1# $OpenBSD: addrmatch.sh,v 1.6 2020/08/28 03:17:13 dtucker Exp $ 2# Placed in the Public Domain. 3 4tid="address match" 5 6mv $OBJ/sshd_proxy $OBJ/sshd_proxy_bak 7 8run_trial() 9{ 10 user="$1"; addr="$2"; host="$3"; laddr="$4"; lport="$5" 11 expected="$6"; descr="$7" 12 13 verbose "test $descr for $user $addr $host" 14 result=`${SSHD} -f $OBJ/sshd_proxy -T \ 15 -C user=${user},addr=${addr},host=${host},laddr=${laddr},lport=${lport} | \ 16 awk '/^forcecommand/ {print $2}'` 17 if [ "$result" != "$expected" ]; then 18 fail "failed '$descr' expected $expected got $result" 19 fi 20} 21 22cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 23cat >>$OBJ/sshd_proxy <<EOD 24ForceCommand nomatch 25Match Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com 26 ForceCommand match1 27Match Address 1.1.1.1,::1,!::3,2000::/16 28 ForceCommand match2 29Match LocalAddress 127.0.0.1,::1 30 ForceCommand match3 31Match LocalPort 5678 32 ForceCommand match4 33EOD 34 35run_trial user 192.168.0.1 somehost 1.2.3.4 1234 match1 "first entry" 36run_trial user 192.168.30.1 somehost 1.2.3.4 1234 nomatch "negative match" 37run_trial user 19.0.0.1 somehost 1.2.3.4 1234 nomatch "no match" 38run_trial user 10.255.255.254 somehost 1.2.3.4 1234 match1 "list middle" 39run_trial user 192.168.30.1 192.168.0.1 1.2.3.4 1234 nomatch "faked IP in hostname" 40run_trial user 1.1.1.1 somehost.example.com 1.2.3.4 1234 match2 "bare IP4 address" 41run_trial user 19.0.0.1 somehost 127.0.0.1 1234 match3 "localaddress" 42run_trial user 19.0.0.1 somehost 1.2.3.4 5678 match4 "localport" 43 44if test "$TEST_SSH_IPV6" != "no"; then 45run_trial user ::1 somehost.example.com ::2 1234 match2 "bare IP6 address" 46run_trial user ::2 somehost.example.com ::2 1234 nomatch "deny IPv6" 47run_trial user ::3 somehost ::2 1234 nomatch "IP6 negated" 48run_trial user ::4 somehost ::2 1234 nomatch "IP6 no match" 49run_trial user 2000::1 somehost ::2 1234 match2 "IP6 network" 50run_trial user 2001::1 somehost ::2 1234 nomatch "IP6 network" 51run_trial user ::5 somehost ::1 1234 match3 "IP6 localaddress" 52run_trial user ::5 somehost ::2 5678 match4 "IP6 localport" 53fi 54 55# 56# Check that we catch invalid address/mask in Match Address/Localaddress 57# 58for i in 10.0.1.0/8 10.0.0.1/24 2000:aa:bb:01::/56; do 59 for a in address localaddress; do 60 verbose "test invalid Match $a $i" 61 echo "Match $a $i" > $OBJ/sshd_proxy 62 ${SUDO} ${SSHD} -f $OBJ/sshd_proxy -t >/dev/null 2>&1 && \ 63 fail "accepted invalid match $a $i" 64 done 65done 66 67cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 68rm $OBJ/sshd_proxy_bak 69