1# $OpenBSD: sshcfgparse.sh,v 1.9 2021/06/08 07:05:27 dtucker Exp $ 2# Placed in the Public Domain. 3 4tid="ssh config parse" 5 6dsa=0 7for t in $SSH_KEYTYPES; do 8 case "$t" in 9 ssh-dss) dsa=1 ;; 10 esac 11done 12 13expect_result_present() { 14 _str="$1" ; shift 15 for _expect in "$@" ; do 16 echo "$f" | tr ',' '\n' | grep "^$_expect\$" >/dev/null 17 if test $? -ne 0 ; then 18 fail "missing expected \"$_expect\" from \"$_str\"" 19 fi 20 done 21} 22expect_result_absent() { 23 _str="$1" ; shift 24 for _expect in "$@" ; do 25 echo "$f" | tr ',' '\n' | grep "^$_expect\$" >/dev/null 26 if test $? -eq 0 ; then 27 fail "unexpected \"$_expect\" present in \"$_str\"" 28 fi 29 done 30} 31 32verbose "reparse minimal config" 33(${SSH} -G -F $OBJ/ssh_config somehost >$OBJ/ssh_config.1 && 34 ${SSH} -G -F $OBJ/ssh_config.1 somehost >$OBJ/ssh_config.2 && 35 diff $OBJ/ssh_config.1 $OBJ/ssh_config.2) || fail "failed to reparse minimal" 36 37verbose "ssh -W opts" 38f=`${SSH} -GF $OBJ/ssh_config host | awk '/exitonforwardfailure/{print $2}'` 39test "$f" = "no" || fail "exitonforwardfailure default" 40f=`${SSH} -GF $OBJ/ssh_config -W a:1 h | awk '/exitonforwardfailure/{print $2}'` 41test "$f" = "yes" || fail "exitonforwardfailure enable" 42f=`${SSH} -GF $OBJ/ssh_config -W a:1 -o exitonforwardfailure=no h | \ 43 awk '/exitonforwardfailure/{print $2}'` 44test "$f" = "no" || fail "exitonforwardfailure override" 45 46f=`${SSH} -GF $OBJ/ssh_config host | awk '/clearallforwardings/{print $2}'` 47test "$f" = "no" || fail "clearallforwardings default" 48f=`${SSH} -GF $OBJ/ssh_config -W a:1 h | awk '/clearallforwardings/{print $2}'` 49test "$f" = "yes" || fail "clearallforwardings enable" 50f=`${SSH} -GF $OBJ/ssh_config -W a:1 -o clearallforwardings=no h | \ 51 awk '/clearallforwardings/{print $2}'` 52test "$f" = "no" || fail "clearallforwardings override" 53 54verbose "user first match" 55user=`awk '$1=="User" {print $2}' $OBJ/ssh_config` 56f=`${SSH} -GF $OBJ/ssh_config host | awk '/^user /{print $2}'` 57test "$f" = "$user" || fail "user from config, expected '$user' got '$f'" 58f=`${SSH} -GF $OBJ/ssh_config -o user=foo -l bar baz@host | awk '/^user /{print $2}'` 59test "$f" = "foo" || fail "user first match -oUser, expected 'foo' got '$f' " 60f=`${SSH} -GF $OBJ/ssh_config -lbar baz@host user=foo baz@host | awk '/^user /{print $2}'` 61test "$f" = "bar" || fail "user first match -l, expected 'bar' got '$f'" 62f=`${SSH} -GF $OBJ/ssh_config baz@host -o user=foo -l bar baz@host | awk '/^user /{print $2}'` 63test "$f" = "baz" || fail "user first match user@host, expected 'baz' got '$f'" 64 65verbose "pubkeyacceptedalgorithms" 66# Default set 67f=`${SSH} -GF none host | awk '/^pubkeyacceptedalgorithms /{print $2}'` 68expect_result_present "$f" "ssh-ed25519" "ssh-ed25519-cert-v01.*" 69expect_result_absent "$f" "ssh-dss" 70# Explicit override 71f=`${SSH} -GF none -opubkeyacceptedalgorithms=ssh-ed25519 host | \ 72 awk '/^pubkeyacceptedalgorithms /{print $2}'` 73expect_result_present "$f" "ssh-ed25519" 74expect_result_absent "$f" "ssh-ed25519-cert-v01.*" "ssh-dss" 75# Removal from default set 76f=`${SSH} -GF none -opubkeyacceptedalgorithms=-ssh-ed25519-cert* host | \ 77 awk '/^pubkeyacceptedalgorithms /{print $2}'` 78expect_result_present "$f" "ssh-ed25519" 79expect_result_absent "$f" "ssh-ed25519-cert-v01.*" "ssh-dss" 80f=`${SSH} -GF none -opubkeyacceptedalgorithms=-ssh-ed25519 host | \ 81 awk '/^pubkeyacceptedalgorithms /{print $2}'` 82expect_result_present "$f" "ssh-ed25519-cert-v01.*" 83expect_result_absent "$f" "ssh-ed25519" "ssh-dss" 84# Append to default set. 85# This is not tested when built !WITH_OPENSSL 86if [ "$dsa" = "1" ]; then 87 f=`${SSH} -GF none -opubkeyacceptedalgorithms=+ssh-dss-cert* host | \ 88 awk '/^pubkeyacceptedalgorithms /{print $2}'` 89 expect_result_present "$f" "ssh-ed25519" "ssh-dss-cert-v01.*" 90 expect_result_absent "$f" "ssh-dss" 91 f=`${SSH} -GF none -opubkeyacceptedalgorithms=+ssh-dss host | \ 92 awk '/^pubkeyacceptedalgorithms /{print $2}'` 93 expect_result_present "$f" "ssh-ed25519" "ssh-ed25519-cert-v01.*" "ssh-dss" 94 expect_result_absent "$f" "ssh-dss-cert-v01.*" 95fi 96 97verbose "agentforwarding" 98f=`${SSH} -GF none host | awk '/^forwardagent /{print$2}'` 99expect_result_present "$f" "no" 100f=`${SSH} -GF none -oforwardagent=no host | awk '/^forwardagent /{print$2}'` 101expect_result_present "$f" "no" 102f=`${SSH} -GF none -oforwardagent=yes host | awk '/^forwardagent /{print$2}'` 103expect_result_present "$f" "yes" 104f=`${SSH} -GF none '-oforwardagent=SSH_AUTH_SOCK.forward' host | awk '/^forwardagent /{print$2}'` 105expect_result_present "$f" "SSH_AUTH_SOCK.forward" 106 107verbose "command line override" 108cat >$OBJ/ssh_config.0 <<EOD 109Host * 110 IPQoS af21 cs1 111 TunnelDevice 1:2 112EOD 113f=`${SSH} -GF $OBJ/ssh_config.0 -oipqos=cs1 host | awk '/^ipqos /{print$2}'` 114expect_result_present "$f" "cs1" 115f=`${SSH} -GF $OBJ/ssh_config.0 -otunneldevice=3:4 host | awk '/^tunneldevice /{print$2}'` 116expect_result_present "$f" "3:4" 117 118# cleanup 119rm -f $OBJ/ssh_config.[012] 120