#!/usr/bin/env bash
# Tests to ensure that the monkeysphere is working
+#
+# unset MONKEYSPHERE_TEST_NO_EXAMINE to examine
# Authors:
# Daniel Kahn Gillmor <dkg@fifthhorseman.net>
## make sure that the right tools are installed to run the test. the
## test has *more* requirements than plain ol' monkeysphere:
+[ -f /usr/sbin/sshd ] || { echo "You must have sshd installed to run this test." ; exit 1; }
which socat >/dev/null || { echo "You must have socat installed to run this test." ; exit 1; }
perl -MCrypt::OpenSSL::RSA -e 1 2>/dev/null || { echo "You must have the perl module Crypt::OpenSSL::RSA installed to run this test.
On debian-derived systems, you can set this up with:
apt-get install libcrypt-openssl-rsa-perl" ; exit 1; }
-
-perl -MDigest::SHA1 -e 1 2>/dev/null || { echo "You must have the perl module Digest::SHA1 installed to run this test.
+perl -MDigest::SHA -e 1 2>/dev/null || { echo "You must have the perl module Digest::SHA installed to run this test.
On debian-derived systems, you can set this up with:
- apt-get install libdigest-sha1-perl" ; exit 1; }
+ apt-get install libdigest-sha-perl" ; exit 1; }
## FIXME: other checks?
# test ssh connection
# first argument is expected return code from ssh connection
ssh_test() {
+ local RETURN=0
+
umask 0077
CODE=${1:-0}
# wait until the socket is created before continuing
while [ ! -S "$SOCKET" ] ; do
- sleep 1
+ sleep 2
done
# make a client connection to the socket
echo "##### starting ssh client..."
ssh-agent bash -c \
- "monkeysphere subkey-to-ssh-agent && ssh -F $TEMPDIR/testuser/.ssh/config testhost true" \
+ "monkeysphere subkey-to-ssh-agent && ssh -F $TEMPDIR/testuser/.ssh/config ${target_hostname:-testhost} true" \
|| RETURN="$?"
# kill the sshd process if it's still running
- kill "$SSHD_PID"
+ kill "$SSHD_PID" || true
SSHD_PID=
- echo "##### return $RETURN"
if [ "$RETURN" = "$CODE" ] ; then
- echo "##### ssh connection test returned as desired"
+ echo "##### ssh connection test PASSED. returned: $RETURN"
return 0
else
- echo "##### ssh connection test failed. expected return code $CODE"
+ echo "##### ssh connection test FAILED. returned: $RETURN, expected: $CODE"
return 1
fi
}
# Use the local copy of executables first, instead of system ones.
# This should help us test without installing.
-export PATH="$TESTDIR"/../src:"$TESTDIR"/../src/keytrans:"$PATH"
+export PATH="$TESTDIR"/../src:"$PATH"
export MONKEYSPHERE_SYSDATADIR="$TEMPDIR"
export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR"
export MONKEYSPHERE_CORE_KEYLENGTH=1024
export MONKEYSPHERE_PROMPT=false
+# unset SUBKEYS_FOR_AGENT variable which, if set, would confuse the
+# into trying to use the user's key, instead of the testuser's key
+unset MONKEYSPHERE_SUBKEYS_FOR_AGENT
+
export SSHD_CONFIG="$TEMPDIR"/sshd_config
export SOCKET="$TEMPDIR"/ssh-socket
# *anything* with any running X11 session.
export DISPLAY=monkeys
-## make sure that the version number matches the debian changelog
-## (don't bother if this is being run from the tests).
-
-if [ -f "$TESTDIR"/../packaging/debian/changelog ]; then
- echo
- echo "##################################################"
- echo "### checking version string match..."
- repver=$(monkeysphere version)
- debver=$(head -n1 "$TESTDIR"/../packaging/debian/changelog | sed 's/.*(\([^-]*\)-.*/\1/')
- if [ "$repver" = "$debver" ] ; then
- echo "Versions match!"
- else
- printf "reported version string (%s) does not match debian changelog (%s)\n" "$repver" "$debver"
- exit 1
- fi
-fi
######################################################################
### CONFIGURE ENVIRONMENTS
echo
echo "##################################################"
echo "### configuring testuser home..."
-cp -a "$TESTDIR"/home/testuser "$TEMPDIR"/
+(cd "$TESTDIR"/home && find testuser | cpio -pdu "$TEMPDIR")
+
# set up environment for testuser
export TESTHOME="$TEMPDIR"/testuser
export GNUPGHOME="$TESTHOME"/.gnupg
echo
echo "##################################################"
echo "### configuring admin home..."
-cp -a "$TESTDIR"/home/admin "$TEMPDIR"/
+(cd "$TESTDIR"/home && find admin | cpio -pdu "$TEMPDIR")
# set up sshd
echo
# FIXME: this is maybe not failing properly for:
# ms: improper group or other writability on path '/tmp'.
-
######################################################################
### TESTS
monkeysphere-authentication update-users $(whoami)
echo
echo "##################################################"
-echo "### ssh connection test for server authentication denial..."
+echo "### ssh connection test for failure..."
ssh_test 255
mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
monkeysphere-authentication update-users $(whoami)
echo
echo "##################################################"
-echo "### ssh connection test for server authentication denial..."
+echo "### ssh connection test for failure..."
ssh_test 255
chmod g-w "$TESTHOME"/.monkeysphere/authorized_user_ids
echo
monkeysphere-authentication update-users $(whoami)
echo
echo "##################################################"
-echo "### ssh connection test for server authentication denial..."
+echo "### ssh connection test for failure..."
ssh_test 255
chmod o-w "$TESTHOME"/.monkeysphere/authorized_user_ids
monkeysphere-authentication update-users $(whoami)
+# test symlinks
+echo
+echo "##################################################"
+echo "### setup for symlink tests..."
+cp -a "$TESTHOME"/.monkeysphere{,.linktest}
+
+echo
+echo "##################################################"
+echo "### make authorized_user_ids an absolute symlink and updating..."
+mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak}
+ln -s "$TESTHOME"/.monkeysphere{.linktest,}/authorized_user_ids
+monkeysphere-authentication update-users $(whoami)
+echo
+echo "##################################################"
+echo "### ssh connection test for success..."
+ssh_test
+echo
+echo "##################################################"
+echo "### create bad permissions on link dir and updating..."
+chmod o+w "$TESTHOME"/.monkeysphere.linktest
+monkeysphere-authentication update-users $(whoami)
+echo
+echo "##################################################"
+echo "### ssh connection test for failure..."
+ssh_test 255
+chmod o-w "$TESTHOME"/.monkeysphere.linktest
+echo
+echo "##################################################"
+echo "### make authorized_user_ids a relative symlink and updating..."
+ln -sf ../.monkeysphere.linktest/authorized_user_ids "$TESTHOME"/.monkeysphere/authorized_user_ids
+monkeysphere-authentication update-users $(whoami)
+echo
+echo "##################################################"
+echo "### ssh connection test for success..."
+ssh_test
+echo
+echo "##################################################"
+echo "### create bad permissions on link dir updating..."
+chmod o+w "$TESTHOME"/.monkeysphere.linktest
+monkeysphere-authentication update-users $(whoami)
+echo
+echo "##################################################"
+echo "### ssh connection test for failure..."
+ssh_test 255
+chmod o-w "$TESTHOME"/.monkeysphere.linktest
+# FIXME: implement check of link path, and uncomment this test
+# echo
+# echo "##################################################"
+# echo "### create bad permissions on link dir and updating..."
+# chmod o+w "$TESTHOME"/.monkeysphere
+# monkeysphere-authentication update-users $(whoami)
+# echo
+# echo "##################################################"
+# echo "### ssh connection test for failure..."
+# ssh_test 255
+# chmod o-w "$TESTHOME"/.monkeysphere
+rm "$TESTHOME"/.monkeysphere/authorized_user_ids
+mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
+
+echo
+echo "##################################################"
+echo "### make .monkeysphere directory an absolute symlink and updating..."
+mv "$TESTHOME"/.monkeysphere{,.bak}
+ln -s "$TESTHOME"/.monkeysphere{.linktest,}
+monkeysphere-authentication update-users $(whoami)
+echo
+echo "##################################################"
+echo "### ssh connection test for success..."
+ssh_test
+echo
+echo "##################################################"
+echo "### create bad permissions on link dir and updating..."
+chmod o+w "$TESTHOME"/.monkeysphere.linktest
+monkeysphere-authentication update-users $(whoami)
+echo
+echo "##################################################"
+echo "### ssh connection test for failure..."
+ssh_test 255
+chmod o-w "$TESTHOME"/.monkeysphere.linktest
+echo
+echo "##################################################"
+echo "### make .monkeysphere directory a relative symlink and updating..."
+ln -sfn .monkeysphere{.linktest,}
+monkeysphere-authentication update-users $(whoami)
+echo
+echo "##################################################"
+echo "### ssh connection test for success..."
+ssh_test
+echo
+echo "##################################################"
+echo "### create bad permissions on link dir updating..."
+chmod o+w "$TESTHOME"/.monkeysphere.linktest
+monkeysphere-authentication update-users $(whoami)
+echo
+echo "##################################################"
+echo "### ssh connection test for failure..."
+ssh_test 255
+chmod o-w "$TESTHOME"/.monkeysphere.linktest
+rm "$TESTHOME"/.monkeysphere
+mv "$TESTHOME"/.monkeysphere{.bak,}
+
+# ensure we're back to normal:
+echo
+echo "##################################################"
+echo "### making sure we are back to normal..."
+monkeysphere-authentication update-users $(whoami)
+ssh_test
+
+
+echo
+echo "##################################################"
+echo "### ssh connection test directly to 'testhost2' without new name..."
+target_hostname=testhost2 ssh_test 255
+echo
+echo "##################################################"
+echo "### add hostname, certify by admin, import by user..."
+monkeysphere-host add-hostname testhost2
+< "$MONKEYSPHERE_SYSCONFIGDIR"/ssh_host_rsa_key.pub.gpg gpgadmin --import
+printf "y\ny\n" | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID"
+
+echo
+echo "##################################################"
+echo "### ssh connection test with hostname 'testhost2' added..."
+gpgadmin --export "$HOSTKEYID" | gpg --import
+gpg --check-trustdb
+ssh_test
+
+echo
+echo "##################################################"
+echo "### ssh connection test directly to 'testhost2' ..."
+gpg --import <"$MONKEYSPHERE_SYSCONFIGDIR"/ssh_host_rsa_key.pub.gpg
+gpg --check-trustdb
+target_hostname=testhost2 ssh_test
+
+echo
+echo "##################################################"
+echo "### ssh connection test for failure with 'testhost2' revoked..."
+monkeysphere-host revoke-hostname testhost2
+gpg --import <"$MONKEYSPHERE_SYSCONFIGDIR"/ssh_host_rsa_key.pub.gpg
+gpg --check-trustdb
+target_hostname=testhost2 ssh_test 255
+
# FIXME: addtest: remove admin as id-certifier and check ssh failure
-# FIXME: addtest: add hostname on host key
-# FIXME: addtest: revoke hostname on host key and check ssh failure
+# FIXME: addtest: how do we test that set-expire makes sense after new
+# hostnames have been added?
+
+# FIXME: addtest: revoke the host key and check ssh failure
-# addtest: revoke the host key and check ssh failure
# test to make sure things are OK after the previous tests:
+echo
+echo "##################################################"
+echo "### settings reset, updating..."
+monkeysphere-authentication update-users $(whoami)
+echo
+echo "##################################################"
+echo "### ssh connection test for success..."
ssh_test
+
echo
echo "##################################################"
-echo "### ssh connection test for server with revoked key..."
+echo "### revoking host key..."
# generate the revocation certificate and feed it directly to the test
# user's keyring (we're not publishing to the keyservers)
monkeysphere-host revoke-key | gpg --import
+echo
+echo "##################################################"
+echo "### ssh connection test for failure..."
ssh_test 255