Files: ae008179f033c8409c69b13787a539351bace626 / t
10182 bytesRaw
| 1 | #! /usr/bin/perl -w |
| 2 | |
| 3 | # Test script for sslh |
| 4 | |
| 5 | use strict; |
| 6 | use IO::Socket::INET6; |
| 7 | use Test::More qw/no_plan/; |
| 8 | |
| 9 | # We use ports 9000, 9001 and 9002 -- hope that won't clash |
| 10 | # with anything... |
| 11 | my $ssh_address = "ip6-localhost:9000"; |
| 12 | my $ssl_address = "ip6-localhost:9001"; |
| 13 | my $sslh_port = 9002; |
| 14 | my $no_listen = 9003; # Port on which no-one listens |
| 15 | my $pidfile = "/tmp/sslh_test.pid"; |
| 16 | |
| 17 | # Which tests do we run |
| 18 | my $SSL_CNX = 1; |
| 19 | my $SSH_SHY_CNX = 1; |
| 20 | my $SSH_BOLD_CNX = 1; |
| 21 | my $SSL_MIX_SSH = 1; |
| 22 | my $SSH_MIX_SSL = 1; |
| 23 | my $BIG_MSG = 1; |
| 24 | my $STALL_CNX = 1; |
| 25 | |
| 26 | # Robustness tests. These are mostly to achieve full test |
| 27 | # coverage, but do not necessarily result in an actual test |
| 28 | # (e.g. some tests need to be run with valgrind to check all |
| 29 | # memory management code). |
| 30 | my $RB_CNX_NOSERVER = 1; |
| 31 | my $RB_PARAM_NOHOST = 1; |
| 32 | my $RB_WRONG_USERNAME = 1; |
| 33 | my $RB_OPEN_PID_FILE = 1; |
| 34 | my $RB_BIND_ADDRESS = 1; |
| 35 | my $RB_RESOLVE_ADDRESS = 1; |
| 36 | |
| 37 | `lcov --directory . --zerocounters`; |
| 38 | |
| 39 | |
| 40 | my ($ssh_pid, $ssl_pid); |
| 41 | |
| 42 | if (!($ssh_pid = fork)) { |
| 43 | exec "./echosrv --listen $ssh_address --prefix 'ssh: '"; |
| 44 | } |
| 45 | |
| 46 | if (!($ssl_pid = fork)) { |
| 47 | exec "./echosrv --listen $ssl_address --prefix 'ssl: '"; |
| 48 | } |
| 49 | |
| 50 | my @binaries = ('sslh-select', 'sslh-fork'); |
| 51 | for my $binary (@binaries) { |
| 52 | warn "Testing $binary\n"; |
| 53 | |
| 54 | # Start sslh with the right plumbing |
| 55 | my $sslh_pid; |
| 56 | if (!($sslh_pid = fork)) { |
| 57 | my $user = (getpwuid $<)[0]; # Run under current username |
| 58 | exec "./$binary -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile"; |
| 59 | #exec "valgrind --leak-check=full ./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address -ssl $ssl_address -P $pidfile"; |
| 60 | exit 0; |
| 61 | } |
| 62 | warn "spawned $sslh_pid\n"; |
| 63 | sleep 1; # valgrind can be heavy -- wait 5 seconds |
| 64 | |
| 65 | |
| 66 | my $test_data = "hello world\n"; |
| 67 | |
| 68 | # Test: SSL connection |
| 69 | if ($SSL_CNX) { |
| 70 | print "***Test: SSL connection\n"; |
| 71 | my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 72 | warn "$!\n" unless $cnx_l; |
| 73 | if (defined $cnx_l) { |
| 74 | print $cnx_l $test_data; |
| 75 | my $data = <$cnx_l>; |
| 76 | is($data, "ssl: $test_data", "SSL connection"); |
| 77 | } |
| 78 | } |
| 79 | |
| 80 | # Test: Shy SSH connection |
| 81 | if ($SSH_SHY_CNX) { |
| 82 | print "***Test: Shy SSH connection\n"; |
| 83 | my $cnx_h = new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 84 | warn "$!\n" unless $cnx_h; |
| 85 | if (defined $cnx_h) { |
| 86 | sleep 3; |
| 87 | print $cnx_h $test_data; |
| 88 | my $data = <$cnx_h>; |
| 89 | is($data, "ssh: $test_data", "Shy SSH connection"); |
| 90 | } |
| 91 | } |
| 92 | |
| 93 | # Test: Bold SSH connection |
| 94 | if ($SSH_BOLD_CNX) { |
| 95 | print "***Test: Bold SSH connection\n"; |
| 96 | my $cnx_h = new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 97 | warn "$!\n" unless $cnx_h; |
| 98 | if (defined $cnx_h) { |
| 99 | my $td = "SSH-2.0 testsuite\t$test_data"; |
| 100 | print $cnx_h $td; |
| 101 | my $data = <$cnx_h>; |
| 102 | is($data, "ssh: $td", "Bold SSH connection"); |
| 103 | } |
| 104 | } |
| 105 | |
| 106 | # Test: One SSL half-started then one SSH |
| 107 | if ($SSL_MIX_SSH) { |
| 108 | print "***Test: One SSL half-started then one SSH\n"; |
| 109 | my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 110 | warn "$!\n" unless $cnx_l; |
| 111 | if (defined $cnx_l) { |
| 112 | print $cnx_l $test_data; |
| 113 | my $cnx_h= new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 114 | warn "$!\n" unless $cnx_h; |
| 115 | if (defined $cnx_h) { |
| 116 | sleep 3; |
| 117 | print $cnx_h $test_data; |
| 118 | my $data_h = <$cnx_h>; |
| 119 | is($data_h, "ssh: $test_data", "SSH during SSL being established"); |
| 120 | } |
| 121 | my $data = <$cnx_l>; |
| 122 | is($data, "ssl: $test_data", "SSL connection interrupted by SSH"); |
| 123 | } |
| 124 | } |
| 125 | |
| 126 | # Test: One SSH half-started then one SSL |
| 127 | if ($SSH_MIX_SSL) { |
| 128 | print "***Test: One SSH half-started then one SSL\n"; |
| 129 | my $cnx_h = new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 130 | warn "$!\n" unless $cnx_h; |
| 131 | if (defined $cnx_h) { |
| 132 | sleep 3; |
| 133 | my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 134 | warn "$!\n" unless $cnx_l; |
| 135 | if (defined $cnx_l) { |
| 136 | print $cnx_l $test_data; |
| 137 | my $data = <$cnx_l>; |
| 138 | is($data, "ssl: $test_data", "SSL during SSH being established"); |
| 139 | } |
| 140 | print $cnx_h $test_data; |
| 141 | my $data = <$cnx_h>; |
| 142 | is($data, "ssh: $test_data", "SSH connection interrupted by SSL"); |
| 143 | } |
| 144 | } |
| 145 | |
| 146 | |
| 147 | # Test: Big messages (careful: don't go over echosrv's buffer limit (1M)) |
| 148 | if ($BIG_MSG) { |
| 149 | print "***Test: big message\n"; |
| 150 | my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 151 | warn "$!\n" unless $cnx_l; |
| 152 | my $test_data2 = "helloworld"; |
| 153 | my $rept = 10000; |
| 154 | if (defined $cnx_l) { |
| 155 | print $cnx_l ($test_data2 x $rept); |
| 156 | print $cnx_l "\n"; |
| 157 | my $data = <$cnx_l>; |
| 158 | is($data, "ssl: ". ($test_data2 x $rept) . "\n", "Big message"); |
| 159 | } |
| 160 | } |
| 161 | |
| 162 | # Test: Stalled connection |
| 163 | # Create two connections, stall one, check the other one |
| 164 | # works, unstall first and check it works fine |
| 165 | if ($STALL_CNX) { |
| 166 | print "***Test: Stalled connection\n"; |
| 167 | my $cnx_1 = new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 168 | warn "$!\n" unless defined $cnx_1; |
| 169 | my $cnx_2 = new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 170 | warn "$!\n" unless defined $cnx_2; |
| 171 | my $test_data2 = "helloworld"; |
| 172 | my $rept = 10000; |
| 173 | if (defined $cnx_1 and defined $cnx_2) { |
| 174 | print $cnx_1 ($test_data2 x $rept); |
| 175 | print $cnx_1 "\n"; |
| 176 | print $cnx_2 ($test_data2 x $rept); |
| 177 | print $cnx_2 "\n"; |
| 178 | my $data = <$cnx_2>; |
| 179 | is($data, "ssl: " . ($test_data2 x $rept) . "\n", "Stalled connection (1)"); |
| 180 | print $cnx_2 ($test_data2 x $rept); |
| 181 | print $cnx_2 "\n"; |
| 182 | $data = <$cnx_2>; |
| 183 | is($data, "ssl: " . ($test_data2 x $rept) . "\n", "Stalled connection (2)"); |
| 184 | $data = <$cnx_1>; |
| 185 | is($data, "ssl: " . ($test_data2 x $rept) . "\n", "Stalled connection (3)"); |
| 186 | |
| 187 | } |
| 188 | } |
| 189 | |
| 190 | my $pid = `cat $pidfile`; |
| 191 | warn "killing $pid\n"; |
| 192 | kill TERM => $pid or warn "kill process: $!\n"; |
| 193 | sleep 1; |
| 194 | } |
| 195 | |
| 196 | # Robustness: Connecting to non-existant server |
| 197 | if ($RB_CNX_NOSERVER) { |
| 198 | print "***Test: Connecting to non-existant server\n"; |
| 199 | my $sslh_pid; |
| 200 | if (!($sslh_pid = fork)) { |
| 201 | my $user = (getpwuid $<)[0]; # Run under current username |
| 202 | exec "./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh localhost:$no_listen --ssl localhost:$no_listen -P $pidfile"; |
| 203 | } |
| 204 | warn "spawned $sslh_pid\n"; |
| 205 | |
| 206 | sleep 1; |
| 207 | |
| 208 | my $cnx_h = new IO::Socket::INET(PeerHost => "localhost:$sslh_port"); |
| 209 | warn "$!\n" unless $cnx_h; |
| 210 | if (defined $cnx_h) { |
| 211 | sleep 1; |
| 212 | my $test_data = "hello"; |
| 213 | print $cnx_h $test_data; |
| 214 | } |
| 215 | # Ideally we should check a log is emitted. |
| 216 | |
| 217 | kill TERM => `cat $pidfile` or warn "kill: $!\n"; |
| 218 | sleep 1; |
| 219 | } |
| 220 | |
| 221 | |
| 222 | # Robustness: No hostname in address |
| 223 | if ($RB_PARAM_NOHOST) { |
| 224 | print "***Test: No hostname in address\n"; |
| 225 | my $sslh_pid; |
| 226 | if (!($sslh_pid = fork)) { |
| 227 | my $user = (getpwuid $<)[0]; # Run under current username |
| 228 | exec "./sslh-select -v -f -u $user --listen $sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile"; |
| 229 | } |
| 230 | warn "spawned $sslh_pid\n"; |
| 231 | waitpid $sslh_pid, 0; |
| 232 | my $code = $? >> 8; |
| 233 | warn "exited with $code\n"; |
| 234 | is($code, 1, "Exit status on illegal option"); |
| 235 | } |
| 236 | |
| 237 | # Robustness: User does not exist |
| 238 | if ($RB_WRONG_USERNAME) { |
| 239 | print "***Test: Changing to non-existant username\n"; |
| 240 | my $sslh_pid; |
| 241 | if (!($sslh_pid = fork)) { |
| 242 | my $user = (getpwuid $<)[0]; # Run under current username |
| 243 | exec "./sslh-select -v -f -u ${user}_doesnt_exist --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile"; |
| 244 | } |
| 245 | warn "spawned $sslh_pid\n"; |
| 246 | waitpid $sslh_pid, 0; |
| 247 | my $code = $? >> 8; |
| 248 | warn "exited with $code\n"; |
| 249 | is($code, 2, "Exit status on non-existant username"); |
| 250 | } |
| 251 | |
| 252 | # Robustness: Can't open PID file |
| 253 | if ($RB_OPEN_PID_FILE) { |
| 254 | print "***Test: Can't open PID file\n"; |
| 255 | my $sslh_pid; |
| 256 | if (!($sslh_pid = fork)) { |
| 257 | my $user = (getpwuid $<)[0]; # Run under current username |
| 258 | exec "./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P /dont_exist/$pidfile"; |
| 259 | # You don't have a /dont_exist/ directory, do you?! |
| 260 | } |
| 261 | warn "spawned $sslh_pid\n"; |
| 262 | waitpid $sslh_pid, 0; |
| 263 | my $code = $? >> 8; |
| 264 | warn "exited with $code\n"; |
| 265 | is($code, 3, "Exit status if can't open PID file"); |
| 266 | } |
| 267 | |
| 268 | # Robustness: Can't bind address |
| 269 | if ($RB_BIND_ADDRESS) { |
| 270 | print "***Test: Can't bind address\n"; |
| 271 | my $sslh_pid; |
| 272 | if (!($sslh_pid = fork)) { |
| 273 | my $user = (getpwuid $<)[0]; # Run under current username |
| 274 | exec "./sslh-select -v -f -u $user --listen 74.125.39.106:9000 --ssh $ssh_address --ssl $ssl_address -P $pidfile"; |
| 275 | } |
| 276 | warn "spawned $sslh_pid\n"; |
| 277 | waitpid $sslh_pid, 0; |
| 278 | my $code = $? >> 8; |
| 279 | warn "exited with $code\n"; |
| 280 | is($code, 1, "Exit status if can't bind address"); |
| 281 | } |
| 282 | |
| 283 | # Robustness: Can't resolve address |
| 284 | if ($RB_RESOLVE_ADDRESS) { |
| 285 | print "***Test: Can't resolve address\n"; |
| 286 | my $sslh_pid; |
| 287 | if (!($sslh_pid = fork)) { |
| 288 | my $user = (getpwuid $<)[0]; # Run under current username |
| 289 | exec "./sslh-select -v -f -u $user --listen blahblah.dontexist:9000 --ssh $ssh_address --ssl $ssl_address -P $pidfile"; |
| 290 | } |
| 291 | warn "spawned $sslh_pid\n"; |
| 292 | waitpid $sslh_pid, 0; |
| 293 | my $code = $? >> 8; |
| 294 | warn "exited with $code\n"; |
| 295 | is($code, 4, "Exit status if can't resolve address"); |
| 296 | } |
| 297 | |
| 298 | `lcov --directory . --capture --output-file sslh_cov.info`; |
| 299 | `genhtml sslh_cov.info`; |
| 300 | |
| 301 | `killall echosrv`; |
| 302 | |
| 303 |
Built with git-ssb-web