From ea3464532eeae75440658656def0cfed7cb9e668 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Fri, 16 Jan 2026 16:36:42 +0100 Subject: [PATCH] test: Tighten testing to make sure right user and key is used with proxyjumps Signed-off-by: Jakub Jelen Reviewed-by: Andreas Schneider --- tests/CMakeLists.txt | 1 + tests/client/torture_proxyjump.c | 66 +++++++++++++++++++++++++++----- tests/etc/passwd.in | 1 + 3 files changed, 59 insertions(+), 9 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 981733ba..cf1adf56 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -394,6 +394,7 @@ if (CLIENT_TESTING OR SERVER_TESTING) # Allow to auth with bob's public keys on alice and doe account configure_file(keys/id_rsa.pub ${CMAKE_CURRENT_BINARY_DIR}/home/alice/.ssh/authorized_keys @ONLY) configure_file(keys/id_rsa.pub ${CMAKE_CURRENT_BINARY_DIR}/home/doe/.ssh/authorized_keys @ONLY) + configure_file(keys/id_ecdsa.pub ${CMAKE_CURRENT_BINARY_DIR}/home/frank/.ssh/authorized_keys @ONLY) # append ECDSA public key file(READ keys/id_ecdsa.pub CONTENTS) diff --git a/tests/client/torture_proxyjump.c b/tests/client/torture_proxyjump.c index 0d857063..cc2d8d64 100644 --- a/tests/client/torture_proxyjump.c +++ b/tests/client/torture_proxyjump.c @@ -121,6 +121,50 @@ static int authenticate(ssh_session jump_session, void *user) return ssh_userauth_publickey_auto(jump_session, NULL, NULL); } +static int authenticate_doe(ssh_session jump_session, void *user) +{ + ssh_key pkey = NULL; + char bob_ssh_key[1024]; + struct passwd *pwd = NULL; + int rc; + + (void)user; + + pwd = getpwnam("bob"); + assert_non_null(pwd); + + snprintf(bob_ssh_key, sizeof(bob_ssh_key), "%s/.ssh/id_rsa", pwd->pw_dir); + + rc = ssh_pki_import_privkey_file(bob_ssh_key, NULL, NULL, NULL, &pkey); + assert_int_equal(rc, SSH_OK); + + rc = ssh_userauth_publickey(jump_session, NULL, pkey); + ssh_key_free(pkey); + return rc; +} + +static int authenticate_frank(ssh_session jump_session, void *user) +{ + ssh_key pkey = NULL; + char bob_ssh_key[1024]; + struct passwd *pwd = NULL; + int rc; + + (void)user; + + pwd = getpwnam("bob"); + assert_non_null(pwd); + + snprintf(bob_ssh_key, sizeof(bob_ssh_key), "%s/.ssh/id_ecdsa", pwd->pw_dir); + + rc = ssh_pki_import_privkey_file(bob_ssh_key, NULL, NULL, NULL, &pkey); + assert_int_equal(rc, SSH_OK); + + rc = ssh_userauth_publickey(jump_session, NULL, pkey); + ssh_key_free(pkey); + return rc; +} + static void torture_proxyjump_multiple_jump(void **state) { struct torture_state *s = *state; @@ -129,11 +173,10 @@ static void torture_proxyjump_multiple_jump(void **state) const char *address = torture_server_address(AF_INET); int rc; socket_t fd; - struct ssh_jump_callbacks_struct c = { .before_connection = before_connection, .verify_knownhost = verify_knownhost, - .authenticate = authenticate + .authenticate = authenticate, }; rc = snprintf(proxyjump_buf, @@ -177,14 +220,14 @@ static void torture_proxyjump_multiple_sshd_jump(void **state) struct ssh_jump_callbacks_struct c = { .before_connection = before_connection, .verify_knownhost = verify_knownhost, - .authenticate = authenticate, + .authenticate = authenticate_doe, }; torture_setup_sshd_servers(state, false); rc = snprintf(proxyjump_buf, sizeof(proxyjump_buf), - "alice@%s:22,alice@%s:22", + "doe@%s:22,doe@%s:22", address, address1); if (rc < 0 || rc >= (int)sizeof(proxyjump_buf)) { @@ -222,17 +265,22 @@ static void torture_proxyjump_multiple_sshd_users_jump(void **state) int rc; socket_t fd; - struct ssh_jump_callbacks_struct c = { + struct ssh_jump_callbacks_struct c1 = { .before_connection = before_connection, .verify_knownhost = verify_knownhost, - .authenticate = authenticate, + .authenticate = authenticate_doe, + }; + struct ssh_jump_callbacks_struct c2 = { + .before_connection = before_connection, + .verify_knownhost = verify_knownhost, + .authenticate = authenticate_frank, }; torture_setup_sshd_servers(state, false); rc = snprintf(proxyjump_buf, sizeof(proxyjump_buf), - "doe@%s:22,alice@%s:22", + "doe@%s:22,frank@%s:22", address, address1); if (rc < 0 || rc >= (int)sizeof(proxyjump_buf)) { @@ -240,9 +288,9 @@ static void torture_proxyjump_multiple_sshd_users_jump(void **state) } rc = ssh_options_set(session, SSH_OPTIONS_PROXYJUMP, proxyjump_buf); assert_ssh_return_code(session, rc); - rc = ssh_options_set(session, SSH_OPTIONS_PROXYJUMP_CB_LIST_APPEND, &c); + rc = ssh_options_set(session, SSH_OPTIONS_PROXYJUMP_CB_LIST_APPEND, &c1); assert_ssh_return_code(session, rc); - rc = ssh_options_set(session, SSH_OPTIONS_PROXYJUMP_CB_LIST_APPEND, &c); + rc = ssh_options_set(session, SSH_OPTIONS_PROXYJUMP_CB_LIST_APPEND, &c2); assert_ssh_return_code(session, rc); rc = ssh_connect(session); diff --git a/tests/etc/passwd.in b/tests/etc/passwd.in index cae364b7..87dcb985 100644 --- a/tests/etc/passwd.in +++ b/tests/etc/passwd.in @@ -2,6 +2,7 @@ bob:x:5000:9000:bob gecos:@HOMEDIR@/bob:/bin/sh alice:x:5001:9000:alice gecos:@HOMEDIR@/alice:/bin/sh charlie:x:5002:9000:charlie gecos:@HOMEDIR@/charlie:/bin/sh doe:x:5003:9000:doe gecos:@HOMEDIR@/doe:/bin/sh +frank:x:5003:9000:doe gecos:@HOMEDIR@/frank:/bin/sh sshd:x:65530:65531:sshd:@HOMEDIR@:/sbin/nologin nobody:x:65533:65534:nobody gecos:@HOMEDIR@:/bin/false root:x:65534:65532:root gecos:@HOMEDIR@:/bin/false