Heschi Kreinick
325b735346
It's failing with a file permissions error: sign_and_send_pubkey: signing using rsa-sha2-512 SHA256:Anr3LjZK8YVpjrxu79myrW9Hrb/wpcMNpVvTq/RcBm8\r\nBad permissions. Try removing permissions for user: UNKNOWN\\\\UNKNOWN (S-1-15-2-2) on file C:/b/s/w/ir/x/t/TestSSHCLIAuth1586735692/001/rsa. For golang/go#64403 Change-Id: Iece8eac4a1ac349f9f7a273ac7389315cb96568e Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-windows-amd64-longtest,x_crypto-go1.21-windows-amd64-longtest,x_crypto-go1.20-windows-amd64-longtest Reviewed-on: https://go-review.googlesource.com/c/crypto/+/545135 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Auto-Submit: Heschi Kreinick <heschi@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
101 lines
2.9 KiB
Go
101 lines
2.9 KiB
Go
// Copyright 2023 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package test
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"runtime"
|
|
"testing"
|
|
|
|
"golang.org/x/crypto/internal/testenv"
|
|
"golang.org/x/crypto/ssh"
|
|
"golang.org/x/crypto/ssh/testdata"
|
|
)
|
|
|
|
func sshClient(t *testing.T) string {
|
|
if testing.Short() {
|
|
t.Skip("Skipping test that executes OpenSSH in -short mode")
|
|
}
|
|
sshCLI := os.Getenv("SSH_CLI_PATH")
|
|
if sshCLI == "" {
|
|
sshCLI = "ssh"
|
|
}
|
|
var err error
|
|
sshCLI, err = exec.LookPath(sshCLI)
|
|
if err != nil {
|
|
t.Skipf("Can't find an ssh(1) client to test against: %v", err)
|
|
}
|
|
return sshCLI
|
|
}
|
|
|
|
func TestSSHCLIAuth(t *testing.T) {
|
|
if runtime.GOOS == "windows" {
|
|
t.Skipf("always fails on Windows, see #64403")
|
|
}
|
|
sshCLI := sshClient(t)
|
|
dir := t.TempDir()
|
|
keyPrivPath := filepath.Join(dir, "rsa")
|
|
|
|
for fn, content := range map[string][]byte{
|
|
keyPrivPath: testdata.PEMBytes["rsa"],
|
|
keyPrivPath + ".pub": ssh.MarshalAuthorizedKey(testPublicKeys["rsa"]),
|
|
filepath.Join(dir, "rsa-cert.pub"): testdata.SSHCertificates["rsa-user-testcertificate"],
|
|
} {
|
|
if err := os.WriteFile(fn, content, 0600); err != nil {
|
|
t.Fatalf("WriteFile(%q): %v", fn, err)
|
|
}
|
|
}
|
|
|
|
certChecker := ssh.CertChecker{
|
|
IsUserAuthority: func(k ssh.PublicKey) bool {
|
|
return bytes.Equal(k.Marshal(), testPublicKeys["ca"].Marshal())
|
|
},
|
|
UserKeyFallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
|
|
if conn.User() == "testpubkey" && bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) {
|
|
return nil, nil
|
|
}
|
|
|
|
return nil, fmt.Errorf("pubkey for %q not acceptable", conn.User())
|
|
},
|
|
}
|
|
|
|
config := &ssh.ServerConfig{
|
|
PublicKeyCallback: certChecker.Authenticate,
|
|
}
|
|
config.AddHostKey(testSigners["rsa"])
|
|
|
|
server, err := newTestServer(config)
|
|
if err != nil {
|
|
t.Fatalf("unable to start test server: %v", err)
|
|
}
|
|
defer server.Close()
|
|
|
|
port, err := server.port()
|
|
if err != nil {
|
|
t.Fatalf("unable to get server port: %v", err)
|
|
}
|
|
|
|
// test public key authentication.
|
|
cmd := testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no",
|
|
"-p", port, "testpubkey@127.0.0.1", "true")
|
|
out, err := cmd.CombinedOutput()
|
|
if err != nil {
|
|
t.Fatalf("public key authentication failed, error: %v, command output %q", err, string(out))
|
|
}
|
|
// Test SSH user certificate authentication.
|
|
// The username must match one of the principals included in the certificate.
|
|
// The certificate "rsa-user-testcertificate" has "testcertificate" as principal.
|
|
cmd = testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no",
|
|
"-p", port, "testcertificate@127.0.0.1", "true")
|
|
out, err = cmd.CombinedOutput()
|
|
if err != nil {
|
|
t.Fatalf("user certificate authentication failed, error: %v, command output %q", err, string(out))
|
|
}
|
|
}
|