3 # Tests to ensure that the monkeysphere is working
5 # unset MONKEYSPHERE_TEST_NO_EXAMINE to get a prompt to examine the
6 # test state after failure.
9 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
10 # Jameson Rollins <jrollins@fifthhorseman.net>
11 # Micah Anderson <micah@riseup.net>
13 # Copyright: 2008-2009
14 # License: GPL v3 or later
16 # these tests should all be able to run as a non-privileged user.
18 # put all the test output to stdout
20 # all subcommands in this script should complete without failure:
22 # piped commands should return the code of the first non-zero return
25 # make sure the TESTDIR is an absolute path, not a relative one.
26 export TESTDIR=$(cd $(dirname "$0") && pwd)
28 source "$TESTDIR"/common
30 ## make sure that the right tools are installed to run the test. the
31 ## test has *more* requirements than plain ol' monkeysphere:
32 [ -f /usr/sbin/sshd ] || { echo "You must have sshd installed to run this test." ; exit 1; }
33 which socat >/dev/null || { echo "You must have socat installed to run this test." ; exit 1; }
35 perl -MCrypt::OpenSSL::RSA -e 1 2>/dev/null || { echo "You must have the perl module Crypt::OpenSSL::RSA installed to run this test.
36 On debian-derived systems, you can set this up with:
37 apt-get install libcrypt-openssl-rsa-perl" ; exit 1; }
39 perl -MDigest::SHA -e 1 2>/dev/null || { echo "You must have the perl module Digest::SHA installed to run this test.
40 On debian-derived systems, you can set this up with:
41 apt-get install libdigest-sha-perl" ; exit 1; }
43 ## FIXME: other checks?
45 ######################################################################
48 # gpg command for test admin user
50 chmod 0700 "$TEMPDIR"/admin "$TEMPDIR"/admin/.gnupg
51 GNUPGHOME="$TEMPDIR"/admin/.gnupg gpg --no-tty "$@"
55 # first argument is expected return code from ssh connection
63 # start the ssh daemon on the socket
64 echo "##### starting ssh server..."
65 socat EXEC:"/usr/sbin/sshd -f ${SSHD_CONFIG} -i -D -e" "UNIX-LISTEN:${SOCKET}" 2> "$TEMPDIR"/sshd.log &
68 # wait until the socket is created before continuing
69 while [ ! -S "$SOCKET" ] ; do
73 # make a client connection to the socket
74 echo "##### starting ssh client..."
76 "monkeysphere subkey-to-ssh-agent && ssh -F $TEMPDIR/testuser/.ssh/config ${target_hostname:-testhost} true" \
79 # kill the sshd process if it's still running
80 kill "$SSHD_PID" || true
84 if [ "$RETURN" = "$CODE" ] ; then
85 echo "##### ssh connection test PASSED. returned: $RETURN"
88 echo "##### ssh connection test FAILED. returned: $RETURN, expected: $CODE"
93 # invoke this instead of ssh_test() if you want this test to be
94 # skipped when the working directory has bad permissions.
95 ssh_good_perm_test() {
96 if [ "$TEMPDIR_PERMISSIONS_SAFE" = no ] ; then
97 echo "WARNING!!! Test SKIPPED because we are running in an unsafe working directory."
107 trap failed_cleanup EXIT
110 ######################################################################
113 ## set up some variables to ensure that we're operating strictly in
114 ## the tests, not system-wide:
118 # NOTE: /tmp can not be used as the temp dir here, since the
119 # permissions on /tmp are usually such that they will not pass the
120 # monkeysphere/ssh path permission checking. If you need to use a
121 # different location than the current source, please set $TMPDIR
122 # somewhere with tighter permissions.
124 mkdir -p "$TESTDIR"/tmp
125 TEMPDIR=$(mktemp -d "${TMPDIR:-$TESTDIR/tmp}/monkeyspheretest.XXXXXXX")
127 # Use the local copy of executables first, instead of system ones.
128 # This should help us test without installing.
129 export PATH="$TESTDIR"/../src:"$PATH"
131 export MONKEYSPHERE_SYSDATADIR="$TEMPDIR"
132 export MONKEYSPHERE_SYSCONFIGDIR="$TEMPDIR"
133 export MONKEYSPHERE_SYSSHAREDIR="$TESTDIR"/../src/share
134 export MONKEYSPHERE_MONKEYSPHERE_USER=$(whoami)
136 HOST_KEY_FILE="$MONKEYSPHERE_SYSCONFIGDIR"/host_keys.pub.gpg
138 export MONKEYSPHERE_CHECK_KEYSERVER=false
139 # example.org does not respond to the HKP port, so this should cause
140 # any keyserver connection attempts that do happen (they shouldn't!)
141 # to hang, so we'll notice them:
142 export MONKEYSPHERE_KEYSERVER=example.org
144 export MONKEYSPHERE_LOG_LEVEL=DEBUG
145 export MONKEYSPHERE_CORE_KEYLENGTH=1024
146 export MONKEYSPHERE_PROMPT=false
148 # unset SUBKEYS_FOR_AGENT variable which, if set, would confuse the
149 # into trying to use the user's key, instead of the testuser's key
150 unset MONKEYSPHERE_SUBKEYS_FOR_AGENT
152 export SSHD_CONFIG="$TEMPDIR"/sshd_config
153 export SOCKET="$TEMPDIR"/ssh-socket
155 # Make sure $DISPLAY is set to convince ssh and monkeysphere to fall
156 # back on $SSH_ASKPASS. Make sure it's not set to the current actual
157 # $DISPLAY (if one exists) because this test suite should not be doing
158 # *anything* with any running X11 session.
159 export DISPLAY=monkeys
162 ## we cannot do proper directory permissions checking if the current
163 ## working directory has unsatisfactory permissions:
164 if "$MONKEYSPHERE_SYSSHAREDIR"/checkperms $(whoami) "$TEMPDIR"; then
165 echo "Permissions on temporary directory '$TEMPDIR' are OK for permissions checks."
166 TEMPDIR_PERMISSIONS_SAFE=yes
170 !!!WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING!!!
171 Permissions on testing directory '$TEMPDIR' are
172 too loose to do proper strict permissions checking. Some tests
173 will be disabled or ignored.
175 To avoid this warning (and to make sure that all tests are run
176 properly), please run these tests within a directory that meets
177 sshd's standards for "StrictModes yes" -- the directory (and every
178 one of its parents) should be owned only be the user running this
179 test or root, and should not be writable by group or other.
180 !!!WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING!!!
184 # FIXME: what else should we do with this knowledge to make sure
185 # that the appropriate tests are handled properly?
186 TEMPDIR_PERMISSIONS_SAFE=no
188 # this is a new option (as of 0.26) to disable filesystem
191 # it should operate by analogy with StrictModes from sshd_config(5)
192 export MONKEYSPHERE_STRICT_MODES=false
197 ######################################################################
198 ### CONFIGURE ENVIRONMENTS
200 # copy in admin and testuser home to tmp
202 echo "##################################################"
203 echo "### configuring testuser home..."
204 (cd "$TESTDIR"/home && find testuser | cpio -pdu "$TEMPDIR")
206 # set up environment for testuser
207 export TESTHOME="$TEMPDIR"/testuser
208 export GNUPGHOME="$TESTHOME"/.gnupg
209 chmod 0700 "$GNUPGHOME"
210 export SSH_ASKPASS="$TESTHOME"/.ssh/askpass
211 export MONKEYSPHERE_HOME="$TESTHOME"/.monkeysphere
212 cat <<EOF >> "$TESTHOME"/.ssh/config
213 UserKnownHostsFile $TESTHOME/.ssh/known_hosts
214 IdentityFile $TESTHOME/.ssh/no-such-identity
215 ProxyCommand $TESTHOME/.ssh/proxy-command %h %p $SOCKET
217 cat <<EOF >> "$MONKEYSPHERE_HOME"/monkeysphere.conf
218 KNOWN_HOSTS=$TESTHOME/.ssh/known_hosts
220 get_gpg_prng_arg >> "$GNUPGHOME"/gpg.conf
223 echo "##################################################"
224 echo "### configuring admin home..."
225 (cd "$TESTDIR"/home && find admin | cpio -pdu "$TEMPDIR")
229 echo "##################################################"
230 echo "### configuring sshd..."
231 cp "$TESTDIR"/etc/ssh/sshd_config "$SSHD_CONFIG"
232 # write the sshd_config
233 cat <<EOF >> "$SSHD_CONFIG"
234 HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key
235 AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/%u
238 # disable sshd's strict permissions settings so that some tests can
239 # complete when running under a dubious path:
240 if [ "$TEMPDIR_PERMISSIONS_SAFE" != yes ] ; then
241 cat <<EOF >> "$SSHD_CONFIG"
247 ######################################################################
248 ### SERVER HOST SETUP
252 echo "##################################################"
253 echo "### import host key..."
254 ssh-keygen -b 1024 -t rsa -N '' -f "$TEMPDIR"/ssh_host_rsa_key
255 monkeysphere-host import-key "$TEMPDIR"/ssh_host_rsa_key ssh://testhost
258 echo "##################################################"
259 echo "### getting host key fingerprint..."
260 HOSTKEYID=$( monkeysphere-host show-key | grep '^OpenPGP fingerprint: ' | cut -f3 -d\ )
263 # change host key expiration
265 echo "##################################################"
266 echo "### setting host key expiration..."
267 monkeysphere-host set-expire 1
268 # FIXME: how do we check that the expiration has really been set?
270 # certify host key with the "Admin's Key".
271 # (this would normally be done via keyservers)
273 echo "##################################################"
274 echo "### certifying server host key..."
275 < "$HOST_KEY_FILE" gpgadmin --import
276 echo y | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID"
278 # FIXME: add revoker?
280 # FIXME: how can we test publish-key without flooding junk into the
283 # FIXME: should we run "diagnostics" here to test setup?
286 ######################################################################
287 ### SERVER AUTHENTICATION SETUP
289 # set up monkeysphere authentication
291 echo "##################################################"
292 echo "### setup monkeysphere authentication..."
293 cp "$TESTDIR"/etc/monkeysphere/monkeysphere-authentication.conf "$TEMPDIR"/
294 cat <<EOF >> "$TEMPDIR"/monkeysphere-authentication.conf
295 AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authorized_user_ids"
297 monkeysphere-authentication setup
298 get_gpg_prng_arg >> "$MONKEYSPHERE_SYSDATADIR"/authentication/sphere/gpg.conf
300 # add admin as identity certifier for testhost
302 echo "##################################################"
303 echo "### adding admin as certifier..."
304 monkeysphere-authentication add-id-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg
307 echo "##################################################"
308 echo "### list certifiers..."
309 monkeysphere-authentication list-certifiers
311 # FIXME: should we run "diagnostics" here to test setup?
313 ######################################################################
316 # generate an auth subkey for the test user that expires in 2 days
318 echo "##################################################"
319 echo "### generating key for testuser..."
320 monkeysphere gen-subkey
322 # add server key to testuser keychain
324 echo "##################################################"
325 echo "### export server key to testuser..."
326 gpgadmin --armor --export "$HOSTKEYID" | gpg --import
328 # teach the "server" about the testuser's key
330 echo "##################################################"
331 echo "### export testuser key to server..."
332 gpg --export testuser | monkeysphere-authentication gpg-cmd --import
334 # update authorized_keys for user
336 echo "##################################################"
337 echo "### update server authorized_keys file for this testuser..."
338 monkeysphere-authentication update-users $(whoami)
339 # FIXME: this is maybe not failing properly for:
340 # ms: improper group or other writability on path '/tmp'.
342 ######################################################################
345 # connect to test sshd, using monkeysphere ssh-proxycommand to verify
346 # the identity before connection. This should work in both directions!
348 echo "##################################################"
349 echo "### ssh connection test for success..."
352 # remove the testuser's authorized_user_ids file, update, and make
353 # sure that the ssh authentication FAILS
355 echo "##################################################"
356 echo "### removing testuser authorized_user_ids and updating..."
357 mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak}
358 monkeysphere-authentication update-users $(whoami)
360 echo "##################################################"
361 echo "### ssh connection test for failure..."
363 mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
365 # put improper permissions on authorized_user_ids file, update, and
366 # make sure ssh authentication FAILS
368 echo "##################################################"
369 echo "### setting group writability on authorized_user_ids and updating..."
370 chmod g+w "$TESTHOME"/.monkeysphere/authorized_user_ids
371 monkeysphere-authentication update-users $(whoami)
373 echo "##################################################"
374 echo "### ssh connection test for failure..."
375 ssh_good_perm_test 255
376 chmod g-w "$TESTHOME"/.monkeysphere/authorized_user_ids
378 echo "##################################################"
379 echo "### setting other writability on authorized_user_ids and updating..."
380 chmod o+w "$TESTHOME"/.monkeysphere/authorized_user_ids
381 monkeysphere-authentication update-users $(whoami)
383 echo "##################################################"
384 echo "### ssh connection test for failure..."
385 ssh_good_perm_test 255
386 chmod o-w "$TESTHOME"/.monkeysphere/authorized_user_ids
387 monkeysphere-authentication update-users $(whoami)
391 echo "##################################################"
392 echo "### setup for symlink tests..."
393 cp -a "$TESTHOME"/.monkeysphere{,.linktest}
396 echo "##################################################"
397 echo "### make authorized_user_ids an absolute symlink and updating..."
398 mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak}
399 ln -s "$TESTHOME"/.monkeysphere{.linktest,}/authorized_user_ids
400 monkeysphere-authentication update-users $(whoami)
402 echo "##################################################"
403 echo "### ssh connection test for success..."
406 echo "##################################################"
407 echo "### create bad permissions on link dir and updating..."
408 chmod o+w "$TESTHOME"/.monkeysphere.linktest
409 monkeysphere-authentication update-users $(whoami)
411 echo "##################################################"
412 echo "### ssh connection test for failure..."
413 ssh_good_perm_test 255
414 chmod o-w "$TESTHOME"/.monkeysphere.linktest
416 echo "##################################################"
417 echo "### make authorized_user_ids a relative symlink and updating..."
418 ln -sf ../.monkeysphere.linktest/authorized_user_ids "$TESTHOME"/.monkeysphere/authorized_user_ids
419 monkeysphere-authentication update-users $(whoami)
421 echo "##################################################"
422 echo "### ssh connection test for success..."
425 echo "##################################################"
426 echo "### create bad permissions on link dir updating..."
427 chmod o+w "$TESTHOME"/.monkeysphere.linktest
428 monkeysphere-authentication update-users $(whoami)
430 echo "##################################################"
431 echo "### ssh connection test for failure..."
432 ssh_good_perm_test 255
433 chmod o-w "$TESTHOME"/.monkeysphere.linktest
434 # FIXME: implement check of link path, and uncomment this test
436 # echo "##################################################"
437 # echo "### create bad permissions on link dir and updating..."
438 # chmod o+w "$TESTHOME"/.monkeysphere
439 # monkeysphere-authentication update-users $(whoami)
441 # echo "##################################################"
442 # echo "### ssh connection test for failure..."
443 # ssh_good_perm_test 255
444 # chmod o-w "$TESTHOME"/.monkeysphere
445 rm "$TESTHOME"/.monkeysphere/authorized_user_ids
446 mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
449 echo "##################################################"
450 echo "### make .monkeysphere directory an absolute symlink and updating..."
451 mv "$TESTHOME"/.monkeysphere{,.bak}
452 ln -s "$TESTHOME"/.monkeysphere{.linktest,}
453 monkeysphere-authentication update-users $(whoami)
455 echo "##################################################"
456 echo "### ssh connection test for success..."
459 echo "##################################################"
460 echo "### create bad permissions on link dir and updating..."
461 chmod o+w "$TESTHOME"/.monkeysphere.linktest
462 monkeysphere-authentication update-users $(whoami)
464 echo "##################################################"
465 echo "### ssh connection test for failure..."
466 ssh_good_perm_test 255
467 chmod o-w "$TESTHOME"/.monkeysphere.linktest
469 echo "##################################################"
470 echo "### make .monkeysphere directory a relative symlink and updating..."
471 ln -sfn .monkeysphere.linktest "$TESTHOME"/.monkeysphere
472 monkeysphere-authentication update-users $(whoami)
474 echo "##################################################"
475 echo "### ssh connection test for success..."
478 echo "##################################################"
479 echo "### create bad permissions on link dir updating..."
480 chmod o+w "$TESTHOME"/.monkeysphere.linktest
481 monkeysphere-authentication update-users $(whoami)
483 echo "##################################################"
484 echo "### ssh connection test for failure..."
485 ssh_good_perm_test 255
486 chmod o-w "$TESTHOME"/.monkeysphere.linktest
487 rm "$TESTHOME"/.monkeysphere
488 mv "$TESTHOME"/.monkeysphere{.bak,}
490 # ensure we're back to normal:
492 echo "##################################################"
493 echo "### making sure we are back to normal..."
494 monkeysphere-authentication update-users $(whoami)
499 echo "##################################################"
500 echo "### ssh connection test directly to 'testhost2' without new name..."
501 target_hostname=testhost2 ssh_test 255
503 echo "##################################################"
504 echo "### add hostname, certify by admin, import by user..."
505 monkeysphere-host add-hostname ssh://testhost2
506 <"$HOST_KEY_FILE" gpgadmin --import
507 printf "y\ny\n" | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID"
510 echo "##################################################"
511 echo "### ssh connection test with hostname 'testhost2' added..."
512 gpgadmin --export "$HOSTKEYID" | gpg --import
517 echo "##################################################"
518 echo "### ssh connection test directly to 'testhost2' ..."
519 gpg --import <"$HOST_KEY_FILE"
521 target_hostname=testhost2 ssh_test
524 echo "##################################################"
525 echo "### ssh connection test for failure with 'testhost2' revoked..."
526 monkeysphere-host revoke-hostname ssh://testhost2
527 gpg --import <"$HOST_KEY_FILE"
529 target_hostname=testhost2 ssh_test 255
531 # FIXME: addtest: remove admin as id-certifier and check ssh failure
533 # FIXME: addtest: how do we test that set-expire makes sense after new
534 # hostnames have been added?
536 # FIXME: addtest: revoke the host key and check ssh failure
538 # test to make sure things are OK after the previous tests:
540 echo "##################################################"
541 echo "### settings reset, updating..."
542 monkeysphere-authentication update-users $(whoami)
544 echo "##################################################"
545 echo "### ssh connection test for success..."
549 echo "##################################################"
550 echo "### revoking host key..."
551 # generate the revocation certificate and feed it directly to the test
552 # user's keyring (we're not publishing to the keyservers)
553 monkeysphere-host revoke-key | gpg --import
555 echo "##################################################"
556 echo "### ssh connection test for failure..."
560 ######################################################################
565 echo "##################################################"
566 echo " Monkeysphere basic tests completed successfully!"
567 echo "##################################################"