1
0
mirror of https://github.com/libssh2/libssh2.git synced 2025-11-18 15:20:56 +03:00
Files
libssh2/tests/openssh_fixture.c
Viktor Szakats a459a25302 tests: improve running tests
TL;DR: Sync test builds between autotools and CMake. Sync sshd
configuration between Docker and non-Docker fixtures. Bump up
sshd_config for recent OpenSSH releases.

This also opens up the path to have non-Docker tests that use a
local sshd process. Though sshd is practically unusable on Windows
CI machines out of the box, so this will need further efforts.

Details:

- cmake: run sshd fixture test just like autotool did already.

- sync tests and their order between autotools and CMake.

  It makes `test_aa_warmup` the first test with both.

- cmake: load test lists from `Makefile.am`.

  Needed to update the loader to throw away certain lines to keep the
  converted output conform CMake syntax. Using regexp might be an
  alternative way of doing this, but couldn't make it work.

- cmake: use the official way to configure test environment variables.
  Switch to syntax that's extendable.

- cmake: allow to run the same test both under Docker and sshd fixture.

  Useful for testing the sshd fixture runner, or how the same test
  behaves in each fixture.

- update test fixture to read the username from `USER` envvar instead of
  using the Dockfile-specific hardwired one, when running outside Docker.

- rework `ssh2.sh` into `sshd_fixture.sh`, to:

  - allow running any tests (not just `test_ssh2`).
  - configure Docker tests for running outside Docker.
  - fixup `SSHD` path when running on Windows (e.g. in AppVeyor CI).
    Fixes: `sshd re-exec requires execution with an absolute path`
  - allow overriding `PUBKEY` and `PRIVKEY` envvars.
  - allow overriding `ssh_config` via `SSHD_FIXTURE_CONFIG`.

- prepare support for running multiple tests via sshd_fixture.

  Add a TAP runner for autotools and extend CMake logic. The TAP runner
  loads the test list from `Makefile.am`.

  Notice however that on Windows, `sshd_fixture.sh` is very flaky with
  GitHub Actions. And consistently broken for subsequent tests in
  AppVeyor CI:
    'libssh2_session_handshake failed (-43): Failed getting banner'

  Another way to try is a single sshd instance serving all tests.
  For CMake this would probably mean using an external script.

- ed25519 test keys were identical for auth and host. Regenerate the
  auth keypair to make them distinct.

- sync the sshd environment between Docker and sshd_fixture.

  - use common via `openssh_server/sshd_config`.
  - accept same auth keys.
  - offer the same host keys.
  - sync TrustedUserCAKeys.
  - delete now unused keypairs: `etc/host*`, `etc/user*`.
  - bump up startup delay for Windows (randomly, to 5 secs, from 3).
  - delete `UsePrivilegeSeparation no` to avoid deprecation warnings.
    `command-line line 0: Deprecated option UsePrivilegeSeparation`
  - delete `Protocol 2` to avoid deprecation warnings.
    It has been the default since OpenSSH 3.0 (2001-11-06).
  - delete `StrictModes no` (CI tests work without it, Docker tests
    never used it).

- bump `Dockerfile` base image to `testing-slim` (from `bullseye-slim`).

  It needed `sshd_config` updates to keep things working with
  OpenSSH 9.2 (compared to bullseye's 8.4).

  - replace `ChallengeResponseAuthentication` alias with
    `KbdInteractiveAuthentication`.
    The former is no longer present in default `sshd_config` since
    OpenSSH 8.7 (2021-08-20). This broke the `Dockerfile` script.
    The new name is documented since OpenSSH 4.9 (2008-03-31)

  - add `PubkeyAcceptedKeyTypes +ssh-rsa,ssh-dss,ssh-rsa-cert-v01@openssh.com`
    and `HostKeyAlgorithms +ssh-rsa`.

    Original-patch-by: Eric van Gyzen (@vangyzen on github)
    Fixes #691

    There is a new name for `PubkeyAcceptedKeyTypes`:
       `PubkeyAcceptedAlgorithms`.
    It requires OpenSSH 8.5 (2021-03-03) and breaks some envs so we're
    not using it just yet.

- drop `rijndael-cbc@lysator.liu.se` tests and references from config.

  This is a draft alias for `aes256-cbc`. No need to test it twice.
  Also this alias is no longer recognized by OpenSSH 8.5 (2021-03-03).

- update `mansyntax.sh` and `sshd_fixture.sh` to not rely on `srcdir`.

  Hopefully this works with out-of-tree builds.

- fix `test_read_algos.test` to honor CRLF EOLs in their inputs
  (necessary when running on Windows.)

- fix `test_read_algos.test` to honor `EXEEXT`. Might be useful when
  running tests under cross-builds?

- `test_ssh2.c`:

  - use libssh2 API to set blocking mode. This makes it support all
    platforms.
  - adapt socket open timeout logic from `openssh_fixture.c`.
    Sadly this did not help fix flakiness on GHA Windows.

- tests: delete unused C headers and variable initialization.

- delete unused test files: `sshd_fixture.sh.in`, `sshdwrap`,
  `etc/sshd_config`.

  Ref: cf80f2f4b5

- autotools: delete stray `.c` test sources from `EXTRA_DIST` in tests.

- `tests/.gitignore`: drop two stray tests.

- autotools: fix passing `SSHD` containing space (Windows needs this).

- autotools: sort `EXTRA_DIST` in tests.

- cmake: fix to add `test_ssh2` to `TEST_TARGETS`.

- fix `authorized_key` order in `tests/gen_keys.sh`.

- silence shellcheck warning in `ci/checksrc.sh`.

- set `SSHD` for autotools on GitHub Actions Windows. [skipped]

  Auto-detection doesn't work (maybe because sshd is installed via
  Git for Windows and we're using MSYS2's shell.)

  It enables running sshd fixture (non-Docker) tests in these jobs.

  I did not include this in the final patch due to flakiness:
  ```
  Connection to 127.0.0.1:4711 attempt #0 failed: retrying...
  Connection to 127.0.0.1:4711 attempt #1 failed: retrying...
  Connection to 127.0.0.1:4711 attempt #2 failed: retrying...
  Failure establishing SSH session: -43
  ```

  Can be enabled with:
  `export SSHD='C:/Program Files/Git/usr/bin/sshd.exe'`

Closes #996
2023-04-24 21:28:28 +00:00

465 lines
12 KiB
C

/* Copyright (C) 2016 Alexander Lamaison
* All rights reserved.
*
* Redistribution and use in source and binary forms,
* with or without modification, are permitted provided
* that the following conditions are met:
*
* Redistributions of source code must retain the above
* copyright notice, this list of conditions and the
* following disclaimer.
*
* Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the following
* disclaimer in the documentation and/or other materials
* provided with the distribution.
*
* Neither the name of the copyright holder nor the names
* of any other contributors may be used to endorse or
* promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
* CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
* USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
* OF SUCH DAMAGE.
*/
#include "session_fixture.h"
#include "openssh_fixture.h"
#ifdef HAVE_SYS_SOCKET_H
#include <sys/socket.h>
#endif
#ifdef HAVE_ARPA_INET_H
#include <arpa/inet.h>
#endif
#ifdef HAVE_NETINET_IN_H
#include <netinet/in.h>
#endif
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#if defined(WIN32) && defined(_WIN64)
#define LIBSSH2_SOCKET_MASK "%lld"
#else
#define LIBSSH2_SOCKET_MASK "%d"
#endif
static int have_docker = 0;
int openssh_fixture_have_docker(void)
{
return have_docker;
}
static int run_command_varg(char **output, const char *command, va_list args)
{
static const char redirect_stderr[] = "%s 2>&1";
FILE *pipe;
char command_buf[BUFSIZ];
char buf[BUFSIZ];
int ret;
size_t buf_len;
if(output) {
*output = NULL;
}
/* Format the command string */
ret = vsnprintf(command_buf, sizeof(command_buf), command, args);
if(ret < 0 || ret >= BUFSIZ) {
fprintf(stderr, "Unable to format command (%s)\n", command);
return -1;
}
/* Rewrite the command to redirect stderr to stdout to we can output it */
if(strlen(command_buf) + strlen(redirect_stderr) >= sizeof(buf)) {
fprintf(stderr, "Unable to rewrite command (%s)\n", command);
return -1;
}
ret = snprintf(buf, sizeof(buf), redirect_stderr, command_buf);
if(ret < 0 || ret >= BUFSIZ) {
fprintf(stderr, "Unable to rewrite command (%s)\n", command);
return -1;
}
fprintf(stdout, "Command: %s\n", command_buf);
#ifdef WIN32
pipe = _popen(buf, "r");
#else
pipe = popen(buf, "r");
#endif
if(!pipe) {
fprintf(stderr, "Unable to execute command '%s'\n", command);
return -1;
}
buf[0] = 0;
buf_len = 0;
while(buf_len < (sizeof(buf) - 1) &&
fgets(&buf[buf_len], (int)(sizeof(buf) - buf_len), pipe)) {
buf_len = strlen(buf);
}
#ifdef WIN32
ret = _pclose(pipe);
#else
ret = pclose(pipe);
#endif
if(ret) {
fprintf(stderr, "Error running command '%s' (exit %d): %s\n",
command, ret, buf);
}
if(output) {
/* command output may contain a trailing newline, so we trim
* whitespace here */
size_t end = strlen(buf);
while(end > 0 && isspace(buf[end - 1])) {
buf[end - 1] = '\0';
}
*output = strdup(buf);
}
return ret;
}
static int run_command(char **output, const char *command, ...)
{
va_list args;
int ret;
va_start(args, command);
ret = run_command_varg(output, command, args);
va_end(args);
return ret;
}
static const char *openssh_server_image(void)
{
return getenv("OPENSSH_SERVER_IMAGE");
}
static int build_openssh_server_docker_image(void)
{
if(have_docker) {
char buildcmd[1024];
const char *container_image_name = openssh_server_image();
if(container_image_name) {
int ret = run_command(NULL, "docker pull %s",
container_image_name);
if(ret == 0) {
ret = run_command(NULL, "docker tag %s libssh2/openssh_server",
container_image_name);
if(ret == 0) {
return ret;
}
}
}
buildcmd[sizeof(buildcmd)-1] = 0;
snprintf(buildcmd, sizeof(buildcmd)-1,
"docker build --quiet -t libssh2/openssh_server %s",
srcdir_path("openssh_server"));
return run_command(NULL, buildcmd);
}
else {
return 0;
}
}
static const char *openssh_server_port(void)
{
return getenv("OPENSSH_SERVER_PORT");
}
static int start_openssh_server(char **container_id_out)
{
if(have_docker) {
const char *container_host_port = openssh_server_port();
if(container_host_port) {
return run_command(container_id_out,
"docker run --rm -d -p %s:22 "
"libssh2/openssh_server",
container_host_port);
}
return run_command(container_id_out,
"docker run --rm -d -p 22 "
"libssh2/openssh_server");
}
else {
*container_id_out = strdup("");
return 0;
}
}
static int stop_openssh_server(char *container_id)
{
if(have_docker) {
return run_command(NULL, "docker stop %s", container_id);
}
else {
return 0;
}
}
static const char *docker_machine_name(void)
{
return getenv("DOCKER_MACHINE_NAME");
}
static int is_running_inside_a_container(void)
{
#ifdef WIN32
return 0;
#else
const char *cgroup_filename = "/proc/self/cgroup";
FILE *f;
char *line = NULL;
size_t len = 0;
ssize_t read;
int found = 0;
f = fopen(cgroup_filename, "r");
if(!f) {
/* Don't go further, we are not in a container */
return 0;
}
while((read = getline(&line, &len, f)) != -1) {
if(strstr(line, "docker")) {
found = 1;
break;
}
}
fclose(f);
free(line);
return found;
#endif
}
static void portable_sleep(unsigned int seconds)
{
#ifdef WIN32
Sleep(seconds);
#else
sleep(seconds);
#endif
}
static int ip_address_from_container(char *container_id, char **ip_address_out)
{
const char *active_docker_machine = docker_machine_name();
if(active_docker_machine) {
/* This can be flaky when tests run in parallel (see
https://github.com/docker/machine/issues/2612), so we retry a few
times with exponential backoff if it fails */
int attempt_no = 0;
int wait_time = 500;
for(;;) {
int ret = run_command(ip_address_out, "docker-machine ip %s",
active_docker_machine);
if(ret == 0) {
return 0;
}
else if(attempt_no > 5) {
fprintf(
stderr,
"Unable to get IP from docker-machine after %d attempts\n",
attempt_no);
return -1;
}
else {
portable_sleep(wait_time);
++attempt_no;
wait_time *= 2;
}
}
}
else {
if(is_running_inside_a_container()) {
return run_command(ip_address_out,
"docker inspect --format "
"\"{{ .NetworkSettings.IPAddress }}\""
" %s",
container_id);
}
else {
return run_command(ip_address_out,
"docker inspect --format "
"\"{{ index (index (index "
".NetworkSettings.Ports "
"\\\"22/tcp\\\") 0) \\\"HostIp\\\" }}\" %s",
container_id);
}
}
}
static int port_from_container(char *container_id, char **port_out)
{
if(is_running_inside_a_container()) {
*port_out = strdup("22");
return 0;
}
else {
return run_command(port_out,
"docker inspect --format "
"\"{{ index (index (index .NetworkSettings.Ports "
"\\\"22/tcp\\\") 0) \\\"HostPort\\\" }}\" %s",
container_id);
}
}
static libssh2_socket_t open_socket_to_container(char *container_id)
{
char *ip_address = NULL;
char *port_string = NULL;
uint32_t hostaddr;
libssh2_socket_t sock;
struct sockaddr_in sin;
int counter;
libssh2_socket_t ret = LIBSSH2_INVALID_SOCKET;
if(have_docker) {
int res;
res = ip_address_from_container(container_id, &ip_address);
if(res) {
fprintf(stderr, "Failed to get IP address for container %s\n",
container_id);
goto cleanup;
}
res = port_from_container(container_id, &port_string);
if(res) {
fprintf(stderr, "Failed to get port for container %s\n",
container_id);
goto cleanup;
}
}
else {
const char *env;
env = getenv("OPENSSH_SERVER_HOST");
if(!env) {
env = "127.0.0.1";
}
ip_address = strdup(env);
env = openssh_server_port();
if(!env) {
env = "4711";
}
port_string = strdup(env);
}
/* 0.0.0.0 is returned by Docker for Windows, because the container
is reachable from anywhere. But we cannot connect to 0.0.0.0,
instead we assume localhost and try to connect to 127.0.0.1. */
if(ip_address && strcmp(ip_address, "0.0.0.0") == 0) {
free(ip_address);
ip_address = strdup("127.0.0.1");
}
hostaddr = inet_addr(ip_address);
if(hostaddr == (uint32_t)(-1)) {
fprintf(stderr, "Failed to convert %s host address\n", ip_address);
goto cleanup;
}
sock = socket(AF_INET, SOCK_STREAM, 0);
if(sock == LIBSSH2_INVALID_SOCKET) {
fprintf(stderr,
"Failed to open socket (" LIBSSH2_SOCKET_MASK ")\n", sock);
goto cleanup;
}
sin.sin_family = AF_INET;
sin.sin_port = htons((short)strtol(port_string, NULL, 0));
sin.sin_addr.s_addr = hostaddr;
for(counter = 0; counter < 3; ++counter) {
if(connect(sock, (struct sockaddr*)(&sin),
sizeof(struct sockaddr_in))) {
fprintf(stderr,
"Connection to %s:%s attempt #%d failed: retrying...\n",
ip_address, port_string, counter);
portable_sleep(1 + 2*counter);
}
else {
ret = sock;
break;
}
}
if(ret == LIBSSH2_INVALID_SOCKET) {
fprintf(stderr, "Failed to connect to %s:%s\n",
ip_address, port_string);
goto cleanup;
}
cleanup:
free(ip_address);
free(port_string);
return ret;
}
static char *running_container_id = NULL;
int start_openssh_fixture(void)
{
int ret;
#ifdef WIN32
WSADATA wsadata;
ret = WSAStartup(MAKEWORD(2, 0), &wsadata);
if(ret) {
fprintf(stderr, "WSAStartup failed with error: %d\n", ret);
return 1;
}
#endif
have_docker = !getenv("OPENSSH_NO_DOCKER");
ret = build_openssh_server_docker_image();
if(!ret) {
return start_openssh_server(&running_container_id);
}
else {
fprintf(stderr, "Failed to build docker image\n");
return ret;
}
}
void stop_openssh_fixture(void)
{
if(running_container_id) {
stop_openssh_server(running_container_id);
free(running_container_id);
running_container_id = NULL;
}
else if(have_docker) {
fprintf(stderr, "Cannot stop container - none started");
}
}
libssh2_socket_t open_socket_to_openssh_server(void)
{
return open_socket_to_container(running_container_id);
}