1#	$OpenBSD: dynamic-forward.sh,v 1.17 2024/03/08 11:34:10 dtucker Exp $
2#	Placed in the Public Domain.
3
4tid="dynamic forwarding"
5
6# This is a reasonable proxy for IPv6 support.
7if ! config_defined HAVE_STRUCT_IN6_ADDR ; then
8	SKIP_IPV6=yes
9fi
10
11FWDPORT=`expr $PORT + 1`
12make_tmpdir
13CTL=${SSH_REGRESS_TMP}/ctl-sock
14cp $OBJ/ssh_config $OBJ/ssh_config.orig
15proxycmd="$OBJ/netcat -x 127.0.0.1:$FWDPORT -X"
16trace "will use ProxyCommand $proxycmd"
17
18start_ssh() {
19	direction="$1"
20	arg="$2"
21	n=0
22	error="1"
23	# Use a multiplexed ssh so we can control its lifecycle.
24	trace "start dynamic -$direction forwarding, fork to background"
25	(cat $OBJ/ssh_config.orig ; echo "$arg") > $OBJ/ssh_config
26	${REAL_SSH} -vvvnNfF $OBJ/ssh_config -E$TEST_SSH_LOGFILE \
27	    -$direction $FWDPORT -oExitOnForwardFailure=yes \
28	    -oControlMaster=yes -oControlPath=$CTL somehost
29	r=$?
30	test $r -eq 0 || fatal "failed to start dynamic forwarding $r"
31	if ! ${REAL_SSH} -qF$OBJ/ssh_config -O check \
32	     -oControlPath=$CTL somehost >/dev/null 2>&1 ; then
33		fatal "forwarding ssh process unresponsive"
34	fi
35}
36
37stop_ssh() {
38	test -S $CTL || return
39	if ! ${REAL_SSH} -qF$OBJ/ssh_config -O exit \
40	     -oControlPath=$CTL >/dev/null somehost >/dev/null ; then
41		fatal "forwarding ssh process did not respond to close"
42	fi
43	n=0
44	while [ "$n" -lt 20 ] ; do
45		test -S $CTL || break
46		sleep 1
47		n=`expr $n + 1`
48	done
49	if test -S $CTL ; then
50		fatal "forwarding ssh process did not exit"
51	fi
52}
53
54check_socks() {
55	direction=$1
56	expect_success=$2
57	for s in 4 5; do
58	    for h in 127.0.0.1 localhost; do
59		trace "testing ssh socks version $s host $h (-$direction)"
60		${REAL_SSH} -q -F $OBJ/ssh_config -o \
61		   "ProxyCommand ${TEST_SHELL} -c '${proxycmd}${s} $h $PORT 2>/dev/null'" \
62		   somehost cat ${DATA} > ${COPY}
63		r=$?
64		if [ "x$expect_success" = "xY" ] ; then
65			if [ $r -ne 0 ] ; then
66				fail "ssh failed with exit status $r"
67			fi
68			test -f ${COPY}	 || fail "failed copy ${DATA}"
69			cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
70		elif [ $r -eq 0 ] ; then
71			fail "ssh unexpectedly succeeded"
72		fi
73	    done
74	done
75}
76
77start_sshd
78trap "stop_ssh" EXIT
79
80for d in D R; do
81	verbose "test -$d forwarding"
82	start_ssh $d
83	check_socks $d Y
84	stop_ssh
85	test "x$d" = "xR" || continue
86
87	# Test PermitRemoteOpen
88	verbose "PermitRemoteOpen=any"
89	start_ssh $d PermitRemoteOpen=any
90	check_socks $d Y
91	stop_ssh
92
93	verbose "PermitRemoteOpen=none"
94	start_ssh $d PermitRemoteOpen=none
95	check_socks $d N
96	stop_ssh
97
98	verbose "PermitRemoteOpen=explicit"
99	permit="127.0.0.1:$PORT [::1]:$PORT localhost:$PORT"
100	test -z "$SKIP_IPV6" || permit="127.0.0.1:$PORT localhost:$PORT"
101	start_ssh $d PermitRemoteOpen="$permit"
102	check_socks $d Y
103	stop_ssh
104
105	verbose "PermitRemoteOpen=disallowed"
106	permit="127.0.0.1:1 [::1]:1 localhost:1"
107	test -z "$SKIP_IPV6" || permit="127.0.0.1:1 localhost:1"
108	start_ssh $d PermitRemoteOpen="$permit"
109	check_socks $d N
110	stop_ssh
111done
112