Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 agent_unix_test.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. //go:build aix \|\| darwin \|\| dragonfly \|\| freebsd \|\| linux \|\| netbsd \|\| openbsd \|\| solaris package test import ( "bytes" "testing" "golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh/agent" ) func TestAgentForward(t *testing.T) { server := newServer(t) conn := server.Dial(clientConfig()) defer conn.Close() keyring := agent.NewKeyring() if err := keyring.Add(agent.AddedKey{PrivateKey: testPrivateKeys["ecdsa"]}); err != nil { t.Fatalf("Error adding key: %s", err) } if err := keyring.Add(agent.AddedKey{ PrivateKey: testPrivateKeys["ecdsa"], ConfirmBeforeUse: true, LifetimeSecs: 3600, }); err != nil { t.Fatalf("Error adding key with constraints: %s", err) } pub := testPublicKeys["ecdsa"] sess, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("NewSession: %v", err) } if err := agent.RequestAgentForwarding(sess); err != nil { t.Fatalf("RequestAgentForwarding: %v", err) } if err := agent.ForwardToAgent(conn, keyring); err != nil { t.Fatalf("SetupForwardKeyring: %v", err) } out, err := sess.CombinedOutput("ssh-add -L") if err != nil { t.Fatalf("running ssh-add: %v, out %s", err, out) } key, _, _, _, err := ssh.ParseAuthorizedKey(out) if err != nil { t.Fatalf("ParseAuthorizedKey(%q): %v", out, err) } if !bytes.Equal(key.Marshal(), pub.Marshal()) { t.Fatalf("got key %s, want %s", ssh.MarshalAuthorizedKey(key), ssh.MarshalAuthorizedKey(pub)) } }	1.57 KB	2025-05-25 12:27
📄 banner_test.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. //go:build aix \|\| darwin \|\| dragonfly \|\| freebsd \|\| linux \|\| netbsd \|\| openbsd \|\| solaris package test import ( "testing" ) func TestBannerCallbackAgainstOpenSSH(t *testing.T) { server := newServer(t) clientConf := clientConfig() var receivedBanner string clientConf.BannerCallback = func(message string) error { receivedBanner = message return nil } conn := server.Dial(clientConf) defer conn.Close() expected := "Server Banner" if receivedBanner != expected { t.Fatalf("got %v; want %v", receivedBanner, expected) } }	704 B	2025-05-25 12:27
📄 cert_test.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. //go:build aix \|\| darwin \|\| dragonfly \|\| freebsd \|\| linux \|\| netbsd \|\| openbsd \|\| solaris package test import ( "bytes" "crypto/rand" "testing" "golang.org/x/crypto/ssh" ) // Test both logging in with a cert, and also that the certificate presented by an OpenSSH host can be validated correctly func TestCertLogin(t *testing.T) { s := newServer(t) // Use a key different from the default. clientKey := testSigners["ed25519"] caAuthKey := testSigners["ecdsa"] cert := &ssh.Certificate{ Key: clientKey.PublicKey(), ValidPrincipals: []string{username()}, CertType: ssh.UserCert, ValidBefore: ssh.CertTimeInfinity, } if err := cert.SignCert(rand.Reader, caAuthKey); err != nil { t.Fatalf("SetSignature: %v", err) } certSigner, err := ssh.NewCertSigner(cert, clientKey) if err != nil { t.Fatalf("NewCertSigner: %v", err) } conf := &ssh.ClientConfig{ User: username(), HostKeyCallback: (&ssh.CertChecker{ IsHostAuthority: func(pk ssh.PublicKey, addr string) bool { return bytes.Equal(pk.Marshal(), testPublicKeys["ca"].Marshal()) }, }).CheckHostKey, } conf.Auth = append(conf.Auth, ssh.PublicKeys(certSigner)) for _, test := range []struct { addr string succeed bool }{ {addr: "host.example.com:22", succeed: true}, {addr: "host.example.com:10000", succeed: true}, // non-standard port must be OK {addr: "host.example.com", succeed: false}, // port must be specified {addr: "host.ex4mple.com:22", succeed: false}, // wrong host } { client, err := s.TryDialWithAddr(conf, test.addr) // Always close client if opened successfully if err == nil { client.Close() } // Now evaluate whether the test failed or passed if test.succeed { if err != nil { t.Fatalf("TryDialWithAddr: %v", err) } } else { if err == nil { t.Fatalf("TryDialWithAddr, unexpected success") } } } }	2.01 KB	2025-05-25 12:27
📄 dial_unix_test.go // Copyright 2012 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. //go:build !windows && !js && !wasip1 package test // direct-tcpip and direct-streamlocal functional tests import ( "context" "fmt" "io" "net" "strings" "testing" ) type dialTester interface { TestServerConn(t testing.T, c net.Conn) TestClientConn(t testing.T, c net.Conn) } func testDial(t testing.T, n, listenAddr string, x dialTester) { server := newServer(t) sshConn := server.Dial(clientConfig()) defer sshConn.Close() l, err := net.Listen(n, listenAddr) if err != nil { t.Fatalf("Listen: %v", err) } defer l.Close() testData := fmt.Sprintf("hello from %s, %s", n, listenAddr) go func() { for { c, err := l.Accept() if err != nil { break } x.TestServerConn(t, c) io.WriteString(c, testData) c.Close() } }() ctx, cancel := context.WithCancel(context.Background()) conn, err := sshConn.DialContext(ctx, n, l.Addr().String()) // Canceling the context after dial should have no effect // on the opened connection. cancel() if err != nil { skipIfIssue64959(t, err) t.Fatalf("Dial: %v", err) } x.TestClientConn(t, conn) defer conn.Close() b, err := io.ReadAll(conn) if err != nil { t.Fatalf("ReadAll: %v", err) } t.Logf("got %q", string(b)) if string(b) != testData { t.Fatalf("expected %q, got %q", testData, string(b)) } } type tcpDialTester struct { listenAddr string } func (x tcpDialTester) TestServerConn(t testing.T, c net.Conn) { host := strings.Split(x.listenAddr, ":")[0] prefix := host + ":" if !strings.HasPrefix(c.LocalAddr().String(), prefix) { t.Fatalf("expected to start with %q, got %q", prefix, c.LocalAddr().String()) } if !strings.HasPrefix(c.RemoteAddr().String(), prefix) { t.Fatalf("expected to start with %q, got %q", prefix, c.RemoteAddr().String()) } } func (x tcpDialTester) TestClientConn(t testing.T, c net.Conn) { // we use zero addresses. see Client.Dial. if c.LocalAddr().String() != "0.0.0.0:0" { t.Fatalf("expected \"0.0.0.0:0\", got %q", c.LocalAddr().String()) } if c.RemoteAddr().String() != "0.0.0.0:0" { t.Fatalf("expected \"0.0.0.0:0\", got %q", c.RemoteAddr().String()) } } func TestDialTCP(t testing.T) { x := &tcpDialTester{ listenAddr: "127.0.0.1:0", } testDial(t, "tcp", x.listenAddr, x) } type unixDialTester struct { listenAddr string } func (x unixDialTester) TestServerConn(t testing.T, c net.Conn) { if c.LocalAddr().String() != x.listenAddr { t.Fatalf("expected %q, got %q", x.listenAddr, c.LocalAddr().String()) } if c.RemoteAddr().String() != "@" && c.RemoteAddr().String() != "" { t.Fatalf("expected \"@\" or \"\", got %q", c.RemoteAddr().String()) } } func (x unixDialTester) TestClientConn(t testing.T, c net.Conn) { if c.RemoteAddr().String() != x.listenAddr { t.Fatalf("expected %q, got %q", x.listenAddr, c.RemoteAddr().String()) } if c.LocalAddr().String() != "@" { t.Fatalf("expected \"@\", got %q", c.LocalAddr().String()) } } func TestDialUnix(t testing.T) { addr, cleanup := newTempSocket(t) defer cleanup() x := &unixDialTester{ listenAddr: addr, } testDial(t, "unix", x.listenAddr, x) }	3.18 KB	2025-05-25 12:27
📄 doc.go // Copyright 2012 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. // Package test contains integration tests for the // golang.org/x/crypto/ssh package. package test	260 B	2025-05-25 12:27
📄 forward_unix_test.go // Copyright 2012 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. //go:build aix \|\| darwin \|\| dragonfly \|\| freebsd \|\| linux \|\| netbsd \|\| openbsd \|\| solaris package test import ( "bytes" "fmt" "io" "math/rand" "net" "runtime" "testing" "time" ) type closeWriter interface { CloseWrite() error } func testPortForward(t testing.T, n, listenAddr string) { server := newServer(t) conn := server.Dial(clientConfig()) defer conn.Close() sshListener, err := conn.Listen(n, listenAddr) if err != nil { if runtime.GOOS == "darwin" && err == io.EOF { t.Skipf("skipping test broken on some versions of macOS; see https://go.dev/issue/64959") } t.Fatal(err) } errCh := make(chan error, 1) go func() { defer close(errCh) sshConn, err := sshListener.Accept() if err != nil { errCh <- fmt.Errorf("listen.Accept failed: %v", err) return } defer sshConn.Close() _, err = io.Copy(sshConn, sshConn) if err != nil && err != io.EOF { errCh <- fmt.Errorf("ssh client copy: %v", err) } }() forwardedAddr := sshListener.Addr().String() netConn, err := net.Dial(n, forwardedAddr) if err != nil { t.Fatalf("net dial failed: %v", err) } readChan := make(chan []byte) go func() { data, _ := io.ReadAll(netConn) readChan <- data }() // Invent some data. data := make([]byte, 1001000) for i := range data { data[i] = byte(i % 255) } var sent []byte for len(sent) < 10001000 { // Send random sized chunks m := rand.Intn(len(data)) n, err := netConn.Write(data[:m]) if err != nil { break } sent = append(sent, data[:n]...) } if err := netConn.(closeWriter).CloseWrite(); err != nil { t.Errorf("netConn.CloseWrite: %v", err) } // Check for errors on server goroutine err = <-errCh if err != nil { t.Fatalf("server: %v", err) } read := <-readChan if len(sent) != len(read) { t.Fatalf("got %d bytes, want %d", len(read), len(sent)) } if bytes.Compare(sent, read) != 0 { t.Fatalf("read back data does not match") } if err := sshListener.Close(); err != nil { t.Fatalf("sshListener.Close: %v", err) } // Check that the forward disappeared. netConn, err = net.Dial(n, forwardedAddr) if err == nil { netConn.Close() t.Errorf("still listening to %s after closing", forwardedAddr) } } func TestPortForwardTCP(t testing.T) { testPortForward(t, "tcp", "localhost:0") } func TestPortForwardUnix(t testing.T) { addr, cleanup := newTempSocket(t) defer cleanup() testPortForward(t, "unix", addr) } func testAcceptClose(t testing.T, n, listenAddr string) { server := newServer(t) conn := server.Dial(clientConfig()) sshListener, err := conn.Listen(n, listenAddr) if err != nil { if runtime.GOOS == "darwin" && err == io.EOF { t.Skipf("skipping test broken on some versions of macOS; see https://go.dev/issue/64959") } t.Fatal(err) } quit := make(chan error, 1) go func() { for { c, err := sshListener.Accept() if err != nil { quit <- err break } c.Close() } }() sshListener.Close() select { case <-time.After(1 * time.Second): t.Errorf("timeout: listener did not close.") case err := <-quit: t.Logf("quit as expected (error %v)", err) } } func TestAcceptCloseTCP(t testing.T) { testAcceptClose(t, "tcp", "localhost:0") } func TestAcceptCloseUnix(t testing.T) { addr, cleanup := newTempSocket(t) defer cleanup() testAcceptClose(t, "unix", addr) } // Check that listeners exit if the underlying client transport dies. func testPortForwardConnectionClose(t testing.T, n, listenAddr string) { server := newServer(t) client := server.Dial(clientConfig()) sshListener, err := client.Listen(n, listenAddr) if err != nil { if runtime.GOOS == "darwin" && err == io.EOF { t.Skipf("skipping test broken on some versions of macOS; see https://go.dev/issue/64959") } t.Fatal(err) } quit := make(chan error, 1) go func() { for { c, err := sshListener.Accept() if err != nil { quit <- err break } c.Close() } }() // It would be even nicer if we closed the server side, but it // is more involved as the fd for that side is dup()ed. server.lastDialConn.Close() err = <-quit t.Logf("quit as expected (error %v)", err) } func TestPortForwardConnectionCloseTCP(t testing.T) { testPortForwardConnectionClose(t, "tcp", "localhost:0") } func TestPortForwardConnectionCloseUnix(t *testing.T) { addr, cleanup := newTempSocket(t) defer cleanup() testPortForwardConnectionClose(t, "unix", addr) }	4.48 KB	2025-05-25 12:27
📄 multi_auth_test.go // Copyright 2017 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. // Tests for ssh client multi-auth // // These tests run a simple go ssh client against OpenSSH server // over unix domain sockets. The tests use multiple combinations // of password, keyboard-interactive and publickey authentication // methods. // // A wrapper library for making sshd PAM authentication use test // passwords is required in ./sshd_test_pw.so. If the library does // not exist these tests will be skipped. See compile instructions // (for linux) in file ./sshd_test_pw.c. //go:build linux package test import ( "fmt" "strings" "testing" "golang.org/x/crypto/ssh" ) // test cases type multiAuthTestCase struct { authMethods []string expectedPasswordCbs int expectedKbdIntCbs int } // test context type multiAuthTestCtx struct { password string numPasswordCbs int numKbdIntCbs int } // create test context func newMultiAuthTestCtx(t testing.T) multiAuthTestCtx { password, err := randomPassword() if err != nil { t.Fatalf("Failed to generate random test password: %s", err.Error()) } return &multiAuthTestCtx{ password: password, } } // password callback func (ctx multiAuthTestCtx) passwordCb() (secret string, err error) { ctx.numPasswordCbs++ return ctx.password, nil } // keyboard-interactive callback func (ctx multiAuthTestCtx) kbdIntCb(user, instruction string, questions []string, echos []bool) (answers []string, err error) { if len(questions) == 0 { return nil, nil } ctx.numKbdIntCbs++ if len(questions) == 1 { return []string{ctx.password}, nil } return nil, fmt.Errorf("unsupported keyboard-interactive flow") } // TestMultiAuth runs several subtests for different combinations of password, keyboard-interactive and publickey authentication methods func TestMultiAuth(t testing.T) { testCases := []multiAuthTestCase{ // Test password,publickey authentication, assert that password callback is called 1 time { authMethods: []string{"password", "publickey"}, expectedPasswordCbs: 1, }, // Test keyboard-interactive,publickey authentication, assert that keyboard-interactive callback is called 1 time { authMethods: []string{"keyboard-interactive", "publickey"}, expectedKbdIntCbs: 1, }, // Test publickey,password authentication, assert that password callback is called 1 time { authMethods: []string{"publickey", "password"}, expectedPasswordCbs: 1, }, // Test publickey,keyboard-interactive authentication, assert that keyboard-interactive callback is called 1 time { authMethods: []string{"publickey", "keyboard-interactive"}, expectedKbdIntCbs: 1, }, // Test password,password authentication, assert that password callback is called 2 times { authMethods: []string{"password", "password"}, expectedPasswordCbs: 2, }, } for _, testCase := range testCases { t.Run(strings.Join(testCase.authMethods, ","), func(t testing.T) { ctx := newMultiAuthTestCtx(t) server := newServerForConfig(t, "MultiAuth", map[string]string{"AuthMethods": strings.Join(testCase.authMethods, ",")}) clientConfig := clientConfig() server.setTestPassword(clientConfig.User, ctx.password) publicKeyAuthMethod := clientConfig.Auth[0] clientConfig.Auth = nil for _, authMethod := range testCase.authMethods { switch authMethod { case "publickey": clientConfig.Auth = append(clientConfig.Auth, publicKeyAuthMethod) case "password": clientConfig.Auth = append(clientConfig.Auth, ssh.RetryableAuthMethod(ssh.PasswordCallback(ctx.passwordCb), 5)) case "keyboard-interactive": clientConfig.Auth = append(clientConfig.Auth, ssh.RetryableAuthMethod(ssh.KeyboardInteractive(ctx.kbdIntCb), 5)) default: t.Fatalf("Unknown authentication method %s", authMethod) } } conn := server.Dial(clientConfig) defer conn.Close() if ctx.numPasswordCbs != testCase.expectedPasswordCbs { t.Fatalf("passwordCallback was called %d times, expected %d times", ctx.numPasswordCbs, testCase.expectedPasswordCbs) } if ctx.numKbdIntCbs != testCase.expectedKbdIntCbs { t.Fatalf("keyboardInteractiveCallback was called %d times, expected %d times", ctx.numKbdIntCbs, testCase.expectedKbdIntCbs) } }) } }	4.31 KB	2025-05-25 12:27
📄 server_test.go // Copyright 2023 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package test import ( "net" "golang.org/x/crypto/ssh" ) type exitStatusMsg struct { Status uint32 } // goTestServer is a test Go SSH server that accepts public key and certificate // authentication and replies with a 0 exit status to any exec request without // running any commands. type goTestServer struct { listener net.Listener config ssh.ServerConfig done <-chan struct{} } func newTestServer(config ssh.ServerConfig) (goTestServer, error) { server := &goTestServer{ config: config, } listener, err := net.Listen("tcp", "127.0.0.1:") if err != nil { return nil, err } server.listener = listener done := make(chan struct{}, 1) server.done = done go server.acceptConnections(done) return server, nil } func (s goTestServer) port() (string, error) { _, port, err := net.SplitHostPort(s.listener.Addr().String()) return port, err } func (s goTestServer) acceptConnections(done chan<- struct{}) { defer close(done) for { c, err := s.listener.Accept() if err != nil { return } _, chans, reqs, err := ssh.NewServerConn(c, s.config) if err != nil { return } go ssh.DiscardRequests(reqs) defer c.Close() for newChannel := range chans { if newChannel.ChannelType() != "session" { newChannel.Reject(ssh.UnknownChannelType, "unknown channel type") continue } channel, requests, err := newChannel.Accept() if err != nil { continue } go func(in <-chan ssh.Request) { for req := range in { ok := false switch req.Type { case "exec": ok = true go func() { channel.SendRequest("exit-status", false, ssh.Marshal(&exitStatusMsg{Status: 0})) channel.Close() }() } if req.WantReply { req.Reply(ok, nil) } } }(requests) } } } func (s *goTestServer) Close() error { err := s.listener.Close() // wait for the accept loop to exit <-s.done return err }	2.03 KB	2025-05-25 12:27
📄 session_test.go // Copyright 2012 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. //go:build !windows && !js && !wasip1 package test // Session functional tests. import ( "bytes" "errors" "fmt" "io" "path/filepath" "regexp" "runtime" "strings" "testing" "golang.org/x/crypto/ssh" ) func skipIfIssue64959(t testing.T, err error) { if err != nil && runtime.GOOS == "darwin" && strings.Contains(err.Error(), "ssh: unexpected packet in response to channel open: <nil>") { t.Helper() t.Skipf("skipping test broken on some versions of macOS; see https://go.dev/issue/64959") } } func TestRunCommandSuccess(t testing.T) { server := newServer(t) conn := server.Dial(clientConfig()) defer conn.Close() session, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("session failed: %v", err) } defer session.Close() err = session.Run("true") if err != nil { t.Fatalf("session failed: %v", err) } } func TestHostKeyCheck(t testing.T) { server := newServer(t) conf := clientConfig() hostDB := hostKeyDB() conf.HostKeyCallback = hostDB.Check // change the keys. hostDB.keys[ssh.KeyAlgoRSA][25]++ hostDB.keys[ssh.KeyAlgoDSA][25]++ hostDB.keys[ssh.KeyAlgoECDSA256][25]++ conn, err := server.TryDial(conf) if err == nil { conn.Close() t.Fatalf("dial should have failed.") } else if !strings.Contains(err.Error(), "host key mismatch") { t.Fatalf("'host key mismatch' not found in %v", err) } } func TestRunCommandStdin(t testing.T) { server := newServer(t) conn := server.Dial(clientConfig()) defer conn.Close() session, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("session failed: %v", err) } defer session.Close() r, w := io.Pipe() defer r.Close() defer w.Close() session.Stdin = r err = session.Run("true") if err != nil { t.Fatalf("session failed: %v", err) } } func TestRunCommandStdinError(t testing.T) { server := newServer(t) conn := server.Dial(clientConfig()) defer conn.Close() session, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("session failed: %v", err) } defer session.Close() r, w := io.Pipe() defer r.Close() session.Stdin = r pipeErr := errors.New("closing write end of pipe") w.CloseWithError(pipeErr) err = session.Run("true") if err != pipeErr { t.Fatalf("expected %v, found %v", pipeErr, err) } } func TestRunCommandFailed(t testing.T) { server := newServer(t) conn := server.Dial(clientConfig()) defer conn.Close() session, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("session failed: %v", err) } defer session.Close() err = session.Run(`bash -c "kill -9 $$"`) if err == nil { t.Fatalf("session succeeded: %v", err) } } func TestRunCommandWeClosed(t testing.T) { server := newServer(t) conn := server.Dial(clientConfig()) defer conn.Close() session, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("session failed: %v", err) } err = session.Shell() if err != nil { t.Fatalf("shell failed: %v", err) } err = session.Close() if err != nil { t.Fatalf("shell failed: %v", err) } } func TestFuncLargeRead(t testing.T) { server := newServer(t) conn := server.Dial(clientConfig()) defer conn.Close() session, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("unable to create new session: %s", err) } stdout, err := session.StdoutPipe() if err != nil { t.Fatalf("unable to acquire stdout pipe: %s", err) } err = session.Start("dd if=/dev/urandom bs=2048 count=1024") if err != nil { t.Fatalf("unable to execute remote command: %s", err) } buf := new(bytes.Buffer) n, err := io.Copy(buf, stdout) if err != nil { t.Fatalf("error reading from remote stdout: %s", err) } if n != 20481024 { t.Fatalf("Expected %d bytes but read only %d from remote command", 2048, n) } } func TestKeyChange(t testing.T) { server := newServer(t) conf := clientConfig() hostDB := hostKeyDB() conf.HostKeyCallback = hostDB.Check conf.RekeyThreshold = 1024 conn := server.Dial(conf) defer conn.Close() for i := 0; i < 4; i++ { session, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("unable to create new session: %s", err) } stdout, err := session.StdoutPipe() if err != nil { t.Fatalf("unable to acquire stdout pipe: %s", err) } err = session.Start("dd if=/dev/urandom bs=1024 count=1") if err != nil { t.Fatalf("unable to execute remote command: %s", err) } buf := new(bytes.Buffer) n, err := io.Copy(buf, stdout) if err != nil { t.Fatalf("error reading from remote stdout: %s", err) } want := int64(1024) if n != want { t.Fatalf("Expected %d bytes but read only %d from remote command", want, n) } } if changes := hostDB.checkCount; changes < 4 { t.Errorf("got %d key changes, want 4", changes) } } func TestValidTerminalMode(t testing.T) { if runtime.GOOS == "aix" { // On AIX, sshd cannot acquire /dev/pts/ if launched as // a non-root user. t.Skipf("skipping on %s", runtime.GOOS) } server := newServer(t) conn := server.Dial(clientConfig()) defer conn.Close() session, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("session failed: %v", err) } defer session.Close() stdout, err := session.StdoutPipe() if err != nil { t.Fatalf("unable to acquire stdout pipe: %s", err) } stdin, err := session.StdinPipe() if err != nil { t.Fatalf("unable to acquire stdin pipe: %s", err) } tm := ssh.TerminalModes{ssh.ECHO: 0} if err = session.RequestPty("xterm", 80, 40, tm); err != nil { t.Fatalf("req-pty failed: %s", err) } err = session.Shell() if err != nil { t.Fatalf("session failed: %s", err) } if _, err := io.WriteString(stdin, "echo && echo SHELL $SHELL && stty -a && exit\n"); err != nil { t.Fatal(err) } buf := new(strings.Builder) if _, err := io.Copy(buf, stdout); err != nil { t.Fatalf("reading failed: %s", err) } if testing.Verbose() { t.Logf("echo && echo SHELL $SHELL && stty -a && exit:\n%s", buf) } shellLine := regexp.MustCompile("(?m)^SHELL (.)$").FindStringSubmatch(buf.String()) if len(shellLine) != 2 { t.Fatalf("missing output from echo SHELL $SHELL") } switch shell := filepath.Base(strings.TrimSpace(shellLine[1])); shell { case "sh", "bash": default: t.Skipf("skipping test on non-Bourne shell %q", shell) } if sttyOutput := buf.String(); !strings.Contains(sttyOutput, "-echo ") { t.Fatal("terminal mode failure: expected -echo in stty output") } } func TestWindowChange(t testing.T) { if runtime.GOOS == "aix" { // On AIX, sshd cannot acquire /dev/pts/* if launched as // a non-root user. t.Skipf("skipping on %s", runtime.GOOS) } server := newServer(t) conn := server.Dial(clientConfig()) defer conn.Close() session, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("session failed: %v", err) } defer session.Close() stdout, err := session.StdoutPipe() if err != nil { t.Fatalf("unable to acquire stdout pipe: %s", err) } stdin, err := session.StdinPipe() if err != nil { t.Fatalf("unable to acquire stdin pipe: %s", err) } tm := ssh.TerminalModes{ssh.ECHO: 0} if err = session.RequestPty("xterm", 80, 40, tm); err != nil { t.Fatalf("req-pty failed: %s", err) } if err := session.WindowChange(100, 100); err != nil { t.Fatalf("window-change failed: %s", err) } err = session.Shell() if err != nil { t.Fatalf("session failed: %s", err) } stdin.Write([]byte("stty size && exit\n")) var buf bytes.Buffer if _, err := io.Copy(&buf, stdout); err != nil { t.Fatalf("reading failed: %s", err) } if sttyOutput := buf.String(); !strings.Contains(sttyOutput, "100 100") { t.Fatalf("terminal WindowChange failure: expected \"100 100\" stty output, got %s", sttyOutput) } } func testOneCipher(t testing.T, cipher string, cipherOrder []string) { server := newServer(t) conf := clientConfig() conf.Ciphers = []string{cipher} // Don't fail if sshd doesn't have the cipher. conf.Ciphers = append(conf.Ciphers, cipherOrder...) conn, err := server.TryDial(conf) if err != nil { t.Fatalf("TryDial: %v", err) } defer conn.Close() numBytes := 4096 // Exercise receiving data from the server session, err := conn.NewSession() if err != nil { skipIfIssue64959(t, err) t.Fatalf("NewSession: %v", err) } out, err := session.Output(fmt.Sprintf("dd if=/dev/zero bs=%d count=1", numBytes)) if err != nil { t.Fatalf("Output: %v", err) } if len(out) != numBytes { t.Fatalf("got %d bytes, want %d bytes", len(out), numBytes) } // Exercise sending data to the server if _, _, err := conn.Conn.SendRequest("drop-me", false, make([]byte, numBytes)); err != nil { t.Fatalf("SendRequest: %v", err) } } var deprecatedCiphers = []string{ "aes128-cbc", "3des-cbc", "arcfour128", "arcfour256", } func TestCiphers(t testing.T) { var config ssh.Config config.SetDefaults() cipherOrder := append(config.Ciphers, deprecatedCiphers...) for _, ciph := range cipherOrder { t.Run(ciph, func(t testing.T) { testOneCipher(t, ciph, cipherOrder) }) } } func TestMACs(t testing.T) { var config ssh.Config config.SetDefaults() macOrder := config.MACs for _, mac := range macOrder { t.Run(mac, func(t testing.T) { server := newServer(t) conf := clientConfig() conf.MACs = []string{mac} // Don't fail if sshd doesn't have the MAC. conf.MACs = append(conf.MACs, macOrder...) if conn, err := server.TryDial(conf); err == nil { conn.Close() } else { t.Fatalf("failed for MAC %q", mac) } }) } } func TestKeyExchanges(t testing.T) { var config ssh.Config config.SetDefaults() kexOrder := config.KeyExchanges // Based on the discussion in #17230, the key exchange algorithms // diffie-hellman-group-exchange-sha1 and diffie-hellman-group-exchange-sha256 // are not included in the default list of supported kex so we have to add them // here manually. kexOrder = append(kexOrder, "diffie-hellman-group-exchange-sha1", "diffie-hellman-group-exchange-sha256") // The key exchange algorithms diffie-hellman-group16-sha512 is disabled by // default so we add it here manually. kexOrder = append(kexOrder, "diffie-hellman-group16-sha512") for _, kex := range kexOrder { t.Run(kex, func(t testing.T) { server := newServer(t) conf := clientConfig() // Don't fail if sshd doesn't have the kex. conf.KeyExchanges = append([]string{kex}, kexOrder...) conn, err := server.TryDial(conf) if err == nil { conn.Close() } else { t.Errorf("failed for kex %q", kex) } }) } } func TestClientAuthAlgorithms(t testing.T) { for _, key := range []string{ "rsa", "ecdsa", "ed25519", } { t.Run(key, func(t testing.T) { server := newServer(t) conf := clientConfig() conf.SetDefaults() conf.Auth = []ssh.AuthMethod{ ssh.PublicKeys(testSigners[key]), } conn, err := server.TryDial(conf) if err == nil { conn.Close() } else { t.Errorf("failed for key %q", key) } }) } } func TestClientAuthDisconnect(t testing.T) { // Use a static key that is not accepted by server. // This key has been generated with following ssh-keygen command and // used exclusively in this unit test: // $ ssh-keygen -t RSA -b 2048 -f /tmp/static_key \ // -C "Static RSA key for golang.org/x/crypto/ssh unit test" const privKeyData = `-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn NhAAAAAwEAAQAAAQEAwV1Zg3MqX27nIQQNWd8V09P4q4F1fx7H2xNJdL3Yg3y91GFLJ92+ 0IiGV8n1VMGL/71PPhzyqBpUYSTpWjiU2JZSfA+iTg1GJBcOaEOA6vrXsTtXTHZ//mOT4d mlvuP4+9NqfCBLGXN7ZJpT+amkD8AVW9YW9QN3ipY61ZWxPaAocVpDd8rVgJTk54KvaPa7 t4ddOSQDQq61aubIDR1Z3P+XjkB4piWOsbck3HJL+veTALy12C09tAhwUnZUAXS+DjhxOL xpDVclF/yXYhAvBvsjwyk/OC3+nK9F799hpQZsjxmbP7oN+tGwz06BUcAKi7u7QstENvvk 85SDZy1q1QAAA/A7ylbJO8pWyQAAAAdzc2gtcnNhAAABAQDBXVmDcypfbuchBA1Z3xXT0/ irgXV/HsfbE0l0vdiDfL3UYUsn3b7QiIZXyfVUwYv/vU8+HPKoGlRhJOlaOJTYllJ8D6JO DUYkFw5oQ4Dq+texO1dMdn/+Y5Ph2aW+4/j702p8IEsZc3tkmlP5qaQPwBVb1hb1A3eKlj rVlbE9oChxWkN3ytWAlOTngq9o9ru3h105JANCrrVq5sgNHVnc/5eOQHimJY6xtyTcckv6 95MAvLXYLT20CHBSdlQBdL4OOHE4vGkNVyUX/JdiEC8G+yPDKT84Lf6cr0Xv32GlBmyPGZ s/ug360bDPToFRwAqLu7tCy0Q2++TzlINnLWrVAAAAAwEAAQAAAQAIvPDHMiyIxgCksGPF uyv9F9U4XjVip8/abE9zkAMJWW5++wuT/bRlBOUPRrWIXZEM9ETbtsqswo3Wxah+7CjRIH qR7SdFlYTP1jPk4yIKXF4OvggBUPySkMpAGJ9hwOMW8Ymcb4gn77JJ4aMoWIcXssje+XiC 8iO+4UWU3SV2i6K7flK1UDCI5JVCyBr3DVf3QhMOgvwJl9TgD7FzWy1hkjuZq/Pzdv+fA2 OfrUFiSukLNolidNoI9+KWa1yxixE+B2oN4Xan3ZbqGbL6Wc1dB+K9h/bNcu+SKf7fXWRi /vVG44A61xGDZzen1+eQlqFp7narkKXoaU71+45VXDThAAAAgBPWUdQykEEm0yOS6hPIW+ hS8z1LXWGTEcag9fMwJXKE7cQFO3LEk+dXMbClHdhD/ydswOZYGSNepxwvmo/a5LiO2ulp W+5tnsNhcK3skdaf71t+boUEXBNZ6u3WNTkU7tDN8h9tebI+xlNceDGSGjOlNoHQVMKZdA W9TA4ZqXUPAAAAgQDWU0UZVOSCAOODPz4PYsbFKdCfXNP8O4+t9txyc9E3hsLAsVs+CpVX Gr219MGLrublzAxojipyzuQb6Tp1l9nsu7VkcBrPL8I1tokz0AyTnmNF3A9KszBal7gGNS a2qYuf6JO4cub1KzonxUJQHZPZq9YhCxOtDwTd+uyHZiPy9QAAAIEA5vayd+nfVJgCKTdf z5MFsxBSUj/cAYg7JYPS/0bZ5bEkLosL22wl5Tm/ZftJa8apkyBPhguAWt6jEWLoDiK+kn Fv0SaEq1HUdXgWmISVnWzv2pxdAtq/apmbxTg3iIJyrAwEDo13iImR3k6rNPx1m3i/jX56 HLcvWM4Y6bFzbGEAAAA0U3RhdGljIFJTQSBrZXkgZm9yIGdvbGFuZy5vcmcveC9jcnlwdG 8vc3NoIHVuaXQgdGVzdAECAwQFBgc= -----END OPENSSH PRIVATE KEY-----` signer, err := ssh.ParsePrivateKey([]byte(privKeyData)) if err != nil { t.Fatalf("failed to create signer from key: %v", err) } // Start server with MaxAuthTries 1 and publickey and password auth // enabled server := newServerForConfig(t, "MaxAuthTries", map[string]string{}) // Connect to server, expect failure, that PublicKeysCallback is called // and that PasswordCallback is not called. publicKeysCallbackCalled := false config := clientConfig() config.Auth = []ssh.AuthMethod{ ssh.PublicKeysCallback(func() ([]ssh.Signer, error) { publicKeysCallbackCalled = true return []ssh.Signer{signer}, nil }), ssh.PasswordCallback(func() (string, error) { t.Errorf("unexpected call to PasswordCallback()") return "notaverygoodpassword", nil }), } client, err := server.TryDial(config) if err == nil { t.Errorf("expected TryDial() to fail") _ = client.Close() } if !publicKeysCallbackCalled { t.Errorf("expected PublicKeysCallback() to be called") } }	14.11 KB	2025-05-25 12:27
📄 sshcli_test.go // Copyright 2023 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package test import ( "bytes" "fmt" "os" "os/exec" "path/filepath" "runtime" "testing" "golang.org/x/crypto/internal/testenv" "golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh/testdata" ) func sshClient(t testing.T) string { if testing.Short() { t.Skip("Skipping test that executes OpenSSH in -short mode") } sshCLI := os.Getenv("SSH_CLI_PATH") if sshCLI == "" { sshCLI = "ssh" } var err error sshCLI, err = exec.LookPath(sshCLI) if err != nil { t.Skipf("Can't find an ssh(1) client to test against: %v", err) } return sshCLI } func TestSSHCLIAuth(t testing.T) { if runtime.GOOS == "windows" { t.Skipf("always fails on Windows, see #64403") } sshCLI := sshClient(t) dir := t.TempDir() keyPrivPath := filepath.Join(dir, "rsa") for fn, content := range map[string][]byte{ keyPrivPath: testdata.PEMBytes["rsa"], keyPrivPath + ".pub": ssh.MarshalAuthorizedKey(testPublicKeys["rsa"]), filepath.Join(dir, "rsa-cert.pub"): testdata.SSHCertificates["rsa-user-testcertificate"], } { if err := os.WriteFile(fn, content, 0600); err != nil { t.Fatalf("WriteFile(%q): %v", fn, err) } } certChecker := ssh.CertChecker{ IsUserAuthority: func(k ssh.PublicKey) bool { return bytes.Equal(k.Marshal(), testPublicKeys["ca"].Marshal()) }, UserKeyFallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) { if conn.User() == "testpubkey" && bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) { return nil, nil } return nil, fmt.Errorf("pubkey for %q not acceptable", conn.User()) }, } config := &ssh.ServerConfig{ PublicKeyCallback: certChecker.Authenticate, } config.AddHostKey(testSigners["rsa"]) server, err := newTestServer(config) if err != nil { t.Fatalf("unable to start test server: %v", err) } defer server.Close() port, err := server.port() if err != nil { t.Fatalf("unable to get server port: %v", err) } // test public key authentication. cmd := testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no", "-p", port, "testpubkey@127.0.0.1", "true") out, err := cmd.CombinedOutput() if err != nil { t.Fatalf("public key authentication failed, error: %v, command output %q", err, string(out)) } // Test SSH user certificate authentication. // The username must match one of the principals included in the certificate. // The certificate "rsa-user-testcertificate" has "testcertificate" as principal. cmd = testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no", "-p", port, "testcertificate@127.0.0.1", "true") out, err = cmd.CombinedOutput() if err != nil { t.Fatalf("user certificate authentication failed, error: %v, command output %q", err, string(out)) } }	2.9 KB	2025-05-25 12:27
📄 sshd_test_pw.c // Copyright 2017 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. // sshd_test_pw.c // Wrapper to inject test password data for sshd PAM authentication // // This wrapper implements custom versions of getpwnam, getpwnam_r, // getspnam and getspnam_r. These functions first call their real // libc versions, then check if the requested user matches test user // specified in env variable TEST_USER and if so replace the password // with crypted() value of TEST_PASSWD env variable. // // Compile: // gcc -Wall -shared -o sshd_test_pw.so -fPIC sshd_test_pw.c // // Compile with debug: // gcc -DVERBOSE -Wall -shared -o sshd_test_pw.so -fPIC sshd_test_pw.c // // Run sshd: // LD_PRELOAD="sshd_test_pw.so" TEST_USER="..." TEST_PASSWD="..." sshd ... //go:build ignore #define _GNU_SOURCE #include <string.h> #include <pwd.h> #include <shadow.h> #include <dlfcn.h> #include <stdlib.h> #include <unistd.h> #include <stdio.h> #ifdef VERBOSE #define DEBUG(X...) fprintf(stderr, X) #else #define DEBUG(X...) while (0) { } #endif /* crypt() password / static char pwhash(char passwd) { return strdup(crypt(passwd, "$6$")); } / Pointers to real functions in libc / static struct passwd (real_getpwnam)(const char ) = NULL; static int (real_getpwnam_r)(const char , struct passwd , char , size_t, struct passwd *) = NULL; static struct spwd (real_getspnam)(const char ) = NULL; static int (real_getspnam_r)(const char , struct spwd , char , size_t, struct spwd *) = NULL; / Cached test user and test password / static char test_user = NULL; static char test_passwd_hash = NULL; static void init(void) { / Fetch real libc function pointers / real_getpwnam = dlsym(RTLD_NEXT, "getpwnam"); real_getpwnam_r = dlsym(RTLD_NEXT, "getpwnam_r"); real_getspnam = dlsym(RTLD_NEXT, "getspnam"); real_getspnam_r = dlsym(RTLD_NEXT, "getspnam_r"); / abort if env variables are not defined / if (getenv("TEST_USER") == NULL \|\| getenv("TEST_PASSWD") == NULL) { fprintf(stderr, "env variables TEST_USER and TEST_PASSWD are missing\n"); abort(); } / Fetch test user and test password from env / test_user = strdup(getenv("TEST_USER")); test_passwd_hash = pwhash(getenv("TEST_PASSWD")); DEBUG("sshd_test_pw init():\n"); DEBUG("\treal_getpwnam: %p\n", real_getpwnam); DEBUG("\treal_getpwnam_r: %p\n", real_getpwnam_r); DEBUG("\treal_getspnam: %p\n", real_getspnam); DEBUG("\treal_getspnam_r: %p\n", real_getspnam_r); DEBUG("\tTEST_USER: '%s'\n", test_user); DEBUG("\tTEST_PASSWD: '%s'\n", getenv("TEST_PASSWD")); DEBUG("\tTEST_PASSWD_HASH: '%s'\n", test_passwd_hash); } static int is_test_user(const char name) { if (test_user != NULL && strcmp(test_user, name) == 0) return 1; return 0; } /* getpwnam / struct passwd getpwnam(const char name) { struct passwd pw; DEBUG("sshd_test_pw getpwnam(%s)\n", name); if (real_getpwnam == NULL) init(); if ((pw = real_getpwnam(name)) == NULL) return NULL; if (is_test_user(name)) pw->pw_passwd = strdup(test_passwd_hash); return pw; } /* getpwnam_r / int getpwnam_r(const char name, struct passwd pwd, char buf, size_t buflen, struct passwd *result) { int r; DEBUG("sshd_test_pw getpwnam_r(%s)\n", name); if (real_getpwnam_r == NULL) init(); if ((r = real_getpwnam_r(name, pwd, buf, buflen, result)) != 0 \|\| result == NULL) return r; if (is_test_user(name)) pwd->pw_passwd = strdup(test_passwd_hash); return 0; } /* getspnam / struct spwd getspnam(const char name) { struct spwd sp; DEBUG("sshd_test_pw getspnam(%s)\n", name); if (real_getspnam == NULL) init(); if ((sp = real_getspnam(name)) == NULL) return NULL; if (is_test_user(name)) sp->sp_pwdp = strdup(test_passwd_hash); return sp; } /* getspnam_r / int getspnam_r(const char name, struct spwd spbuf, char buf, size_t buflen, struct spwd **spbufp) { int r; DEBUG("sshd_test_pw getspnam_r(%s)\n", name); if (real_getspnam_r == NULL) init(); if ((r = real_getspnam_r(name, spbuf, buf, buflen, spbufp)) != 0) return r; if (is_test_user(name)) spbuf->sp_pwdp = strdup(test_passwd_hash); return r; }	4.25 KB	2025-05-25 12:27
📄 test_unix_test.go // Copyright 2012 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. //go:build aix \|\| darwin \|\| dragonfly \|\| freebsd \|\| linux \|\| netbsd \|\| openbsd \|\| plan9 \|\| solaris package test // functional test harness for unix. import ( "bytes" "crypto/rand" "encoding/base64" "fmt" "log" "net" "os" "os/exec" "os/user" "path/filepath" "testing" "text/template" "golang.org/x/crypto/internal/testenv" "golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh/testdata" ) const ( defaultSshdConfig = ` Protocol 2 Banner {{.Dir}}/banner HostKey {{.Dir}}/id_rsa HostKey {{.Dir}}/id_dsa HostKey {{.Dir}}/id_ecdsa HostCertificate {{.Dir}}/id_rsa-sha2-512-cert.pub Pidfile {{.Dir}}/sshd.pid #UsePrivilegeSeparation no KeyRegenerationInterval 3600 ServerKeyBits 768 SyslogFacility AUTH LogLevel DEBUG2 LoginGraceTime 120 PermitRootLogin no StrictModes no RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile {{.Dir}}/authorized_keys TrustedUserCAKeys {{.Dir}}/id_ecdsa.pub IgnoreRhosts yes RhostsRSAAuthentication no HostbasedAuthentication no PubkeyAcceptedKeyTypes=* ` multiAuthSshdConfigTail = ` UsePAM yes PasswordAuthentication yes ChallengeResponseAuthentication yes AuthenticationMethods {{.AuthMethods}} ` maxAuthTriesSshdConfigTail = ` PasswordAuthentication yes MaxAuthTries 1 ` ) var configTmpl = map[string]template.Template{ "default": template.Must(template.New("").Parse(defaultSshdConfig)), "MultiAuth": template.Must(template.New("").Parse(defaultSshdConfig + multiAuthSshdConfigTail)), "MaxAuthTries": template.Must(template.New("").Parse(defaultSshdConfig + maxAuthTriesSshdConfigTail))} type server struct { t testing.T configfile string testUser string // test username for sshd testPasswd string // test password for sshd sshdTestPwSo string // dynamic library to inject a custom password into sshd lastDialConn net.Conn } func username() string { var username string if user, err := user.Current(); err == nil { username = user.Username } else { // user.Current() currently requires cgo. If an error is // returned attempt to get the username from the environment. log.Printf("user.Current: %v; falling back on $USER", err) username = os.Getenv("USER") } if username == "" { panic("Unable to get username") } return username } type storedHostKey struct { // keys map from an algorithm string to binary key data. keys map[string][]byte // checkCount counts the Check calls. Used for testing // rekeying. checkCount int } func (k storedHostKey) Add(key ssh.PublicKey) { if k.keys == nil { k.keys = map[string][]byte{} } k.keys[key.Type()] = key.Marshal() } func (k storedHostKey) Check(addr string, remote net.Addr, key ssh.PublicKey) error { k.checkCount++ algo := key.Type() if k.keys == nil \|\| bytes.Compare(key.Marshal(), k.keys[algo]) != 0 { return fmt.Errorf("host key mismatch. Got %q, want %q", key, k.keys[algo]) } return nil } func hostKeyDB() storedHostKey { keyChecker := &storedHostKey{} keyChecker.Add(testPublicKeys["ecdsa"]) keyChecker.Add(testPublicKeys["rsa"]) keyChecker.Add(testPublicKeys["dsa"]) return keyChecker } func clientConfig() ssh.ClientConfig { config := &ssh.ClientConfig{ User: username(), Auth: []ssh.AuthMethod{ ssh.PublicKeys(testSigners["user"]), }, HostKeyCallback: hostKeyDB().Check, HostKeyAlgorithms: []string{ // by default, don't allow certs as this affects the hostKeyDB checker ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521, ssh.KeyAlgoRSA, ssh.KeyAlgoDSA, ssh.KeyAlgoED25519, }, } return config } // unixConnection creates two halves of a connected net.UnixConn. It // is used for connecting the Go SSH client with sshd without opening // ports. func unixConnection() (net.UnixConn, net.UnixConn, error) { dir, err := os.MkdirTemp("", "unixConnection") if err != nil { return nil, nil, err } defer os.Remove(dir) addr := filepath.Join(dir, "ssh") listener, err := net.Listen("unix", addr) if err != nil { return nil, nil, err } defer listener.Close() c1, err := net.Dial("unix", addr) if err != nil { return nil, nil, err } c2, err := listener.Accept() if err != nil { c1.Close() return nil, nil, err } return c1.(net.UnixConn), c2.(net.UnixConn), nil } func (s server) TryDial(config ssh.ClientConfig) (ssh.Client, error) { return s.TryDialWithAddr(config, "") } // addr is the user specified host:port. While we don't actually dial it, // we need to know this for host key matching func (s server) TryDialWithAddr(config ssh.ClientConfig, addr string) (client ssh.Client, err error) { sshd, err := exec.LookPath("sshd") if err != nil { s.t.Skipf("skipping test: %v", err) } c1, c2, err := unixConnection() if err != nil { s.t.Fatalf("unixConnection: %v", err) } defer func() { // Close c2 after we've started the sshd command so that it won't prevent c1 // from returning EOF when the sshd command exits. c2.Close() // Leave c1 open if we're returning a client that wraps it. // (The client is responsible for closing it.) // Otherwise, close it to free up the socket. if client == nil { c1.Close() } }() f, err := c2.File() if err != nil { s.t.Fatalf("UnixConn.File: %v", err) } defer f.Close() cmd := testenv.Command(s.t, sshd, "-f", s.configfile, "-i", "-e") cmd.Stdin = f cmd.Stdout = f cmd.Stderr = new(bytes.Buffer) if s.sshdTestPwSo != "" { if s.testUser == "" { s.t.Fatal("user missing from sshd_test_pw.so config") } if s.testPasswd == "" { s.t.Fatal("password missing from sshd_test_pw.so config") } cmd.Env = append(os.Environ(), fmt.Sprintf("LD_PRELOAD=%s", s.sshdTestPwSo), fmt.Sprintf("TEST_USER=%s", s.testUser), fmt.Sprintf("TEST_PASSWD=%s", s.testPasswd)) } if err := cmd.Start(); err != nil { s.t.Fatalf("s.cmd.Start: %v", err) } s.lastDialConn = c1 s.t.Cleanup(func() { // Don't check for errors; if it fails it's most // likely "os: process already finished", and we don't // care about that. Use os.Interrupt, so child // processes are killed too. cmd.Process.Signal(os.Interrupt) cmd.Wait() if s.t.Failed() \|\| testing.Verbose() { // log any output from sshd process s.t.Logf("sshd:\n%s", cmd.Stderr) } }) conn, chans, reqs, err := ssh.NewClientConn(c1, addr, config) if err != nil { return nil, err } return ssh.NewClient(conn, chans, reqs), nil } func (s server) Dial(config ssh.ClientConfig) ssh.Client { conn, err := s.TryDial(config) if err != nil { s.t.Fatalf("ssh.Client: %v", err) } return conn } func writeFile(path string, contents []byte) { f, err := os.OpenFile(path, os.O_WRONLY\|os.O_TRUNC\|os.O_CREATE, 0600) if err != nil { panic(err) } defer f.Close() if _, err := f.Write(contents); err != nil { panic(err) } } // generate random password func randomPassword() (string, error) { b := make([]byte, 12) _, err := rand.Read(b) if err != nil { return "", err } return base64.RawURLEncoding.EncodeToString(b), nil } // setTestPassword is used for setting user and password data for sshd_test_pw.so // This function also checks that ./sshd_test_pw.so exists and if not calls s.t.Skip() func (s server) setTestPassword(user, passwd string) error { wd, _ := os.Getwd() wrapper := filepath.Join(wd, "sshd_test_pw.so") if _, err := os.Stat(wrapper); err != nil { s.t.Skip(fmt.Errorf("sshd_test_pw.so is not available")) return err } s.sshdTestPwSo = wrapper s.testUser = user s.testPasswd = passwd return nil } // newServer returns a new mock ssh server. func newServer(t testing.T) server { return newServerForConfig(t, "default", map[string]string{}) } // newServerForConfig returns a new mock ssh server. func newServerForConfig(t testing.T, config string, configVars map[string]string) server { if testing.Short() { t.Skip("skipping test due to -short") } u, err := user.Current() if err != nil { t.Fatalf("user.Current: %v", err) } uname := u.Name if uname == "" { // Check the value of u.Username as u.Name // can be "" on some OSes like AIX. uname = u.Username } if uname == "root" { t.Skip("skipping test because current user is root") } dir, err := os.MkdirTemp("", "sshtest") if err != nil { t.Fatal(err) } f, err := os.Create(filepath.Join(dir, "sshd_config")) if err != nil { t.Fatal(err) } if _, ok := configTmpl[config]; ok == false { t.Fatal(fmt.Errorf("Invalid server config '%s'", config)) } configVars["Dir"] = dir err = configTmpl[config].Execute(f, configVars) if err != nil { t.Fatal(err) } f.Close() writeFile(filepath.Join(dir, "banner"), []byte("Server Banner")) for k, v := range testdata.PEMBytes { filename := "id_" + k writeFile(filepath.Join(dir, filename), v) writeFile(filepath.Join(dir, filename+".pub"), ssh.MarshalAuthorizedKey(testPublicKeys[k])) } for k, v := range testdata.SSHCertificates { filename := "id_" + k + "-cert.pub" writeFile(filepath.Join(dir, filename), v) } var authkeys bytes.Buffer for k := range testdata.PEMBytes { authkeys.Write(ssh.MarshalAuthorizedKey(testPublicKeys[k])) } writeFile(filepath.Join(dir, "authorized_keys"), authkeys.Bytes()) t.Cleanup(func() { if err := os.RemoveAll(dir); err != nil { t.Error(err) } }) return &server{ t: t, configfile: f.Name(), } } func newTempSocket(t *testing.T) (string, func()) { dir, err := os.MkdirTemp("", "socket") if err != nil { t.Fatal(err) } deferFunc := func() { os.RemoveAll(dir) } addr := filepath.Join(dir, "sock") return addr, deferFunc }	9.46 KB	2025-05-25 12:27
📄 testdata_test.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. // IMPLEMENTATION NOTE: To avoid a package loop, this file is in three places: // ssh/, ssh/agent, and ssh/test/. It should be kept in sync across all three // instances. package test import ( "crypto/rand" "fmt" "golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh/testdata" ) var ( testPrivateKeys map[string]interface{} testSigners map[string]ssh.Signer testPublicKeys map[string]ssh.PublicKey ) func init() { var err error n := len(testdata.PEMBytes) testPrivateKeys = make(map[string]interface{}, n) testSigners = make(map[string]ssh.Signer, n) testPublicKeys = make(map[string]ssh.PublicKey, n) for t, k := range testdata.PEMBytes { testPrivateKeys[t], err = ssh.ParseRawPrivateKey(k) if err != nil { panic(fmt.Sprintf("Unable to parse test key %s: %v", t, err)) } testSigners[t], err = ssh.NewSignerFromKey(testPrivateKeys[t]) if err != nil { panic(fmt.Sprintf("Unable to create signer for test key %s: %v", t, err)) } testPublicKeys[t] = testSigners[t].PublicKey() } // Create a cert and sign it for use in tests. testCert := &ssh.Certificate{ Nonce: []byte{}, // To pass reflect.DeepEqual after marshal & parse, this must be non-nil ValidPrincipals: []string{"gopher1", "gopher2"}, // increases test coverage ValidAfter: 0, // unix epoch ValidBefore: ssh.CertTimeInfinity, // The end of currently representable time. Reserved: []byte{}, // To pass reflect.DeepEqual after marshal & parse, this must be non-nil Key: testPublicKeys["ecdsa"], SignatureKey: testPublicKeys["rsa"], Permissions: ssh.Permissions{ CriticalOptions: map[string]string{}, Extensions: map[string]string{}, }, } testCert.SignCert(rand.Reader, testSigners["rsa"]) testPrivateKeys["cert"] = testPrivateKeys["ecdsa"] testSigners["cert"], err = ssh.NewCertSigner(testCert, testSigners["ecdsa"]) if err != nil { panic(fmt.Sprintf("Unable to create certificate signer: %v", err)) } }	2.17 KB	2025-05-25 12:27

Terminal