1#	$OpenBSD: sshcfgparse.sh,v 1.7 2021/02/24 23:12:35 dtucker Exp $
2#	Placed in the Public Domain.
3
4tid="ssh config parse"
5
6dsa=0
7for t in $SSH_KEYTYPES; do
8	case "$t" in
9		ssh-dss)	dsa=1 ;;
10	esac
11done
12
13expect_result_present() {
14	_str="$1" ; shift
15	for _expect in "$@" ; do
16		echo "$f" | tr ',' '\n' | grep "^$_expect\$" >/dev/null
17		if test $? -ne 0 ; then
18			fail "missing expected \"$_expect\" from \"$_str\""
19		fi
20	done
21}
22expect_result_absent() {
23	_str="$1" ; shift
24	for _expect in "$@" ; do
25		echo "$f" | tr ',' '\n' | grep "^$_expect\$" >/dev/null
26		if test $? -eq 0 ; then
27			fail "unexpected \"$_expect\" present in \"$_str\""
28		fi
29	done
30}
31
32verbose "reparse minimal config"
33(${SSH} -G -F $OBJ/ssh_config somehost >$OBJ/ssh_config.1 &&
34 ${SSH} -G -F $OBJ/ssh_config.1 somehost >$OBJ/ssh_config.2 &&
35 diff $OBJ/ssh_config.1 $OBJ/ssh_config.2) || fail "reparse minimal config"
36
37verbose "ssh -W opts"
38f=`${SSH} -GF $OBJ/ssh_config host | awk '/exitonforwardfailure/{print $2}'`
39test "$f" = "no" || fail "exitonforwardfailure default"
40f=`${SSH} -GF $OBJ/ssh_config -W a:1 h | awk '/exitonforwardfailure/{print $2}'`
41test "$f" = "yes" || fail "exitonforwardfailure enable"
42f=`${SSH} -GF $OBJ/ssh_config -W a:1 -o exitonforwardfailure=no h | \
43    awk '/exitonforwardfailure/{print $2}'`
44test "$f" = "no" || fail "exitonforwardfailure override"
45
46f=`${SSH} -GF $OBJ/ssh_config host | awk '/clearallforwardings/{print $2}'`
47test "$f" = "no" || fail "clearallforwardings default"
48f=`${SSH} -GF $OBJ/ssh_config -W a:1 h | awk '/clearallforwardings/{print $2}'`
49test "$f" = "yes" || fail "clearallforwardings enable"
50f=`${SSH} -GF $OBJ/ssh_config -W a:1 -o clearallforwardings=no h | \
51    awk '/clearallforwardings/{print $2}'`
52test "$f" = "no" || fail "clearallforwardings override"
53
54verbose "user first match"
55user=`awk '$1=="User" {print $2}' $OBJ/ssh_config`
56f=`${SSH} -GF $OBJ/ssh_config host | awk '/^user /{print $2}'`
57test "$f" = "$user" || fail "user from config, expected '$user' got '$f'"
58f=`${SSH} -GF $OBJ/ssh_config -o user=foo -l bar baz@host | awk '/^user /{print $2}'`
59test "$f" = "foo" || fail "user first match -oUser, expected 'foo' got '$f' "
60f=`${SSH} -GF $OBJ/ssh_config -lbar baz@host user=foo baz@host | awk '/^user /{print $2}'`
61test "$f" = "bar" || fail "user first match -l, expected 'bar' got '$f'"
62f=`${SSH} -GF $OBJ/ssh_config baz@host -o user=foo -l bar baz@host | awk '/^user /{print $2}'`
63test "$f" = "baz" || fail "user first match user@host, expected 'baz' got '$f'"
64
65verbose "pubkeyacceptedalgorithms"
66# Default set
67f=`${SSH} -GF none host | awk '/^pubkeyacceptedalgorithms /{print $2}'`
68expect_result_present "$f" "ssh-ed25519" "ssh-ed25519-cert-v01.*"
69expect_result_absent "$f" "ssh-dss"
70# Explicit override
71f=`${SSH} -GF none -opubkeyacceptedalgorithms=ssh-ed25519 host | \
72    awk '/^pubkeyacceptedalgorithms /{print $2}'`
73expect_result_present "$f" "ssh-ed25519"
74expect_result_absent "$f" "ssh-ed25519-cert-v01.*" "ssh-dss"
75# Removal from default set
76f=`${SSH} -GF none -opubkeyacceptedalgorithms=-ssh-ed25519-cert* host | \
77    awk '/^pubkeyacceptedalgorithms /{print $2}'`
78expect_result_present "$f" "ssh-ed25519"
79expect_result_absent "$f" "ssh-ed25519-cert-v01.*" "ssh-dss"
80f=`${SSH} -GF none -opubkeyacceptedalgorithms=-ssh-ed25519 host | \
81    awk '/^pubkeyacceptedalgorithms /{print $2}'`
82expect_result_present "$f" "ssh-ed25519-cert-v01.*"
83expect_result_absent "$f" "ssh-ed25519" "ssh-dss"
84# Append to default set.
85# This is not tested when built !WITH_OPENSSL
86if [ "$dsa" = "1" ]; then
87	f=`${SSH} -GF none -opubkeyacceptedalgorithms=+ssh-dss-cert* host | \
88	    awk '/^pubkeyacceptedalgorithms /{print $2}'`
89	expect_result_present "$f" "ssh-ed25519" "ssh-dss-cert-v01.*"
90	expect_result_absent "$f" "ssh-dss"
91	f=`${SSH} -GF none -opubkeyacceptedalgorithms=+ssh-dss host | \
92	    awk '/^pubkeyacceptedalgorithms /{print $2}'`
93	expect_result_present "$f" "ssh-ed25519" "ssh-ed25519-cert-v01.*" "ssh-dss"
94	expect_result_absent "$f" "ssh-dss-cert-v01.*"
95fi
96
97verbose "agentforwarding"
98f=`${SSH} -GF none host | awk '/^forwardagent /{print$2}'`
99expect_result_present "$f" "no"
100f=`${SSH} -GF none -oforwardagent=no host | awk '/^forwardagent /{print$2}'`
101expect_result_present "$f" "no"
102f=`${SSH} -GF none -oforwardagent=yes host | awk '/^forwardagent /{print$2}'`
103expect_result_present "$f" "yes"
104f=`${SSH} -GF none '-oforwardagent=SSH_AUTH_SOCK.forward' host | awk '/^forwardagent /{print$2}'`
105expect_result_present "$f" "SSH_AUTH_SOCK.forward"
106
107# cleanup
108rm -f $OBJ/ssh_config.[012]
109