You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

245 lines
10 KiB

  1. ;;; GNU Guix --- Functional package management for GNU
  2. ;;; Copyright © 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
  3. ;;; Copyright © 2017, 2018 Clément Lassieur <clement@lassieur.org>
  4. ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
  5. ;;;
  6. ;;; This file is part of GNU Guix.
  7. ;;;
  8. ;;; GNU Guix is free software; you can redistribute it and/or modify it
  9. ;;; under the terms of the GNU General Public License as published by
  10. ;;; the Free Software Foundation; either version 3 of the License, or (at
  11. ;;; your option) any later version.
  12. ;;;
  13. ;;; GNU Guix is distributed in the hope that it will be useful, but
  14. ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  15. ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16. ;;; GNU General Public License for more details.
  17. ;;;
  18. ;;; You should have received a copy of the GNU General Public License
  19. ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
  20. (define-module (gnu tests ssh)
  21. #:use-module (gnu tests)
  22. #:use-module (gnu system)
  23. #:use-module (gnu system vm)
  24. #:use-module (gnu services)
  25. #:use-module (gnu services ssh)
  26. #:use-module (gnu services networking)
  27. #:use-module (gnu packages ssh)
  28. #:use-module (guix gexp)
  29. #:use-module (guix store)
  30. #:export (%test-openssh
  31. %test-dropbear))
  32. (define* (run-ssh-test name ssh-service pid-file
  33. #:key (sftp? #f) (test-getlogin? #t))
  34. "Run a test of an OS running SSH-SERVICE, which writes its PID to PID-FILE.
  35. SSH-SERVICE must be configured to listen on port 22 and to allow for root and
  36. empty-password logins.
  37. When SFTP? is true, run an SFTP server test."
  38. (define os
  39. (marionette-operating-system
  40. (simple-operating-system (service dhcp-client-service-type) ssh-service)
  41. #:imported-modules '((gnu services herd)
  42. (guix combinators))))
  43. (define vm
  44. (virtual-machine
  45. (operating-system os)
  46. (port-forwardings '((2222 . 22)))))
  47. (define test
  48. (with-imported-modules '((gnu build marionette))
  49. (with-extensions (list guile-ssh)
  50. #~(begin
  51. (use-modules (gnu build marionette)
  52. (srfi srfi-26)
  53. (srfi srfi-64)
  54. (ice-9 textual-ports)
  55. (ice-9 match)
  56. (ssh session)
  57. (ssh auth)
  58. (ssh channel)
  59. (ssh popen)
  60. (ssh sftp))
  61. (define marionette
  62. ;; Enable TCP forwarding of the guest's port 22.
  63. (make-marionette (list #$vm)))
  64. (define (make-session-for-test)
  65. "Make a session with predefined parameters for a test."
  66. (make-session #:user "root"
  67. #:port 2222
  68. #:host "localhost"
  69. #:log-verbosity 'protocol))
  70. (define (call-with-connected-session proc)
  71. "Call the one-argument procedure PROC with a freshly created and
  72. connected SSH session object, return the result of the procedure call. The
  73. session is disconnected when the PROC is finished."
  74. (let ((session (make-session-for-test)))
  75. (dynamic-wind
  76. (lambda ()
  77. (let ((result (connect! session)))
  78. (unless (equal? result 'ok)
  79. (error "Could not connect to a server"
  80. session result))))
  81. (lambda () (proc session))
  82. (lambda () (disconnect! session)))))
  83. (define (call-with-connected-session/auth proc)
  84. "Make an authenticated session. We should be able to connect as
  85. root with an empty password."
  86. (call-with-connected-session
  87. (lambda (session)
  88. ;; Try the simple authentication methods. Dropbear requires
  89. ;; 'none' when there are no passwords, whereas OpenSSH accepts
  90. ;; 'password' with an empty password.
  91. (let loop ((methods (list (cut userauth-password! <> "")
  92. (cut userauth-none! <>))))
  93. (match methods
  94. (()
  95. (error "all the authentication methods failed"))
  96. ((auth rest ...)
  97. (match (pk 'auth (auth session))
  98. ('success
  99. (proc session))
  100. ('denied
  101. (loop rest)))))))))
  102. (mkdir #$output)
  103. (chdir #$output)
  104. (test-begin "ssh-daemon")
  105. ;; Wait for sshd to be up and running.
  106. (test-assert "service running"
  107. (marionette-eval
  108. '(begin
  109. (use-modules (gnu services herd))
  110. (start-service 'ssh-daemon))
  111. marionette))
  112. ;; Check sshd's PID file.
  113. (test-equal "sshd PID"
  114. (wait-for-file #$pid-file marionette)
  115. (marionette-eval
  116. '(begin
  117. (use-modules (gnu services herd)
  118. (srfi srfi-1))
  119. (live-service-running
  120. (find (lambda (live)
  121. (memq 'ssh-daemon
  122. (live-service-provision live)))
  123. (current-services))))
  124. marionette))
  125. (test-assert "wait for port 22"
  126. (wait-for-tcp-port 22 marionette))
  127. ;; Connect to the guest over SSH. Make sure we can run a shell
  128. ;; command there.
  129. (test-equal "shell command"
  130. 'hello
  131. (call-with-connected-session/auth
  132. (lambda (session)
  133. ;; FIXME: 'get-server-public-key' segfaults.
  134. ;; (get-server-public-key session)
  135. (let ((channel (make-channel session)))
  136. (channel-open-session channel)
  137. (channel-request-exec channel "echo hello > /root/witness")
  138. (and (zero? (channel-get-exit-status channel))
  139. (wait-for-file "/root/witness" marionette))))))
  140. ;; Check whether the 'getlogin' procedure returns the right thing.
  141. (unless #$test-getlogin?
  142. (test-skip 1))
  143. (test-equal "getlogin"
  144. '(0 "root")
  145. (call-with-connected-session/auth
  146. (lambda (session)
  147. (let* ((pipe (open-remote-input-pipe
  148. session
  149. "guile -c '(display (getlogin))'"))
  150. (output (get-string-all pipe))
  151. (status (channel-get-exit-status pipe)))
  152. (list status output)))))
  153. ;; Connect to the guest over SFTP. Make sure we can write and
  154. ;; read a file there.
  155. (unless #$sftp?
  156. (test-skip 1))
  157. (test-equal "SFTP file writing and reading"
  158. 'hello
  159. (call-with-connected-session/auth
  160. (lambda (session)
  161. (let ((sftp-session (make-sftp-session session))
  162. (witness "/root/sftp-witness"))
  163. (call-with-remote-output-file sftp-session witness
  164. (cut display "hello" <>))
  165. (call-with-remote-input-file sftp-session witness
  166. read)))))
  167. ;; Connect to the guest over SSH. Make sure we can run commands
  168. ;; from the system profile.
  169. (test-equal "run executables from system profile"
  170. #t
  171. (call-with-connected-session/auth
  172. (lambda (session)
  173. (let ((channel (make-channel session)))
  174. (channel-open-session channel)
  175. (channel-request-exec
  176. channel
  177. (string-append
  178. "mkdir -p /root/.guix-profile/bin && "
  179. "touch /root/.guix-profile/bin/path-witness && "
  180. "chmod 755 /root/.guix-profile/bin/path-witness"))
  181. (zero? (channel-get-exit-status channel))))))
  182. ;; Connect to the guest over SSH. Make sure we can run commands
  183. ;; from the user profile.
  184. (test-equal "run executable from user profile"
  185. #t
  186. (call-with-connected-session/auth
  187. (lambda (session)
  188. (let ((channel (make-channel session)))
  189. (channel-open-session channel)
  190. (channel-request-exec channel "path-witness")
  191. (zero? (channel-get-exit-status channel))))))
  192. (test-end)
  193. (exit (= (test-runner-fail-count (test-runner-current)) 0))))))
  194. (gexp->derivation name test))
  195. (define %test-openssh
  196. (system-test
  197. (name "openssh")
  198. (description "Connect to a running OpenSSH daemon.")
  199. (value (run-ssh-test name
  200. ;; Allow root logins with an empty password to
  201. ;; simplify testing.
  202. (service openssh-service-type
  203. (openssh-configuration
  204. (permit-root-login #t)
  205. (allow-empty-passwords? #t)))
  206. "/var/run/sshd.pid"
  207. #:sftp? #t))))
  208. (define %test-dropbear
  209. (system-test
  210. (name "dropbear")
  211. (description "Connect to a running Dropbear SSH daemon.")
  212. (value (run-ssh-test name
  213. (service dropbear-service-type
  214. (dropbear-configuration
  215. (root-login? #t)
  216. (allow-empty-passwords? #t)))
  217. "/var/run/dropbear.pid"
  218. ;; XXX: Our Dropbear is not built with PAM support.
  219. ;; Even when it is, it seems to ignore the PAM
  220. ;; 'session' requirements.
  221. #:test-getlogin? #f))))