11305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood# $OpenBSD: addrmatch.sh,v 1.3 2010/02/09 04:57:36 djm Exp $ 21305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood# Placed in the Public Domain. 31305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 41305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodtid="address match" 51305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 61305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodmv $OBJ/sshd_proxy $OBJ/sshd_proxy_bak 71305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 81305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial() 91305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood{ 101305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood user="$1"; addr="$2"; host="$3"; expected="$4"; descr="$5" 111305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 121305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood verbose "test $descr for $user $addr $host" 131305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood result=`${SSHD} -f $OBJ/sshd_proxy -T \ 141305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood -C user=${user},addr=${addr},host=${host} | \ 151305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood awk '/^passwordauthentication/ {print $2}'` 161305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood if [ "$result" != "$expected" ]; then 171305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fail "failed for $user $addr $host: expected $expected, got $result" 181305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood fi 191305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood} 201305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 211305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodcp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 221305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodcat >>$OBJ/sshd_proxy <<EOD 231305e95ba6ff9fa202d0818caf10405df4b0f648Mike LockwoodPasswordAuthentication no 241305e95ba6ff9fa202d0818caf10405df4b0f648Mike LockwoodMatch Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com 251305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood PasswordAuthentication yes 261305e95ba6ff9fa202d0818caf10405df4b0f648Mike LockwoodMatch Address 1.1.1.1,::1,!::3,2000::/16 271305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood PasswordAuthentication yes 281305e95ba6ff9fa202d0818caf10405df4b0f648Mike LockwoodEOD 291305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 301305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user 192.168.0.1 somehost yes "permit, first entry" 311305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user 192.168.30.1 somehost no "deny, negative match" 321305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user 19.0.0.1 somehost no "deny, no match" 331305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user 10.255.255.254 somehost yes "permit, list middle" 341305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user 192.168.30.1 192.168.0.1 no "deny, faked IP in hostname" 351305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user 1.1.1.1 somehost.example.com yes "permit, bare IP4 address" 361305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodtest "$TEST_SSH_IPV6" = "no" && exit 371305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user ::1 somehost.example.com yes "permit, bare IP6 address" 381305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user ::2 somehost.exaple.com no "deny IPv6" 391305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user ::3 somehost no "deny IP6 negated" 401305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user ::4 somehost no "deny, IP6 no match" 411305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user 2000::1 somehost yes "permit, IP6 network" 421305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrun_trial user 2001::1 somehost no "deny, IP6 network" 431305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwood 441305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodcp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 451305e95ba6ff9fa202d0818caf10405df4b0f648Mike Lockwoodrm $OBJ/sshd_proxy_bak 46