62 lines
2.8 KiB
Python
62 lines
2.8 KiB
Python
"""Isolated KISS SSH/SFTP fixture contract; no services, namespaces or radios."""
|
|
from pathlib import Path
|
|
import re
|
|
import shlex
|
|
import unittest
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
SCRIPT = ROOT / "tools/hil/ethernet_ssh_phone_bench.sh"
|
|
|
|
|
|
def sshd_arguments(source):
|
|
block = re.search(r"^options=\((.*?)\)\s*$", source, re.M | re.S)
|
|
if block is None:
|
|
raise AssertionError("Missing explicit isolated sshd option array")
|
|
return shlex.split(block[1])
|
|
|
|
|
|
class EthernetPhoneSftpFixtureTests(unittest.TestCase):
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
cls.source = SCRIPT.read_text()
|
|
|
|
def test_dev_null_configuration_explicitly_enables_internal_sftp(self):
|
|
arguments = sshd_arguments(self.source)
|
|
self.assertEqual(arguments[:2], ["-f", "/dev/null"])
|
|
self.assertIn("Subsystem=sftp internal-sftp", arguments)
|
|
position = arguments.index("Subsystem=sftp internal-sftp")
|
|
self.assertEqual(arguments[position - 1], "-o")
|
|
self.assertEqual(arguments.count("Subsystem=sftp internal-sftp"), 1)
|
|
# With -f /dev/null the previous array inherited no system subsystem.
|
|
old = self.source.replace(" -o 'Subsystem=sftp internal-sftp'", "")
|
|
self.assertNotIn("Subsystem=sftp internal-sftp", sshd_arguments(old))
|
|
|
|
def test_server_remains_private_key_only_and_namespace_scoped(self):
|
|
arguments = sshd_arguments(self.source)
|
|
for option in ("ListenAddress=10.90.5.2", "AllowUsers=mikec",
|
|
"PermitRootLogin=no", "UsePAM=no",
|
|
"PasswordAuthentication=no", "KbdInteractiveAuthentication=no",
|
|
"AuthenticationMethods=publickey", "DisableForwarding=yes",
|
|
"PermitUserEnvironment=no", "X11Forwarding=no"):
|
|
self.assertIn(option, arguments)
|
|
self.assertIn('chmod 700 -- "$run_dir"', self.source)
|
|
self.assertIn('ip netns exec "$namespace" /usr/sbin/sshd -D -e "${options[@]}"', self.source)
|
|
self.assertIn('/usr/sbin/sshd -t "${options[@]}"', self.source)
|
|
for forbidden in ("systemctl", "service ssh", "/etc/ssh/sshd_config",
|
|
"useradd", "usermod", "iptables", "nft ", "ip_forward"):
|
|
self.assertNotIn(forbidden, self.source)
|
|
|
|
def test_sftp_change_preserves_kiss_mtu_and_owned_cleanup(self):
|
|
for required in ('mtu 230 up', '--interface lora0',
|
|
'"$observed" == "$inode"', '"$parent" == "$$"',
|
|
'rm -f -- "$run_dir/host_key" "$run_dir/client_key"',
|
|
'Namespace already exists; refusing to reuse it.'):
|
|
self.assertIn(required, self.source)
|
|
self.assertNotIn("killall", self.source)
|
|
self.assertNotIn("pkill", self.source)
|
|
self.assertNotIn("rm -rf", self.source)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|