libssh/tests/client/torture_scp.c

/*
 * This file is part of the SSH Library
 *
 * Copyright (c) 2019 by Red Hat, Inc.
 *
 * Author: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
 *
 * The SSH Library is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation; either version 2.1 of the License, or (at your
 * option) any later version.
 *
 * The SSH Library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
 * License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with the SSH Library; see the file COPYING.  If not, write to
 * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

#define LIBSSH_STATIC

#include "config.h"

#include "torture.h"
#include "libssh/scp.h"

#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>
#include <pwd.h>
#include <errno.h>

#define BUF_SIZE 1024

#define TEMPLATE BINARYDIR "/tests/home/alice/temp_dir_XXXXXX"
#define ALICE_HOME BINARYDIR "/tests/home/alice"

struct scp_st {
    struct torture_state *s;
    char *tmp_dir;
    char *tmp_dir_basename;
};

static int sshd_setup(void **state)
{
    struct scp_st *ts = NULL;
    struct torture_state *s = NULL;

    ts = (struct scp_st *)calloc(1, sizeof(struct scp_st));
    assert_non_null(ts);

    torture_setup_sshd_server((void **)&s, false);
    assert_non_null(s);

    ts->s = s;

    *state = ts;

    return 0;
}

static int sshd_teardown(void **state)
{
    struct scp_st *ts = NULL;

    ts = *((struct scp_st **)state);
    assert_non_null(ts);
    assert_non_null(ts->s);

    torture_teardown_sshd_server((void **)&(ts->s));

    SAFE_FREE(ts);

    return 0;
}

static int session_setup(void **state)
{
    struct scp_st *ts = NULL;
    struct torture_state *s = NULL;

    char *tmp_dir = NULL;
    char *tmp_dir_basename = NULL;

    struct passwd *pwd;

    int rc;

    assert_non_null(state);

    ts = *state;

    assert_non_null(ts);
    assert_non_null(ts->s);

    s = ts->s;

    /* Create temporary directory for alice */
    tmp_dir = torture_make_temp_dir(TEMPLATE);
    assert_non_null(tmp_dir);
    ts->tmp_dir = tmp_dir;

    tmp_dir_basename = ssh_basename(tmp_dir);
    assert_non_null(tmp_dir_basename);
    ts->tmp_dir_basename = tmp_dir_basename;

    pwd = getpwnam("bob");
    assert_non_null(pwd);

    rc = setuid(pwd->pw_uid);
    assert_return_code(rc, errno);

    s->ssh.session = torture_ssh_session(s,
                                         TORTURE_SSH_SERVER,
                                         NULL,
                                         TORTURE_SSH_USER_ALICE,
                                         NULL);
    assert_non_null(s->ssh.session);

    return 0;
}

static int session_teardown(void **state)
{
    struct scp_st *ts = NULL;
    struct torture_state *s = NULL;

    assert_non_null(state);
    ts = *((struct scp_st **)state);

    assert_non_null(ts->s);
    s = ts->s;

    ssh_disconnect(s->ssh.session);
    ssh_free(s->ssh.session);

    assert_non_null(ts->tmp_dir);
    torture_rmdirs(ts->tmp_dir);

    SAFE_FREE(ts->tmp_dir);
    SAFE_FREE(ts->tmp_dir_basename);

    return 0;
}

static void torture_scp_upload(void **state)
{
    struct scp_st *ts = NULL;
    struct torture_state *s = NULL;

    ssh_session session = NULL;
    ssh_scp scp = NULL;

    char expected_a[BUF_SIZE];
    char buf[BUF_SIZE];
    FILE *file = NULL;
    size_t len = 0;
    int rc;

    assert_non_null(state);
    ts = *state;

    assert_non_null(ts->s);
    s = ts->s;

    session = s->ssh.session;
    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);
    assert_non_null(ts->tmp_dir);

    /* Upload file "a" to alice's temp dir */

    /* When writing the file_name must be the directory name */
    scp = ssh_scp_new(session, SSH_SCP_WRITE, ts->tmp_dir_basename);
    assert_non_null(scp);

    rc = ssh_scp_init(scp);
    assert_ssh_return_code(session, rc);

    /* Init buffer content to be written */
    memset(expected_a, 'A', BUF_SIZE);

    /* For ssh_scp_push_file(), the file_name is the name of the file without
     * path */
    rc = ssh_scp_push_file(scp, "a", BUF_SIZE, 0644);
    assert_ssh_return_code(session, rc);

    rc = ssh_scp_write(scp, expected_a, BUF_SIZE);
    assert_ssh_return_code(session, rc);

    /* Cleanup */
    ssh_scp_close(scp);
    ssh_scp_free(scp);

    /* Open file and check content */
    snprintf(buf, BUF_SIZE, "%s/a", ts->tmp_dir);

    file = fopen(buf, "r");
    assert_non_null(file);

    len = fread(buf, BUF_SIZE, 1, file);
    assert_int_equal(len, 1);
    assert_memory_equal(buf, expected_a, BUF_SIZE);

    fclose(file);
}

static void torture_scp_upload_recursive(void **state)
{
    struct scp_st *ts = NULL;
    struct torture_state *s = NULL;

    ssh_session session = NULL;
    ssh_scp scp = NULL;

    char expected_b[BUF_SIZE];
    char buf[BUF_SIZE];
    FILE *file = NULL;
    size_t len = 0;

    int rc;

    assert_non_null(state);
    ts = *state;

    assert_non_null(ts->s);
    s = ts->s;

    session = s->ssh.session;
    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);
    assert_non_null(ts->tmp_dir);

    /* Upload directory "test_dir" containing file "b" to alice's temp dir */

    /* When writing the file_name must be the directory name */
    scp = ssh_scp_new(session, SSH_SCP_WRITE | SSH_SCP_RECURSIVE,
                      ts->tmp_dir_basename);
    assert_non_null(scp);

    rc = ssh_scp_init(scp);
    assert_ssh_return_code(session, rc);

    /* Push directory where the new file will be copied */
    rc = ssh_scp_push_directory(scp, "test_dir", 0755);
    assert_ssh_return_code(session, rc);

    memset(expected_b, 'B', BUF_SIZE);

    /* For ssh_scp_push_file(), the file_name is the name of the file without
     * path */
    rc = ssh_scp_push_file(scp, "b", BUF_SIZE, 0644);
    assert_ssh_return_code(session, rc);

    rc = ssh_scp_write(scp, expected_b, BUF_SIZE);
    assert_ssh_return_code(session, rc);

    /* Leave the directory */
    rc = ssh_scp_leave_directory(scp);
    assert_ssh_return_code(session, rc);

    /* Cleanup */
    ssh_scp_close(scp);
    ssh_scp_free(scp);

    /* Open file and check content */
    snprintf(buf, BUF_SIZE, "%s/test_dir/b", ts->tmp_dir);

    file = fopen(buf, "r");
    assert_non_null(file);

    len = fread(buf, BUF_SIZE, 1, file);
    assert_int_equal(len, 1);
    assert_memory_equal(buf, expected_b, BUF_SIZE);

    fclose(file);
}

static void torture_scp_download(void **state)
{
    struct scp_st *ts = NULL;
    struct torture_state *s = NULL;

    ssh_session session = NULL;
    ssh_scp scp = NULL;

    char expected_a[BUF_SIZE];
    char buf[BUF_SIZE];
    const char *remote_file = NULL;

    FILE *file = NULL;
    int fd = 0;

    size_t size;

    int mode;
    int rc;

    assert_non_null(state);

    ts = *state;

    assert_non_null(ts);
    assert_non_null(ts->s);

    s = ts->s;

    session = s->ssh.session;
    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);
    assert_non_null(ts->tmp_dir);

    /* Create file "a" for alice */
    memset(expected_a, 'A', BUF_SIZE);

    snprintf(buf, BUF_SIZE, "%s/a", ts->tmp_dir);

    fd = open(buf, O_WRONLY | O_CREAT, 0644);
    assert_true(fd > 0);

    file = fdopen(fd, "w");
    assert_non_null(file);

    size = fwrite(expected_a, 1, BUF_SIZE, file);
    assert_int_equal(size, BUF_SIZE);
    fclose(file);

    /* Construct the file path */
    snprintf(buf, BUF_SIZE, "%s/a", ts->tmp_dir_basename);

    /* When reading, the location is the file path */
    scp = ssh_scp_new(session, SSH_SCP_READ, buf);
    assert_non_null(scp);

    rc = ssh_scp_init(scp);
    assert_ssh_return_code(session, rc);

    rc = ssh_scp_pull_request(scp);
    assert_int_equal(rc, SSH_SCP_REQUEST_NEWFILE);

    size = ssh_scp_request_get_size(scp);
    assert_int_equal(size, BUF_SIZE);

    mode = ssh_scp_request_get_permissions(scp);
    assert_int_equal(mode, 0644);

    remote_file = ssh_scp_request_get_filename(scp);
    assert_non_null(remote_file);
    assert_string_equal(remote_file, "a");

    rc = ssh_scp_accept_request(scp);
    assert_ssh_return_code(session, rc);

    rc = ssh_scp_read(scp, buf, BUF_SIZE);
    assert_int_equal(rc, size);

    assert_memory_equal(expected_a, buf, BUF_SIZE);

    /* Cleanup */
    ssh_scp_close(scp);
    ssh_scp_free(scp);
}

static void torture_scp_download_recursive(void **state)
{
    struct scp_st *ts = NULL;
    struct torture_state *s = NULL;

    ssh_session session = NULL;
    ssh_scp scp = NULL;

    char expected_b[BUF_SIZE];
    char buf[BUF_SIZE];
    const char *remote_file = NULL;
    FILE *file = NULL;
    int fd = 0;

    size_t size;

    int mode;
    int rc;

    assert_non_null(state);
    ts = *state;

    assert_non_null(ts->s);
    s = ts->s;

    session = s->ssh.session;
    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);
    assert_non_null(ts->tmp_dir);

    /* Create file "b" for alice */
    memset(expected_b, 'B', BUF_SIZE);

    snprintf(buf, BUF_SIZE, "%s/b", ts->tmp_dir);

    fd = open(buf, O_WRONLY | O_CREAT, 0644);
    assert_true(fd > 0);

    file = fdopen(fd, "w");
    assert_non_null(file);

    size = fwrite(expected_b, 1, BUF_SIZE, file);
    assert_int_equal(size, BUF_SIZE);
    fclose(file);

    /* Copy the directory containing the file "b" */
    scp = ssh_scp_new(session, SSH_SCP_READ | SSH_SCP_RECURSIVE,
                      ts->tmp_dir_basename);
    assert_non_null(scp);

    rc = ssh_scp_init(scp);
    assert_ssh_return_code(session, rc);

    /* Receive the directory */
    rc = ssh_scp_pull_request(scp);
    assert_int_equal(rc, SSH_SCP_REQUEST_NEWDIR);

    mode = ssh_scp_request_get_permissions(scp);
    assert_int_equal(mode, 0700);

    remote_file = ssh_scp_request_get_filename(scp);
    assert_non_null(remote_file);
    assert_string_equal(remote_file, ts->tmp_dir_basename);

    rc = ssh_scp_accept_request(scp);
    assert_ssh_return_code(session, rc);

    /* Receive the file "b" */
    rc = ssh_scp_pull_request(scp);
    assert_int_equal(rc, SSH_SCP_REQUEST_NEWFILE);

    size = ssh_scp_request_get_size(scp);
    assert_int_equal(size, BUF_SIZE);

    mode = ssh_scp_request_get_permissions(scp);
    assert_int_equal(mode, 0644);

    remote_file = ssh_scp_request_get_filename(scp);
    assert_non_null(remote_file);
    assert_string_equal(remote_file, "b");

    rc = ssh_scp_accept_request(scp);
    assert_ssh_return_code(session, rc);

    rc = ssh_scp_read(scp, buf, BUF_SIZE);
    assert_int_equal(rc, size);

    /* Check if the content was the expected */
    assert_memory_equal(expected_b, buf, BUF_SIZE);

    /* Receive end of directory */
    rc = ssh_scp_pull_request(scp);
    assert_int_equal(rc, SSH_SCP_REQUEST_ENDDIR);

    /* Receive end of communication */
    rc = ssh_scp_pull_request(scp);
    assert_int_equal(rc, SSH_SCP_REQUEST_EOF);

    /* Cleanup */
    ssh_scp_close(scp);
    ssh_scp_free(scp);
}

static void torture_scp_upload_newline(void **state)
{
    struct scp_st *ts = NULL;
    struct torture_state *s = NULL;

    ssh_session session = NULL;
    ssh_scp scp = NULL;

    FILE *file = NULL;

    char buf[1024];
    char *rs = NULL;
    int rc;

    assert_non_null(state);
    ts = *state;

    assert_non_null(ts->s);
    s = ts->s;

    session = s->ssh.session;
    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);
    assert_non_null(ts->tmp_dir);

    /* Upload recursively trying to inject protocol messages */

    /* When writing the file_name must be the directory name */
    scp = ssh_scp_new(session, SSH_SCP_WRITE | SSH_SCP_RECURSIVE,
                      ts->tmp_dir_basename);
    assert_non_null(scp);

    rc = ssh_scp_init(scp);
    assert_ssh_return_code(session, rc);

    /* Push directory where the new file will be copied */
    rc = ssh_scp_push_directory(scp, "test_inject", 0755);
    assert_ssh_return_code(session, rc);

    /* Try to push file with injected protocol messages */
    rc = ssh_scp_push_file(scp, "original\nreplacedC0777 8 injected", 8, 0644);
    assert_ssh_return_code(session, rc);

    rc = ssh_scp_write(scp, "original", 8);
    assert_ssh_return_code(session, rc);

    /* Leave the directory */
    rc = ssh_scp_leave_directory(scp);
    assert_ssh_return_code(session, rc);

    /* Cleanup */
    ssh_scp_close(scp);
    ssh_scp_free(scp);

    /* Open the file and check content */
    snprintf(buf, BUF_SIZE, "%s/test_inject/"
             "original\\nreplacedC0777 8 injected",
             ts->tmp_dir);
    file = fopen(buf, "r");
    assert_non_null(file);

    rs = fgets(buf, 1024, file);
    assert_non_null(rs);
    assert_string_equal(buf, "original");

    fclose(file);
}

static void torture_scp_upload_appended_command(void **state)
{
    struct scp_st *ts = NULL;
    struct torture_state *s = NULL;

    ssh_session session = NULL;
    ssh_scp scp = NULL;

    FILE *file = NULL;

    char buf[1024];
    char *rs = NULL;
    int rc;

    assert_non_null(state);
    ts = *state;

    assert_non_null(ts->s);
    s = ts->s;

    session = s->ssh.session;
    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);
    assert_non_null(ts->tmp_dir);

    /* Upload a file path with a command appended */

    /* Append a command to the file path */
    snprintf(buf, BUF_SIZE, "%s"
             "/;touch hack",
             ts->tmp_dir);

    /* When writing the file_name must be the directory name */
    scp = ssh_scp_new(session, SSH_SCP_WRITE | SSH_SCP_RECURSIVE,
                      buf);
    assert_non_null(scp);

    rc = ssh_scp_init(scp);
    assert_ssh_return_code(session, rc);

    /* Push directory where the new file will be copied */
    rc = ssh_scp_push_directory(scp, ";touch hack", 0755);
    assert_ssh_return_code(session, rc);

    /* Try to push file */
    rc = ssh_scp_push_file(scp, "original", 8, 0644);
    assert_ssh_return_code(session, rc);

    rc = ssh_scp_write(scp, "original", 8);
    assert_ssh_return_code(session, rc);

    /* Leave the directory */
    rc = ssh_scp_leave_directory(scp);
    assert_ssh_return_code(session, rc);

    /* Cleanup */
    ssh_scp_close(scp);
    ssh_scp_free(scp);

    /* Make sure the command was not executed */
    snprintf(buf, BUF_SIZE, ALICE_HOME "/hack");
    file = fopen(buf, "r");
    assert_null(file);

    /* Open the file and check content */
    snprintf(buf, BUF_SIZE, "%s"
             "/;touch hack/original",
             ts->tmp_dir);

    file = fopen(buf, "r");
    assert_non_null(file);

    rs = fgets(buf, 1024, file);
    assert_non_null(rs);
    assert_string_equal(buf, "original");

    fclose(file);
}

int torture_run_tests(void)
{
    int rc;
    struct CMUnitTest tests[] = {
        cmocka_unit_test_setup_teardown(torture_scp_upload,
                                        session_setup,
                                        session_teardown),
        cmocka_unit_test_setup_teardown(torture_scp_upload_recursive,
                                        session_setup,
                                        session_teardown),
        cmocka_unit_test_setup_teardown(torture_scp_download,
                                        session_setup,
                                        session_teardown),
        cmocka_unit_test_setup_teardown(torture_scp_download_recursive,
                                        session_setup,
                                        session_teardown),
        cmocka_unit_test_setup_teardown(torture_scp_upload_newline,
                                        session_setup,
                                        session_teardown),
        cmocka_unit_test_setup_teardown(torture_scp_upload_appended_command,
                                        session_setup,
                                        session_teardown),
    };

    ssh_init();

    torture_filter_tests(tests);
    rc = cmocka_run_group_tests(tests, sshd_setup, sshd_teardown);
    ssh_finalize();

    return rc;
}