diff --git a/t/run b/t/run index 3343b48..4ac853c 100755 --- a/t/run +++ b/t/run @@ -53,7 +53,12 @@ sub my_is { push @results, [$cnt++, $desc, $res]; } -#my $pidfile = $conf->lookup_value("pidfile"); +sub my_like { + my ($a, $b, $desc) = @_; + + my $res = like($a, $b, $desc); + push @results, [$cnt++, $desc, $res]; +} sub verbose_exec { @@ -214,7 +219,9 @@ sub run_test_probe close $cnx; my_is($prefix, $expected, "$exe:$expected: probe"); - my_is($data, $test->{data}, "$exe:$expected: shoveled"); + my $data_expected = $test->{data_expected}; + $data_expected =~ s/INPUT_DATA/$test->{data}/; + my_like($data, qr/$data_expected/s, "$exe:$expected: shoveled"); } @@ -248,7 +255,21 @@ sub test_wrong_user ################################################################################ +# Each test is decribed with an entry containing the +# following fields: +# +# * `run`: which test method to use +# +# * `expected`: protocol prompt added by the echosrv (should be the protocol name) +# +# * `data_expected` is a regex for the expected return (which can be +# different when using Proxyprotocol). INPUT_DATA gets +# replaced with $_->{data}, i.e. data sent originally, +# before matching. +# + my @tests = ( + { desc => "No hostname in address", run => \&test_no_host, @@ -278,6 +299,26 @@ my @tests = ( expected => "socks5", # prefix expected from echosrv }, + # test_pp1.cfg has proxyprotocol on ssh but not socks5. + # Check ssh has pp + { + desc => "Server-side ProxyProtocol active", + run => \&run_test_probe, + cfg => "test_pp1.cfg", + data => "SSH-2.0 hello", + expected => "ssh", + data_expected => "^PROXY TCP4 127.0.0.1 127.0.0.1 \\d+ \\d+.*INPUT_DATA", + }, + + # check socks5 does not + { + desc => "Server-side ProxyProtocol not active", + run => \&run_test_probe, + cfg => "test_pp1.cfg", + data => "\x05\x04\x01\x02\x03\x04", + expected => "socks5", + }, + ); diff --git a/t/test_pp1.cfg b/t/test_pp1.cfg new file mode 100644 index 0000000..eaa723e --- /dev/null +++ b/t/test_pp1.cfg @@ -0,0 +1,44 @@ +# Testing for server-side ProxyProtocol + +foreground: true; +inetd: false; +numeric: true; +transparent: false; +timeout: 10; # Probe test writes slowly +pidfile: "/tmp/sslh_test.pid"; + +syslog_facility: "auth"; + +# Logging configuration +# Value: 1: stdout; 2: syslog; 3: both +# Defaults should be sensible. Generally, you want *-error +# to be always enabled, to know if something is going wrong. +verbose-config: 1; # print configuration at startup +verbose-config-error: 1; # print configuration errors +verbose-connections: 1; # trace established incoming address to forward address +verbose-connections-error: 1; # connection errors +verbose-connections-try: 1; # connection attempts towards targets +verbose-fd: 0; # file descriptor activity, open/close/whatnot +verbose-packets: 1; # hexdump packets on which probing is done +verbose-probe-info: 1; # what's happening during the probe process +verbose-probe-error: 1; # failures and problems during probing +verbose-system-error: 1; # system call problem, i.e. malloc, fork, failing +verbose-int-error: 1; # internal errors, the kind that should never happen + +# List of interfaces on which we should listen +# Options: +listen: +( + { host: "localhost"; port: "8080"; keepalive: true; } +); + + +protocols: +( + { name: "ssh"; host: "localhost"; port: "9000"; proxyprotocol: 1; }, + { name: "socks5"; host: "localhost"; port: "9001"; }, + { name: "anyprot"; host: "localhost"; port: "9099"; } +); + +on_timeout: "ssh"; +