1239849Sdes#	$OpenBSD: addrmatch.sh,v 1.4 2012/05/13 01:42:32 dtucker Exp $
2180750Sdes#	Placed in the Public Domain.
3180750Sdes
4180750Sdestid="address match"
5180750Sdes
6204861Sdesmv $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
7180750Sdes
8180750Sdesrun_trial()
9180750Sdes{
10239849Sdes	user="$1"; addr="$2"; host="$3"; laddr="$4"; lport="$5"
11239849Sdes	expected="$6"; descr="$7"
12180750Sdes
13180750Sdes	verbose "test $descr for $user $addr $host"
14180750Sdes	result=`${SSHD} -f $OBJ/sshd_proxy -T \
15239849Sdes	    -C user=${user},addr=${addr},host=${host},laddr=${laddr},lport=${lport} | \
16239849Sdes	    awk '/^forcecommand/ {print $2}'`
17180750Sdes	if [ "$result" != "$expected" ]; then
18239849Sdes		fail "failed '$descr' expected $expected got $result"
19180750Sdes	fi
20180750Sdes}
21180750Sdes
22204861Sdescp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
23180750Sdescat >>$OBJ/sshd_proxy <<EOD
24239849SdesForceCommand nomatch
25180750SdesMatch Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com
26239849Sdes	ForceCommand match1
27180750SdesMatch Address 1.1.1.1,::1,!::3,2000::/16
28239849Sdes	ForceCommand match2
29239849SdesMatch LocalAddress 127.0.0.1,::1
30239849Sdes	ForceCommand match3
31239849SdesMatch LocalPort 5678
32239849Sdes	ForceCommand match4
33180750SdesEOD
34180750Sdes
35239849Sdesrun_trial user 192.168.0.1 somehost 1.2.3.4 1234 match1 "first entry"
36239849Sdesrun_trial user 192.168.30.1 somehost 1.2.3.4 1234 nomatch "negative match"
37239849Sdesrun_trial user 19.0.0.1 somehost 1.2.3.4 1234 nomatch "no match"
38239849Sdesrun_trial user 10.255.255.254 somehost 1.2.3.4 1234 match1 "list middle"
39239849Sdesrun_trial user 192.168.30.1 192.168.0.1 1.2.3.4 1234 nomatch "faked IP in hostname"
40239849Sdesrun_trial user 1.1.1.1 somehost.example.com 1.2.3.4 1234 match2 "bare IP4 address"
41239849Sdesrun_trial user 19.0.0.1 somehost 127.0.0.1 1234 match3 "localaddress"
42239849Sdesrun_trial user 19.0.0.1 somehost 1.2.3.4 5678 match4 "localport"
43204861Sdes
44239849Sdesif test "$TEST_SSH_IPV6" != "no"; then
45239849Sdesrun_trial user ::1 somehost.example.com ::2 1234 match2 "bare IP6 address"
46239849Sdesrun_trial user ::2 somehost.exaple.com ::2 1234 nomatch "deny IPv6"
47239849Sdesrun_trial user ::3 somehost ::2 1234 nomatch "IP6 negated"
48239849Sdesrun_trial user ::4 somehost ::2 1234 nomatch "IP6 no match"
49239849Sdesrun_trial user 2000::1 somehost ::2 1234 match2 "IP6 network"
50239849Sdesrun_trial user 2001::1 somehost ::2 1234 nomatch "IP6 network"
51239849Sdesrun_trial user ::5 somehost ::1 1234 match3 "IP6 localaddress"
52239849Sdesrun_trial user ::5 somehost ::2 5678 match4 "IP6 localport"
53239849Sdesfi
54239849Sdes
55204861Sdescp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
56204861Sdesrm $OBJ/sshd_proxy_bak
57