Commit 23e979a2af
Verified · cmc
Layout: unified · split
internal/sshd/sshd_test.go +115
| @@ -296,3 +296,118 @@ func TestUnregisteredKeyMessageNamesFingerprintAndHost(t *testing.T) { | ||
| 296 | 296 | } |
| 297 | 297 | } |
| 298 | 298 | } |
| 299 | ||
| 300 | // authMeta is the connection metadata authenticate reads: only the | |
| 301 | // remote address. | |
| 302 | type authMeta struct { | |
| 303 | ssh.ConnMetadata | |
| 304 | addr net.Addr | |
| 305 | } | |
| 306 | ||
| 307 | func (m authMeta) RemoteAddr() net.Addr { return m.addr } | |
| 308 | ||
| 309 | func authKey(t *testing.T) ssh.PublicKey { | |
| 310 | t.Helper() | |
| 311 | pub, _, err := ed25519.GenerateKey(rand.Reader) | |
| 312 | if err != nil { | |
| 313 | t.Fatal(err) | |
| 314 | } | |
| 315 | k, err := ssh.NewPublicKey(pub) | |
| 316 | if err != nil { | |
| 317 | t.Fatal(err) | |
| 318 | } | |
| 319 | return k | |
| 320 | } | |
| 321 | ||
| 322 | // authServer is a Server holding what authenticate uses: a store with a | |
| 323 | // runner account's key, the registration mode, and a limiter of three | |
| 324 | // failures a minute. | |
| 325 | func authServer(t *testing.T, mode string) (*Server, ssh.PublicKey) { | |
| 326 | t.Helper() | |
| 327 | st, err := store.Open(filepath.Join(t.TempDir(), "gitbay.db")) | |
| 328 | if err != nil { | |
| 329 | t.Fatal(err) | |
| 330 | } | |
| 331 | t.Cleanup(func() { st.Close() }) | |
| 332 | if err := st.MigrateUp(); err != nil { | |
| 333 | t.Fatal(err) | |
| 334 | } | |
| 335 | uid, err := st.CreateUser("ci", false) | |
| 336 | if err != nil { | |
| 337 | t.Fatal(err) | |
| 338 | } | |
| 339 | runner := authKey(t) | |
| 340 | if err := st.AddSSHKey(uid, ssh.FingerprintSHA256(runner), runner.Type(), runner.Marshal(), "runner", ""); err != nil { | |
| 341 | t.Fatal(err) | |
| 342 | } | |
| 343 | cfg := config.Default() | |
| 344 | cfg.Registration.Mode = mode | |
| 345 | return &Server{cfg: cfg, st: st, authLimiter: newRateLimiter(3, time.Minute)}, runner | |
| 346 | } | |
| 347 | ||
| 348 | // With registration closed an unknown key counts against its address. | |
| 349 | // Below the limit a known key's success clears the count. At the limit | |
| 350 | // authenticate refuses before it looks at the key, so the runner's own | |
| 351 | // key from that address is refused too and its success never runs to | |
| 352 | // clear anything, until the window passes. Another address is not | |
| 353 | // affected. This is why a build must not share the runner's source | |
| 354 | // address (#260). | |
| 355 | func TestAuthLockoutHoldsAgainstTheRunnersKey(t *testing.T) { | |
| 356 | s, runner := authServer(t, "closed") | |
| 357 | stranger := authKey(t) | |
| 358 | failTimes := func(n int) { | |
| 359 | t.Helper() | |
| 360 | for i := 0; i < n; i++ { | |
| 361 | if _, err := s.authenticate(fromLoopback, stranger); err == nil { | |
| 362 | t.Fatal("unknown key admitted with registration closed") | |
| 363 | } | |
| 364 | } | |
| 365 | } | |
| 366 | ||
| 367 | failTimes(2) | |
| 368 | if _, err := s.authenticate(fromLoopback, runner); err != nil { | |
| 369 | t.Fatalf("runner below the limit: %v", err) | |
| 370 | } | |
| 371 | failTimes(2) | |
| 372 | if _, err := s.authenticate(fromLoopback, runner); err != nil { | |
| 373 | t.Fatalf("runner after its success cleared the count: %v", err) | |
| 374 | } | |
| 375 | ||
| 376 | failTimes(3) | |
| 377 | for i := 0; i < 2; i++ { | |
| 378 | if _, err := s.authenticate(fromLoopback, runner); err == nil || !strings.Contains(err.Error(), "too many") { | |
| 379 | t.Fatalf("attempt %d from a locked-out address: %v, want refused", i+1, err) | |
| 380 | } | |
| 381 | } | |
| 382 | if _, err := s.authenticate(fromPublic, runner); err != nil { | |
| 383 | t.Fatalf("another address was locked out too: %v", err) | |
| 384 | } | |
| 385 | ||
| 386 | s.authLimiter.seen["127.0.0.1"].start = time.Now().Add(-2 * time.Minute) | |
| 387 | if _, err := s.authenticate(fromLoopback, runner); err != nil { | |
| 388 | t.Fatalf("runner after the window passed: %v", err) | |
| 389 | } | |
| 390 | } | |
| 391 | ||
| 392 | // With registration open or by invite, an unknown key is admitted to run | |
| 393 | // register and never counts, so no number of unknown-key attempts locks | |
| 394 | // the runner's address out. gitbay.org runs open registration (#260). | |
| 395 | func TestAuthUnknownKeyCountsOnlyWhenClosed(t *testing.T) { | |
| 396 | for _, mode := range []string{"open", "invite"} { | |
| 397 | s, runner := authServer(t, mode) | |
| 398 | for i := 0; i < 10; i++ { | |
| 399 | p, err := s.authenticate(fromLoopback, authKey(t)) | |
| 400 | if err != nil || p.Extensions["anon-key"] == "" { | |
| 401 | t.Fatalf("%s: unknown key %d: %v %+v", mode, i+1, err, p) | |
| 402 | } | |
| 403 | } | |
| 404 | if _, err := s.authenticate(fromLoopback, runner); err != nil { | |
| 405 | t.Fatalf("%s: runner refused after unknown keys: %v", mode, err) | |
| 406 | } | |
| 407 | } | |
| 408 | } | |
| 409 | ||
| 410 | var ( | |
| 411 | fromLoopback = authMeta{addr: &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 40000}} | |
| 412 | fromPublic = authMeta{addr: &net.TCPAddr{IP: net.IPv4(203, 0, 113, 7), Port: 40000}} | |
| 413 | ) | |