79 lines
3.2 KiB
Go
79 lines
3.2 KiB
Go
package main
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func manifest(t *testing.T, root, module, body string) {
|
|
t.Helper()
|
|
dir := filepath.Join(root, "modules", module)
|
|
if err := os.MkdirAll(dir, 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func TestAnotherModuleNamingSSHIsRefused(t *testing.T) {
|
|
root := t.TempDir()
|
|
manifest(t, root, "ssh-client", `{"module":"ssh-client","resources":[{"path":"${machine:account-home}/.ssh/config"}]}`)
|
|
manifest(t, root, "forge-account", `{"module":"forge-account","resources":[{"path":"${machine:account-home}/.ssh/config.d/20-forge"}]}`)
|
|
manifest(t, root, "roster", `{"module":"roster","facts":{"hosts":{"path":".ssh/known_hosts"}}}`)
|
|
manifest(t, root, "box", `{"module":"box","containers":[{"volumes":["~/.ssh:/root/.ssh:ro"]}]}`)
|
|
manifest(t, root, "quiet", `{"module":"quiet","description":"reads ~/.ssh/config","resources":[{"path":"${machine:account-home}/.sshrc-not","template":"# see ~/.ssh/config"},{"path":"/etc/ssh/sshd_config"}]}`)
|
|
found, err := Check(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
got := map[string]bool{}
|
|
for _, f := range found {
|
|
got[f.Module] = true
|
|
}
|
|
if len(found) != 3 || !got["forge-account"] || !got["roster"] || !got["box"] {
|
|
t.Fatalf("refused %+v; want forge-account, roster and box", found)
|
|
}
|
|
}
|
|
|
|
// Issue 1484: a runs-as module's own account has a .ssh of its own, inside its home (a directory of the module's);
|
|
// that is not the operator's ~/.ssh, which only ssh-client names. A path outside any ${dir:} is still refused.
|
|
func TestAModulesOwnDirectoryMayHoldADotSSH(t *testing.T) {
|
|
root := t.TempDir()
|
|
manifest(t, root, "builder", `{"module":"builder","resources":[{"id":"state","type":"directory","place":"."},{"id":"ssh-dir","type":"directory","path":"${dir:state}/.ssh"},{"path":"${dir:ssh-dir}/config"}]}`)
|
|
manifest(t, root, "other", `{"module":"other","resources":[{"path":"${machine:account-home}/.ssh/config"}]}`)
|
|
found, err := Check(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(found) != 1 || found[0].Module != "other" {
|
|
t.Fatalf("refused %+v; want only other", found)
|
|
}
|
|
}
|
|
|
|
// Issue 1484 review: only a directory the mesh places is the module's own home. A ${dir:} that resolves to the
|
|
// operator's home is judged by the path it resolves to.
|
|
func TestADirResolvingToTheOperatorsHomeIsStillRefused(t *testing.T) {
|
|
root := t.TempDir()
|
|
manifest(t, root, "escape", `{"module":"escape","resources":[{"id":"h","type":"directory","path":"${machine:account-home}","unknown":"module"},{"path":"${dir:h}/.ssh/config"}]}`)
|
|
manifest(t, root, "placed", `{"module":"placed","resources":[{"id":"state","type":"directory","place":".","unknown":"program"},{"id":"s","type":"directory","path":"${dir:state}/.ssh"},{"path":"${dir:s}/config"}]}`)
|
|
found, err := Check(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(found) != 1 || found[0].Module != "escape" {
|
|
t.Fatalf("refused %+v; want only escape", found)
|
|
}
|
|
}
|
|
|
|
func TestTheCatalogueHasNone(t *testing.T) {
|
|
found, err := Check("../..")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(found) != 0 {
|
|
t.Fatalf("the catalogue names paths under ~/.ssh outside ssh-client: %+v", found)
|
|
}
|
|
}
|