|
56 | 56 | }.not_to raise_error |
57 | 57 | end |
58 | 58 |
|
| 59 | + describe "#force_command" do |
| 60 | + it "parses valid option" do |
| 61 | + parsed = described_class.parse_openssh(fixture("valid_force_command-cert.pub")) |
| 62 | + expect(parsed.force_command).to eq("asdf") |
| 63 | + end |
| 64 | + |
| 65 | + it "raises on invalid option" do |
| 66 | + parsed = described_class.parse_openssh(fixture("invalid_force_command-cert.pub")) |
| 67 | + |
| 68 | + expect { |
| 69 | + parsed.force_command |
| 70 | + }.to raise_error(SSHData::DecodeError) |
| 71 | + end |
| 72 | + end |
| 73 | + |
| 74 | + describe "#source_address" do |
| 75 | + it "is without option" do |
| 76 | + parsed = described_class.parse_openssh(fixture("rsa_leaf_for_rsa_ca-cert.pub")) |
| 77 | + expect(parsed.source_address).to be_nil |
| 78 | + end |
| 79 | + |
| 80 | + it "parses single address" do |
| 81 | + parsed = described_class.parse_openssh(fixture("single_source_address-cert.pub")) |
| 82 | + expect(parsed.source_address).to eq([IPAddr.new("1.1.1.1")]) |
| 83 | + end |
| 84 | + |
| 85 | + it "parses single CIDR range" do |
| 86 | + parsed = described_class.parse_openssh(fixture("single_cidr_source_address-cert.pub")) |
| 87 | + expect(parsed.source_address).to eq([IPAddr.new("1.1.1.0/24")]) |
| 88 | + end |
| 89 | + |
| 90 | + it "parses multiple CIDR range" do |
| 91 | + parsed = described_class.parse_openssh(fixture("multiple_cidr_source_address-cert.pub")) |
| 92 | + expect(parsed.source_address).to eq([IPAddr.new("1.1.1.0/24"), IPAddr.new("2.2.2.0/24")]) |
| 93 | + end |
| 94 | + |
| 95 | + it "parses option with spaces" do |
| 96 | + parsed = described_class.parse_openssh(fixture("spaces_source_address-cert.pub")) |
| 97 | + expect(parsed.source_address).to eq([IPAddr.new("1.1.1.1"), IPAddr.new("2.2.2.2")]) |
| 98 | + end |
| 99 | + |
| 100 | + it "raises on invalid option" do |
| 101 | + parsed = described_class.parse_openssh(fixture("invalid_source_address_flag-cert.pub")) |
| 102 | + |
| 103 | + expect { |
| 104 | + parsed.source_address |
| 105 | + }.to raise_error(SSHData::DecodeError) |
| 106 | + end |
| 107 | + |
| 108 | + it "raises on invalid IP address in option" do |
| 109 | + parsed = described_class.parse_openssh(fixture("invalid_source_address_bad_ip-cert.pub")) |
| 110 | + |
| 111 | + expect { |
| 112 | + parsed.source_address |
| 113 | + }.to raise_error(SSHData::DecodeError) |
| 114 | + end |
| 115 | + end |
| 116 | + |
| 117 | + describe "#allowed_source_address?" do |
| 118 | + let(:public_key) { SSHData::PrivateKey::ED25519.generate.public_key } |
| 119 | + let(:key_id) { "some-id" } |
| 120 | + |
| 121 | + subject { |
| 122 | + described_class.new(public_key: public_key, key_id: key_id) |
| 123 | + } |
| 124 | + |
| 125 | + it "checks single address" do |
| 126 | + subject.critical_options["source-address"] = "1.1.1.1" |
| 127 | + expect(subject.allowed_source_address?("1.1.1.1")).to be(true) |
| 128 | + expect(subject.allowed_source_address?("2.2.2.2")).to be(false) |
| 129 | + end |
| 130 | + |
| 131 | + it "checks multiple addresses" do |
| 132 | + subject.critical_options["source-address"] = "1.1.1.1,2.2.2.2" |
| 133 | + expect(subject.allowed_source_address?("1.1.1.1")).to be(true) |
| 134 | + expect(subject.allowed_source_address?("2.2.2.2")).to be(true) |
| 135 | + expect(subject.allowed_source_address?("3.3.3.3")).to be(false) |
| 136 | + end |
| 137 | + |
| 138 | + it "checks single CIDR range" do |
| 139 | + subject.critical_options["source-address"] = "1.1.1.0/24" |
| 140 | + expect(subject.allowed_source_address?("1.1.1.1")).to be(true) |
| 141 | + expect(subject.allowed_source_address?("1.1.1.2")).to be(true) |
| 142 | + expect(subject.allowed_source_address?("2.2.2.2")).to be(false) |
| 143 | + expect(subject.allowed_source_address?("1.1.2.1")).to be(false) |
| 144 | + end |
| 145 | + |
| 146 | + it "checks multiple CIDR ranges" do |
| 147 | + subject.critical_options["source-address"] = "1.1.1.0/24,2.2.2.0/24" |
| 148 | + expect(subject.allowed_source_address?("1.1.1.1")).to be(true) |
| 149 | + expect(subject.allowed_source_address?("2.2.2.2")).to be(true) |
| 150 | + expect(subject.allowed_source_address?("3.3.3.3")).to be(false) |
| 151 | + end |
| 152 | + |
| 153 | + it "returns false for bad addresses" do |
| 154 | + subject.critical_options["source-address"] = "1.1.1.1" |
| 155 | + expect(subject.allowed_source_address?("foo")).to be(false) |
| 156 | + end |
| 157 | + |
| 158 | + it "allows any address if option is missing" do |
| 159 | + expect(subject.allowed_source_address?("1.1.1.1")).to be(true) |
| 160 | + end |
| 161 | + end |
| 162 | + |
59 | 163 | test_cases = [] |
60 | 164 |
|
61 | 165 | test_cases << [ |
|
0 commit comments