mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-10-01 01:36:09 -04:00
68092f27dd
* Move `file`, `ssh` and `user` packages to internal * Rename `SSHKey` to `(ssh.)UserKey` * Rename KeyValue / Publickey to PublicKey * Rename SSH key file from "debugd" to "ssh-keys" * Add CreateSSHUsers function to Core * Call CreateSSHUsers users on first control-plane node, when defined in config Tests: * Make StubUserCreator add entries to /etc/passwd * Add NewLinuxUserManagerFake for unit tests * Add unit tests & adjust existing ones to changes
101 lines
2.5 KiB
Go
101 lines
2.5 KiB
Go
package ssh
|
|
|
|
import (
|
|
"context"
|
|
"sync"
|
|
"testing"
|
|
|
|
"github.com/edgelesssys/constellation/internal/deploy/user"
|
|
"github.com/spf13/afero"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestDeploySSHAuthorizedKey(t *testing.T) {
|
|
authorizedKey := UserKey{
|
|
Username: "user",
|
|
PublicKey: "ssh-rsa testkey",
|
|
}
|
|
|
|
testCases := map[string]struct {
|
|
fs afero.Fs
|
|
passwdContents string
|
|
alreadyDeployed bool
|
|
readonly bool
|
|
wantErr bool
|
|
wantFile bool
|
|
wantFileContents string
|
|
}{
|
|
"deploy works": {
|
|
fs: afero.NewMemMapFs(),
|
|
wantErr: false,
|
|
wantFile: true,
|
|
wantFileContents: "ssh-rsa testkey user\n",
|
|
},
|
|
"appending ssh key works": {
|
|
fs: memMapFsWithFile("/home/user/.ssh/authorized_keys.d/ssh-keys", "ssh-rsa preexistingkey user\n"),
|
|
wantErr: false,
|
|
wantFile: true,
|
|
wantFileContents: "ssh-rsa preexistingkey user\nssh-rsa testkey user\n",
|
|
},
|
|
"redeployment avoided": {
|
|
fs: afero.NewMemMapFs(),
|
|
wantErr: false,
|
|
alreadyDeployed: true,
|
|
wantFile: false,
|
|
},
|
|
"readonly fs": {
|
|
fs: afero.NewMemMapFs(),
|
|
readonly: true,
|
|
wantErr: true,
|
|
},
|
|
}
|
|
|
|
for name, tc := range testCases {
|
|
t.Run(name, func(t *testing.T) {
|
|
assert := assert.New(t)
|
|
require := require.New(t)
|
|
userManager := user.NewLinuxUserManagerFake(tc.fs)
|
|
|
|
assert.NoError(afero.WriteFile(userManager.Fs, "/etc/passwd", []byte(tc.passwdContents), 0o755))
|
|
if tc.readonly {
|
|
userManager.Fs = afero.NewReadOnlyFs(userManager.Fs)
|
|
}
|
|
authorized := map[string]bool{}
|
|
if tc.alreadyDeployed {
|
|
authorized["user:ssh-rsa testkey"] = true
|
|
}
|
|
sshAccess := SSHAccess{
|
|
userManager: userManager,
|
|
mux: sync.Mutex{},
|
|
authorized: authorized,
|
|
}
|
|
err := sshAccess.DeploySSHAuthorizedKey(context.Background(), authorizedKey)
|
|
|
|
if tc.wantErr {
|
|
assert.Error(err)
|
|
return
|
|
}
|
|
require.NoError(err)
|
|
if tc.wantFile {
|
|
fileContents, err := afero.ReadFile(userManager.Fs, "/home/user/.ssh/authorized_keys.d/ssh-keys")
|
|
assert.NoError(err)
|
|
assert.Equal(tc.wantFileContents, string(fileContents))
|
|
} else {
|
|
exists, err := afero.Exists(userManager.Fs, "/home/user/.ssh/authorized_keys.d/ssh-keys")
|
|
assert.NoError(err)
|
|
assert.False(exists)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func memMapFsWithFile(path string, contents string) afero.Fs {
|
|
fs := afero.NewMemMapFs()
|
|
err := afero.WriteFile(fs, path, []byte(contents), 0o755)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
return fs
|
|
}
|