2 * This work is licensed under the terms of the GNU GPL, version 2 or later.
3 * See the COPYING file in the top-level directory.
5 #include "qemu/osdep.h"
8 #include <glib/gstdio.h>
12 #include "commands-common-ssh.h"
13 #include "qapi/error.h"
14 #include "qga-qapi-commands.h"
16 #ifdef QGA_BUILD_UNIT_TEST
17 static struct passwd
*
18 test_get_passwd_entry(const gchar
*user_name
, GError
**error
)
23 if (!user_name
|| g_strcmp0(user_name
, g_get_user_name())) {
24 g_set_error(error
, G_UNIX_ERROR
, 0, "Invalid user name");
28 p
= g_new0(struct passwd
, 1);
29 p
->pw_dir
= (char *)g_get_home_dir();
30 p
->pw_uid
= geteuid();
31 p
->pw_gid
= getegid();
33 ret
= g_mkdir_with_parents(p
->pw_dir
, 0700);
39 #define g_unix_get_passwd_entry_qemu(username, err) \
40 test_get_passwd_entry(username, err)
43 static struct passwd
*
44 get_passwd_entry(const char *username
, Error
**errp
)
46 g_autoptr(GError
) err
= NULL
;
49 p
= g_unix_get_passwd_entry_qemu(username
, &err
);
51 error_setg(errp
, "failed to lookup user '%s': %s",
52 username
, err
->message
);
60 mkdir_for_user(const char *path
, const struct passwd
*p
,
61 mode_t mode
, Error
**errp
)
63 if (g_mkdir(path
, mode
) == -1) {
64 error_setg(errp
, "failed to create directory '%s': %s",
65 path
, g_strerror(errno
));
69 if (chown(path
, p
->pw_uid
, p
->pw_gid
) == -1) {
70 error_setg(errp
, "failed to set ownership of directory '%s': %s",
71 path
, g_strerror(errno
));
75 if (chmod(path
, mode
) == -1) {
76 error_setg(errp
, "failed to set permissions of directory '%s': %s",
77 path
, g_strerror(errno
));
85 write_authkeys(const char *path
, const GStrv keys
,
86 const struct passwd
*p
, Error
**errp
)
88 g_autofree
char *contents
= NULL
;
89 g_autoptr(GError
) err
= NULL
;
91 contents
= g_strjoinv("\n", keys
);
92 if (!g_file_set_contents(path
, contents
, -1, &err
)) {
93 error_setg(errp
, "failed to write to '%s': %s", path
, err
->message
);
97 if (chown(path
, p
->pw_uid
, p
->pw_gid
) == -1) {
98 error_setg(errp
, "failed to set ownership of directory '%s': %s",
99 path
, g_strerror(errno
));
103 if (chmod(path
, 0600) == -1) {
104 error_setg(errp
, "failed to set permissions of '%s': %s",
105 path
, g_strerror(errno
));
113 qmp_guest_ssh_add_authorized_keys(const char *username
, strList
*keys
,
114 bool has_reset
, bool reset
,
117 g_autofree
struct passwd
*p
= NULL
;
118 g_autofree
char *ssh_path
= NULL
;
119 g_autofree
char *authkeys_path
= NULL
;
120 g_auto(GStrv
) authkeys
= NULL
;
122 size_t nkeys
, nauthkeys
;
124 reset
= has_reset
&& reset
;
126 if (!check_openssh_pub_keys(keys
, &nkeys
, errp
)) {
130 p
= get_passwd_entry(username
, errp
);
135 ssh_path
= g_build_filename(p
->pw_dir
, ".ssh", NULL
);
136 authkeys_path
= g_build_filename(ssh_path
, "authorized_keys", NULL
);
139 authkeys
= read_authkeys(authkeys_path
, NULL
);
141 if (authkeys
== NULL
) {
142 if (!g_file_test(ssh_path
, G_FILE_TEST_IS_DIR
) &&
143 !mkdir_for_user(ssh_path
, p
, 0700, errp
)) {
148 nauthkeys
= authkeys
? g_strv_length(authkeys
) : 0;
149 authkeys
= g_realloc_n(authkeys
, nauthkeys
+ nkeys
+ 1, sizeof(char *));
150 memset(authkeys
+ nauthkeys
, 0, (nkeys
+ 1) * sizeof(char *));
152 for (k
= keys
; k
!= NULL
; k
= k
->next
) {
153 if (g_strv_contains((const gchar
* const *)authkeys
, k
->value
)) {
156 authkeys
[nauthkeys
++] = g_strdup(k
->value
);
159 write_authkeys(authkeys_path
, authkeys
, p
, errp
);
163 qmp_guest_ssh_remove_authorized_keys(const char *username
, strList
*keys
,
166 g_autofree
struct passwd
*p
= NULL
;
167 g_autofree
char *authkeys_path
= NULL
;
168 g_autofree GStrv new_keys
= NULL
; /* do not own the strings */
169 g_auto(GStrv
) authkeys
= NULL
;
173 if (!check_openssh_pub_keys(keys
, NULL
, errp
)) {
177 p
= get_passwd_entry(username
, errp
);
182 authkeys_path
= g_build_filename(p
->pw_dir
, ".ssh",
183 "authorized_keys", NULL
);
184 if (!g_file_test(authkeys_path
, G_FILE_TEST_EXISTS
)) {
187 authkeys
= read_authkeys(authkeys_path
, errp
);
188 if (authkeys
== NULL
) {
192 new_keys
= g_new0(char *, g_strv_length(authkeys
) + 1);
193 for (a
= authkeys
; *a
!= NULL
; a
++) {
196 for (k
= keys
; k
!= NULL
; k
= k
->next
) {
197 if (g_str_equal(k
->value
, *a
)) {
205 new_keys
[nkeys
++] = *a
;
208 write_authkeys(authkeys_path
, new_keys
, p
, errp
);
211 GuestAuthorizedKeys
*
212 qmp_guest_ssh_get_authorized_keys(const char *username
, Error
**errp
)
214 g_autofree
struct passwd
*p
= NULL
;
215 g_autofree
char *authkeys_path
= NULL
;
216 g_auto(GStrv
) authkeys
= NULL
;
217 g_autoptr(GuestAuthorizedKeys
) ret
= NULL
;
220 p
= get_passwd_entry(username
, errp
);
225 authkeys_path
= g_build_filename(p
->pw_dir
, ".ssh",
226 "authorized_keys", NULL
);
227 authkeys
= read_authkeys(authkeys_path
, errp
);
228 if (authkeys
== NULL
) {
232 ret
= g_new0(GuestAuthorizedKeys
, 1);
233 for (i
= 0; authkeys
[i
] != NULL
; i
++) {
234 g_strstrip(authkeys
[i
]);
235 if (!authkeys
[i
][0] || authkeys
[i
][0] == '#') {
239 QAPI_LIST_PREPEND(ret
->keys
, g_strdup(authkeys
[i
]));
242 return g_steal_pointer(&ret
);
245 #ifdef QGA_BUILD_UNIT_TEST
246 #if GLIB_CHECK_VERSION(2, 60, 0)
247 static const strList test_key2
= {
248 .value
= (char *)"algo key2 comments"
251 static const strList test_key1_2
= {
252 .value
= (char *)"algo key1 comments",
253 .next
= (strList
*)&test_key2
,
257 test_get_authorized_keys_path(void)
259 return g_build_filename(g_get_home_dir(), ".ssh", "authorized_keys", NULL
);
263 test_authorized_keys_set(const char *contents
)
265 g_autoptr(GError
) err
= NULL
;
266 g_autofree
char *path
= NULL
;
269 path
= g_build_filename(g_get_home_dir(), ".ssh", NULL
);
270 ret
= g_mkdir_with_parents(path
, 0700);
274 path
= test_get_authorized_keys_path();
275 g_file_set_contents(path
, contents
, -1, &err
);
276 g_assert(err
== NULL
);
280 test_authorized_keys_equal(const char *expected
)
282 g_autoptr(GError
) err
= NULL
;
283 g_autofree
char *path
= NULL
;
284 g_autofree
char *contents
= NULL
;
286 path
= test_get_authorized_keys_path();
287 g_file_get_contents(path
, &contents
, NULL
, &err
);
288 g_assert(err
== NULL
);
290 g_assert(g_strcmp0(contents
, expected
) == 0);
294 test_invalid_user(void)
298 qmp_guest_ssh_add_authorized_keys("", NULL
, FALSE
, FALSE
, &err
);
299 error_free_or_abort(&err
);
301 qmp_guest_ssh_remove_authorized_keys("", NULL
, &err
);
302 error_free_or_abort(&err
);
306 test_invalid_key(void)
309 .value
= (char *)"not a valid\nkey"
313 qmp_guest_ssh_add_authorized_keys(g_get_user_name(), &key
,
315 error_free_or_abort(&err
);
317 qmp_guest_ssh_remove_authorized_keys(g_get_user_name(), &key
, &err
);
318 error_free_or_abort(&err
);
326 qmp_guest_ssh_add_authorized_keys(g_get_user_name(),
327 (strList
*)&test_key2
,
330 g_assert(err
== NULL
);
332 test_authorized_keys_equal("algo key2 comments");
334 qmp_guest_ssh_add_authorized_keys(g_get_user_name(),
335 (strList
*)&test_key1_2
,
338 g_assert(err
== NULL
);
340 /* key2 came first, and shouldn't be duplicated */
341 test_authorized_keys_equal("algo key2 comments\n"
342 "algo key1 comments");
346 test_add_reset_keys(void)
350 qmp_guest_ssh_add_authorized_keys(g_get_user_name(),
351 (strList
*)&test_key1_2
,
354 g_assert(err
== NULL
);
356 /* reset with key2 only */
357 test_authorized_keys_equal("algo key1 comments\n"
358 "algo key2 comments");
360 qmp_guest_ssh_add_authorized_keys(g_get_user_name(),
361 (strList
*)&test_key2
,
364 g_assert(err
== NULL
);
366 test_authorized_keys_equal("algo key2 comments");
368 /* empty should clear file */
369 qmp_guest_ssh_add_authorized_keys(g_get_user_name(),
373 g_assert(err
== NULL
);
375 test_authorized_keys_equal("");
379 test_remove_keys(void)
382 static const char *authkeys
=
383 "algo key1 comments\n"
384 /* originally duplicated */
385 "algo key1 comments\n"
386 "# a commented line\n"
387 "algo some-key another\n";
389 test_authorized_keys_set(authkeys
);
390 qmp_guest_ssh_remove_authorized_keys(g_get_user_name(),
391 (strList
*)&test_key2
, &err
);
392 g_assert(err
== NULL
);
393 test_authorized_keys_equal(authkeys
);
395 qmp_guest_ssh_remove_authorized_keys(g_get_user_name(),
396 (strList
*)&test_key1_2
, &err
);
397 g_assert(err
== NULL
);
398 test_authorized_keys_equal("# a commented line\n"
399 "algo some-key another\n");
406 static const char *authkeys
=
407 "algo key1 comments\n"
408 "# a commented line\n"
409 "algo some-key another\n";
410 g_autoptr(GuestAuthorizedKeys
) ret
= NULL
;
414 test_authorized_keys_set(authkeys
);
416 ret
= qmp_guest_ssh_get_authorized_keys(g_get_user_name(), &err
);
417 g_assert(err
== NULL
);
419 for (len
= 0, k
= ret
->keys
; k
!= NULL
; k
= k
->next
) {
420 g_assert(g_str_has_prefix(k
->value
, "algo "));
427 int main(int argc
, char *argv
[])
429 setlocale(LC_ALL
, "");
431 g_test_init(&argc
, &argv
, G_TEST_OPTION_ISOLATE_DIRS
, NULL
);
433 g_test_add_func("/qga/ssh/invalid_user", test_invalid_user
);
434 g_test_add_func("/qga/ssh/invalid_key", test_invalid_key
);
435 g_test_add_func("/qga/ssh/add_keys", test_add_keys
);
436 g_test_add_func("/qga/ssh/add_reset_keys", test_add_reset_keys
);
437 g_test_add_func("/qga/ssh/remove_keys", test_remove_keys
);
438 g_test_add_func("/qga/ssh/get_keys", test_get_keys
);
443 int main(int argc
, char *argv
[])
445 g_test_message("test skipped, needs glib >= 2.60");
448 #endif /* GLIB_2_60 */
449 #endif /* BUILD_UNIT_TEST */