mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-10-21 15:18:19 +00:00
Vinícius Ferrão
90 lines
3.8 KiB
Perl
90 lines
3.8 KiB
Perl
#!/usr/bin/env perl
|
|
use strict;
|
|
use warnings;
|
|
|
|
use FindBin;
|
|
use File::Path qw(make_path);
|
|
use File::Spec;
|
|
use File::Slurper qw(read_text write_text);
|
|
use File::Temp qw(tempdir);
|
|
use Test::More;
|
|
|
|
use lib "$FindBin::Bin/../lib";
|
|
use lib "$FindBin::Bin/../../perl-xCAT";
|
|
use XCAT::Test::File qw(repo_path);
|
|
use xCAT::Utils;
|
|
|
|
my $tmpdir = tempdir(CLEANUP => 1);
|
|
my $fips_status = File::Spec->catfile($tmpdir, 'fips_enabled');
|
|
|
|
write_text($fips_status, "1\n");
|
|
ok(xCAT::Utils->isFIPS($fips_status), 'kernel status 1 enables FIPS mode');
|
|
|
|
write_text($fips_status, "0\n");
|
|
ok(!xCAT::Utils->isFIPS($fips_status), 'kernel status 0 disables FIPS mode');
|
|
write_text($fips_status, " 1 \n");
|
|
ok(xCAT::Utils->isFIPS($fips_status), 'kernel status permits surrounding whitespace');
|
|
write_text($fips_status, "enabled\n");
|
|
ok(!xCAT::Utils->isFIPS($fips_status), 'malformed kernel status does not enable FIPS mode');
|
|
write_text($fips_status, '');
|
|
ok(!xCAT::Utils->isFIPS($fips_status), 'empty kernel status does not enable FIPS mode');
|
|
ok(!xCAT::Utils->isFIPS(File::Spec->catfile($tmpdir, 'missing')), 'missing kernel status is not FIPS mode');
|
|
|
|
foreach my $case (
|
|
['el7', 1], ['el8', 1], ['el9', 1], ['el10', 0], ['el11', 0],
|
|
['ubuntu', 1], ['sles12', 1], ['sles15', 1], ['aix', 1],
|
|
) {
|
|
my ($platform, $legacy_allowed) = @{$case};
|
|
is(xCAT::Utils->dsaHostKeyAllowed($platform, 0), $legacy_allowed,
|
|
"$platform retains its non-FIPS DSA policy");
|
|
is(xCAT::Utils->dsaHostKeyAllowed($platform, 1), 0,
|
|
"$platform rejects DSA in FIPS mode");
|
|
}
|
|
|
|
SKIP: {
|
|
skip 'statelite requires Linux shell utilities', 12 unless $^O eq 'linux';
|
|
|
|
foreach my $with_dsa (0, 1) {
|
|
my $fixture = tempdir(CLEANUP => 1);
|
|
my $image = "$fixture/image";
|
|
make_path("$fixture/hostkeys", "$fixture/client",
|
|
"$image/etc/ssh", "$image/root/.ssh");
|
|
write_text("$image/etc/ssh/sshd_config", "X11Forwarding no\n");
|
|
write_text("$fixture/hostkeys/ssh_host_rsa_key", "rsa-host-key\n");
|
|
write_text("$fixture/hostkeys/ssh_host_dsa_key", "dsa-host-key\n")
|
|
if $with_dsa;
|
|
write_text("$fixture/client/$_", "client-$_\n") for qw(id_rsa id_rsa.pub config);
|
|
|
|
my $source = read_text(repo_path('xCAT-server/share/xcat/netboot/add-on/statelite/add_ssh'));
|
|
$source =~ s{/etc/xcat/hostkeys}{$fixture/hostkeys}g;
|
|
$source =~ s{/install/postscripts/_ssh}{$fixture/postscript-keys}g;
|
|
$source =~ s{(?<!\$ROOTDIR)/root/\.ssh}{$fixture/client}g;
|
|
$source =~ s{(?<!\$ROOTDIR)/etc/ssh/ssh_config}{$fixture/client/ssh_config}g;
|
|
write_text("$fixture/add_ssh", $source);
|
|
|
|
my $pid = fork();
|
|
die "fork: $!" unless defined $pid;
|
|
if (!$pid) {
|
|
open(STDOUT, '>', "$fixture/stdout") or die $!;
|
|
open(STDERR, '>', "$fixture/stderr") or die $!;
|
|
$ENV{XCATROOT} = $fixture;
|
|
exec('bash', "$fixture/add_ssh", $image);
|
|
die "exec bash: $!";
|
|
}
|
|
waitpid($pid, 0);
|
|
is($?, 0, "statelite completes with DSA present=$with_dsa");
|
|
is(read_text("$fixture/stderr"), '',
|
|
"statelite reports no missing-key errors with DSA present=$with_dsa");
|
|
like(read_text("$fixture/client/ssh_config"), qr/StrictHostKeyChecking no/,
|
|
'statelite writes client configuration only inside the fixture');
|
|
is(read_text("$image/etc/ssh/ssh_host_rsa_key"), "rsa-host-key\n",
|
|
"statelite preserves the RSA host key with DSA present=$with_dsa");
|
|
is(-f "$image/etc/ssh/ssh_host_dsa_key" ? 1 : 0, $with_dsa,
|
|
'statelite copies the optional DSA key only when supplied');
|
|
is((stat("$image/etc/ssh/ssh_host_rsa_key"))[2] & oct('0777'), oct('0600'),
|
|
'statelite limits host-key permissions');
|
|
}
|
|
}
|
|
|
|
done_testing();
|