/*

 * This file is part of the SSH Library

 *

 * Copyright (c) 2019 by Red Hat, Inc.

 *

 * Author: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

 *

 * The SSH Library is free software; you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as published by

 * the Free Software Foundation; either version 2.1 of the License, or (at your

 * option) any later version.

 *

 * The SSH Library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY

 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public

 * License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with the SSH Library; see the file COPYING.  If not, write to

 * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,

 * MA 02111-1307, USA.

 */

#define LIBSSH_STATIC

#include "config.h"

#include "torture.h"

#include "libssh/scp.h"

#include <sys/stat.h>

#include <sys/types.h>

#include <fcntl.h>

#include <pwd.h>

#include <errno.h>

#define BUF_SIZE 1024

#define TEMPLATE BINARYDIR "/tests/home/alice/temp_dir_XXXXXX"

#define ALICE_HOME BINARYDIR "/tests/home/alice"

struct scp_st {

    struct torture_state *s;

    char *tmp_dir;

    char *tmp_dir_basename;

};

static int sshd_setup(void **state)

{

    struct scp_st *ts = NULL;

    struct torture_state *s = NULL;

    ts = (struct scp_st *)calloc(1, sizeof(struct scp_st));

    assert_non_null(ts);

    torture_setup_sshd_server((void **)&s, false);

    assert_non_null(s);

    ts->s = s;

    *state = ts;

    return 0;

}

static int sshd_teardown(void **state)

{

    struct scp_st *ts = NULL;

    ts = *((struct scp_st **)state);

    assert_non_null(ts);

    assert_non_null(ts->s);

    torture_teardown_sshd_server((void **)&(ts->s));

    SAFE_FREE(ts);

    return 0;

}

static int session_setup(void **state)

{

    struct scp_st *ts = NULL;

    struct torture_state *s = NULL;

    char *tmp_dir = NULL;

    char *tmp_dir_basename = NULL;

    struct passwd *pwd;

    int rc;

    assert_non_null(state);

    ts = *state;

    assert_non_null(ts);

    assert_non_null(ts->s);

    s = ts->s;

    /* Create temporary directory for alice */

    tmp_dir = torture_make_temp_dir(TEMPLATE);

    assert_non_null(tmp_dir);

    ts->tmp_dir = tmp_dir;

    tmp_dir_basename = ssh_basename(tmp_dir);

    assert_non_null(tmp_dir_basename);

    ts->tmp_dir_basename = tmp_dir_basename;

    pwd = getpwnam("bob");

    assert_non_null(pwd);

    rc = setuid(pwd->pw_uid);

    assert_return_code(rc, errno);

    s->ssh.session = torture_ssh_session(s,

                                         TORTURE_SSH_SERVER,

                                         NULL,

                                         TORTURE_SSH_USER_ALICE,

                                         NULL);

    assert_non_null(s->ssh.session);

    return 0;

}

static int session_teardown(void **state)

{

    struct scp_st *ts = NULL;

    struct torture_state *s = NULL;

    assert_non_null(state);

    ts = *((struct scp_st **)state);

    assert_non_null(ts->s);

    s = ts->s;

    ssh_disconnect(s->ssh.session);

    ssh_free(s->ssh.session);

    assert_non_null(ts->tmp_dir);

    torture_rmdirs(ts->tmp_dir);

    SAFE_FREE(ts->tmp_dir);

    SAFE_FREE(ts->tmp_dir_basename);

    return 0;

}

static void torture_scp_upload(void **state)

{

    struct scp_st *ts = NULL;

    struct torture_state *s = NULL;

    ssh_session session = NULL;

    ssh_scp scp = NULL;

    char expected_a[BUF_SIZE];

    char buf[BUF_SIZE];

    FILE *file = NULL;

    size_t len = 0;

    int rc;

    assert_non_null(state);

    ts = *state;

    assert_non_null(ts->s);

    s = ts->s;

    session = s->ssh.session;

    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);

    assert_non_null(ts->tmp_dir);

    /* Upload file "a" to alice's temp dir */

    /* When writing the file_name must be the directory name */

    scp = ssh_scp_new(session, SSH_SCP_WRITE, ts->tmp_dir_basename);

    assert_non_null(scp);

    rc = ssh_scp_init(scp);

    assert_ssh_return_code(session, rc);

    /* Init buffer content to be written */

    memset(expected_a, 'A', BUF_SIZE);

    /* For ssh_scp_push_file(), the file_name is the name of the file without

     * path */

    rc = ssh_scp_push_file(scp, "a", BUF_SIZE, 0644);

    assert_ssh_return_code(session, rc);

    rc = ssh_scp_write(scp, expected_a, BUF_SIZE);

    assert_ssh_return_code(session, rc);

    /* Cleanup */

    ssh_scp_close(scp);

    ssh_scp_free(scp);

    /* Open file and check content */

    snprintf(buf, BUF_SIZE, "%s/a", ts->tmp_dir);

    file = fopen(buf, "r");

    assert_non_null(file);

    len = fread(buf, BUF_SIZE, 1, file);

    assert_int_equal(len, 1);

    assert_memory_equal(buf, expected_a, BUF_SIZE);

    fclose(file);

}

static void torture_scp_upload_recursive(void **state)

{

    struct scp_st *ts = NULL;

    struct torture_state *s = NULL;

    ssh_session session = NULL;

    ssh_scp scp = NULL;

    char expected_b[BUF_SIZE];

    char buf[BUF_SIZE];

    FILE *file = NULL;

    size_t len = 0;

    int rc;

    assert_non_null(state);

    ts = *state;

    assert_non_null(ts->s);

    s = ts->s;

    session = s->ssh.session;

    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);

    assert_non_null(ts->tmp_dir);

    /* Upload directory "test_dir" containing file "b" to alice's temp dir */

    /* When writing the file_name must be the directory name */

    scp = ssh_scp_new(session, SSH_SCP_WRITE | SSH_SCP_RECURSIVE,

                      ts->tmp_dir_basename);

    assert_non_null(scp);

    rc = ssh_scp_init(scp);

    assert_ssh_return_code(session, rc);

    /* Push directory where the new file will be copied */

    rc = ssh_scp_push_directory(scp, "test_dir", 0755);

    assert_ssh_return_code(session, rc);

    memset(expected_b, 'B', BUF_SIZE);

    /* For ssh_scp_push_file(), the file_name is the name of the file without

     * path */

    rc = ssh_scp_push_file(scp, "b", BUF_SIZE, 0644);

    assert_ssh_return_code(session, rc);

    rc = ssh_scp_write(scp, expected_b, BUF_SIZE);

    assert_ssh_return_code(session, rc);

    /* Leave the directory */

    rc = ssh_scp_leave_directory(scp);

    assert_ssh_return_code(session, rc);

    /* Cleanup */

    ssh_scp_close(scp);

    ssh_scp_free(scp);

    /* Open file and check content */

    snprintf(buf, BUF_SIZE, "%s/test_dir/b", ts->tmp_dir);

    file = fopen(buf, "r");

    assert_non_null(file);

    len = fread(buf, BUF_SIZE, 1, file);

    assert_int_equal(len, 1);

    assert_memory_equal(buf, expected_b, BUF_SIZE);

    fclose(file);

}

static void torture_scp_download(void **state)

{

    struct scp_st *ts = NULL;

    struct torture_state *s = NULL;

    ssh_session session = NULL;

    ssh_scp scp = NULL;

    char expected_a[BUF_SIZE];

    char buf[BUF_SIZE];

    const char *remote_file = NULL;

    FILE *file = NULL;

    int fd = 0;

    size_t size;

    int mode;

    int rc;

    assert_non_null(state);

    ts = *state;

    assert_non_null(ts);

    assert_non_null(ts->s);

    s = ts->s;

    session = s->ssh.session;

    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);

    assert_non_null(ts->tmp_dir);

    /* Create file "a" for alice */

    memset(expected_a, 'A', BUF_SIZE);

    snprintf(buf, BUF_SIZE, "%s/a", ts->tmp_dir);

    fd = open(buf, O_WRONLY | O_CREAT, 0644);

    assert_true(fd > 0);

    file = fdopen(fd, "w");

    assert_non_null(file);

    size = fwrite(expected_a, 1, BUF_SIZE, file);

    assert_int_equal(size, BUF_SIZE);

    fclose(file);

    /* Construct the file path */

    snprintf(buf, BUF_SIZE, "%s/a", ts->tmp_dir_basename);

    /* When reading, the location is the file path */

    scp = ssh_scp_new(session, SSH_SCP_READ, buf);

    assert_non_null(scp);

    rc = ssh_scp_init(scp);

    assert_ssh_return_code(session, rc);

    rc = ssh_scp_pull_request(scp);

    assert_int_equal(rc, SSH_SCP_REQUEST_NEWFILE);

    size = ssh_scp_request_get_size(scp);

    assert_int_equal(size, BUF_SIZE);

    mode = ssh_scp_request_get_permissions(scp);

    assert_int_equal(mode, 0644);

    remote_file = ssh_scp_request_get_filename(scp);

    assert_non_null(remote_file);

    assert_string_equal(remote_file, "a");

    rc = ssh_scp_accept_request(scp);

    assert_ssh_return_code(session, rc);

    rc = ssh_scp_read(scp, buf, BUF_SIZE);

    assert_int_equal(rc, size);

    assert_memory_equal(expected_a, buf, BUF_SIZE);

    /* Cleanup */

    ssh_scp_close(scp);

    ssh_scp_free(scp);

}

static void torture_scp_download_recursive(void **state)

{

    struct scp_st *ts = NULL;

    struct torture_state *s = NULL;

    ssh_session session = NULL;

    ssh_scp scp = NULL;

    char expected_b[BUF_SIZE];

    char buf[BUF_SIZE];

    const char *remote_file = NULL;

    FILE *file = NULL;

    int fd = 0;

    size_t size;

    int mode;

    int rc;

    assert_non_null(state);

    ts = *state;

    assert_non_null(ts->s);

    s = ts->s;

    session = s->ssh.session;

    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);

    assert_non_null(ts->tmp_dir);

    /* Create file "b" for alice */

    memset(expected_b, 'B', BUF_SIZE);

    snprintf(buf, BUF_SIZE, "%s/b", ts->tmp_dir);

    fd = open(buf, O_WRONLY | O_CREAT, 0644);

    assert_true(fd > 0);

    file = fdopen(fd, "w");

    assert_non_null(file);

    size = fwrite(expected_b, 1, BUF_SIZE, file);

    assert_int_equal(size, BUF_SIZE);

    fclose(file);

    /* Copy the directory containing the file "b" */

    scp = ssh_scp_new(session, SSH_SCP_READ | SSH_SCP_RECURSIVE,

                      ts->tmp_dir_basename);

    assert_non_null(scp);

    rc = ssh_scp_init(scp);

    assert_ssh_return_code(session, rc);

    /* Receive the directory */

    rc = ssh_scp_pull_request(scp);

    assert_int_equal(rc, SSH_SCP_REQUEST_NEWDIR);

    mode = ssh_scp_request_get_permissions(scp);

    assert_int_equal(mode, 0700);

    remote_file = ssh_scp_request_get_filename(scp);

    assert_non_null(remote_file);

    assert_string_equal(remote_file, ts->tmp_dir_basename);

    rc = ssh_scp_accept_request(scp);

    assert_ssh_return_code(session, rc);

    /* Receive the file "b" */

    rc = ssh_scp_pull_request(scp);

    assert_int_equal(rc, SSH_SCP_REQUEST_NEWFILE);

    size = ssh_scp_request_get_size(scp);

    assert_int_equal(size, BUF_SIZE);

    mode = ssh_scp_request_get_permissions(scp);

    assert_int_equal(mode, 0644);

    remote_file = ssh_scp_request_get_filename(scp);

    assert_non_null(remote_file);

    assert_string_equal(remote_file, "b");

    rc = ssh_scp_accept_request(scp);

    assert_ssh_return_code(session, rc);

    rc = ssh_scp_read(scp, buf, BUF_SIZE);

    assert_int_equal(rc, size);

    /* Check if the content was the expected */

    assert_memory_equal(expected_b, buf, BUF_SIZE);

    /* Receive end of directory */

    rc = ssh_scp_pull_request(scp);

    assert_int_equal(rc, SSH_SCP_REQUEST_ENDDIR);

    /* Receive end of communication */

    rc = ssh_scp_pull_request(scp);

    assert_int_equal(rc, SSH_SCP_REQUEST_EOF);

    /* Cleanup */

    ssh_scp_close(scp);

    ssh_scp_free(scp);

}

static void torture_scp_upload_newline(void **state)

{

    struct scp_st *ts = NULL;

    struct torture_state *s = NULL;

    ssh_session session = NULL;

    ssh_scp scp = NULL;

    FILE *file = NULL;

    char buf[1024];

    char *rs = NULL;

    int rc;

    assert_non_null(state);

    ts = *state;

    assert_non_null(ts->s);

    s = ts->s;

    session = s->ssh.session;

    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);

    assert_non_null(ts->tmp_dir);

    /* Upload recursively trying to inject protocol messages */

    /* When writing the file_name must be the directory name */

    scp = ssh_scp_new(session, SSH_SCP_WRITE | SSH_SCP_RECURSIVE,

                      ts->tmp_dir_basename);

    assert_non_null(scp);

    rc = ssh_scp_init(scp);

    assert_ssh_return_code(session, rc);

    /* Push directory where the new file will be copied */

    rc = ssh_scp_push_directory(scp, "test_inject", 0755);

    assert_ssh_return_code(session, rc);

    /* Try to push file with injected protocol messages */

    rc = ssh_scp_push_file(scp, "original\nreplacedC0777 8 injected", 8, 0644);

    assert_ssh_return_code(session, rc);

    rc = ssh_scp_write(scp, "original", 8);

    assert_ssh_return_code(session, rc);

    /* Leave the directory */

    rc = ssh_scp_leave_directory(scp);

    assert_ssh_return_code(session, rc);

    /* Cleanup */

    ssh_scp_close(scp);

    ssh_scp_free(scp);

    /* Open the file and check content */

    snprintf(buf, BUF_SIZE, "%s/test_inject/"

             "original\\nreplacedC0777 8 injected",

             ts->tmp_dir);

    file = fopen(buf, "r");

    assert_non_null(file);

    rs = fgets(buf, 1024, file);

    assert_non_null(rs);

    assert_string_equal(buf, "original");

    fclose(file);

}

static void torture_scp_upload_appended_command(void **state)

{

    struct scp_st *ts = NULL;

    struct torture_state *s = NULL;

    ssh_session session = NULL;

    ssh_scp scp = NULL;

    FILE *file = NULL;

    char buf[1024];

    char *rs = NULL;

    int rc;

    assert_non_null(state);

    ts = *state;

    assert_non_null(ts->s);

    s = ts->s;

    session = s->ssh.session;

    assert_non_null(session);

    assert_non_null(ts->tmp_dir_basename);

    assert_non_null(ts->tmp_dir);

    /* Upload a file path with a command appended */

    /* Append a command to the file path */

    snprintf(buf, BUF_SIZE, "%s"

             "/;touch hack",

             ts->tmp_dir);

    /* When writing the file_name must be the directory name */

    scp = ssh_scp_new(session, SSH_SCP_WRITE | SSH_SCP_RECURSIVE,

                      buf);

    assert_non_null(scp);

    rc = ssh_scp_init(scp);

    assert_ssh_return_code(session, rc);

    /* Push directory where the new file will be copied */

    rc = ssh_scp_push_directory(scp, ";touch hack", 0755);

    assert_ssh_return_code(session, rc);

    /* Try to push file */

    rc = ssh_scp_push_file(scp, "original", 8, 0644);

    assert_ssh_return_code(session, rc);

    rc = ssh_scp_write(scp, "original", 8);

    assert_ssh_return_code(session, rc);

    /* Leave the directory */

    rc = ssh_scp_leave_directory(scp);

    assert_ssh_return_code(session, rc);

    /* Cleanup */

    ssh_scp_close(scp);

    ssh_scp_free(scp);

    /* Make sure the command was not executed */

    snprintf(buf, BUF_SIZE, ALICE_HOME "/hack");

    file = fopen(buf, "r");

    assert_null(file);

    /* Open the file and check content */

    snprintf(buf, BUF_SIZE, "%s"

             "/;touch hack/original",

             ts->tmp_dir);

    file = fopen(buf, "r");

    assert_non_null(file);

    rs = fgets(buf, 1024, file);

    assert_non_null(rs);

    assert_string_equal(buf, "original");

    fclose(file);

}

int torture_run_tests(void)

{

    int rc;

    struct CMUnitTest tests[] = {

        cmocka_unit_test_setup_teardown(torture_scp_upload,

                                        session_setup,

                                        session_teardown),

        cmocka_unit_test_setup_teardown(torture_scp_upload_recursive,

                                        session_setup,

                                        session_teardown),

        cmocka_unit_test_setup_teardown(torture_scp_download,

                                        session_setup,

                                        session_teardown),

        cmocka_unit_test_setup_teardown(torture_scp_download_recursive,

                                        session_setup,

                                        session_teardown),

        cmocka_unit_test_setup_teardown(torture_scp_upload_newline,

                                        session_setup,

                                        session_teardown),

        cmocka_unit_test_setup_teardown(torture_scp_upload_appended_command,

                                        session_setup,

                                        session_teardown),

    };

    ssh_init();

    torture_filter_tests(tests);

    rc = cmocka_run_group_tests(tests, sshd_setup, sshd_teardown);

    ssh_finalize();

    return rc;

}