Function TestSubsystem

internal/security/handler_session_test.go:140–181

(t *testing.T)

}

func TestSubsystem(t *testing.T) {
	backend := &dummyBackend{}
	session := &sessionHandler{
		config:  config.SecurityConfig{},
		backend: backend,
		sshConnection: &sshConnectionHandler{
			lock: &sync.Mutex{},
		},
		logger: log.NewTestLogger(t),
	}

	session.config.Subsystem.Mode = config.ExecutionPolicyDisable
	assert.Error(t, session.OnSubsystem(1, "sftp"))

	session.config.Subsystem.Mode = config.ExecutionPolicyFilter
	assert.Error(t, session.OnSubsystem(1, "sftp"))
	session.config.Subsystem.Allow = []string{"sftp"}
	assert.NoError(t, session.OnSubsystem(1, "sftp"))

	session.config.Subsystem.Mode = config.ExecutionPolicyEnable
	session.config.Subsystem.Allow = []string{}
	assert.NoError(t, session.OnSubsystem(1, "sftp"))
	session.config.Subsystem.Deny = []string{"sftp"}
	assert.Error(t, session.OnSubsystem(1, "sftp"))

	session.config.Subsystem.Mode = config.ExecutionPolicyEnable
	backend.commandsExecuted = []string{}
	session.config.Subsystem.Deny = []string{}
	backend.env = map[string]string{}
	assert.NoError(t, session.OnSubsystem(1, "sftp"))
	assert.Equal(t, []string{"sftp"}, backend.commandsExecuted)
	assert.Equal(t, map[string]string{}, backend.env)

	session.config.Subsystem.Mode = config.ExecutionPolicyEnable
	session.config.ForceCommand = "/bin/wrapper"
	backend.commandsExecuted = []string{}
	session.config.Subsystem.Deny = []string{}
	backend.env = map[string]string{}
	assert.NoError(t, session.OnSubsystem(1, "sftp"))
	assert.Equal(t, []string{"/bin/wrapper"}, backend.commandsExecuted)
	assert.Equal(t, map[string]string{"SSH_ORIGINAL_COMMAND": "sftp"}, backend.env)
}

// region Dummy backend
type dummyBackend struct {