57 lines
3.1 KiB
Nu
57 lines
3.1 KiB
Nu
#!/usr/bin/env nu
|
|
# Verify SSH streams, host trust, host denial, and standard WASI imports.
|
|
use std/assert
|
|
def wasi [component: path, root: path, args: list, input: string = ''] {
|
|
let ready = (open ($root | path join ready.json))
|
|
$input | ^wasmtime run -S inherit-network -S allow-ip-name-lookup -S http -S cli-exit-with-code=y --dir $'($root)/guest::/' --env HOME=/home --env $'SAUSAGE_HOST_API=http://127.0.0.1:($ready.api)' $component ...$args | complete
|
|
}
|
|
def main [component: path, root: path] {
|
|
let component = ($component | path expand)
|
|
let root = ($root | path expand)
|
|
let wit = (^wasm-tools component wit $component | complete)
|
|
assert equal $wit.exit_code 0
|
|
let imports = ($wit.stdout | lines | str trim | where {|line| $line | str starts-with 'import '})
|
|
assert (not ($imports | is-empty))
|
|
assert ($imports | all {|line| $line | str starts-with 'import wasi:'})
|
|
print 'SSH component imports: PASS (WASI only)'
|
|
print ($imports | str join (char newline))
|
|
let ready = (open ($root | path join ready.json))
|
|
let destination = $'($ready.user)@127.0.0.1'
|
|
let args = [-p $ready.ssh $destination 'echo hi; exit 3']
|
|
let unknown = (wasi $component $root $args)
|
|
assert equal $unknown.exit_code 255
|
|
assert ($unknown.stderr | str contains 'Host key verification failed')
|
|
print 'Unknown host key: PASS'
|
|
let accepted = (wasi $component $root ([-o StrictHostKeyChecking=accept-new] | append $args))
|
|
assert equal $accepted.exit_code 3
|
|
assert equal $accepted.stdout $"hi\n"
|
|
assert (($root | path join guest/home/.ssh/known_hosts) | path exists)
|
|
print 'Accept-new records the host key, prints hi, and exits 3: PASS'
|
|
let repeated = (wasi $component $root $args)
|
|
assert equal $repeated.exit_code 3
|
|
assert equal $repeated.stdout $"hi\n"
|
|
print 'Known host key: PASS'
|
|
let streams = (wasi $component $root [-p $ready.ssh -l $ready.user 127.0.0.1 'cat; echo error >&2; exit 7'] $"input\n")
|
|
assert equal $streams.exit_code 7
|
|
assert equal $streams.stdout $"input\n"
|
|
assert equal $streams.stderr $"error\n"
|
|
print 'Stdin, stdout, stderr, -l user, and remote exit 7: PASS'
|
|
let default_user = (wasi $component $root [-p $ready.ssh 127.0.0.1 'echo default'])
|
|
assert equal $default_user.exit_code 0
|
|
assert equal $default_user.stdout $"default\n"
|
|
print 'Default user from host identity: PASS'
|
|
'deny' | save ($root | path join host/deny)
|
|
let denied = (wasi $component $root $args)
|
|
assert equal $denied.exit_code 255
|
|
assert ($denied.stderr | str contains 'test-key')
|
|
assert ($denied.stderr | str contains 'test-request')
|
|
print 'Host API 403 names the item and request, and exits 255: PASS'
|
|
rm ($root | path join host/deny)
|
|
http post --content-type application/json $'http://127.0.0.1:($ready.api)/fixture/rotate' '{}' | ignore
|
|
let changed = (wasi $component $root ([-o StrictHostKeyChecking=accept-new] | append $args))
|
|
assert equal $changed.exit_code 255
|
|
assert ($changed.stderr | str contains 'REMOTE HOST IDENTIFICATION HAS CHANGED')
|
|
print 'Changed host key fails even with accept-new: PASS'
|
|
print $'Fixture: ($root)'
|
|
}
|