From 7569bb9217d552fd9e9deffd4697d83311f1124e Mon Sep 17 00:00:00 2001
From: djm <djm@openbsd.org>
Date: Fri, 6 Jan 2023 08:07:39 +0000
Subject: [PATCH] regression test for ChannelTimeout

---
 regress/usr.bin/ssh/Makefile           |  7 +-
 regress/usr.bin/ssh/channel-timeout.sh | 91 ++++++++++++++++++++++++++
 2 files changed, 95 insertions(+), 3 deletions(-)
 create mode 100644 regress/usr.bin/ssh/channel-timeout.sh

diff --git a/regress/usr.bin/ssh/Makefile b/regress/usr.bin/ssh/Makefile
index febc206e944..c4a56b976cd 100644
--- a/regress/usr.bin/ssh/Makefile
+++ b/regress/usr.bin/ssh/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.121 2022/12/01 02:22:13 dtucker Exp $
+#	$OpenBSD: Makefile,v 1.122 2023/01/06 08:07:39 djm Exp $
 
 OPENSSL?=	yes
 
@@ -99,7 +99,8 @@ LTESTS= 	connect \
 		knownhosts \
 		knownhosts-command \
 		agent-restrict \
-		hostbased
+		hostbased \
+		channel-timeout
 
 INTEROP_TESTS=	putty-transfer putty-ciphers putty-kex conch-ciphers
 #INTEROP_TESTS+=ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
@@ -125,7 +126,7 @@ CLEANFILES+=	*.core actual agent-key.* authorized_keys_${USERNAME} \
 		rsa_ssh2_crnl.prv scp-ssh-wrapper.exe \
 		scp-ssh-wrapper.scp setuid-allowed sftp-server.log \
 		sftp-server.sh sftp.log ssh-log-wrapper.sh ssh.log \
-		ssh-agent.log ssh-add.log \
+		ssh-agent.log ssh-add.log slow-sftp-server.sh \
 		ssh-rsa_oldfmt knownhosts_command \
 		ssh_config ssh_config.* ssh_proxy ssh_proxy_bak \
 		ssh_proxy_* sshd.log sshd_config sshd_config.* \
diff --git a/regress/usr.bin/ssh/channel-timeout.sh b/regress/usr.bin/ssh/channel-timeout.sh
new file mode 100644
index 00000000000..1c42e832ae2
--- /dev/null
+++ b/regress/usr.bin/ssh/channel-timeout.sh
@@ -0,0 +1,91 @@
+#	$OpenBSD: channel-timeout.sh,v 1.1 2023/01/06 08:07:39 djm Exp $
+#	Placed in the Public Domain.
+
+tid="channel timeout"
+
+# XXX not comprehensive. Still need -R -L agent X11 forwarding + interactive
+
+rm -f $OBJ/sshd_proxy.orig 
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
+
+verbose "no timeout"
+${SSH} -F $OBJ/ssh_proxy somehost "sleep 5 ; exit 23"
+r=$?
+if [ $r -ne 23 ]; then
+	fail "ssh failed"
+fi
+
+verbose "command timeout"
+(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:command=1") \
+	> $OBJ/sshd_proxy
+${SSH} -F $OBJ/ssh_proxy somehost "sleep 5 ; exit 23"
+r=$?
+if [ $r -ne 255 ]; then
+	fail "ssh returned unexpected error code $r"
+fi
+
+verbose "command wildcard timeout"
+(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:*=1") \
+	> $OBJ/sshd_proxy
+${SSH} -F $OBJ/ssh_proxy somehost "sleep 5 ; exit 23"
+r=$?
+if [ $r -ne 255 ]; then
+	fail "ssh returned unexpected error code $r"
+fi
+
+verbose "command irrelevant timeout"
+(cat $OBJ/sshd_proxy.orig ; echo "ChannelTimeout session:shell=1") \
+	> $OBJ/sshd_proxy
+${SSH} -F $OBJ/ssh_proxy somehost "sleep 5 ; exit 23"
+r=$?
+if [ $r -ne 23 ]; then
+	fail "ssh failed"
+fi
+
+# Set up a "slow sftp server" that sleeps before executing the real one.
+cat > $OBJ/slow-sftp-server.sh << _EOF
+#!/bin/sh
+
+sleep 5
+$SFTPSERVER
+_EOF
+chmod a+x $OBJ/slow-sftp-server.sh
+
+verbose "sftp no timeout"
+(grep -vi subsystem.*sftp $OBJ/sshd_proxy.orig;
+ echo "Subsystem sftp $OBJ/slow-sftp-server.sh" ) > $OBJ/sshd_proxy
+
+rm -f ${COPY}
+$SFTP -qS $SSH -F $OBJ/ssh_proxy somehost:$DATA $COPY
+r=$?
+if [ $r -ne 0 ]; then
+	fail "sftp failed"
+fi
+cmp $DATA $COPY || fail "corrupted copy"
+
+verbose "sftp timeout"
+(grep -vi subsystem.*sftp $OBJ/sshd_proxy.orig;
+ echo "ChannelTimeout session:subsystem:sftp=1" ;
+ echo "Subsystem sftp $OBJ/slow-sftp-server.sh" ) > $OBJ/sshd_proxy
+
+rm -f ${COPY}
+$SFTP -qS $SSH -F $OBJ/ssh_proxy somehost:$DATA $COPY
+r=$?
+if [ $r -eq 0 ]; then
+	fail "sftp succeeded unexpectedly"
+fi
+test -f $COPY && cmp $DATA $COPY && fail "intact copy"
+
+verbose "sftp irrelevant timeout"
+(grep -vi subsystem.*sftp $OBJ/sshd_proxy.orig;
+ echo "ChannelTimeout session:subsystem:command=1" ;
+ echo "Subsystem sftp $OBJ/slow-sftp-server.sh" ) > $OBJ/sshd_proxy
+
+rm -f ${COPY}
+$SFTP -qS $SSH -F $OBJ/ssh_proxy somehost:$DATA $COPY
+r=$?
+if [ $r -ne 0 ]; then
+	fail "sftp failed"
+fi
+cmp $DATA $COPY || fail "corrupted copy"
+
-- 
2.20.1