mirror of https://github.com/wolfSSL/wolfssh.git
817 lines
33 KiB
YAML
817 lines
33 KiB
YAML
name: Windows wolfsshd SFTP Test
|
|
|
|
# This workflow tests wolfsshd, SFTP, and SCP on Windows with:
|
|
# 1. Basic test: wolfsshd + SFTP client (pwd, ls, put/get small file)
|
|
# 2. Recursive SCP test: pull a directory tree with "scp -O -r"
|
|
# 3. Large file test: WOLFSSH_NO_SFTP_TIMEOUT, WOLFSSH_MAX_SFTP_RW=10485760,
|
|
# WOLFSSH_MAX_CHN_NAMESZ=4200 - get and put a 3GB file
|
|
# 3. No-profile test: a user with no Windows profile at all, so wolfsshd has to
|
|
# build one with LoadUserProfileW instead of reading ProfileList
|
|
|
|
on:
|
|
push:
|
|
branches: [ 'master', 'main', 'release/**' ]
|
|
pull_request:
|
|
branches: [ '*' ]
|
|
|
|
env:
|
|
WOLFSSL_SOLUTION_FILE_PATH: wolfssl64.sln
|
|
SOLUTION_FILE_PATH: wolfssh.sln
|
|
USER_SETTINGS_H_NEW: wolfssh/ide/winvs/user_settings.h
|
|
USER_SETTINGS_H: wolfssl/IDE/WIN/user_settings.h
|
|
INCLUDE_DIR: wolfssh
|
|
WOLFSSL_BUILD_CONFIGURATION: Release
|
|
WOLFSSH_BUILD_CONFIGURATION: Release
|
|
BUILD_PLATFORM: x64
|
|
TARGET_PLATFORM: 10
|
|
TEST_PORT: 22222
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: windows-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- test_type: basic
|
|
artifact_name: wolfssh-windows-build
|
|
- test_type: large_rw
|
|
artifact_name: wolfssh-windows-build-large-rw
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
repository: wolfssl/wolfssl
|
|
path: wolfssl
|
|
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
path: wolfssh
|
|
|
|
- name: Add MSBuild to PATH
|
|
uses: microsoft/setup-msbuild@v1
|
|
|
|
- name: Update user_settings.h for wolfSSL build
|
|
working-directory: ${{env.GITHUB_WORKSPACE}}
|
|
shell: bash
|
|
run: |
|
|
sed -i 's/#if 0/#if 1/g' ${{env.USER_SETTINGS_H_NEW}}
|
|
cp ${{env.USER_SETTINGS_H_NEW}} ${{env.USER_SETTINGS_H}}
|
|
|
|
- name: Restore wolfSSL NuGet packages
|
|
working-directory: ${{ github.workspace }}\wolfssl
|
|
run: nuget restore ${{env.WOLFSSL_SOLUTION_FILE_PATH}}
|
|
|
|
- name: Build wolfssl library
|
|
working-directory: ${{ github.workspace }}\wolfssl
|
|
run: msbuild /m /p:PlatformToolset=v142 /p:Platform=${{env.BUILD_PLATFORM}} /p:Configuration=${{env.WOLFSSL_BUILD_CONFIGURATION}} /t:wolfssl ${{env.WOLFSSL_SOLUTION_FILE_PATH}}
|
|
|
|
- name: Upload wolfSSL build artifacts
|
|
if: matrix.test_type == 'basic'
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: wolfssl-windows-build
|
|
path: |
|
|
wolfssl/IDE/WIN/${{env.WOLFSSL_BUILD_CONFIGURATION}}/${{env.BUILD_PLATFORM}}/**
|
|
wolfssl/IDE/WIN/${{env.WOLFSSL_BUILD_CONFIGURATION}}/**
|
|
wolfssl/${{env.WOLFSSL_BUILD_CONFIGURATION}}/${{env.BUILD_PLATFORM}}/**
|
|
wolfssl/${{env.WOLFSSL_BUILD_CONFIGURATION}}/**
|
|
|
|
- name: Update user_settings.h for sshd and SFTP
|
|
working-directory: ${{env.GITHUB_WORKSPACE}}
|
|
shell: bash
|
|
run: |
|
|
# Enable SSHD, SFTP support (second #if 0 block)
|
|
sed -i 's/#if 0/#if 1/g' ${{env.USER_SETTINGS_H_NEW}}
|
|
cp ${{env.USER_SETTINGS_H_NEW}} ${{env.USER_SETTINGS_H}}
|
|
# For large_rw test: add SFTP large file defines
|
|
if [ "${{ matrix.test_type }}" = "large_rw" ]; then
|
|
echo "" >> ${{env.USER_SETTINGS_H_NEW}}
|
|
echo "/* SFTP large file test defines */" >> ${{env.USER_SETTINGS_H_NEW}}
|
|
echo "#define WOLFSSH_NO_SFTP_TIMEOUT" >> ${{env.USER_SETTINGS_H_NEW}}
|
|
echo "#define WOLFSSH_MAX_SFTP_RW 10485760" >> ${{env.USER_SETTINGS_H_NEW}}
|
|
echo "#define WOLFSSH_MAX_CHN_NAMESZ 4200" >> ${{env.USER_SETTINGS_H_NEW}}
|
|
echo "Added WOLFSSH_NO_SFTP_TIMEOUT, WOLFSSH_MAX_SFTP_RW=10485760, WOLFSSH_MAX_CHN_NAMESZ=4200"
|
|
cp ${{env.USER_SETTINGS_H_NEW}} ${{env.USER_SETTINGS_H}}
|
|
fi
|
|
|
|
- name: Restore NuGet packages
|
|
working-directory: ${{ github.workspace }}\wolfssh\ide\winvs
|
|
run: nuget restore ${{env.SOLUTION_FILE_PATH}}
|
|
|
|
- name: Build wolfssh
|
|
working-directory: ${{ github.workspace }}\wolfssh\ide\winvs
|
|
run: msbuild /m /p:PlatformToolset=v142 /p:Platform=${{env.BUILD_PLATFORM}} /p:WindowsTargetPlatformVersion=${{env.TARGET_PLATFORM}} /p:Configuration=${{env.WOLFSSH_BUILD_CONFIGURATION}} ${{env.SOLUTION_FILE_PATH}}
|
|
|
|
- name: Upload wolfSSH build artifacts
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: ${{ matrix.artifact_name }}
|
|
if-no-files-found: error
|
|
path: |
|
|
wolfssh/ide/winvs/**/Release/**
|
|
|
|
test:
|
|
needs: build
|
|
runs-on: windows-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- test_type: basic
|
|
artifact_name: wolfssh-windows-build
|
|
- test_type: large_rw
|
|
artifact_name: wolfssh-windows-build-large-rw
|
|
- test_type: no_profile
|
|
artifact_name: wolfssh-windows-build
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
path: wolfssh
|
|
|
|
- name: Download wolfSSH build artifacts
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: ${{ matrix.artifact_name }}
|
|
path: .
|
|
|
|
- name: Download wolfSSL build artifacts
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: wolfssl-windows-build
|
|
path: .
|
|
|
|
- name: Create Windows user testuser and authorized_keys
|
|
if: matrix.test_type != 'no_profile'
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
run: |
|
|
$homeDir = "C:\Users\testuser"
|
|
$sshDir = "$homeDir\.ssh"
|
|
$authKeysFile = "$sshDir\authorized_keys"
|
|
$pw = 'T3stP@ss!xY9'
|
|
|
|
$o = net user testuser $pw /add /homedir:$homeDir 2>&1
|
|
if ($LASTEXITCODE -ne 0) {
|
|
if ($o -match "already exists") {
|
|
net user testuser /homedir:$homeDir 2>$null
|
|
} else {
|
|
Write-Host "net user failed: $o"
|
|
exit 1
|
|
}
|
|
}
|
|
Add-Content -Path $env:GITHUB_ENV -Value "TESTUSER_PASSWORD=$pw"
|
|
|
|
# Log the user on once so Windows builds a real profile: a directory
|
|
# with NTUSER.DAT plus the matching ProfileList entry.
|
|
$sec = ConvertTo-SecureString $pw -AsPlainText -Force
|
|
$cred = New-Object System.Management.Automation.PSCredential("testuser", $sec)
|
|
# -WorkingDirectory has to be readable by testuser.
|
|
Start-Process -FilePath "cmd.exe" -ArgumentList "/c", "exit" `
|
|
-Credential $cred -WorkingDirectory "C:\" -Wait -ErrorAction Stop
|
|
|
|
foreach ($i in 1..120) {
|
|
if (Test-Path "$homeDir\NTUSER.DAT") { break }
|
|
Start-Sleep -Milliseconds 500
|
|
}
|
|
if (-not (Test-Path "$homeDir\NTUSER.DAT")) {
|
|
Write-Host "ERROR: no profile was built for testuser"
|
|
Get-ChildItem -Path "C:\Users"
|
|
exit 1
|
|
}
|
|
|
|
# Later steps use $homeDir literally, so the profile has to be there.
|
|
$sid = (New-Object System.Security.Principal.NTAccount("testuser")).Translate([System.Security.Principal.SecurityIdentifier]).Value
|
|
$profKey = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$sid"
|
|
$imagePath = (Get-ItemProperty -Path $profKey -Name ProfileImagePath -ErrorAction SilentlyContinue).ProfileImagePath
|
|
if ($imagePath -ne $homeDir) {
|
|
Write-Host "ERROR: testuser's profile is at '$imagePath', expected '$homeDir'"
|
|
exit 1
|
|
}
|
|
Write-Host "testuser profile built at $imagePath"
|
|
|
|
New-Item -ItemType Directory -Path $sshDir -Force | Out-Null
|
|
|
|
"" | Out-File -FilePath $authKeysFile -Encoding ASCII -NoNewline
|
|
icacls $authKeysFile /grant "testuser:R" /q
|
|
|
|
- name: Create SCP test key and directory tree
|
|
if: matrix.test_type == 'basic'
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
run: |
|
|
# scp cannot supply a password non-interactively, so the recursive
|
|
# SCP test authenticates with a key.
|
|
$keyFile = Join-Path $env:RUNNER_TEMP "scp_id_ecdsa"
|
|
ssh-keygen -q -t ecdsa -b 256 -f $keyFile -N ""
|
|
Get-Content "$keyFile.pub" |
|
|
Add-Content -Path "C:\Users\testuser\.ssh\authorized_keys" -Encoding ASCII
|
|
icacls $keyFile /inheritance:r /grant:r "$($env:USERNAME):R" /q
|
|
Add-Content -Path $env:GITHUB_ENV -Value "SCP_KEY=$keyFile"
|
|
|
|
# A nested subdirectory and an empty one. The empty directory is the
|
|
# case where "." and ".." are the only entries.
|
|
$src = "C:\Users\testuser\scp_src"
|
|
New-Item -ItemType Directory -Path "$src\nested" -Force | Out-Null
|
|
New-Item -ItemType Directory -Path "$src\emptydir" -Force | Out-Null
|
|
Set-Content -Path "$src\alpha.txt" -Value "alpha contents"
|
|
Set-Content -Path "$src\beta.txt" -Value "beta contents"
|
|
Set-Content -Path "$src\nested\gamma.txt" -Value "gamma contents"
|
|
icacls $src /grant "testuser:(OI)(CI)F" /T /q
|
|
|
|
# No home directory, no ACL grant and no ProfileList entry, which is what a
|
|
# user that has never logged on to the machine looks like.
|
|
- name: Create Windows user testuser with no profile
|
|
if: matrix.test_type == 'no_profile'
|
|
shell: pwsh
|
|
run: |
|
|
$pw = 'T3stP@ss!xY9'
|
|
Add-Content -Path $env:GITHUB_ENV -Value "TESTUSER_PASSWORD=$pw"
|
|
|
|
# testuser2 is for the concurrent-session test, which needs a user
|
|
# whose profile no earlier step has built.
|
|
foreach ($u in @('testuser', 'testuser2')) {
|
|
$o = net user $u $pw /add 2>&1
|
|
if ($LASTEXITCODE -ne 0) {
|
|
Write-Host "net user $u failed: $o"
|
|
exit 1
|
|
}
|
|
|
|
$sid = (New-Object System.Security.Principal.NTAccount($u)).Translate([System.Security.Principal.SecurityIdentifier]).Value
|
|
$profKey = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$sid"
|
|
if (Test-Path $profKey) {
|
|
Write-Host "ERROR: $u already has a ProfileList entry"
|
|
exit 1
|
|
}
|
|
if (Test-Path "C:\Users\$u") {
|
|
Write-Host "ERROR: C:\Users\$u already exists"
|
|
exit 1
|
|
}
|
|
Write-Host "$u created with no profile, SID $sid"
|
|
|
|
if ($u -eq 'testuser') {
|
|
Add-Content -Path $env:GITHUB_ENV -Value "TESTUSER_SID=$sid"
|
|
}
|
|
else {
|
|
Add-Content -Path $env:GITHUB_ENV -Value "TESTUSER2_SID=$sid"
|
|
}
|
|
}
|
|
|
|
- name: Create wolfSSHd config file
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
run: |
|
|
$keyPath = Join-Path "${{ github.workspace }}" "wolfssh\keys\server-key.pem"
|
|
$keyPathFull = (Resolve-Path $keyPath -ErrorAction Stop)
|
|
$configContent = @"
|
|
Port ${{env.TEST_PORT}}
|
|
PasswordAuthentication yes
|
|
PermitRootLogin yes
|
|
HostKey $($keyPathFull.Path)
|
|
AuthorizedKeysFile C:\Users\testuser\.ssh\authorized_keys
|
|
"@
|
|
$configContent | Out-File -FilePath sshd_config_test -Encoding ASCII
|
|
Get-Content sshd_config_test
|
|
|
|
- name: Find wolfSSH executables
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
run: |
|
|
$searchRoot = "${{ github.workspace }}"
|
|
$sshdExe = Get-ChildItem -Path $searchRoot -Recurse -Filter "wolfsshd.exe" -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.FullName -like "*Release*" } | Select-Object -First 1
|
|
if ($sshdExe) {
|
|
Add-Content -Path $env:GITHUB_ENV -Value "SSHD_PATH=$($sshdExe.FullName)"
|
|
} else {
|
|
Write-Host "ERROR: wolfsshd.exe not found"
|
|
exit 1
|
|
}
|
|
|
|
$sftpExe = Get-ChildItem -Path $searchRoot -Recurse -Filter "wolfsftp.exe" -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.FullName -like "*Release*" } | Select-Object -First 1
|
|
if (-not $sftpExe) {
|
|
$sftpExe = Get-ChildItem -Path $searchRoot -Recurse -Filter "wolfsftp-client.exe" -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.FullName -like "*Release*" } | Select-Object -First 1
|
|
}
|
|
if ($sftpExe) {
|
|
Add-Content -Path $env:GITHUB_ENV -Value "SFTP_PATH=$($sftpExe.FullName)"
|
|
} else {
|
|
Write-Host "ERROR: SFTP client exe not found"
|
|
exit 1
|
|
}
|
|
|
|
$clientExe = Get-ChildItem -Path $searchRoot -Recurse -Filter "client.exe" -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.FullName -like "*Release*" } | Select-Object -First 1
|
|
if ($clientExe) {
|
|
Add-Content -Path $env:GITHUB_ENV -Value "CLIENT_PATH=$($clientExe.FullName)"
|
|
}
|
|
|
|
- name: Copy wolfSSL DLL to executable directory
|
|
working-directory: ${{ github.workspace }}
|
|
shell: pwsh
|
|
run: |
|
|
$sshdPath = $env:SSHD_PATH
|
|
$sshdDir = Split-Path -Parent $sshdPath
|
|
if (Test-Path (Join-Path $sshdDir "wolfssl.lib")) { exit 0 }
|
|
$wolfsslDll = Get-ChildItem -Path "${{ github.workspace }}\wolfssl" -Recurse -Filter "wolfssl.dll" -ErrorAction SilentlyContinue | Select-Object -First 1
|
|
if ($wolfsslDll) {
|
|
Copy-Item -Path $wolfsslDll.FullName -Destination (Join-Path $sshdDir "wolfssl.dll") -Force
|
|
}
|
|
|
|
- name: Grant service access to config and keys
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
run: |
|
|
icacls (Get-Location).Path /grant "NT AUTHORITY\SYSTEM:(OI)(CI)RX" /T /q
|
|
|
|
- name: Start wolfSSHd as Windows service
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
run: |
|
|
$sshdPath = $env:SSHD_PATH
|
|
$configPathFull = (Resolve-Path "sshd_config_test").Path
|
|
$serviceName = "wolfsshd"
|
|
|
|
$existingService = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
|
|
if ($existingService) {
|
|
if ($existingService.Status -eq 'Running') { Stop-Service -Name $serviceName -Force }
|
|
sc.exe delete $serviceName | Out-Null
|
|
Start-Sleep -Seconds 2
|
|
}
|
|
|
|
$binPath = "`"$sshdPath`" -f `"$configPathFull`" -p ${{env.TEST_PORT}}"
|
|
sc.exe create $serviceName binPath= $binPath
|
|
sc.exe start $serviceName
|
|
Start-Sleep -Seconds 5
|
|
|
|
$service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
|
|
if ($service.Status -ne 'Running') {
|
|
Write-Host "ERROR: Service failed to start"
|
|
sc.exe query $serviceName
|
|
exit 1
|
|
}
|
|
Add-Content -Path $env:GITHUB_ENV -Value "SSHD_SERVICE_NAME=$serviceName"
|
|
|
|
- name: Test SFTP get non-existent file (no hang, correct error)
|
|
if: matrix.test_type != 'no_profile'
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
timeout-minutes: 1
|
|
run: |
|
|
$sftpPath = $env:SFTP_PATH
|
|
$destFile = Join-Path $env:TEMP "copy.dat"
|
|
$getCommands = "get /this_file_does_not_exist_xyz $destFile`nquit"
|
|
$getCommands | Out-File -FilePath sftp_get_nonexistent_commands.txt -Encoding ASCII
|
|
|
|
$proc = Start-Process -FilePath $sftpPath `
|
|
-ArgumentList "-u", "testuser", "-P", $env:TESTUSER_PASSWORD, "-h", "localhost", "-p", "${{env.TEST_PORT}}" `
|
|
-RedirectStandardInput "sftp_get_nonexistent_commands.txt" `
|
|
-RedirectStandardOutput "sftp_get_nonexistent_out.txt" `
|
|
-RedirectStandardError "sftp_get_nonexistent_err.txt" `
|
|
-Wait -NoNewWindow -PassThru
|
|
|
|
Write-Host "=== SFTP Output ==="
|
|
$output = ""
|
|
if (Test-Path sftp_get_nonexistent_out.txt) {
|
|
$output = Get-Content sftp_get_nonexistent_out.txt -Raw
|
|
Write-Host $output
|
|
}
|
|
Write-Host "=== SFTP Error ==="
|
|
if (Test-Path sftp_get_nonexistent_err.txt) { Get-Content sftp_get_nonexistent_err.txt }
|
|
|
|
# Verify file was NOT created
|
|
if (Test-Path $destFile) {
|
|
Write-Host "ERROR: $destFile was created despite non-existent source file"
|
|
exit 1
|
|
}
|
|
# Verify error message was emitted
|
|
if ($output -notmatch "Error getting file") {
|
|
Write-Host "ERROR: Expected 'Error getting file' in output"
|
|
exit 1
|
|
}
|
|
Write-Host "PASS: SFTP get non-existent file did not create file, reported error correctly, did not hang"
|
|
|
|
# First connection for this user, so it is the one that builds the profile.
|
|
# An exec session goes through the shell subsystem, whose cleanup unloads
|
|
# it.
|
|
- name: Test exec session (no profile)
|
|
if: matrix.test_type == 'no_profile'
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
timeout-minutes: 2
|
|
run: |
|
|
if (-not $env:CLIENT_PATH) {
|
|
Write-Host "ERROR: client.exe not found"
|
|
exit 1
|
|
}
|
|
"" | Out-File -FilePath exec_stdin.txt -Encoding ASCII
|
|
|
|
# Nothing may have built the profile before this connection, or the
|
|
# checks below would not be about the exec session.
|
|
if (Test-Path "C:\Users\testuser\NTUSER.DAT") {
|
|
Write-Host "ERROR: testuser already has a profile before the exec session"
|
|
exit 1
|
|
}
|
|
|
|
$proc = Start-Process -FilePath $env:CLIENT_PATH `
|
|
-ArgumentList "-u", "testuser", "-P", $env:TESTUSER_PASSWORD, "-h", "localhost", "-p", "${{env.TEST_PORT}}", "-c", "whoami" `
|
|
-RedirectStandardInput "exec_stdin.txt" `
|
|
-RedirectStandardOutput "exec_out.txt" `
|
|
-RedirectStandardError "exec_err.txt" `
|
|
-Wait -NoNewWindow -PassThru
|
|
|
|
Write-Host "=== exec output ==="
|
|
if (Test-Path exec_out.txt) { Get-Content exec_out.txt }
|
|
Write-Host "=== exec error ==="
|
|
if (Test-Path exec_err.txt) { Get-Content exec_err.txt }
|
|
|
|
if ($proc.ExitCode -ne 0) {
|
|
Write-Host "ERROR: exec session failed with exit $($proc.ExitCode)"
|
|
exit 1
|
|
}
|
|
if ((Get-Content exec_out.txt -Raw) -notmatch "testuser") {
|
|
Write-Host "ERROR: exec output does not name testuser"
|
|
exit 1
|
|
}
|
|
|
|
# NTUSER.DAT only exists if a real profile was built for the user.
|
|
if (-not (Test-Path "C:\Users\testuser\NTUSER.DAT")) {
|
|
Write-Host "ERROR: the exec session did not build a profile"
|
|
Get-ChildItem -Path "C:\Users"
|
|
exit 1
|
|
}
|
|
|
|
# The server thread tears the connection down after the client exits.
|
|
$loaded = $true
|
|
foreach ($i in 1..120) {
|
|
if (-not (Test-Path "Registry::HKEY_USERS\$env:TESTUSER_SID")) {
|
|
$loaded = $false
|
|
break
|
|
}
|
|
Start-Sleep -Milliseconds 500
|
|
}
|
|
if ($loaded) {
|
|
Write-Host "ERROR: testuser's hive is still loaded after the exec session"
|
|
exit 1
|
|
}
|
|
Write-Host "PASS: exec session built the profile and released the hive"
|
|
|
|
# Session A builds the profile and holds the only handle to the hive,
|
|
# session B finds the profile already there. Ending A must not unmount the
|
|
# hive while B is still running against it.
|
|
- name: Test concurrent sessions for one profile-less user
|
|
if: matrix.test_type == 'no_profile'
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
timeout-minutes: 5
|
|
run: |
|
|
if (-not $env:CLIENT_PATH) {
|
|
Write-Host "ERROR: client.exe not found"
|
|
exit 1
|
|
}
|
|
|
|
# Each session holds itself open by pinging. No spaces in the paths, so
|
|
# -c stays a single argument. The commands end on their own, which
|
|
# leaves no child process holding the hive open.
|
|
$bMark = "C:\Users\Public\b_started.txt"
|
|
Remove-Item $bMark -Force -ErrorAction SilentlyContinue
|
|
Set-Content -Path "C:\Users\Public\hold_a.cmd" -Value "ping -n 25 127.0.0.1 > nul" -Encoding ASCII
|
|
Set-Content -Path "C:\Users\Public\hold_b.cmd" -Value @(
|
|
"echo started > $bMark", "ping -n 60 127.0.0.1 > nul") -Encoding ASCII
|
|
"" | Out-File -FilePath hold_stdin.txt -Encoding ASCII
|
|
|
|
$hive = "Registry::HKEY_USERS\$env:TESTUSER2_SID"
|
|
|
|
function Show-Hives($why) {
|
|
Write-Host "--- $why"
|
|
Write-Host "loaded hives:"
|
|
(Get-ChildItem Registry::HKEY_USERS -ErrorAction SilentlyContinue).Name
|
|
Write-Host "profile dir: $(Test-Path 'C:\Users\testuser2\NTUSER.DAT')"
|
|
}
|
|
if (Test-Path "C:\Users\testuser2\NTUSER.DAT") {
|
|
Write-Host "ERROR: testuser2 already has a profile"
|
|
exit 1
|
|
}
|
|
|
|
function Test-Running($proc) {
|
|
return $null -ne (Get-Process -Id $proc.Id -ErrorAction SilentlyContinue)
|
|
}
|
|
|
|
function Start-Hold($script, $tag) {
|
|
return Start-Process -FilePath $env:CLIENT_PATH -ArgumentList @(
|
|
"-u", "testuser2", "-P", $env:TESTUSER_PASSWORD,
|
|
"-h", "localhost", "-p", "${{env.TEST_PORT}}", "-c", $script) `
|
|
-RedirectStandardInput "hold_stdin.txt" `
|
|
-RedirectStandardOutput "hold_${tag}_out.txt" `
|
|
-RedirectStandardError "hold_${tag}_err.txt" `
|
|
-NoNewWindow -PassThru
|
|
}
|
|
|
|
$procA = Start-Hold "C:\Users\Public\hold_a.cmd" "a"
|
|
|
|
# Watch from the start: the hive can appear and go away again inside a
|
|
# fixed sleep, which reads the same as never appearing.
|
|
$sawHive = $false
|
|
foreach ($i in 1..40) {
|
|
if (Test-Path $hive) {
|
|
$sawHive = $true
|
|
Write-Host "hive appeared after $($i * 500) ms"
|
|
break
|
|
}
|
|
Start-Sleep -Milliseconds 500
|
|
}
|
|
if (-not (Test-Path "C:\Users\testuser2\NTUSER.DAT")) {
|
|
Write-Host "ERROR: session A did not build the profile"
|
|
Show-Hives "no profile"
|
|
Get-Content hold_a_out.txt, hold_a_err.txt -ErrorAction SilentlyContinue
|
|
exit 1
|
|
}
|
|
if (-not $sawHive) {
|
|
Write-Host "ERROR: testuser2's hive never appeared during session A"
|
|
Show-Hives "hive never seen"
|
|
Get-Content hold_a_out.txt, hold_a_err.txt -ErrorAction SilentlyContinue
|
|
exit 1
|
|
}
|
|
if (-not (Test-Running $procA)) {
|
|
Write-Host "ERROR: session A ended before the hive check"
|
|
Show-Hives "A gone"
|
|
Get-Content hold_a_out.txt, hold_a_err.txt -ErrorAction SilentlyContinue
|
|
exit 1
|
|
}
|
|
if (-not (Test-Path $hive)) {
|
|
Write-Host "ERROR: testuser2's hive went away while session A was live"
|
|
Show-Hives "hive dropped under A"
|
|
exit 1
|
|
}
|
|
Write-Host "session A built the profile and holds the hive"
|
|
|
|
$procB = Start-Hold "C:\Users\Public\hold_b.cmd" "b"
|
|
foreach ($i in 1..60) {
|
|
if (Test-Path $bMark) { break }
|
|
Start-Sleep -Milliseconds 500
|
|
}
|
|
if (-not (Test-Path $bMark)) {
|
|
Write-Host "ERROR: session B's command never ran"
|
|
Get-Content hold_b_out.txt, hold_b_err.txt -ErrorAction SilentlyContinue
|
|
exit 1
|
|
}
|
|
if (-not (Test-Running $procB)) {
|
|
Write-Host "ERROR: session B ended early"
|
|
Get-Content hold_b_out.txt, hold_b_err.txt
|
|
exit 1
|
|
}
|
|
Write-Host "session B is running alongside session A"
|
|
|
|
Wait-Process -Id $procA.Id -Timeout 120 -ErrorAction SilentlyContinue
|
|
if (Test-Running $procA) {
|
|
Write-Host "ERROR: session A did not end"
|
|
exit 1
|
|
}
|
|
# This asserts the hive does not go away, so settle rather than poll.
|
|
Start-Sleep -Seconds 15
|
|
|
|
if (-not (Test-Running $procB)) {
|
|
Write-Host "ERROR: session B ended before the hive check"
|
|
Get-Content hold_b_out.txt, hold_b_err.txt
|
|
exit 1
|
|
}
|
|
if (-not (Test-Path $hive)) {
|
|
Write-Host "ERROR: ending session A unmounted the hive under session B"
|
|
Show-Hives "hive dropped under B"
|
|
exit 1
|
|
}
|
|
Write-Host "hive survived session A ending"
|
|
|
|
Wait-Process -Id $procB.Id -Timeout 240 -ErrorAction SilentlyContinue
|
|
if (Test-Running $procB) {
|
|
Write-Host "ERROR: session B did not end"
|
|
exit 1
|
|
}
|
|
$loaded = $true
|
|
foreach ($i in 1..120) {
|
|
if (-not (Test-Path $hive)) {
|
|
$loaded = $false
|
|
break
|
|
}
|
|
Start-Sleep -Milliseconds 500
|
|
}
|
|
if ($loaded) {
|
|
Write-Host "ERROR: testuser2's hive is still loaded after both sessions ended"
|
|
Show-Hives "hive still loaded"
|
|
exit 1
|
|
}
|
|
Write-Host "PASS: the hive outlived session A and went away with session B"
|
|
|
|
- name: Test SFTP connection (basic)
|
|
if: matrix.test_type == 'basic' || matrix.test_type == 'no_profile'
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
run: |
|
|
$sftpPath = $env:SFTP_PATH
|
|
$testCommands = "pwd`nls`nquit"
|
|
$testCommands | Out-File -FilePath sftp_commands.txt -Encoding ASCII
|
|
|
|
$process = Start-Process -FilePath $sftpPath `
|
|
-ArgumentList "-u", "testuser", "-P", $env:TESTUSER_PASSWORD, "-h", "localhost", "-p", "${{env.TEST_PORT}}" `
|
|
-RedirectStandardInput "sftp_commands.txt" `
|
|
-RedirectStandardOutput "sftp_output.txt" `
|
|
-RedirectStandardError "sftp_error.txt" `
|
|
-Wait -NoNewWindow -PassThru
|
|
|
|
Get-Content sftp_output.txt
|
|
Get-Content sftp_error.txt
|
|
if ($process.ExitCode -ne 0) {
|
|
Write-Host "ERROR: SFTP basic test failed with exit $($process.ExitCode)"
|
|
exit 1
|
|
}
|
|
Write-Host "Basic SFTP test passed"
|
|
|
|
- name: Test SCP recursive directory pull
|
|
if: matrix.test_type == 'basic'
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
timeout-minutes: 2
|
|
run: |
|
|
$scp = Get-Command scp.exe -ErrorAction SilentlyContinue
|
|
if (-not $scp) {
|
|
Write-Host "ERROR: scp.exe not found on runner image"
|
|
exit 1
|
|
}
|
|
|
|
$out = Join-Path $env:RUNNER_TEMP "scp_out"
|
|
New-Item -ItemType Directory -Path $out -Force | Out-Null
|
|
|
|
# -O forces the legacy SCP protocol. Without it OpenSSH 9 and later
|
|
# run the transfer over SFTP and never reach the SCP server code.
|
|
$scpArgs = @(
|
|
"-O", "-r", "-P", "${{env.TEST_PORT}}", "-i", $env:SCP_KEY,
|
|
"-o", "StrictHostKeyChecking=no", "-o", "UserKnownHostsFile=NUL",
|
|
"-o", "IdentitiesOnly=yes", "-o", "BatchMode=yes",
|
|
"testuser@localhost:C:/Users/testuser/scp_src", $out
|
|
)
|
|
$process = Start-Process -FilePath $scp.Source -ArgumentList $scpArgs `
|
|
-RedirectStandardOutput "scp_output.txt" `
|
|
-RedirectStandardError "scp_error.txt" `
|
|
-Wait -NoNewWindow -PassThru
|
|
|
|
Get-Content scp_output.txt
|
|
Get-Content scp_error.txt
|
|
if ($process.ExitCode -ne 0) {
|
|
Write-Host "ERROR: SCP recursive test failed with exit $($process.ExitCode)"
|
|
exit 1
|
|
}
|
|
|
|
# The whole tree must arrive. A server that treats end of directory as
|
|
# fatal aborts partway and leaves nested entries behind.
|
|
$expected = @(
|
|
"scp_src\alpha.txt", "scp_src\beta.txt",
|
|
"scp_src\nested", "scp_src\nested\gamma.txt", "scp_src\emptydir"
|
|
)
|
|
$missing = $expected | Where-Object { -not (Test-Path (Join-Path $out $_)) }
|
|
Get-ChildItem -Recurse $out | ForEach-Object { $_.FullName }
|
|
if ($missing) {
|
|
Write-Host "ERROR: missing from transfer: $($missing -join ', ')"
|
|
exit 1
|
|
}
|
|
Write-Host "Recursive SCP test passed"
|
|
|
|
- name: Verify the SFTP session used and released testuser's profile
|
|
if: matrix.test_type == 'no_profile'
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
run: |
|
|
$output = Get-Content sftp_output.txt -Raw
|
|
|
|
if ($output -match "systemprofile") {
|
|
Write-Host "ERROR: session landed in the service account's profile"
|
|
Write-Host $output
|
|
exit 1
|
|
}
|
|
if ($output -notmatch "testuser") {
|
|
Write-Host "ERROR: 'testuser' missing from pwd output"
|
|
Write-Host $output
|
|
exit 1
|
|
}
|
|
# An SFTP session reaches the unload through wolfSSHD_AuthFreeUser at
|
|
# connection teardown rather than through the shell subsystem.
|
|
$loaded = $true
|
|
foreach ($i in 1..120) {
|
|
if (-not (Test-Path "Registry::HKEY_USERS\$env:TESTUSER_SID")) {
|
|
$loaded = $false
|
|
break
|
|
}
|
|
Start-Sleep -Milliseconds 500
|
|
}
|
|
if ($loaded) {
|
|
Write-Host "ERROR: testuser's hive is still loaded after the SFTP session"
|
|
(Get-ChildItem Registry::HKEY_USERS -ErrorAction SilentlyContinue).Name
|
|
exit 1
|
|
}
|
|
Write-Host "PASS: SFTP session used testuser's own home directory and released the hive"
|
|
|
|
- name: Create 3GB test file and run SFTP get/put
|
|
if: matrix.test_type == 'large_rw'
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
timeout-minutes: 25
|
|
run: |
|
|
$sftpPath = $env:SFTP_PATH
|
|
$workDir = Join-Path $env:GITHUB_WORKSPACE "wolfssh"
|
|
$largeFile = Join-Path $workDir "large_test.dat"
|
|
$getDestPath = Join-Path $workDir "large_test_copy.dat"
|
|
|
|
# Create 3GB file: one random 10MB chunk repeated 307x + 2MB
|
|
Write-Host "Creating 3GB test file..."
|
|
$chunkSize = 10485760 # 10MB
|
|
$totalSize = [long]3221225472 # 3GB
|
|
$rng = New-Object System.Security.Cryptography.RNGCryptoServiceProvider
|
|
$chunk = New-Object byte[] $chunkSize
|
|
$rng.GetBytes($chunk)
|
|
$fs = [System.IO.File]::Create($largeFile)
|
|
$remaining = $totalSize
|
|
while ($remaining -gt 0) {
|
|
$toWrite = [int][Math]::Min([long]$chunkSize, $remaining)
|
|
$fs.Write($chunk, 0, $toWrite)
|
|
$remaining -= $toWrite
|
|
}
|
|
$fs.Close()
|
|
|
|
$hash = Get-FileHash -Path $largeFile -Algorithm SHA256
|
|
$hash.Hash | Out-File -FilePath (Join-Path $workDir "large_test.dat.sha256")
|
|
Write-Host "Created 3GB file, SHA256: $($hash.Hash)"
|
|
|
|
# SFTP PUT (upload)
|
|
# Use a relative remote path (no leading /) so the server resolves it
|
|
# under testuser's home directory. An absolute /large_test.dat maps to
|
|
# the drive root (C:\) where testuser has no write permission; relative
|
|
# large_test.dat is prefixed by workingDir (C:\Users\testuser) on the
|
|
# client and becomes C:\Users\testuser\large_test.dat on the server.
|
|
Write-Host "SFTP PUT 3GB file..."
|
|
$putCommands = "put $largeFile large_test.dat`nquit"
|
|
$putCommands | Out-File -FilePath (Join-Path $workDir "sftp_put_commands.txt") -Encoding ASCII
|
|
$proc = Start-Process -FilePath $sftpPath `
|
|
-ArgumentList "-u", "testuser", "-P", $env:TESTUSER_PASSWORD, "-h", "localhost", "-p", "${{env.TEST_PORT}}" `
|
|
-WorkingDirectory $workDir `
|
|
-RedirectStandardInput (Join-Path $workDir "sftp_put_commands.txt") `
|
|
-RedirectStandardOutput (Join-Path $workDir "sftp_put_out.txt") `
|
|
-RedirectStandardError (Join-Path $workDir "sftp_put_err.txt") `
|
|
-Wait -NoNewWindow -PassThru
|
|
|
|
$putOut = Get-Content (Join-Path $workDir "sftp_put_out.txt") -Raw -ErrorAction SilentlyContinue
|
|
Write-Host "=== SFTP PUT output ==="; Write-Host $putOut
|
|
if ($proc.ExitCode -ne 0 -or $putOut -match "Error pushing file") {
|
|
Get-Content (Join-Path $workDir "sftp_put_err.txt") -ErrorAction SilentlyContinue
|
|
Write-Host "ERROR: SFTP PUT failed"
|
|
exit 1
|
|
}
|
|
Write-Host "PUT succeeded"
|
|
|
|
# SFTP GET (download) - relative remote and local paths.
|
|
# Remote large_test.dat resolves to C:\Users\testuser\large_test.dat.
|
|
# Local large_test_copy.dat is relative to wolfsftp's CWD ($workDir).
|
|
Write-Host "SFTP GET 3GB file..."
|
|
$getCommands = "get large_test.dat large_test_copy.dat`nquit"
|
|
$getCommands | Out-File -FilePath (Join-Path $workDir "sftp_get_commands.txt") -Encoding ASCII
|
|
$proc2 = Start-Process -FilePath $sftpPath `
|
|
-ArgumentList "-u", "testuser", "-P", $env:TESTUSER_PASSWORD, "-h", "localhost", "-p", "${{env.TEST_PORT}}" `
|
|
-WorkingDirectory $workDir `
|
|
-RedirectStandardInput (Join-Path $workDir "sftp_get_commands.txt") `
|
|
-RedirectStandardOutput (Join-Path $workDir "sftp_get_out.txt") `
|
|
-RedirectStandardError (Join-Path $workDir "sftp_get_err.txt") `
|
|
-Wait -NoNewWindow -PassThru
|
|
|
|
$getOut = Get-Content (Join-Path $workDir "sftp_get_out.txt") -Raw -ErrorAction SilentlyContinue
|
|
Write-Host "=== SFTP GET output ==="; Write-Host $getOut
|
|
if ($proc2.ExitCode -ne 0 -or $getOut -match "Error getting file") {
|
|
Get-Content (Join-Path $workDir "sftp_get_err.txt") -ErrorAction SilentlyContinue
|
|
Write-Host "ERROR: SFTP GET failed"
|
|
exit 1
|
|
}
|
|
Write-Host "GET succeeded"
|
|
|
|
# Verify integrity (file is in $workDir from GET with relative path)
|
|
$expectedHash = (Get-Content (Join-Path $workDir "large_test.dat.sha256")).Trim()
|
|
$actualHash = (Get-FileHash -Path $getDestPath -Algorithm SHA256).Hash
|
|
Write-Host "File: $getDestPath"
|
|
Write-Host "Expected SHA256: $expectedHash"
|
|
Write-Host "Actual SHA256: $actualHash"
|
|
if ($expectedHash -ne $actualHash) {
|
|
Write-Host "ERROR: SHA256 mismatch - PUT/GET corruption"
|
|
exit 1
|
|
}
|
|
Write-Host "PASS: 3GB SFTP get/put succeeded"
|
|
|
|
- name: Cleanup
|
|
if: always()
|
|
working-directory: ${{ github.workspace }}\wolfssh
|
|
shell: pwsh
|
|
run: |
|
|
$serviceName = $env:SSHD_SERVICE_NAME
|
|
if (-not $serviceName) { $serviceName = "wolfsshd" }
|
|
$service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
|
|
if ($service) {
|
|
if ($service.Status -eq 'Running') { Stop-Service -Name $serviceName -Force }
|
|
sc.exe delete $serviceName | Out-Null
|
|
}
|