blob: 3243dd39e68236977cc4d20032f3ce4274a173b4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
require_relative 'spec_helper'
require_relative '../lib/gitlab_shell'
describe GitlabShell do
subject do
ARGV[0] = key_id
GitlabShell.new.tap do |shell|
shell.stub(exec_cmd: :exec_called)
shell.stub(api: api)
end
end
let(:api) do
double(GitlabNet).tap do |api|
api.stub(discover: { 'name' => 'John Doe' })
api.stub(allowed?: true)
end
end
let(:key_id) { "key-#{rand(100) + 100}" }
let(:repository_path) { "/home/git#{rand(100)}/repos" }
before do
GitlabConfig.any_instance.stub(repos_path: repository_path, audit_usernames: false)
end
describe :initialize do
before { ssh_cmd 'git-receive-pack' }
its(:key_id) { should == key_id }
its(:repos_path) { should == repository_path }
end
describe :parse_cmd do
context 'w/o namespace' do
before do
ssh_cmd 'git-upload-pack gitlab-ci.git'
subject.send :parse_cmd
end
its(:repo_name) { should == 'gitlab-ci.git' }
its(:git_cmd) { should == 'git-upload-pack' }
end
context 'namespace' do
before do
ssh_cmd 'git-upload-pack dmitriy.zaporozhets/gitlab-ci.git'
subject.send :parse_cmd
end
its(:repo_name) { should == 'dmitriy.zaporozhets/gitlab-ci.git' }
its(:git_cmd) { should == 'git-upload-pack' }
end
end
describe :exec do
context 'git-upload-pack' do
before { ssh_cmd 'git-upload-pack gitlab-ci.git' }
after { subject.exec }
it "should process the command" do
subject.should_receive(:process_cmd).with()
end
it "should execute the command" do
subject.should_receive(:exec_cmd).with("git-upload-pack", File.join(repository_path, 'gitlab-ci.git'))
end
it "should set the GL_ID environment variable" do
ENV.should_receive("[]=").with("GL_ID", key_id)
end
it "should log the command execution" do
message = "gitlab-shell: executing git command "
message << "<git-upload-pack #{File.join(repository_path, 'gitlab-ci.git')}> "
message << "for user with key #{key_id}."
$logger.should_receive(:info).with(message)
end
it "should use usernames if configured to do so" do
GitlabConfig.any_instance.stub(audit_usernames: true)
$logger.should_receive(:info) { |msg| msg.should =~ /for John Doe/ }
end
end
context 'git-receive-pack' do
before { ssh_cmd 'git-receive-pack gitlab-ci.git' }
after { subject.exec }
it "should process the command" do
subject.should_receive(:process_cmd).with()
end
it "should execute the command" do
subject.should_receive(:exec_cmd).with("git-receive-pack", File.join(repository_path, 'gitlab-ci.git'))
end
it "should log the command execution" do
message = "gitlab-shell: executing git command "
message << "<git-receive-pack #{File.join(repository_path, 'gitlab-ci.git')}> "
message << "for user with key #{key_id}."
$logger.should_receive(:info).with(message)
end
end
context 'arbitrary command' do
before { ssh_cmd 'arbitrary command' }
after { subject.exec }
it "should not process the command" do
subject.should_not_receive(:process_cmd)
end
it "should not execute the command" do
subject.should_not_receive(:exec_cmd)
end
it "should log the attempt" do
message = "gitlab-shell: Attempt to execute disallowed command <arbitrary command> by user with key #{key_id}."
$logger.should_receive(:warn).with(message)
end
end
context 'no command' do
before { ssh_cmd nil }
after { subject.exec }
it "should call api.discover" do
api.should_receive(:discover).with(key_id)
end
end
end
describe :validate_access do
before { ssh_cmd 'git-upload-pack gitlab-ci.git' }
after { subject.exec }
it "should call api.allowed?" do
api.should_receive(:allowed?).
with('git-upload-pack', 'gitlab-ci.git', key_id, '_any')
end
it "should disallow access and log the attempt if allowed? returns false" do
api.stub(allowed?: false)
message = "gitlab-shell: Access denied for git command <git-upload-pack gitlab-ci.git> "
message << "by user with key #{key_id}."
$logger.should_receive(:warn).with(message)
end
end
def ssh_cmd(cmd)
ENV['SSH_ORIGINAL_COMMAND'] = cmd
end
end
|
