Files
firezone/scripts/tests/token-path.sh
Reactor Scram 869dcfa02f fix(linux-client): forbid passing the token as a CLI arg (#4683)
Closes #4682 
Closes #4691 

```[tasklist]
# Before merging
- [x] Wait for `linux-group` test to go green on `main` (#4692)
- [ ] Wait for those browsers tests to get fixed
- [ ] *All* compatibility tests must pass on this branch
```

---------

Signed-off-by: Reactor Scram <ReactorScram@users.noreply.github.com>
Co-authored-by: Thomas Eizinger <thomas@eizinger.io>
2024-04-24 14:09:08 +00:00

40 lines
1.3 KiB
Bash
Executable File

#!/usr/bin/env bash
source "./scripts/tests/lib.sh"
BINARY_NAME=firezone-linux-client
TOKEN="n.SFMyNTY.g2gDaANtAAAAJGM4OWJjYzhjLTkzOTItNGRhZS1hNDBkLTg4OGFlZjZkMjhlMG0AAAAkN2RhN2QxY2QtMTExYy00NGE3LWI1YWMtNDAyN2I5ZDIzMGU1bQAAACtBaUl5XzZwQmstV0xlUkFQenprQ0ZYTnFJWktXQnMyRGR3XzJ2Z0lRdkZnbgYAGUmu74wBYgABUYA.UN3vSLLcAMkHeEh5VHumPOutkuue8JA6wlxM9JxJEPE"
TOKEN_PATH="token"
sudo cp "rust/target/debug/firezone-headless-client" "/usr/bin/$BINARY_NAME"
# Fails because there's no token yet
sudo "$BINARY_NAME" --check standalone && exit 1
# Pass if we use the env var
sudo FIREZONE_TOKEN="$TOKEN" "$BINARY_NAME" --check standalone
# Fails because passing tokens as CLI args is not allowed anymore
sudo "$BINARY_NAME" --check --token "$TOKEN" standalone && exit 1
touch "$TOKEN_PATH"
chmod 600 "$TOKEN_PATH"
sudo chown root:root "$TOKEN_PATH"
echo "$TOKEN" | sudo tee "$TOKEN_PATH" > /dev/null
# Fails because the token is not in the default path
sudo "$BINARY_NAME" --check standalone && exit 1
# Passes if we tell it where to look
sudo "$BINARY_NAME" --check --token-path "$TOKEN_PATH" standalone
# Move the token to the default path
sudo mkdir /etc/dev.firezone.client
sudo mv "$TOKEN_PATH" /etc/dev.firezone.client/token
# Now passes with the default path
sudo "$BINARY_NAME" --check standalone
# Redundant, but helps if the last command has an `&& exit 1`
exit 0