tyler.durden/Win32-OpenSSH
1
0
Fork 0
mirror of https://github.com/PowerShell/Win32-OpenSSH.git synced 2025-07-02 03:34:43 +02:00
Code Issues Packages Projects Releases Wiki Activity

7.1p1 original test files

Browse Source
This commit is contained in:
arif-pragmasys 2015-09-29 13:59:44 -05:00
parent 720b3620fa
commit 92eae9ee02
222 changed files with 11941 additions and 669 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
.cvsignore Normal file
View File

@ -0,0 +1,28 @@
*.0
*.out
Makefile
autom4te.cache
buildit.sh
buildpkg.sh
config.cache
config.h
config.h.in
config.log
config.status
configure
openssh.xml
opensshd.init
scp
sftp
sftp-server
ssh
ssh-add
ssh-agent
ssh-keygen
ssh-keyscan
ssh-keysign
ssh-pkcs11-helper
sshd
stamp-h.in
survey
survey.sh

105
PROTOCOL.chacha20poly1305 Normal file
View File

@ -0,0 +1,105 @@
This document describes the chacha20-poly1305@openssh.com authenticated
encryption cipher supported by OpenSSH.
Background
----------
ChaCha20 is a stream cipher designed by Daniel Bernstein and described
in [1]. It operates by permuting 128 fixed bits, 128 or 256 bits of key,
a 64 bit nonce and a 64 bit counter into 64 bytes of output. This output
is used as a keystream, with any unused bytes simply discarded.
Poly1305[2], also by Daniel Bernstein, is a one-time Carter-Wegman MAC
that computes a 128 bit integrity tag given a message and a single-use
256 bit secret key.
The chacha20-poly1305@openssh.com combines these two primitives into an
authenticated encryption mode. The construction used is based on that
proposed for TLS by Adam Langley in [3], but differs in the layout of
data passed to the MAC and in the addition of encyption of the packet
lengths.
Negotiation
-----------
The chacha20-poly1305@openssh.com offers both encryption and
authentication. As such, no separate MAC is required. If the
chacha20-poly1305@openssh.com cipher is selected in key exchange,
the offered MAC algorithms are ignored and no MAC is required to be
negotiated.
Detailed Construction
---------------------
The chacha20-poly1305@openssh.com cipher requires 512 bits of key
material as output from the SSH key exchange. This forms two 256 bit
keys (K_1 and K_2), used by two separate instances of chacha20.
The instance keyed by K_1 is a stream cipher that is used only
to encrypt the 4 byte packet length field. The second instance,
keyed by K_2, is used in conjunction with poly1305 to build an AEAD
(Authenticated Encryption with Associated Data) that is used to encrypt
and authenticate the entire packet.
Two separate cipher instances are used here so as to keep the packet
lengths confidential but not create an oracle for the packet payload
cipher by decrypting and using the packet length prior to checking
the MAC. By using an independently-keyed cipher instance to encrypt the
length, an active attacker seeking to exploit the packet input handling
as a decryption oracle can learn nothing about the payload contents or
its MAC (assuming key derivation, ChaCha20 and Poly1305 are secure).
The AEAD is constructed as follows: for each packet, generate a Poly1305
key by taking the first 256 bits of ChaCha20 stream output generated
using K_2, an IV consisting of the packet sequence number encoded as an
uint64 under the SSH wire encoding rules and a ChaCha20 block counter of
zero. The K_2 ChaCha20 block counter is then set to the little-endian
encoding of 1 (i.e. {1, 0, 0, 0, 0, 0, 0, 0}) and this instance is used
for encryption of the packet payload.
Packet Handling
---------------
When receiving a packet, the length must be decrypted first. When 4
bytes of ciphertext length have been received, they may be decrypted
using the K_1 key, a nonce consisting of the packet sequence number
encoded as a uint64 under the usual SSH wire encoding and a zero block
counter to obtain the plaintext length.
Once the entire packet has been received, the MAC MUST be checked
before decryption. A per-packet Poly1305 key is generated as described
above and the MAC tag calculated using Poly1305 with this key over the
ciphertext of the packet length and the payload together. The calculated
MAC is then compared in constant time with the one appended to the
packet and the packet decrypted using ChaCha20 as described above (with
K_2, the packet sequence number as nonce and a starting block counter of
1).
To send a packet, first encode the 4 byte length and encrypt it using
K_1. Encrypt the packet payload (using K_2) and append it to the
encrypted length. Finally, calculate a MAC tag and append it.
Rekeying
--------
ChaCha20 must never reuse a {key, nonce} for encryption nor may it be
used to encrypt more than 2^70 bytes under the same {key, nonce}. The
SSH Transport protocol (RFC4253) recommends a far more conservative
rekeying every 1GB of data sent or received. If this recommendation
is followed, then chacha20-poly1305@openssh.com requires no special
handling in this area.
References
----------
[1] "ChaCha, a variant of Salsa20", Daniel Bernstein
http://cr.yp.to/chacha/chacha-20080128.pdf
[2] "The Poly1305-AES message-authentication code", Daniel Bernstein
http://cr.yp.to/mac/poly1305-20050329.pdf
[3] "ChaCha20 and Poly1305 based Cipher Suites for TLS", Adam Langley
http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-03
$OpenBSD: PROTOCOL.chacha20poly1305,v 1.2 2013/12/02 02:50:27 djm Exp $

68
PROTOCOL.key Normal file
View File

@ -0,0 +1,68 @@
This document describes the private key format for OpenSSH.
1. Overall format
The key consists of a header, a list of public keys, and
an encrypted list of matching private keys.
#define AUTH_MAGIC "openssh-key-v1"
byte[] AUTH_MAGIC
string ciphername
string kdfname
string kdfoptions
int number of keys N
string publickey1
string publickey2
...
string publickeyN
string encrypted, padded list of private keys
2. KDF options for kdfname "bcrypt"
The options:
string salt
uint32 rounds
are concatenated and represented as a string.
3. Unencrypted list of N private keys
The list of privatekey/comment pairs is padded with the
bytes 1, 2, 3, ... until the total length is a multiple
of the cipher block size.
uint32 checkint
uint32 checkint
string privatekey1
string comment1
string privatekey2
string comment2
...
string privatekeyN
string commentN
char 1
char 2
char 3
...
char padlen % 255
Before the key is encrypted, a random integer is assigned
to both checkint fields so successful decryption can be
quickly checked by verifying that both checkint fields
hold the same value.
4. Encryption
The KDF is used to derive a key, IV (and other values required by
the cipher) from the passphrase. These values are then used to
encrypt the unencrypted list of private keys.
5. No encryption
For unencrypted keys the cipher "none" and the KDF "none"
are used with empty passphrases. The options if the KDF "none"
are the empty string.
$OpenBSD: PROTOCOL.key,v 1.1 2013/12/06 13:34:54 markus Exp $

169
PROTOCOL.krl Normal file
View File

@ -0,0 +1,169 @@
This describes the key/certificate revocation list format for OpenSSH.
1. Overall format
The KRL consists of a header and zero or more sections. The header is:
#define KRL_MAGIC 0x5353484b524c0a00ULL /* "SSHKRL\n\0" */
#define KRL_FORMAT_VERSION 1
uint64 KRL_MAGIC
uint32 KRL_FORMAT_VERSION
uint64 krl_version
uint64 generated_date
uint64 flags
string reserved
string comment
Where "krl_version" is a version number that increases each time the KRL
is modified, "generated_date" is the time in seconds since 1970-01-01
00:00:00 UTC that the KRL was generated, "comment" is an optional comment
and "reserved" an extension field whose contents are currently ignored.
No "flags" are currently defined.
Following the header are zero or more sections, each consisting of:
byte section_type
string section_data
Where "section_type" indicates the type of the "section_data". An exception
to this is the KRL_SECTION_SIGNATURE section, that has a slightly different
format (see below).
The available section types are:
#define KRL_SECTION_CERTIFICATES 1
#define KRL_SECTION_EXPLICIT_KEY 2
#define KRL_SECTION_FINGERPRINT_SHA1 3
#define KRL_SECTION_SIGNATURE 4
2. Certificate section
These sections use type KRL_SECTION_CERTIFICATES to revoke certificates by
serial number or key ID. The consist of the CA key that issued the
certificates to be revoked and a reserved field whose contents is currently
ignored.
string ca_key
string reserved
Where "ca_key" is the standard SSH wire serialisation of the CA's
public key. Alternately, "ca_key" may be an empty string to indicate
the certificate section applies to all CAs (this is most useful when
revoking key IDs).
Followed by one or more sections:
byte cert_section_type
string cert_section_data
The certificate section types are:
#define KRL_SECTION_CERT_SERIAL_LIST 0x20
#define KRL_SECTION_CERT_SERIAL_RANGE 0x21
#define KRL_SECTION_CERT_SERIAL_BITMAP 0x22
#define KRL_SECTION_CERT_KEY_ID 0x23
2.1 Certificate serial list section
This section is identified as KRL_SECTION_CERT_SERIAL_LIST. It revokes
certificates by listing their serial numbers. The cert_section_data in this
case contains:
uint64 revoked_cert_serial
uint64 ...
This section may appear multiple times.
2.2. Certificate serial range section
These sections use type KRL_SECTION_CERT_SERIAL_RANGE and hold
a range of serial numbers of certificates:
uint64 serial_min
uint64 serial_max
All certificates in the range serial_min <= serial <= serial_max are
revoked.
This section may appear multiple times.
2.3. Certificate serial bitmap section
Bitmap sections use type KRL_SECTION_CERT_SERIAL_BITMAP and revoke keys
by listing their serial number in a bitmap.
uint64 serial_offset
mpint revoked_keys_bitmap
A bit set at index N in the bitmap corresponds to revocation of a keys with
serial number (serial_offset + N).
This section may appear multiple times.
2.4. Revoked key ID sections
KRL_SECTION_CERT_KEY_ID sections revoke particular certificate "key
ID" strings. This may be useful in revoking all certificates
associated with a particular identity, e.g. a host or a user.
string key_id[0]
...
This section must contain at least one "key_id". This section may appear
multiple times.
3. Explicit key sections
These sections, identified as KRL_SECTION_EXPLICIT_KEY, revoke keys
(not certificates). They are less space efficient than serial numbers,
but are able to revoke plain keys.
string public_key_blob[0]
....
This section must contain at least one "public_key_blob". The blob
must be a raw key (i.e. not a certificate).
This section may appear multiple times.
4. SHA1 fingerprint sections
These sections, identified as KRL_SECTION_FINGERPRINT_SHA1, revoke
plain keys (i.e. not certificates) by listing their SHA1 hashes:
string public_key_hash[0]
....
This section must contain at least one "public_key_hash". The hash blob
is obtained by taking the SHA1 hash of the public key blob. Hashes in
this section must appear in numeric order, treating each hash as a big-
endian integer.
This section may appear multiple times.
5. KRL signature sections
The KRL_SECTION_SIGNATURE section serves a different purpose to the
preceeding ones: to provide cryptographic authentication of a KRL that
is retrieved over a channel that does not provide integrity protection.
Its format is slightly different to the previously-described sections:
in order to simplify the signature generation, it includes as a "body"
two string components instead of one.
byte KRL_SECTION_SIGNATURE
string signature_key
string signature
The signature is calculated over the entire KRL from the KRL_MAGIC
to this subsection's "signature_key", including both and using the
signature generation rules appropriate for the type of "signature_key".
This section must appear last in the KRL. If multiple signature sections
appear, they must appear consecutively at the end of the KRL file.
Implementations that retrieve KRLs over untrusted channels must verify
signatures. Signature sections are optional for KRLs distributed by
trusted means.
$OpenBSD: PROTOCOL.krl,v 1.3 2015/01/30 01:10:33 djm Exp $

26
fixalgorithms Normal file
View File

@ -0,0 +1,26 @@
#!/bin/sh
#
# fixciphers - remove unsupported ciphers from man pages.
# Usage: fixpaths /path/to/sed cipher1 [cipher2] <infile >outfile
#
# Author: Darren Tucker (dtucker at zip com.au). Placed in the public domain.
die() {
echo $*
exit -1
}
SED=$1
shift
for c in $*; do
subs="$subs -e /.Dq.$c.*$/d"
subs="$subs -e s/$c,//g"
done
# now remove any entirely empty lines
subs="$subs -e /^$/d"
${SED} $subs
exit 0

1
openbsd-compat/.cvsignore Normal file
View File

@ -0,0 +1 @@
Makefile

6
openbsd-compat/regress/.cvsignore Normal file
View File

@ -0,0 +1,6 @@
Makefile
snprintftest
strduptest
strtonumtest
closefromtest
opensslvertest

6
openbsd-compat/regress/Makefile.in
View File

@ -1,4 +1,4 @@
# $Id: Makefile.in,v 1.4 2006/08/19 09:12:14 dtucker Exp $
# $Id: Makefile.in,v 1.5 2014/06/17 13:06:08 dtucker Exp $
sysconfdir=@sysconfdir@
piddir=@piddir@
@ -16,11 +16,11 @@ LIBS=@LIBS@
LDFLAGS=@LDFLAGS@ $(LIBCOMPAT)
TESTPROGS=closefromtest$(EXEEXT) snprintftest$(EXEEXT) strduptest$(EXEEXT) \
strtonumtest$(EXEEXT)
strtonumtest$(EXEEXT) opensslvertest$(EXEEXT)
all: t-exec ${OTHERTESTS}
%$(EXEEXT): %.c
%$(EXEEXT): %.c $(LIBCOMPAT)
$(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) -o $@ $< $(LIBCOMPAT) $(LIBS)
t-exec: $(TESTPROGS)

69
openbsd-compat/regress/opensslvertest.c Normal file
View File

@ -0,0 +1,69 @@
/*
* Copyright (c) 2014 Darren Tucker
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include <stdio.h>
#include <stdlib.h>
int ssh_compatible_openssl(long, long);
struct version_test {
long headerver;
long libver;
int result;
} version_tests[] = {
/* built with 0.9.8b release headers */
{ 0x0090802fL, 0x0090802fL, 1}, /* exact match */
{ 0x0090802fL, 0x0090804fL, 1}, /* newer library fix version: ok */
{ 0x0090802fL, 0x0090801fL, 1}, /* older library fix version: ok */
{ 0x0090802fL, 0x0090702fL, 0}, /* older library minor version: NO */
{ 0x0090802fL, 0x0090902fL, 0}, /* newer library minor version: NO */
{ 0x0090802fL, 0x0080802fL, 0}, /* older library major version: NO */
{ 0x0090802fL, 0x1000100fL, 0}, /* newer library major version: NO */
/* built with 1.0.1b release headers */
{ 0x1000101fL, 0x1000101fL, 1},/* exact match */
{ 0x1000101fL, 0x1000102fL, 1}, /* newer library patch version: ok */
{ 0x1000101fL, 0x1000100fL, 1}, /* older library patch version: ok */
{ 0x1000101fL, 0x1000201fL, 1}, /* newer library fix version: ok */
{ 0x1000101fL, 0x1000001fL, 0}, /* older library fix version: NO */
{ 0x1000101fL, 0x1010101fL, 0}, /* newer library minor version: NO */
{ 0x1000101fL, 0x0000101fL, 0}, /* older library major version: NO */
{ 0x1000101fL, 0x2000101fL, 0}, /* newer library major version: NO */
};
void
fail(long hver, long lver, int result)
{
fprintf(stderr, "opensslver: header %lx library %lx != %d \n", hver, lver, result);
exit(1);
}
int
main(void)
{
unsigned int i;
int res;
long hver, lver;
for (i = 0; i < sizeof(version_tests) / sizeof(version_tests[0]); i++) {
hver = version_tests[i].headerver;
lver = version_tests[i].libver;
res = version_tests[i].result;
if (ssh_compatible_openssl(hver, lver) != res)
fail(hver, lver, res);
}
exit(0);
}

31
regress/.cvsignore Normal file
View File

@ -0,0 +1,31 @@
*-agent
*.copy
*.log
*.prv
*.pub
actual
authorized_keys_*
batch
copy.dd*
data
expect
host.rsa*
key.*
known_hosts
krl-*
modpipe
remote_pid
revoked-*
revoked-ca
revoked-keyid
revoked-serials
rsa
rsa1
sftp-server.sh
ssh-log-wrapper.sh
ssh_config
ssh_proxy*
sshd_config
sshd_proxy*
t*.out
t*.out[0-9]

87
regress/Makefile
View File

@ -1,13 +1,17 @@
# $OpenBSD: Makefile,v 1.58 2011/01/06 22:46:21 djm Exp $
# $OpenBSD: Makefile,v 1.81 2015/05/21 06:44:25 djm Exp $
REGRESS_TARGETS= t1 t2 t3 t4 t5 t6 t7 t8 t9 t-exec
tests: $(REGRESS_TARGETS)
REGRESS_TARGETS= unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t-exec
tests: prep $(REGRESS_TARGETS)
# Interop tests are not run by default
interop interop-tests: t-exec-interop
prep:
test "x${USE_VALGRIND}" = "x" || mkdir -p $(OBJ)/valgrind-out
clean:
for F in $(CLEANFILES); do rm -f $(OBJ)$$F; done
test -z "${SUDO}" || ${SUDO} rm -f ${SUDO_CLEAN}
rm -rf $(OBJ).putty
distclean: clean
@ -38,16 +42,19 @@ LTESTS= connect \
key-options \
scp \
sftp \
sftp-chroot \
sftp-cmds \
sftp-badcmds \
sftp-batch \
sftp-glob \
sftp-perm \
reconfigure \
dynamic-forward \
forwarding \
multiplex \
reexec \
brokenkeys \
cfgparse \
cfgmatch \
addrmatch \
localcommand \
@ -57,7 +64,20 @@ LTESTS= connect \
kextype \
cert-hostkey \
cert-userkey \
host-expand
host-expand \
keys-command \
forward-control \
integrity \
krl \
multipubkey \
limit-keytype \
hostkey-agent \
keygen-knownhosts \
hostkey-rotate \
principals-command
# dhgex \
INTEROP_TESTS= putty-transfer putty-ciphers putty-kex conch-ciphers
#INTEROP_TESTS+=ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
@ -66,24 +86,36 @@ INTEROP_TESTS= putty-transfer putty-ciphers putty-kex conch-ciphers
USER!= id -un
CLEANFILES= t2.out t3.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
t8.out t8.out.pub t9.out t9.out.pub \
authorized_keys_${USER} known_hosts pidfile \
t8.out t8.out.pub t9.out t9.out.pub t10.out t10.out.pub \
t12.out t12.out.pub \
authorized_keys_${USER} known_hosts pidfile testdata \
ssh_config sshd_config.orig ssh_proxy sshd_config sshd_proxy \
rsa.pub rsa rsa1.pub rsa1 host.rsa host.rsa1 \
rsa-agent rsa-agent.pub rsa1-agent rsa1-agent.pub \
ls.copy banner.in banner.out empty.in \
scp-ssh-wrapper.scp ssh_proxy_envpass remote_pid \
sshd_proxy_bak rsa_ssh2_cr.prv rsa_ssh2_crnl.prv \
known_hosts-cert host_ca_key* cert_host_key* \
known_hosts-cert host_ca_key* cert_host_key* cert_user_key* \
putty.rsa2 sshd_proxy_orig ssh_proxy_bak \
key.rsa-* key.dsa-* key.ecdsa-* \
authorized_principals_${USER} expect actual
authorized_principals_${USER} expect actual ready \
sshd_proxy.* authorized_keys_${USER}.* modpipe revoked-* krl-* \
ssh.log failed-ssh.log sshd.log failed-sshd.log \
regress.log failed-regress.log ssh-log-wrapper.sh \
sftp-server.sh sftp-server.log sftp.log setuid-allowed \
data ed25519-agent ed25519-agent.pub key.ed25519-512 \
key.ed25519-512.pub netcat host_krl_* host_revoked_* \
kh.* user_*key* agent-key.* known_hosts.* hkr.*
SUDO_CLEAN+= /var/run/testdata_${USER} /var/run/keycommand_${USER}
# Enable all malloc(3) randomisations and checks
TEST_ENV= "MALLOC_OPTIONS=AFGJPRX"
TEST_SSH_SSHKEYGEN?=ssh-keygen
CPPFLAGS=-I..
t1:
${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/rsa_ssh2.prv | diff - ${.CURDIR}/rsa_openssh.prv
tr '\n' '\r' <${.CURDIR}/rsa_ssh2.prv > ${.OBJDIR}/rsa_ssh2_cr.prv
@ -101,7 +133,7 @@ t3:
${TEST_SSH_SSHKEYGEN} -if $(OBJ)/t3.out | diff - ${.CURDIR}/rsa_openssh.pub
t4:
${TEST_SSH_SSHKEYGEN} -lf ${.CURDIR}/rsa_openssh.pub |\
${TEST_SSH_SSHKEYGEN} -E md5 -lf ${.CURDIR}/rsa_openssh.pub |\
awk '{print $$2}' | diff - ${.CURDIR}/t4.ok
t5:
@ -138,19 +170,52 @@ t9: $(OBJ)/t9.out
test "${TEST_SSH_ECC}" != yes || \
${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t9.out > /dev/null
$(OBJ)/t10.out:
${TEST_SSH_SSHKEYGEN} -q -t ed25519 -N '' -f $@
t10: $(OBJ)/t10.out
${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t10.out > /dev/null
${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t10.out > /dev/null
t11:
${TEST_SSH_SSHKEYGEN} -E sha256 -lf ${.CURDIR}/rsa_openssh.pub |\
awk '{print $$2}' | diff - ${.CURDIR}/t11.ok
$(OBJ)/t12.out:
${TEST_SSH_SSHKEYGEN} -q -t ed25519 -N '' -C 'test-comment-1234' -f $@
t12: $(OBJ)/t12.out
${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t12.out.pub | grep test-comment-1234 >/dev/null
t-exec: ${LTESTS:=.sh}
@if [ "x$?" = "x" ]; then exit 0; fi; \
for TEST in ""$?; do \
echo "run test $${TEST}" ... 1>&2; \
(env SUDO="${SUDO}" TEST_ENV=${TEST_ENV} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
(env SUDO="${SUDO}" TEST_ENV=${TEST_ENV} ${TEST_SHELL} ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
done
t-exec-interop: ${INTEROP_TESTS:=.sh}
@if [ "x$?" = "x" ]; then exit 0; fi; \
for TEST in ""$?; do \
echo "run test $${TEST}" ... 1>&2; \
(env SUDO="${SUDO}" TEST_ENV=${TEST_ENV} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
(env SUDO="${SUDO}" TEST_ENV=${TEST_ENV} ${TEST_SHELL} ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
done
# Not run by default
interop: ${INTEROP_TARGETS}
# Unit tests, built by top-level Makefile
unit:
set -e ; if test -z "${SKIP_UNIT}" ; then \
V="" ; \
test "x${USE_VALGRIND}" = "x" || \
V=${.CURDIR}/valgrind-unit.sh ; \
$$V ${.OBJDIR}/unittests/sshbuf/test_sshbuf ; \
$$V ${.OBJDIR}/unittests/sshkey/test_sshkey \
-d ${.CURDIR}/unittests/sshkey/testdata ; \
$$V ${.OBJDIR}/unittests/bitmap/test_bitmap ; \
$$V ${.OBJDIR}/unittests/kex/test_kex ; \
$$V ${.OBJDIR}/unittests/hostkeys/test_hostkeys \
-d ${.CURDIR}/unittests/hostkeys/testdata ; \
fi

2
regress/README.regress
View File

@ -31,7 +31,7 @@ TEST_SHELL: shell used for running the test scripts.
TEST_SSH_PORT: TCP port to be used for the listening tests.
TEST_SSH_SSH_CONFOPTS: Configuration directives to be added to ssh_config
before running each test.
TEST_SSH_SSHD_CONFOTPS: Configuration directives to be added to sshd_config
TEST_SSH_SSHD_CONFOPTS: Configuration directives to be added to sshd_config
before running each test.

53
regress/addrmatch.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: addrmatch.sh,v 1.3 2010/02/09 04:57:36 djm Exp $
# $OpenBSD: addrmatch.sh,v 1.4 2012/05/13 01:42:32 dtucker Exp $
# Placed in the Public Domain.
tid="address match"
@ -7,39 +7,50 @@ mv $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
run_trial()
{
user="$1"; addr="$2"; host="$3"; expected="$4"; descr="$5"
user="$1"; addr="$2"; host="$3"; laddr="$4"; lport="$5"
expected="$6"; descr="$7"
verbose "test $descr for $user $addr $host"
result=`${SSHD} -f $OBJ/sshd_proxy -T \
-C user=${user},addr=${addr},host=${host} | \
awk '/^passwordauthentication/ {print $2}'`
-C user=${user},addr=${addr},host=${host},laddr=${laddr},lport=${lport} | \
awk '/^forcecommand/ {print $2}'`
if [ "$result" != "$expected" ]; then
fail "failed for $user $addr $host: expected $expected, got $result"
fail "failed '$descr' expected $expected got $result"
fi
}
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
cat >>$OBJ/sshd_proxy <<EOD
PasswordAuthentication no
ForceCommand nomatch
Match Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com
PasswordAuthentication yes
ForceCommand match1
Match Address 1.1.1.1,::1,!::3,2000::/16
PasswordAuthentication yes
ForceCommand match2
Match LocalAddress 127.0.0.1,::1
ForceCommand match3
Match LocalPort 5678
ForceCommand match4
EOD
run_trial user 192.168.0.1 somehost yes "permit, first entry"
run_trial user 192.168.30.1 somehost no "deny, negative match"
run_trial user 19.0.0.1 somehost no "deny, no match"
run_trial user 10.255.255.254 somehost yes "permit, list middle"
run_trial user 192.168.30.1 192.168.0.1 no "deny, faked IP in hostname"
run_trial user 1.1.1.1 somehost.example.com yes "permit, bare IP4 address"
test "$TEST_SSH_IPV6" = "no" && exit
run_trial user ::1 somehost.example.com yes "permit, bare IP6 address"
run_trial user ::2 somehost.exaple.com no "deny IPv6"
run_trial user ::3 somehost no "deny IP6 negated"
run_trial user ::4 somehost no "deny, IP6 no match"
run_trial user 2000::1 somehost yes "permit, IP6 network"
run_trial user 2001::1 somehost no "deny, IP6 network"
run_trial user 192.168.0.1 somehost 1.2.3.4 1234 match1 "first entry"
run_trial user 192.168.30.1 somehost 1.2.3.4 1234 nomatch "negative match"
run_trial user 19.0.0.1 somehost 1.2.3.4 1234 nomatch "no match"
run_trial user 10.255.255.254 somehost 1.2.3.4 1234 match1 "list middle"
run_trial user 192.168.30.1 192.168.0.1 1.2.3.4 1234 nomatch "faked IP in hostname"
run_trial user 1.1.1.1 somehost.example.com 1.2.3.4 1234 match2 "bare IP4 address"
run_trial user 19.0.0.1 somehost 127.0.0.1 1234 match3 "localaddress"
run_trial user 19.0.0.1 somehost 1.2.3.4 5678 match4 "localport"
if test "$TEST_SSH_IPV6" != "no"; then
run_trial user ::1 somehost.example.com ::2 1234 match2 "bare IP6 address"
run_trial user ::2 somehost.exaple.com ::2 1234 nomatch "deny IPv6"
run_trial user ::3 somehost ::2 1234 nomatch "IP6 negated"
run_trial user ::4 somehost ::2 1234 nomatch "IP6 no match"
run_trial user 2000::1 somehost ::2 1234 match2 "IP6 network"
run_trial user 2001::1 somehost ::2 1234 nomatch "IP6 network"
run_trial user ::5 somehost ::1 1234 match3 "IP6 localaddress"
run_trial user ::5 somehost ::2 5678 match4 "IP6 localport"
fi
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
rm $OBJ/sshd_proxy_bak

3
regress/agent-getpeereid.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: agent-getpeereid.sh,v 1.4 2007/11/25 15:35:09 jmc Exp $
# $OpenBSD: agent-getpeereid.sh,v 1.5 2013/05/17 10:33:09 dtucker Exp $
# Placed in the Public Domain.
tid="disallow agent attach from other uid"
@ -18,7 +18,6 @@ if [ -z "$SUDO" ]; then
exit 0
fi
trace "start agent"
eval `${SSHAGENT} -s -a ${ASOCK}` > /dev/null
r=$?

4
regress/agent-pkcs11.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: agent-pkcs11.sh,v 1.1 2010/02/08 10:52:47 markus Exp $
# $OpenBSD: agent-pkcs11.sh,v 1.2 2015/01/12 11:46:32 djm Exp $
# Placed in the Public Domain.
tid="pkcs11 agent test"
@ -6,6 +6,8 @@ tid="pkcs11 agent test"
TEST_SSH_PIN=""
TEST_SSH_PKCS11=/usr/local/lib/soft-pkcs11.so.0.0
test -f "$TEST_SSH_PKCS11" || fatal "$TEST_SSH_PKCS11 does not exist"
# setup environment for soft-pkcs11 token
SOFTPKCS11RC=$OBJ/pkcs11.info
export SOFTPKCS11RC

14
regress/agent-ptrace.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: agent-ptrace.sh,v 1.1 2002/12/09 15:38:30 markus Exp $
# $OpenBSD: agent-ptrace.sh,v 1.2 2014/02/27 21:21:25 djm Exp $
# Placed in the Public Domain.
tid="disallow agent ptrace attach"
@ -19,6 +19,13 @@ else
exit 0
fi
if $OBJ/setuid-allowed ${SSHAGENT} ; then
: ok
else
echo "skipped (${SSHAGENT} is mounted on a no-setuid filesystem)"
exit 0
fi
if test -z "$SUDO" ; then
echo "skipped (SUDO not set)"
exit 0
@ -38,8 +45,9 @@ else
gdb ${SSHAGENT} ${SSH_AGENT_PID} > ${OBJ}/gdb.out 2>&1 << EOF
quit
EOF
if [ $? -ne 0 ]; then
fail "gdb failed: exit code $?"
r=$?
if [ $r -ne 0 ]; then
fail "gdb failed: exit code $r"
fi
egrep 'ptrace: Operation not permitted.|procfs:.*Permission denied.|ttrace.*Permission denied.|procfs:.*: Invalid argument.|Unable to access task ' >/dev/null ${OBJ}/gdb.out
r=$?

4
regress/agent-timeout.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: agent-timeout.sh,v 1.1 2002/06/06 00:38:40 markus Exp $
# $OpenBSD: agent-timeout.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="agent timeout test"
@ -12,7 +12,7 @@ if [ $r -ne 0 ]; then
fail "could not start ssh-agent: exit code $r"
else
trace "add keys with timeout"
for t in rsa rsa1; do
for t in ${SSH_KEYTYPES}; do
${SSHADD} -t ${SSHAGENT_TIMEOUT} $OBJ/$t > /dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh-add did succeed exit code 0"

40
regress/agent.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: agent.sh,v 1.7 2007/11/25 15:35:09 jmc Exp $
# $OpenBSD: agent.sh,v 1.11 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="simple agent test"
@ -19,8 +19,8 @@ else
fail "ssh-add -l did not fail with exit code 1"
fi
trace "overwrite authorized keys"
echon > $OBJ/authorized_keys_$USER
for t in rsa rsa1; do
printf '' > $OBJ/authorized_keys_$USER
for t in ${SSH_KEYTYPES}; do
# generate user key for agent
rm -f $OBJ/$t-agent
${SSHKEYGEN} -q -N '' -t $t -f $OBJ/$t-agent ||\
@ -34,40 +34,46 @@ else
fi
done
${SSHADD} -l > /dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh-add -l failed: exit code $?"
r=$?
if [ $r -ne 0 ]; then
fail "ssh-add -l failed: exit code $r"
fi
# the same for full pubkey output
${SSHADD} -L > /dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh-add -L failed: exit code $?"
r=$?
if [ $r -ne 0 ]; then
fail "ssh-add -L failed: exit code $r"
fi
trace "simple connect via agent"
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
${SSH} -$p -F $OBJ/ssh_proxy somehost exit 5$p
if [ $? -ne 5$p ]; then
fail "ssh connect with protocol $p failed (exit code $?)"
r=$?
if [ $r -ne 5$p ]; then
fail "ssh connect with protocol $p failed (exit code $r)"
fi
done
trace "agent forwarding"
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
${SSH} -A -$p -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh-add -l via agent fwd proto $p failed (exit code $?)"
r=$?
if [ $r -ne 0 ]; then
fail "ssh-add -l via agent fwd proto $p failed (exit code $r)"
fi
${SSH} -A -$p -F $OBJ/ssh_proxy somehost \
"${SSH} -$p -F $OBJ/ssh_proxy somehost exit 5$p"
if [ $? -ne 5$p ]; then
fail "agent fwd proto $p failed (exit code $?)"
r=$?
if [ $r -ne 5$p ]; then
fail "agent fwd proto $p failed (exit code $r)"
fi
done
trace "delete all agent keys"
${SSHADD} -D > /dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh-add -D failed: exit code $?"
r=$?
if [ $r -ne 0 ]; then
fail "ssh-add -D failed: exit code $r"
fi
trace "kill agent"

4
regress/broken-pipe.sh
View File

@ -1,9 +1,9 @@
# $OpenBSD: broken-pipe.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
# $OpenBSD: broken-pipe.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="broken pipe test"
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
trace "protocol $p"
for i in 1 2 3 4; do
${SSH} -$p -F $OBJ/ssh_config_config nexthost echo $i 2> /dev/null | true

79
regress/bsd.regress.mk
View File

@ -1,79 +0,0 @@
# $OpenBSD: bsd.regress.mk,v 1.9 2002/02/17 01:10:15 marc Exp $
# No man pages for regression tests.
NOMAN=
# No installation.
install:
# If REGRESSTARGETS is defined and PROG is not defined, set NOPROG
.if defined(REGRESSTARGETS) && !defined(PROG)
NOPROG=
.endif
.include <bsd.prog.mk>
.MAIN: all
all: regress
# XXX - Need full path to REGRESSLOG, otherwise there will be much pain.
REGRESSLOG?=/dev/null
REGRESSNAME=${.CURDIR:S/${BSDSRCDIR}\/regress\///}
.if defined(PROG) && !empty(PROG)
run-regress-${PROG}: ${PROG}
./${PROG}
.endif
.if !defined(REGRESSTARGETS)
REGRESSTARGETS=run-regress-${PROG}
. if defined(REGRESSSKIP)
REGRESSSKIPTARGETS=run-regress-${PROG}
. endif
.endif
REGRESSSKIPSLOW?=no
#.if (${REGRESSSKIPSLOW:L} == "yes") && defined(REGRESSSLOWTARGETS)
.if (${REGRESSSKIPSLOW} == "yes") && defined(REGRESSSLOWTARGETS)
REGRESSSKIPTARGETS+=${REGRESSSLOWTARGETS}
.endif
.if defined(REGRESSROOTTARGETS)
ROOTUSER!=id -g
SUDO?=
. if (${ROOTUSER} != 0) && empty(SUDO)
REGRESSSKIPTARGETS+=${REGRESSROOTTARGETS}
. endif
.endif
REGRESSSKIPTARGETS?=
regress:
.for RT in ${REGRESSTARGETS}
. if ${REGRESSSKIPTARGETS:M${RT}}
@echo -n "SKIP " >> ${REGRESSLOG}
. else
# XXX - we need a better method to see if a test fails due to timeout or just
# normal failure.
. if !defined(REGRESSMAXTIME)
@if cd ${.CURDIR} && ${MAKE} ${RT}; then \
echo -n "SUCCESS " >> ${REGRESSLOG} ; \
else \
echo -n "FAIL " >> ${REGRESSLOG} ; \
echo FAILED ; \
fi
. else
@if cd ${.CURDIR} && (ulimit -t ${REGRESSMAXTIME} ; ${MAKE} ${RT}); then \
echo -n "SUCCESS " >> ${REGRESSLOG} ; \
else \
echo -n "FAIL (possible timeout) " >> ${REGRESSLOG} ; \
echo FAILED ; \
fi
. endif
. endif
@echo ${REGRESSNAME}/${RT:S/^run-regress-//} >> ${REGRESSLOG}
.endfor
.PHONY: regress

308
regress/cert-hostkey.sh
View File

@ -1,52 +1,106 @@
# $OpenBSD: cert-hostkey.sh,v 1.6 2011/05/20 02:43:36 djm Exp $
# $OpenBSD: cert-hostkey.sh,v 1.13 2015/07/10 06:23:25 markus Exp $
# Placed in the Public Domain.
tid="certified host keys"
# used to disable ECC based tests on platforms without ECC
ecdsa=""
if test "x$TEST_SSH_ECC" = "xyes"; then
ecdsa=ecdsa
fi
rm -f $OBJ/known_hosts-cert* $OBJ/host_ca_key* $OBJ/host_revoked_*
rm -f $OBJ/cert_host_key* $OBJ/host_krl_*
rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
# Allow all hostkey/pubkey types, prefer certs for the client
types=""
for i in `$SSH -Q key`; do
if [ -z "$types" ]; then
types="$i"
continue
fi
case "$i" in
*cert*) types="$i,$types";;
*) types="$types,$i";;
esac
done
(
echo "HostKeyAlgorithms ${types}"
echo "PubkeyAcceptedKeyTypes *"
) >> $OBJ/ssh_proxy
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
(
echo "HostKeyAlgorithms *"
echo "PubkeyAcceptedKeyTypes *"
) >> $OBJ/sshd_proxy_bak
HOSTS='localhost-with-alias,127.0.0.1,::1'
# Create a CA key and add it to known hosts
${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/host_ca_key ||\
# Create a CA key and add it to known hosts. Ed25519 chosed for speed.
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/host_ca_key ||\
fail "ssh-keygen of host_ca_key failed"
(
echon '@cert-authority '
echon "$HOSTS "
printf '@cert-authority '
printf "$HOSTS "
cat $OBJ/host_ca_key.pub
) > $OBJ/known_hosts-cert
) > $OBJ/known_hosts-cert.orig
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
# Plain text revocation files
touch $OBJ/host_revoked_empty
touch $OBJ/host_revoked_plain
touch $OBJ/host_revoked_cert
cp $OBJ/host_ca_key.pub $OBJ/host_revoked_ca
PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/g;s/^ssh-//'`
# Prepare certificate, plain key and CA KRLs
${SSHKEYGEN} -kf $OBJ/host_krl_empty || fatal "KRL init failed"
${SSHKEYGEN} -kf $OBJ/host_krl_plain || fatal "KRL init failed"
${SSHKEYGEN} -kf $OBJ/host_krl_cert || fatal "KRL init failed"
${SSHKEYGEN} -kf $OBJ/host_krl_ca $OBJ/host_ca_key.pub \
|| fatal "KRL init failed"
# Generate and sign host keys
for ktype in rsa dsa $ecdsa ; do
serial=1
for ktype in $PLAIN_TYPES ; do
verbose "$tid: sign host ${ktype} cert"
# Generate and sign a host key
${SSHKEYGEN} -q -N '' -t ${ktype} \
-f $OBJ/cert_host_key_${ktype} || \
fail "ssh-keygen of cert_host_key_${ktype} failed"
${SSHKEYGEN} -h -q -s $OBJ/host_ca_key \
fatal "ssh-keygen of cert_host_key_${ktype} failed"
${SSHKEYGEN} -ukf $OBJ/host_krl_plain \
$OBJ/cert_host_key_${ktype}.pub || fatal "KRL update failed"
cat $OBJ/cert_host_key_${ktype}.pub >> $OBJ/host_revoked_plain
${SSHKEYGEN} -h -q -s $OBJ/host_ca_key -z $serial \
-I "regress host key for $USER" \
-n $HOSTS $OBJ/cert_host_key_${ktype} ||
fail "couldn't sign cert_host_key_${ktype}"
# v00 ecdsa certs do not exist
test "${ktype}" = "ecdsa" && continue
cp $OBJ/cert_host_key_${ktype} $OBJ/cert_host_key_${ktype}_v00
cp $OBJ/cert_host_key_${ktype}.pub $OBJ/cert_host_key_${ktype}_v00.pub
${SSHKEYGEN} -t v00 -h -q -s $OBJ/host_ca_key \
-I "regress host key for $USER" \
-n $HOSTS $OBJ/cert_host_key_${ktype}_v00 ||
fail "couldn't sign cert_host_key_${ktype}_v00"
fatal "couldn't sign cert_host_key_${ktype}"
${SSHKEYGEN} -ukf $OBJ/host_krl_cert \
$OBJ/cert_host_key_${ktype}-cert.pub || \
fatal "KRL update failed"
cat $OBJ/cert_host_key_${ktype}-cert.pub >> $OBJ/host_revoked_cert
serial=`expr $serial + 1`
done
# Basic connect tests
attempt_connect() {
_ident="$1"
_expect_success="$2"
shift; shift
verbose "$tid: $_ident expect success $_expect_success"
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
"$@" -F $OBJ/ssh_proxy somehost true
_r=$?
if [ "x$_expect_success" = "xyes" ] ; then
if [ $_r -ne 0 ]; then
fail "ssh cert connect $_ident failed"
fi
else
if [ $_r -eq 0 ]; then
fail "ssh cert connect $_ident succeeded unexpectedly"
fi
fi
}
# Basic connect and revocation tests.
for privsep in yes no ; do
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00; do
for ktype in $PLAIN_TYPES ; do
verbose "$tid: host ${ktype} cert connect privsep $privsep"
(
cat $OBJ/sshd_proxy_bak
@ -55,40 +109,40 @@ for privsep in yes no ; do
echo UsePrivilegeSeparation $privsep
) > $OBJ/sshd_proxy
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
fi
# test name expect success
attempt_connect "$ktype basic connect" "yes"
attempt_connect "$ktype empty KRL" "yes" \
-oRevokedHostKeys=$OBJ/host_krl_empty
attempt_connect "$ktype KRL w/ plain key revoked" "no" \
-oRevokedHostKeys=$OBJ/host_krl_plain
attempt_connect "$ktype KRL w/ cert revoked" "no" \
-oRevokedHostKeys=$OBJ/host_krl_cert
attempt_connect "$ktype KRL w/ CA revoked" "no" \
-oRevokedHostKeys=$OBJ/host_krl_ca
attempt_connect "$ktype empty plaintext revocation" "yes" \
-oRevokedHostKeys=$OBJ/host_revoked_empty
attempt_connect "$ktype plain key plaintext revocation" "no" \
-oRevokedHostKeys=$OBJ/host_revoked_plain
attempt_connect "$ktype cert plaintext revocation" "no" \
-oRevokedHostKeys=$OBJ/host_revoked_cert
attempt_connect "$ktype CA plaintext revocation" "no" \
-oRevokedHostKeys=$OBJ/host_revoked_ca
done
done
# Revoked certificates with key present
(
echon '@cert-authority '
echon "$HOSTS "
printf '@cert-authority '
printf "$HOSTS "
cat $OBJ/host_ca_key.pub
echon '@revoked '
echon "* "
cat $OBJ/cert_host_key_rsa.pub
if test "x$TEST_SSH_ECC" = "xyes"; then
echon '@revoked '
echon "* "
cat $OBJ/cert_host_key_ecdsa.pub
fi
echon '@revoked '
echon "* "
cat $OBJ/cert_host_key_dsa.pub
echon '@revoked '
echon "* "
cat $OBJ/cert_host_key_rsa_v00.pub
echon '@revoked '
echon "* "
cat $OBJ/cert_host_key_dsa_v00.pub
) > $OBJ/known_hosts-cert
for ktype in $PLAIN_TYPES ; do
test -f "$OBJ/cert_host_key_${ktype}.pub" || fatal "no pubkey"
printf "@revoked * `cat $OBJ/cert_host_key_${ktype}.pub`\n"
done
) > $OBJ/known_hosts-cert.orig
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
for privsep in yes no ; do
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00; do
for ktype in $PLAIN_TYPES ; do
verbose "$tid: host ${ktype} revoked cert privsep $privsep"
(
cat $OBJ/sshd_proxy_bak
@ -97,6 +151,7 @@ for privsep in yes no ; do
echo UsePrivilegeSeparation $privsep
) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
@ -108,20 +163,22 @@ done
# Revoked CA
(
echon '@cert-authority '
echon "$HOSTS "
printf '@cert-authority '
printf "$HOSTS "
cat $OBJ/host_ca_key.pub
echon '@revoked '
echon "* "
printf '@revoked '
printf "* "
cat $OBJ/host_ca_key.pub
) > $OBJ/known_hosts-cert
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
) > $OBJ/known_hosts-cert.orig
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
for ktype in $PLAIN_TYPES ; do
verbose "$tid: host ${ktype} revoked cert"
(
cat $OBJ/sshd_proxy_bak
echo HostKey $OBJ/cert_host_key_${ktype}
echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
@ -132,27 +189,21 @@ done
# Create a CA key and add it to known hosts
(
echon '@cert-authority '
echon "$HOSTS "
printf '@cert-authority '
printf "$HOSTS "
cat $OBJ/host_ca_key.pub
) > $OBJ/known_hosts-cert
) > $OBJ/known_hosts-cert.orig
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
test_one() {
ident=$1
result=$2
sign_opts=$3
for kt in rsa rsa_v00 ; do
case $kt in
*_v00) args="-t v00" ;;
*) args="" ;;
esac
verbose "$tid: host cert connect $ident $kt expect $result"
for kt in rsa ed25519 ; do
${SSHKEYGEN} -q -s $OBJ/host_ca_key \
-I "regress host key for $USER" \
$sign_opts $args \
$OBJ/cert_host_key_${kt} ||
$sign_opts $OBJ/cert_host_key_${kt} ||
fail "couldn't sign cert_host_key_${kt}"
(
cat $OBJ/sshd_proxy_bak
@ -160,6 +211,7 @@ test_one() {
echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
@ -185,72 +237,66 @@ test_one "cert valid interval" success "-h -V-1w:+2w"
test_one "cert has constraints" failure "-h -Oforce-command=false"
# Check downgrade of cert to raw key when no CA found
for v in v01 v00 ; do
for ktype in rsa dsa $ecdsa ; do
# v00 ecdsa certs do not exist.
test "${v}${ktype}" = "v00ecdsa" && continue
rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
# Generate and sign a host key
${SSHKEYGEN} -q -N '' -t ${ktype} \
-f $OBJ/cert_host_key_${ktype} || \
fail "ssh-keygen of cert_host_key_${ktype} failed"
${SSHKEYGEN} -t ${v} -h -q -s $OBJ/host_ca_key \
-I "regress host key for $USER" \
-n $HOSTS $OBJ/cert_host_key_${ktype} ||
fail "couldn't sign cert_host_key_${ktype}"
(
echon "$HOSTS "
cat $OBJ/cert_host_key_${ktype}.pub
) > $OBJ/known_hosts-cert
(
cat $OBJ/sshd_proxy_bak
echo HostKey $OBJ/cert_host_key_${ktype}
echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
) > $OBJ/sshd_proxy
for ktype in $PLAIN_TYPES ; do
rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
# Generate and sign a host key
${SSHKEYGEN} -q -N '' -t ${ktype} \
-f $OBJ/cert_host_key_${ktype} || \
fail "ssh-keygen of cert_host_key_${ktype} failed"
${SSHKEYGEN} -t ${v} -h -q -s $OBJ/host_ca_key \
-I "regress host key for $USER" \
-n $HOSTS $OBJ/cert_host_key_${ktype} ||
fail "couldn't sign cert_host_key_${ktype}"
(
printf "$HOSTS "
cat $OBJ/cert_host_key_${ktype}.pub
) > $OBJ/known_hosts-cert
(
cat $OBJ/sshd_proxy_bak
echo HostKey $OBJ/cert_host_key_${ktype}
echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
) > $OBJ/sshd_proxy
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
fi
done
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
fi
done
# Wrong certificate
(
echon '@cert-authority '
echon "$HOSTS "
printf '@cert-authority '
printf "$HOSTS "
cat $OBJ/host_ca_key.pub
) > $OBJ/known_hosts-cert
for v in v01 v00 ; do
for kt in rsa dsa $ecdsa ; do
# v00 ecdsa certs do not exist.
test "${v}${ktype}" = "v00ecdsa" && continue
rm -f $OBJ/cert_host_key*
# Self-sign key
${SSHKEYGEN} -q -N '' -t ${kt} \
-f $OBJ/cert_host_key_${kt} || \
fail "ssh-keygen of cert_host_key_${kt} failed"
${SSHKEYGEN} -t ${v} -h -q -s $OBJ/cert_host_key_${kt} \
-I "regress host key for $USER" \
-n $HOSTS $OBJ/cert_host_key_${kt} ||
fail "couldn't sign cert_host_key_${kt}"
verbose "$tid: host ${kt} connect wrong cert"
(
cat $OBJ/sshd_proxy_bak
echo HostKey $OBJ/cert_host_key_${kt}
echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
) > $OBJ/sshd_proxy
) > $OBJ/known_hosts-cert.orig
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
for kt in $PLAIN_TYPES ; do
rm -f $OBJ/cert_host_key*
# Self-sign key
${SSHKEYGEN} -q -N '' -t ${kt} \
-f $OBJ/cert_host_key_${kt} || \
fail "ssh-keygen of cert_host_key_${kt} failed"
${SSHKEYGEN} -t ${v} -h -q -s $OBJ/cert_host_key_${kt} \
-I "regress host key for $USER" \
-n $HOSTS $OBJ/cert_host_key_${kt} ||
fail "couldn't sign cert_host_key_${kt}"
verbose "$tid: host ${kt} connect wrong cert"
(
cat $OBJ/sshd_proxy_bak
echo HostKey $OBJ/cert_host_key_${kt}
echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
) > $OBJ/sshd_proxy
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect $ident succeeded unexpectedly"
fi
done
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect $ident succeeded unexpectedly"
fi
done
rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
rm -f $OBJ/known_hosts-cert* $OBJ/host_ca_key* $OBJ/cert_host_key*

104
regress/cert-userkey.sh
View File

@ -1,43 +1,37 @@
# $OpenBSD: cert-userkey.sh,v 1.8 2011/05/17 07:13:31 djm Exp $
# $OpenBSD: cert-userkey.sh,v 1.14 2015/07/10 06:23:25 markus Exp $
# Placed in the Public Domain.
tid="certified user keys"
# used to disable ECC based tests on platforms without ECC
ecdsa=""
if test "x$TEST_SSH_ECC" = "xyes"; then
ecdsa=ecdsa
fi
rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/;s/^ssh-//'`
kname() {
n=`echo "$1" | sed 's/^dsa/ssh-dss/;s/^rsa/ssh-rsa/;s/^ed/ssh-ed/'`
echo "$n*,ssh-rsa*,ssh-ed25519*"
}
# Create a CA key
${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_ca_key ||\
fail "ssh-keygen of user_ca_key failed"
# Generate and sign user keys
for ktype in rsa dsa $ecdsa ; do
for ktype in $PLAIN_TYPES ; do
verbose "$tid: sign user ${ktype} cert"
${SSHKEYGEN} -q -N '' -t ${ktype} \
-f $OBJ/cert_user_key_${ktype} || \
fail "ssh-keygen of cert_user_key_${ktype} failed"
${SSHKEYGEN} -q -s $OBJ/user_ca_key -I \
"regress user key for $USER" \
-n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype} ||
${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
-z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype} ||
fail "couldn't sign cert_user_key_${ktype}"
# v00 ecdsa certs do not exist
test "${ktype}" = "ecdsa" && continue
cp $OBJ/cert_user_key_${ktype} $OBJ/cert_user_key_${ktype}_v00
cp $OBJ/cert_user_key_${ktype}.pub $OBJ/cert_user_key_${ktype}_v00.pub
${SSHKEYGEN} -q -t v00 -s $OBJ/user_ca_key -I \
"regress user key for $USER" \
-n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype}_v00 ||
fail "couldn't sign cert_user_key_${ktype}_v00"
done
# Test explicitly-specified principals
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
for ktype in $PLAIN_TYPES ; do
t=$(kname $ktype)
for privsep in yes no ; do
_prefix="${ktype} privsep $privsep"
@ -49,7 +43,12 @@ for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
echo "AuthorizedPrincipalsFile " \
"$OBJ/authorized_principals_%u"
echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
echo "PubkeyAcceptedKeyTypes ${t}"
) > $OBJ/sshd_proxy
(
cat $OBJ/ssh_proxy_bak
echo "PubkeyAcceptedKeyTypes ${t}"
) > $OBJ/ssh_proxy
# Missing authorized_principals
verbose "$tid: ${_prefix} missing authorized_principals"
@ -122,12 +121,17 @@ for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
(
cat $OBJ/sshd_proxy_bak
echo "UsePrivilegeSeparation $privsep"
echo "PubkeyAcceptedKeyTypes ${t}"
) > $OBJ/sshd_proxy
(
cat $OBJ/ssh_proxy_bak
echo "PubkeyAcceptedKeyTypes ${t}"
) > $OBJ/ssh_proxy
# Wrong principals list
verbose "$tid: ${_prefix} wrong principals key option"
(
echon 'cert-authority,principals="gregorsamsa" '
printf 'cert-authority,principals="gregorsamsa" '
cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \
@ -139,7 +143,7 @@ for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
# Correct principals list
verbose "$tid: ${_prefix} correct principals key option"
(
echon 'cert-authority,principals="mekmitasdigoat" '
printf 'cert-authority,principals="mekmitasdigoat" '
cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \
@ -155,7 +159,7 @@ basic_tests() {
if test "x$auth" = "xauthorized_keys" ; then
# Add CA to authorized_keys
(
echon 'cert-authority '
printf 'cert-authority '
cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER
else
@ -163,7 +167,8 @@ basic_tests() {
extra_sshd="TrustedUserCAKeys $OBJ/user_ca_key.pub"
fi
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
for ktype in $PLAIN_TYPES ; do
t=$(kname $ktype)
for privsep in yes no ; do
_prefix="${ktype} privsep $privsep $auth"
# Simple connect
@ -171,8 +176,13 @@ basic_tests() {
(
cat $OBJ/sshd_proxy_bak
echo "UsePrivilegeSeparation $privsep"
echo "PubkeyAcceptedKeyTypes ${t}"
echo "$extra_sshd"
) > $OBJ/sshd_proxy
(
cat $OBJ/ssh_proxy_bak
echo "PubkeyAcceptedKeyTypes ${t}"
) > $OBJ/ssh_proxy
${SSH} -2i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true
@ -185,14 +195,33 @@ basic_tests() {
(
cat $OBJ/sshd_proxy_bak
echo "UsePrivilegeSeparation $privsep"
echo "RevokedKeys $OBJ/cert_user_key_${ktype}.pub"
echo "RevokedKeys $OBJ/cert_user_key_revoked"
echo "PubkeyAcceptedKeyTypes ${t}"
echo "$extra_sshd"
) > $OBJ/sshd_proxy
cp $OBJ/cert_user_key_${ktype}.pub \
$OBJ/cert_user_key_revoked
${SSH} -2i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpecedly"
fi
verbose "$tid: ${_prefix} revoked via KRL"
rm $OBJ/cert_user_key_revoked
${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked \
$OBJ/cert_user_key_${ktype}.pub
${SSH} -2i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpecedly"
fi
verbose "$tid: ${_prefix} empty KRL"
${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked
${SSH} -2i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
fi
done
# Revoked CA
@ -200,6 +229,7 @@ basic_tests() {
(
cat $OBJ/sshd_proxy_bak
echo "RevokedKeys $OBJ/user_ca_key.pub"
echo "PubkeyAcceptedKeyTypes ${t}"
echo "$extra_sshd"
) > $OBJ/sshd_proxy
${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
@ -212,6 +242,7 @@ basic_tests() {
verbose "$tid: $auth CA does not authenticate"
(
cat $OBJ/sshd_proxy_bak
echo "PubkeyAcceptedKeyTypes ${t}"
echo "$extra_sshd"
) > $OBJ/sshd_proxy
verbose "$tid: ensure CA key does not authenticate user"
@ -237,23 +268,20 @@ test_one() {
fi
for auth in $auth_choice ; do
for ktype in rsa rsa_v00 ; do
case $ktype in
*_v00) keyv="-t v00" ;;
*) keyv="" ;;
esac
for ktype in rsa ed25519 ; do
cat $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
if test "x$auth" = "xauthorized_keys" ; then
# Add CA to authorized_keys
(
echon "cert-authority${auth_opt} "
printf "cert-authority${auth_opt} "
cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER
else
echo > $OBJ/authorized_keys_$USER
echo "TrustedUserCAKeys $OBJ/user_ca_key.pub" \
>> $OBJ/sshd_proxy
echo "PubkeyAcceptedKeyTypes ${t}*" \
>> $OBJ/sshd_proxy
if test "x$auth_opt" != "x" ; then
echo $auth_opt >> $OBJ/sshd_proxy
fi
@ -262,8 +290,7 @@ test_one() {
verbose "$tid: $ident auth $auth expect $result $ktype"
${SSHKEYGEN} -q -s $OBJ/user_ca_key \
-I "regress user key for $USER" \
$sign_opts $keyv \
$OBJ/cert_user_key_${ktype} ||
$sign_opts $OBJ/cert_user_key_${ktype} ||
fail "couldn't sign cert_user_key_${ktype}"
${SSH} -2i $OBJ/cert_user_key_${ktype} \
@ -315,13 +342,10 @@ test_one "principals key option no principals" failure "" \
# Wrong certificate
cat $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
case $ktype in
*_v00) args="-t v00" ;;
*) args="" ;;
esac
for ktype in $PLAIN_TYPES ; do
t=$(kname $ktype)
# Self-sign
${SSHKEYGEN} $args -q -s $OBJ/cert_user_key_${ktype} -I \
${SSHKEYGEN} -q -s $OBJ/cert_user_key_${ktype} -I \
"regress user key for $USER" \
-n $USER $OBJ/cert_user_key_${ktype} ||
fail "couldn't sign cert_user_key_${ktype}"

34
regress/cfgmatch.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: cfgmatch.sh,v 1.6 2011/06/03 05:35:10 dtucker Exp $
# $OpenBSD: cfgmatch.sh,v 1.9 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="sshd_config match"
@ -15,7 +15,7 @@ start_client()
rm -f $pidfile
${SSH} -q -$p $fwd "$@" somehost \
exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' \
>>$TEST_SSH_LOGFILE 2>&1 &
>>$TEST_REGRESS_LOGFILE 2>&1 &
client_pid=$!
# Wait for remote end
n=0
@ -34,21 +34,20 @@ stop_client()
pid=`cat $pidfile`
if [ ! -z "$pid" ]; then
kill $pid
sleep 1
fi
wait
}
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
grep -v AuthorizedKeysFile $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
echo "AuthorizedKeysFile /dev/null" >>$OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1" >>$OBJ/sshd_config
echo "Match user $USER" >>$OBJ/sshd_proxy
echo "AuthorizedKeysFile /dev/null $OBJ/authorized_keys_%u" >>$OBJ/sshd_proxy
echo "Match Address 127.0.0.1" >>$OBJ/sshd_config
echo "PermitOpen 127.0.0.1:$PORT" >>$OBJ/sshd_config
grep -v AuthorizedKeysFile $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
echo "AuthorizedKeysFile /dev/null" >>$OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1" >>$OBJ/sshd_proxy
echo "Match user $USER" >>$OBJ/sshd_proxy
echo "AuthorizedKeysFile /dev/null $OBJ/authorized_keys_%u" >>$OBJ/sshd_proxy
echo "Match Address 127.0.0.1" >>$OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:$PORT" >>$OBJ/sshd_proxy
@ -57,7 +56,7 @@ start_sshd
#set -x
# Test Match + PermitOpen in sshd_config. This should be permitted
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
trace "match permitopen localhost proto $p"
start_client -F $OBJ/ssh_config
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
@ -66,7 +65,7 @@ for p in 1 2; do
done
# Same but from different source. This should not be permitted
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
trace "match permitopen proxy proto $p"
start_client -F $OBJ/ssh_proxy
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
@ -75,11 +74,12 @@ for p in 1 2; do
done
# Retry previous with key option, should also be denied.
echon 'permitopen="127.0.0.1:'$PORT'" ' >$OBJ/authorized_keys_$USER
cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
echon 'permitopen="127.0.0.1:'$PORT'" ' >>$OBJ/authorized_keys_$USER
cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
for p in 1 2; do
cp /dev/null $OBJ/authorized_keys_$USER
for t in ${SSH_KEYTYPES}; do
printf 'permitopen="127.0.0.1:'$PORT'" ' >> $OBJ/authorized_keys_$USER
cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
done
for p in ${SSH_PROTOCOLS}; do
trace "match permitopen proxy w/key opts proto $p"
start_client -F $OBJ/ssh_proxy
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
@ -89,7 +89,7 @@ done
# Test both sshd_config and key options permitting the same dst/port pair.
# Should be permitted.
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
trace "match permitopen localhost proto $p"
start_client -F $OBJ/ssh_config
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
@ -103,7 +103,7 @@ echo "Match User $USER" >>$OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
# Test that a Match overrides a PermitOpen in the global section
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
trace "match permitopen proxy w/key opts proto $p"
start_client -F $OBJ/ssh_proxy
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
@ -118,7 +118,7 @@ echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
# Test that a rule that doesn't match doesn't override, plus test a
# PermitOpen entry that's not at the start of the list
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
trace "nomatch permitopen proxy w/key opts proto $p"
start_client -F $OBJ/ssh_proxy
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \

75
regress/cfgparse.sh Normal file
View File

@ -0,0 +1,75 @@
# $OpenBSD: cfgparse.sh,v 1.5 2015/05/29 03:05:13 djm Exp $
# Placed in the Public Domain.
tid="config parse"
# This is a reasonable proxy for IPv6 support.
if ! config_defined HAVE_STRUCT_IN6_ADDR ; then
SKIP_IPV6=yes
fi
# We need to use the keys generated for the regression test because sshd -T
# will fail if we're not running with SUDO (no permissions for real keys) or
# if we are # running tests on a system that has never had sshd installed
# (keys won't exist).
grep "HostKey " $OBJ/sshd_config > $OBJ/sshd_config_minimal
SSHD_KEYS="`cat $OBJ/sshd_config_minimal`"
verbose "reparse minimal config"
($SUDO ${SSHD} -T -f $OBJ/sshd_config_minimal >$OBJ/sshd_config.1 &&
$SUDO ${SSHD} -T -f $OBJ/sshd_config.1 >$OBJ/sshd_config.2 &&
diff $OBJ/sshd_config.1 $OBJ/sshd_config.2) || fail "reparse minimal config"
verbose "reparse regress config"
($SUDO ${SSHD} -T -f $OBJ/sshd_config >$OBJ/sshd_config.1 &&
$SUDO ${SSHD} -T -f $OBJ/sshd_config.1 >$OBJ/sshd_config.2 &&
diff $OBJ/sshd_config.1 $OBJ/sshd_config.2) || fail "reparse regress config"
verbose "listenaddress order"
# expected output
cat > $OBJ/sshd_config.0 <<EOD
listenaddress 1.2.3.4:1234
listenaddress 1.2.3.4:5678
EOD
[ X${SKIP_IPV6} = Xyes ] || cat >> $OBJ/sshd_config.0 <<EOD
listenaddress [::1]:1234
listenaddress [::1]:5678
EOD
# test input sets. should all result in the output above.
# test 1: addressfamily and port first
cat > $OBJ/sshd_config.1 <<EOD
${SSHD_KEYS}
addressfamily any
port 1234
port 5678
listenaddress 1.2.3.4
EOD
[ X${SKIP_IPV6} = Xyes ] || cat >> $OBJ/sshd_config.1 <<EOD
listenaddress ::1
EOD
($SUDO ${SSHD} -T -f $OBJ/sshd_config.1 | \
grep 'listenaddress ' >$OBJ/sshd_config.2 &&
diff $OBJ/sshd_config.0 $OBJ/sshd_config.2) || \
fail "listenaddress order 1"
# test 2: listenaddress first
cat > $OBJ/sshd_config.1 <<EOD
${SSHD_KEYS}
listenaddress 1.2.3.4
port 1234
port 5678
addressfamily any
EOD
[ X${SKIP_IPV6} = Xyes ] || cat >> $OBJ/sshd_config.1 <<EOD
listenaddress ::1
EOD
($SUDO ${SSHD} -T -f $OBJ/sshd_config.1 | \
grep 'listenaddress ' >$OBJ/sshd_config.2 &&
diff $OBJ/sshd_config.0 $OBJ/sshd_config.2) || \
fail "listenaddress order 2"
# cleanup
rm -f $OBJ/sshd_config.[012]

32
regress/cipher-speed.sh
View File

@ -1,29 +1,20 @@
# $OpenBSD: cipher-speed.sh,v 1.4 2011/08/02 01:23:41 djm Exp $
# $OpenBSD: cipher-speed.sh,v 1.13 2015/03/24 20:22:17 markus Exp $
# Placed in the Public Domain.
tid="cipher speed"
getbytes ()
{
sed -n '/transferred/s/.*secs (\(.* bytes.sec\).*/\1/p'
sed -n -e '/transferred/s/.*secs (\(.* bytes.sec\).*/\1/p' \
-e '/copied/s/.*s, \(.* MB.s\).*/\1/p'
}
tries="1 2"
DATA=/bin/ls
DATA=/bsd
ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc
arcfour128 arcfour256 arcfour
aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se
aes128-ctr aes192-ctr aes256-ctr"
macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
config_defined HAVE_EVP_SHA256 &&
macs="$macs hmac-sha2-256 hmac-sha2-256-96 hmac-sha2-512 hmac-sha2-512-96"
for c in $ciphers; do for m in $macs; do
for c in `${SSH} -Q cipher`; do n=0; for m in `${SSH} -Q mac`; do
trace "proto 2 cipher $c mac $m"
for x in $tries; do
echon "$c/$m:\t"
printf "%-60s" "$c/$m:"
( ${SSH} -o 'compression no' \
-F $OBJ/ssh_proxy -2 -m $m -c $c somehost \
exec sh -c \'"dd of=/dev/null obs=32k"\' \
@ -33,13 +24,22 @@ for c in $ciphers; do for m in $macs; do
fail "ssh -2 failed with mac $m cipher $c"
fi
done
# No point trying all MACs for AEAD ciphers since they are ignored.
if ${SSH} -Q cipher-auth | grep "^${c}\$" >/dev/null 2>&1 ; then
break
fi
n=`expr $n + 1`
done; done
ciphers="3des blowfish"
if ssh_version 1; then
ciphers="3des blowfish"
else
ciphers=""
fi
for c in $ciphers; do
trace "proto 1 cipher $c"
for x in $tries; do
echon "$c:\t"
printf "%-60s" "$c:"
( ${SSH} -o 'compression no' \
-F $OBJ/ssh_proxy -1 -c $c somehost \
exec sh -c \'"dd of=/dev/null obs=32k"\' \

5
regress/conch-ciphers.sh
View File

@ -1,11 +1,8 @@
# $OpenBSD: conch-ciphers.sh,v 1.2 2008/06/30 10:43:03 djm Exp $
# $OpenBSD: conch-ciphers.sh,v 1.3 2013/05/17 04:29:14 dtucker Exp $
# Placed in the Public Domain.
tid="conch ciphers"
DATA=/bin/ls
COPY=${OBJ}/copy
if test "x$REGRESS_INTEROP_CONCH" != "xyes" ; then
echo "conch interop tests not enabled"
exit 0

17
regress/connect-privsep.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: connect-privsep.sh,v 1.2 2011/06/30 22:44:43 markus Exp $
# $OpenBSD: connect-privsep.sh,v 1.6 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="proxy connect with privsep"
@ -6,7 +6,7 @@ tid="proxy connect with privsep"
cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
echo 'UsePrivilegeSeparation yes' >> $OBJ/sshd_proxy
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
if [ $? -ne 0 ]; then
fail "ssh privsep+proxyconnect protocol $p failed"
@ -16,10 +16,21 @@ done
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
echo 'UsePrivilegeSeparation sandbox' >> $OBJ/sshd_proxy
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
if [ $? -ne 0 ]; then
# XXX replace this with fail once sandbox has stabilised
warn "ssh privsep/sandbox+proxyconnect protocol $p failed"
fi
done
# Because sandbox is sensitive to changes in libc, especially malloc, retest
# with every malloc.conf option (and none).
for m in '' A F G H J P R S X '<' '>'; do
for p in ${SSH_PROTOCOLS}; do
env MALLOC_OPTIONS="$m" ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
if [ $? -ne 0 ]; then
fail "ssh privsep/sandbox+proxyconnect protocol $p mopt '$m' failed"
fi
done
done

4
regress/connect.sh
View File

@ -1,11 +1,11 @@
# $OpenBSD: connect.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
# $OpenBSD: connect.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="simple connect"
start_sshd
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true
if [ $? -ne 0 ]; then
fail "ssh connect with protocol $p failed"

58
regress/dhgex.sh Normal file
View File

@ -0,0 +1,58 @@
# $OpenBSD: dhgex.sh,v 1.2 2014/04/21 22:15:37 djm Exp $
# Placed in the Public Domain.
tid="dhgex"
LOG=${TEST_SSH_LOGFILE}
rm -f ${LOG}
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
kexs=`${SSH} -Q kex | grep diffie-hellman-group-exchange`
ssh_test_dhgex()
{
bits="$1"; shift
cipher="$1"; shift
kex="$1"; shift
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "KexAlgorithms=$kex" >> $OBJ/sshd_proxy
echo "Ciphers=$cipher" >> $OBJ/sshd_proxy
rm -f ${LOG}
opts="-oKexAlgorithms=$kex -oCiphers=$cipher"
groupsz="1024<$bits<8192"
verbose "$tid bits $bits $kex $cipher"
${SSH} ${opts} $@ -vvv -F ${OBJ}/ssh_proxy somehost true
if [ $? -ne 0 ]; then
fail "ssh failed ($@)"
fi
# check what we request
grep "SSH2_MSG_KEX_DH_GEX_REQUEST($groupsz) sent" ${LOG} >/dev/null
if [ $? != 0 ]; then
got=`egrep "SSH2_MSG_KEX_DH_GEX_REQUEST(.*) sent" ${LOG}`
fail "$tid unexpected GEX sizes, expected $groupsz, got $got"
fi
# check what we got (depends on contents of system moduli file)
gotbits="`awk '/bits set:/{print $4}' ${LOG} | head -1 | cut -f2 -d/`"
if [ "$gotbits" -lt "$bits" ]; then
fatal "$tid expected $bits bit group, got $gotbits"
fi
}
check()
{
bits="$1"; shift
for c in $@; do
for k in $kexs; do
ssh_test_dhgex $bits $c $k
done
done
}
#check 2048 3des-cbc
check 3072 `${SSH} -Q cipher | grep 128`
check 3072 arcfour blowfish-cbc
check 7680 `${SSH} -Q cipher | grep 192`
check 8192 `${SSH} -Q cipher | grep 256`
check 8192 rijndael-cbc@lysator.liu.se chacha20-poly1305@openssh.com

6
regress/dynamic-forward.sh
View File

@ -1,12 +1,10 @@
# $OpenBSD: dynamic-forward.sh,v 1.9 2011/06/03 00:29:52 dtucker Exp $
# $OpenBSD: dynamic-forward.sh,v 1.11 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="dynamic forwarding"
FWDPORT=`expr $PORT + 1`
DATA=/bin/ls${EXEEXT}
if have_prog nc && nc -h 2>&1 | grep "proxy address" >/dev/null; then
proxycmd="nc -x 127.0.0.1:$FWDPORT -X"
elif have_prog connect; then
@ -19,7 +17,7 @@ trace "will use ProxyCommand $proxycmd"
start_sshd
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
n=0
error="1"
trace "start dynamic forwarding, fork to background"

4
regress/exit-status.sh
View File

@ -1,9 +1,9 @@
# $OpenBSD: exit-status.sh,v 1.6 2002/03/15 13:08:56 markus Exp $
# $OpenBSD: exit-status.sh,v 1.7 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="remote exit status"
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
for s in 0 1 4 5 44; do
trace "proto $p status $s"
verbose "test $tid: proto $p status $s"

26
regress/forcecommand.sh
View File

@ -1,30 +1,32 @@
# $OpenBSD: forcecommand.sh,v 1.1 2006/07/19 13:09:28 dtucker Exp $
# $OpenBSD: forcecommand.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="forced command"
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
echon 'command="true" ' >$OBJ/authorized_keys_$USER
cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
echon 'command="true" ' >>$OBJ/authorized_keys_$USER
cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
cp /dev/null $OBJ/authorized_keys_$USER
for t in ${SSH_KEYTYPES}; do
printf 'command="true" ' >>$OBJ/authorized_keys_$USER
cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
done
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
trace "forced command in key option proto $p"
${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
fail "forced command in key proto $p"
done
echon 'command="false" ' >$OBJ/authorized_keys_$USER
cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
echon 'command="false" ' >>$OBJ/authorized_keys_$USER
cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
cp /dev/null $OBJ/authorized_keys_$USER
for t in ${SSH_KEYTYPES}; do
printf 'command="false" ' >> $OBJ/authorized_keys_$USER
cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
done
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "ForceCommand true" >> $OBJ/sshd_proxy
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
trace "forced command in sshd_config overrides key option proto $p"
${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
fail "forced command in key proto $p"
@ -35,7 +37,7 @@ echo "ForceCommand false" >> $OBJ/sshd_proxy
echo "Match User $USER" >> $OBJ/sshd_proxy
echo " ForceCommand true" >> $OBJ/sshd_proxy
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
trace "forced command with match proto $p"
${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
fail "forced command in key proto $p"

168
regress/forward-control.sh Normal file
View File

@ -0,0 +1,168 @@
# $OpenBSD: forward-control.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="sshd control of local and remote forwarding"
LFWD_PORT=3320
RFWD_PORT=3321
CTL=$OBJ/ctl-sock
READY=$OBJ/ready
wait_for_file_to_appear() {
_path=$1
_n=0
while test ! -f $_path ; do
test $_n -eq 1 && trace "waiting for $_path to appear"
_n=`expr $_n + 1`
test $_n -ge 20 && return 1
sleep 1
done
return 0
}
wait_for_process_to_exit() {
_pid=$1
_n=0
while kill -0 $_pid 2>/dev/null ; do
test $_n -eq 1 && trace "waiting for $_pid to exit"
_n=`expr $_n + 1`
test $_n -ge 20 && return 1
sleep 1
done
return 0
}
# usage: check_lfwd protocol Y|N message
check_lfwd() {
_proto=$1
_expected=$2
_message=$3
rm -f $READY
${SSH} -oProtocol=$_proto -F $OBJ/ssh_proxy \
-L$LFWD_PORT:127.0.0.1:$PORT \
-o ExitOnForwardFailure=yes \
-n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
>/dev/null 2>&1 &
_sshpid=$!
wait_for_file_to_appear $READY || \
fatal "check_lfwd ssh fail: $_message"
${SSH} -F $OBJ/ssh_config -p $LFWD_PORT \
-oConnectionAttempts=4 host true >/dev/null 2>&1
_result=$?
kill $_sshpid `cat $READY` 2>/dev/null
wait_for_process_to_exit $_sshpid
if test "x$_expected" = "xY" -a $_result -ne 0 ; then
fail "check_lfwd failed (expecting success): $_message"
elif test "x$_expected" = "xN" -a $_result -eq 0 ; then
fail "check_lfwd succeeded (expecting failure): $_message"
elif test "x$_expected" != "xY" -a "x$_expected" != "xN" ; then
fatal "check_lfwd invalid argument \"$_expected\""
else
verbose "check_lfwd done (expecting $_expected): $_message"
fi
}
# usage: check_rfwd protocol Y|N message
check_rfwd() {
_proto=$1
_expected=$2
_message=$3
rm -f $READY
${SSH} -oProtocol=$_proto -F $OBJ/ssh_proxy \
-R$RFWD_PORT:127.0.0.1:$PORT \
-o ExitOnForwardFailure=yes \
-n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
>/dev/null 2>&1 &
_sshpid=$!
wait_for_file_to_appear $READY
_result=$?
if test $_result -eq 0 ; then
${SSH} -F $OBJ/ssh_config -p $RFWD_PORT \
-oConnectionAttempts=4 host true >/dev/null 2>&1
_result=$?
kill $_sshpid `cat $READY` 2>/dev/null
wait_for_process_to_exit $_sshpid
fi
if test "x$_expected" = "xY" -a $_result -ne 0 ; then
fail "check_rfwd failed (expecting success): $_message"
elif test "x$_expected" = "xN" -a $_result -eq 0 ; then
fail "check_rfwd succeeded (expecting failure): $_message"
elif test "x$_expected" != "xY" -a "x$_expected" != "xN" ; then
fatal "check_rfwd invalid argument \"$_expected\""
else
verbose "check_rfwd done (expecting $_expected): $_message"
fi
}
start_sshd
cp ${OBJ}/sshd_proxy ${OBJ}/sshd_proxy.bak
cp ${OBJ}/authorized_keys_${USER} ${OBJ}/authorized_keys_${USER}.bak
# Sanity check: ensure the default config allows forwarding
for p in ${SSH_PROTOCOLS} ; do
check_lfwd $p Y "proto $p, default configuration"
check_rfwd $p Y "proto $p, default configuration"
done
# Usage: all_tests yes|local|remote|no Y|N Y|N Y|N Y|N Y|N Y|N
all_tests() {
_tcpfwd=$1
_plain_lfwd=$2
_plain_rfwd=$3
_nopermit_lfwd=$4
_nopermit_rfwd=$5
_permit_lfwd=$6
_permit_rfwd=$7
_badfwd=127.0.0.1:22
_goodfwd=127.0.0.1:${PORT}
for _proto in ${SSH_PROTOCOLS} ; do
cp ${OBJ}/authorized_keys_${USER}.bak \
${OBJ}/authorized_keys_${USER}
_prefix="proto $_proto, AllowTcpForwarding=$_tcpfwd"
# No PermitOpen
( cat ${OBJ}/sshd_proxy.bak ;
echo "AllowTcpForwarding $_tcpfwd" ) \
> ${OBJ}/sshd_proxy
check_lfwd $_proto $_plain_lfwd "$_prefix"
check_rfwd $_proto $_plain_rfwd "$_prefix"
# PermitOpen via sshd_config that doesn't match
( cat ${OBJ}/sshd_proxy.bak ;
echo "AllowTcpForwarding $_tcpfwd" ;
echo "PermitOpen $_badfwd" ) \
> ${OBJ}/sshd_proxy
check_lfwd $_proto $_nopermit_lfwd "$_prefix, !PermitOpen"
check_rfwd $_proto $_nopermit_rfwd "$_prefix, !PermitOpen"
# PermitOpen via sshd_config that does match
( cat ${OBJ}/sshd_proxy.bak ;
echo "AllowTcpForwarding $_tcpfwd" ;
echo "PermitOpen $_badfwd $_goodfwd" ) \
> ${OBJ}/sshd_proxy
# NB. permitopen via authorized_keys should have same
# success/fail as via sshd_config
# permitopen via authorized_keys that doesn't match
sed "s/^/permitopen=\"$_badfwd\" /" \
< ${OBJ}/authorized_keys_${USER}.bak \
> ${OBJ}/authorized_keys_${USER} || fatal "sed 1 fail"
( cat ${OBJ}/sshd_proxy.bak ;
echo "AllowTcpForwarding $_tcpfwd" ) \
> ${OBJ}/sshd_proxy
check_lfwd $_proto $_nopermit_lfwd "$_prefix, !permitopen"
check_rfwd $_proto $_nopermit_rfwd "$_prefix, !permitopen"
# permitopen via authorized_keys that does match
sed "s/^/permitopen=\"$_badfwd\",permitopen=\"$_goodfwd\" /" \
< ${OBJ}/authorized_keys_${USER}.bak \
> ${OBJ}/authorized_keys_${USER} || fatal "sed 2 fail"
( cat ${OBJ}/sshd_proxy.bak ;
echo "AllowTcpForwarding $_tcpfwd" ) \
> ${OBJ}/sshd_proxy
check_lfwd $_proto $_permit_lfwd "$_prefix, permitopen"
check_rfwd $_proto $_permit_rfwd "$_prefix, permitopen"
done
}
# no-permitopen mismatch-permitopen match-permitopen
# AllowTcpForwarding local remote local remote local remote
all_tests yes Y Y N Y Y Y
all_tests local Y N N N Y N
all_tests remote N Y N Y N Y
all_tests no N N N N N N

56
regress/forwarding.sh
View File

@ -1,7 +1,8 @@
# $OpenBSD: forwarding.sh,v 1.7 2010/01/11 02:53:44 dtucker Exp $
# $OpenBSD: forwarding.sh,v 1.15 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="local and remote forwarding"
DATA=/bin/ls${EXEEXT}
start_sshd
@ -9,6 +10,9 @@ start_sshd
base=33
last=$PORT
fwd=""
CTL=$OBJ/ctl-sock
rm -f $CTL
for j in 0 1 2; do
for i in 0 1 2; do
a=$base$j$i
@ -19,21 +23,24 @@ for j in 0 1 2; do
last=$a
done
done
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
q=`expr 3 - $p`
if ! ssh_version $q; then
q=$p
fi
trace "start forwarding, fork to background"
${SSH} -$p -F $OBJ/ssh_config -f $fwd somehost sleep 10
trace "transfer over forwarded channels and check result"
${SSH} -$q -F $OBJ/ssh_config -p$last -o 'ConnectionAttempts=4' \
somehost cat $DATA > $OBJ/ls.copy
test -f $OBJ/ls.copy || fail "failed copy $DATA"
cmp $DATA $OBJ/ls.copy || fail "corrupted copy of $DATA"
somehost cat ${DATA} > ${COPY}
test -s ${COPY} || fail "failed copy of ${DATA}"
cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
sleep 10
done
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
for d in L R; do
trace "exit on -$d forward failure, proto $p"
@ -63,7 +70,7 @@ for d in L R; do
done
done
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
trace "simple clear forwarding proto $p"
${SSH} -$p -F $OBJ/ssh_config -oClearAllForwardings=yes somehost true
@ -75,7 +82,7 @@ for p in 1 2; do
else
# this one should fail
${SSH} -$p -F $OBJ/ssh_config -p ${base}01 true \
2>${TEST_SSH_LOGFILE} && \
>>$TEST_REGRESS_LOGFILE 2>&1 && \
fail "local forwarding not cleared"
fi
sleep 10
@ -88,7 +95,7 @@ for p in 1 2; do
else
# this one should fail
${SSH} -$p -F $OBJ/ssh_config -p ${base}01 true \
2>${TEST_SSH_LOGFILE} && \
>>$TEST_REGRESS_LOGFILE 2>&1 && \
fail "remote forwarding not cleared"
fi
sleep 10
@ -103,3 +110,34 @@ for p in 2; do
fail "stdio forwarding proto $p"
fi
done
echo "LocalForward ${base}01 127.0.0.1:$PORT" >> $OBJ/ssh_config
echo "RemoteForward ${base}02 127.0.0.1:${base}01" >> $OBJ/ssh_config
for p in ${SSH_PROTOCOLS}; do
trace "config file: start forwarding, fork to background"
${SSH} -S $CTL -M -$p -F $OBJ/ssh_config -f somehost sleep 10
trace "config file: transfer over forwarded channels and check result"
${SSH} -F $OBJ/ssh_config -p${base}02 -o 'ConnectionAttempts=4' \
somehost cat ${DATA} > ${COPY}
test -s ${COPY} || fail "failed copy of ${DATA}"
cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
${SSH} -S $CTL -O exit somehost
done
for p in 2; do
trace "transfer over chained unix domain socket forwards and check result"
rm -f $OBJ/unix-[123].fwd
${SSH} -f -F $OBJ/ssh_config -R${base}01:[$OBJ/unix-1.fwd] somehost sleep 10
${SSH} -f -F $OBJ/ssh_config -L[$OBJ/unix-1.fwd]:[$OBJ/unix-2.fwd] somehost sleep 10
${SSH} -f -F $OBJ/ssh_config -R[$OBJ/unix-2.fwd]:[$OBJ/unix-3.fwd] somehost sleep 10
${SSH} -f -F $OBJ/ssh_config -L[$OBJ/unix-3.fwd]:127.0.0.1:$PORT somehost sleep 10
${SSH} -F $OBJ/ssh_config -p${base}01 -o 'ConnectionAttempts=4' \
somehost cat ${DATA} > ${COPY}
test -s ${COPY} || fail "failed copy ${DATA}"
cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
#wait
sleep 10
done

3
regress/host-expand.sh
View File

@ -1,3 +1,4 @@
# $OpenBSD: host-expand.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="expand %h and %n"
@ -10,7 +11,7 @@ somehost
127.0.0.1
EOE
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
verbose "test $tid: proto $p"
${SSH} -F $OBJ/ssh_proxy -$p somehost true >$OBJ/actual
diff $OBJ/expect $OBJ/actual || fail "$tid proto $p"

53
regress/hostkey-agent.sh Normal file
View File

@ -0,0 +1,53 @@
# $OpenBSD: hostkey-agent.sh,v 1.6 2015/07/10 06:23:25 markus Exp $
# Placed in the Public Domain.
tid="hostkey agent"
rm -f $OBJ/agent-key.* $OBJ/ssh_proxy.orig $OBJ/known_hosts.orig
trace "start agent"
eval `${SSHAGENT} -s` > /dev/null
r=$?
[ $r -ne 0 ] && fatal "could not start ssh-agent: exit code $r"
grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig
echo "HostKeyAgent $SSH_AUTH_SOCK" >> $OBJ/sshd_proxy.orig
trace "load hostkeys"
for k in `${SSH} -Q key-plain` ; do
${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k"
(
printf 'localhost-with-alias,127.0.0.1,::1 '
cat $OBJ/agent-key.$k.pub
) >> $OBJ/known_hosts.orig
${SSHADD} $OBJ/agent-key.$k >/dev/null 2>&1 || \
fatal "couldn't load key $OBJ/agent-key.$k"
echo "Hostkey $OBJ/agent-key.${k}" >> $OBJ/sshd_proxy.orig
# Remove private key so the server can't use it.
rm $OBJ/agent-key.$k || fatal "couldn't rm $OBJ/agent-key.$k"
done
cp $OBJ/known_hosts.orig $OBJ/known_hosts
unset SSH_AUTH_SOCK
for ps in no yes; do
for k in `${SSH} -Q key-plain` ; do
verbose "key type $k privsep=$ps"
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
echo "HostKeyAlgorithms $k" >> $OBJ/sshd_proxy
opts="-oHostKeyAlgorithms=$k -F $OBJ/ssh_proxy"
cp $OBJ/known_hosts.orig $OBJ/known_hosts
SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
if [ $? -ne 0 ]; then
fail "protocol $p privsep=$ps failed"
fi
if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
fail "bad SSH_CONNECTION key type $k privsep=$ps"
fi
done
done
trace "kill agent"
${SSHAGENT} -k > /dev/null

128
regress/hostkey-rotate.sh Normal file
View File

@ -0,0 +1,128 @@
# $OpenBSD: hostkey-rotate.sh,v 1.4 2015/07/10 06:23:25 markus Exp $
# Placed in the Public Domain.
tid="hostkey rotate"
# Need full names here since they are used in HostKeyAlgorithms
HOSTKEY_TYPES="ecdsa-sha2-nistp256 ssh-ed25519 ssh-rsa ssh-dss"
rm -f $OBJ/hkr.* $OBJ/ssh_proxy.orig
grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig
echo "UpdateHostkeys=yes" >> $OBJ/ssh_proxy
rm $OBJ/known_hosts
trace "prepare hostkeys"
nkeys=0
all_algs=""
for k in `${SSH} -Q key-plain` ; do
${SSHKEYGEN} -qt $k -f $OBJ/hkr.$k -N '' || fatal "ssh-keygen $k"
echo "Hostkey $OBJ/hkr.${k}" >> $OBJ/sshd_proxy.orig
nkeys=`expr $nkeys + 1`
test "x$all_algs" = "x" || all_algs="${all_algs},"
all_algs="${all_algs}$k"
done
dossh() {
# All ssh should succeed in this test
${SSH} -F $OBJ/ssh_proxy "$@" x true || fail "ssh $@ failed"
}
expect_nkeys() {
_expected=$1
_message=$2
_n=`wc -l $OBJ/known_hosts | awk '{ print $1 }'` || fatal "wc failed"
[ "x$_n" = "x$_expected" ] || fail "$_message (got $_n wanted $_expected)"
}
check_key_present() {
_type=$1
_kfile=$2
test "x$_kfile" = "x" && _kfile="$OBJ/hkr.${_type}.pub"
_kpub=`awk "/$_type /"' { print $2 }' < $_kfile` || \
fatal "awk failed"
fgrep "$_kpub" $OBJ/known_hosts > /dev/null
}
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
# Connect to sshd with StrictHostkeyChecking=no
verbose "learn hostkey with StrictHostKeyChecking=no"
>$OBJ/known_hosts
dossh -oHostKeyAlgorithms=ssh-ed25519 -oStrictHostKeyChecking=no
# Verify no additional keys learned
expect_nkeys 1 "unstrict connect keys"
check_key_present ssh-ed25519 || fail "unstrict didn't learn key"
# Connect to sshd as usual
verbose "learn additional hostkeys"
dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs
# Check that other keys learned
expect_nkeys $nkeys "learn hostkeys"
check_key_present ssh-rsa || fail "didn't learn keys"
# Check each key type
for k in `${SSH} -Q key-plain` ; do
verbose "learn additional hostkeys, type=$k"
dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$k,$all_algs
expect_nkeys $nkeys "learn hostkeys $k"
check_key_present $k || fail "didn't learn $k"
done
# Change one hostkey (non primary) and relearn
verbose "learn changed non-primary hostkey"
mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
rm -f $OBJ/hkr.ssh-rsa
${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa -N '' || fatal "ssh-keygen $k"
dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs
# Check that the key was replaced
expect_nkeys $nkeys "learn hostkeys"
check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
check_key_present ssh-rsa || fail "didn't learn changed key"
# Add new hostkey (primary type) to sshd and connect
verbose "learn new primary hostkey"
${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa-new -N '' || fatal "ssh-keygen $k"
( cat $OBJ/sshd_proxy.orig ; echo HostKey $OBJ/hkr.ssh-rsa-new ) \
> $OBJ/sshd_proxy
# Check new hostkey added
dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs
expect_nkeys `expr $nkeys + 1` "learn hostkeys"
check_key_present ssh-rsa || fail "current key missing"
check_key_present ssh-rsa $OBJ/hkr.ssh-rsa-new.pub || fail "new key missing"
# Remove old hostkey (primary type) from sshd
verbose "rotate primary hostkey"
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
mv $OBJ/hkr.ssh-rsa-new.pub $OBJ/hkr.ssh-rsa.pub
mv $OBJ/hkr.ssh-rsa-new $OBJ/hkr.ssh-rsa
# Check old hostkey removed
dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs
expect_nkeys $nkeys "learn hostkeys"
check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
check_key_present ssh-rsa || fail "didn't learn changed key"
# Connect again, forcing rotated key
verbose "check rotate primary hostkey"
dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa
expect_nkeys 1 "learn hostkeys"
check_key_present ssh-rsa || fail "didn't learn changed key"
# $OpenBSD: hostkey-rotate.sh,v 1.4 2015/07/10 06:23:25 markus Exp $
# Placed in the Public Domain.
tid="hostkey rotate"
# Prepare hostkeys file with one key
# Connect to sshd
# Check that other keys learned
# Change one hostkey (non primary)
# Connect to sshd
# Check that the key was replaced

75
regress/integrity.sh Normal file
View File

@ -0,0 +1,75 @@
# $OpenBSD: integrity.sh,v 1.16 2015/03/24 20:22:17 markus Exp $
# Placed in the Public Domain.
tid="integrity"
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
# start at byte 2900 (i.e. after kex) and corrupt at different offsets
# XXX the test hangs if we modify the low bytes of the packet length
# XXX and ssh tries to read...
tries=10
startoffset=2900
macs=`${SSH} -Q mac`
# The following are not MACs, but ciphers with integrated integrity. They are
# handled specially below.
macs="$macs `${SSH} -Q cipher-auth`"
# avoid DH group exchange as the extra traffic makes it harder to get the
# offset into the stream right.
echo "KexAlgorithms diffie-hellman-group14-sha1,diffie-hellman-group1-sha1" \
>> $OBJ/ssh_proxy
# sshd-command for proxy (see test-exec.sh)
cmd="$SUDO sh ${SRC}/sshd-log-wrapper.sh ${TEST_SSHD_LOGFILE} ${SSHD} -i -f $OBJ/sshd_proxy"
for m in $macs; do
trace "test $tid: mac $m"
elen=0
epad=0
emac=0
ecnt=0
skip=0
for off in `jot $tries $startoffset`; do
skip=`expr $skip - 1`
if [ $skip -gt 0 ]; then
# avoid modifying the high bytes of the length
continue
fi
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
# modify output from sshd at offset $off
pxy="proxycommand=$cmd | $OBJ/modpipe -wm xor:$off:1"
if ${SSH} -Q cipher-auth | grep "^${m}\$" >/dev/null 2>&1 ; then
echo "Ciphers=$m" >> $OBJ/sshd_proxy
macopt="-c $m"
else
echo "Ciphers=aes128-ctr" >> $OBJ/sshd_proxy
echo "MACs=$m" >> $OBJ/sshd_proxy
macopt="-m $m -c aes128-ctr"
fi
verbose "test $tid: $m @$off"
${SSH} $macopt -2F $OBJ/ssh_proxy -o "$pxy" \
-oServerAliveInterval=1 -oServerAliveCountMax=30 \
999.999.999.999 'printf "%4096s" " "' >/dev/null
if [ $? -eq 0 ]; then
fail "ssh -m $m succeeds with bit-flip at $off"
fi
ecnt=`expr $ecnt + 1`
out=$(tail -2 $TEST_SSH_LOGFILE | egrep -v "^debug" | \
tr -s '\r\n' '.')
case "$out" in
Bad?packet*) elen=`expr $elen + 1`; skip=3;;
Corrupted?MAC* | *message?authentication?code?incorrect*)
emac=`expr $emac + 1`; skip=0;;
padding*) epad=`expr $epad + 1`; skip=0;;
*) fail "unexpected error mac $m at $off: $out";;
esac
done
verbose "test $tid: $ecnt errors: mac $emac padding $epad length $elen"
if [ $emac -eq 0 ]; then
fail "$m: no mac errors"
fi
expect=`expr $ecnt - $epad - $elen`
if [ $emac -ne $expect ]; then
fail "$m: expected $expect mac errors, got $emac"
fi
done

17
regress/kextype.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: kextype.sh,v 1.1 2010/09/22 12:26:05 djm Exp $
# $OpenBSD: kextype.sh,v 1.6 2015/03/24 20:19:15 markus Exp $
# Placed in the Public Domain.
tid="login with different key exchange algorithms"
@ -7,18 +7,13 @@ TIME=/usr/bin/time
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
if test "$TEST_SSH_ECC" = "yes"; then
kextypes="ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521"
fi
if test "$TEST_SSH_SHA256" = "yes"; then
kextypes="$kextypes diffie-hellman-group-exchange-sha256"
fi
kextypes="$kextypes diffie-hellman-group-exchange-sha1"
kextypes="$kextypes diffie-hellman-group14-sha1"
kextypes="$kextypes diffie-hellman-group1-sha1"
# Make server accept all key exchanges.
ALLKEX=`${SSH} -Q kex`
KEXOPT=`echo $ALLKEX | tr ' ' ,`
echo "KexAlgorithms=$KEXOPT" >> $OBJ/sshd_proxy
tries="1 2 3 4"
for k in $kextypes; do
for k in `${SSH} -Q kex`; do
verbose "kex $k"
for i in $tries; do
${SSH} -F $OBJ/ssh_proxy -o KexAlgorithms=$k x true

10
regress/key-options.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: key-options.sh,v 1.2 2008/06/30 08:07:34 djm Exp $
# $OpenBSD: key-options.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="key options"
@ -8,7 +8,7 @@ authkeys="$OBJ/authorized_keys_${USER}"
cp $authkeys $origkeys
# Test command= forced command
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do
sed "s/.*/$c &/" $origkeys >$authkeys
verbose "key option proto $p $c"
@ -24,7 +24,7 @@ done
# Test no-pty
sed 's/.*/no-pty &/' $origkeys >$authkeys
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
verbose "key option proto $p no-pty"
r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost tty`
if [ -f "$r" ]; then
@ -35,7 +35,7 @@ done
# Test environment=
echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy
sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
verbose "key option proto $p environment"
r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo $FOO'`
if [ "$r" != "bar" ]; then
@ -45,7 +45,7 @@ done
# Test from= restriction
start_sshd
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
for f in 127.0.0.1 '127.0.0.0\/8'; do
cat $origkeys >$authkeys
${SSH} -$p -q -F $OBJ/ssh_proxy somehost true

9
regress/keygen-change.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: keygen-change.sh,v 1.2 2002/07/16 09:15:55 markus Exp $
# $OpenBSD: keygen-change.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="change passphrase for key"
@ -6,7 +6,12 @@ tid="change passphrase for key"
S1="secret1"
S2="2secret"
for t in rsa dsa rsa1; do
KEYTYPES=`${SSH} -Q key-plain`
if ssh_version 1; then
KEYTYPES="${KEYTYPES} rsa1"
fi
for t in $KEYTYPES; do
# generate user key for agent
trace "generating $t key"
rm -f $OBJ/$t-key

197
regress/keygen-knownhosts.sh Normal file
View File

@ -0,0 +1,197 @@
# $OpenBSD: keygen-knownhosts.sh,v 1.3 2015/07/17 03:34:27 djm Exp $
# Placed in the Public Domain.
tid="ssh-keygen known_hosts"
rm -f $OBJ/kh.*
# Generate some keys for testing (just ed25519 for speed) and make a hosts file.
for x in host-a host-b host-c host-d host-e host-f host-a2 host-b2; do
${SSHKEYGEN} -qt ed25519 -f $OBJ/kh.$x -C "$x" -N "" || \
fatal "ssh-keygen failed"
# Add a comment that we expect should be preserved.
echo "# $x" >> $OBJ/kh.hosts
(
case "$x" in
host-a|host-b) printf "$x " ;;
host-c) printf "@cert-authority $x " ;;
host-d) printf "@revoked $x " ;;
host-e) printf "host-e* " ;;
host-f) printf "host-f,host-g,host-h " ;;
host-a2) printf "host-a " ;;
host-b2) printf "host-b " ;;
esac
cat $OBJ/kh.${x}.pub
# Blank line should be preserved.
echo "" >> $OBJ/kh.hosts
) >> $OBJ/kh.hosts
done
# Generate a variant with an invalid line. We'll use this for most tests,
# because keygen should be able to cope and it should be preserved in any
# output file.
cat $OBJ/kh.hosts >> $OBJ/kh.invalid
echo "host-i " >> $OBJ/kh.invalid
cp $OBJ/kh.invalid $OBJ/kh.invalid.orig
cp $OBJ/kh.hosts $OBJ/kh.hosts.orig
expect_key() {
_host=$1
_hosts=$2
_key=$3
_line=$4
_mark=$5
_marker=""
test "x$_mark" = "xCA" && _marker="@cert-authority "
test "x$_mark" = "xREVOKED" && _marker="@revoked "
test "x$_line" != "x" &&
echo "# Host $_host found: line $_line $_mark" >> $OBJ/kh.expect
printf "${_marker}$_hosts " >> $OBJ/kh.expect
cat $OBJ/kh.${_key}.pub >> $OBJ/kh.expect ||
fatal "${_key}.pub missing"
}
check_find() {
_host=$1
_name=$2
_keygenopt=$3
${SSHKEYGEN} $_keygenopt -f $OBJ/kh.invalid -F $_host > $OBJ/kh.result
if ! diff -w $OBJ/kh.expect $OBJ/kh.result ; then
fail "didn't find $_name"
fi
}
# Find key
rm -f $OBJ/kh.expect
expect_key host-a host-a host-a 2
expect_key host-a host-a host-a2 20
check_find host-a "simple find"
# find CA key
rm -f $OBJ/kh.expect
expect_key host-c host-c host-c 8 CA
check_find host-c "find CA key"
# find revoked key
rm -f $OBJ/kh.expect
expect_key host-d host-d host-d 11 REVOKED
check_find host-d "find revoked key"
# find key with wildcard
rm -f $OBJ/kh.expect
expect_key host-e.somedomain "host-e*" host-e 14
check_find host-e.somedomain "find wildcard key"
# find key among multiple hosts
rm -f $OBJ/kh.expect
expect_key host-h "host-f,host-g,host-h " host-f 17
check_find host-h "find multiple hosts"
check_hashed_find() {
_host=$1
_name=$2
_file=$3
test "x$_file" = "x" && _file=$OBJ/kh.invalid
${SSHKEYGEN} -f $_file -HF $_host | grep '|1|' | \
sed "s/^[^ ]*/$_host/" > $OBJ/kh.result
if ! diff -w $OBJ/kh.expect $OBJ/kh.result ; then
fail "didn't find $_name"
fi
}
# Find key and hash
rm -f $OBJ/kh.expect
expect_key host-a host-a host-a
expect_key host-a host-a host-a2
check_hashed_find host-a "find simple and hash"
# Find CA key and hash
rm -f $OBJ/kh.expect
expect_key host-c host-c host-c "" CA
# CA key output is not hashed.
check_find host-c "find simple and hash" -H
# Find revoked key and hash
rm -f $OBJ/kh.expect
expect_key host-d host-d host-d "" REVOKED
# Revoked key output is not hashed.
check_find host-d "find simple and hash" -H
# find key with wildcard and hash
rm -f $OBJ/kh.expect
expect_key host-e "host-e*" host-e ""
# Key with wildcard hostname should not be hashed.
check_find host-e "find wildcard key" -H
# find key among multiple hosts
rm -f $OBJ/kh.expect
# Comma-separated hostnames should be expanded and hashed.
expect_key host-f "host-h " host-f
expect_key host-g "host-h " host-f
expect_key host-h "host-h " host-f
check_hashed_find host-h "find multiple hosts"
# Attempt remove key on invalid file.
cp $OBJ/kh.invalid.orig $OBJ/kh.invalid
${SSHKEYGEN} -qf $OBJ/kh.invalid -R host-a 2>/dev/null
diff $OBJ/kh.invalid $OBJ/kh.invalid.orig || fail "remove on invalid succeeded"
# Remove key
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-a 2>/dev/null
grep -v "^host-a " $OBJ/kh.hosts.orig > $OBJ/kh.expect
diff $OBJ/kh.hosts $OBJ/kh.expect || fail "remove simple"
# Remove CA key
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-c 2>/dev/null
# CA key should not be removed.
diff $OBJ/kh.hosts $OBJ/kh.hosts.orig || fail "remove CA"
# Remove revoked key
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-d 2>/dev/null
# revoked key should not be removed.
diff $OBJ/kh.hosts $OBJ/kh.hosts.orig || fail "remove revoked"
# Remove wildcard
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-e.blahblah 2>/dev/null
grep -v "^host-e[*] " $OBJ/kh.hosts.orig > $OBJ/kh.expect
diff $OBJ/kh.hosts $OBJ/kh.expect || fail "remove wildcard"
# Remove multiple
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-h 2>/dev/null
grep -v "^host-f," $OBJ/kh.hosts.orig > $OBJ/kh.expect
diff $OBJ/kh.hosts $OBJ/kh.expect || fail "remove wildcard"
# Attempt hash on invalid file
cp $OBJ/kh.invalid.orig $OBJ/kh.invalid
${SSHKEYGEN} -qf $OBJ/kh.invalid -H 2>/dev/null && fail "hash invalid succeeded"
diff $OBJ/kh.invalid $OBJ/kh.invalid.orig || fail "invalid file modified"
# Hash valid file
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -H 2>/dev/null || fail "hash failed"
diff $OBJ/kh.hosts.old $OBJ/kh.hosts.orig || fail "backup differs"
grep "^host-[abfgh]" $OBJ/kh.hosts && fail "original hostnames persist"
cp $OBJ/kh.hosts $OBJ/kh.hashed.orig
# Test lookup
rm -f $OBJ/kh.expect
expect_key host-a host-a host-a
expect_key host-a host-a host-a2
check_hashed_find host-a "find simple in hashed" $OBJ/kh.hosts
# Test multiple expanded
rm -f $OBJ/kh.expect
expect_key host-h host-h host-f
check_hashed_find host-h "find simple in hashed" $OBJ/kh.hosts
# Test remove
cp $OBJ/kh.hashed.orig $OBJ/kh.hashed
${SSHKEYGEN} -qf $OBJ/kh.hashed -R host-a 2>/dev/null
${SSHKEYGEN} -qf $OBJ/kh.hashed -F host-a && fail "found key after hashed remove"

76
regress/keys-command.sh Normal file
View File

@ -0,0 +1,76 @@
# $OpenBSD: keys-command.sh,v 1.3 2015/05/21 06:40:02 djm Exp $
# Placed in the Public Domain.
tid="authorized keys from command"
if test -z "$SUDO" ; then
echo "skipped (SUDO not set)"
echo "need SUDO to create file in /var/run, test won't work without"
exit 0
fi
rm -f $OBJ/keys-command-args
touch $OBJ/keys-command-args
chmod a+rw $OBJ/keys-command-args
expected_key_text=`awk '{ print $2 }' < $OBJ/rsa.pub`
expected_key_fp=`$SSHKEYGEN -lf $OBJ/rsa.pub | awk '{ print $2 }'`
# Establish a AuthorizedKeysCommand in /var/run where it will have
# acceptable directory permissions.
KEY_COMMAND="/var/run/keycommand_${LOGNAME}"
cat << _EOF | $SUDO sh -c "rm -f '$KEY_COMMAND' ; cat > '$KEY_COMMAND'"
#!/bin/sh
echo args: "\$@" >> $OBJ/keys-command-args
echo "$PATH" | grep -q mekmitasdigoat && exit 7
test "x\$1" != "x${LOGNAME}" && exit 1
if test $# -eq 6 ; then
test "x\$2" != "xblah" && exit 2
test "x\$3" != "x${expected_key_text}" && exit 3
test "x\$4" != "xssh-rsa" && exit 4
test "x\$5" != "x${expected_key_fp}" && exit 5
test "x\$6" != "xblah" && exit 6
fi
exec cat "$OBJ/authorized_keys_${LOGNAME}"
_EOF
$SUDO chmod 0755 "$KEY_COMMAND"
if [ -x $KEY_COMMAND ]; then
cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
verbose "AuthorizedKeysCommand with arguments"
(
grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
echo AuthorizedKeysFile none
echo AuthorizedKeysCommand $KEY_COMMAND %u blah %k %t %f blah
echo AuthorizedKeysCommandUser ${LOGNAME}
) > $OBJ/sshd_proxy
# Ensure that $PATH is sanitised in sshd
env PATH=$PATH:/sbin/mekmitasdigoat \
${SSH} -F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then
fail "connect failed"
fi
verbose "AuthorizedKeysCommand without arguments"
# Check legacy behavior of no-args resulting in username being passed.
(
grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
echo AuthorizedKeysFile none
echo AuthorizedKeysCommand $KEY_COMMAND
echo AuthorizedKeysCommandUser ${LOGNAME}
) > $OBJ/sshd_proxy
# Ensure that $PATH is sanitised in sshd
env PATH=$PATH:/sbin/mekmitasdigoat \
${SSH} -F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then
fail "connect failed"
fi
else
echo "SKIPPED: $KEY_COMMAND not executable (/var/run mounted noexec?)"
fi
$SUDO rm -f $KEY_COMMAND

9
regress/keyscan.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: keyscan.sh,v 1.3 2002/03/15 13:08:56 markus Exp $
# $OpenBSD: keyscan.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="keyscan"
@ -8,7 +8,12 @@ rm -f ${OBJ}/host.dsa
start_sshd
for t in rsa1 rsa dsa; do
KEYTYPES="rsa dsa"
if ssh_version 1; then
KEYTYPES="${KEYTYPES} rsa1"
fi
for t in $KEYTYPES; do
trace "keyscan type $t"
${SSHKEYSCAN} -t $t -p $PORT 127.0.0.1 127.0.0.1 127.0.0.1 \
> /dev/null 2>&1

32
regress/keytype.sh
View File

@ -1,9 +1,9 @@
# $OpenBSD: keytype.sh,v 1.1 2010/09/02 16:12:55 markus Exp $
# $OpenBSD: keytype.sh,v 1.4 2015/07/10 06:23:25 markus Exp $
# Placed in the Public Domain.
tid="login with different key types"
TIME=`which time` 2>/dev/null
TIME=`which time 2>/dev/null`
if test ! -x "$TIME"; then
TIME=""
fi
@ -11,10 +11,16 @@ fi
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
ktypes="dsa-1024 rsa-2048 rsa-3072"
if test "$TEST_SSH_ECC" = "yes"; then
ktypes="$ktypes ecdsa-256 ecdsa-384 ecdsa-521"
fi
# Traditional and builtin key types.
ktypes="dsa-1024 rsa-2048 rsa-3072 ed25519-512"
# Types not present in all OpenSSL versions.
for i in `$SSH -Q key`; do
case "$i" in
ecdsa-sha2-nistp256) ktypes="$ktypes ecdsa-256" ;;
ecdsa-sha2-nistp384) ktypes="$ktypes ecdsa-384" ;;
ecdsa-sha2-nistp521) ktypes="$ktypes ecdsa-521" ;;
esac
done
for kt in $ktypes; do
rm -f $OBJ/key.$kt
@ -30,17 +36,29 @@ for ut in $ktypes; do
htypes=$ut
#htypes=$ktypes
for ht in $htypes; do
case $ht in
dsa-1024) t=ssh-dss;;
ecdsa-256) t=ecdsa-sha2-nistp256;;
ecdsa-384) t=ecdsa-sha2-nistp384;;
ecdsa-521) t=ecdsa-sha2-nistp521;;
ed25519-512) t=ssh-ed25519;;
rsa-*) t=ssh-rsa;;
esac
trace "ssh connect, userkey $ut, hostkey $ht"
(
grep -v HostKey $OBJ/sshd_proxy_bak
echo HostKey $OBJ/key.$ht
echo PubkeyAcceptedKeyTypes $t
echo HostKeyAlgorithms $t
) > $OBJ/sshd_proxy
(
grep -v IdentityFile $OBJ/ssh_proxy_bak
echo IdentityFile $OBJ/key.$ut
echo PubkeyAcceptedKeyTypes $t
echo HostKeyAlgorithms $t
) > $OBJ/ssh_proxy
(
echon 'localhost-with-alias,127.0.0.1,::1 '
printf 'localhost-with-alias,127.0.0.1,::1 '
cat $OBJ/key.$ht.pub
) > $OBJ/known_hosts
cat $OBJ/key.$ut.pub > $OBJ/authorized_keys_$USER

185
regress/krl.sh Normal file
View File

@ -0,0 +1,185 @@
# $OpenBSD: krl.sh,v 1.6 2015/01/30 01:11:39 djm Exp $
# Placed in the Public Domain.
tid="key revocation lists"
# If we don't support ecdsa keys then this tell will be much slower.
ECDSA=ecdsa
if test "x$TEST_SSH_ECC" != "xyes"; then
ECDSA=rsa
fi
# Do most testing with ssh-keygen; it uses the same verification code as sshd.
# Old keys will interfere with ssh-keygen.
rm -f $OBJ/revoked-* $OBJ/krl-*
# Generate a CA key
$SSHKEYGEN -t $ECDSA -f $OBJ/revoked-ca -C "" -N "" > /dev/null ||
fatal "$SSHKEYGEN CA failed"
$SSHKEYGEN -t ed25519 -f $OBJ/revoked-ca2 -C "" -N "" > /dev/null ||
fatal "$SSHKEYGEN CA2 failed"
# A specification that revokes some certificates by serial numbers
# The serial pattern is chosen to ensure the KRL includes list, range and
# bitmap sections.
cat << EOF >> $OBJ/revoked-serials
serial: 1-4
serial: 10
serial: 15
serial: 30
serial: 50
serial: 999
# The following sum to 500-799
serial: 500
serial: 501
serial: 502
serial: 503-600
serial: 700-797
serial: 798
serial: 799
serial: 599-701
# Some multiple consecutive serial number ranges
serial: 10000-20000
serial: 30000-40000
EOF
# A specification that revokes some certificated by key ID.
touch $OBJ/revoked-keyid
for n in 1 2 3 4 10 15 30 50 `jot 500 300` 999 1000 1001 1002; do
test "x$n" = "x499" && continue
# Fill in by-ID revocation spec.
echo "id: revoked $n" >> $OBJ/revoked-keyid
done
keygen() {
N=$1
f=$OBJ/revoked-`printf "%04d" $N`
# Vary the keytype. We use mostly ECDSA since this is fastest by far.
keytype=$ECDSA
case $N in
2 | 10 | 510 | 1001) keytype=rsa;;
4 | 30 | 520 | 1002) keytype=ed25519;;
esac
$SSHKEYGEN -t $keytype -f $f -C "" -N "" > /dev/null \
|| fatal "$SSHKEYGEN failed"
# Sign cert
$SSHKEYGEN -s $OBJ/revoked-ca -z $n -I "revoked $N" $f >/dev/null 2>&1 \
|| fatal "$SSHKEYGEN sign failed"
echo $f
}
# Generate some keys.
verbose "$tid: generating test keys"
REVOKED_SERIALS="1 4 10 50 500 510 520 799 999"
for n in $REVOKED_SERIALS ; do
f=`keygen $n`
RKEYS="$RKEYS ${f}.pub"
RCERTS="$RCERTS ${f}-cert.pub"
done
UNREVOKED_SERIALS="5 9 14 16 29 49 51 499 800 1010 1011"
UNREVOKED=""
for n in $UNREVOKED_SERIALS ; do
f=`keygen $n`
UKEYS="$UKEYS ${f}.pub"
UCERTS="$UCERTS ${f}-cert.pub"
done
genkrls() {
OPTS=$1
$SSHKEYGEN $OPTS -kf $OBJ/krl-empty - </dev/null \
>/dev/null || fatal "$SSHKEYGEN KRL failed"
$SSHKEYGEN $OPTS -kf $OBJ/krl-keys $RKEYS \
>/dev/null || fatal "$SSHKEYGEN KRL failed"
$SSHKEYGEN $OPTS -kf $OBJ/krl-cert $RCERTS \
>/dev/null || fatal "$SSHKEYGEN KRL failed"
$SSHKEYGEN $OPTS -kf $OBJ/krl-all $RKEYS $RCERTS \
>/dev/null || fatal "$SSHKEYGEN KRL failed"
$SSHKEYGEN $OPTS -kf $OBJ/krl-ca $OBJ/revoked-ca.pub \
>/dev/null || fatal "$SSHKEYGEN KRL failed"
# This should fail as KRLs from serial/key-id spec need the CA specified.
$SSHKEYGEN $OPTS -kf $OBJ/krl-serial $OBJ/revoked-serials \
>/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly"
$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid $OBJ/revoked-keyid \
>/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly"
# These should succeed; they specify an explicit CA key.
$SSHKEYGEN $OPTS -kf $OBJ/krl-serial -s $OBJ/revoked-ca \
$OBJ/revoked-serials >/dev/null || fatal "$SSHKEYGEN KRL failed"
$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid -s $OBJ/revoked-ca.pub \
$OBJ/revoked-keyid >/dev/null || fatal "$SSHKEYGEN KRL failed"
# These should succeed; they specify an wildcard CA key.
$SSHKEYGEN $OPTS -kf $OBJ/krl-serial-wild -s NONE $OBJ/revoked-serials \
>/dev/null || fatal "$SSHKEYGEN KRL failed"
$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid-wild -s NONE $OBJ/revoked-keyid \
>/dev/null || fatal "$SSHKEYGEN KRL failed"
# Revoke the same serials with the second CA key to ensure a multi-CA
# KRL is generated.
$SSHKEYGEN $OPTS -kf $OBJ/krl-serial -u -s $OBJ/revoked-ca2 \
$OBJ/revoked-serials >/dev/null || fatal "$SSHKEYGEN KRL failed"
}
## XXX dump with trace and grep for set cert serials
## XXX test ranges near (u64)-1, etc.
verbose "$tid: generating KRLs"
genkrls
check_krl() {
KEY=$1
KRL=$2
EXPECT_REVOKED=$3
TAG=$4
$SSHKEYGEN -Qf $KRL $KEY >/dev/null
result=$?
if test "x$EXPECT_REVOKED" = "xyes" -a $result -eq 0 ; then
fatal "key $KEY not revoked by KRL $KRL: $TAG"
elif test "x$EXPECT_REVOKED" = "xno" -a $result -ne 0 ; then
fatal "key $KEY unexpectedly revoked by KRL $KRL: $TAG"
fi
}
test_rev() {
FILES=$1
TAG=$2
KEYS_RESULT=$3
ALL_RESULT=$4
SERIAL_RESULT=$5
KEYID_RESULT=$6
CERTS_RESULT=$7
CA_RESULT=$8
SERIAL_WRESULT=$9
KEYID_WRESULT=$10
verbose "$tid: checking revocations for $TAG"
for f in $FILES ; do
check_krl $f $OBJ/krl-empty no "$TAG"
check_krl $f $OBJ/krl-keys $KEYS_RESULT "$TAG"
check_krl $f $OBJ/krl-all $ALL_RESULT "$TAG"
check_krl $f $OBJ/krl-serial $SERIAL_RESULT "$TAG"
check_krl $f $OBJ/krl-keyid $KEYID_RESULT "$TAG"
check_krl $f $OBJ/krl-cert $CERTS_RESULT "$TAG"
check_krl $f $OBJ/krl-ca $CA_RESULT "$TAG"
check_krl $f $OBJ/krl-serial-wild $SERIAL_WRESULT "$TAG"
check_krl $f $OBJ/krl-keyid-wild $KEYID_WRESULT "$TAG"
done
}
test_all() {
# wildcard
# keys all sr# k.ID cert CA sr.# k.ID
test_rev "$RKEYS" "revoked keys" yes yes no no no no no no
test_rev "$UKEYS" "unrevoked keys" no no no no no no no no
test_rev "$RCERTS" "revoked certs" yes yes yes yes yes yes yes yes
test_rev "$UCERTS" "unrevoked certs" no no no no no yes no no
}
test_all
# Check update. Results should be identical.
verbose "$tid: testing KRL update"
for f in $OBJ/krl-keys $OBJ/krl-cert $OBJ/krl-all \
$OBJ/krl-ca $OBJ/krl-serial $OBJ/krl-keyid \
$OBJ/krl-serial-wild $OBJ/krl-keyid-wild; do
cp -f $OBJ/krl-empty $f
genkrls -u
done
test_all

80
regress/limit-keytype.sh Normal file
View File

@ -0,0 +1,80 @@
# $OpenBSD: limit-keytype.sh,v 1.1 2015/01/13 07:49:49 djm Exp $
# Placed in the Public Domain.
tid="restrict pubkey type"
rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/user_key*
rm -f $OBJ/authorized_principals_$USER $OBJ/cert_user_key*
mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
mv $OBJ/ssh_proxy $OBJ/ssh_proxy.orig
# Create a CA key
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key ||\
fatal "ssh-keygen failed"
# Make some keys and a certificate.
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key1 || \
fatal "ssh-keygen failed"
${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key2 || \
fatal "ssh-keygen failed"
${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key3 || \
fatal "ssh-keygen failed"
${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
-z $$ -n ${USER},mekmitasdigoat $OBJ/user_key3 ||
fatal "couldn't sign user_key1"
# Copy the private key alongside the cert to allow better control of when
# it is offered.
mv $OBJ/user_key3-cert.pub $OBJ/cert_user_key3.pub
cp -p $OBJ/user_key3 $OBJ/cert_user_key3
grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy
opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes"
fullopts="$opts -i $OBJ/cert_user_key3 -i $OBJ/user_key1 -i $OBJ/user_key2"
echo mekmitasdigoat > $OBJ/authorized_principals_$USER
cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER
cat $OBJ/user_key2.pub >> $OBJ/authorized_keys_$USER
prepare_config() {
(
grep -v "Protocol" $OBJ/sshd_proxy.orig
echo "Protocol 2"
echo "AuthenticationMethods publickey"
echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
echo "AuthorizedPrincipalsFile $OBJ/authorized_principals_%u"
for x in "$@" ; do
echo "$x"
done
) > $OBJ/sshd_proxy
}
prepare_config
# Check we can log in with all key types.
${SSH} $opts -i $OBJ/cert_user_key3 proxy true || fatal "cert failed"
${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
# Allow plain Ed25519 and RSA. The certificate should fail.
verbose "privsep=$privsep allow rsa,ed25519"
prepare_config "PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519"
${SSH} $opts -i $OBJ/cert_user_key3 proxy true && fatal "cert succeeded"
${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
# Allow Ed25519 only.
verbose "privsep=$privsep allow ed25519"
prepare_config "PubkeyAcceptedKeyTypes ssh-ed25519"
${SSH} $opts -i $OBJ/cert_user_key3 proxy true && fatal "cert succeeded"
${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded"
# Allow all certs. Plain keys should fail.
verbose "privsep=$privsep allow cert only"
prepare_config "PubkeyAcceptedKeyTypes ssh-*-cert-v01@openssh.com"
${SSH} $opts -i $OBJ/cert_user_key3 proxy true || fatal "cert failed"
${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded"
${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded"

4
regress/localcommand.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: localcommand.sh,v 1.1 2007/10/29 06:57:13 dtucker Exp $
# $OpenBSD: localcommand.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="localcommand"
@ -6,7 +6,7 @@ tid="localcommand"
echo 'PermitLocalCommand yes' >> $OBJ/ssh_proxy
echo 'LocalCommand echo foo' >> $OBJ/ssh_proxy
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
verbose "test $tid: proto $p localcommand"
a=`${SSH} -F $OBJ/ssh_proxy -$p somehost true`
if [ "$a" != "foo" ] ; then

5
regress/login-timeout.sh
View File

@ -1,9 +1,11 @@
# $OpenBSD: login-timeout.sh,v 1.4 2005/02/27 23:13:36 djm Exp $
# $OpenBSD: login-timeout.sh,v 1.7 2014/03/13 20:44:49 djm Exp $
# Placed in the Public Domain.
tid="connect after login grace timeout"
trace "test login grace with privsep"
cp $OBJ/sshd_config $OBJ/sshd_config.orig
grep -vi LoginGraceTime $OBJ/sshd_config.orig > $OBJ/sshd_config
echo "LoginGraceTime 10s" >> $OBJ/sshd_config
echo "MaxStartups 1" >> $OBJ/sshd_config
start_sshd
@ -20,6 +22,7 @@ $SUDO kill `$SUDO cat $PIDFILE`
trace "test login grace without privsep"
echo "UsePrivilegeSeparation no" >> $OBJ/sshd_config
start_sshd
sleep 1
(echo SSH-2.0-fake; sleep 60) | telnet 127.0.0.1 ${PORT} >/dev/null 2>&1 &
sleep 15

175
regress/modpipe.c Normal file
View File

@ -0,0 +1,175 @@
/*
* Copyright (c) 2012 Damien Miller <djm@mindrot.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
/* $OpenBSD: modpipe.c,v 1.6 2013/11/21 03:16:47 djm Exp $ */
#include "includes.h"
#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <stdarg.h>
#include <stdlib.h>
#include <errno.h>
#include "openbsd-compat/getopt_long.c"
static void err(int, const char *, ...) __attribute__((format(printf, 2, 3)));
static void errx(int, const char *, ...) __attribute__((format(printf, 2, 3)));
static void
err(int r, const char *fmt, ...)
{
va_list args;
va_start(args, fmt);
fprintf(stderr, "%s: ", strerror(errno));
vfprintf(stderr, fmt, args);
fputc('\n', stderr);
va_end(args);
exit(r);
}
static void
errx(int r, const char *fmt, ...)
{
va_list args;
va_start(args, fmt);
vfprintf(stderr, fmt, args);
fputc('\n', stderr);
va_end(args);
exit(r);
}
static void
usage(void)
{
fprintf(stderr, "Usage: modpipe -w [-m modspec ...] < in > out\n");
fprintf(stderr, "modspec is one of:\n");
fprintf(stderr, " xor:offset:value - XOR \"value\" at \"offset\"\n");
fprintf(stderr, " andor:offset:val1:val2 - AND \"val1\" then OR \"val2\" at \"offset\"\n");
exit(1);
}
#define MAX_MODIFICATIONS 256
struct modification {
enum { MOD_XOR, MOD_AND_OR } what;
unsigned long long offset;
u_int8_t m1, m2;
};
static void
parse_modification(const char *s, struct modification *m)
{
char what[16+1];
int n, m1, m2;
bzero(m, sizeof(*m));
if ((n = sscanf(s, "%16[^:]%*[:]%llu%*[:]%i%*[:]%i",
what, &m->offset, &m1, &m2)) < 3)
errx(1, "Invalid modification spec \"%s\"", s);
if (strcasecmp(what, "xor") == 0) {
if (n > 3)
errx(1, "Invalid modification spec \"%s\"", s);
if (m1 < 0 || m1 > 0xff)
errx(1, "Invalid XOR modification value");
m->what = MOD_XOR;
m->m1 = m1;
} else if (strcasecmp(what, "andor") == 0) {
if (n != 4)
errx(1, "Invalid modification spec \"%s\"", s);
if (m1 < 0 || m1 > 0xff)
errx(1, "Invalid AND modification value");
if (m2 < 0 || m2 > 0xff)
errx(1, "Invalid OR modification value");
m->what = MOD_AND_OR;
m->m1 = m1;
m->m2 = m2;
} else
errx(1, "Invalid modification type \"%s\"", what);
}
int
main(int argc, char **argv)
{
int ch;
u_char buf[8192];
size_t total;
ssize_t r, s, o;
struct modification mods[MAX_MODIFICATIONS];
u_int i, wflag = 0, num_mods = 0;
while ((ch = getopt(argc, argv, "wm:")) != -1) {
switch (ch) {
case 'm':
if (num_mods >= MAX_MODIFICATIONS)
errx(1, "Too many modifications");
parse_modification(optarg, &(mods[num_mods++]));
break;
case 'w':
wflag = 1;
break;
default:
usage();
/* NOTREACHED */
}
}
for (total = 0;;) {
r = s = read(STDIN_FILENO, buf, sizeof(buf));
if (r == 0)
break;
if (r < 0) {
if (errno == EAGAIN || errno == EINTR)
continue;
err(1, "read");
}
for (i = 0; i < num_mods; i++) {
if (mods[i].offset < total ||
mods[i].offset >= total + s)
continue;
switch (mods[i].what) {
case MOD_XOR:
buf[mods[i].offset - total] ^= mods[i].m1;
break;
case MOD_AND_OR:
buf[mods[i].offset - total] &= mods[i].m1;
buf[mods[i].offset - total] |= mods[i].m2;
break;
}
}
for (o = 0; o < s; o += r) {
r = write(STDOUT_FILENO, buf, s - o);
if (r == 0)
break;
if (r < 0) {
if (errno == EAGAIN || errno == EINTR)
continue;
err(1, "write");
}
}
total += s;
}
/* Warn if modifications not reached in input stream */
r = 0;
for (i = 0; wflag && i < num_mods; i++) {
if (mods[i].offset < total)
continue;
r = 1;
fprintf(stderr, "modpipe: warning - mod %u not reached\n", i);
}
return r;
}

133
regress/multiplex.sh
View File

@ -1,27 +1,43 @@
# $OpenBSD: multiplex.sh,v 1.12 2009/05/05 07:51:36 dtucker Exp $
# $OpenBSD: multiplex.sh,v 1.27 2014/12/22 06:14:29 djm Exp $
# Placed in the Public Domain.
CTL=/tmp/openssh.regress.ctl-sock.$$
tid="connection multiplexing"
NC=$OBJ/netcat
trace "will use ProxyCommand $proxycmd"
if config_defined DISABLE_FD_PASSING ; then
echo "skipped (not supported on this platform)"
exit 0
fi
DATA=/bin/ls${EXEEXT}
COPY=$OBJ/ls.copy
LOG=$TEST_SSH_LOGFILE
P=3301 # test port
wait_for_mux_master_ready()
{
for i in 1 2 3 4 5; do
${SSH} -F $OBJ/ssh_config -S $CTL -Ocheck otherhost \
>/dev/null 2>&1 && return 0
sleep $i
done
fatal "mux master never becomes ready"
}
start_sshd
trace "start master, fork to background"
${SSH} -Nn2 -MS$CTL -F $OBJ/ssh_config -oSendEnv="_XXX_TEST" somehost &
MASTER_PID=$!
start_mux_master()
{
trace "start master, fork to background"
${SSH} -Nn2 -MS$CTL -F $OBJ/ssh_config -oSendEnv="_XXX_TEST" somehost \
-E $TEST_REGRESS_LOGFILE 2>&1 &
# NB. $SSH_PID will be killed by test-exec.sh:cleanup on fatal errors.
SSH_PID=$!
wait_for_mux_master_ready
}
# Wait for master to start and authenticate
sleep 5
start_mux_master
verbose "test $tid: envpass"
trace "env passing over multiplexed connection"
@ -48,17 +64,36 @@ cmp ${DATA} ${COPY} || fail "ssh -S ctl: corrupted copy of ${DATA}"
rm -f ${COPY}
trace "sftp transfer over multiplexed connection and check result"
echo "get ${DATA} ${COPY}" | \
${SFTP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost >$LOG 2>&1
${SFTP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost >>$TEST_REGRESS_LOGFILE 2>&1
test -f ${COPY} || fail "sftp: failed copy ${DATA}"
cmp ${DATA} ${COPY} || fail "sftp: corrupted copy of ${DATA}"
rm -f ${COPY}
trace "scp transfer over multiplexed connection and check result"
${SCP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost:${DATA} ${COPY} >$LOG 2>&1
${SCP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost:${DATA} ${COPY} >>$TEST_REGRESS_LOGFILE 2>&1
test -f ${COPY} || fail "scp: failed copy ${DATA}"
cmp ${DATA} ${COPY} || fail "scp: corrupted copy of ${DATA}"
rm -f ${COPY}
verbose "test $tid: forward"
trace "forward over TCP/IP and check result"
$NC -N -l 127.0.0.1 $((${PORT} + 1)) < ${DATA} > /dev/null &
netcat_pid=$!
${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -L127.0.0.1:$((${PORT} + 2)):127.0.0.1:$((${PORT} + 1)) otherhost >>$TEST_SSH_LOGFILE 2>&1
$NC 127.0.0.1 $((${PORT} + 2)) < /dev/null > ${COPY}
cmp ${DATA} ${COPY} || fail "ssh: corrupted copy of ${DATA}"
kill $netcat_pid 2>/dev/null
rm -f ${COPY} $OBJ/unix-[123].fwd
trace "forward over UNIX and check result"
$NC -N -Ul $OBJ/unix-1.fwd < ${DATA} > /dev/null &
netcat_pid=$!
${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -L$OBJ/unix-2.fwd:$OBJ/unix-1.fwd otherhost >>$TEST_SSH_LOGFILE 2>&1
${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -R$OBJ/unix-3.fwd:$OBJ/unix-2.fwd otherhost >>$TEST_SSH_LOGFILE 2>&1
$NC -U $OBJ/unix-3.fwd < /dev/null > ${COPY} 2>/dev/null
cmp ${DATA} ${COPY} || fail "ssh: corrupted copy of ${DATA}"
kill $netcat_pid 2>/dev/null
rm -f ${COPY} $OBJ/unix-[123].fwd
for s in 0 1 4 5 44; do
trace "exit status $s over multiplexed connection"
@ -79,13 +114,77 @@ for s in 0 1 4 5 44; do
fi
done
trace "test check command"
${SSH} -F $OBJ/ssh_config -S $CTL -Ocheck otherhost || fail "check command failed"
verbose "test $tid: cmd check"
${SSH} -F $OBJ/ssh_config -S $CTL -Ocheck otherhost >>$TEST_REGRESS_LOGFILE 2>&1 \
|| fail "check command failed"
trace "test exit command"
${SSH} -F $OBJ/ssh_config -S $CTL -Oexit otherhost || fail "send exit command failed"
verbose "test $tid: cmd forward local (TCP)"
${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -L $P:localhost:$PORT otherhost \
|| fail "request local forward failed"
${SSH} -F $OBJ/ssh_config -p$P otherhost true \
|| fail "connect to local forward port failed"
${SSH} -F $OBJ/ssh_config -S $CTL -Ocancel -L $P:localhost:$PORT otherhost \
|| fail "cancel local forward failed"
${SSH} -F $OBJ/ssh_config -p$P otherhost true \
&& fail "local forward port still listening"
verbose "test $tid: cmd forward remote (TCP)"
${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -R $P:localhost:$PORT otherhost \
|| fail "request remote forward failed"
${SSH} -F $OBJ/ssh_config -p$P otherhost true \
|| fail "connect to remote forwarded port failed"
${SSH} -F $OBJ/ssh_config -S $CTL -Ocancel -R $P:localhost:$PORT otherhost \
|| fail "cancel remote forward failed"
${SSH} -F $OBJ/ssh_config -p$P otherhost true \
&& fail "remote forward port still listening"
verbose "test $tid: cmd forward local (UNIX)"
${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -L $OBJ/unix-1.fwd:localhost:$PORT otherhost \
|| fail "request local forward failed"
echo "" | $NC -U $OBJ/unix-1.fwd | grep "Protocol mismatch" >/dev/null 2>&1 \
|| fail "connect to local forward path failed"
${SSH} -F $OBJ/ssh_config -S $CTL -Ocancel -L $OBJ/unix-1.fwd:localhost:$PORT otherhost \
|| fail "cancel local forward failed"
N=$(echo "xyzzy" | $NC -U $OBJ/unix-1.fwd 2>&1 | grep "xyzzy" | wc -l)
test ${N} -eq 0 || fail "local forward path still listening"
rm -f $OBJ/unix-1.fwd
verbose "test $tid: cmd forward remote (UNIX)"
${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -R $OBJ/unix-1.fwd:localhost:$PORT otherhost \
|| fail "request remote forward failed"
echo "" | $NC -U $OBJ/unix-1.fwd | grep "Protocol mismatch" >/dev/null 2>&1 \
|| fail "connect to remote forwarded path failed"
${SSH} -F $OBJ/ssh_config -S $CTL -Ocancel -R $OBJ/unix-1.fwd:localhost:$PORT otherhost \
|| fail "cancel remote forward failed"
N=$(echo "xyzzy" | $NC -U $OBJ/unix-1.fwd 2>&1 | grep "xyzzy" | wc -l)
test ${N} -eq 0 || fail "remote forward path still listening"
rm -f $OBJ/unix-1.fwd
verbose "test $tid: cmd exit"
${SSH} -F $OBJ/ssh_config -S $CTL -Oexit otherhost >>$TEST_REGRESS_LOGFILE 2>&1 \
|| fail "send exit command failed"
# Wait for master to exit
sleep 2
wait $SSH_PID
kill -0 $SSH_PID >/dev/null 2>&1 && fail "exit command failed"
# Restart master and test -O stop command with master using -N
verbose "test $tid: cmd stop"
trace "restart master, fork to background"
start_mux_master
# start a long-running command then immediately request a stop
${SSH} -F $OBJ/ssh_config -S $CTL otherhost "sleep 10; exit 0" \
>>$TEST_REGRESS_LOGFILE 2>&1 &
SLEEP_PID=$!
${SSH} -F $OBJ/ssh_config -S $CTL -Ostop otherhost >>$TEST_REGRESS_LOGFILE 2>&1 \
|| fail "send stop command failed"
# wait until both long-running command and master have exited.
wait $SLEEP_PID
[ $! != 0 ] || fail "waiting for concurrent command"
wait $SSH_PID
[ $! != 0 ] || fail "waiting for master stop"
kill -0 $SSH_PID >/dev/null 2>&1 && fatal "stop command failed"
SSH_PID="" # Already gone, so don't kill in cleanup
kill -0 $MASTER_PID >/dev/null 2>&1 && fail "exit command failed"

66
regress/multipubkey.sh Normal file
View File

@ -0,0 +1,66 @@
# $OpenBSD: multipubkey.sh,v 1.1 2014/12/22 08:06:03 djm Exp $
# Placed in the Public Domain.
tid="multiple pubkey"
rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/user_key*
rm -f $OBJ/authorized_principals_$USER $OBJ/cert_user_key*
mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
mv $OBJ/ssh_proxy $OBJ/ssh_proxy.orig
# Create a CA key
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key ||\
fatal "ssh-keygen failed"
# Make some keys and a certificate.
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key1 || \
fatal "ssh-keygen failed"
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key2 || \
fatal "ssh-keygen failed"
${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
-z $$ -n ${USER},mekmitasdigoat $OBJ/user_key1 ||
fail "couldn't sign user_key1"
# Copy the private key alongside the cert to allow better control of when
# it is offered.
mv $OBJ/user_key1-cert.pub $OBJ/cert_user_key1.pub
cp -p $OBJ/user_key1 $OBJ/cert_user_key1
grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy
opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes"
opts="$opts -i $OBJ/cert_user_key1 -i $OBJ/user_key1 -i $OBJ/user_key2"
for privsep in no yes; do
(
grep -v "Protocol" $OBJ/sshd_proxy.orig
echo "Protocol 2"
echo "UsePrivilegeSeparation $privsep"
echo "AuthenticationMethods publickey,publickey"
echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
echo "AuthorizedPrincipalsFile $OBJ/authorized_principals_%u"
) > $OBJ/sshd_proxy
# Single key should fail.
rm -f $OBJ/authorized_principals_$USER
cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER
${SSH} $opts proxy true && fail "ssh succeeded with key"
# Single key with same-public cert should fail.
echo mekmitasdigoat > $OBJ/authorized_principals_$USER
cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER
${SSH} $opts proxy true && fail "ssh succeeded with key+cert"
# Multiple plain keys should succeed.
rm -f $OBJ/authorized_principals_$USER
cat $OBJ/user_key1.pub $OBJ/user_key2.pub > \
$OBJ/authorized_keys_$USER
${SSH} $opts proxy true || fail "ssh failed with multiple keys"
# Cert and different key should succeed
# Key and different-public cert should succeed.
echo mekmitasdigoat > $OBJ/authorized_principals_$USER
cat $OBJ/user_key2.pub > $OBJ/authorized_keys_$USER
${SSH} $opts proxy true || fail "ssh failed with key/cert"
done

1696
regress/netcat.c Normal file
View File

File diff suppressed because it is too large Load Diff

2
regress/portnum.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: portnum.sh,v 1.1 2009/08/13 00:57:17 djm Exp $
# $OpenBSD: portnum.sh,v 1.2 2013/05/17 10:34:30 dtucker Exp $
# Placed in the Public Domain.
tid="port number parsing"

145
regress/principals-command.sh Normal file
View File

@ -0,0 +1,145 @@
# $OpenBSD: principals-command.sh,v 1.1 2015/05/21 06:44:25 djm Exp $
# Placed in the Public Domain.
tid="authorized principals command"
rm -f $OBJ/user_ca_key* $OBJ/cert_user_key*
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
if test -z "$SUDO" ; then
echo "skipped (SUDO not set)"
echo "need SUDO to create file in /var/run, test won't work without"
exit 0
fi
# Establish a AuthorizedPrincipalsCommand in /var/run where it will have
# acceptable directory permissions.
PRINCIPALS_CMD="/var/run/principals_command_${LOGNAME}"
cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_CMD'"
#!/bin/sh
test "x\$1" != "x${LOGNAME}" && exit 1
test -f "$OBJ/authorized_principals_${LOGNAME}" &&
exec cat "$OBJ/authorized_principals_${LOGNAME}"
_EOF
test $? -eq 0 || fatal "couldn't prepare principals command"
$SUDO chmod 0755 "$PRINCIPALS_CMD"
# Create a CA key and a user certificate.
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key || \
fatal "ssh-keygen of user_ca_key failed"
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/cert_user_key || \
fatal "ssh-keygen of cert_user_key failed"
${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
-z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key || \
fatal "couldn't sign cert_user_key"
if [ -x $PRINCIPALS_CMD ]; then
# Test explicitly-specified principals
for privsep in yes no ; do
_prefix="privsep $privsep"
# Setup for AuthorizedPrincipalsCommand
rm -f $OBJ/authorized_keys_$USER
(
cat $OBJ/sshd_proxy_bak
echo "UsePrivilegeSeparation $privsep"
echo "AuthorizedKeysFile none"
echo "AuthorizedPrincipalsCommand $PRINCIPALS_CMD %u"
echo "AuthorizedPrincipalsCommandUser ${LOGNAME}"
echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
) > $OBJ/sshd_proxy
# XXX test missing command
# XXX test failing command
# Empty authorized_principals
verbose "$tid: ${_prefix} empty authorized_principals"
echo > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
fi
# Wrong authorized_principals
verbose "$tid: ${_prefix} wrong authorized_principals"
echo gregorsamsa > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
fi
# Correct authorized_principals
verbose "$tid: ${_prefix} correct authorized_principals"
echo mekmitasdigoat > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
fi
# authorized_principals with bad key option
verbose "$tid: ${_prefix} authorized_principals bad key opt"
echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
fi
# authorized_principals with command=false
verbose "$tid: ${_prefix} authorized_principals command=false"
echo 'command="false" mekmitasdigoat' > \
$OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
fi
# authorized_principals with command=true
verbose "$tid: ${_prefix} authorized_principals command=true"
echo 'command="true" mekmitasdigoat' > \
$OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
fi
# Setup for principals= key option
rm -f $OBJ/authorized_principals_$USER
(
cat $OBJ/sshd_proxy_bak
echo "UsePrivilegeSeparation $privsep"
) > $OBJ/sshd_proxy
# Wrong principals list
verbose "$tid: ${_prefix} wrong principals key option"
(
printf 'cert-authority,principals="gregorsamsa" '
cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER
${SSH} -2i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
fi
# Correct principals list
verbose "$tid: ${_prefix} correct principals key option"
(
printf 'cert-authority,principals="mekmitasdigoat" '
cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER
${SSH} -2i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
fi
done
else
echo "SKIPPED: $PRINCIPALS_COMMAND not executable " \
"(/var/run mounted noexec?)"
fi

6
regress/proto-mismatch.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: proto-mismatch.sh,v 1.3 2002/03/15 13:08:56 markus Exp $
# $OpenBSD: proto-mismatch.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="protocol version mismatch"
@ -16,4 +16,6 @@ mismatch ()
}
mismatch 2 SSH-1.5-HALLO
mismatch 1 SSH-2.0-HALLO
if ssh_version 1; then
mismatch 1 SSH-2.0-HALLO
fi

12
regress/proto-version.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: proto-version.sh,v 1.3 2002/03/15 13:08:56 markus Exp $
# $OpenBSD: proto-version.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="sshd version with different protocol combinations"
@ -8,7 +8,7 @@ check_version ()
{
version=$1
expect=$2
banner=`echon | ${SSHD} -o "Protocol=${version}" -i -f ${OBJ}/sshd_proxy`
banner=`printf '' | ${SSHD} -o "Protocol=${version}" -i -f ${OBJ}/sshd_proxy`
case ${banner} in
SSH-1.99-*)
proto=199
@ -28,7 +28,9 @@ check_version ()
fi
}
check_version 2,1 199
check_version 1,2 199
check_version 2 20
check_version 1 15
if ssh_version 1; then
check_version 2,1 199
check_version 1,2 199
check_version 1 15
fi

31
regress/proxy-connect.sh
View File

@ -1,18 +1,31 @@
# $OpenBSD: proxy-connect.sh,v 1.5 2002/12/09 15:28:46 markus Exp $
# $OpenBSD: proxy-connect.sh,v 1.8 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="proxy connect"
for p in 1 2; do
${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
for ps in no yes; do
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
for p in ${SSH_PROTOCOLS}; do
for c in no yes; do
verbose "plain username protocol $p privsep=$ps comp=$c"
opts="-$p -oCompression=$c -F $OBJ/ssh_proxy"
SSH_CONNECTION=`${SSH} $opts 999.999.999.999 'echo $SSH_CONNECTION'`
if [ $? -ne 0 ]; then
fail "ssh proxyconnect protocol $p failed"
fi
SSH_CONNECTION=`${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 'echo $SSH_CONNECTION'`
if [ $? -ne 0 ]; then
fail "ssh proxyconnect protocol $p failed"
fail "ssh proxyconnect protocol $p privsep=$ps comp=$c failed"
fi
if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
fail "bad SSH_CONNECTION"
fail "bad SSH_CONNECTION protocol $p privsep=$ps comp=$c"
fi
done
done
done
for p in ${SSH_PROTOCOLS}; do
verbose "username with style protocol $p"
${SSH} -$p -F $OBJ/ssh_proxy ${USER}:style@999.999.999.999 true || \
fail "ssh proxyconnect protocol $p failed"
done

5
regress/putty-ciphers.sh
View File

@ -1,11 +1,8 @@
# $OpenBSD: putty-ciphers.sh,v 1.3 2008/11/10 02:06:35 djm Exp $
# $OpenBSD: putty-ciphers.sh,v 1.4 2013/05/17 04:29:14 dtucker Exp $
# Placed in the Public Domain.
tid="putty ciphers"
DATA=/bin/ls
COPY=${OBJ}/copy
if test "x$REGRESS_INTEROP_PUTTY" != "xyes" ; then
echo "putty interop tests not enabled"
exit 0

5
regress/putty-kex.sh
View File

@ -1,11 +1,8 @@
# $OpenBSD: putty-kex.sh,v 1.2 2008/06/30 10:31:11 djm Exp $
# $OpenBSD: putty-kex.sh,v 1.3 2013/05/17 04:29:14 dtucker Exp $
# Placed in the Public Domain.
tid="putty KEX"
DATA=/bin/ls
COPY=${OBJ}/copy
if test "x$REGRESS_INTEROP_PUTTY" != "xyes" ; then
echo "putty interop tests not enabled"
exit 0

5
regress/putty-transfer.sh
View File

@ -1,11 +1,8 @@
# $OpenBSD: putty-transfer.sh,v 1.2 2008/06/30 10:31:11 djm Exp $
# $OpenBSD: putty-transfer.sh,v 1.3 2013/05/17 04:29:14 dtucker Exp $
# Placed in the Public Domain.
tid="putty transfer data"
DATA=/bin/ls
COPY=${OBJ}/copy
if test "x$REGRESS_INTEROP_PUTTY" != "xyes" ; then
echo "putty interop tests not enabled"
exit 0

31
regress/reconfigure.sh
View File

@ -1,20 +1,30 @@
# $OpenBSD: reconfigure.sh,v 1.2 2003/06/21 09:14:05 markus Exp $
# $OpenBSD: reconfigure.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="simple connect after reconfigure"
# we need the full path to sshd for -HUP
case $SSHD in
/*)
# full path is OK
;;
*)
# otherwise make fully qualified
SSHD=$OBJ/$SSHD
esac
if test "x$USE_VALGRIND" = "x" ; then
case $SSHD in
/*)
# full path is OK
;;
*)
# otherwise make fully qualified
SSHD=$OBJ/$SSHD
esac
fi
start_sshd
trace "connect before restart"
for p in ${SSH_PROTOCOLS} ; do
${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true
if [ $? -ne 0 ]; then
fail "ssh connect with protocol $p failed before reconfigure"
fi
done
PID=`$SUDO cat $PIDFILE`
rm -f $PIDFILE
$SUDO kill -HUP $PID
@ -28,7 +38,8 @@ done
test -f $PIDFILE || fatal "sshd did not restart"
for p in 1 2; do
trace "connect after restart"
for p in ${SSH_PROTOCOLS} ; do
${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true
if [ $? -ne 0 ]; then
fail "ssh connect with protocol $p failed after reconfigure"

15
regress/reexec.sh
View File

@ -1,12 +1,10 @@
# $OpenBSD: reexec.sh,v 1.5 2004/10/08 02:01:50 djm Exp $
# $OpenBSD: reexec.sh,v 1.8 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="reexec tests"
DATA=/bin/ls${EXEEXT}
COPY=${OBJ}/copy
SSHD_ORIG=$SSHD${EXEEXT}
SSHD_COPY=$OBJ/sshd${EXEEXT}
SSHD_ORIG=$SSHD
SSHD_COPY=$OBJ/sshd
# Start a sshd and then delete it
start_sshd_copy ()
@ -21,7 +19,7 @@ start_sshd_copy ()
copy_tests ()
{
rm -f ${COPY}
for p in 1 2; do
for p in ${SSH_PROTOCOLS} ; do
verbose "$tid: proto $p"
${SSH} -nqo "Protocol=$p" -F $OBJ/ssh_config somehost \
cat ${DATA} > ${COPY}
@ -46,6 +44,9 @@ rm -f $PIDFILE
cp $OBJ/sshd_config.orig $OBJ/sshd_config
# cygwin can't fork a deleted binary
if [ "$os" != "cygwin" ]; then
verbose "test reexec fallback"
start_sshd_copy
@ -69,4 +70,4 @@ copy_tests
$SUDO kill `$SUDO cat $PIDFILE`
rm -f $PIDFILE
fi

170
regress/rekey.sh
View File

@ -1,27 +1,81 @@
# $OpenBSD: rekey.sh,v 1.1 2003/03/28 13:58:28 markus Exp $
# $OpenBSD: rekey.sh,v 1.16 2015/02/14 12:43:16 markus Exp $
# Placed in the Public Domain.
tid="rekey during transfer data"
tid="rekey"
DATA=${OBJ}/data
COPY=${OBJ}/copy
LOG=${OBJ}/log
LOG=${TEST_SSH_LOGFILE}
rm -f ${COPY} ${LOG} ${DATA}
touch ${DATA}
dd if=/bin/ls${EXEEXT} of=${DATA} bs=1k seek=511 count=1 > /dev/null 2>&1
rm -f ${LOG}
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
# Test rekeying based on data volume only.
# Arguments will be passed to ssh.
ssh_data_rekeying()
{
_kexopt=$1 ; shift
_opts="$@"
if ! test -z "$_kexopts" ; then
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "$_kexopt" >> $OBJ/sshd_proxy
_opts="$_opts -o$_kexopt"
fi
rm -f ${COPY} ${LOG}
_opts="$_opts -oCompression=no"
${SSH} <${DATA} $_opts -v -F $OBJ/ssh_proxy somehost "cat > ${COPY}"
if [ $? -ne 0 ]; then
fail "ssh failed ($@)"
fi
cmp ${DATA} ${COPY} || fail "corrupted copy ($@)"
n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
n=`expr $n - 1`
trace "$n rekeying(s)"
if [ $n -lt 1 ]; then
fail "no rekeying occured ($@)"
fi
}
increase_datafile_size 300
opts=""
for i in `${SSH} -Q kex`; do
opts="$opts KexAlgorithms=$i"
done
for i in `${SSH} -Q cipher`; do
opts="$opts Ciphers=$i"
done
for i in `${SSH} -Q mac`; do
opts="$opts MACs=$i"
done
for opt in $opts; do
verbose "client rekey $opt"
ssh_data_rekeying "$opt" -oRekeyLimit=256k
done
# AEAD ciphers are magical so test with all KexAlgorithms
if ${SSH} -Q cipher-auth | grep '^.*$' >/dev/null 2>&1 ; then
for c in `${SSH} -Q cipher-auth`; do
for kex in `${SSH} -Q kex`; do
verbose "client rekey $c $kex"
ssh_data_rekeying "KexAlgorithms=$kex" -oRekeyLimit=256k -oCiphers=$c
done
done
fi
for s in 16 1k 128k 256k; do
trace "rekeylimit ${s}"
rm -f ${COPY}
cat $DATA | \
${SSH} -oCompression=no -oRekeyLimit=$s \
-v -F $OBJ/ssh_proxy somehost "cat > ${COPY}" \
2> ${LOG}
verbose "client rekeylimit ${s}"
ssh_data_rekeying "" -oCompression=no -oRekeyLimit=$s
done
for s in 5 10; do
verbose "client rekeylimit default ${s}"
rm -f ${COPY} ${LOG}
${SSH} < ${DATA} -oCompression=no -oRekeyLimit="default $s" -F \
$OBJ/ssh_proxy somehost "cat >${COPY};sleep $s;sleep 3"
if [ $? -ne 0 ]; then
fail "ssh failed"
fi
cmp $DATA ${COPY} || fail "corrupted copy"
cmp ${DATA} ${COPY} || fail "corrupted copy"
n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
n=`expr $n - 1`
trace "$n rekeying(s)"
@ -29,4 +83,88 @@ for s in 16 1k 128k 256k; do
fail "no rekeying occured"
fi
done
rm -f ${COPY} ${LOG} ${DATA}
for s in 5 10; do
verbose "client rekeylimit default ${s} no data"
rm -f ${COPY} ${LOG}
${SSH} -oCompression=no -oRekeyLimit="default $s" -F \
$OBJ/ssh_proxy somehost "sleep $s;sleep 3"
if [ $? -ne 0 ]; then
fail "ssh failed"
fi
n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
n=`expr $n - 1`
trace "$n rekeying(s)"
if [ $n -lt 1 ]; then
fail "no rekeying occured"
fi
done
for s in 16 1k 128k 256k; do
verbose "server rekeylimit ${s}"
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "rekeylimit ${s}" >>$OBJ/sshd_proxy
rm -f ${COPY} ${LOG}
${SSH} -oCompression=no -F $OBJ/ssh_proxy somehost "cat ${DATA}" \
> ${COPY}
if [ $? -ne 0 ]; then
fail "ssh failed"
fi
cmp ${DATA} ${COPY} || fail "corrupted copy"
n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
n=`expr $n - 1`
trace "$n rekeying(s)"
if [ $n -lt 1 ]; then
fail "no rekeying occured"
fi
done
for s in 5 10; do
verbose "server rekeylimit default ${s} no data"
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "rekeylimit default ${s}" >>$OBJ/sshd_proxy
rm -f ${COPY} ${LOG}
${SSH} -oCompression=no -F $OBJ/ssh_proxy somehost "sleep $s;sleep 3"
if [ $? -ne 0 ]; then
fail "ssh failed"
fi
n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
n=`expr $n - 1`
trace "$n rekeying(s)"
if [ $n -lt 1 ]; then
fail "no rekeying occured"
fi
done
verbose "rekeylimit parsing"
for size in 16 1k 1K 1m 1M 1g 1G; do
for time in 1 1m 1M 1h 1H 1d 1D 1w 1W; do
case $size in
16) bytes=16 ;;
1k|1K) bytes=1024 ;;
1m|1M) bytes=1048576 ;;
1g|1G) bytes=1073741824 ;;
esac
case $time in
1) seconds=1 ;;
1m|1M) seconds=60 ;;
1h|1H) seconds=3600 ;;
1d|1D) seconds=86400 ;;
1w|1W) seconds=604800 ;;
esac
b=`$SUDO ${SSHD} -T -o "rekeylimit $size $time" -f $OBJ/sshd_proxy | \
awk '/rekeylimit/{print $2}'`
s=`$SUDO ${SSHD} -T -o "rekeylimit $size $time" -f $OBJ/sshd_proxy | \
awk '/rekeylimit/{print $3}'`
if [ "$bytes" != "$b" ]; then
fatal "rekeylimit size: expected $bytes bytes got $b"
fi
if [ "$seconds" != "$s" ]; then
fatal "rekeylimit time: expected $time seconds got $s"
fi
done
done
rm -f ${COPY} ${DATA}

13
regress/runtests.sh
View File

@ -1,13 +0,0 @@
#!/bin/sh
TEST_SSH_SSH=../ssh
TEST_SSH_SSHD=../sshd
TEST_SSH_SSHAGENT=../ssh-agent
TEST_SSH_SSHADD=../ssh-add
TEST_SSH_SSHKEYGEN=../ssh-keygen
TEST_SSH_SSHKEYSCAN=../ssh-keyscan
TEST_SSH_SFTP=../sftp
TEST_SSH_SFTPSERVER=../sftp-server
pmake

8
regress/scp-ssh-wrapper.sh
View File

@ -1,5 +1,5 @@
#!/bin/sh
# $OpenBSD: scp-ssh-wrapper.sh,v 1.2 2005/12/14 04:36:39 dtucker Exp $
# $OpenBSD: scp-ssh-wrapper.sh,v 1.3 2014/01/26 10:49:17 djm Exp $
# Placed in the Public Domain.
printname () {
@ -17,7 +17,7 @@ printname () {
}
# Discard all but last argument. We use arg later.
while test "$1" != ""; do
while test "x$1" != "x"; do
arg="$1"
shift
done
@ -52,6 +52,8 @@ badserver_4)
echo "X"
;;
*)
exec $arg
set -- $arg
shift
exec $SCP "$@"
;;
esac

5
regress/scp.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: scp.sh,v 1.7 2006/01/31 10:36:33 djm Exp $
# $OpenBSD: scp.sh,v 1.10 2014/01/26 10:49:17 djm Exp $
# Placed in the Public Domain.
tid="scp"
@ -12,8 +12,6 @@ else
DIFFOPT="-r"
fi
DATA=/bin/ls${EXEEXT}
COPY=${OBJ}/copy
COPY2=${OBJ}/copy2
DIR=${COPY}.dd
DIR2=${COPY}.dd2
@ -22,6 +20,7 @@ SRC=`dirname ${SCRIPT}`
cp ${SRC}/scp-ssh-wrapper.sh ${OBJ}/scp-ssh-wrapper.scp
chmod 755 ${OBJ}/scp-ssh-wrapper.scp
scpopts="-q -S ${OBJ}/scp-ssh-wrapper.scp"
export SCP # used in scp-ssh-wrapper.scp
scpclean() {
rm -rf ${COPY} ${COPY2} ${DIR} ${DIR2}

57
regress/setuid-allowed.c Normal file
View File

@ -0,0 +1,57 @@
/*
* Copyright (c) 2013 Damien Miller <djm@mindrot.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
/* $OpenBSD$ */
#include "includes.h"
#include <sys/types.h>
#ifdef HAVE_SYS_STATVFS_H
# include <sys/statvfs.h>
#endif
#include <stdio.h>
#include <string.h>
#include <errno.h>
void
usage(void)
{
fprintf(stderr, "check-setuid [path]\n");
exit(1);
}
int
main(int argc, char **argv)
{
const char *path = ".";
struct statvfs sb;
if (argc > 2)
usage();
else if (argc == 2)
path = argv[1];
if (statvfs(path, &sb) != 0) {
/* Don't return an error if the host doesn't support statvfs */
if (errno == ENOSYS)
return 0;
fprintf(stderr, "statvfs for \"%s\" failed: %s\n",
path, strerror(errno));
}
return (sb.f_flag & ST_NOSUID) ? 1 : 0;
}

4
regress/sftp-badcmds.sh
View File

@ -1,12 +1,10 @@
# $OpenBSD: sftp-badcmds.sh,v 1.4 2009/08/13 01:11:55 djm Exp $
# $OpenBSD: sftp-badcmds.sh,v 1.6 2013/05/17 10:26:26 dtucker Exp $
# Placed in the Public Domain.
tid="sftp invalid commands"
DATA=/bin/ls${EXEEXT}
DATA2=/bin/sh${EXEEXT}
NONEXIST=/NONEXIST.$$
COPY=${OBJ}/copy
GLOBFILES=`(cd /bin;echo l*)`
rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd

4
regress/sftp-batch.sh
View File

@ -1,10 +1,8 @@
# $OpenBSD: sftp-batch.sh,v 1.4 2009/08/13 01:11:55 djm Exp $
# $OpenBSD: sftp-batch.sh,v 1.5 2013/05/17 04:29:14 dtucker Exp $
# Placed in the Public Domain.
tid="sftp batchfile"
DATA=/bin/ls${EXEEXT}
COPY=${OBJ}/copy
BATCH=${OBJ}/sftp.bb
rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${BATCH}.*

26
regress/sftp-chroot.sh Normal file
View File

@ -0,0 +1,26 @@
# $OpenBSD: sftp-chroot.sh,v 1.4 2014/01/20 00:00:30 dtucker Exp $
# Placed in the Public Domain.
tid="sftp in chroot"
CHROOT=/var/run
FILENAME=testdata_${USER}
PRIVDATA=${CHROOT}/${FILENAME}
if [ -z "$SUDO" ]; then
echo "skipped: need SUDO to create file in /var/run, test won't work without"
exit 0
fi
$SUDO sh -c "echo mekmitastdigoat > $PRIVDATA" || \
fatal "create $PRIVDATA failed"
start_sshd -oChrootDirectory=$CHROOT -oForceCommand="internal-sftp -d /"
verbose "test $tid: get"
${SFTP} -S "$SSH" -F $OBJ/ssh_config host:/${FILENAME} $COPY \
>>$TEST_REGRESS_LOGFILE 2>&1 || \
fatal "Fetch ${FILENAME} failed"
cmp $PRIVDATA $COPY || fail "$PRIVDATA $COPY differ"
$SUDO rm $PRIVDATA

30
regress/sftp-cmds.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: sftp-cmds.sh,v 1.11 2010/12/04 00:21:19 djm Exp $
# $OpenBSD: sftp-cmds.sh,v 1.14 2013/06/21 02:26:26 djm Exp $
# Placed in the Public Domain.
# XXX - TODO:
@ -7,8 +7,6 @@
tid="sftp commands"
DATA=/bin/ls${EXEEXT}
COPY=${OBJ}/copy
# test that these files are readable!
for i in `(cd /bin;echo l*)`
do
@ -17,20 +15,6 @@ do
fi
done
if have_prog uname
then
case `uname` in
CYGWIN*)
os=cygwin
;;
*)
os=`uname`
;;
esac
else
os="unknown"
fi
# Path with embedded quote
QUOTECOPY=${COPY}".\"blah\""
QUOTECOPY_ARG=${COPY}'.\"blah\"'
@ -40,7 +24,7 @@ SPACECOPY_ARG="${COPY}\ this\ has\ spaces.txt"
# File with glob metacharacters
GLOBMETACOPY="${COPY} [metachar].txt"
rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 ${BATCH}.*
rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2
mkdir ${COPY}.dd
verbose "$tid: lls"
@ -122,7 +106,7 @@ rm -f ${COPY}.dd/*
verbose "$tid: get to directory"
echo "get $DATA ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
|| fail "get failed"
cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after get"
cmp $DATA ${COPY}.dd/$DATANAME || fail "corrupted copy after get"
rm -f ${COPY}.dd/*
verbose "$tid: glob get to directory"
@ -136,7 +120,7 @@ rm -f ${COPY}.dd/*
verbose "$tid: get to local dir"
(echo "lcd ${COPY}.dd"; echo "get $DATA" ) | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
|| fail "get failed"
cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after get"
cmp $DATA ${COPY}.dd/$DATANAME || fail "corrupted copy after get"
rm -f ${COPY}.dd/*
verbose "$tid: glob get to local dir"
@ -170,7 +154,7 @@ rm -f ${COPY}.dd/*
verbose "$tid: put to directory"
echo "put $DATA ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
|| fail "put failed"
cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after put"
cmp $DATA ${COPY}.dd/$DATANAME || fail "corrupted copy after put"
rm -f ${COPY}.dd/*
verbose "$tid: glob put to directory"
@ -184,7 +168,7 @@ rm -f ${COPY}.dd/*
verbose "$tid: put to local dir"
(echo "cd ${COPY}.dd"; echo "put $DATA") | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
|| fail "put failed"
cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after put"
cmp $DATA ${COPY}.dd/$DATANAME || fail "corrupted copy after put"
rm -f ${COPY}.dd/*
verbose "$tid: glob put to local dir"
@ -242,7 +226,7 @@ verbose "$tid: lchdir"
echo "lchdir ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
|| fail "lchdir failed"
rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 ${BATCH}.*
rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2
rm -rf ${QUOTECOPY} "$SPACECOPY" "$GLOBMETACOPY"

269
regress/sftp-perm.sh Normal file
View File

@ -0,0 +1,269 @@
# $OpenBSD: sftp-perm.sh,v 1.2 2013/10/17 22:00:18 djm Exp $
# Placed in the Public Domain.
tid="sftp permissions"
SERVER_LOG=${OBJ}/sftp-server.log
CLIENT_LOG=${OBJ}/sftp.log
TEST_SFTP_SERVER=${OBJ}/sftp-server.sh
prepare_server() {
printf "#!/bin/sh\nexec $SFTPSERVER -el debug3 $* 2>$SERVER_LOG\n" \
> $TEST_SFTP_SERVER
chmod a+x $TEST_SFTP_SERVER
}
run_client() {
echo "$@" | ${SFTP} -D ${TEST_SFTP_SERVER} -vvvb - >$CLIENT_LOG 2>&1
}
prepare_files() {
_prep="$1"
rm -f ${COPY} ${COPY}.1
test -d ${COPY}.dd && { rmdir ${COPY}.dd || fatal "rmdir ${COPY}.dd"; }
test -z "$_prep" && return
sh -c "$_prep" || fail "preparation failed: \"$_prep\""
}
postcondition() {
_title="$1"
_check="$2"
test -z "$_check" && return
${TEST_SHELL} -c "$_check" || fail "postcondition check failed: $_title"
}
ro_test() {
_desc=$1
_cmd="$2"
_prep="$3"
_expect_success_post="$4"
_expect_fail_post="$5"
verbose "$tid: read-only $_desc"
# Plain (no options, mostly to test that _cmd is good)
prepare_files "$_prep"
prepare_server
run_client "$_cmd" || fail "plain $_desc failed"
postcondition "$_desc no-readonly" "$_expect_success_post"
# Read-only enabled
prepare_files "$_prep"
prepare_server -R
run_client "$_cmd" && fail "read-only $_desc succeeded"
postcondition "$_desc readonly" "$_expect_fail_post"
}
perm_test() {
_op=$1
_whitelist_ops=$2
_cmd="$3"
_prep="$4"
_expect_success_post="$5"
_expect_fail_post="$6"
verbose "$tid: explicit $_op"
# Plain (no options, mostly to test that _cmd is good)
prepare_files "$_prep"
prepare_server
run_client "$_cmd" || fail "plain $_op failed"
postcondition "$_op no white/blacklists" "$_expect_success_post"
# Whitelist
prepare_files "$_prep"
prepare_server -p $_op,$_whitelist_ops
run_client "$_cmd" || fail "whitelisted $_op failed"
postcondition "$_op whitelisted" "$_expect_success_post"
# Blacklist
prepare_files "$_prep"
prepare_server -P $_op
run_client "$_cmd" && fail "blacklisted $_op succeeded"
postcondition "$_op blacklisted" "$_expect_fail_post"
# Whitelist with op missing.
prepare_files "$_prep"
prepare_server -p $_whitelist_ops
run_client "$_cmd" && fail "no whitelist $_op succeeded"
postcondition "$_op not in whitelist" "$_expect_fail_post"
}
ro_test \
"upload" \
"put $DATA $COPY" \
"" \
"cmp $DATA $COPY" \
"test ! -f $COPY"
ro_test \
"setstat" \
"chmod 0700 $COPY" \
"touch $COPY; chmod 0400 $COPY" \
"test -x $COPY" \
"test ! -x $COPY"
ro_test \
"rm" \
"rm $COPY" \
"touch $COPY" \
"test ! -f $COPY" \
"test -f $COPY"
ro_test \
"mkdir" \
"mkdir ${COPY}.dd" \
"" \
"test -d ${COPY}.dd" \
"test ! -d ${COPY}.dd"
ro_test \
"rmdir" \
"rmdir ${COPY}.dd" \
"mkdir ${COPY}.dd" \
"test ! -d ${COPY}.dd" \
"test -d ${COPY}.dd"
ro_test \
"posix-rename" \
"rename $COPY ${COPY}.1" \
"touch $COPY" \
"test -f ${COPY}.1 -a ! -f $COPY" \
"test -f $COPY -a ! -f ${COPY}.1"
ro_test \
"oldrename" \
"rename -l $COPY ${COPY}.1" \
"touch $COPY" \
"test -f ${COPY}.1 -a ! -f $COPY" \
"test -f $COPY -a ! -f ${COPY}.1"
ro_test \
"symlink" \
"ln -s $COPY ${COPY}.1" \
"touch $COPY" \
"test -h ${COPY}.1" \
"test ! -h ${COPY}.1"
ro_test \
"hardlink" \
"ln $COPY ${COPY}.1" \
"touch $COPY" \
"test -f ${COPY}.1" \
"test ! -f ${COPY}.1"
# Test explicit permissions
perm_test \
"open" \
"realpath,stat,lstat,read,close" \
"get $DATA $COPY" \
"" \
"cmp $DATA $COPY" \
"! cmp $DATA $COPY 2>/dev/null"
perm_test \
"read" \
"realpath,stat,lstat,open,close" \
"get $DATA $COPY" \
"" \
"cmp $DATA $COPY" \
"! cmp $DATA $COPY 2>/dev/null"
perm_test \
"write" \
"realpath,stat,lstat,open,close" \
"put $DATA $COPY" \
"" \
"cmp $DATA $COPY" \
"! cmp $DATA $COPY 2>/dev/null"
perm_test \
"lstat" \
"realpath,stat,open,read,close" \
"get $DATA $COPY" \
"" \
"cmp $DATA $COPY" \
"! cmp $DATA $COPY 2>/dev/null"
perm_test \
"opendir" \
"realpath,readdir,stat,lstat" \
"ls -ln $OBJ"
perm_test \
"readdir" \
"realpath,opendir,stat,lstat" \
"ls -ln $OBJ"
perm_test \
"setstat" \
"realpath,stat,lstat" \
"chmod 0700 $COPY" \
"touch $COPY; chmod 0400 $COPY" \
"test -x $COPY" \
"test ! -x $COPY"
perm_test \
"remove" \
"realpath,stat,lstat" \
"rm $COPY" \
"touch $COPY" \
"test ! -f $COPY" \
"test -f $COPY"
perm_test \
"mkdir" \
"realpath,stat,lstat" \
"mkdir ${COPY}.dd" \
"" \
"test -d ${COPY}.dd" \
"test ! -d ${COPY}.dd"
perm_test \
"rmdir" \
"realpath,stat,lstat" \
"rmdir ${COPY}.dd" \
"mkdir ${COPY}.dd" \
"test ! -d ${COPY}.dd" \
"test -d ${COPY}.dd"
perm_test \
"posix-rename" \
"realpath,stat,lstat" \
"rename $COPY ${COPY}.1" \
"touch $COPY" \
"test -f ${COPY}.1 -a ! -f $COPY" \
"test -f $COPY -a ! -f ${COPY}.1"
perm_test \
"rename" \
"realpath,stat,lstat" \
"rename -l $COPY ${COPY}.1" \
"touch $COPY" \
"test -f ${COPY}.1 -a ! -f $COPY" \
"test -f $COPY -a ! -f ${COPY}.1"
perm_test \
"symlink" \
"realpath,stat,lstat" \
"ln -s $COPY ${COPY}.1" \
"touch $COPY" \
"test -h ${COPY}.1" \
"test ! -h ${COPY}.1"
perm_test \
"hardlink" \
"realpath,stat,lstat" \
"ln $COPY ${COPY}.1" \
"touch $COPY" \
"test -f ${COPY}.1" \
"test ! -f ${COPY}.1"
perm_test \
"statvfs" \
"realpath,stat,lstat" \
"df /"
# XXX need good tests for:
# fstat
# fsetstat
# realpath
# stat
# readlink
# fstatvfs
rm -rf ${COPY} ${COPY}.1 ${COPY}.dd

5
regress/sftp.sh
View File

@ -1,11 +1,8 @@
# $OpenBSD: sftp.sh,v 1.3 2009/08/13 01:11:55 djm Exp $
# $OpenBSD: sftp.sh,v 1.5 2013/05/17 10:28:11 dtucker Exp $
# Placed in the Public Domain.
tid="basic sftp put/get"
DATA=/bin/ls${EXEEXT}
COPY=${OBJ}/copy
SFTPCMDFILE=${OBJ}/batch
cat >$SFTPCMDFILE <<EOF
version

6
regress/ssh-com-client.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: ssh-com-client.sh,v 1.6 2004/02/24 17:06:52 markus Exp $
# $OpenBSD: ssh-com-client.sh,v 1.7 2013/05/17 04:29:14 dtucker Exp $
# Placed in the Public Domain.
tid="connect with ssh.com client"
@ -67,10 +67,6 @@ EOF
# we need a real server (no ProxyConnect option)
start_sshd
DATA=/bin/ls${EXEEXT}
COPY=${OBJ}/copy
rm -f ${COPY}
# go for it
for v in ${VERSIONS}; do
ssh2=${TEST_COMBASE}/${v}/ssh2

4
regress/ssh-com-sftp.sh
View File

@ -1,10 +1,8 @@
# $OpenBSD: ssh-com-sftp.sh,v 1.6 2009/08/20 18:43:07 djm Exp $
# $OpenBSD: ssh-com-sftp.sh,v 1.7 2013/05/17 04:29:14 dtucker Exp $
# Placed in the Public Domain.
tid="basic sftp put/get with ssh.com server"
DATA=/bin/ls${EXEEXT}
COPY=${OBJ}/copy
SFTPCMDFILE=${OBJ}/batch
cat >$SFTPCMDFILE <<EOF

4
regress/ssh-com.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: ssh-com.sh,v 1.7 2004/02/24 17:06:52 markus Exp $
# $OpenBSD: ssh-com.sh,v 1.9 2015/05/08 07:29:00 djm Exp $
# Placed in the Public Domain.
tid="connect to ssh.com server"
@ -70,7 +70,7 @@ done
# convert and append DSA hostkey
(
echon 'ssh2-localhost-with-alias,127.0.0.1,::1 '
printf 'ssh2-localhost-with-alias,127.0.0.1,::1 '
${SSHKEYGEN} -if ${SRC}/dsa_ssh2.pub
) >> $OBJ/known_hosts

2
regress/ssh2putty.sh
View File

@ -1,5 +1,5 @@
#!/bin/sh
# $OpenBSD: ssh2putty.sh,v 1.2 2009/10/06 23:51:49 dtucker Exp $
# $OpenBSD: ssh2putty.sh,v 1.3 2015/05/08 07:26:13 djm Exp $
if test "x$1" = "x" -o "x$2" = "x" -o "x$3" = "x" ; then
echo "Usage: ssh2putty hostname port ssh-private-key"

10
regress/sshd-log-wrapper.sh
View File

@ -1,13 +1,11 @@
#!/bin/sh
# $OpenBSD: sshd-log-wrapper.sh,v 1.2 2005/02/27 11:40:30 dtucker Exp $
# $OpenBSD: sshd-log-wrapper.sh,v 1.3 2013/04/07 02:16:03 dtucker Exp $
# Placed in the Public Domain.
#
# simple wrapper for sshd proxy mode to catch stderr output
# sh sshd-log-wrapper.sh /path/to/sshd /path/to/logfile
# sh sshd-log-wrapper.sh /path/to/logfile /path/to/sshd [args...]
sshd=$1
log=$2
shift
log=$1
shift
exec $sshd $@ -e 2>>$log
exec "$@" -E$log

20
regress/stderr-after-eof.sh
View File

@ -1,29 +1,13 @@
# $OpenBSD: stderr-after-eof.sh,v 1.1 2002/03/23 16:38:09 markus Exp $
# $OpenBSD: stderr-after-eof.sh,v 1.2 2013/05/17 04:29:14 dtucker Exp $
# Placed in the Public Domain.
tid="stderr data after eof"
DATA=/etc/motd
DATA=${OBJ}/data
COPY=${OBJ}/copy
if have_prog md5sum; then
CHECKSUM=md5sum
elif have_prog openssl; then
CHECKSUM="openssl md5"
elif have_prog cksum; then
CHECKSUM=cksum
elif have_prog sum; then
CHECKSUM=sum
else
fatal "No checksum program available, aborting $tid test"
fi
# setup data
rm -f ${DATA} ${COPY}
cp /dev/null ${DATA}
for i in 1 2 3 4 5 6; do
(date;echo $i) | $CHECKSUM >> ${DATA}
(date;echo $i) | md5 >> ${DATA}
done
${SSH} -2 -F $OBJ/ssh_proxy otherhost \

8
regress/stderr-data.sh
View File

@ -1,14 +1,10 @@
# $OpenBSD: stderr-data.sh,v 1.2 2002/03/27 22:39:52 markus Exp $
# $OpenBSD: stderr-data.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="stderr data transfer"
DATA=/bin/ls${EXEEXT}
COPY=${OBJ}/copy
rm -f ${COPY}
for n in '' -n; do
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
verbose "test $tid: proto $p ($n)"
${SSH} $n -$p -F $OBJ/ssh_proxy otherhost \
exec sh -c \'"exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \

1
regress/t11.ok Normal file
View File

@ -0,0 +1 @@
SHA256:4w1rnrek3klTJOTVhwuCIFd5k+pq9Bfo5KTxxb8BqbY

2
regress/t4.ok
View File

@ -1 +1 @@
3b:dd:44:e9:49:18:84:95:f1:e7:33:6b:9d:93:b1:36
MD5:3b:dd:44:e9:49:18:84:95:f1:e7:33:6b:9d:93:b1:36

246
regress/test-exec.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: test-exec.sh,v 1.37 2010/02/24 06:21:56 djm Exp $
# $OpenBSD: test-exec.sh,v 1.51 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
#SUDO=sudo
@ -12,6 +12,13 @@ OSF1*)
BIN_SH=xpg4
export BIN_SH
;;
CYGWIN_NT-5.0)
os=cygwin
TEST_SSH_IPV6=no
;;
CYGWIN*)
os=cygwin
;;
esac
if [ ! -z "$TEST_SSH_PORT" ]; then
@ -123,32 +130,122 @@ if [ "x$TEST_SSH_CONCH" != "x" ]; then
esac
fi
SSH_PROTOCOLS=`$SSH -Q protocol-version`
if [ "x$TEST_SSH_PROTOCOLS" != "x" ]; then
SSH_PROTOCOLS="${TEST_SSH_PROTOCOLS}"
fi
# Path to sshd must be absolute for rexec
case "$SSHD" in
/*) ;;
*) SSHD=`which sshd` ;;
*) SSHD=`which $SSHD` ;;
esac
if [ "x$TEST_SSH_LOGFILE" = "x" ]; then
TEST_SSH_LOGFILE=/dev/null
case "$SSHAGENT" in
/*) ;;
*) SSHAGENT=`which $SSHAGENT` ;;
esac
# Record the actual binaries used.
SSH_BIN=${SSH}
SSHD_BIN=${SSHD}
SSHAGENT_BIN=${SSHAGENT}
SSHADD_BIN=${SSHADD}
SSHKEYGEN_BIN=${SSHKEYGEN}
SSHKEYSCAN_BIN=${SSHKEYSCAN}
SFTP_BIN=${SFTP}
SFTPSERVER_BIN=${SFTPSERVER}
SCP_BIN=${SCP}
if [ "x$USE_VALGRIND" != "x" ]; then
mkdir -p $OBJ/valgrind-out
VG_TEST=`basename $SCRIPT .sh`
# Some tests are difficult to fix.
case "$VG_TEST" in
connect-privsep|reexec)
VG_SKIP=1 ;;
esac
if [ x"$VG_SKIP" = "x" ]; then
VG_IGNORE="/bin/*,/sbin/*,/usr/*,/var/*"
VG_LOG="$OBJ/valgrind-out/${VG_TEST}."
VG_OPTS="--track-origins=yes --leak-check=full"
VG_OPTS="$VG_OPTS --trace-children=yes"
VG_OPTS="$VG_OPTS --trace-children-skip=${VG_IGNORE}"
VG_PATH="valgrind"
if [ "x$VALGRIND_PATH" != "x" ]; then
VG_PATH="$VALGRIND_PATH"
fi
VG="$VG_PATH $VG_OPTS"
SSH="$VG --log-file=${VG_LOG}ssh.%p $SSH"
SSHD="$VG --log-file=${VG_LOG}sshd.%p $SSHD"
SSHAGENT="$VG --log-file=${VG_LOG}ssh-agent.%p $SSHAGENT"
SSHADD="$VG --log-file=${VG_LOG}ssh-add.%p $SSHADD"
SSHKEYGEN="$VG --log-file=${VG_LOG}ssh-keygen.%p $SSHKEYGEN"
SSHKEYSCAN="$VG --log-file=${VG_LOG}ssh-keyscan.%p $SSHKEYSCAN"
SFTP="$VG --log-file=${VG_LOG}sftp.%p ${SFTP}"
SCP="$VG --log-file=${VG_LOG}scp.%p $SCP"
cat > $OBJ/valgrind-sftp-server.sh << EOF
#!/bin/sh
exec $VG --log-file=${VG_LOG}sftp-server.%p $SFTPSERVER "\$@"
EOF
chmod a+rx $OBJ/valgrind-sftp-server.sh
SFTPSERVER="$OBJ/valgrind-sftp-server.sh"
fi
fi
# Logfiles.
# SSH_LOGFILE should be the debug output of ssh(1) only
# SSHD_LOGFILE should be the debug output of sshd(8) only
# REGRESS_LOGFILE is the output of the test itself stdout and stderr
if [ "x$TEST_SSH_LOGFILE" = "x" ]; then
TEST_SSH_LOGFILE=$OBJ/ssh.log
fi
if [ "x$TEST_SSHD_LOGFILE" = "x" ]; then
TEST_SSHD_LOGFILE=$OBJ/sshd.log
fi
if [ "x$TEST_REGRESS_LOGFILE" = "x" ]; then
TEST_REGRESS_LOGFILE=$OBJ/regress.log
fi
# truncate logfiles
>$TEST_SSH_LOGFILE
>$TEST_SSHD_LOGFILE
>$TEST_REGRESS_LOGFILE
# Create wrapper ssh with logging. We can't just specify "SSH=ssh -E..."
# because sftp and scp don't handle spaces in arguments.
SSHLOGWRAP=$OBJ/ssh-log-wrapper.sh
echo "#!/bin/sh" > $SSHLOGWRAP
echo "exec ${SSH} -E${TEST_SSH_LOGFILE} "'"$@"' >>$SSHLOGWRAP
chmod a+rx $OBJ/ssh-log-wrapper.sh
SSH="$SSHLOGWRAP"
# Some test data. We make a copy because some tests will overwrite it.
# The tests may assume that $DATA exists and is writable and $COPY does
# not exist. Tests requiring larger data files can call increase_datafile_size
# [kbytes] to ensure the file is at least that large.
DATANAME=data
DATA=$OBJ/${DATANAME}
cat ${SSHAGENT_BIN} >${DATA}
chmod u+w ${DATA}
COPY=$OBJ/copy
rm -f ${COPY}
increase_datafile_size()
{
while [ `du -k ${DATA} | cut -f1` -lt $1 ]; do
cat ${SSHAGENT_BIN} >>${DATA}
done
}
# these should be used in tests
export SSH SSHD SSHAGENT SSHADD SSHKEYGEN SSHKEYSCAN SFTP SFTPSERVER SCP
#echo $SSH $SSHD $SSHAGENT $SSHADD $SSHKEYGEN $SSHKEYSCAN $SFTP $SFTPSERVER $SCP
# helper
echon()
{
if [ "x`echo -n`" = "x" ]; then
echo -n "$@"
elif [ "x`echo '\c'`" = "x" ]; then
echo "$@\c"
else
fatal "Don't know how to echo without newline."
fi
}
# Portable specific functions
have_prog()
{
saved_IFS="$IFS"
@ -164,15 +261,53 @@ have_prog()
return 1
}
jot() {
awk "BEGIN { for (i = $2; i < $2 + $1; i++) { printf \"%d\n\", i } exit }"
}
# Check whether preprocessor symbols are defined in config.h.
config_defined ()
{
str=$1
while test "x$2" != "x" ; do
str="$str|$2"
shift
done
egrep "^#define.*($str)" ${BUILDDIR}/config.h >/dev/null 2>&1
}
md5 () {
if have_prog md5sum; then
md5sum
elif have_prog openssl; then
openssl md5
elif have_prog cksum; then
cksum
elif have_prog sum; then
sum
else
wc -c
fi
}
# End of portable specific functions
# helper
cleanup ()
{
if [ "x$SSH_PID" != "x" ]; then
if [ $SSH_PID -lt 2 ]; then
echo bad pid for ssh: $SSH_PID
else
kill $SSH_PID
fi
fi
if [ -f $PIDFILE ]; then
pid=`$SUDO cat $PIDFILE`
if [ "X$pid" = "X" ]; then
echo no sshd running
else
if [ $pid -lt 2 ]; then
echo bad pid for ssh: $pid
echo bad pid for sshd: $pid
else
$SUDO kill $pid
trace "wait for sshd to exit"
@ -188,9 +323,26 @@ cleanup ()
fi
}
start_debug_log ()
{
echo "trace: $@" >$TEST_REGRESS_LOGFILE
echo "trace: $@" >$TEST_SSH_LOGFILE
echo "trace: $@" >$TEST_SSHD_LOGFILE
}
save_debug_log ()
{
echo $@ >>$TEST_REGRESS_LOGFILE
echo $@ >>$TEST_SSH_LOGFILE
echo $@ >>$TEST_SSHD_LOGFILE
(cat $TEST_REGRESS_LOGFILE; echo) >>$OBJ/failed-regress.log
(cat $TEST_SSH_LOGFILE; echo) >>$OBJ/failed-ssh.log
(cat $TEST_SSHD_LOGFILE; echo) >>$OBJ/failed-sshd.log
}
trace ()
{
echo "trace: $@" >>$TEST_SSH_LOGFILE
start_debug_log $@
if [ "X$TEST_SSH_TRACE" = "Xyes" ]; then
echo "$@"
fi
@ -198,7 +350,7 @@ trace ()
verbose ()
{
echo "verbose: $@" >>$TEST_SSH_LOGFILE
start_debug_log $@
if [ "X$TEST_SSH_QUIET" != "Xyes" ]; then
echo "$@"
fi
@ -212,29 +364,24 @@ warn ()
fail ()
{
echo "FAIL: $@" >>$TEST_SSH_LOGFILE
save_debug_log "FAIL: $@"
RESULT=1
echo "$@"
}
fatal ()
{
echo "FATAL: $@" >>$TEST_SSH_LOGFILE
echon "FATAL: "
save_debug_log "FATAL: $@"
printf "FATAL: "
fail "$@"
cleanup
exit $RESULT
}
# Check whether preprocessor symbols are defined in config.h.
config_defined ()
ssh_version ()
{
str=$1
while test "x$2" != "x" ; do
str="$str|$2"
shift
done
egrep "^#define.*($str)" ${BUILDDIR}/config.h >/dev/null 2>&1
echo ${SSH_PROTOCOLS} | grep "$1" >/dev/null
}
RESULT=0
@ -242,17 +389,23 @@ PIDFILE=$OBJ/pidfile
trap fatal 3 2
if ssh_version 1; then
PROTO="2,1"
else
PROTO="2"
fi
# create server config
cat << EOF > $OBJ/sshd_config
StrictModes no
Port $PORT
Protocol 2,1
Protocol $PROTO
AddressFamily inet
ListenAddress 127.0.0.1
#ListenAddress ::1
PidFile $PIDFILE
AuthorizedKeysFile $OBJ/authorized_keys_%u
LogLevel VERBOSE
LogLevel DEBUG3
AcceptEnv _XXX_TEST_*
AcceptEnv _XXX_TEST
Subsystem sftp $SFTPSERVER
@ -272,7 +425,7 @@ echo 'StrictModes no' >> $OBJ/sshd_proxy
# create client config
cat << EOF > $OBJ/ssh_config
Host *
Protocol 2,1
Protocol $PROTO
Hostname 127.0.0.1
HostKeyAlias localhost-with-alias
Port $PORT
@ -284,27 +437,36 @@ Host *
ChallengeResponseAuthentication no
HostbasedAuthentication no
PasswordAuthentication no
RhostsRSAAuthentication no
BatchMode yes
StrictHostKeyChecking yes
LogLevel DEBUG3
EOF
if [ ! -z "$TEST_SSH_SSH_CONFOPTS" ]; then
trace "adding ssh_config option $TEST_SSH_SSHD_CONFOPTS"
trace "adding ssh_config option $TEST_SSH_SSH_CONFOPTS"
echo "$TEST_SSH_SSH_CONFOPTS" >> $OBJ/ssh_config
fi
rm -f $OBJ/known_hosts $OBJ/authorized_keys_$USER
if ssh_version 1; then
SSH_KEYTYPES="rsa rsa1"
else
SSH_KEYTYPES="rsa ed25519"
fi
trace "generate keys"
for t in rsa rsa1; do
for t in ${SSH_KEYTYPES}; do
# generate user key
rm -f $OBJ/$t
${SSHKEYGEN} -b 1024 -q -N '' -t $t -f $OBJ/$t ||\
fail "ssh-keygen for $t failed"
if [ ! -f $OBJ/$t ] || [ ${SSHKEYGEN_BIN} -nt $OBJ/$t ]; then
rm -f $OBJ/$t
${SSHKEYGEN} -q -N '' -t $t -f $OBJ/$t ||\
fail "ssh-keygen for $t failed"
fi
# known hosts file for client
(
echon 'localhost-with-alias,127.0.0.1,::1 '
printf 'localhost-with-alias,127.0.0.1,::1 '
cat $OBJ/$t.pub
) >> $OBJ/known_hosts
@ -359,7 +521,7 @@ if test "$REGRESS_INTEROP_PUTTY" = "yes" ; then
echo "Hostname=127.0.0.1" >> ${OBJ}/.putty/sessions/localhost_proxy
echo "PortNumber=$PORT" >> ${OBJ}/.putty/sessions/localhost_proxy
echo "ProxyMethod=5" >> ${OBJ}/.putty/sessions/localhost_proxy
echo "ProxyTelnetCommand=sh ${SRC}/sshd-log-wrapper.sh ${SSHD} ${TEST_SSH_LOGFILE} -i -f $OBJ/sshd_proxy" >> ${OBJ}/.putty/sessions/localhost_proxy
echo "ProxyTelnetCommand=sh ${SRC}/sshd-log-wrapper.sh ${TEST_SSHD_LOGFILE} ${SSHD} -i -f $OBJ/sshd_proxy" >> ${OBJ}/.putty/sessions/localhost_proxy
REGRESS_INTEROP_PUTTY=yes
fi
@ -367,7 +529,7 @@ fi
# create a proxy version of the client config
(
cat $OBJ/ssh_config
echo proxycommand ${SUDO} sh ${SRC}/sshd-log-wrapper.sh ${SSHD} ${TEST_SSH_LOGFILE} -i -f $OBJ/sshd_proxy
echo proxycommand ${SUDO} sh ${SRC}/sshd-log-wrapper.sh ${TEST_SSHD_LOGFILE} ${SSHD} -i -f $OBJ/sshd_proxy
) > $OBJ/ssh_proxy
# check proxy config
@ -377,7 +539,7 @@ start_sshd ()
{
# start sshd
$SUDO ${SSHD} -f $OBJ/sshd_config "$@" -t || fatal "sshd_config broken"
$SUDO ${SSHD} -f $OBJ/sshd_config -e "$@" >>$TEST_SSH_LOGFILE 2>&1
$SUDO ${SSHD} -f $OBJ/sshd_config "$@" -E$TEST_SSHD_LOGFILE
trace "wait for sshd"
i=0;

7
regress/transfer.sh
View File

@ -1,12 +1,9 @@
# $OpenBSD: transfer.sh,v 1.1 2002/03/27 00:03:37 markus Exp $
# $OpenBSD: transfer.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
# Placed in the Public Domain.
tid="transfer data"
DATA=/bin/ls${EXEEXT}
COPY=${OBJ}/copy
for p in 1 2; do
for p in ${SSH_PROTOCOLS}; do
verbose "$tid: proto $p"
rm -f ${COPY}
${SSH} -n -q -$p -F $OBJ/ssh_proxy somehost cat ${DATA} > ${COPY}

47
regress/try-ciphers.sh
View File

@ -1,28 +1,36 @@
# $OpenBSD: try-ciphers.sh,v 1.12 2011/08/02 01:23:41 djm Exp $
# $OpenBSD: try-ciphers.sh,v 1.25 2015/03/24 20:22:17 markus Exp $
# Placed in the Public Domain.
tid="try ciphers"
ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc
arcfour128 arcfour256 arcfour
aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se
aes128-ctr aes192-ctr aes256-ctr"
macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
config_defined HAVE_EVP_SHA256 &&
macs="$macs hmac-sha2-256 hmac-sha2-256-96 hmac-sha2-512 hmac-sha2-512-96"
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
for c in $ciphers; do
for m in $macs; do
for c in `${SSH} -Q cipher`; do
n=0
for m in `${SSH} -Q mac`; do
trace "proto 2 cipher $c mac $m"
verbose "test $tid: proto 2 cipher $c mac $m"
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "Ciphers=$c" >> $OBJ/sshd_proxy
echo "MACs=$m" >> $OBJ/sshd_proxy
${SSH} -F $OBJ/ssh_proxy -2 -m $m -c $c somehost true
if [ $? -ne 0 ]; then
fail "ssh -2 failed with mac $m cipher $c"
fi
# No point trying all MACs for AEAD ciphers since they
# are ignored.
if ${SSH} -Q cipher-auth | grep "^${c}\$" >/dev/null 2>&1 ; then
break
fi
n=`expr $n + 1`
done
done
ciphers="3des blowfish"
if ssh_version 1; then
ciphers="3des blowfish"
else
ciphers=""
fi
for c in $ciphers; do
trace "proto 1 cipher $c"
verbose "test $tid: proto 1 cipher $c"
@ -32,20 +40,3 @@ for c in $ciphers; do
fi
done
if ${SSH} -oCiphers=acss@openssh.org 2>&1 | grep "Bad SSH2 cipher" >/dev/null
then
:
else
echo "Ciphers acss@openssh.org" >> $OBJ/sshd_proxy
c=acss@openssh.org
for m in $macs; do
trace "proto 2 $c mac $m"
verbose "test $tid: proto 2 cipher $c mac $m"
${SSH} -F $OBJ/ssh_proxy -2 -m $m -c $c somehost true
if [ $? -ne 0 ]; then
fail "ssh -2 failed with mac $m cipher $c"
fi
done
fi

59
regress/unittests/Makefile.inc Normal file
View File

@ -0,0 +1,59 @@
# $OpenBSD: Makefile.inc,v 1.6 2015/07/01 23:11:18 djm Exp $
.include <bsd.own.mk>
.include <bsd.obj.mk>
# enable warnings
WARNINGS=Yes
DEBUG=-g
CFLAGS+= -fstack-protector-all
CDIAGFLAGS= -Wall
CDIAGFLAGS+= -Wextra
CDIAGFLAGS+= -Werror
CDIAGFLAGS+= -Wchar-subscripts
CDIAGFLAGS+= -Wcomment
CDIAGFLAGS+= -Wformat
CDIAGFLAGS+= -Wformat-security
CDIAGFLAGS+= -Wimplicit
CDIAGFLAGS+= -Winline
CDIAGFLAGS+= -Wmissing-declarations
CDIAGFLAGS+= -Wmissing-prototypes
CDIAGFLAGS+= -Wparentheses
CDIAGFLAGS+= -Wpointer-arith
CDIAGFLAGS+= -Wreturn-type
CDIAGFLAGS+= -Wshadow
CDIAGFLAGS+= -Wsign-compare
CDIAGFLAGS+= -Wstrict-aliasing
CDIAGFLAGS+= -Wstrict-prototypes
CDIAGFLAGS+= -Wswitch
CDIAGFLAGS+= -Wtrigraphs
CDIAGFLAGS+= -Wuninitialized
CDIAGFLAGS+= -Wunused
.if ${COMPILER_VERSION} == "gcc4"
CDIAGFLAGS+= -Wpointer-sign
CDIAGFLAGS+= -Wold-style-definition
.endif
SSHREL=../../../../../usr.bin/ssh
CFLAGS+=-I${.CURDIR}/../test_helper -I${.CURDIR}/${SSHREL}
.if exists(${.CURDIR}/../test_helper/${__objdir})
LDADD+=-L${.CURDIR}/../test_helper/${__objdir} -ltest_helper
DPADD+=${.CURDIR}/../test_helper/${__objdir}/libtest_helper.a
.else
LDADD+=-L${.CURDIR}/../test_helper -ltest_helper
DPADD+=${.CURDIR}/../test_helper/libtest_helper.a
.endif
.if exists(${.CURDIR}/${SSHREL}/lib/${__objdir})
LDADD+=-L${.CURDIR}/${SSHREL}/lib/${__objdir} -lssh
DPADD+=${.CURDIR}/${SSHREL}/lib/${__objdir}/libssh.a
.else
LDADD+=-L${.CURDIR}/${SSHREL}/lib -lssh
DPADD+=${.CURDIR}/${SSHREL}/lib/libssh.a
.endif
LDADD+= -lcrypto
DPADD+= ${LIBCRYPTO}

135
regress/unittests/bitmap/tests.c Normal file
View File

@ -0,0 +1,135 @@
/* $OpenBSD: tests.c,v 1.1 2015/01/15 07:36:28 djm Exp $ */
/*
* Regress test for bitmap.h bitmap API
*
* Placed in the public domain
*/
#include "includes.h"
#include <sys/types.h>
#include <sys/param.h>
#include <stdio.h>
#ifdef HAVE_STDINT_H
#include <stdint.h>
#endif
#include <stdlib.h>
#include <string.h>
#include <openssl/bn.h>
#include "../test_helper/test_helper.h"
#include "bitmap.h"
#define NTESTS 131
void
tests(void)
{
struct bitmap *b;
BIGNUM *bn;
size_t len;
int i, j, k, n;
u_char bbuf[1024], bnbuf[1024];
int r;
TEST_START("bitmap_new");
b = bitmap_new();
ASSERT_PTR_NE(b, NULL);
bn = BN_new();
ASSERT_PTR_NE(bn, NULL);
TEST_DONE();
TEST_START("bitmap_set_bit / bitmap_test_bit");
for (i = -1; i < NTESTS; i++) {
for (j = -1; j < NTESTS; j++) {
for (k = -1; k < NTESTS; k++) {
bitmap_zero(b);
BN_clear(bn);
test_subtest_info("set %d/%d/%d", i, j, k);
/* Set bits */
if (i >= 0) {
ASSERT_INT_EQ(bitmap_set_bit(b, i), 0);
ASSERT_INT_EQ(BN_set_bit(bn, i), 1);
}
if (j >= 0) {
ASSERT_INT_EQ(bitmap_set_bit(b, j), 0);
ASSERT_INT_EQ(BN_set_bit(bn, j), 1);
}
if (k >= 0) {
ASSERT_INT_EQ(bitmap_set_bit(b, k), 0);
ASSERT_INT_EQ(BN_set_bit(bn, k), 1);
}
/* Check perfect match between bitmap and bn */
test_subtest_info("match %d/%d/%d", i, j, k);
for (n = 0; n < NTESTS; n++) {
ASSERT_INT_EQ(BN_is_bit_set(bn, n),
bitmap_test_bit(b, n));
}
/* Test length calculations */
test_subtest_info("length %d/%d/%d", i, j, k);
ASSERT_INT_EQ(BN_num_bits(bn),
(int)bitmap_nbits(b));
ASSERT_INT_EQ(BN_num_bytes(bn),
(int)bitmap_nbytes(b));
/* Test serialisation */
test_subtest_info("serialise %d/%d/%d",
i, j, k);
len = bitmap_nbytes(b);
memset(bbuf, 0xfc, sizeof(bbuf));
ASSERT_INT_EQ(bitmap_to_string(b, bbuf,
sizeof(bbuf)), 0);
for (n = len; n < (int)sizeof(bbuf); n++)
ASSERT_U8_EQ(bbuf[n], 0xfc);
r = BN_bn2bin(bn, bnbuf);
ASSERT_INT_GE(r, 0);
ASSERT_INT_EQ(r, (int)len);
ASSERT_MEM_EQ(bbuf, bnbuf, len);
/* Test deserialisation */
test_subtest_info("deserialise %d/%d/%d",
i, j, k);
bitmap_zero(b);
ASSERT_INT_EQ(bitmap_from_string(b, bnbuf,
len), 0);
for (n = 0; n < NTESTS; n++) {
ASSERT_INT_EQ(BN_is_bit_set(bn, n),
bitmap_test_bit(b, n));
}
/* Test clearing bits */
test_subtest_info("clear %d/%d/%d",
i, j, k);
for (n = 0; n < NTESTS; n++) {
ASSERT_INT_EQ(bitmap_set_bit(b, n), 0);
ASSERT_INT_EQ(BN_set_bit(bn, n), 1);
}
if (i >= 0) {
bitmap_clear_bit(b, i);
BN_clear_bit(bn, i);
}
if (j >= 0) {
bitmap_clear_bit(b, j);
BN_clear_bit(bn, j);
}
if (k >= 0) {
bitmap_clear_bit(b, k);
BN_clear_bit(bn, k);
}
for (n = 0; n < NTESTS; n++) {
ASSERT_INT_EQ(BN_is_bit_set(bn, n),
bitmap_test_bit(b, n));
}
}
}
}
bitmap_free(b);
BN_free(bn);
TEST_DONE();
}

94
regress/unittests/hostkeys/mktestdata.sh Normal file
View File

@ -0,0 +1,94 @@
#!/bin/sh
# $OpenBSD: mktestdata.sh,v 1.1 2015/02/16 22:18:34 djm Exp $
set -ex
cd testdata
rm -f rsa1* rsa* dsa* ecdsa* ed25519*
rm -f known_hosts*
gen_all() {
_n=$1
_ecdsa_bits=256
test "x$_n" = "x1" && _ecdsa_bits=384
test "x$_n" = "x2" && _ecdsa_bits=521
ssh-keygen -qt rsa1 -b 1024 -C "RSA1 #$_n" -N "" -f rsa1_$_n
ssh-keygen -qt rsa -b 1024 -C "RSA #$_n" -N "" -f rsa_$_n
ssh-keygen -qt dsa -b 1024 -C "DSA #$_n" -N "" -f dsa_$_n
ssh-keygen -qt ecdsa -b $_ecdsa_bits -C "ECDSA #$_n" -N "" -f ecdsa_$_n
ssh-keygen -qt ed25519 -C "ED25519 #$_n" -N "" -f ed25519_$_n
# Don't need private keys
rm -f rsa1_$_n rsa_$_n dsa_$_n ecdsa_$_n ed25519_$_n
}
hentries() {
_preamble=$1
_kspec=$2
for k in `ls -1 $_kspec | sort` ; do
printf "$_preamble "
cat $k
done
echo
}
gen_all 1
gen_all 2
gen_all 3
gen_all 4
gen_all 5
gen_all 6
# A section of known_hosts with hashed hostnames.
(
hentries "sisyphus.example.com" "*_5.pub"
hentries "prometheus.example.com,192.0.2.1,2001:db8::1" "*_6.pub"
) > known_hosts_hash_frag
ssh-keygen -Hf known_hosts_hash_frag
rm -f known_hosts_hash_frag.old
# Populated known_hosts, including comments, hashed names and invalid lines
(
echo "# Plain host keys, plain host names"
hentries "sisyphus.example.com" "*_1.pub"
echo "# Plain host keys, hostnames + addresses"
hentries "prometheus.example.com,192.0.2.1,2001:db8::1" "*_2.pub"
echo "# Some hosts with wildcard names / IPs"
hentries "*.example.com,192.0.2.*,2001:*" "*_3.pub"
echo "# Hashed hostname and address entries"
cat known_hosts_hash_frag
rm -f known_hosts_hash_frag
echo
echo "# Revoked and CA keys"
printf "@revoked sisyphus.example.com " ; cat rsa1_4.pub
printf "@revoked sisyphus.example.com " ; cat ed25519_4.pub
printf "@cert-authority prometheus.example.com " ; cat ecdsa_4.pub
printf "@cert-authority *.example.com " ; cat dsa_4.pub
printf "\n"
echo "# Some invalid lines"
# Invalid marker
printf "@what sisyphus.example.com " ; cat rsa1_1.pub
# Key missing
echo "sisyphus.example.com "
# Key blob missing
echo "prometheus.example.com ssh-ed25519 "
# Key blob truncated
echo "sisyphus.example.com ssh-dsa AAAATgAAAAdz"
# RSA1 key truncated after key bits
echo "prometheus.example.com 1024 "
# RSA1 key truncated after exponent
echo "sisyphus.example.com 1024 65535 "
# RSA1 key incorrect key bits
printf "prometheus.example.com 1025 " ; cut -d' ' -f2- < rsa1_1.pub
# Invalid type
echo "sisyphus.example.com ssh-XXX AAAATgAAAAdzc2gtWFhYAAAAP0ZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRg=="
# Type mismatch with blob
echo "prometheus.example.com ssh-rsa AAAATgAAAAdzc2gtWFhYAAAAP0ZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRg=="
) > known_hosts
echo OK

1171
regress/unittests/hostkeys/test_iterate.c Normal file
View File

File diff suppressed because it is too large Load Diff

1
regress/unittests/hostkeys/testdata/dsa_1.pub vendored Normal file
View File

@ -0,0 +1 @@
ssh-dss AAAAB3NzaC1kc3MAAACBAOqffHxEW4c+Z9q/r3l4sYK8F7qrBsU8XF9upGsW62T9InROFFq9IO0x3pQ6mDA0Wtw0sqcDmkPCHPyP4Ok/fU3/drLaZusHoVYu8pBBrWsIDrKgkeX9TEodBsSrYdl4Sqtqq9EZv9+DttV6LStZrgYyUTOKwOF95wGantpLynX5AAAAFQDdt+zjRNlETDsgmxcSYFgREirJrQAAAIBQlrPaiPhR24FhnMLcHH4016vL7AqDDID6Qw7PhbXGa4/XlxWMIigjBKrIPKvnZ6p712LSnCKtcbfdx0MtmJlNa01CYqPaRhgRaf+uGdvTkTUcdaq8R5lLJL+JMNwUhcC8ijm3NqEjXjffuebGe1EzIeiITbA7Nndcd+GytwRDegAAAIEAkRYPjSVcUxfUHhHdpP6V8CuY1+CYSs9EPJ7iiWTDuXWVIBTU32oJLAnrmAcOwtIzEfPvm+rff5FI/Yhon2pB3VTXhPPEBjYzE5qANanAT4e6tzAVc5f3DUhHaDknwRYfDz86GFvuLtDjeE/UZ9t6OofYoEsCBpYozLAprBvNIQY= DSA #1

1
regress/unittests/hostkeys/testdata/dsa_2.pub vendored Normal file
View File

@ -0,0 +1 @@
ssh-dss AAAAB3NzaC1kc3MAAACBAI38Hy/61/O5Bp6yUG8J5XQCeNjRS0xvjlCdzKLyXCueMa+L+X2L/u9PWUsy5SVbTjGgpB8sF6UkCNsV+va7S8zCCHas2MZ7GPlxP6GZBkRPTIFR0N/Pu7wfBzDQz0t0iL4VmxBfTBQv/SxkGWZg+yHihIQP9fwdSAwD/7aVh6ItAAAAFQDSyihIUlINlswM0PJ8wXSti3yIMwAAAIB+oqzaB6ozqs8YxpN5oQOBa/9HEBQEsp8RSIlQmVubXRNgktp42n+Ii1waU9UUk8DX5ahhIeR6B7ojWkqmDAji4SKpoHf4kmr6HvYo85ZSTSx0W4YK/gJHSpDJwhlT52tAfb1JCbWSObjl09B4STv7KedCHcR5oXQvvrV+XoKOSAAAAIAue/EXrs2INw1RfaKNHC0oqOMxmRitv0BFMuNVPo1VDj39CE5kA7AHjwvS1TNeaHtK5Hhgeb6vsmLmNPTOc8xCob0ilyQbt9O0GbONeF2Ge7D2UJyULA/hxql+tCYFIC6yUrmo35fF9XiNisXLoaflk9fjp7ROWWVwnki/jstaQw== DSA #2

1
regress/unittests/hostkeys/testdata/dsa_3.pub vendored Normal file
View File

@ -0,0 +1 @@
ssh-dss AAAAB3NzaC1kc3MAAACBAI6lz2Ip9bzE7TGuDD4SjO9S4Ac90gq0h6ai1O06eI8t/Ot2uJ5Jk2QyVr2jvIZHDl/5bwBx7+5oyjlwRoUrAPPD814wf5tU2tSnmdu1Wbf0cBswif5q0r4tevzmopp/AtgH11QHo3u0/pfyJd10qBDLV2FaYSKMmZvyPfZJ0s9pAAAAFQD5Eqjl6Rx2qVePodD9OwAPT0bU6wAAAIAfnDm6csZF0sFaJR3NIJvaYgSGr8s7cqlsk2gLltB/1wOOO2yX+NeEC+B0H93hlMfaUsPa08bwgmYxnavSMqEBpmtPceefJiEd68zwYqXd38f88wyWZ9Z5iwaI/6OVZPHzCbDxOa4ewVTevRNYUKP1xUTZNT8/gSMfZLYPk4T2AQAAAIAUKroozRMyV+3V/rxt0gFnNxRXBKk+9cl3vgsQ7ktkI9cYg7V1T2K0XF21AVMK9gODszy6PBJjV6ruXBV6TRiqIbQauivp3bHHKYsG6wiJNqwdbVwIjfvv8nn1qFoZQLXG3sdONr9NwN8KzrX89OV0BlR2dVM5qqp+YxOXymP9yg== DSA #3

1
regress/unittests/hostkeys/testdata/dsa_4.pub vendored Normal file
View File

@ -0,0 +1 @@
ssh-dss AAAAB3NzaC1kc3MAAACBAKvjnFHm0VvMr5h2Zu3nURsxQKGoxm+DCzYDxRYcilK07Cm5c4XTrFbA2X86+9sGs++W7QRMcTJUYIg0a+UtIMtAjwORd6ZPXM2K5dBW+gh1oHyvKi767tWX7I2c+1ZPJDY95mUUfZQUEfdy9eGDSBmw/pSsveQ1ur6XNUh/MtP/AAAAFQDHnXk/9jBJAdce1pHtLWnbdPSGdQAAAIEAm2OLy8tZBfiEO3c3X1yyB/GTcDwrQCqRMDkhnsmrliec3dWkOfNTzu+MrdvF8ymTWLEqPpbMheYtvNyZ3TF0HO5W7aVBpdGZbOdOAIfB+6skqGbI8A5Up1d7dak/bSsqL2r5NjwbDOdq+1hBzzvbl/qjh+sQarV2zHrpKoQaV28AAACANtkBVedBbqIAdphCrN/LbUi9WlyuF9UZz+tlpVLYrj8GJVwnplV2tvOmUw6yP5/pzCimTsao8dpL5PWxm7fKxLWVxA+lEsA4WeC885CiZn8xhdaJOCN+NyJ2bqkz+4VPI7oDGBm0aFwUqJn+M1PiSgvI50XdF2dBsFRTRNY0wzA= DSA #4

1
regress/unittests/hostkeys/testdata/dsa_5.pub vendored Normal file
View File

@ -0,0 +1 @@
ssh-dss AAAAB3NzaC1kc3MAAACBALrFy7w5ihlaOG+qR+6fj+vm5EQaO3qwxgACLcgH+VfShuOG4mkx8qFJmf+OZ3fh5iKngjNZfKtfcqI7zHWdk6378TQfQC52/kbZukjNXOLCpyNkogahcjA00onIoTK1RUDuMW28edAHwPFbpttXDTaqis+8JPMY8hZwsZGENCzTAAAAFQD6+It5vozwGgaN9ROYPMlByhi6jwAAAIBz2mcAC694vNzz9b6614gkX9d9E99PzJYfU1MPkXDziKg7MrjBw7Opd5y1jL09S3iL6lSTlHkKwVKvQ3pOwWRwXXRrKVus4I0STveoApm526jmp6mY0YEtqR98vMJ0v97h1ydt8FikKlihefCsnXVicb8887PXs2Y8C6GuFT3tfQAAAIBbmHtV5tPcrMRDkULhaQ/Whap2VKvT2DUhIHA7lx6oy/KpkltOpxDZOIGUHKqffGbiR7Jh01/y090AY5L2eCf0S2Ytx93+eADwVVpJbFJo6zSwfeey2Gm6L2oA+rCz9zTdmtZoekpD3/RAOQjnJIAPwbs7mXwabZTw4xRtiYIRrw== DSA #5

1
regress/unittests/hostkeys/testdata/dsa_6.pub vendored Normal file
View File

@ -0,0 +1 @@
ssh-dss AAAAB3NzaC1kc3MAAACBAIutigAse65TCW6hHDOEGXenE9L4L0talHbs65hj3UUNtWflKdQeXLofqXgW8AwaDKmnuRPrxRoxVNXj84n45wtBEdt4ztmdAZteAbXSnHqpcxME3jDxh3EtxzGPXLs+RUmKPVguraSgo7W2oN7KFx6VM+AcAtxANSTlvDid3s47AAAAFQCd9Q3kkHSLWe77sW0eRaayI45ovwAAAIAw6srGF6xvFasI44Y3r9JJ2K+3ezozl3ldL3p2+p2HG3iWafC4SdV8pB6ZIxKlYAywiiFb3LzH/JweGFq1jtoFDRM3MlYORBevydU4zPz7b5QLDVB0sY4evYtWmg2BFJvoWRfhLnlZVW7h5N8v4fNIwdVmVsw4Ljes7iF2HRGhHgAAAIBDFT3fww2Oby1xUA6G9pDAcVikrQFqp1sJRylNTUyeyQ37SNAGzYxwHJFgQr8gZLdRQ1UW+idYpqVbVNcYFMOiw/zSqK2OfVwPZ9U+TTKdc992ChSup6vJEKM/ZVIyDWDbJr7igQ4ahy7jo9mFvm8ljN926EnspQzCvs0Dxk6tHA== DSA #6

1
regress/unittests/hostkeys/testdata/ecdsa_1.pub vendored Normal file
View File

@ -0,0 +1 @@
ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBF6yQEtD9yBw9gmDRf477WBBzvWhAa0ioBI3nbA4emKykj0RbuQd5C4XdQAEOZGzE7v//FcCjwB2wi+JH5eKkxCtN6CjohDASZ1huoIV2UVyYIicZJEEOg1IWjjphvaxtw== ECDSA #1

1
regress/unittests/hostkeys/testdata/ecdsa_2.pub vendored Normal file
View File

@ -0,0 +1 @@
ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAB8qVcXwgBM92NCmReQlPrZAoui4Bz/mW0VUBFOpHXXW1n+15b/Y7Pc6UBd/ITTZmaBciXY+PWaSBGdwc5GdqGdLgFyJ/QAGrFMPNpVutm/82gNQzlxpNwjbMcKyiZEXzSgnjS6DzMQ0WuSMdzIBXq8OW/Kafxg4ZkU6YqALUXxlQMZuQ== ECDSA #2

1
regress/unittests/hostkeys/testdata/ecdsa_3.pub vendored Normal file
View File

@ -0,0 +1 @@
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIb3BhJZk+vUQPg5TQc1koIzuGqloCq7wjr9LjlhG24IBeiFHLsdWw74HDlH4DrOmlxToVYk2lTdnjARleRByjk= ECDSA #3

1
regress/unittests/hostkeys/testdata/ecdsa_4.pub vendored Normal file
View File

@ -0,0 +1 @@
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHZd0OXHIWwK3xnjAdMZ1tojxWycdu38pORO/UX5cqsKMgGCKQVBWWO3TFk1ePkGIE9VMWT1hCGqWRRwYlH+dSE= ECDSA #4

Some files were not shown because too many files have changed in this diff Show More