tyler.durden/openssh-portable
1
0
Fork 0
mirror of https://github.com/PowerShell/openssh-portable.git synced 2025-07-27 15:54:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

upstream commit

Browse Source 
eliminate explicit specification of protocol in tests and
loops over protocol. We only support SSHv2 now.

Upstream-Regress-ID: 0082838a9b8a382b7ee9cbf0c1b9db727784fadd
This commit is contained in:
djm@openbsd.org 2017-04-30 23:34:55 +00:00 committed by Damien Miller
parent 557f921aad
commit dd369320d2
39 changed files with 471 additions and 638 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
regress/agent-pkcs11.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: agent-pkcs11.sh,v 1.2 2015/01/12 11:46:32 djm Exp $ # $OpenBSD: agent-pkcs11.sh,v 1.3 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="pkcs11 agent test" tid="pkcs11 agent test"
@ -53,7 +53,7 @@ else
fi fi
trace "pkcs11 connect via agent" trace "pkcs11 connect via agent"
${SSH} -2 -F $OBJ/ssh_proxy somehost exit 5 ${SSH} -F $OBJ/ssh_proxy somehost exit 5
r=$? r=$?
if [ $r -ne 5 ]; then if [ $r -ne 5 ]; then
fail "ssh connect failed (exit code $r)" fail "ssh connect failed (exit code $r)"

24
regress/agent.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: agent.sh,v 1.11 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: agent.sh,v 1.12 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="simple agent test" tid="simple agent test"
@ -46,28 +46,24 @@ else
fi fi
trace "simple connect via agent" trace "simple connect via agent"
for p in ${SSH_PROTOCOLS}; do ${SSH} -F $OBJ/ssh_proxy somehost exit 52
${SSH} -$p -F $OBJ/ssh_proxy somehost exit 5$p
r=$? r=$?
if [ $r -ne 5$p ]; then if [ $r -ne 52 ]; then
fail "ssh connect with protocol $p failed (exit code $r)" fail "ssh connect with failed (exit code $r)"
fi fi
done
trace "agent forwarding" trace "agent forwarding"
for p in ${SSH_PROTOCOLS}; do ${SSH} -A -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
${SSH} -A -$p -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
r=$? r=$?
if [ $r -ne 0 ]; then if [ $r -ne 0 ]; then
fail "ssh-add -l via agent fwd proto $p failed (exit code $r)" fail "ssh-add -l via agent fwd failed (exit code $r)"
fi fi
${SSH} -A -$p -F $OBJ/ssh_proxy somehost \ ${SSH} -A -F $OBJ/ssh_proxy somehost \
"${SSH} -$p -F $OBJ/ssh_proxy somehost exit 5$p" "${SSH} -F $OBJ/ssh_proxy somehost exit 52"
r=$? r=$?
if [ $r -ne 5$p ]; then if [ $r -ne 52 ]; then
fail "agent fwd proto $p failed (exit code $r)" fail "agent fwd failed (exit code $r)"
fi fi
done
trace "delete all agent keys" trace "delete all agent keys"
${SSHADD} -D > /dev/null 2>&1 ${SSHADD} -D > /dev/null 2>&1

8
regress/banner.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: banner.sh,v 1.2 2003/10/11 11:49:49 dtucker Exp $ # $OpenBSD: banner.sh,v 1.3 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="banner" tid="banner"
@ -9,7 +9,7 @@ touch $OBJ/empty.in
trace "test missing banner file" trace "test missing banner file"
verbose "test $tid: missing banner file" verbose "test $tid: missing banner file"
( ${SSH} -2 -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \ ( ${SSH} -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \
cmp $OBJ/empty.in $OBJ/banner.out ) || \ cmp $OBJ/empty.in $OBJ/banner.out ) || \
fail "missing banner file" fail "missing banner file"
@ -30,14 +30,14 @@ for s in 0 10 100 1000 10000 100000 ; do
trace "test banner size $s" trace "test banner size $s"
verbose "test $tid: size $s" verbose "test $tid: size $s"
( ${SSH} -2 -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \ ( ${SSH} -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \
cmp $OBJ/banner.in $OBJ/banner.out ) || \ cmp $OBJ/banner.in $OBJ/banner.out ) || \
fail "banner size $s mismatch" fail "banner size $s mismatch"
done done
trace "test suppress banner (-q)" trace "test suppress banner (-q)"
verbose "test $tid: suppress banner (-q)" verbose "test $tid: suppress banner (-q)"
( ${SSH} -q -2 -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \ ( ${SSH} -q -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \
cmp $OBJ/empty.in $OBJ/banner.out ) || \ cmp $OBJ/empty.in $OBJ/banner.out ) || \
fail "suppress banner (-q)" fail "suppress banner (-q)"

11
regress/broken-pipe.sh
View File

@ -1,15 +1,12 @@
# $OpenBSD: broken-pipe.sh,v 1.5 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: broken-pipe.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="broken pipe test" tid="broken pipe test"
for p in ${SSH_PROTOCOLS}; do for i in 1 2 3 4; do
trace "protocol $p" ${SSH} -F $OBJ/ssh_config_config nexthost echo $i 2> /dev/null | true
for i in 1 2 3 4; do
${SSH} -$p -F $OBJ/ssh_config_config nexthost echo $i 2> /dev/null | true
r=$? r=$?
if [ $r -ne 0 ]; then if [ $r -ne 0 ]; then
fail "broken pipe returns $r for protocol $p" fail "broken pipe returns $r"
fi fi
done
done done

6
regress/brokenkeys.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: brokenkeys.sh,v 1.1 2004/10/29 23:59:22 djm Exp $ # $OpenBSD: brokenkeys.sh,v 1.2 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="broken keys" tid="broken keys"
@ -14,9 +14,9 @@ echo "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEABTM= bad key" > $KEYS
cat ${KEYS}.bak >> ${KEYS} cat ${KEYS}.bak >> ${KEYS}
cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
${SSH} -2 -F $OBJ/ssh_config somehost true ${SSH} -F $OBJ/ssh_config somehost true
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh connect with protocol $p failed" fail "ssh connect with failed"
fi fi
mv ${KEYS}.bak ${KEYS} mv ${KEYS}.bak ${KEYS}

117
regress/cert-file.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: cert-file.sh,v 1.5 2017/03/11 23:44:16 djm Exp $ # $OpenBSD: cert-file.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="ssh with certificates" tid="ssh with certificates"
@ -54,66 +54,64 @@ cat $OBJ/ssh_proxy | grep -v IdentityFile > $OBJ/no_identity_config
# XXX: verify that certificate used was what we expect. Needs exposure of # XXX: verify that certificate used was what we expect. Needs exposure of
# keys via enviornment variable or similar. # keys via enviornment variable or similar.
for p in ${SSH_PROTOCOLS}; do
# Key with no .pub should work - finding the equivalent *-cert.pub. # Key with no .pub should work - finding the equivalent *-cert.pub.
verbose "protocol $p: identity cert with no plain public file" verbose "identity cert with no plain public file"
${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \ ${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \
-i $OBJ/user_key3 somehost exit 5$p -i $OBJ/user_key3 somehost exit 52
[ $? -ne 5$p ] && fail "ssh failed" [ $? -ne 52 ] && fail "ssh failed"
# CertificateFile matching private key with no .pub file should work. # CertificateFile matching private key with no .pub file should work.
verbose "protocol $p: CertificateFile with no plain public file" verbose "CertificateFile with no plain public file"
${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \ ${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \
-oCertificateFile=$OBJ/user_key3-cert.pub \ -oCertificateFile=$OBJ/user_key3-cert.pub \
-i $OBJ/user_key3 somehost exit 5$p -i $OBJ/user_key3 somehost exit 52
[ $? -ne 5$p ] && fail "ssh failed" [ $? -ne 52 ] && fail "ssh failed"
# Just keys should fail # Just keys should fail
verbose "protocol $p: plain keys" verbose "plain keys"
${SSH} $opts2 somehost exit 5$p ${SSH} $opts2 somehost exit 52
r=$? r=$?
if [ $r -eq 5$p ]; then if [ $r -eq 52 ]; then
fail "ssh succeeded with no certs in protocol $p" fail "ssh succeeded with no certs"
fi fi
# Keys with untrusted cert should fail. # Keys with untrusted cert should fail.
verbose "protocol $p: untrusted cert" verbose "untrusted cert"
opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub" opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
${SSH} $opts3 somehost exit 5$p ${SSH} $opts3 somehost exit 52
r=$? r=$?
if [ $r -eq 5$p ]; then if [ $r -eq 52 ]; then
fail "ssh succeeded with bad cert in protocol $p" fail "ssh succeeded with bad cert"
fi fi
# Good cert with bad key should fail. # Good cert with bad key should fail.
verbose "protocol $p: good cert, bad key" verbose "good cert, bad key"
opts3="$opts -i $OBJ/user_key2" opts3="$opts -i $OBJ/user_key2"
opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub" opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
${SSH} $opts3 somehost exit 5$p ${SSH} $opts3 somehost exit 52
r=$? r=$?
if [ $r -eq 5$p ]; then if [ $r -eq 52 ]; then
fail "ssh succeeded with no matching key in protocol $p" fail "ssh succeeded with no matching key"
fi fi
# Keys with one trusted cert, should succeed. # Keys with one trusted cert, should succeed.
verbose "protocol $p: single trusted" verbose "single trusted"
opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub" opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
${SSH} $opts3 somehost exit 5$p ${SSH} $opts3 somehost exit 52
r=$? r=$?
if [ $r -ne 5$p ]; then if [ $r -ne 52 ]; then
fail "ssh failed with trusted cert and key in protocol $p" fail "ssh failed with trusted cert and key"
fi fi
# Multiple certs and keys, with one trusted cert, should succeed. # Multiple certs and keys, with one trusted cert, should succeed.
verbose "protocol $p: multiple trusted" verbose "multiple trusted"
opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub" opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub" opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
${SSH} $opts3 somehost exit 5$p ${SSH} $opts3 somehost exit 52
r=$? r=$?
if [ $r -ne 5$p ]; then if [ $r -ne 52 ]; then
fail "ssh failed with multiple certs in protocol $p" fail "ssh failed with multiple certs"
fi fi
done
#next, using an agent in combination with the keys #next, using an agent in combination with the keys
SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1 SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1
@ -139,26 +137,25 @@ if [ $? -ne 0 ]; then
fi fi
# try ssh with the agent and certificates # try ssh with the agent and certificates
# note: ssh agent only uses certificates in protocol 2
opts="-F $OBJ/ssh_proxy" opts="-F $OBJ/ssh_proxy"
# with no certificates, shoud fail # with no certificates, shoud fail
${SSH} -2 $opts somehost exit 52 ${SSH} $opts somehost exit 52
if [ $? -eq 52 ]; then if [ $? -eq 52 ]; then
fail "ssh connect with agent in protocol 2 succeeded with no cert" fail "ssh connect with agent in succeeded with no cert"
fi fi
#with an untrusted certificate, should fail #with an untrusted certificate, should fail
opts="$opts -oCertificateFile=$OBJ/cert_user_key1_2.pub" opts="$opts -oCertificateFile=$OBJ/cert_user_key1_2.pub"
${SSH} -2 $opts somehost exit 52 ${SSH} $opts somehost exit 52
if [ $? -eq 52 ]; then if [ $? -eq 52 ]; then
fail "ssh connect with agent in protocol 2 succeeded with bad cert" fail "ssh connect with agent in succeeded with bad cert"
fi fi
#with an additional trusted certificate, should succeed #with an additional trusted certificate, should succeed
opts="$opts -oCertificateFile=$OBJ/cert_user_key1_1.pub" opts="$opts -oCertificateFile=$OBJ/cert_user_key1_1.pub"
${SSH} -2 $opts somehost exit 52 ${SSH} $opts somehost exit 52
if [ $? -ne 52 ]; then if [ $? -ne 52 ]; then
fail "ssh connect with agent in protocol 2 failed with good cert" fail "ssh connect with agent in failed with good cert"
fi fi
trace "kill agent" trace "kill agent"

14
regress/cert-hostkey.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: cert-hostkey.sh,v 1.14 2016/05/02 09:52:00 djm Exp $ # $OpenBSD: cert-hostkey.sh,v 1.15 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="certified host keys" tid="certified host keys"
@ -104,7 +104,7 @@ attempt_connect() {
shift; shift shift; shift
verbose "$tid: $_ident expect success $_expect_success" verbose "$tid: $_ident expect success $_expect_success"
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \ -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
"$@" -F $OBJ/ssh_proxy somehost true "$@" -F $OBJ/ssh_proxy somehost true
_r=$? _r=$?
@ -169,7 +169,7 @@ for privsep in yes no ; do
) > $OBJ/sshd_proxy ) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \ -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -190,7 +190,7 @@ for ktype in $PLAIN_TYPES ; do
echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
) > $OBJ/sshd_proxy ) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \ -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -222,7 +222,7 @@ test_one() {
) > $OBJ/sshd_proxy ) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \ -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
rc=$? rc=$?
@ -271,7 +271,7 @@ for ktype in $PLAIN_TYPES ; do
echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
) > $OBJ/sshd_proxy ) > $OBJ/sshd_proxy
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \ -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true -F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
@ -303,7 +303,7 @@ for kt in $PLAIN_TYPES ; do
) > $OBJ/sshd_proxy ) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \ -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then

36
regress/cert-userkey.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: cert-userkey.sh,v 1.17 2016/11/30 03:01:33 djm Exp $ # $OpenBSD: cert-userkey.sh,v 1.18 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="certified user keys" tid="certified user keys"
@ -67,7 +67,7 @@ for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
# Missing authorized_principals # Missing authorized_principals
verbose "$tid: ${_prefix} missing authorized_principals" verbose "$tid: ${_prefix} missing authorized_principals"
rm -f $OBJ/authorized_principals_$USER rm -f $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -76,7 +76,7 @@ for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
# Empty authorized_principals # Empty authorized_principals
verbose "$tid: ${_prefix} empty authorized_principals" verbose "$tid: ${_prefix} empty authorized_principals"
echo > $OBJ/authorized_principals_$USER echo > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -85,7 +85,7 @@ for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
# Wrong authorized_principals # Wrong authorized_principals
verbose "$tid: ${_prefix} wrong authorized_principals" verbose "$tid: ${_prefix} wrong authorized_principals"
echo gregorsamsa > $OBJ/authorized_principals_$USER echo gregorsamsa > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -94,7 +94,7 @@ for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
# Correct authorized_principals # Correct authorized_principals
verbose "$tid: ${_prefix} correct authorized_principals" verbose "$tid: ${_prefix} correct authorized_principals"
echo mekmitasdigoat > $OBJ/authorized_principals_$USER echo mekmitasdigoat > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cert connect failed" fail "ssh cert connect failed"
@ -103,7 +103,7 @@ for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
# authorized_principals with bad key option # authorized_principals with bad key option
verbose "$tid: ${_prefix} authorized_principals bad key opt" verbose "$tid: ${_prefix} authorized_principals bad key opt"
echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -113,7 +113,7 @@ for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
verbose "$tid: ${_prefix} authorized_principals command=false" verbose "$tid: ${_prefix} authorized_principals command=false"
echo 'command="false" mekmitasdigoat' > \ echo 'command="false" mekmitasdigoat' > \
$OBJ/authorized_principals_$USER $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -124,7 +124,7 @@ for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
verbose "$tid: ${_prefix} authorized_principals command=true" verbose "$tid: ${_prefix} authorized_principals command=true"
echo 'command="true" mekmitasdigoat' > \ echo 'command="true" mekmitasdigoat' > \
$OBJ/authorized_principals_$USER $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost false >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cert connect failed" fail "ssh cert connect failed"
@ -148,7 +148,7 @@ for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
printf 'cert-authority,principals="gregorsamsa" ' printf 'cert-authority,principals="gregorsamsa" '
cat $OBJ/user_ca_key.pub cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER ) > $OBJ/authorized_keys_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -160,7 +160,7 @@ for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
printf 'cert-authority,principals="mekmitasdigoat" ' printf 'cert-authority,principals="mekmitasdigoat" '
cat $OBJ/user_ca_key.pub cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER ) > $OBJ/authorized_keys_$USER
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cert connect failed" fail "ssh cert connect failed"
@ -198,7 +198,7 @@ basic_tests() {
echo "PubkeyAcceptedKeyTypes ${t}" echo "PubkeyAcceptedKeyTypes ${t}"
) > $OBJ/ssh_proxy ) > $OBJ/ssh_proxy
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true -F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cert connect failed" fail "ssh cert connect failed"
@ -215,7 +215,7 @@ basic_tests() {
) > $OBJ/sshd_proxy ) > $OBJ/sshd_proxy
cp $OBJ/cert_user_key_${ktype}.pub \ cp $OBJ/cert_user_key_${ktype}.pub \
$OBJ/cert_user_key_revoked $OBJ/cert_user_key_revoked
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpecedly" fail "ssh cert connect succeeded unexpecedly"
@ -224,14 +224,14 @@ basic_tests() {
rm $OBJ/cert_user_key_revoked rm $OBJ/cert_user_key_revoked
${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked \ ${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked \
$OBJ/cert_user_key_${ktype}.pub $OBJ/cert_user_key_${ktype}.pub
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpecedly" fail "ssh cert connect succeeded unexpecedly"
fi fi
verbose "$tid: ${_prefix} empty KRL" verbose "$tid: ${_prefix} empty KRL"
${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked ${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cert connect failed" fail "ssh cert connect failed"
@ -246,7 +246,7 @@ basic_tests() {
echo "PubkeyAcceptedKeyTypes ${t}" echo "PubkeyAcceptedKeyTypes ${t}"
echo "$extra_sshd" echo "$extra_sshd"
) > $OBJ/sshd_proxy ) > $OBJ/sshd_proxy
${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \ ${SSH} -i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
somehost true >/dev/null 2>&1 somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpecedly" fail "ssh cert connect succeeded unexpecedly"
@ -260,7 +260,7 @@ basic_tests() {
echo "$extra_sshd" echo "$extra_sshd"
) > $OBJ/sshd_proxy ) > $OBJ/sshd_proxy
verbose "$tid: ensure CA key does not authenticate user" verbose "$tid: ensure CA key does not authenticate user"
${SSH} -2i $OBJ/user_ca_key \ ${SSH} -i $OBJ/user_ca_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect with CA key succeeded unexpectedly" fail "ssh cert connect with CA key succeeded unexpectedly"
@ -307,7 +307,7 @@ test_one() {
$sign_opts $OBJ/cert_user_key_${ktype} || $sign_opts $OBJ/cert_user_key_${ktype} ||
fail "couldn't sign cert_user_key_${ktype}" fail "couldn't sign cert_user_key_${ktype}"
${SSH} -2i $OBJ/cert_user_key_${ktype} \ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
rc=$? rc=$?
if [ "x$result" = "xsuccess" ] ; then if [ "x$result" = "xsuccess" ] ; then
@ -378,7 +378,7 @@ for ktype in $PLAIN_TYPES ; do
-n $USER $OBJ/cert_user_key_${ktype} || -n $USER $OBJ/cert_user_key_${ktype} ||
fatal "couldn't sign cert_user_key_${ktype}" fatal "couldn't sign cert_user_key_${ktype}"
verbose "$tid: user ${ktype} connect wrong cert" verbose "$tid: user ${ktype} connect wrong cert"
${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \ ${SSH} -i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
somehost true >/dev/null 2>&1 somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect $ident succeeded unexpectedly" fail "ssh cert connect $ident succeeded unexpectedly"

76
regress/cfgmatch.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: cfgmatch.sh,v 1.9 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: cfgmatch.sh,v 1.10 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="sshd_config match" tid="sshd_config match"
@ -13,7 +13,7 @@ echo "ExitOnForwardFailure=yes" >> $OBJ/ssh_proxy
start_client() start_client()
{ {
rm -f $pidfile rm -f $pidfile
${SSH} -q -$p $fwd "$@" somehost \ ${SSH} -q $fwd "$@" somehost \
exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' \ exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' \
>>$TEST_REGRESS_LOGFILE 2>&1 & >>$TEST_REGRESS_LOGFILE 2>&1 &
client_pid=$! client_pid=$!
@ -56,22 +56,18 @@ start_sshd
#set -x #set -x
# Test Match + PermitOpen in sshd_config. This should be permitted # Test Match + PermitOpen in sshd_config. This should be permitted
for p in ${SSH_PROTOCOLS}; do trace "match permitopen localhost"
trace "match permitopen localhost proto $p" start_client -F $OBJ/ssh_config
start_client -F $OBJ/ssh_config ${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ fail "match permitopen permit"
fail "match permitopen permit proto $p" stop_client
stop_client
done
# Same but from different source. This should not be permitted # Same but from different source. This should not be permitted
for p in ${SSH_PROTOCOLS}; do trace "match permitopen proxy"
trace "match permitopen proxy proto $p" start_client -F $OBJ/ssh_proxy
start_client -F $OBJ/ssh_proxy ${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true && \
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ fail "match permitopen deny"
fail "match permitopen deny proto $p" stop_client
stop_client
done
# Retry previous with key option, should also be denied. # Retry previous with key option, should also be denied.
cp /dev/null $OBJ/authorized_keys_$USER cp /dev/null $OBJ/authorized_keys_$USER
@ -79,23 +75,19 @@ for t in ${SSH_KEYTYPES}; do
printf 'permitopen="127.0.0.1:'$PORT'" ' >> $OBJ/authorized_keys_$USER printf 'permitopen="127.0.0.1:'$PORT'" ' >> $OBJ/authorized_keys_$USER
cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
done done
for p in ${SSH_PROTOCOLS}; do trace "match permitopen proxy w/key opts"
trace "match permitopen proxy w/key opts proto $p" start_client -F $OBJ/ssh_proxy
start_client -F $OBJ/ssh_proxy ${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true && \
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ fail "match permitopen deny w/key opt"
fail "match permitopen deny w/key opt proto $p" stop_client
stop_client
done
# Test both sshd_config and key options permitting the same dst/port pair. # Test both sshd_config and key options permitting the same dst/port pair.
# Should be permitted. # Should be permitted.
for p in ${SSH_PROTOCOLS}; do trace "match permitopen localhost"
trace "match permitopen localhost proto $p" start_client -F $OBJ/ssh_config
start_client -F $OBJ/ssh_config ${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ fail "match permitopen permit"
fail "match permitopen permit proto $p" stop_client
stop_client
done
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy
@ -103,13 +95,11 @@ echo "Match User $USER" >>$OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
# Test that a Match overrides a PermitOpen in the global section # Test that a Match overrides a PermitOpen in the global section
for p in ${SSH_PROTOCOLS}; do trace "match permitopen proxy w/key opts"
trace "match permitopen proxy w/key opts proto $p" start_client -F $OBJ/ssh_proxy
start_client -F $OBJ/ssh_proxy ${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true && \
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ fail "match override permitopen"
fail "match override permitopen proto $p" stop_client
stop_client
done
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy
@ -118,10 +108,8 @@ echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
# Test that a rule that doesn't match doesn't override, plus test a # Test that a rule that doesn't match doesn't override, plus test a
# PermitOpen entry that's not at the start of the list # PermitOpen entry that's not at the start of the list
for p in ${SSH_PROTOCOLS}; do trace "nomatch permitopen proxy w/key opts"
trace "nomatch permitopen proxy w/key opts proto $p" start_client -F $OBJ/ssh_proxy
start_client -F $OBJ/ssh_proxy ${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ fail "nomatch override permitopen"
fail "nomatch override permitopen proto $p" stop_client
stop_client
done

27
regress/cipher-speed.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: cipher-speed.sh,v 1.13 2015/03/24 20:22:17 markus Exp $ # $OpenBSD: cipher-speed.sh,v 1.14 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="cipher speed" tid="cipher speed"
@ -12,16 +12,16 @@ getbytes ()
tries="1 2" tries="1 2"
for c in `${SSH} -Q cipher`; do n=0; for m in `${SSH} -Q mac`; do for c in `${SSH} -Q cipher`; do n=0; for m in `${SSH} -Q mac`; do
trace "proto 2 cipher $c mac $m" trace "cipher $c mac $m"
for x in $tries; do for x in $tries; do
printf "%-60s" "$c/$m:" printf "%-60s" "$c/$m:"
( ${SSH} -o 'compression no' \ ( ${SSH} -o 'compression no' \
-F $OBJ/ssh_proxy -2 -m $m -c $c somehost \ -F $OBJ/ssh_proxy -m $m -c $c somehost \
exec sh -c \'"dd of=/dev/null obs=32k"\' \ exec sh -c \'"dd of=/dev/null obs=32k"\' \
< ${DATA} ) 2>&1 | getbytes < ${DATA} ) 2>&1 | getbytes
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh -2 failed with mac $m cipher $c" fail "ssh failed with mac $m cipher $c"
fi fi
done done
# No point trying all MACs for AEAD ciphers since they are ignored. # No point trying all MACs for AEAD ciphers since they are ignored.
@ -30,22 +30,3 @@ for c in `${SSH} -Q cipher`; do n=0; for m in `${SSH} -Q mac`; do
fi fi
n=`expr $n + 1` n=`expr $n + 1`
done; done done; done
if ssh_version 1; then
ciphers="3des blowfish"
else
ciphers=""
fi
for c in $ciphers; do
trace "proto 1 cipher $c"
for x in $tries; do
printf "%-60s" "$c:"
( ${SSH} -o 'compression no' \
-F $OBJ/ssh_proxy -1 -c $c somehost \
exec sh -c \'"dd of=/dev/null obs=32k"\' \
< ${DATA} ) 2>&1 | getbytes
if [ $? -ne 0 ]; then
fail "ssh -1 failed with cipher $c"
fi
done
done

28
regress/connect-privsep.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: connect-privsep.sh,v 1.8 2016/11/01 13:43:27 tb Exp $ # $OpenBSD: connect-privsep.sh,v 1.9 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="proxy connect with privsep" tid="proxy connect with privsep"
@ -6,23 +6,19 @@ tid="proxy connect with privsep"
cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
echo 'UsePrivilegeSeparation yes' >> $OBJ/sshd_proxy echo 'UsePrivilegeSeparation yes' >> $OBJ/sshd_proxy
for p in ${SSH_PROTOCOLS}; do ${SSH} -F $OBJ/ssh_proxy 999.999.999.999 true
${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true if [ $? -ne 0 ]; then
if [ $? -ne 0 ]; then fail "ssh privsep+proxyconnect failed"
fail "ssh privsep+proxyconnect protocol $p failed" fi
fi
done
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
echo 'UsePrivilegeSeparation sandbox' >> $OBJ/sshd_proxy echo 'UsePrivilegeSeparation sandbox' >> $OBJ/sshd_proxy
for p in ${SSH_PROTOCOLS}; do ${SSH} -F $OBJ/ssh_proxy 999.999.999.999 true
${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true if [ $? -ne 0 ]; then
if [ $? -ne 0 ]; then
# XXX replace this with fail once sandbox has stabilised # XXX replace this with fail once sandbox has stabilised
warn "ssh privsep/sandbox+proxyconnect protocol $p failed" warn "ssh privsep/sandbox+proxyconnect failed"
fi fi
done
# Because sandbox is sensitive to changes in libc, especially malloc, retest # Because sandbox is sensitive to changes in libc, especially malloc, retest
# with every malloc.conf option (and none). # with every malloc.conf option (and none).
@ -32,10 +28,8 @@ else
mopts=`echo $TEST_MALLOC_OPTIONS | sed 's/./& /g'` mopts=`echo $TEST_MALLOC_OPTIONS | sed 's/./& /g'`
fi fi
for m in '' $mopts ; do for m in '' $mopts ; do
for p in ${SSH_PROTOCOLS}; do env MALLOC_OPTIONS="$m" ${SSH} -F $OBJ/ssh_proxy 999.999.999.999 true
env MALLOC_OPTIONS="$m" ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh privsep/sandbox+proxyconnect protocol $p mopt '$m' failed" fail "ssh privsep/sandbox+proxyconnect mopt '$m' failed"
fi fi
done
done done

12
regress/connect.sh
View File

@ -1,13 +1,11 @@
# $OpenBSD: connect.sh,v 1.5 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: connect.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="simple connect" tid="simple connect"
start_sshd start_sshd
for p in ${SSH_PROTOCOLS}; do ${SSH} -F $OBJ/ssh_config somehost true
${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true if [ $? -ne 0 ]; then
if [ $? -ne 0 ]; then fail "ssh connect with failed"
fail "ssh connect with protocol $p failed" fi
fi
done

2
regress/dynamic-forward.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: dynamic-forward.sh,v 1.11 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: dynamic-forward.sh,v 1.12 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="dynamic forwarding" tid="dynamic forwarding"

20
regress/exit-status.sh
View File

@ -1,24 +1,22 @@
# $OpenBSD: exit-status.sh,v 1.7 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: exit-status.sh,v 1.8 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="remote exit status" tid="remote exit status"
for p in ${SSH_PROTOCOLS}; do for s in 0 1 4 5 44; do
for s in 0 1 4 5 44; do trace "status $s"
trace "proto $p status $s" verbose "test $tid: status $s"
verbose "test $tid: proto $p status $s" ${SSH} -F $OBJ/ssh_proxy otherhost exit $s
${SSH} -$p -F $OBJ/ssh_proxy otherhost exit $s
r=$? r=$?
if [ $r -ne $s ]; then if [ $r -ne $s ]; then
fail "exit code mismatch for protocol $p: $r != $s" fail "exit code mismatch for: $r != $s"
fi fi
# same with early close of stdout/err # same with early close of stdout/err
${SSH} -$p -F $OBJ/ssh_proxy -n otherhost \ ${SSH} -F $OBJ/ssh_proxy -n otherhost exec \
exec sh -c \'"sleep 2; exec > /dev/null 2>&1; sleep 3; exit $s"\' sh -c \'"sleep 2; exec > /dev/null 2>&1; sleep 3; exit $s"\'
r=$? r=$?
if [ $r -ne $s ]; then if [ $r -ne $s ]; then
fail "exit code (with sleep) mismatch for protocol $p: $r != $s" fail "exit code (with sleep) mismatch for: $r != $s"
fi fi
done
done done

23
regress/forcecommand.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: forcecommand.sh,v 1.3 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: forcecommand.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="forced command" tid="forced command"
@ -11,11 +11,8 @@ for t in ${SSH_KEYTYPES}; do
cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
done done
for p in ${SSH_PROTOCOLS}; do trace "forced command in key option"
trace "forced command in key option proto $p" ${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command in key"
${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
fail "forced command in key proto $p"
done
cp /dev/null $OBJ/authorized_keys_$USER cp /dev/null $OBJ/authorized_keys_$USER
for t in ${SSH_KEYTYPES}; do for t in ${SSH_KEYTYPES}; do
@ -26,19 +23,13 @@ done
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "ForceCommand true" >> $OBJ/sshd_proxy echo "ForceCommand true" >> $OBJ/sshd_proxy
for p in ${SSH_PROTOCOLS}; do trace "forced command in sshd_config overrides key option"
trace "forced command in sshd_config overrides key option proto $p" ${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command in key"
${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
fail "forced command in key proto $p"
done
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "ForceCommand false" >> $OBJ/sshd_proxy echo "ForceCommand false" >> $OBJ/sshd_proxy
echo "Match User $USER" >> $OBJ/sshd_proxy echo "Match User $USER" >> $OBJ/sshd_proxy
echo " ForceCommand true" >> $OBJ/sshd_proxy echo " ForceCommand true" >> $OBJ/sshd_proxy
for p in ${SSH_PROTOCOLS}; do trace "forced command with match"
trace "forced command with match proto $p" ${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command in key"
${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
fail "forced command in key proto $p"
done

49
regress/forward-control.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: forward-control.sh,v 1.3 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: forward-control.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="sshd control of local and remote forwarding" tid="sshd control of local and remote forwarding"
@ -32,13 +32,12 @@ wait_for_process_to_exit() {
return 0 return 0
} }
# usage: check_lfwd protocol Y|N message # usage: check_lfwd Y|N message
check_lfwd() { check_lfwd() {
_proto=$1 _expected=$1
_expected=$2 _message=$2
_message=$3
rm -f $READY rm -f $READY
${SSH} -oProtocol=$_proto -F $OBJ/ssh_proxy \ ${SSH} -F $OBJ/ssh_proxy \
-L$LFWD_PORT:127.0.0.1:$PORT \ -L$LFWD_PORT:127.0.0.1:$PORT \
-o ExitOnForwardFailure=yes \ -o ExitOnForwardFailure=yes \
-n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \ -n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
@ -62,13 +61,12 @@ check_lfwd() {
fi fi
} }
# usage: check_rfwd protocol Y|N message # usage: check_rfwd Y|N message
check_rfwd() { check_rfwd() {
_proto=$1 _expected=$1
_expected=$2 _message=$2
_message=$3
rm -f $READY rm -f $READY
${SSH} -oProtocol=$_proto -F $OBJ/ssh_proxy \ ${SSH} -F $OBJ/ssh_proxy \
-R$RFWD_PORT:127.0.0.1:$PORT \ -R$RFWD_PORT:127.0.0.1:$PORT \
-o ExitOnForwardFailure=yes \ -o ExitOnForwardFailure=yes \
-n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \ -n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
@ -99,10 +97,8 @@ cp ${OBJ}/sshd_proxy ${OBJ}/sshd_proxy.bak
cp ${OBJ}/authorized_keys_${USER} ${OBJ}/authorized_keys_${USER}.bak cp ${OBJ}/authorized_keys_${USER} ${OBJ}/authorized_keys_${USER}.bak
# Sanity check: ensure the default config allows forwarding # Sanity check: ensure the default config allows forwarding
for p in ${SSH_PROTOCOLS} ; do check_lfwd Y "default configuration"
check_lfwd $p Y "proto $p, default configuration" check_rfwd Y "default configuration"
check_rfwd $p Y "proto $p, default configuration"
done
# Usage: all_tests yes|local|remote|no Y|N Y|N Y|N Y|N Y|N Y|N # Usage: all_tests yes|local|remote|no Y|N Y|N Y|N Y|N Y|N Y|N
all_tests() { all_tests() {
@ -115,23 +111,21 @@ all_tests() {
_permit_rfwd=$7 _permit_rfwd=$7
_badfwd=127.0.0.1:22 _badfwd=127.0.0.1:22
_goodfwd=127.0.0.1:${PORT} _goodfwd=127.0.0.1:${PORT}
for _proto in ${SSH_PROTOCOLS} ; do cp ${OBJ}/authorized_keys_${USER}.bak ${OBJ}/authorized_keys_${USER}
cp ${OBJ}/authorized_keys_${USER}.bak \ _prefix="AllowTcpForwarding=$_tcpfwd"
${OBJ}/authorized_keys_${USER}
_prefix="proto $_proto, AllowTcpForwarding=$_tcpfwd"
# No PermitOpen # No PermitOpen
( cat ${OBJ}/sshd_proxy.bak ; ( cat ${OBJ}/sshd_proxy.bak ;
echo "AllowTcpForwarding $_tcpfwd" ) \ echo "AllowTcpForwarding $_tcpfwd" ) \
> ${OBJ}/sshd_proxy > ${OBJ}/sshd_proxy
check_lfwd $_proto $_plain_lfwd "$_prefix" check_lfwd $_plain_lfwd "$_prefix"
check_rfwd $_proto $_plain_rfwd "$_prefix" check_rfwd $_plain_rfwd "$_prefix"
# PermitOpen via sshd_config that doesn't match # PermitOpen via sshd_config that doesn't match
( cat ${OBJ}/sshd_proxy.bak ; ( cat ${OBJ}/sshd_proxy.bak ;
echo "AllowTcpForwarding $_tcpfwd" ; echo "AllowTcpForwarding $_tcpfwd" ;
echo "PermitOpen $_badfwd" ) \ echo "PermitOpen $_badfwd" ) \
> ${OBJ}/sshd_proxy > ${OBJ}/sshd_proxy
check_lfwd $_proto $_nopermit_lfwd "$_prefix, !PermitOpen" check_lfwd $_nopermit_lfwd "$_prefix, !PermitOpen"
check_rfwd $_proto $_nopermit_rfwd "$_prefix, !PermitOpen" check_rfwd $_nopermit_rfwd "$_prefix, !PermitOpen"
# PermitOpen via sshd_config that does match # PermitOpen via sshd_config that does match
( cat ${OBJ}/sshd_proxy.bak ; ( cat ${OBJ}/sshd_proxy.bak ;
echo "AllowTcpForwarding $_tcpfwd" ; echo "AllowTcpForwarding $_tcpfwd" ;
@ -146,8 +140,8 @@ all_tests() {
( cat ${OBJ}/sshd_proxy.bak ; ( cat ${OBJ}/sshd_proxy.bak ;
echo "AllowTcpForwarding $_tcpfwd" ) \ echo "AllowTcpForwarding $_tcpfwd" ) \
> ${OBJ}/sshd_proxy > ${OBJ}/sshd_proxy
check_lfwd $_proto $_nopermit_lfwd "$_prefix, !permitopen" check_lfwd $_nopermit_lfwd "$_prefix, !permitopen"
check_rfwd $_proto $_nopermit_rfwd "$_prefix, !permitopen" check_rfwd $_nopermit_rfwd "$_prefix, !permitopen"
# permitopen via authorized_keys that does match # permitopen via authorized_keys that does match
sed "s/^/permitopen=\"$_badfwd\",permitopen=\"$_goodfwd\" /" \ sed "s/^/permitopen=\"$_badfwd\",permitopen=\"$_goodfwd\" /" \
< ${OBJ}/authorized_keys_${USER}.bak \ < ${OBJ}/authorized_keys_${USER}.bak \
@ -155,9 +149,8 @@ all_tests() {
( cat ${OBJ}/sshd_proxy.bak ; ( cat ${OBJ}/sshd_proxy.bak ;
echo "AllowTcpForwarding $_tcpfwd" ) \ echo "AllowTcpForwarding $_tcpfwd" ) \
> ${OBJ}/sshd_proxy > ${OBJ}/sshd_proxy
check_lfwd $_proto $_permit_lfwd "$_prefix, permitopen" check_lfwd $_permit_lfwd "$_prefix, permitopen"
check_rfwd $_proto $_permit_rfwd "$_prefix, permitopen" check_rfwd $_permit_rfwd "$_prefix, permitopen"
done
} }
# no-permitopen mismatch-permitopen match-permitopen # no-permitopen mismatch-permitopen match-permitopen

136
regress/forwarding.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: forwarding.sh,v 1.19 2017/01/30 05:22:14 djm Exp $ # $OpenBSD: forwarding.sh,v 1.20 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="local and remote forwarding" tid="local and remote forwarding"
@ -22,30 +22,24 @@ for j in 0 1 2; do
last=$a last=$a
done done
done done
for p in ${SSH_PROTOCOLS}; do
q=`expr 3 - $p`
if ! ssh_version $q; then
q=$p
fi
trace "start forwarding, fork to background"
rm -f $CTL
${SSH} -S $CTL -M -$p -F $OBJ/ssh_config -f $fwd somehost sleep 10
trace "transfer over forwarded channels and check result" trace "start forwarding, fork to background"
${SSH} -$q -F $OBJ/ssh_config -p$last -o 'ConnectionAttempts=4' \ rm -f $CTL
${SSH} -S $CTL -M -F $OBJ/ssh_config -f $fwd somehost sleep 10
trace "transfer over forwarded channels and check result"
${SSH} -F $OBJ/ssh_config -p$last -o 'ConnectionAttempts=4' \
somehost cat ${DATA} > ${COPY} somehost cat ${DATA} > ${COPY}
test -s ${COPY} || fail "failed copy of ${DATA}" test -s ${COPY} || fail "failed copy of ${DATA}"
cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}" cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost ${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
done
for p in ${SSH_PROTOCOLS}; do
for d in L R; do for d in L R; do
trace "exit on -$d forward failure, proto $p" trace "exit on -$d forward failure"
# this one should succeed # this one should succeed
${SSH} -$p -F $OBJ/ssh_config \ ${SSH} -F $OBJ/ssh_config \
-$d ${base}01:127.0.0.1:$PORT \ -$d ${base}01:127.0.0.1:$PORT \
-$d ${base}02:127.0.0.1:$PORT \ -$d ${base}02:127.0.0.1:$PORT \
-$d ${base}03:127.0.0.1:$PORT \ -$d ${base}03:127.0.0.1:$PORT \
@ -55,7 +49,7 @@ for d in L R; do
fatal "connection failed, should not" fatal "connection failed, should not"
else else
# this one should fail # this one should fail
${SSH} -q -$p -F $OBJ/ssh_config \ ${SSH} -q -F $OBJ/ssh_config \
-$d ${base}01:127.0.0.1:$PORT \ -$d ${base}01:127.0.0.1:$PORT \
-$d ${base}02:127.0.0.1:$PORT \ -$d ${base}02:127.0.0.1:$PORT \
-$d ${base}03:127.0.0.1:$PORT \ -$d ${base}03:127.0.0.1:$PORT \
@ -68,82 +62,74 @@ for d in L R; do
fi fi
fi fi
done done
done
for p in ${SSH_PROTOCOLS}; do trace "simple clear forwarding"
trace "simple clear forwarding proto $p" ${SSH} -F $OBJ/ssh_config -oClearAllForwardings=yes somehost true
${SSH} -$p -F $OBJ/ssh_config -oClearAllForwardings=yes somehost true
trace "clear local forward proto $p" trace "clear local forward"
rm -f $CTL rm -f $CTL
${SSH} -S $CTL -M -$p -f -F $OBJ/ssh_config -L ${base}01:127.0.0.1:$PORT \ ${SSH} -S $CTL -M -f -F $OBJ/ssh_config -L ${base}01:127.0.0.1:$PORT \
-oClearAllForwardings=yes somehost sleep 10 -oClearAllForwardings=yes somehost sleep 10
if [ $? != 0 ]; then if [ $? != 0 ]; then
fail "connection failed with cleared local forwarding" fail "connection failed with cleared local forwarding"
else else
# this one should fail # this one should fail
${SSH} -$p -F $OBJ/ssh_config -p ${base}01 somehost true \ ${SSH} -F $OBJ/ssh_config -p ${base}01 somehost true \
>>$TEST_REGRESS_LOGFILE 2>&1 && \ >>$TEST_REGRESS_LOGFILE 2>&1 && \
fail "local forwarding not cleared" fail "local forwarding not cleared"
fi fi
${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost ${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
trace "clear remote forward proto $p" trace "clear remote forward"
rm -f $CTL rm -f $CTL
${SSH} -S $CTL -M -$p -f -F $OBJ/ssh_config -R ${base}01:127.0.0.1:$PORT \ ${SSH} -S $CTL -M -f -F $OBJ/ssh_config -R ${base}01:127.0.0.1:$PORT \
-oClearAllForwardings=yes somehost sleep 10 -oClearAllForwardings=yes somehost sleep 10
if [ $? != 0 ]; then if [ $? != 0 ]; then
fail "connection failed with cleared remote forwarding" fail "connection failed with cleared remote forwarding"
else else
# this one should fail # this one should fail
${SSH} -$p -F $OBJ/ssh_config -p ${base}01 somehost true \ ${SSH} -F $OBJ/ssh_config -p ${base}01 somehost true \
>>$TEST_REGRESS_LOGFILE 2>&1 && \ >>$TEST_REGRESS_LOGFILE 2>&1 && \
fail "remote forwarding not cleared" fail "remote forwarding not cleared"
fi fi
${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost ${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
done
for p in 2; do trace "stdio forwarding"
trace "stdio forwarding proto $p" cmd="${SSH} -F $OBJ/ssh_config"
cmd="${SSH} -$p -F $OBJ/ssh_config" $cmd -o "ProxyCommand $cmd -q -W localhost:$PORT somehost" somehost true
$cmd -o "ProxyCommand $cmd -q -W localhost:$PORT somehost" \ if [ $? != 0 ]; then
somehost true fail "stdio forwarding"
if [ $? != 0 ]; then fi
fail "stdio forwarding proto $p"
fi
done
echo "LocalForward ${base}01 127.0.0.1:$PORT" >> $OBJ/ssh_config echo "LocalForward ${base}01 127.0.0.1:$PORT" >> $OBJ/ssh_config
echo "RemoteForward ${base}02 127.0.0.1:${base}01" >> $OBJ/ssh_config echo "RemoteForward ${base}02 127.0.0.1:${base}01" >> $OBJ/ssh_config
for p in ${SSH_PROTOCOLS}; do
trace "config file: start forwarding, fork to background"
rm -f $CTL
${SSH} -S $CTL -M -$p -F $OBJ/ssh_config -f somehost sleep 10
trace "config file: transfer over forwarded channels and check result" trace "config file: start forwarding, fork to background"
${SSH} -F $OBJ/ssh_config -p${base}02 -o 'ConnectionAttempts=4' \ rm -f $CTL
${SSH} -S $CTL -M -F $OBJ/ssh_config -f somehost sleep 10
trace "config file: transfer over forwarded channels and check result"
${SSH} -F $OBJ/ssh_config -p${base}02 -o 'ConnectionAttempts=4' \
somehost cat ${DATA} > ${COPY} somehost cat ${DATA} > ${COPY}
test -s ${COPY} || fail "failed copy of ${DATA}" test -s ${COPY} || fail "failed copy of ${DATA}"
cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}" cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost ${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
done
for p in 2; do trace "transfer over chained unix domain socket forwards and check result"
trace "transfer over chained unix domain socket forwards and check result" rm -f $OBJ/unix-[123].fwd
rm -f $OBJ/unix-[123].fwd rm -f $CTL $CTL.[123]
rm -f $CTL $CTL.[123] ${SSH} -S $CTL -M -f -F $OBJ/ssh_config -R${base}01:[$OBJ/unix-1.fwd] somehost sleep 10
${SSH} -S $CTL -M -f -F $OBJ/ssh_config -R${base}01:[$OBJ/unix-1.fwd] somehost sleep 10 ${SSH} -S $CTL.1 -M -f -F $OBJ/ssh_config -L[$OBJ/unix-1.fwd]:[$OBJ/unix-2.fwd] somehost sleep 10
${SSH} -S $CTL.1 -M -f -F $OBJ/ssh_config -L[$OBJ/unix-1.fwd]:[$OBJ/unix-2.fwd] somehost sleep 10 ${SSH} -S $CTL.2 -M -f -F $OBJ/ssh_config -R[$OBJ/unix-2.fwd]:[$OBJ/unix-3.fwd] somehost sleep 10
${SSH} -S $CTL.2 -M -f -F $OBJ/ssh_config -R[$OBJ/unix-2.fwd]:[$OBJ/unix-3.fwd] somehost sleep 10 ${SSH} -S $CTL.3 -M -f -F $OBJ/ssh_config -L[$OBJ/unix-3.fwd]:127.0.0.1:$PORT somehost sleep 10
${SSH} -S $CTL.3 -M -f -F $OBJ/ssh_config -L[$OBJ/unix-3.fwd]:127.0.0.1:$PORT somehost sleep 10 ${SSH} -F $OBJ/ssh_config -p${base}01 -o 'ConnectionAttempts=4' \
${SSH} -F $OBJ/ssh_config -p${base}01 -o 'ConnectionAttempts=4' \
somehost cat ${DATA} > ${COPY} somehost cat ${DATA} > ${COPY}
test -s ${COPY} || fail "failed copy ${DATA}" test -s ${COPY} || fail "failed copy ${DATA}"
cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}" cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
${SSH} -F $OBJ/ssh_config -S $CTL.1 -O exit somehost
${SSH} -F $OBJ/ssh_config -S $CTL.2 -O exit somehost
${SSH} -F $OBJ/ssh_config -S $CTL.3 -O exit somehost
${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
${SSH} -F $OBJ/ssh_config -S $CTL.1 -O exit somehost
${SSH} -F $OBJ/ssh_config -S $CTL.2 -O exit somehost
${SSH} -F $OBJ/ssh_config -S $CTL.3 -O exit somehost
done

9
regress/host-expand.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: host-expand.sh,v 1.4 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: host-expand.sh,v 1.5 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="expand %h and %n" tid="expand %h and %n"
@ -11,9 +11,6 @@ somehost
127.0.0.1 127.0.0.1
EOE EOE
for p in ${SSH_PROTOCOLS}; do ${SSH} -F $OBJ/ssh_proxy somehost true >$OBJ/actual
verbose "test $tid: proto $p" diff $OBJ/expect $OBJ/actual || fail "$tid"
${SSH} -F $OBJ/ssh_proxy -$p somehost true >$OBJ/actual
diff $OBJ/expect $OBJ/actual || fail "$tid proto $p"
done

4
regress/hostkey-agent.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: hostkey-agent.sh,v 1.6 2015/07/10 06:23:25 markus Exp $ # $OpenBSD: hostkey-agent.sh,v 1.7 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="hostkey agent" tid="hostkey agent"
@ -40,7 +40,7 @@ for ps in no yes; do
cp $OBJ/known_hosts.orig $OBJ/known_hosts cp $OBJ/known_hosts.orig $OBJ/known_hosts
SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'` SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "protocol $p privsep=$ps failed" fail "privsep=$ps failed"
fi fi
if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
fail "bad SSH_CONNECTION key type $k privsep=$ps" fail "bad SSH_CONNECTION key type $k privsep=$ps"

4
regress/integrity.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: integrity.sh,v 1.22 2017/04/28 04:16:27 dtucker Exp $ # $OpenBSD: integrity.sh,v 1.23 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="integrity" tid="integrity"
@ -46,7 +46,7 @@ for m in $macs; do
macopt="-m $m -c aes128-ctr" macopt="-m $m -c aes128-ctr"
fi fi
verbose "test $tid: $m @$off" verbose "test $tid: $m @$off"
${SSH} $macopt -2F $OBJ/ssh_proxy -o "$pxy" \ ${SSH} $macopt -F $OBJ/ssh_proxy -o "$pxy" \
-oServerAliveInterval=1 -oServerAliveCountMax=30 \ -oServerAliveInterval=1 -oServerAliveCountMax=30 \
999.999.999.999 'printf "%4096s" " "' >/dev/null 999.999.999.999 'printf "%4096s" " "' >/dev/null
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then

50
regress/key-options.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: key-options.sh,v 1.3 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: key-options.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="key options" tid="key options"
@ -8,64 +8,56 @@ authkeys="$OBJ/authorized_keys_${USER}"
cp $authkeys $origkeys cp $authkeys $origkeys
# Test command= forced command # Test command= forced command
for p in ${SSH_PROTOCOLS}; do for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do
for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do
sed "s/.*/$c &/" $origkeys >$authkeys sed "s/.*/$c &/" $origkeys >$authkeys
verbose "key option proto $p $c" verbose "key option $c"
r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost echo foo` r=`${SSH} -q -F $OBJ/ssh_proxy somehost echo foo`
if [ "$r" = "foo" ]; then if [ "$r" = "foo" ]; then
fail "key option forced command not restricted" fail "key option forced command not restricted"
fi fi
if [ "$r" != "bar" ]; then if [ "$r" != "bar" ]; then
fail "key option forced command not executed" fail "key option forced command not executed"
fi fi
done
done done
# Test no-pty # Test no-pty
sed 's/.*/no-pty &/' $origkeys >$authkeys sed 's/.*/no-pty &/' $origkeys >$authkeys
for p in ${SSH_PROTOCOLS}; do verbose "key option proto no-pty"
verbose "key option proto $p no-pty" r=`${SSH} -q -F $OBJ/ssh_proxy somehost tty`
r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost tty` if [ -f "$r" ]; then
if [ -f "$r" ]; then fail "key option failed no-pty (pty $r)"
fail "key option failed proto $p no-pty (pty $r)" fi
fi
done
# Test environment= # Test environment=
echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy
sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys
for p in ${SSH_PROTOCOLS}; do verbose "key option environment"
verbose "key option proto $p environment" r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo $FOO'`
r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo $FOO'` if [ "$r" != "bar" ]; then
if [ "$r" != "bar" ]; then
fail "key option environment not set" fail "key option environment not set"
fi fi
done
# Test from= restriction # Test from= restriction
start_sshd start_sshd
for p in ${SSH_PROTOCOLS}; do for f in 127.0.0.1 '127.0.0.0\/8'; do
for f in 127.0.0.1 '127.0.0.0\/8'; do
cat $origkeys >$authkeys cat $origkeys >$authkeys
${SSH} -$p -q -F $OBJ/ssh_proxy somehost true ${SSH} -q -F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "key option proto $p failed without restriction" fail "key option failed without restriction"
fi fi
sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys
from=`head -1 $authkeys | cut -f1 -d ' '` from=`head -1 $authkeys | cut -f1 -d ' '`
verbose "key option proto $p $from" verbose "key option $from"
r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo true'` r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo true'`
if [ "$r" = "true" ]; then if [ "$r" = "true" ]; then
fail "key option proto $p $from not restricted" fail "key option $from not restricted"
fi fi
r=`${SSH} -$p -q -F $OBJ/ssh_config somehost 'echo true'` r=`${SSH} -q -F $OBJ/ssh_config somehost 'echo true'`
if [ "$r" != "true" ]; then if [ "$r" != "true" ]; then
fail "key option proto $p $from not allowed but should be" fail "key option $from not allowed but should be"
fi fi
done
done done
rm -f "$origkeys" rm -f "$origkeys"

5
regress/keygen-change.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: keygen-change.sh,v 1.5 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: keygen-change.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="change passphrase for key" tid="change passphrase for key"
@ -7,9 +7,6 @@ S1="secret1"
S2="2secret" S2="2secret"
KEYTYPES=`${SSH} -Q key-plain` KEYTYPES=`${SSH} -Q key-plain`
if ssh_version 1; then
KEYTYPES="${KEYTYPES} rsa1"
fi
for t in $KEYTYPES; do for t in $KEYTYPES; do
# generate user key for agent # generate user key for agent

6
regress/keyscan.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: keyscan.sh,v 1.5 2015/09/11 03:44:21 djm Exp $ # $OpenBSD: keyscan.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="keyscan" tid="keyscan"
@ -9,10 +9,6 @@ rm -f ${OBJ}/host.dsa
start_sshd start_sshd
KEYTYPES=`${SSH} -Q key-plain` KEYTYPES=`${SSH} -Q key-plain`
if ssh_version 1; then
KEYTYPES="${KEYTYPES} rsa1"
fi
for t in $KEYTYPES; do for t in $KEYTYPES; do
trace "keyscan type $t" trace "keyscan type $t"
${SSHKEYSCAN} -t $t -p $PORT 127.0.0.1 127.0.0.1 127.0.0.1 \ ${SSHKEYSCAN} -t $t -p $PORT 127.0.0.1 127.0.0.1 127.0.0.1 \

12
regress/localcommand.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: localcommand.sh,v 1.3 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: localcommand.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="localcommand" tid="localcommand"
@ -6,10 +6,8 @@ tid="localcommand"
echo 'PermitLocalCommand yes' >> $OBJ/ssh_proxy echo 'PermitLocalCommand yes' >> $OBJ/ssh_proxy
echo 'LocalCommand echo foo' >> $OBJ/ssh_proxy echo 'LocalCommand echo foo' >> $OBJ/ssh_proxy
for p in ${SSH_PROTOCOLS}; do verbose "test $tid: proto $p localcommand"
verbose "test $tid: proto $p localcommand" a=`${SSH} -F $OBJ/ssh_proxy somehost true`
a=`${SSH} -F $OBJ/ssh_proxy -$p somehost true` if [ "$a" != "foo" ] ; then
if [ "$a" != "foo" ] ; then
fail "$tid proto $p" fail "$tid proto $p"
fi fi
done

4
regress/misc/kexfuzz/kexfuzz.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: kexfuzz.c,v 1.3 2016/10/11 21:49:54 djm Exp $ */ /* $OpenBSD: kexfuzz.c,v 1.4 2017/04/30 23:34:55 djm Exp $ */
/* /*
* Fuzz harness for KEX code * Fuzz harness for KEX code
* *
@ -418,7 +418,7 @@ main(int argc, char **argv)
close(fd); close(fd);
/* XXX check that it is a private key */ /* XXX check that it is a private key */
/* XXX support certificates */ /* XXX support certificates */
if (key == NULL || key->type == KEY_UNSPEC || key->type == KEY_RSA1) if (key == NULL || key->type == KEY_UNSPEC)
badusage("Invalid key file (-k flag)"); badusage("Invalid key file (-k flag)");
/* Replace (fuzz) mode */ /* Replace (fuzz) mode */

6
regress/multiplex.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: multiplex.sh,v 1.27 2014/12/22 06:14:29 djm Exp $ # $OpenBSD: multiplex.sh,v 1.28 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
CTL=/tmp/openssh.regress.ctl-sock.$$ CTL=/tmp/openssh.regress.ctl-sock.$$
@ -101,7 +101,7 @@ for s in 0 1 4 5 44; do
${SSH} -F $OBJ/ssh_config -S $CTL otherhost exit $s ${SSH} -F $OBJ/ssh_config -S $CTL otherhost exit $s
r=$? r=$?
if [ $r -ne $s ]; then if [ $r -ne $s ]; then
fail "exit code mismatch for protocol $p: $r != $s" fail "exit code mismatch: $r != $s"
fi fi
# same with early close of stdout/err # same with early close of stdout/err
@ -110,7 +110,7 @@ for s in 0 1 4 5 44; do
exec sh -c \'"sleep 2; exec > /dev/null 2>&1; sleep 3; exit $s"\' exec sh -c \'"sleep 2; exec > /dev/null 2>&1; sleep 3; exit $s"\'
r=$? r=$?
if [ $r -ne $s ]; then if [ $r -ne $s ]; then
fail "exit code (with sleep) mismatch for protocol $p: $r != $s" fail "exit code (with sleep) mismatch: $r != $s"
fi fi
done done

18
regress/principals-command.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: principals-command.sh,v 1.3 2016/09/26 21:34:38 bluhm Exp $ # $OpenBSD: principals-command.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="authorized principals command" tid="authorized principals command"
@ -78,7 +78,7 @@ if [ -x $PRINCIPALS_COMMAND ]; then
# Empty authorized_principals # Empty authorized_principals
verbose "$tid: ${_prefix} empty authorized_principals" verbose "$tid: ${_prefix} empty authorized_principals"
echo > $OBJ/authorized_principals_$USER echo > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -87,7 +87,7 @@ if [ -x $PRINCIPALS_COMMAND ]; then
# Wrong authorized_principals # Wrong authorized_principals
verbose "$tid: ${_prefix} wrong authorized_principals" verbose "$tid: ${_prefix} wrong authorized_principals"
echo gregorsamsa > $OBJ/authorized_principals_$USER echo gregorsamsa > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -96,7 +96,7 @@ if [ -x $PRINCIPALS_COMMAND ]; then
# Correct authorized_principals # Correct authorized_principals
verbose "$tid: ${_prefix} correct authorized_principals" verbose "$tid: ${_prefix} correct authorized_principals"
echo mekmitasdigoat > $OBJ/authorized_principals_$USER echo mekmitasdigoat > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cert connect failed" fail "ssh cert connect failed"
@ -105,7 +105,7 @@ if [ -x $PRINCIPALS_COMMAND ]; then
# authorized_principals with bad key option # authorized_principals with bad key option
verbose "$tid: ${_prefix} authorized_principals bad key opt" verbose "$tid: ${_prefix} authorized_principals bad key opt"
echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -115,7 +115,7 @@ if [ -x $PRINCIPALS_COMMAND ]; then
verbose "$tid: ${_prefix} authorized_principals command=false" verbose "$tid: ${_prefix} authorized_principals command=false"
echo 'command="false" mekmitasdigoat' > \ echo 'command="false" mekmitasdigoat' > \
$OBJ/authorized_principals_$USER $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -125,7 +125,7 @@ if [ -x $PRINCIPALS_COMMAND ]; then
verbose "$tid: ${_prefix} authorized_principals command=true" verbose "$tid: ${_prefix} authorized_principals command=true"
echo 'command="true" mekmitasdigoat' > \ echo 'command="true" mekmitasdigoat' > \
$OBJ/authorized_principals_$USER $OBJ/authorized_principals_$USER
${SSH} -2i $OBJ/cert_user_key \ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost false >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cert connect failed" fail "ssh cert connect failed"
@ -144,7 +144,7 @@ if [ -x $PRINCIPALS_COMMAND ]; then
printf 'cert-authority,principals="gregorsamsa" ' printf 'cert-authority,principals="gregorsamsa" '
cat $OBJ/user_ca_key.pub cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER ) > $OBJ/authorized_keys_$USER
${SSH} -2i $OBJ/cert_user_key \ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly" fail "ssh cert connect succeeded unexpectedly"
@ -156,7 +156,7 @@ if [ -x $PRINCIPALS_COMMAND ]; then
printf 'cert-authority,principals="mekmitasdigoat" ' printf 'cert-authority,principals="mekmitasdigoat" '
cat $OBJ/user_ca_key.pub cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER ) > $OBJ/authorized_keys_$USER
${SSH} -2i $OBJ/cert_user_key \ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cert connect failed" fail "ssh cert connect failed"

12
regress/proto-mismatch.sh
View File

@ -1,21 +1,17 @@
# $OpenBSD: proto-mismatch.sh,v 1.4 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: proto-mismatch.sh,v 1.5 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="protocol version mismatch" tid="protocol version mismatch"
mismatch () mismatch ()
{ {
server=$1
client=$2 client=$2
banner=`echo ${client} | ${SSHD} -o "Protocol=${server}" -i -f ${OBJ}/sshd_proxy` banner=`echo ${client} | ${SSHD} -i -f ${OBJ}/sshd_proxy`
r=$? r=$?
trace "sshd prints ${banner}" trace "sshd prints ${banner}"
if [ $r -ne 255 ]; then if [ $r -ne 255 ]; then
fail "sshd prints ${banner} and accepts connect with version ${client}" fail "sshd prints ${banner} but accepts version ${client}"
fi fi
} }
mismatch 2 SSH-1.5-HALLO mismatch SSH-1.5-HALLO
if ssh_version 1; then
mismatch 1 SSH-2.0-HALLO
fi

14
regress/proto-version.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: proto-version.sh,v 1.5 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: proto-version.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="sshd version with different protocol combinations" tid="sshd version with different protocol combinations"
@ -6,9 +6,8 @@ tid="sshd version with different protocol combinations"
# we just start sshd in inetd mode and check the banner # we just start sshd in inetd mode and check the banner
check_version () check_version ()
{ {
version=$1
expect=$2 expect=$2
banner=`printf '' | ${SSHD} -o "Protocol=${version}" -i -f ${OBJ}/sshd_proxy` banner=`printf '' | ${SSHD} -i -f ${OBJ}/sshd_proxy`
case ${banner} in case ${banner} in
SSH-1.99-*) SSH-1.99-*)
proto=199 proto=199
@ -24,13 +23,8 @@ check_version ()
;; ;;
esac esac
if [ ${expect} -ne ${proto} ]; then if [ ${expect} -ne ${proto} ]; then
fail "wrong protocol version ${banner} for ${version}" fail "wrong protocol version ${banner}"
fi fi
} }
check_version 2 20 check_version 20
if ssh_version 1; then
check_version 2,1 199
check_version 1,2 199
check_version 1 15
fi

21
regress/proxy-connect.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: proxy-connect.sh,v 1.9 2016/02/17 02:24:17 djm Exp $ # $OpenBSD: proxy-connect.sh,v 1.10 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="proxy connect" tid="proxy connect"
@ -8,25 +8,20 @@ mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
for ps in no yes; do for ps in no yes; do
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
for p in ${SSH_PROTOCOLS}; do
for c in no yes; do for c in no yes; do
verbose "plain username protocol $p privsep=$ps comp=$c" verbose "plain username privsep=$ps comp=$c"
opts="-$p -oCompression=$c -F $OBJ/ssh_proxy" opts="-oCompression=$c -F $OBJ/ssh_proxy"
SSH_CONNECTION=`${SSH} $opts 999.999.999.999 'echo $SSH_CONNECTION'` SSH_CONNECTION=`${SSH} $opts 999.999.999.999 'echo $SSH_CONNECTION'`
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh proxyconnect protocol $p privsep=$ps comp=$c failed" fail "ssh proxyconnect privsep=$ps comp=$c failed"
fi fi
if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
fail "bad SSH_CONNECTION protocol $p privsep=$ps comp=$c: " \ fail "bad SSH_CONNECTION privsep=$ps comp=$c: " \
"$SSH_CONNECTION" "$SSH_CONNECTION"
fi fi
done done
done
done done
for p in ${SSH_PROTOCOLS}; do verbose "username with style"
verbose "username with style protocol $p" ${SSH} -F $OBJ/ssh_proxy ${USER}:style@999.999.999.999 true || \
${SSH} -$p -F $OBJ/ssh_proxy ${USER}:style@999.999.999.999 true || \ fail "ssh proxyconnect failed"
fail "ssh proxyconnect protocol $p failed"
done

15
regress/putty-transfer.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: putty-transfer.sh,v 1.4 2016/11/25 03:02:01 dtucker Exp $ # $OpenBSD: putty-transfer.sh,v 1.5 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="putty transfer data" tid="putty transfer data"
@ -8,34 +8,31 @@ if test "x$REGRESS_INTEROP_PUTTY" != "xyes" ; then
exit 0 exit 0
fi fi
# XXX support protocol 1 too for c in 0 1 ; do
for p in 2; do verbose "$tid: compression $c"
for c in 0 1 ; do
verbose "$tid: proto $p compression $c"
rm -f ${COPY} rm -f ${COPY}
cp ${OBJ}/.putty/sessions/localhost_proxy \ cp ${OBJ}/.putty/sessions/localhost_proxy \
${OBJ}/.putty/sessions/compression_$c ${OBJ}/.putty/sessions/compression_$c
echo "Compression=$c" >> ${OBJ}/.putty/sessions/kex_$k echo "Compression=$c" >> ${OBJ}/.putty/sessions/kex_$k
env HOME=$PWD ${PLINK} -load compression_$c -batch \ env HOME=$PWD ${PLINK} -load compression_$c -batch \
-i putty.rsa$p cat ${DATA} > ${COPY} -i putty.rsa cat ${DATA} > ${COPY}
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cat $DATA failed" fail "ssh cat $DATA failed"
fi fi
cmp ${DATA} ${COPY} || fail "corrupted copy" cmp ${DATA} ${COPY} || fail "corrupted copy"
for s in 10 100 1k 32k 64k 128k 256k; do for s in 10 100 1k 32k 64k 128k 256k; do
trace "proto $p compression $c dd-size ${s}" trace "compression $c dd-size ${s}"
rm -f ${COPY} rm -f ${COPY}
dd if=$DATA obs=${s} 2> /dev/null | \ dd if=$DATA obs=${s} 2> /dev/null | \
env HOME=$PWD ${PLINK} -load compression_$c \ env HOME=$PWD ${PLINK} -load compression_$c \
-batch -i putty.rsa$p \ -batch -i putty.rsa \
"cat > ${COPY}" "cat > ${COPY}"
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cat $DATA failed" fail "ssh cat $DATA failed"
fi fi
cmp $DATA ${COPY} || fail "corrupted copy" cmp $DATA ${COPY} || fail "corrupted copy"
done done
done
done done
rm -f ${COPY} rm -f ${COPY}

22
regress/reconfigure.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: reconfigure.sh,v 1.5 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: reconfigure.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="simple connect after reconfigure" tid="simple connect after reconfigure"
@ -18,12 +18,10 @@ fi
start_sshd start_sshd
trace "connect before restart" trace "connect before restart"
for p in ${SSH_PROTOCOLS} ; do ${SSH} -F $OBJ/ssh_config somehost true
${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true if [ $? -ne 0 ]; then
if [ $? -ne 0 ]; then fail "ssh connect with failed before reconfigure"
fail "ssh connect with protocol $p failed before reconfigure" fi
fi
done
PID=`$SUDO cat $PIDFILE` PID=`$SUDO cat $PIDFILE`
rm -f $PIDFILE rm -f $PIDFILE
@ -39,9 +37,7 @@ done
test -f $PIDFILE || fatal "sshd did not restart" test -f $PIDFILE || fatal "sshd did not restart"
trace "connect after restart" trace "connect after restart"
for p in ${SSH_PROTOCOLS} ; do ${SSH} -F $OBJ/ssh_config somehost true
${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true if [ $? -ne 0 ]; then
if [ $? -ne 0 ]; then fail "ssh connect with failed after reconfigure"
fail "ssh connect with protocol $p failed after reconfigure" fi
fi
done

7
regress/reexec.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: reexec.sh,v 1.10 2016/12/16 01:06:27 dtucker Exp $ # $OpenBSD: reexec.sh,v 1.11 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="reexec tests" tid="reexec tests"
@ -19,16 +19,13 @@ start_sshd_copy ()
copy_tests () copy_tests ()
{ {
rm -f ${COPY} rm -f ${COPY}
for p in ${SSH_PROTOCOLS} ; do ${SSH} -nq -F $OBJ/ssh_config somehost \
verbose "$tid: proto $p"
${SSH} -nqo "Protocol=$p" -F $OBJ/ssh_config somehost \
cat ${DATA} > ${COPY} cat ${DATA} > ${COPY}
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cat $DATA failed" fail "ssh cat $DATA failed"
fi fi
cmp ${DATA} ${COPY} || fail "corrupted copy" cmp ${DATA} ${COPY} || fail "corrupted copy"
rm -f ${COPY} rm -f ${COPY}
done
} }
verbose "test config passing" verbose "test config passing"

4
regress/stderr-after-eof.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: stderr-after-eof.sh,v 1.2 2013/05/17 04:29:14 dtucker Exp $ # $OpenBSD: stderr-after-eof.sh,v 1.3 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="stderr data after eof" tid="stderr data after eof"
@ -10,7 +10,7 @@ for i in 1 2 3 4 5 6; do
(date;echo $i) | md5 >> ${DATA} (date;echo $i) | md5 >> ${DATA}
done done
${SSH} -2 -F $OBJ/ssh_proxy otherhost \ ${SSH} -F $OBJ/ssh_proxy otherhost \
exec sh -c \'"exec > /dev/null; sleep 2; cat ${DATA} 1>&2 $s"\' \ exec sh -c \'"exec > /dev/null; sleep 2; cat ${DATA} 1>&2 $s"\' \
2> ${COPY} 2> ${COPY}
r=$? r=$?

14
regress/stderr-data.sh
View File

@ -1,13 +1,12 @@
# $OpenBSD: stderr-data.sh,v 1.4 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: stderr-data.sh,v 1.5 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="stderr data transfer" tid="stderr data transfer"
for n in '' -n; do for n in '' -n; do
for p in ${SSH_PROTOCOLS}; do verbose "test $tid: ($n)"
verbose "test $tid: proto $p ($n)" ${SSH} $n -F $OBJ/ssh_proxy otherhost exec \
${SSH} $n -$p -F $OBJ/ssh_proxy otherhost \ sh -c \'"exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \
exec sh -c \'"exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \
2> ${COPY} 2> ${COPY}
r=$? r=$?
if [ $r -ne 0 ]; then if [ $r -ne 0 ]; then
@ -16,8 +15,8 @@ for p in ${SSH_PROTOCOLS}; do
cmp ${DATA} ${COPY} || fail "stderr corrupt" cmp ${DATA} ${COPY} || fail "stderr corrupt"
rm -f ${COPY} rm -f ${COPY}
${SSH} $n -$p -F $OBJ/ssh_proxy otherhost \ ${SSH} $n -F $OBJ/ssh_proxy otherhost exec \
exec sh -c \'"echo a; exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \ sh -c \'"echo a; exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \
> /dev/null 2> ${COPY} > /dev/null 2> ${COPY}
r=$? r=$?
if [ $r -ne 0 ]; then if [ $r -ne 0 ]; then
@ -26,4 +25,3 @@ for p in ${SSH_PROTOCOLS}; do
cmp ${DATA} ${COPY} || fail "stderr corrupt" cmp ${DATA} ${COPY} || fail "stderr corrupt"
rm -f ${COPY} rm -f ${COPY}
done done
done

26
regress/test-exec.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: test-exec.sh,v 1.59 2017/02/07 23:03:11 dtucker Exp $ # $OpenBSD: test-exec.sh,v 1.60 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
#SUDO=sudo #SUDO=sudo
@ -130,12 +130,6 @@ if [ "x$TEST_SSH_CONCH" != "x" ]; then
esac esac
fi fi
SSH_PROTOCOLS=2
#SSH_PROTOCOLS=`$SSH -Q protocol-version`
if [ "x$TEST_SSH_PROTOCOLS" != "x" ]; then
SSH_PROTOCOLS="${TEST_SSH_PROTOCOLS}"
fi
# Path to sshd must be absolute for rexec # Path to sshd must be absolute for rexec
case "$SSHD" in case "$SSHD" in
/*) ;; /*) ;;
@ -386,22 +380,11 @@ fatal ()
exit $RESULT exit $RESULT
} }
ssh_version ()
{
echo ${SSH_PROTOCOLS} | grep "$1" >/dev/null
}
RESULT=0 RESULT=0
PIDFILE=$OBJ/pidfile PIDFILE=$OBJ/pidfile
trap fatal 3 2 trap fatal 3 2
if ssh_version 1; then
PROTO="2,1"
else
PROTO="2"
fi
# create server config # create server config
cat << EOF > $OBJ/sshd_config cat << EOF > $OBJ/sshd_config
StrictModes no StrictModes no
@ -460,11 +443,8 @@ fi
rm -f $OBJ/known_hosts $OBJ/authorized_keys_$USER rm -f $OBJ/known_hosts $OBJ/authorized_keys_$USER
if ssh_version 1; then SSH_KEYTYPES="rsa ed25519"
SSH_KEYTYPES="rsa rsa1"
else
SSH_KEYTYPES="rsa ed25519"
fi
trace "generate keys" trace "generate keys"
for t in ${SSH_KEYTYPES}; do for t in ${SSH_KEYTYPES}; do
# generate user key # generate user key

21
regress/transfer.sh
View File

@ -1,26 +1,23 @@
# $OpenBSD: transfer.sh,v 1.3 2015/03/03 22:35:19 markus Exp $ # $OpenBSD: transfer.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="transfer data" tid="transfer data"
for p in ${SSH_PROTOCOLS}; do rm -f ${COPY}
verbose "$tid: proto $p" ${SSH} -n -q -F $OBJ/ssh_proxy somehost cat ${DATA} > ${COPY}
rm -f ${COPY} if [ $? -ne 0 ]; then
${SSH} -n -q -$p -F $OBJ/ssh_proxy somehost cat ${DATA} > ${COPY}
if [ $? -ne 0 ]; then
fail "ssh cat $DATA failed" fail "ssh cat $DATA failed"
fi fi
cmp ${DATA} ${COPY} || fail "corrupted copy" cmp ${DATA} ${COPY} || fail "corrupted copy"
for s in 10 100 1k 32k 64k 128k 256k; do for s in 10 100 1k 32k 64k 128k 256k; do
trace "proto $p dd-size ${s}" trace "dd-size ${s}"
rm -f ${COPY} rm -f ${COPY}
dd if=$DATA obs=${s} 2> /dev/null | \ dd if=$DATA obs=${s} 2> /dev/null | \
${SSH} -q -$p -F $OBJ/ssh_proxy somehost "cat > ${COPY}" ${SSH} -q -F $OBJ/ssh_proxy somehost "cat > ${COPY}"
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh cat $DATA failed" fail "ssh cat $DATA failed"
fi fi
cmp $DATA ${COPY} || fail "corrupted copy" cmp $DATA ${COPY} || fail "corrupted copy"
done
done done
rm -f ${COPY} rm -f ${COPY}

24
regress/try-ciphers.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: try-ciphers.sh,v 1.25 2015/03/24 20:22:17 markus Exp $ # $OpenBSD: try-ciphers.sh,v 1.26 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="try ciphers" tid="try ciphers"
@ -8,14 +8,14 @@ cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
for c in `${SSH} -Q cipher`; do for c in `${SSH} -Q cipher`; do
n=0 n=0
for m in `${SSH} -Q mac`; do for m in `${SSH} -Q mac`; do
trace "proto 2 cipher $c mac $m" trace "cipher $c mac $m"
verbose "test $tid: proto 2 cipher $c mac $m" verbose "test $tid: cipher $c mac $m"
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "Ciphers=$c" >> $OBJ/sshd_proxy echo "Ciphers=$c" >> $OBJ/sshd_proxy
echo "MACs=$m" >> $OBJ/sshd_proxy echo "MACs=$m" >> $OBJ/sshd_proxy
${SSH} -F $OBJ/ssh_proxy -2 -m $m -c $c somehost true ${SSH} -F $OBJ/ssh_proxy -m $m -c $c somehost true
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
fail "ssh -2 failed with mac $m cipher $c" fail "ssh failed with mac $m cipher $c"
fi fi
# No point trying all MACs for AEAD ciphers since they # No point trying all MACs for AEAD ciphers since they
# are ignored. # are ignored.
@ -26,17 +26,3 @@ for c in `${SSH} -Q cipher`; do
done done
done done
if ssh_version 1; then
ciphers="3des blowfish"
else
ciphers=""
fi
for c in $ciphers; do
trace "proto 1 cipher $c"
verbose "test $tid: proto 1 cipher $c"
${SSH} -F $OBJ/ssh_proxy -1 -c $c somehost true
if [ $? -ne 0 ]; then
fail "ssh -1 failed with cipher $c"
fi
done

12
regress/yes-head.sh
View File

@ -3,13 +3,11 @@
tid="yes pipe head" tid="yes pipe head"
for p in ${SSH_PROTOCOLS}; do lines=`${SSH} -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -2000"' | (sleep 3 ; wc -l)`
lines=`${SSH} -$p -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -2000"' | (sleep 3 ; wc -l)` if [ $? -ne 0 ]; then
if [ $? -ne 0 ]; then
fail "yes|head test failed" fail "yes|head test failed"
lines = 0; lines = 0;
fi fi
if [ $lines -ne 2000 ]; then if [ $lines -ne 2000 ]; then
fail "yes|head returns $lines lines instead of 2000" fail "yes|head returns $lines lines instead of 2000"
fi fi
done