upstream commit

Adapt tests, now that DSA if off by default; use
 PubkeyAcceptedKeyTypes and PubkeyAcceptedKeyTypes to test DSA.

Upstream-Regress-ID: 0ff2a3ff5ac1ce5f92321d27aa07b98656efcc5c

diff --git a/regress/cert-hostkey.sh b/regress/cert-hostkey.sh
index c99c2b1c36de0ac83db42306540123da5ff40b94..3f53922c89e034fffb47d7ab1993f094c41ca223 100644 (file)
--- a/regress/cert-hostkey.sh
+++ b/regress/cert-hostkey.sh
@@ -1,11 +1,32 @@
-#      $OpenBSD: cert-hostkey.sh,v 1.12 2015/07/03 04:39:23 djm Exp $
+#      $OpenBSD: cert-hostkey.sh,v 1.13 2015/07/10 06:23:25 markus Exp $
 #      Placed in the Public Domain.
 
 tid="certified host keys"
 
 rm -f $OBJ/known_hosts-cert* $OBJ/host_ca_key* $OBJ/host_revoked_*
 rm -f $OBJ/cert_host_key* $OBJ/host_krl_*
+
+# Allow all hostkey/pubkey types, prefer certs for the client
+types=""
+for i in `$SSH -Q key`; do
+       if [ -z "$types" ]; then
+               types="$i"
+               continue
+       fi
+       case "$i" in
+       *cert*) types="$i,$types";;
+       *)      types="$types,$i";;
+       esac
+done
+(
+       echo "HostKeyAlgorithms ${types}"
+       echo "PubkeyAcceptedKeyTypes *"
+) >> $OBJ/ssh_proxy
 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
+(
+       echo "HostKeyAlgorithms *"
+       echo "PubkeyAcceptedKeyTypes *"
+) >> $OBJ/sshd_proxy_bak
 
 HOSTS='localhost-with-alias,127.0.0.1,::1'
 

diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh
index d461b9e34ca5b65a7d2258a73ee385af931d99d4..739a036e2f67eaeb74a41fdacd73e41700c20586 100644 (file)
--- a/regress/cert-userkey.sh
+++ b/regress/cert-userkey.sh
@@ -1,13 +1,19 @@
-#      $OpenBSD: cert-userkey.sh,v 1.13 2015/07/03 04:39:23 djm Exp $
+#      $OpenBSD: cert-userkey.sh,v 1.14 2015/07/10 06:23:25 markus Exp $
 #      Placed in the Public Domain.
 
 tid="certified user keys"
 
 rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
+cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
 
 PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/;s/^ssh-//'`
 
+kname() {
+       echo -n $1 | sed 's/^dsa/ssh-dss/;s/^rsa/ssh-rsa/;s/^ed/ssh-ed/'
+       echo "*,ssh-rsa*,ssh-ed25519*"
+}
+
 # Create a CA key
 ${SSHKEYGEN} -q -N '' -t rsa  -f $OBJ/user_ca_key ||\
        fail "ssh-keygen of user_ca_key failed"
@@ -25,6 +31,7 @@ done
 
 # Test explicitly-specified principals
 for ktype in $PLAIN_TYPES ; do 
+       t=$(kname $ktype)
        for privsep in yes no ; do
                _prefix="${ktype} privsep $privsep"
 
@@ -36,7 +43,12 @@ for ktype in $PLAIN_TYPES ; do
                        echo "AuthorizedPrincipalsFile " \
                            "$OBJ/authorized_principals_%u"
                        echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
+                       echo "PubkeyAcceptedKeyTypes ${t}"
                ) > $OBJ/sshd_proxy
+               (
+                       cat $OBJ/ssh_proxy_bak
+                       echo "PubkeyAcceptedKeyTypes ${t}"
+               ) > $OBJ/ssh_proxy
 
                # Missing authorized_principals
                verbose "$tid: ${_prefix} missing authorized_principals"
@@ -109,7 +121,12 @@ for ktype in $PLAIN_TYPES ; do
                (
                        cat $OBJ/sshd_proxy_bak
                        echo "UsePrivilegeSeparation $privsep"
+                       echo "PubkeyAcceptedKeyTypes ${t}"
                ) > $OBJ/sshd_proxy
+               (
+                       cat $OBJ/ssh_proxy_bak
+                       echo "PubkeyAcceptedKeyTypes ${t}"
+               ) > $OBJ/ssh_proxy
 
                # Wrong principals list
                verbose "$tid: ${_prefix} wrong principals key option"
@@ -151,6 +168,7 @@ basic_tests() {
        fi
        
        for ktype in $PLAIN_TYPES ; do 
+               t=$(kname $ktype)
                for privsep in yes no ; do
                        _prefix="${ktype} privsep $privsep $auth"
                        # Simple connect
@@ -158,8 +176,13 @@ basic_tests() {
                        (
                                cat $OBJ/sshd_proxy_bak
                                echo "UsePrivilegeSeparation $privsep"
+                               echo "PubkeyAcceptedKeyTypes ${t}"
                                echo "$extra_sshd"
                        ) > $OBJ/sshd_proxy
+                       (
+                               cat $OBJ/ssh_proxy_bak
+                               echo "PubkeyAcceptedKeyTypes ${t}"
+                       ) > $OBJ/ssh_proxy
        
                        ${SSH} -2i $OBJ/cert_user_key_${ktype} \
                            -F $OBJ/ssh_proxy somehost true
@@ -173,6 +196,7 @@ basic_tests() {
                                cat $OBJ/sshd_proxy_bak
                                echo "UsePrivilegeSeparation $privsep"
                                echo "RevokedKeys $OBJ/cert_user_key_revoked"
+                               echo "PubkeyAcceptedKeyTypes ${t}"
                                echo "$extra_sshd"
                        ) > $OBJ/sshd_proxy
                        cp $OBJ/cert_user_key_${ktype}.pub \
@@ -205,6 +229,7 @@ basic_tests() {
                (
                        cat $OBJ/sshd_proxy_bak
                        echo "RevokedKeys $OBJ/user_ca_key.pub"
+                       echo "PubkeyAcceptedKeyTypes ${t}"
                        echo "$extra_sshd"
                ) > $OBJ/sshd_proxy
                ${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
@@ -217,6 +242,7 @@ basic_tests() {
        verbose "$tid: $auth CA does not authenticate"
        (
                cat $OBJ/sshd_proxy_bak
+               echo "PubkeyAcceptedKeyTypes ${t}"
                echo "$extra_sshd"
        ) > $OBJ/sshd_proxy
        verbose "$tid: ensure CA key does not authenticate user"
@@ -254,6 +280,8 @@ test_one() {
                                echo > $OBJ/authorized_keys_$USER
                                echo "TrustedUserCAKeys $OBJ/user_ca_key.pub" \
                                    >> $OBJ/sshd_proxy
+                               echo "PubkeyAcceptedKeyTypes ${t}*" \
+                                   >> $OBJ/sshd_proxy
                                if test "x$auth_opt" != "x" ; then
                                        echo $auth_opt >> $OBJ/sshd_proxy
                                fi
@@ -315,6 +343,7 @@ test_one "principals key option no principals" failure "" \
 # Wrong certificate
 cat $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
 for ktype in $PLAIN_TYPES ; do 
+       t=$(kname $ktype)
        # Self-sign
        ${SSHKEYGEN} -q -s $OBJ/cert_user_key_${ktype} -I \
            "regress user key for $USER" \

diff --git a/regress/hostkey-agent.sh b/regress/hostkey-agent.sh
index a011ec83107fcdb7d1fefbd26936d274abf7b5b4..094700da62f7f01c674d8f89541668986e17f95f 100644 (file)
--- a/regress/hostkey-agent.sh
+++ b/regress/hostkey-agent.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: hostkey-agent.sh,v 1.5 2015/02/21 20:51:02 djm Exp $
+#      $OpenBSD: hostkey-agent.sh,v 1.6 2015/07/10 06:23:25 markus Exp $
 #      Placed in the Public Domain.
 
 tid="hostkey agent"
@@ -31,10 +31,11 @@ cp $OBJ/known_hosts.orig $OBJ/known_hosts
 unset SSH_AUTH_SOCK
 
 for ps in no yes; do
-       cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
-       echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
        for k in `${SSH} -Q key-plain` ; do
                verbose "key type $k privsep=$ps"
+               cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
+               echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
+               echo "HostKeyAlgorithms $k" >> $OBJ/sshd_proxy
                opts="-oHostKeyAlgorithms=$k -F $OBJ/ssh_proxy"
                cp $OBJ/known_hosts.orig $OBJ/known_hosts
                SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`

diff --git a/regress/hostkey-rotate.sh b/regress/hostkey-rotate.sh
index cde6008f4623d37d35afd66f2cf3499e7e9e8eee..3aa8c40c0adf4ed86aed5c8b6ee9c6a6d44d5e95 100644 (file)
--- a/regress/hostkey-rotate.sh
+++ b/regress/hostkey-rotate.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: hostkey-rotate.sh,v 1.3 2015/03/24 20:22:17 markus Exp $
+#      $OpenBSD: hostkey-rotate.sh,v 1.4 2015/07/10 06:23:25 markus Exp $
 #      Placed in the Public Domain.
 
 tid="hostkey rotate"
@@ -56,7 +56,7 @@ check_key_present ssh-ed25519 || fail "unstrict didn't learn key"
 
 # Connect to sshd as usual
 verbose "learn additional hostkeys"
-dossh -oStrictHostKeyChecking=yes
+dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs
 # Check that other keys learned
 expect_nkeys $nkeys "learn hostkeys"
 check_key_present ssh-rsa || fail "didn't learn keys"
@@ -74,7 +74,7 @@ verbose "learn changed non-primary hostkey"
 mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
 rm -f $OBJ/hkr.ssh-rsa
 ${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa -N '' || fatal "ssh-keygen $k"
-dossh -oStrictHostKeyChecking=yes
+dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$all_algs
 # Check that the key was replaced
 expect_nkeys $nkeys "learn hostkeys"
 check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
@@ -109,7 +109,7 @@ dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa
 expect_nkeys 1 "learn hostkeys"
 check_key_present ssh-rsa || fail "didn't learn changed key"
 
-#      $OpenBSD: hostkey-rotate.sh,v 1.3 2015/03/24 20:22:17 markus Exp $
+#      $OpenBSD: hostkey-rotate.sh,v 1.4 2015/07/10 06:23:25 markus Exp $
 #      Placed in the Public Domain.
 
 tid="hostkey rotate"

diff --git a/regress/keytype.sh b/regress/keytype.sh
index 9752acb0a080b0a5d88581ccbcd553b3c8d850bb..8f697788f8656efc2b0fdfc4b1c46312916ac9b4 100644 (file)
--- a/regress/keytype.sh
+++ b/regress/keytype.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: keytype.sh,v 1.3 2013/12/06 13:52:46 markus Exp $
+#      $OpenBSD: keytype.sh,v 1.4 2015/07/10 06:23:25 markus Exp $
 #      Placed in the Public Domain.
 
 tid="login with different key types"
@@ -36,14 +36,26 @@ for ut in $ktypes; do
        htypes=$ut
        #htypes=$ktypes
        for ht in $htypes; do 
+               case $ht in
+               dsa-1024)       t=ssh-dss;;
+               ecdsa-256)      t=ecdsa-sha2-nistp256;;
+               ecdsa-384)      t=ecdsa-sha2-nistp384;;
+               ecdsa-521)      t=ecdsa-sha2-nistp521;;
+               ed25519-512)    t=ssh-ed25519;;
+               rsa-*)          t=ssh-rsa;;
+               esac
                trace "ssh connect, userkey $ut, hostkey $ht"
                (
                        grep -v HostKey $OBJ/sshd_proxy_bak
                        echo HostKey $OBJ/key.$ht 
+                       echo PubkeyAcceptedKeyTypes $t
+                       echo HostKeyAlgorithms $t
                ) > $OBJ/sshd_proxy
                (
                        grep -v IdentityFile $OBJ/ssh_proxy_bak
                        echo IdentityFile $OBJ/key.$ut 
+                       echo PubkeyAcceptedKeyTypes $t
+                       echo HostKeyAlgorithms $t
                ) > $OBJ/ssh_proxy
                (
                        printf 'localhost-with-alias,127.0.0.1,::1 '

diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c
index c61e2bdbb2704a731e55ffaa03655d76b657551b..6e5999bb9edd9e6ce8abcf02a01643cd7a1992f1 100644 (file)
--- a/regress/unittests/kex/test_kex.c
+++ b/regress/unittests/kex/test_kex.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: test_kex.c,v 1.1 2015/01/15 23:41:29 markus Exp $ */
+/*     $OpenBSD: test_kex.c,v 1.2 2015/07/10 06:23:25 markus Exp $ */
 /*
  * Regress test KEX
  *
@@ -85,6 +85,7 @@ do_kex_with_key(char *kex, int keytype, int bits)
        struct sshbuf *state;
        struct kex_params kex_params;
        char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
+       char *keyname = NULL;
 
        TEST_START("sshkey_generate");
        ASSERT_INT_EQ(sshkey_generate(keytype, bits, &private), 0);
@@ -98,6 +99,9 @@ do_kex_with_key(char *kex, int keytype, int bits)
        memcpy(kex_params.proposal, myproposal, sizeof(myproposal));
        if (kex != NULL)
                kex_params.proposal[PROPOSAL_KEX_ALGS] = kex;
+       keyname = strdup(sshkey_ssh_name(private));
+       ASSERT_PTR_NE(keyname, NULL);
+       kex_params.proposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = keyname;
        ASSERT_INT_EQ(ssh_init(&client, 0, &kex_params), 0);
        ASSERT_INT_EQ(ssh_init(&server, 1, &kex_params), 0);
        ASSERT_PTR_NE(client, NULL);
@@ -167,6 +171,7 @@ do_kex_with_key(char *kex, int keytype, int bits)
        ssh_free(client);
        ssh_free(server);
        ssh_free(server2);
+       free(keyname);
        TEST_DONE();
 }