upstream: Check if dbclient supports SHA1 before trying SHA1-based

KEX.

Dropbear 2025.87 removed SHA1 support by default, which means
diffie-hellman-group14-sha1 is not available.  Unfortunately there isn't a
flag to query supported KEX, so instead check MACs and if it doesn't have
SHA1 methods, assuming SHA1 based KEXes are likewise not available.  Spotted
by anton@.

OpenBSD-Regress-ID: acfa8e26c001cb18b9fb81a27271c3b51288d304

diff --git a/regress/dropbear-kex.sh b/regress/dropbear-kex.sh
index d9f1b32c09d4616058b823018df3b865e33d3308..72717fbb786645f36a4abd4c96952774ffdb10f4 100644 (file)
--- a/regress/dropbear-kex.sh
+++ b/regress/dropbear-kex.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: dropbear-kex.sh,v 1.3 2024/06/19 10:10:46 dtucker Exp $
+#      $OpenBSD: dropbear-kex.sh,v 1.4 2025/03/11 07:42:08 dtucker Exp $
 #      Placed in the Public Domain.
 
 tid="dropbear kex"
@@ -10,8 +10,14 @@ fi
 cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
 
 kex="curve25519-sha256 curve25519-sha256@libssh.org"
-if $SSH -Q kex | grep 'diffie-hellman-group14-sha1'; then
-       kex="$kex diffie-hellman-group14-sha256 diffie-hellman-group14-sha1"
+if $SSH -Q kex | grep 'diffie-hellman-group14-sha256' >/dev/null; then
+       kex="$kex diffie-hellman-group14-sha256"
+fi
+# There's no flag to query KEX, so if MACs does not contain SHA1, assume
+# there's also SHA1-based KEX methods either.
+if $SSH -Q kex | grep 'diffie-hellman-group14-sha1' >/dev/null && \
+    $DBCLIENT -m help hst 2>&1 | grep -- '-sha1' >/dev/null ; then
+       kex="$kex diffie-hellman-group14-sha1"
 fi
 
 for k in $kex; do
@@ -19,8 +25,9 @@ for k in $kex; do
        rm -f ${COPY}
        # dbclient doesn't have switch for kex, so force in server
        (cat $OBJ/sshd_proxy.bak; echo "KexAlgorithms $k") >$OBJ/sshd_proxy
-       env HOME=$OBJ dbclient -y -i $OBJ/.dropbear/id_ed25519 2>$OBJ/dbclient.log \
-           -J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY}
+       env HOME=$OBJ \
+           ${DBCLIENT} -y -i $OBJ/.dropbear/id_ed25519 2>$OBJ/dbclient.log \
+          -J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY}
        if [ $? -ne 0 ]; then
                fail "ssh cat $DATA failed"
        fi