36 lines
1.2 KiB
Bash
36 lines
1.2 KiB
Bash
# $OpenBSD: dropbear-kex.sh,v 1.4 2025/03/11 07:42:08 dtucker Exp $
|
|
# Placed in the Public Domain.
|
|
|
|
tid="dropbear kex"
|
|
|
|
if test "x$REGRESS_INTEROP_DROPBEAR" != "xyes" ; then
|
|
skip "dropbear interop tests not enabled"
|
|
fi
|
|
|
|
cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
|
|
|
|
kex="curve25519-sha256 curve25519-sha256@libssh.org"
|
|
if $SSH -Q kex | grep 'diffie-hellman-group14-sha256' >/dev/null; then
|
|
kex="$kex diffie-hellman-group14-sha256"
|
|
fi
|
|
# There's no flag to query KEX, so if MACs does not contain SHA1, assume
|
|
# there's also SHA1-based KEX methods either.
|
|
if $SSH -Q kex | grep 'diffie-hellman-group14-sha1' >/dev/null && \
|
|
$DBCLIENT -m help hst 2>&1 | grep -- '-sha1' >/dev/null ; then
|
|
kex="$kex diffie-hellman-group14-sha1"
|
|
fi
|
|
|
|
for k in $kex; do
|
|
verbose "$tid: kex $k"
|
|
rm -f ${COPY}
|
|
# dbclient doesn't have switch for kex, so force in server
|
|
(cat $OBJ/sshd_proxy.bak; echo "KexAlgorithms $k") >$OBJ/sshd_proxy
|
|
env HOME=$OBJ \
|
|
${DBCLIENT} -y -i $OBJ/.dropbear/id_ed25519 2>$OBJ/dbclient.log \
|
|
-J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY}
|
|
if [ $? -ne 0 ]; then
|
|
fail "ssh cat $DATA failed"
|
|
fi
|
|
cmp ${DATA} ${COPY} || fail "corrupted copy"
|
|
done
|
|
rm -f ${COPY}
|