Adding upstream version 1:9.9p1.upstream/1%9.9p1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 78 insertions, 40 deletions

diff --git a/regress/rekey.sh b/regress/rekey.sh
index 8005a86..3f5e1d5 100644
--- a/regress/rekey.sh
+++ b/regress/rekey.sh
@@ -1,76 +1,114 @@
-#	$OpenBSD: rekey.sh,v 1.20 2024/05/22 04:20:00 djm Exp $
+#	$OpenBSD: rekey.sh,v 1.30 2024/08/28 12:08:26 djm Exp $
 #	Placed in the Public Domain.
 
 tid="rekey"
 
 LOG=${TEST_SSH_LOGFILE}
+COPY2=$OBJ/copy2
 
 rm -f ${LOG}
 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 
+echo "Compression no" >> $OBJ/ssh_proxy
+echo "RekeyLimit 256k" >> $OBJ/ssh_proxy
+echo "KexAlgorithms curve25519-sha256" >> ssh_proxy
+
 # Test rekeying based on data volume only.
-# Arguments will be passed to ssh.
+# Arguments: rekeylimit, kex method, optional remaining opts are passed to ssh.
 ssh_data_rekeying()
 {
+	_bytes=$1 ; shift
 	_kexopt=$1 ; shift
 	_opts="$@"
+	if test -z "$_bytes"; then
+		_bytes=32k
+	fi
 	if ! test -z "$_kexopt" ; then
 		cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
 		echo "$_kexopt" >> $OBJ/sshd_proxy
 		_opts="$_opts -o$_kexopt"
 	fi
-	rm -f ${COPY} ${LOG}
-	_opts="$_opts -oCompression=no"
-	${SSH} <${DATA} $_opts -v -F $OBJ/ssh_proxy somehost "cat > ${COPY}"
+	case "$_kexopt" in
+	MACs=*)
+		# default chacha20-poly1305 cipher has implicit MAC
+		_opts="$_opts -oCiphers=aes128-ctr" ;;
+	esac
+	trace  bytes $_bytes kex $_kexopt opts $_opts
+	rm -f ${COPY} ${COPY2} ${LOG}
+	# Create data file just big enough to reach rekey threshold.
+	dd if=${DATA} of=${COPY} bs=$_bytes count=1 2>/dev/null
+	${SSH} <${COPY} $_opts -vv \
+	    -oRekeyLimit=$_bytes -F $OBJ/ssh_proxy somehost "cat >${COPY2}"
 	if [ $? -ne 0 ]; then
 		fail "ssh failed ($@)"
 	fi
-	cmp ${DATA} ${COPY}		|| fail "corrupted copy ($@)"
+	cmp ${COPY} ${COPY2}		|| fail "corrupted copy ($@)"
 	n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
 	n=`expr $n - 1`
+	_want=`echo $_kexopt | cut -f2 -d=`
+	_got=""
+	case "$_kexopt" in
+	KexAlgorithms=*)
+		_got=`awk '/kex: algorithm: /{print $4}' ${LOG} | \
+		    tr -d '\r' | sort -u` ;;
+	Ciphers=*)
+		_got=`awk '/kex: client->server cipher:/{print $5}' ${LOG} | \
+		    tr -d '\r' | sort -u` ;;
+	MACs=*)
+		_got=`awk '/kex: client->server cipher:/{print $7}' ${LOG} | \
+		    tr -d '\r' | sort -u` ;;
+	esac
+	if [ "$_want" != "$_got" ]; then
+		fail "unexpected algorithm, want $_want, got $_got"
+	fi
 	trace "$n rekeying(s)"
 	if [ $n -lt 1 ]; then
 		fail "no rekeying occurred ($@)"
 	fi
+	cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
 }
 
 increase_datafile_size 300
 
 opts=""
-for i in `${SSH} -Q kex`; do
+
+# Filter out duplicate curve algo
+kexs=`${SSH} -Q kex | grep -v curve25519-sha256@libssh.org`
+ciphers=`${SSH} -Q cipher`
+macs=`${SSH} -Q mac`
+
+for i in $kexs; do
 	opts="$opts KexAlgorithms=$i"
 done
-for i in `${SSH} -Q cipher`; do
+for i in $ciphers; do
 	opts="$opts Ciphers=$i"
 done
-for i in `${SSH} -Q mac`; do
+for i in $macs; do
 	opts="$opts MACs=$i"
 done
 
 for opt in $opts; do
 	verbose "client rekey $opt"
-	ssh_data_rekeying "$opt" -oRekeyLimit=256k
+	if ${SSH} -Q cipher-auth | sed 's/^/Ciphers=/' | \
+	    grep $opt >/dev/null; then
+		trace AEAD cipher, testing all KexAlgorithms
+		for kex in $kexs; do
+			ssh_data_rekeying "" "KexAlgorithms=$kex" "-o$opt"
+		done
+	else
+		ssh_data_rekeying "" "$opt"
+	fi
 done
 
-# AEAD ciphers are magical so test with all KexAlgorithms
-if ${SSH} -Q cipher-auth | grep '^.*$' >/dev/null 2>&1 ; then
-  for c in `${SSH} -Q cipher-auth`; do
-    for kex in `${SSH} -Q kex`; do
-	verbose "client rekey $c $kex"
-	ssh_data_rekeying "KexAlgorithms=$kex" -oRekeyLimit=256k -oCiphers=$c
-    done
-  done
-fi
-
 for s in 16 1k 128k 256k; do
 	verbose "client rekeylimit ${s}"
-	ssh_data_rekeying "" -oCompression=no -oRekeyLimit=$s
+	ssh_data_rekeying "$s" ""
 done
 
 for s in 5 10; do
 	verbose "client rekeylimit default ${s}"
 	rm -f ${COPY} ${LOG}
-	${SSH} < ${DATA} -oCompression=no -oRekeyLimit="default $s" -F \
+	${SSH} < ${DATA} -oRekeyLimit="default $s" -F \
 		$OBJ/ssh_proxy somehost "cat >${COPY};sleep $s;sleep 10"
 	if [ $? -ne 0 ]; then
 		fail "ssh failed"
@@ -87,7 +125,7 @@ done
 for s in 5 10; do
 	verbose "client rekeylimit default ${s} no data"
 	rm -f ${COPY} ${LOG}
-	${SSH} -oCompression=no -oRekeyLimit="default $s" -F \
+	${SSH} -oRekeyLimit="default $s" -F \
 		$OBJ/ssh_proxy somehost "sleep $s;sleep 10"
 	if [ $? -ne 0 ]; then
 		fail "ssh failed"
@@ -104,13 +142,13 @@ for s in 16 1k 128k 256k; do
 	verbose "server rekeylimit ${s}"
 	cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
 	echo "rekeylimit ${s}" >>$OBJ/sshd_proxy
-	rm -f ${COPY} ${LOG}
-	${SSH} -oCompression=no -F $OBJ/ssh_proxy somehost "cat ${DATA}" \
-	    > ${COPY}
+	rm -f ${COPY} ${COPY2} ${LOG}
+	dd if=${DATA} of=${COPY} bs=$s count=1 2>/dev/null
+	${SSH} -F $OBJ/ssh_proxy somehost "cat ${COPY}" >${COPY2}
 	if [ $? -ne 0 ]; then
 		fail "ssh failed"
 	fi
-	cmp ${DATA} ${COPY}		|| fail "corrupted copy"
+	cmp ${COPY} ${COPY2}		|| fail "corrupted copy"
 	n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
 	n=`expr $n - 1`
 	trace "$n rekeying(s)"
@@ -124,7 +162,7 @@ for s in 5 10; do
 	cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
 	echo "rekeylimit default ${s}" >>$OBJ/sshd_proxy
 	rm -f ${COPY} ${LOG}
-	${SSH} -oCompression=no -F $OBJ/ssh_proxy somehost "sleep $s;sleep 10"
+	${SSH} -F $OBJ/ssh_proxy somehost "sleep $s;sleep 10"
 	if [ $? -ne 0 ]; then
 		fail "ssh failed"
 	fi
@@ -136,9 +174,8 @@ for s in 5 10; do
 	fi
 done
 
-verbose "rekeylimit parsing"
+verbose "rekeylimit parsing: bytes"
 for size in 16 1k 1K 1m 1M 1g 1G 4G 8G; do
-    for time in 1 1m 1M 1h 1H 1d 1D 1w 1W; do
 	case $size in
 		16)	bytes=16 ;;
 		1k|1K)	bytes=1024 ;;
@@ -147,6 +184,15 @@ for size in 16 1k 1K 1m 1M 1g 1G 4G 8G; do
 		4g|4G)	bytes=4294967296 ;;
 		8g|8G)	bytes=8589934592 ;;
 	esac
+	b=`${SSH} -G -o "rekeylimit $size" -F $OBJ/ssh_proxy host | \
+	    awk '/rekeylimit/{print $2}'`
+	if [ "$bytes" != "$b" ]; then
+		fatal "rekeylimit size: expected $bytes bytes got $b"
+	fi
+done
+
+verbose "rekeylimit parsing: time"
+for time in 1 1m 1M 1h 1H 1d 1D 1w 1W; do
 	case $time in
 		1)	seconds=1 ;;
 		1m|1M)	seconds=60 ;;
@@ -154,19 +200,11 @@ for size in 16 1k 1K 1m 1M 1g 1G 4G 8G; do
 		1d|1D)	seconds=86400 ;;
 		1w|1W)	seconds=604800 ;;
 	esac
-
-	b=`$SUDO ${SSHD} -T -o "rekeylimit $size $time" -f $OBJ/sshd_proxy | \
-	    awk '/rekeylimit/{print $2}'`
-	s=`$SUDO ${SSHD} -T -o "rekeylimit $size $time" -f $OBJ/sshd_proxy | \
+	s=`${SSH} -G -o "rekeylimit default $time" -F $OBJ/ssh_proxy host | \
 	    awk '/rekeylimit/{print $3}'`
-
-	if [ "$bytes" != "$b" ]; then
-		fatal "rekeylimit size: expected $bytes bytes got $b"
-	fi
 	if [ "$seconds" != "$s" ]; then
 		fatal "rekeylimit time: expected $time seconds got $s"
 	fi
-    done
 done
 
-rm -f ${COPY} ${DATA}
+rm -f ${COPY} ${COPY2} ${DATA}