1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
|
Overview.
$ ./configure && make tests
You'll see some progress info. A failure will cause either the make to
abort or the driver script to report a "FATAL" failure.
The test consists of 2 parts. The first is the file-based tests which is
driven by the Makefile, and the second is a set of network or proxycommand
based tests, which are driven by a driver script (test-exec.sh) which is
called multiple times by the Makefile.
Failures in the first part will cause the Makefile to return an error.
Failures in the second part will print a "FATAL" message for the failed
test and continue.
OpenBSD has a system-wide regression test suite. OpenSSH Portable's test
suite is based on OpenBSD's with modifications.
Environment variables.
SKIP_UNIT: Skip unit tests.
SUDO: path to sudo/doas command, if desired. Note that some systems
(notably systems using PAM) require sudo to execute some tests.
LTESTS: Whitespace separated list of tests (filenames without the .sh
extension) to run.
SKIP_LTESTS: Whitespace separated list of tests to skip.
OBJ: used by test scripts to access build dir.
TEST_SHELL: shell used for running the test scripts.
TEST_SSH_FAIL_FATAL: set to "yes" to make any failure abort the test
currently in progress.
TEST_SSH_PORT: TCP port to be used for the listening tests.
TEST_SSH_QUIET: set to "yes" to suppress non-fatal output.
TEST_SSH_SSHD_CONFOPTS: Configuration directives to be added to sshd_config
before running each test.
TEST_SSH_SSH_CONFOPTS: Configuration directives to be added to
ssh_config before running each test.
TEST_SSH_TRACE: set to "yes" for verbose output from tests
TEST_SSH_x: path to "ssh" command under test, where x is one of
SSH, SSHD, SSHAGENT, SSHADD, SSHKEYGEN, SSHKEYSCAN, SFTP or
SFTPSERVER
USE_VALGRIND: Run the tests under valgrind memory checker.
Individual tests.
You can run an individual test from the top-level Makefile, eg:
$ make tests LTESTS=agent-timeout
If you need to manipulate the environment more you can invoke test-exec.sh
directly if you set up the path to find the binaries under test and the
test scripts themselves, for example:
$ cd regress
$ PATH=`pwd`/..:$PATH:. TEST_SHELL=/bin/sh sh test-exec.sh `pwd` \
agent-timeout.sh
ok agent timeout test
Files.
test-exec.sh: the main test driver. Sets environment, creates config files
and keys and runs the specified test.
At the time of writing, the individual tests are:
connect.sh: simple connect
proxy-connect.sh: proxy connect
connect-privsep.sh: proxy connect with privsep
connect-uri.sh: uri connect
proto-version.sh: sshd version with different protocol combinations
proto-mismatch.sh: protocol version mismatch
exit-status.sh: remote exit status
envpass.sh: environment passing
transfer.sh: transfer data
banner.sh: banner
rekey.sh: rekey
stderr-data.sh: stderr data transfer
stderr-after-eof.sh: stderr data after eof
broken-pipe.sh: broken pipe test
try-ciphers.sh: try ciphers
yes-head.sh: yes pipe head
login-timeout.sh: connect after login grace timeout
agent.sh: simple connect via agent
agent-getpeereid.sh: disallow agent attach from other uid
agent-timeout.sh: agent timeout test
agent-ptrace.sh: disallow agent ptrace attach
keyscan.sh: keyscan
keygen-change.sh: change passphrase for key
keygen-convert.sh: convert keys
keygen-moduli.sh: keygen moduli
key-options.sh: key options
scp.sh: scp
scp-uri.sh: scp-uri
sftp.sh: basic sftp put/get
sftp-chroot.sh: sftp in chroot
sftp-cmds.sh: sftp command
sftp-badcmds.sh: sftp invalid commands
sftp-batch.sh: sftp batchfile
sftp-glob.sh: sftp glob
sftp-perm.sh: sftp permissions
sftp-uri.sh: sftp-uri
ssh-com-client.sh: connect with ssh.com client
ssh-com-keygen.sh: ssh.com key import
ssh-com-sftp.sh: basic sftp put/get with ssh.com server
ssh-com.sh: connect to ssh.com server
reconfigure.sh: simple connect after reconfigure
dynamic-forward.sh: dynamic forwarding
forwarding.sh: local and remote forwarding
multiplex.sh: connection multiplexing
reexec.sh: reexec tests
brokenkeys.sh: broken keys
sshcfgparse.sh: ssh config parse
cfgparse.sh: sshd config parse
cfgmatch.sh: sshd_config match
cfgmatchlisten.sh: sshd_config matchlisten
addrmatch.sh: address match
localcommand.sh: localcommand
forcecommand.sh: forced command
portnum.sh: port number parsing
keytype.sh: login with different key types
kextype.sh: login with different key exchange algorithms
cert-hostkey.sh certified host keys
cert-userkey.sh: certified user keys
host-expand.sh: expand %h and %n
keys-command.sh: authorized keys from command
forward-control.sh: sshd control of local and remote forwarding
integrity.sh: integrity
krl.sh: key revocation lists
multipubkey.sh: multiple pubkey
limit-keytype.sh: restrict pubkey type
hostkey-agent.sh: hostkey agent
keygen-knownhosts.sh: ssh-keygen known_hosts
hostkey-rotate.sh: hostkey rotate
principals-command.sh: authorized principals command
cert-file.sh: ssh with certificates
cfginclude.sh: config include
allow-deny-users.sh: AllowUsers/DenyUsers
authinfo.sh: authinfo
Problems?
Run the failing test with shell tracing (-x) turned on:
$ PATH=`pwd`/..:$PATH:. sh -x test-exec.sh `pwd` agent-timeout.sh
Failed tests can be difficult to diagnose. Suggestions:
- run the individual test via ./test-exec.sh `pwd` [testname]
- set LogLevel to VERBOSE in test-exec.sh and enable syslogging of
auth.debug (eg to /var/log/authlog).
Known Issues.
- Similarly, if you do not have "scp" in your system's $PATH then the
multiplex scp tests will fail (since the system's shell startup scripts
will determine where the shell started by sshd will look for scp).
- Recent GNU coreutils deprecate "head -[n]": this will cause the yes-head
test to fail. The old behaviour can be restored by setting (and
exporting) _POSIX2_VERSION=199209 before running the tests.
|
