Add interop test with Dropbear. Right now this is only dbclient not the

Dropbear server since it won't currently run as a ProxyCommand.

diff --git a/regress/usr.bin/ssh/Makefile b/regress/usr.bin/ssh/Makefile
index 8a8c30e..30a0328 100644 (file)
--- a/regress/usr.bin/ssh/Makefile
+++ b/regress/usr.bin/ssh/Makefile
@@ -1,4 +1,4 @@
-#      $OpenBSD: Makefile,v 1.127 2023/09/24 08:14:13 claudio Exp $
+#      $OpenBSD: Makefile,v 1.128 2023/10/20 06:56:45 dtucker Exp $
 
 OPENSSL?=      yes
 
@@ -103,6 +103,7 @@ LTESTS=     connect \
                match-subsystem
 
 INTEROP_TESTS= putty-transfer putty-ciphers putty-kex conch-ciphers
+INTEROP_TESTS+=        dropbear-ciphers dropbear-kex
 #INTEROP_TESTS+=ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
 
 EXTRA_TESTS=   agent-pkcs11
@@ -253,5 +254,6 @@ c-${s}:
 clean: ${CLEAN_SUBDIR}
        rm -f ${CLEANFILES}
        rm -rf .putty
+       rm -rf .dropbear
 
 .include <bsd.regress.mk>

diff --git a/regress/usr.bin/ssh/dropbear-ciphers.sh b/regress/usr.bin/ssh/dropbear-ciphers.sh
new file mode 100644 (file)
index 0000000..2e0f9a1
--- /dev/null
+++ b/regress/usr.bin/ssh/dropbear-ciphers.sh
@@ -0,0 +1,33 @@
+#      $OpenBSD: dropbear-ciphers.sh,v 1.1 2023/10/20 06:56:45 dtucker Exp $
+#      Placed in the Public Domain.
+
+tid="dropbear ciphers"
+
+if test "x$REGRESS_INTEROP_DROPBEAR" != "xyes" ; then
+       skip "dropbear interop tests not enabled"
+fi
+
+cat >>$OBJ/sshd_proxy <<EOD
+PubkeyAcceptedAlgorithms +ssh-rsa,ssh-dss
+HostkeyAlgorithms +ssh-rsa,ssh-dss
+EOD
+
+ciphers=`$DBCLIENT -c help 2>&1 | awk '/ ciphers: /{print $4}' | tr ',' ' '`
+macs=`$DBCLIENT -m help 2>&1 | awk '/ MACs: /{print $4}' | tr ',' ' '`
+keytype=`(cd $OBJ/.dropbear && ls id_*)`
+
+for c in $ciphers ; do
+  for m in $macs; do
+    for kt in $keytype; do
+       verbose "$tid: cipher $c mac $m kt $kt"
+       rm -f ${COPY}
+       env HOME=$OBJ dbclient -y -i $OBJ/.dropbear/$kt 2>$OBJ/dbclient.log \
+           -c $c -m $m -J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY}
+       if [ $? -ne 0 ]; then
+               fail "ssh cat $DATA failed"
+       fi
+       cmp ${DATA} ${COPY}             || fail "corrupted copy"
+    done
+  done
+done
+rm -f ${COPY}

diff --git a/regress/usr.bin/ssh/dropbear-kex.sh b/regress/usr.bin/ssh/dropbear-kex.sh
new file mode 100644 (file)
index 0000000..a25de3e
--- /dev/null
+++ b/regress/usr.bin/ssh/dropbear-kex.sh
@@ -0,0 +1,31 @@
+#      $OpenBSD: dropbear-kex.sh,v 1.1 2023/10/20 06:56:45 dtucker Exp $
+#      Placed in the Public Domain.
+
+tid="dropbear kex"
+
+if test "x$REGRESS_INTEROP_DROPBEAR" != "xyes" ; then
+       skip "dropbear interop tests not enabled"
+fi
+
+cat >>$OBJ/sshd_proxy <<EOD
+PubkeyAcceptedAlgorithms +ssh-rsa,ssh-dss
+HostkeyAlgorithms +ssh-rsa,ssh-dss
+EOD
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
+
+kex="curve25519-sha256 curve25519-sha256@libssh.org
+    diffie-hellman-group14-sha256 diffie-hellman-group14-sha1"
+
+for k in $kex; do
+       verbose "$tid: kex $k"
+       rm -f ${COPY}
+       # dbclient doesn't have switch for kex, so force in server
+       (cat $OBJ/sshd_proxy.bak; echo "KexAlgorithms $k") >$OBJ/sshd_proxy
+       env HOME=$OBJ dbclient -y -i $OBJ/.dropbear/id_rsa 2>$OBJ/dbclient.log \
+           -J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY}
+       if [ $? -ne 0 ]; then
+               fail "ssh cat $DATA failed"
+       fi
+       cmp ${DATA} ${COPY}             || fail "corrupted copy"
+done
+rm -f ${COPY}

diff --git a/regress/usr.bin/ssh/test-exec.sh b/regress/usr.bin/ssh/test-exec.sh
index 38b191d..d67e3d4 100644 (file)
--- a/regress/usr.bin/ssh/test-exec.sh
+++ b/regress/usr.bin/ssh/test-exec.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: test-exec.sh,v 1.99 2023/10/12 03:48:53 djm Exp $
+#      $OpenBSD: test-exec.sh,v 1.100 2023/10/20 06:56:45 dtucker Exp $
 #      Placed in the Public Domain.
 
 #SUDO=sudo
@@ -58,6 +58,10 @@ SCP=scp
 PLINK=/usr/local/bin/plink
 PUTTYGEN=/usr/local/bin/puttygen
 CONCH=/usr/local/bin/conch
+DROPBEAR=/usr/local/bin/dropbear
+DBCLIENT=/usr/local/bin/dbclient
+DROPBEARKEY=/usr/local/bin/dropbearkey
+DROPBEARCONVERT=/usr/local/bin/dropbearconvert
 
 # Tools used by multiple tests
 NC=nc
@@ -584,6 +588,30 @@ if test "$REGRESS_INTEROP_PUTTY" = "yes" ; then
        echo "ProxyLocalhost=1" >> ${OBJ}/.putty/sessions/localhost_proxy
 fi
 
+REGRESS_INTEROP_DROPBEAR=no
+if test -x "$DROPBEARKEY" -a -x "$DBCLIENT" -a -x "$DROPBEARCONVERT"; then
+       REGRESS_INTEROP_DROPBEAR=yes
+fi
+case "$SCRIPT" in
+*dropbear*)    ;;
+*)             REGRESS_INTEROP_DROPBEAR=no ;;
+esac
+
+if test "$REGRESS_INTEROP_DROPBEAR" = "yes" ; then
+       trace Create dropbear keys and add to authorized_keys
+       mkdir -p $OBJ/.dropbear
+       for i in rsa ecdsa ed25519 dss; do
+               if [ ! -f "$OBJ/.dropbear/id_$i" ]; then
+                       ($DROPBEARKEY -t $i -f $OBJ/.dropbear/id_$i
+                       $DROPBEARCONVERT dropbear openssh \
+                           $OBJ/.dropbear/id_$i $OBJ/.dropbear/ossh.id_$i
+                       ) > /dev/null 2>&1
+               fi
+               $SSHKEYGEN -y -f $OBJ/.dropbear/ossh.id_$i \
+                  >>$OBJ/authorized_keys_$USER
+       done
+fi
+
 # create a proxy version of the client config
 (
        cat $OBJ/ssh_config
@@ -593,6 +621,12 @@ fi
 # check proxy config
 ${SSHD} -t -f $OBJ/sshd_proxy  || fatal "sshd_proxy broken"
 
+# extract proxycommand into separate shell script for use by Dropbear.
+echo '#!/bin/sh' >$OBJ/ssh_proxy.sh
+awk '/^proxycommand/' $OBJ/ssh_proxy | sed 's/^proxycommand//' \
+   >>$OBJ/ssh_proxy.sh
+chmod a+x $OBJ/ssh_proxy.sh
+
 start_sshd ()
 {
        # start sshd