From 77568e37aedd1a951824746ce9fc33867c285073 Mon Sep 17 00:00:00 2001 From: dtucker Date: Fri, 20 Oct 2023 06:56:45 +0000 Subject: [PATCH] Add interop test with Dropbear. Right now this is only dbclient not the Dropbear server since it won't currently run as a ProxyCommand. --- regress/usr.bin/ssh/Makefile | 4 ++- regress/usr.bin/ssh/dropbear-ciphers.sh | 33 +++++++++++++++++++++++ regress/usr.bin/ssh/dropbear-kex.sh | 31 +++++++++++++++++++++ regress/usr.bin/ssh/test-exec.sh | 36 ++++++++++++++++++++++++- 4 files changed, 102 insertions(+), 2 deletions(-) create mode 100644 regress/usr.bin/ssh/dropbear-ciphers.sh create mode 100644 regress/usr.bin/ssh/dropbear-kex.sh diff --git a/regress/usr.bin/ssh/Makefile b/regress/usr.bin/ssh/Makefile index 8a8c30ea321..30a0328c80a 100644 --- a/regress/usr.bin/ssh/Makefile +++ b/regress/usr.bin/ssh/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.127 2023/09/24 08:14:13 claudio Exp $ +# $OpenBSD: Makefile,v 1.128 2023/10/20 06:56:45 dtucker Exp $ OPENSSL?= yes @@ -103,6 +103,7 @@ LTESTS= connect \ match-subsystem INTEROP_TESTS= putty-transfer putty-ciphers putty-kex conch-ciphers +INTEROP_TESTS+= dropbear-ciphers dropbear-kex #INTEROP_TESTS+=ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp EXTRA_TESTS= agent-pkcs11 @@ -253,5 +254,6 @@ c-${s}: clean: ${CLEAN_SUBDIR} rm -f ${CLEANFILES} rm -rf .putty + rm -rf .dropbear .include diff --git a/regress/usr.bin/ssh/dropbear-ciphers.sh b/regress/usr.bin/ssh/dropbear-ciphers.sh new file mode 100644 index 00000000000..2e0f9a1d337 --- /dev/null +++ b/regress/usr.bin/ssh/dropbear-ciphers.sh @@ -0,0 +1,33 @@ +# $OpenBSD: dropbear-ciphers.sh,v 1.1 2023/10/20 06:56:45 dtucker Exp $ +# Placed in the Public Domain. + +tid="dropbear ciphers" + +if test "x$REGRESS_INTEROP_DROPBEAR" != "xyes" ; then + skip "dropbear interop tests not enabled" +fi + +cat >>$OBJ/sshd_proxy <&1 | awk '/ ciphers: /{print $4}' | tr ',' ' '` +macs=`$DBCLIENT -m help 2>&1 | awk '/ MACs: /{print $4}' | tr ',' ' '` +keytype=`(cd $OBJ/.dropbear && ls id_*)` + +for c in $ciphers ; do + for m in $macs; do + for kt in $keytype; do + verbose "$tid: cipher $c mac $m kt $kt" + rm -f ${COPY} + env HOME=$OBJ dbclient -y -i $OBJ/.dropbear/$kt 2>$OBJ/dbclient.log \ + -c $c -m $m -J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY} + if [ $? -ne 0 ]; then + fail "ssh cat $DATA failed" + fi + cmp ${DATA} ${COPY} || fail "corrupted copy" + done + done +done +rm -f ${COPY} diff --git a/regress/usr.bin/ssh/dropbear-kex.sh b/regress/usr.bin/ssh/dropbear-kex.sh new file mode 100644 index 00000000000..a25de3eddb7 --- /dev/null +++ b/regress/usr.bin/ssh/dropbear-kex.sh @@ -0,0 +1,31 @@ +# $OpenBSD: dropbear-kex.sh,v 1.1 2023/10/20 06:56:45 dtucker Exp $ +# Placed in the Public Domain. + +tid="dropbear kex" + +if test "x$REGRESS_INTEROP_DROPBEAR" != "xyes" ; then + skip "dropbear interop tests not enabled" +fi + +cat >>$OBJ/sshd_proxy <$OBJ/sshd_proxy + env HOME=$OBJ dbclient -y -i $OBJ/.dropbear/id_rsa 2>$OBJ/dbclient.log \ + -J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY} + if [ $? -ne 0 ]; then + fail "ssh cat $DATA failed" + fi + cmp ${DATA} ${COPY} || fail "corrupted copy" +done +rm -f ${COPY} diff --git a/regress/usr.bin/ssh/test-exec.sh b/regress/usr.bin/ssh/test-exec.sh index 38b191de2ca..d67e3d4bcf3 100644 --- a/regress/usr.bin/ssh/test-exec.sh +++ b/regress/usr.bin/ssh/test-exec.sh @@ -1,4 +1,4 @@ -# $OpenBSD: test-exec.sh,v 1.99 2023/10/12 03:48:53 djm Exp $ +# $OpenBSD: test-exec.sh,v 1.100 2023/10/20 06:56:45 dtucker Exp $ # Placed in the Public Domain. #SUDO=sudo @@ -58,6 +58,10 @@ SCP=scp PLINK=/usr/local/bin/plink PUTTYGEN=/usr/local/bin/puttygen CONCH=/usr/local/bin/conch +DROPBEAR=/usr/local/bin/dropbear +DBCLIENT=/usr/local/bin/dbclient +DROPBEARKEY=/usr/local/bin/dropbearkey +DROPBEARCONVERT=/usr/local/bin/dropbearconvert # Tools used by multiple tests NC=nc @@ -584,6 +588,30 @@ if test "$REGRESS_INTEROP_PUTTY" = "yes" ; then echo "ProxyLocalhost=1" >> ${OBJ}/.putty/sessions/localhost_proxy fi +REGRESS_INTEROP_DROPBEAR=no +if test -x "$DROPBEARKEY" -a -x "$DBCLIENT" -a -x "$DROPBEARCONVERT"; then + REGRESS_INTEROP_DROPBEAR=yes +fi +case "$SCRIPT" in +*dropbear*) ;; +*) REGRESS_INTEROP_DROPBEAR=no ;; +esac + +if test "$REGRESS_INTEROP_DROPBEAR" = "yes" ; then + trace Create dropbear keys and add to authorized_keys + mkdir -p $OBJ/.dropbear + for i in rsa ecdsa ed25519 dss; do + if [ ! -f "$OBJ/.dropbear/id_$i" ]; then + ($DROPBEARKEY -t $i -f $OBJ/.dropbear/id_$i + $DROPBEARCONVERT dropbear openssh \ + $OBJ/.dropbear/id_$i $OBJ/.dropbear/ossh.id_$i + ) > /dev/null 2>&1 + fi + $SSHKEYGEN -y -f $OBJ/.dropbear/ossh.id_$i \ + >>$OBJ/authorized_keys_$USER + done +fi + # create a proxy version of the client config ( cat $OBJ/ssh_config @@ -593,6 +621,12 @@ fi # check proxy config ${SSHD} -t -f $OBJ/sshd_proxy || fatal "sshd_proxy broken" +# extract proxycommand into separate shell script for use by Dropbear. +echo '#!/bin/sh' >$OBJ/ssh_proxy.sh +awk '/^proxycommand/' $OBJ/ssh_proxy | sed 's/^proxycommand//' \ + >>$OBJ/ssh_proxy.sh +chmod a+x $OBJ/ssh_proxy.sh + start_sshd () { # start sshd -- 2.20.1