upstream commit
eliminate explicit specification of protocol in tests and
loops over protocol. We only support SSHv2 now.
Upstream-Regress-ID: 0082838a9b8a382b7ee9cbf0c1b9db727784fadd
diff --git a/regress/agent-pkcs11.sh b/regress/agent-pkcs11.sh
index 3aa20c8..db3018b 100644
--- a/regress/agent-pkcs11.sh
+++ b/regress/agent-pkcs11.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: agent-pkcs11.sh,v 1.2 2015/01/12 11:46:32 djm Exp $
+# $OpenBSD: agent-pkcs11.sh,v 1.3 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="pkcs11 agent test"
@@ -53,7 +53,7 @@
fi
trace "pkcs11 connect via agent"
- ${SSH} -2 -F $OBJ/ssh_proxy somehost exit 5
+ ${SSH} -F $OBJ/ssh_proxy somehost exit 5
r=$?
if [ $r -ne 5 ]; then
fail "ssh connect failed (exit code $r)"
diff --git a/regress/agent.sh b/regress/agent.sh
index c5e2794..0baf0c7 100644
--- a/regress/agent.sh
+++ b/regress/agent.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: agent.sh,v 1.11 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: agent.sh,v 1.12 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="simple agent test"
@@ -46,28 +46,24 @@
fi
trace "simple connect via agent"
- for p in ${SSH_PROTOCOLS}; do
- ${SSH} -$p -F $OBJ/ssh_proxy somehost exit 5$p
- r=$?
- if [ $r -ne 5$p ]; then
- fail "ssh connect with protocol $p failed (exit code $r)"
- fi
- done
+ ${SSH} -F $OBJ/ssh_proxy somehost exit 52
+ r=$?
+ if [ $r -ne 52 ]; then
+ fail "ssh connect with failed (exit code $r)"
+ fi
trace "agent forwarding"
- for p in ${SSH_PROTOCOLS}; do
- ${SSH} -A -$p -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
- r=$?
- if [ $r -ne 0 ]; then
- fail "ssh-add -l via agent fwd proto $p failed (exit code $r)"
- fi
- ${SSH} -A -$p -F $OBJ/ssh_proxy somehost \
- "${SSH} -$p -F $OBJ/ssh_proxy somehost exit 5$p"
- r=$?
- if [ $r -ne 5$p ]; then
- fail "agent fwd proto $p failed (exit code $r)"
- fi
- done
+ ${SSH} -A -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
+ r=$?
+ if [ $r -ne 0 ]; then
+ fail "ssh-add -l via agent fwd failed (exit code $r)"
+ fi
+ ${SSH} -A -F $OBJ/ssh_proxy somehost \
+ "${SSH} -F $OBJ/ssh_proxy somehost exit 52"
+ r=$?
+ if [ $r -ne 52 ]; then
+ fail "agent fwd failed (exit code $r)"
+ fi
trace "delete all agent keys"
${SSHADD} -D > /dev/null 2>&1
diff --git a/regress/banner.sh b/regress/banner.sh
index 0b9c950..0d9654f 100644
--- a/regress/banner.sh
+++ b/regress/banner.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: banner.sh,v 1.2 2003/10/11 11:49:49 dtucker Exp $
+# $OpenBSD: banner.sh,v 1.3 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="banner"
@@ -9,7 +9,7 @@
trace "test missing banner file"
verbose "test $tid: missing banner file"
-( ${SSH} -2 -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \
+( ${SSH} -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \
cmp $OBJ/empty.in $OBJ/banner.out ) || \
fail "missing banner file"
@@ -30,14 +30,14 @@
trace "test banner size $s"
verbose "test $tid: size $s"
- ( ${SSH} -2 -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \
+ ( ${SSH} -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \
cmp $OBJ/banner.in $OBJ/banner.out ) || \
fail "banner size $s mismatch"
done
trace "test suppress banner (-q)"
verbose "test $tid: suppress banner (-q)"
-( ${SSH} -q -2 -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \
+( ${SSH} -q -F $OBJ/ssh_proxy otherhost true 2>$OBJ/banner.out && \
cmp $OBJ/empty.in $OBJ/banner.out ) || \
fail "suppress banner (-q)"
diff --git a/regress/broken-pipe.sh b/regress/broken-pipe.sh
index a416f7a..c69276e 100644
--- a/regress/broken-pipe.sh
+++ b/regress/broken-pipe.sh
@@ -1,15 +1,12 @@
-# $OpenBSD: broken-pipe.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: broken-pipe.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="broken pipe test"
-for p in ${SSH_PROTOCOLS}; do
- trace "protocol $p"
- for i in 1 2 3 4; do
- ${SSH} -$p -F $OBJ/ssh_config_config nexthost echo $i 2> /dev/null | true
- r=$?
- if [ $r -ne 0 ]; then
- fail "broken pipe returns $r for protocol $p"
- fi
- done
+for i in 1 2 3 4; do
+ ${SSH} -F $OBJ/ssh_config_config nexthost echo $i 2> /dev/null | true
+ r=$?
+ if [ $r -ne 0 ]; then
+ fail "broken pipe returns $r"
+ fi
done
diff --git a/regress/brokenkeys.sh b/regress/brokenkeys.sh
index 3e70c34..9d5a54f 100644
--- a/regress/brokenkeys.sh
+++ b/regress/brokenkeys.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: brokenkeys.sh,v 1.1 2004/10/29 23:59:22 djm Exp $
+# $OpenBSD: brokenkeys.sh,v 1.2 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="broken keys"
@@ -14,9 +14,9 @@
cat ${KEYS}.bak >> ${KEYS}
cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
-${SSH} -2 -F $OBJ/ssh_config somehost true
+${SSH} -F $OBJ/ssh_config somehost true
if [ $? -ne 0 ]; then
- fail "ssh connect with protocol $p failed"
+ fail "ssh connect with failed"
fi
mv ${KEYS}.bak ${KEYS}
diff --git a/regress/cert-file.sh b/regress/cert-file.sh
index 43b8e02..8fd62c7 100644
--- a/regress/cert-file.sh
+++ b/regress/cert-file.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: cert-file.sh,v 1.5 2017/03/11 23:44:16 djm Exp $
+# $OpenBSD: cert-file.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="ssh with certificates"
@@ -54,66 +54,64 @@
# XXX: verify that certificate used was what we expect. Needs exposure of
# keys via enviornment variable or similar.
-for p in ${SSH_PROTOCOLS}; do
# Key with no .pub should work - finding the equivalent *-cert.pub.
- verbose "protocol $p: identity cert with no plain public file"
- ${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \
- -i $OBJ/user_key3 somehost exit 5$p
- [ $? -ne 5$p ] && fail "ssh failed"
+verbose "identity cert with no plain public file"
+${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \
+ -i $OBJ/user_key3 somehost exit 52
+[ $? -ne 52 ] && fail "ssh failed"
- # CertificateFile matching private key with no .pub file should work.
- verbose "protocol $p: CertificateFile with no plain public file"
- ${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \
- -oCertificateFile=$OBJ/user_key3-cert.pub \
- -i $OBJ/user_key3 somehost exit 5$p
- [ $? -ne 5$p ] && fail "ssh failed"
+# CertificateFile matching private key with no .pub file should work.
+verbose "CertificateFile with no plain public file"
+${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \
+ -oCertificateFile=$OBJ/user_key3-cert.pub \
+ -i $OBJ/user_key3 somehost exit 52
+[ $? -ne 52 ] && fail "ssh failed"
- # Just keys should fail
- verbose "protocol $p: plain keys"
- ${SSH} $opts2 somehost exit 5$p
- r=$?
- if [ $r -eq 5$p ]; then
- fail "ssh succeeded with no certs in protocol $p"
- fi
+# Just keys should fail
+verbose "plain keys"
+${SSH} $opts2 somehost exit 52
+r=$?
+if [ $r -eq 52 ]; then
+ fail "ssh succeeded with no certs"
+fi
- # Keys with untrusted cert should fail.
- verbose "protocol $p: untrusted cert"
- opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
- ${SSH} $opts3 somehost exit 5$p
- r=$?
- if [ $r -eq 5$p ]; then
- fail "ssh succeeded with bad cert in protocol $p"
- fi
+# Keys with untrusted cert should fail.
+verbose "untrusted cert"
+opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
+${SSH} $opts3 somehost exit 52
+r=$?
+if [ $r -eq 52 ]; then
+ fail "ssh succeeded with bad cert"
+fi
- # Good cert with bad key should fail.
- verbose "protocol $p: good cert, bad key"
- opts3="$opts -i $OBJ/user_key2"
- opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
- ${SSH} $opts3 somehost exit 5$p
- r=$?
- if [ $r -eq 5$p ]; then
- fail "ssh succeeded with no matching key in protocol $p"
- fi
+# Good cert with bad key should fail.
+verbose "good cert, bad key"
+opts3="$opts -i $OBJ/user_key2"
+opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
+${SSH} $opts3 somehost exit 52
+r=$?
+if [ $r -eq 52 ]; then
+ fail "ssh succeeded with no matching key"
+fi
- # Keys with one trusted cert, should succeed.
- verbose "protocol $p: single trusted"
- opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
- ${SSH} $opts3 somehost exit 5$p
- r=$?
- if [ $r -ne 5$p ]; then
- fail "ssh failed with trusted cert and key in protocol $p"
- fi
+# Keys with one trusted cert, should succeed.
+verbose "single trusted"
+opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
+${SSH} $opts3 somehost exit 52
+r=$?
+if [ $r -ne 52 ]; then
+ fail "ssh failed with trusted cert and key"
+fi
- # Multiple certs and keys, with one trusted cert, should succeed.
- verbose "protocol $p: multiple trusted"
- opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
- opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
- ${SSH} $opts3 somehost exit 5$p
- r=$?
- if [ $r -ne 5$p ]; then
- fail "ssh failed with multiple certs in protocol $p"
- fi
-done
+# Multiple certs and keys, with one trusted cert, should succeed.
+verbose "multiple trusted"
+opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
+opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
+${SSH} $opts3 somehost exit 52
+r=$?
+if [ $r -ne 52 ]; then
+ fail "ssh failed with multiple certs"
+fi
#next, using an agent in combination with the keys
SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1
@@ -139,26 +137,25 @@
fi
# try ssh with the agent and certificates
-# note: ssh agent only uses certificates in protocol 2
opts="-F $OBJ/ssh_proxy"
# with no certificates, shoud fail
-${SSH} -2 $opts somehost exit 52
+${SSH} $opts somehost exit 52
if [ $? -eq 52 ]; then
- fail "ssh connect with agent in protocol 2 succeeded with no cert"
+ fail "ssh connect with agent in succeeded with no cert"
fi
#with an untrusted certificate, should fail
opts="$opts -oCertificateFile=$OBJ/cert_user_key1_2.pub"
-${SSH} -2 $opts somehost exit 52
+${SSH} $opts somehost exit 52
if [ $? -eq 52 ]; then
- fail "ssh connect with agent in protocol 2 succeeded with bad cert"
+ fail "ssh connect with agent in succeeded with bad cert"
fi
#with an additional trusted certificate, should succeed
opts="$opts -oCertificateFile=$OBJ/cert_user_key1_1.pub"
-${SSH} -2 $opts somehost exit 52
+${SSH} $opts somehost exit 52
if [ $? -ne 52 ]; then
- fail "ssh connect with agent in protocol 2 failed with good cert"
+ fail "ssh connect with agent in failed with good cert"
fi
trace "kill agent"
diff --git a/regress/cert-hostkey.sh b/regress/cert-hostkey.sh
index 62261cf..3d5732a 100644
--- a/regress/cert-hostkey.sh
+++ b/regress/cert-hostkey.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: cert-hostkey.sh,v 1.14 2016/05/02 09:52:00 djm Exp $
+# $OpenBSD: cert-hostkey.sh,v 1.15 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="certified host keys"
@@ -104,7 +104,7 @@
shift; shift
verbose "$tid: $_ident expect success $_expect_success"
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
- ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
"$@" -F $OBJ/ssh_proxy somehost true
_r=$?
@@ -169,7 +169,7 @@
) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
- ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
@@ -190,7 +190,7 @@
echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
- ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
@@ -222,7 +222,7 @@
) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
- ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
rc=$?
@@ -271,7 +271,7 @@
echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
) > $OBJ/sshd_proxy
- ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then
@@ -303,7 +303,7 @@
) > $OBJ/sshd_proxy
cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
- ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+ ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
-F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh
index 7005fd5..6a23fe3 100644
--- a/regress/cert-userkey.sh
+++ b/regress/cert-userkey.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: cert-userkey.sh,v 1.17 2016/11/30 03:01:33 djm Exp $
+# $OpenBSD: cert-userkey.sh,v 1.18 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="certified user keys"
@@ -67,7 +67,7 @@
# Missing authorized_principals
verbose "$tid: ${_prefix} missing authorized_principals"
rm -f $OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -76,7 +76,7 @@
# Empty authorized_principals
verbose "$tid: ${_prefix} empty authorized_principals"
echo > $OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -85,7 +85,7 @@
# Wrong authorized_principals
verbose "$tid: ${_prefix} wrong authorized_principals"
echo gregorsamsa > $OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -94,7 +94,7 @@
# Correct authorized_principals
verbose "$tid: ${_prefix} correct authorized_principals"
echo mekmitasdigoat > $OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
@@ -103,7 +103,7 @@
# authorized_principals with bad key option
verbose "$tid: ${_prefix} authorized_principals bad key opt"
echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -113,7 +113,7 @@
verbose "$tid: ${_prefix} authorized_principals command=false"
echo 'command="false" mekmitasdigoat' > \
$OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -124,7 +124,7 @@
verbose "$tid: ${_prefix} authorized_principals command=true"
echo 'command="true" mekmitasdigoat' > \
$OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
@@ -148,7 +148,7 @@
printf 'cert-authority,principals="gregorsamsa" '
cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -160,7 +160,7 @@
printf 'cert-authority,principals="mekmitasdigoat" '
cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
@@ -198,7 +198,7 @@
echo "PubkeyAcceptedKeyTypes ${t}"
) > $OBJ/ssh_proxy
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
@@ -215,7 +215,7 @@
) > $OBJ/sshd_proxy
cp $OBJ/cert_user_key_${ktype}.pub \
$OBJ/cert_user_key_revoked
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpecedly"
@@ -224,14 +224,14 @@
rm $OBJ/cert_user_key_revoked
${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked \
$OBJ/cert_user_key_${ktype}.pub
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpecedly"
fi
verbose "$tid: ${_prefix} empty KRL"
${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
@@ -246,7 +246,7 @@
echo "PubkeyAcceptedKeyTypes ${t}"
echo "$extra_sshd"
) > $OBJ/sshd_proxy
- ${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpecedly"
@@ -260,7 +260,7 @@
echo "$extra_sshd"
) > $OBJ/sshd_proxy
verbose "$tid: ensure CA key does not authenticate user"
- ${SSH} -2i $OBJ/user_ca_key \
+ ${SSH} -i $OBJ/user_ca_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect with CA key succeeded unexpectedly"
@@ -307,7 +307,7 @@
$sign_opts $OBJ/cert_user_key_${ktype} ||
fail "couldn't sign cert_user_key_${ktype}"
- ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
rc=$?
if [ "x$result" = "xsuccess" ] ; then
@@ -378,7 +378,7 @@
-n $USER $OBJ/cert_user_key_${ktype} ||
fatal "couldn't sign cert_user_key_${ktype}"
verbose "$tid: user ${ktype} connect wrong cert"
- ${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
+ ${SSH} -i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect $ident succeeded unexpectedly"
diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh
index 0562963..2504d04 100644
--- a/regress/cfgmatch.sh
+++ b/regress/cfgmatch.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: cfgmatch.sh,v 1.9 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: cfgmatch.sh,v 1.10 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="sshd_config match"
@@ -13,7 +13,7 @@
start_client()
{
rm -f $pidfile
- ${SSH} -q -$p $fwd "$@" somehost \
+ ${SSH} -q $fwd "$@" somehost \
exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' \
>>$TEST_REGRESS_LOGFILE 2>&1 &
client_pid=$!
@@ -56,22 +56,18 @@
#set -x
# Test Match + PermitOpen in sshd_config. This should be permitted
-for p in ${SSH_PROTOCOLS}; do
- trace "match permitopen localhost proto $p"
- start_client -F $OBJ/ssh_config
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
- fail "match permitopen permit proto $p"
- stop_client
-done
+trace "match permitopen localhost"
+start_client -F $OBJ/ssh_config
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
+ fail "match permitopen permit"
+stop_client
# Same but from different source. This should not be permitted
-for p in ${SSH_PROTOCOLS}; do
- trace "match permitopen proxy proto $p"
- start_client -F $OBJ/ssh_proxy
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
- fail "match permitopen deny proto $p"
- stop_client
-done
+trace "match permitopen proxy"
+start_client -F $OBJ/ssh_proxy
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true && \
+ fail "match permitopen deny"
+stop_client
# Retry previous with key option, should also be denied.
cp /dev/null $OBJ/authorized_keys_$USER
@@ -79,23 +75,19 @@
printf 'permitopen="127.0.0.1:'$PORT'" ' >> $OBJ/authorized_keys_$USER
cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
done
-for p in ${SSH_PROTOCOLS}; do
- trace "match permitopen proxy w/key opts proto $p"
- start_client -F $OBJ/ssh_proxy
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
- fail "match permitopen deny w/key opt proto $p"
- stop_client
-done
+trace "match permitopen proxy w/key opts"
+start_client -F $OBJ/ssh_proxy
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true && \
+ fail "match permitopen deny w/key opt"
+stop_client
# Test both sshd_config and key options permitting the same dst/port pair.
# Should be permitted.
-for p in ${SSH_PROTOCOLS}; do
- trace "match permitopen localhost proto $p"
- start_client -F $OBJ/ssh_config
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
- fail "match permitopen permit proto $p"
- stop_client
-done
+trace "match permitopen localhost"
+start_client -F $OBJ/ssh_config
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
+ fail "match permitopen permit"
+stop_client
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy
@@ -103,13 +95,11 @@
echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
# Test that a Match overrides a PermitOpen in the global section
-for p in ${SSH_PROTOCOLS}; do
- trace "match permitopen proxy w/key opts proto $p"
- start_client -F $OBJ/ssh_proxy
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
- fail "match override permitopen proto $p"
- stop_client
-done
+trace "match permitopen proxy w/key opts"
+start_client -F $OBJ/ssh_proxy
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true && \
+ fail "match override permitopen"
+stop_client
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy
@@ -118,10 +108,8 @@
# Test that a rule that doesn't match doesn't override, plus test a
# PermitOpen entry that's not at the start of the list
-for p in ${SSH_PROTOCOLS}; do
- trace "nomatch permitopen proxy w/key opts proto $p"
- start_client -F $OBJ/ssh_proxy
- ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
- fail "nomatch override permitopen proto $p"
- stop_client
-done
+trace "nomatch permitopen proxy w/key opts"
+start_client -F $OBJ/ssh_proxy
+${SSH} -q -p $fwdport -F $OBJ/ssh_config somehost true || \
+ fail "nomatch override permitopen"
+stop_client
diff --git a/regress/cipher-speed.sh b/regress/cipher-speed.sh
index 575dc23..5da95b3 100644
--- a/regress/cipher-speed.sh
+++ b/regress/cipher-speed.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: cipher-speed.sh,v 1.13 2015/03/24 20:22:17 markus Exp $
+# $OpenBSD: cipher-speed.sh,v 1.14 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="cipher speed"
@@ -12,16 +12,16 @@
tries="1 2"
for c in `${SSH} -Q cipher`; do n=0; for m in `${SSH} -Q mac`; do
- trace "proto 2 cipher $c mac $m"
+ trace "cipher $c mac $m"
for x in $tries; do
printf "%-60s" "$c/$m:"
( ${SSH} -o 'compression no' \
- -F $OBJ/ssh_proxy -2 -m $m -c $c somehost \
+ -F $OBJ/ssh_proxy -m $m -c $c somehost \
exec sh -c \'"dd of=/dev/null obs=32k"\' \
< ${DATA} ) 2>&1 | getbytes
if [ $? -ne 0 ]; then
- fail "ssh -2 failed with mac $m cipher $c"
+ fail "ssh failed with mac $m cipher $c"
fi
done
# No point trying all MACs for AEAD ciphers since they are ignored.
@@ -30,22 +30,3 @@
fi
n=`expr $n + 1`
done; done
-
-if ssh_version 1; then
- ciphers="3des blowfish"
-else
- ciphers=""
-fi
-for c in $ciphers; do
- trace "proto 1 cipher $c"
- for x in $tries; do
- printf "%-60s" "$c:"
- ( ${SSH} -o 'compression no' \
- -F $OBJ/ssh_proxy -1 -c $c somehost \
- exec sh -c \'"dd of=/dev/null obs=32k"\' \
- < ${DATA} ) 2>&1 | getbytes
- if [ $? -ne 0 ]; then
- fail "ssh -1 failed with cipher $c"
- fi
- done
-done
diff --git a/regress/connect-privsep.sh b/regress/connect-privsep.sh
index 81cedc7..b6abb65 100644
--- a/regress/connect-privsep.sh
+++ b/regress/connect-privsep.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: connect-privsep.sh,v 1.8 2016/11/01 13:43:27 tb Exp $
+# $OpenBSD: connect-privsep.sh,v 1.9 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="proxy connect with privsep"
@@ -6,23 +6,19 @@
cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
echo 'UsePrivilegeSeparation yes' >> $OBJ/sshd_proxy
-for p in ${SSH_PROTOCOLS}; do
- ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
- if [ $? -ne 0 ]; then
- fail "ssh privsep+proxyconnect protocol $p failed"
- fi
-done
+${SSH} -F $OBJ/ssh_proxy 999.999.999.999 true
+if [ $? -ne 0 ]; then
+ fail "ssh privsep+proxyconnect failed"
+fi
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
echo 'UsePrivilegeSeparation sandbox' >> $OBJ/sshd_proxy
-for p in ${SSH_PROTOCOLS}; do
- ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
- if [ $? -ne 0 ]; then
- # XXX replace this with fail once sandbox has stabilised
- warn "ssh privsep/sandbox+proxyconnect protocol $p failed"
- fi
-done
+${SSH} -F $OBJ/ssh_proxy 999.999.999.999 true
+if [ $? -ne 0 ]; then
+ # XXX replace this with fail once sandbox has stabilised
+ warn "ssh privsep/sandbox+proxyconnect failed"
+fi
# Because sandbox is sensitive to changes in libc, especially malloc, retest
# with every malloc.conf option (and none).
@@ -32,10 +28,8 @@
mopts=`echo $TEST_MALLOC_OPTIONS | sed 's/./& /g'`
fi
for m in '' $mopts ; do
- for p in ${SSH_PROTOCOLS}; do
- env MALLOC_OPTIONS="$m" ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
+ env MALLOC_OPTIONS="$m" ${SSH} -F $OBJ/ssh_proxy 999.999.999.999 true
if [ $? -ne 0 ]; then
- fail "ssh privsep/sandbox+proxyconnect protocol $p mopt '$m' failed"
+ fail "ssh privsep/sandbox+proxyconnect mopt '$m' failed"
fi
- done
done
diff --git a/regress/connect.sh b/regress/connect.sh
index f0d55d3..1b344b6 100644
--- a/regress/connect.sh
+++ b/regress/connect.sh
@@ -1,13 +1,11 @@
-# $OpenBSD: connect.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: connect.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="simple connect"
start_sshd
-for p in ${SSH_PROTOCOLS}; do
- ${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true
- if [ $? -ne 0 ]; then
- fail "ssh connect with protocol $p failed"
- fi
-done
+${SSH} -F $OBJ/ssh_config somehost true
+if [ $? -ne 0 ]; then
+ fail "ssh connect with failed"
+fi
diff --git a/regress/dynamic-forward.sh b/regress/dynamic-forward.sh
index dd67c96..2e2115f 100644
--- a/regress/dynamic-forward.sh
+++ b/regress/dynamic-forward.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: dynamic-forward.sh,v 1.11 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: dynamic-forward.sh,v 1.12 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="dynamic forwarding"
diff --git a/regress/exit-status.sh b/regress/exit-status.sh
index 397d8d7..aadf99f 100644
--- a/regress/exit-status.sh
+++ b/regress/exit-status.sh
@@ -1,24 +1,22 @@
-# $OpenBSD: exit-status.sh,v 1.7 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: exit-status.sh,v 1.8 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="remote exit status"
-for p in ${SSH_PROTOCOLS}; do
- for s in 0 1 4 5 44; do
- trace "proto $p status $s"
- verbose "test $tid: proto $p status $s"
- ${SSH} -$p -F $OBJ/ssh_proxy otherhost exit $s
- r=$?
- if [ $r -ne $s ]; then
- fail "exit code mismatch for protocol $p: $r != $s"
- fi
+for s in 0 1 4 5 44; do
+ trace "status $s"
+ verbose "test $tid: status $s"
+ ${SSH} -F $OBJ/ssh_proxy otherhost exit $s
+ r=$?
+ if [ $r -ne $s ]; then
+ fail "exit code mismatch for: $r != $s"
+ fi
- # same with early close of stdout/err
- ${SSH} -$p -F $OBJ/ssh_proxy -n otherhost \
- exec sh -c \'"sleep 2; exec > /dev/null 2>&1; sleep 3; exit $s"\'
- r=$?
- if [ $r -ne $s ]; then
- fail "exit code (with sleep) mismatch for protocol $p: $r != $s"
- fi
- done
+ # same with early close of stdout/err
+ ${SSH} -F $OBJ/ssh_proxy -n otherhost exec \
+ sh -c \'"sleep 2; exec > /dev/null 2>&1; sleep 3; exit $s"\'
+ r=$?
+ if [ $r -ne $s ]; then
+ fail "exit code (with sleep) mismatch for: $r != $s"
+ fi
done
diff --git a/regress/forcecommand.sh b/regress/forcecommand.sh
index 8a9b090..e059f1f 100644
--- a/regress/forcecommand.sh
+++ b/regress/forcecommand.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: forcecommand.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: forcecommand.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="forced command"
@@ -11,11 +11,8 @@
cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
done
-for p in ${SSH_PROTOCOLS}; do
- trace "forced command in key option proto $p"
- ${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
- fail "forced command in key proto $p"
-done
+trace "forced command in key option"
+${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command in key"
cp /dev/null $OBJ/authorized_keys_$USER
for t in ${SSH_KEYTYPES}; do
@@ -26,19 +23,13 @@
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "ForceCommand true" >> $OBJ/sshd_proxy
-for p in ${SSH_PROTOCOLS}; do
- trace "forced command in sshd_config overrides key option proto $p"
- ${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
- fail "forced command in key proto $p"
-done
+trace "forced command in sshd_config overrides key option"
+${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command in key"
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "ForceCommand false" >> $OBJ/sshd_proxy
echo "Match User $USER" >> $OBJ/sshd_proxy
echo " ForceCommand true" >> $OBJ/sshd_proxy
-for p in ${SSH_PROTOCOLS}; do
- trace "forced command with match proto $p"
- ${SSH} -$p -F $OBJ/ssh_proxy somehost false \ ||
- fail "forced command in key proto $p"
-done
+trace "forced command with match"
+${SSH} -F $OBJ/ssh_proxy somehost false || fail "forced command in key"
diff --git a/regress/forward-control.sh b/regress/forward-control.sh
index 9195709..2e9dbb5 100644
--- a/regress/forward-control.sh
+++ b/regress/forward-control.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: forward-control.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: forward-control.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="sshd control of local and remote forwarding"
@@ -32,13 +32,12 @@
return 0
}
-# usage: check_lfwd protocol Y|N message
+# usage: check_lfwd Y|N message
check_lfwd() {
- _proto=$1
- _expected=$2
- _message=$3
+ _expected=$1
+ _message=$2
rm -f $READY
- ${SSH} -oProtocol=$_proto -F $OBJ/ssh_proxy \
+ ${SSH} -F $OBJ/ssh_proxy \
-L$LFWD_PORT:127.0.0.1:$PORT \
-o ExitOnForwardFailure=yes \
-n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
@@ -62,13 +61,12 @@
fi
}
-# usage: check_rfwd protocol Y|N message
+# usage: check_rfwd Y|N message
check_rfwd() {
- _proto=$1
- _expected=$2
- _message=$3
+ _expected=$1
+ _message=$2
rm -f $READY
- ${SSH} -oProtocol=$_proto -F $OBJ/ssh_proxy \
+ ${SSH} -F $OBJ/ssh_proxy \
-R$RFWD_PORT:127.0.0.1:$PORT \
-o ExitOnForwardFailure=yes \
-n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
@@ -99,10 +97,8 @@
cp ${OBJ}/authorized_keys_${USER} ${OBJ}/authorized_keys_${USER}.bak
# Sanity check: ensure the default config allows forwarding
-for p in ${SSH_PROTOCOLS} ; do
- check_lfwd $p Y "proto $p, default configuration"
- check_rfwd $p Y "proto $p, default configuration"
-done
+check_lfwd Y "default configuration"
+check_rfwd Y "default configuration"
# Usage: all_tests yes|local|remote|no Y|N Y|N Y|N Y|N Y|N Y|N
all_tests() {
@@ -115,49 +111,46 @@
_permit_rfwd=$7
_badfwd=127.0.0.1:22
_goodfwd=127.0.0.1:${PORT}
- for _proto in ${SSH_PROTOCOLS} ; do
- cp ${OBJ}/authorized_keys_${USER}.bak \
- ${OBJ}/authorized_keys_${USER}
- _prefix="proto $_proto, AllowTcpForwarding=$_tcpfwd"
- # No PermitOpen
- ( cat ${OBJ}/sshd_proxy.bak ;
- echo "AllowTcpForwarding $_tcpfwd" ) \
- > ${OBJ}/sshd_proxy
- check_lfwd $_proto $_plain_lfwd "$_prefix"
- check_rfwd $_proto $_plain_rfwd "$_prefix"
- # PermitOpen via sshd_config that doesn't match
- ( cat ${OBJ}/sshd_proxy.bak ;
- echo "AllowTcpForwarding $_tcpfwd" ;
- echo "PermitOpen $_badfwd" ) \
- > ${OBJ}/sshd_proxy
- check_lfwd $_proto $_nopermit_lfwd "$_prefix, !PermitOpen"
- check_rfwd $_proto $_nopermit_rfwd "$_prefix, !PermitOpen"
- # PermitOpen via sshd_config that does match
- ( cat ${OBJ}/sshd_proxy.bak ;
- echo "AllowTcpForwarding $_tcpfwd" ;
- echo "PermitOpen $_badfwd $_goodfwd" ) \
- > ${OBJ}/sshd_proxy
- # NB. permitopen via authorized_keys should have same
- # success/fail as via sshd_config
- # permitopen via authorized_keys that doesn't match
- sed "s/^/permitopen=\"$_badfwd\" /" \
- < ${OBJ}/authorized_keys_${USER}.bak \
- > ${OBJ}/authorized_keys_${USER} || fatal "sed 1 fail"
- ( cat ${OBJ}/sshd_proxy.bak ;
- echo "AllowTcpForwarding $_tcpfwd" ) \
- > ${OBJ}/sshd_proxy
- check_lfwd $_proto $_nopermit_lfwd "$_prefix, !permitopen"
- check_rfwd $_proto $_nopermit_rfwd "$_prefix, !permitopen"
- # permitopen via authorized_keys that does match
- sed "s/^/permitopen=\"$_badfwd\",permitopen=\"$_goodfwd\" /" \
- < ${OBJ}/authorized_keys_${USER}.bak \
- > ${OBJ}/authorized_keys_${USER} || fatal "sed 2 fail"
- ( cat ${OBJ}/sshd_proxy.bak ;
- echo "AllowTcpForwarding $_tcpfwd" ) \
- > ${OBJ}/sshd_proxy
- check_lfwd $_proto $_permit_lfwd "$_prefix, permitopen"
- check_rfwd $_proto $_permit_rfwd "$_prefix, permitopen"
- done
+ cp ${OBJ}/authorized_keys_${USER}.bak ${OBJ}/authorized_keys_${USER}
+ _prefix="AllowTcpForwarding=$_tcpfwd"
+ # No PermitOpen
+ ( cat ${OBJ}/sshd_proxy.bak ;
+ echo "AllowTcpForwarding $_tcpfwd" ) \
+ > ${OBJ}/sshd_proxy
+ check_lfwd $_plain_lfwd "$_prefix"
+ check_rfwd $_plain_rfwd "$_prefix"
+ # PermitOpen via sshd_config that doesn't match
+ ( cat ${OBJ}/sshd_proxy.bak ;
+ echo "AllowTcpForwarding $_tcpfwd" ;
+ echo "PermitOpen $_badfwd" ) \
+ > ${OBJ}/sshd_proxy
+ check_lfwd $_nopermit_lfwd "$_prefix, !PermitOpen"
+ check_rfwd $_nopermit_rfwd "$_prefix, !PermitOpen"
+ # PermitOpen via sshd_config that does match
+ ( cat ${OBJ}/sshd_proxy.bak ;
+ echo "AllowTcpForwarding $_tcpfwd" ;
+ echo "PermitOpen $_badfwd $_goodfwd" ) \
+ > ${OBJ}/sshd_proxy
+ # NB. permitopen via authorized_keys should have same
+ # success/fail as via sshd_config
+ # permitopen via authorized_keys that doesn't match
+ sed "s/^/permitopen=\"$_badfwd\" /" \
+ < ${OBJ}/authorized_keys_${USER}.bak \
+ > ${OBJ}/authorized_keys_${USER} || fatal "sed 1 fail"
+ ( cat ${OBJ}/sshd_proxy.bak ;
+ echo "AllowTcpForwarding $_tcpfwd" ) \
+ > ${OBJ}/sshd_proxy
+ check_lfwd $_nopermit_lfwd "$_prefix, !permitopen"
+ check_rfwd $_nopermit_rfwd "$_prefix, !permitopen"
+ # permitopen via authorized_keys that does match
+ sed "s/^/permitopen=\"$_badfwd\",permitopen=\"$_goodfwd\" /" \
+ < ${OBJ}/authorized_keys_${USER}.bak \
+ > ${OBJ}/authorized_keys_${USER} || fatal "sed 2 fail"
+ ( cat ${OBJ}/sshd_proxy.bak ;
+ echo "AllowTcpForwarding $_tcpfwd" ) \
+ > ${OBJ}/sshd_proxy
+ check_lfwd $_permit_lfwd "$_prefix, permitopen"
+ check_rfwd $_permit_rfwd "$_prefix, permitopen"
}
# no-permitopen mismatch-permitopen match-permitopen
diff --git a/regress/forwarding.sh b/regress/forwarding.sh
index 45c596d..39fccba 100644
--- a/regress/forwarding.sh
+++ b/regress/forwarding.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: forwarding.sh,v 1.19 2017/01/30 05:22:14 djm Exp $
+# $OpenBSD: forwarding.sh,v 1.20 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="local and remote forwarding"
@@ -22,30 +22,24 @@
last=$a
done
done
-for p in ${SSH_PROTOCOLS}; do
- q=`expr 3 - $p`
- if ! ssh_version $q; then
- q=$p
- fi
- trace "start forwarding, fork to background"
- rm -f $CTL
- ${SSH} -S $CTL -M -$p -F $OBJ/ssh_config -f $fwd somehost sleep 10
- trace "transfer over forwarded channels and check result"
- ${SSH} -$q -F $OBJ/ssh_config -p$last -o 'ConnectionAttempts=4' \
- somehost cat ${DATA} > ${COPY}
- test -s ${COPY} || fail "failed copy of ${DATA}"
- cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
+trace "start forwarding, fork to background"
+rm -f $CTL
+${SSH} -S $CTL -M -F $OBJ/ssh_config -f $fwd somehost sleep 10
- ${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
-done
+trace "transfer over forwarded channels and check result"
+${SSH} -F $OBJ/ssh_config -p$last -o 'ConnectionAttempts=4' \
+ somehost cat ${DATA} > ${COPY}
+test -s ${COPY} || fail "failed copy of ${DATA}"
+cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
-for p in ${SSH_PROTOCOLS}; do
+${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
+
for d in L R; do
- trace "exit on -$d forward failure, proto $p"
+ trace "exit on -$d forward failure"
# this one should succeed
- ${SSH} -$p -F $OBJ/ssh_config \
+ ${SSH} -F $OBJ/ssh_config \
-$d ${base}01:127.0.0.1:$PORT \
-$d ${base}02:127.0.0.1:$PORT \
-$d ${base}03:127.0.0.1:$PORT \
@@ -55,7 +49,7 @@
fatal "connection failed, should not"
else
# this one should fail
- ${SSH} -q -$p -F $OBJ/ssh_config \
+ ${SSH} -q -F $OBJ/ssh_config \
-$d ${base}01:127.0.0.1:$PORT \
-$d ${base}02:127.0.0.1:$PORT \
-$d ${base}03:127.0.0.1:$PORT \
@@ -68,82 +62,74 @@
fi
fi
done
-done
-for p in ${SSH_PROTOCOLS}; do
- trace "simple clear forwarding proto $p"
- ${SSH} -$p -F $OBJ/ssh_config -oClearAllForwardings=yes somehost true
+trace "simple clear forwarding"
+${SSH} -F $OBJ/ssh_config -oClearAllForwardings=yes somehost true
- trace "clear local forward proto $p"
- rm -f $CTL
- ${SSH} -S $CTL -M -$p -f -F $OBJ/ssh_config -L ${base}01:127.0.0.1:$PORT \
- -oClearAllForwardings=yes somehost sleep 10
- if [ $? != 0 ]; then
- fail "connection failed with cleared local forwarding"
- else
- # this one should fail
- ${SSH} -$p -F $OBJ/ssh_config -p ${base}01 somehost true \
- >>$TEST_REGRESS_LOGFILE 2>&1 && \
- fail "local forwarding not cleared"
- fi
- ${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
-
- trace "clear remote forward proto $p"
- rm -f $CTL
- ${SSH} -S $CTL -M -$p -f -F $OBJ/ssh_config -R ${base}01:127.0.0.1:$PORT \
- -oClearAllForwardings=yes somehost sleep 10
- if [ $? != 0 ]; then
- fail "connection failed with cleared remote forwarding"
- else
- # this one should fail
- ${SSH} -$p -F $OBJ/ssh_config -p ${base}01 somehost true \
- >>$TEST_REGRESS_LOGFILE 2>&1 && \
- fail "remote forwarding not cleared"
- fi
- ${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
-done
+trace "clear local forward"
+rm -f $CTL
+${SSH} -S $CTL -M -f -F $OBJ/ssh_config -L ${base}01:127.0.0.1:$PORT \
+ -oClearAllForwardings=yes somehost sleep 10
+if [ $? != 0 ]; then
+ fail "connection failed with cleared local forwarding"
+else
+ # this one should fail
+ ${SSH} -F $OBJ/ssh_config -p ${base}01 somehost true \
+ >>$TEST_REGRESS_LOGFILE 2>&1 && \
+ fail "local forwarding not cleared"
+fi
+${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
-for p in 2; do
- trace "stdio forwarding proto $p"
- cmd="${SSH} -$p -F $OBJ/ssh_config"
- $cmd -o "ProxyCommand $cmd -q -W localhost:$PORT somehost" \
- somehost true
- if [ $? != 0 ]; then
- fail "stdio forwarding proto $p"
- fi
-done
+trace "clear remote forward"
+rm -f $CTL
+${SSH} -S $CTL -M -f -F $OBJ/ssh_config -R ${base}01:127.0.0.1:$PORT \
+ -oClearAllForwardings=yes somehost sleep 10
+if [ $? != 0 ]; then
+ fail "connection failed with cleared remote forwarding"
+else
+ # this one should fail
+ ${SSH} -F $OBJ/ssh_config -p ${base}01 somehost true \
+ >>$TEST_REGRESS_LOGFILE 2>&1 && \
+ fail "remote forwarding not cleared"
+fi
+${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
+
+trace "stdio forwarding"
+cmd="${SSH} -F $OBJ/ssh_config"
+$cmd -o "ProxyCommand $cmd -q -W localhost:$PORT somehost" somehost true
+if [ $? != 0 ]; then
+ fail "stdio forwarding"
+fi
echo "LocalForward ${base}01 127.0.0.1:$PORT" >> $OBJ/ssh_config
echo "RemoteForward ${base}02 127.0.0.1:${base}01" >> $OBJ/ssh_config
-for p in ${SSH_PROTOCOLS}; do
- trace "config file: start forwarding, fork to background"
- rm -f $CTL
- ${SSH} -S $CTL -M -$p -F $OBJ/ssh_config -f somehost sleep 10
- trace "config file: transfer over forwarded channels and check result"
- ${SSH} -F $OBJ/ssh_config -p${base}02 -o 'ConnectionAttempts=4' \
- somehost cat ${DATA} > ${COPY}
- test -s ${COPY} || fail "failed copy of ${DATA}"
- cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
+trace "config file: start forwarding, fork to background"
+rm -f $CTL
+${SSH} -S $CTL -M -F $OBJ/ssh_config -f somehost sleep 10
- ${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
-done
+trace "config file: transfer over forwarded channels and check result"
+${SSH} -F $OBJ/ssh_config -p${base}02 -o 'ConnectionAttempts=4' \
+ somehost cat ${DATA} > ${COPY}
+test -s ${COPY} || fail "failed copy of ${DATA}"
+cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
-for p in 2; do
- trace "transfer over chained unix domain socket forwards and check result"
- rm -f $OBJ/unix-[123].fwd
- rm -f $CTL $CTL.[123]
- ${SSH} -S $CTL -M -f -F $OBJ/ssh_config -R${base}01:[$OBJ/unix-1.fwd] somehost sleep 10
- ${SSH} -S $CTL.1 -M -f -F $OBJ/ssh_config -L[$OBJ/unix-1.fwd]:[$OBJ/unix-2.fwd] somehost sleep 10
- ${SSH} -S $CTL.2 -M -f -F $OBJ/ssh_config -R[$OBJ/unix-2.fwd]:[$OBJ/unix-3.fwd] somehost sleep 10
- ${SSH} -S $CTL.3 -M -f -F $OBJ/ssh_config -L[$OBJ/unix-3.fwd]:127.0.0.1:$PORT somehost sleep 10
- ${SSH} -F $OBJ/ssh_config -p${base}01 -o 'ConnectionAttempts=4' \
- somehost cat ${DATA} > ${COPY}
- test -s ${COPY} || fail "failed copy ${DATA}"
- cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
+${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
- ${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
- ${SSH} -F $OBJ/ssh_config -S $CTL.1 -O exit somehost
- ${SSH} -F $OBJ/ssh_config -S $CTL.2 -O exit somehost
- ${SSH} -F $OBJ/ssh_config -S $CTL.3 -O exit somehost
-done
+trace "transfer over chained unix domain socket forwards and check result"
+rm -f $OBJ/unix-[123].fwd
+rm -f $CTL $CTL.[123]
+${SSH} -S $CTL -M -f -F $OBJ/ssh_config -R${base}01:[$OBJ/unix-1.fwd] somehost sleep 10
+${SSH} -S $CTL.1 -M -f -F $OBJ/ssh_config -L[$OBJ/unix-1.fwd]:[$OBJ/unix-2.fwd] somehost sleep 10
+${SSH} -S $CTL.2 -M -f -F $OBJ/ssh_config -R[$OBJ/unix-2.fwd]:[$OBJ/unix-3.fwd] somehost sleep 10
+${SSH} -S $CTL.3 -M -f -F $OBJ/ssh_config -L[$OBJ/unix-3.fwd]:127.0.0.1:$PORT somehost sleep 10
+${SSH} -F $OBJ/ssh_config -p${base}01 -o 'ConnectionAttempts=4' \
+ somehost cat ${DATA} > ${COPY}
+test -s ${COPY} || fail "failed copy ${DATA}"
+cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
+
+${SSH} -F $OBJ/ssh_config -S $CTL -O exit somehost
+${SSH} -F $OBJ/ssh_config -S $CTL.1 -O exit somehost
+${SSH} -F $OBJ/ssh_config -S $CTL.2 -O exit somehost
+${SSH} -F $OBJ/ssh_config -S $CTL.3 -O exit somehost
+
diff --git a/regress/host-expand.sh b/regress/host-expand.sh
index 2a95bfe..9444f7f 100644
--- a/regress/host-expand.sh
+++ b/regress/host-expand.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: host-expand.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: host-expand.sh,v 1.5 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="expand %h and %n"
@@ -11,9 +11,6 @@
127.0.0.1
EOE
-for p in ${SSH_PROTOCOLS}; do
- verbose "test $tid: proto $p"
- ${SSH} -F $OBJ/ssh_proxy -$p somehost true >$OBJ/actual
- diff $OBJ/expect $OBJ/actual || fail "$tid proto $p"
-done
+${SSH} -F $OBJ/ssh_proxy somehost true >$OBJ/actual
+diff $OBJ/expect $OBJ/actual || fail "$tid"
diff --git a/regress/hostkey-agent.sh b/regress/hostkey-agent.sh
index 094700d..811b6b9 100644
--- a/regress/hostkey-agent.sh
+++ b/regress/hostkey-agent.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: hostkey-agent.sh,v 1.6 2015/07/10 06:23:25 markus Exp $
+# $OpenBSD: hostkey-agent.sh,v 1.7 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="hostkey agent"
@@ -40,7 +40,7 @@
cp $OBJ/known_hosts.orig $OBJ/known_hosts
SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
if [ $? -ne 0 ]; then
- fail "protocol $p privsep=$ps failed"
+ fail "privsep=$ps failed"
fi
if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
fail "bad SSH_CONNECTION key type $k privsep=$ps"
diff --git a/regress/integrity.sh b/regress/integrity.sh
index b71aa46..3eda40f 100644
--- a/regress/integrity.sh
+++ b/regress/integrity.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: integrity.sh,v 1.22 2017/04/28 04:16:27 dtucker Exp $
+# $OpenBSD: integrity.sh,v 1.23 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="integrity"
@@ -46,7 +46,7 @@
macopt="-m $m -c aes128-ctr"
fi
verbose "test $tid: $m @$off"
- ${SSH} $macopt -2F $OBJ/ssh_proxy -o "$pxy" \
+ ${SSH} $macopt -F $OBJ/ssh_proxy -o "$pxy" \
-oServerAliveInterval=1 -oServerAliveCountMax=30 \
999.999.999.999 'printf "%4096s" " "' >/dev/null
if [ $? -eq 0 ]; then
diff --git a/regress/key-options.sh b/regress/key-options.sh
index 7a68ad3..2adee68 100644
--- a/regress/key-options.sh
+++ b/regress/key-options.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: key-options.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: key-options.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="key options"
@@ -8,64 +8,56 @@
cp $authkeys $origkeys
# Test command= forced command
-for p in ${SSH_PROTOCOLS}; do
- for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do
+for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do
sed "s/.*/$c &/" $origkeys >$authkeys
- verbose "key option proto $p $c"
- r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost echo foo`
+ verbose "key option $c"
+ r=`${SSH} -q -F $OBJ/ssh_proxy somehost echo foo`
if [ "$r" = "foo" ]; then
fail "key option forced command not restricted"
fi
if [ "$r" != "bar" ]; then
fail "key option forced command not executed"
fi
- done
done
# Test no-pty
sed 's/.*/no-pty &/' $origkeys >$authkeys
-for p in ${SSH_PROTOCOLS}; do
- verbose "key option proto $p no-pty"
- r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost tty`
- if [ -f "$r" ]; then
- fail "key option failed proto $p no-pty (pty $r)"
- fi
-done
+verbose "key option proto no-pty"
+r=`${SSH} -q -F $OBJ/ssh_proxy somehost tty`
+if [ -f "$r" ]; then
+ fail "key option failed no-pty (pty $r)"
+fi
# Test environment=
echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy
sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys
-for p in ${SSH_PROTOCOLS}; do
- verbose "key option proto $p environment"
- r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo $FOO'`
- if [ "$r" != "bar" ]; then
- fail "key option environment not set"
- fi
-done
+verbose "key option environment"
+r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo $FOO'`
+if [ "$r" != "bar" ]; then
+ fail "key option environment not set"
+fi
# Test from= restriction
start_sshd
-for p in ${SSH_PROTOCOLS}; do
- for f in 127.0.0.1 '127.0.0.0\/8'; do
+for f in 127.0.0.1 '127.0.0.0\/8'; do
cat $origkeys >$authkeys
- ${SSH} -$p -q -F $OBJ/ssh_proxy somehost true
+ ${SSH} -q -F $OBJ/ssh_proxy somehost true
if [ $? -ne 0 ]; then
- fail "key option proto $p failed without restriction"
+ fail "key option failed without restriction"
fi
sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys
from=`head -1 $authkeys | cut -f1 -d ' '`
- verbose "key option proto $p $from"
- r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo true'`
+ verbose "key option $from"
+ r=`${SSH} -q -F $OBJ/ssh_proxy somehost 'echo true'`
if [ "$r" = "true" ]; then
- fail "key option proto $p $from not restricted"
+ fail "key option $from not restricted"
fi
- r=`${SSH} -$p -q -F $OBJ/ssh_config somehost 'echo true'`
+ r=`${SSH} -q -F $OBJ/ssh_config somehost 'echo true'`
if [ "$r" != "true" ]; then
- fail "key option proto $p $from not allowed but should be"
+ fail "key option $from not allowed but should be"
fi
- done
done
rm -f "$origkeys"
diff --git a/regress/keygen-change.sh b/regress/keygen-change.sh
index e561850..8b8acd5 100644
--- a/regress/keygen-change.sh
+++ b/regress/keygen-change.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: keygen-change.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: keygen-change.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="change passphrase for key"
@@ -7,9 +7,6 @@
S2="2secret"
KEYTYPES=`${SSH} -Q key-plain`
-if ssh_version 1; then
- KEYTYPES="${KEYTYPES} rsa1"
-fi
for t in $KEYTYPES; do
# generate user key for agent
diff --git a/regress/keyscan.sh b/regress/keyscan.sh
index f97364b..3bde121 100644
--- a/regress/keyscan.sh
+++ b/regress/keyscan.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: keyscan.sh,v 1.5 2015/09/11 03:44:21 djm Exp $
+# $OpenBSD: keyscan.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="keyscan"
@@ -9,10 +9,6 @@
start_sshd
KEYTYPES=`${SSH} -Q key-plain`
-if ssh_version 1; then
- KEYTYPES="${KEYTYPES} rsa1"
-fi
-
for t in $KEYTYPES; do
trace "keyscan type $t"
${SSHKEYSCAN} -t $t -p $PORT 127.0.0.1 127.0.0.1 127.0.0.1 \
diff --git a/regress/localcommand.sh b/regress/localcommand.sh
index 220f19a..5224a16 100644
--- a/regress/localcommand.sh
+++ b/regress/localcommand.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: localcommand.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: localcommand.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="localcommand"
@@ -6,10 +6,8 @@
echo 'PermitLocalCommand yes' >> $OBJ/ssh_proxy
echo 'LocalCommand echo foo' >> $OBJ/ssh_proxy
-for p in ${SSH_PROTOCOLS}; do
- verbose "test $tid: proto $p localcommand"
- a=`${SSH} -F $OBJ/ssh_proxy -$p somehost true`
- if [ "$a" != "foo" ] ; then
- fail "$tid proto $p"
- fi
-done
+verbose "test $tid: proto $p localcommand"
+a=`${SSH} -F $OBJ/ssh_proxy somehost true`
+if [ "$a" != "foo" ] ; then
+ fail "$tid proto $p"
+fi
diff --git a/regress/misc/kexfuzz/kexfuzz.c b/regress/misc/kexfuzz/kexfuzz.c
index 6705802..3e2c481 100644
--- a/regress/misc/kexfuzz/kexfuzz.c
+++ b/regress/misc/kexfuzz/kexfuzz.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexfuzz.c,v 1.3 2016/10/11 21:49:54 djm Exp $ */
+/* $OpenBSD: kexfuzz.c,v 1.4 2017/04/30 23:34:55 djm Exp $ */
/*
* Fuzz harness for KEX code
*
@@ -418,7 +418,7 @@
close(fd);
/* XXX check that it is a private key */
/* XXX support certificates */
- if (key == NULL || key->type == KEY_UNSPEC || key->type == KEY_RSA1)
+ if (key == NULL || key->type == KEY_UNSPEC)
badusage("Invalid key file (-k flag)");
/* Replace (fuzz) mode */
diff --git a/regress/multiplex.sh b/regress/multiplex.sh
index acb9234..078a53a 100644
--- a/regress/multiplex.sh
+++ b/regress/multiplex.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: multiplex.sh,v 1.27 2014/12/22 06:14:29 djm Exp $
+# $OpenBSD: multiplex.sh,v 1.28 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
CTL=/tmp/openssh.regress.ctl-sock.$$
@@ -101,7 +101,7 @@
${SSH} -F $OBJ/ssh_config -S $CTL otherhost exit $s
r=$?
if [ $r -ne $s ]; then
- fail "exit code mismatch for protocol $p: $r != $s"
+ fail "exit code mismatch: $r != $s"
fi
# same with early close of stdout/err
@@ -110,7 +110,7 @@
exec sh -c \'"sleep 2; exec > /dev/null 2>&1; sleep 3; exit $s"\'
r=$?
if [ $r -ne $s ]; then
- fail "exit code (with sleep) mismatch for protocol $p: $r != $s"
+ fail "exit code (with sleep) mismatch: $r != $s"
fi
done
diff --git a/regress/principals-command.sh b/regress/principals-command.sh
index 9b38eb1..bcc68e8 100644
--- a/regress/principals-command.sh
+++ b/regress/principals-command.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: principals-command.sh,v 1.3 2016/09/26 21:34:38 bluhm Exp $
+# $OpenBSD: principals-command.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="authorized principals command"
@@ -78,7 +78,7 @@
# Empty authorized_principals
verbose "$tid: ${_prefix} empty authorized_principals"
echo > $OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key \
+ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -87,7 +87,7 @@
# Wrong authorized_principals
verbose "$tid: ${_prefix} wrong authorized_principals"
echo gregorsamsa > $OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key \
+ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -96,7 +96,7 @@
# Correct authorized_principals
verbose "$tid: ${_prefix} correct authorized_principals"
echo mekmitasdigoat > $OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key \
+ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
@@ -105,7 +105,7 @@
# authorized_principals with bad key option
verbose "$tid: ${_prefix} authorized_principals bad key opt"
echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key \
+ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -115,7 +115,7 @@
verbose "$tid: ${_prefix} authorized_principals command=false"
echo 'command="false" mekmitasdigoat' > \
$OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key \
+ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -125,7 +125,7 @@
verbose "$tid: ${_prefix} authorized_principals command=true"
echo 'command="true" mekmitasdigoat' > \
$OBJ/authorized_principals_$USER
- ${SSH} -2i $OBJ/cert_user_key \
+ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
@@ -144,7 +144,7 @@
printf 'cert-authority,principals="gregorsamsa" '
cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER
- ${SSH} -2i $OBJ/cert_user_key \
+ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -eq 0 ]; then
fail "ssh cert connect succeeded unexpectedly"
@@ -156,7 +156,7 @@
printf 'cert-authority,principals="mekmitasdigoat" '
cat $OBJ/user_ca_key.pub
) > $OBJ/authorized_keys_$USER
- ${SSH} -2i $OBJ/cert_user_key \
+ ${SSH} -i $OBJ/cert_user_key \
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
if [ $? -ne 0 ]; then
fail "ssh cert connect failed"
diff --git a/regress/proto-mismatch.sh b/regress/proto-mismatch.sh
index 9e8024b..6ab28c9 100644
--- a/regress/proto-mismatch.sh
+++ b/regress/proto-mismatch.sh
@@ -1,21 +1,17 @@
-# $OpenBSD: proto-mismatch.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: proto-mismatch.sh,v 1.5 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="protocol version mismatch"
mismatch ()
{
- server=$1
client=$2
- banner=`echo ${client} | ${SSHD} -o "Protocol=${server}" -i -f ${OBJ}/sshd_proxy`
+ banner=`echo ${client} | ${SSHD} -i -f ${OBJ}/sshd_proxy`
r=$?
trace "sshd prints ${banner}"
if [ $r -ne 255 ]; then
- fail "sshd prints ${banner} and accepts connect with version ${client}"
+ fail "sshd prints ${banner} but accepts version ${client}"
fi
}
-mismatch 2 SSH-1.5-HALLO
-if ssh_version 1; then
- mismatch 1 SSH-2.0-HALLO
-fi
+mismatch SSH-1.5-HALLO
diff --git a/regress/proto-version.sh b/regress/proto-version.sh
index cf49461..5faeb75 100644
--- a/regress/proto-version.sh
+++ b/regress/proto-version.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: proto-version.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: proto-version.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="sshd version with different protocol combinations"
@@ -6,9 +6,8 @@
# we just start sshd in inetd mode and check the banner
check_version ()
{
- version=$1
expect=$2
- banner=`printf '' | ${SSHD} -o "Protocol=${version}" -i -f ${OBJ}/sshd_proxy`
+ banner=`printf '' | ${SSHD} -i -f ${OBJ}/sshd_proxy`
case ${banner} in
SSH-1.99-*)
proto=199
@@ -24,13 +23,8 @@
;;
esac
if [ ${expect} -ne ${proto} ]; then
- fail "wrong protocol version ${banner} for ${version}"
+ fail "wrong protocol version ${banner}"
fi
}
-check_version 2 20
-if ssh_version 1; then
- check_version 2,1 199
- check_version 1,2 199
- check_version 1 15
-fi
+check_version 20
diff --git a/regress/proxy-connect.sh b/regress/proxy-connect.sh
index b7a43fa..f1b9d9f 100644
--- a/regress/proxy-connect.sh
+++ b/regress/proxy-connect.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: proxy-connect.sh,v 1.9 2016/02/17 02:24:17 djm Exp $
+# $OpenBSD: proxy-connect.sh,v 1.10 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="proxy connect"
@@ -6,27 +6,22 @@
mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
for ps in no yes; do
- cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
- echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
-
- for p in ${SSH_PROTOCOLS}; do
- for c in no yes; do
- verbose "plain username protocol $p privsep=$ps comp=$c"
- opts="-$p -oCompression=$c -F $OBJ/ssh_proxy"
- SSH_CONNECTION=`${SSH} $opts 999.999.999.999 'echo $SSH_CONNECTION'`
- if [ $? -ne 0 ]; then
- fail "ssh proxyconnect protocol $p privsep=$ps comp=$c failed"
- fi
- if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
- fail "bad SSH_CONNECTION protocol $p privsep=$ps comp=$c: " \
- "$SSH_CONNECTION"
- fi
- done
- done
+ cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
+ echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
+ for c in no yes; do
+ verbose "plain username privsep=$ps comp=$c"
+ opts="-oCompression=$c -F $OBJ/ssh_proxy"
+ SSH_CONNECTION=`${SSH} $opts 999.999.999.999 'echo $SSH_CONNECTION'`
+ if [ $? -ne 0 ]; then
+ fail "ssh proxyconnect privsep=$ps comp=$c failed"
+ fi
+ if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
+ fail "bad SSH_CONNECTION privsep=$ps comp=$c: " \
+ "$SSH_CONNECTION"
+ fi
+ done
done
-for p in ${SSH_PROTOCOLS}; do
- verbose "username with style protocol $p"
- ${SSH} -$p -F $OBJ/ssh_proxy ${USER}:style@999.999.999.999 true || \
- fail "ssh proxyconnect protocol $p failed"
-done
+verbose "username with style"
+${SSH} -F $OBJ/ssh_proxy ${USER}:style@999.999.999.999 true || \
+ fail "ssh proxyconnect failed"
diff --git a/regress/putty-transfer.sh b/regress/putty-transfer.sh
index 8eb6ae0..32c79f9 100644
--- a/regress/putty-transfer.sh
+++ b/regress/putty-transfer.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: putty-transfer.sh,v 1.4 2016/11/25 03:02:01 dtucker Exp $
+# $OpenBSD: putty-transfer.sh,v 1.5 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="putty transfer data"
@@ -8,33 +8,30 @@
exit 0
fi
-# XXX support protocol 1 too
-for p in 2; do
- for c in 0 1 ; do
- verbose "$tid: proto $p compression $c"
+for c in 0 1 ; do
+ verbose "$tid: compression $c"
+ rm -f ${COPY}
+ cp ${OBJ}/.putty/sessions/localhost_proxy \
+ ${OBJ}/.putty/sessions/compression_$c
+ echo "Compression=$c" >> ${OBJ}/.putty/sessions/kex_$k
+ env HOME=$PWD ${PLINK} -load compression_$c -batch \
+ -i putty.rsa cat ${DATA} > ${COPY}
+ if [ $? -ne 0 ]; then
+ fail "ssh cat $DATA failed"
+ fi
+ cmp ${DATA} ${COPY} || fail "corrupted copy"
+
+ for s in 10 100 1k 32k 64k 128k 256k; do
+ trace "compression $c dd-size ${s}"
rm -f ${COPY}
- cp ${OBJ}/.putty/sessions/localhost_proxy \
- ${OBJ}/.putty/sessions/compression_$c
- echo "Compression=$c" >> ${OBJ}/.putty/sessions/kex_$k
- env HOME=$PWD ${PLINK} -load compression_$c -batch \
- -i putty.rsa$p cat ${DATA} > ${COPY}
+ dd if=$DATA obs=${s} 2> /dev/null | \
+ env HOME=$PWD ${PLINK} -load compression_$c \
+ -batch -i putty.rsa \
+ "cat > ${COPY}"
if [ $? -ne 0 ]; then
fail "ssh cat $DATA failed"
fi
- cmp ${DATA} ${COPY} || fail "corrupted copy"
-
- for s in 10 100 1k 32k 64k 128k 256k; do
- trace "proto $p compression $c dd-size ${s}"
- rm -f ${COPY}
- dd if=$DATA obs=${s} 2> /dev/null | \
- env HOME=$PWD ${PLINK} -load compression_$c \
- -batch -i putty.rsa$p \
- "cat > ${COPY}"
- if [ $? -ne 0 ]; then
- fail "ssh cat $DATA failed"
- fi
- cmp $DATA ${COPY} || fail "corrupted copy"
- done
+ cmp $DATA ${COPY} || fail "corrupted copy"
done
done
rm -f ${COPY}
diff --git a/regress/reconfigure.sh b/regress/reconfigure.sh
index eecddd3..dd15edd 100644
--- a/regress/reconfigure.sh
+++ b/regress/reconfigure.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: reconfigure.sh,v 1.5 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: reconfigure.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="simple connect after reconfigure"
@@ -18,12 +18,10 @@
start_sshd
trace "connect before restart"
-for p in ${SSH_PROTOCOLS} ; do
- ${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true
- if [ $? -ne 0 ]; then
- fail "ssh connect with protocol $p failed before reconfigure"
- fi
-done
+${SSH} -F $OBJ/ssh_config somehost true
+if [ $? -ne 0 ]; then
+ fail "ssh connect with failed before reconfigure"
+fi
PID=`$SUDO cat $PIDFILE`
rm -f $PIDFILE
@@ -39,9 +37,7 @@
test -f $PIDFILE || fatal "sshd did not restart"
trace "connect after restart"
-for p in ${SSH_PROTOCOLS} ; do
- ${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true
- if [ $? -ne 0 ]; then
- fail "ssh connect with protocol $p failed after reconfigure"
- fi
-done
+${SSH} -F $OBJ/ssh_config somehost true
+if [ $? -ne 0 ]; then
+ fail "ssh connect with failed after reconfigure"
+fi
diff --git a/regress/reexec.sh b/regress/reexec.sh
index 72957d4..ce23a1a 100644
--- a/regress/reexec.sh
+++ b/regress/reexec.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: reexec.sh,v 1.10 2016/12/16 01:06:27 dtucker Exp $
+# $OpenBSD: reexec.sh,v 1.11 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="reexec tests"
@@ -19,16 +19,13 @@
copy_tests ()
{
rm -f ${COPY}
- for p in ${SSH_PROTOCOLS} ; do
- verbose "$tid: proto $p"
- ${SSH} -nqo "Protocol=$p" -F $OBJ/ssh_config somehost \
- cat ${DATA} > ${COPY}
- if [ $? -ne 0 ]; then
- fail "ssh cat $DATA failed"
- fi
- cmp ${DATA} ${COPY} || fail "corrupted copy"
- rm -f ${COPY}
- done
+ ${SSH} -nq -F $OBJ/ssh_config somehost \
+ cat ${DATA} > ${COPY}
+ if [ $? -ne 0 ]; then
+ fail "ssh cat $DATA failed"
+ fi
+ cmp ${DATA} ${COPY} || fail "corrupted copy"
+ rm -f ${COPY}
}
verbose "test config passing"
diff --git a/regress/stderr-after-eof.sh b/regress/stderr-after-eof.sh
index 218ac6b..9065245 100644
--- a/regress/stderr-after-eof.sh
+++ b/regress/stderr-after-eof.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: stderr-after-eof.sh,v 1.2 2013/05/17 04:29:14 dtucker Exp $
+# $OpenBSD: stderr-after-eof.sh,v 1.3 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="stderr data after eof"
@@ -10,7 +10,7 @@
(date;echo $i) | md5 >> ${DATA}
done
-${SSH} -2 -F $OBJ/ssh_proxy otherhost \
+${SSH} -F $OBJ/ssh_proxy otherhost \
exec sh -c \'"exec > /dev/null; sleep 2; cat ${DATA} 1>&2 $s"\' \
2> ${COPY}
r=$?
diff --git a/regress/stderr-data.sh b/regress/stderr-data.sh
index 8c8149a..0ceb72b 100644
--- a/regress/stderr-data.sh
+++ b/regress/stderr-data.sh
@@ -1,13 +1,12 @@
-# $OpenBSD: stderr-data.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: stderr-data.sh,v 1.5 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="stderr data transfer"
for n in '' -n; do
-for p in ${SSH_PROTOCOLS}; do
- verbose "test $tid: proto $p ($n)"
- ${SSH} $n -$p -F $OBJ/ssh_proxy otherhost \
- exec sh -c \'"exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \
+ verbose "test $tid: ($n)"
+ ${SSH} $n -F $OBJ/ssh_proxy otherhost exec \
+ sh -c \'"exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \
2> ${COPY}
r=$?
if [ $r -ne 0 ]; then
@@ -16,8 +15,8 @@
cmp ${DATA} ${COPY} || fail "stderr corrupt"
rm -f ${COPY}
- ${SSH} $n -$p -F $OBJ/ssh_proxy otherhost \
- exec sh -c \'"echo a; exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \
+ ${SSH} $n -F $OBJ/ssh_proxy otherhost exec \
+ sh -c \'"echo a; exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \
> /dev/null 2> ${COPY}
r=$?
if [ $r -ne 0 ]; then
@@ -26,4 +25,3 @@
cmp ${DATA} ${COPY} || fail "stderr corrupt"
rm -f ${COPY}
done
-done
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index dc033cd..1480f13 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: test-exec.sh,v 1.59 2017/02/07 23:03:11 dtucker Exp $
+# $OpenBSD: test-exec.sh,v 1.60 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
#SUDO=sudo
@@ -130,12 +130,6 @@
esac
fi
-SSH_PROTOCOLS=2
-#SSH_PROTOCOLS=`$SSH -Q protocol-version`
-if [ "x$TEST_SSH_PROTOCOLS" != "x" ]; then
- SSH_PROTOCOLS="${TEST_SSH_PROTOCOLS}"
-fi
-
# Path to sshd must be absolute for rexec
case "$SSHD" in
/*) ;;
@@ -386,22 +380,11 @@
exit $RESULT
}
-ssh_version ()
-{
- echo ${SSH_PROTOCOLS} | grep "$1" >/dev/null
-}
-
RESULT=0
PIDFILE=$OBJ/pidfile
trap fatal 3 2
-if ssh_version 1; then
- PROTO="2,1"
-else
- PROTO="2"
-fi
-
# create server config
cat << EOF > $OBJ/sshd_config
StrictModes no
@@ -460,11 +443,8 @@
rm -f $OBJ/known_hosts $OBJ/authorized_keys_$USER
-if ssh_version 1; then
- SSH_KEYTYPES="rsa rsa1"
-else
- SSH_KEYTYPES="rsa ed25519"
-fi
+SSH_KEYTYPES="rsa ed25519"
+
trace "generate keys"
for t in ${SSH_KEYTYPES}; do
# generate user key
diff --git a/regress/transfer.sh b/regress/transfer.sh
index 36c1463..cf174a0 100644
--- a/regress/transfer.sh
+++ b/regress/transfer.sh
@@ -1,26 +1,23 @@
-# $OpenBSD: transfer.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
+# $OpenBSD: transfer.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="transfer data"
-for p in ${SSH_PROTOCOLS}; do
- verbose "$tid: proto $p"
+rm -f ${COPY}
+${SSH} -n -q -F $OBJ/ssh_proxy somehost cat ${DATA} > ${COPY}
+if [ $? -ne 0 ]; then
+ fail "ssh cat $DATA failed"
+fi
+cmp ${DATA} ${COPY} || fail "corrupted copy"
+
+for s in 10 100 1k 32k 64k 128k 256k; do
+ trace "dd-size ${s}"
rm -f ${COPY}
- ${SSH} -n -q -$p -F $OBJ/ssh_proxy somehost cat ${DATA} > ${COPY}
+ dd if=$DATA obs=${s} 2> /dev/null | \
+ ${SSH} -q -F $OBJ/ssh_proxy somehost "cat > ${COPY}"
if [ $? -ne 0 ]; then
fail "ssh cat $DATA failed"
fi
- cmp ${DATA} ${COPY} || fail "corrupted copy"
-
- for s in 10 100 1k 32k 64k 128k 256k; do
- trace "proto $p dd-size ${s}"
- rm -f ${COPY}
- dd if=$DATA obs=${s} 2> /dev/null | \
- ${SSH} -q -$p -F $OBJ/ssh_proxy somehost "cat > ${COPY}"
- if [ $? -ne 0 ]; then
- fail "ssh cat $DATA failed"
- fi
- cmp $DATA ${COPY} || fail "corrupted copy"
- done
+ cmp $DATA ${COPY} || fail "corrupted copy"
done
rm -f ${COPY}
diff --git a/regress/try-ciphers.sh b/regress/try-ciphers.sh
index 889a735..e04268b 100644
--- a/regress/try-ciphers.sh
+++ b/regress/try-ciphers.sh
@@ -1,4 +1,4 @@
-# $OpenBSD: try-ciphers.sh,v 1.25 2015/03/24 20:22:17 markus Exp $
+# $OpenBSD: try-ciphers.sh,v 1.26 2017/04/30 23:34:55 djm Exp $
# Placed in the Public Domain.
tid="try ciphers"
@@ -8,14 +8,14 @@
for c in `${SSH} -Q cipher`; do
n=0
for m in `${SSH} -Q mac`; do
- trace "proto 2 cipher $c mac $m"
- verbose "test $tid: proto 2 cipher $c mac $m"
+ trace "cipher $c mac $m"
+ verbose "test $tid: cipher $c mac $m"
cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
echo "Ciphers=$c" >> $OBJ/sshd_proxy
echo "MACs=$m" >> $OBJ/sshd_proxy
- ${SSH} -F $OBJ/ssh_proxy -2 -m $m -c $c somehost true
+ ${SSH} -F $OBJ/ssh_proxy -m $m -c $c somehost true
if [ $? -ne 0 ]; then
- fail "ssh -2 failed with mac $m cipher $c"
+ fail "ssh failed with mac $m cipher $c"
fi
# No point trying all MACs for AEAD ciphers since they
# are ignored.
@@ -26,17 +26,3 @@
done
done
-if ssh_version 1; then
- ciphers="3des blowfish"
-else
- ciphers=""
-fi
-for c in $ciphers; do
- trace "proto 1 cipher $c"
- verbose "test $tid: proto 1 cipher $c"
- ${SSH} -F $OBJ/ssh_proxy -1 -c $c somehost true
- if [ $? -ne 0 ]; then
- fail "ssh -1 failed with cipher $c"
- fi
-done
-
diff --git a/regress/yes-head.sh b/regress/yes-head.sh
index 1fc7542..fce2f65 100644
--- a/regress/yes-head.sh
+++ b/regress/yes-head.sh
@@ -3,13 +3,11 @@
tid="yes pipe head"
-for p in ${SSH_PROTOCOLS}; do
- lines=`${SSH} -$p -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -2000"' | (sleep 3 ; wc -l)`
- if [ $? -ne 0 ]; then
- fail "yes|head test failed"
- lines = 0;
- fi
- if [ $lines -ne 2000 ]; then
- fail "yes|head returns $lines lines instead of 2000"
- fi
-done
+lines=`${SSH} -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -2000"' | (sleep 3 ; wc -l)`
+if [ $? -ne 0 ]; then
+ fail "yes|head test failed"
+ lines = 0;
+fi
+if [ $lines -ne 2000 ]; then
+ fail "yes|head returns $lines lines instead of 2000"
+fi