diff options
Diffstat (limited to 'crypto/openssh/regress/unittests')
105 files changed, 3283 insertions, 421 deletions
diff --git a/crypto/openssh/regress/unittests/Makefile b/crypto/openssh/regress/unittests/Makefile index e464b085adc8..e370900e4de6 100644 --- a/crypto/openssh/regress/unittests/Makefile +++ b/crypto/openssh/regress/unittests/Makefile @@ -1,7 +1,6 @@ -# $OpenBSD: Makefile,v 1.10 2018/03/03 03:16:17 djm Exp $ +# $OpenBSD: Makefile,v 1.13 2023/09/24 08:14:13 claudio Exp $ -REGRESS_FAIL_EARLY?= yes SUBDIR= test_helper sshbuf sshkey bitmap kex hostkeys utf8 match conversion -SUBDIR+=authopt +SUBDIR+=authopt misc sshsig .include <bsd.subdir.mk> diff --git a/crypto/openssh/regress/unittests/Makefile.inc b/crypto/openssh/regress/unittests/Makefile.inc index b509f4452500..98e280486ab1 100644 --- a/crypto/openssh/regress/unittests/Makefile.inc +++ b/crypto/openssh/regress/unittests/Makefile.inc @@ -1,8 +1,28 @@ -# $OpenBSD: Makefile.inc,v 1.12 2017/12/21 00:41:22 djm Exp $ +# $OpenBSD: Makefile.inc,v 1.16 2024/01/11 01:45:58 djm Exp $ .include <bsd.own.mk> .include <bsd.obj.mk> +# User-settable options +UNITTEST_FAST?= no # Skip slow tests (e.g. less intensive fuzzing). +UNITTEST_SLOW?= no # Include slower tests (e.g. more intensive fuzzing). +UNITTEST_VERBOSE?= no # Verbose test output (inc. per-test names). + +MALLOC_OPTIONS?= CFGJRSUX +TEST_ENV?= MALLOC_OPTIONS=${MALLOC_OPTIONS} + +# XXX detect from ssh binary? +OPENSSL?= yes +DSAKEY?= yes + +.if (${DSAKEY:L} == "yes") +CFLAGS+= -DWITH_DSA +.endif + +.if (${OPENSSL:L} == "yes") +CFLAGS+= -DWITH_OPENSSL +.endif + # enable warnings WARNINGS=Yes @@ -49,5 +69,24 @@ DPADD+=${.CURDIR}/../test_helper/libtest_helper.a .PATH: ${.CURDIR}/${SSHREL} +LDADD+= -lutil +DPADD+= ${LIBUTIL} + +.if (${OPENSSL:L} == "yes") LDADD+= -lcrypto DPADD+= ${LIBCRYPTO} +.endif + +LDADD+= -lfido2 -lcbor -lusbhid +DPADD+= ${LIBFIDO2} ${LIBCBOR} ${LIBUSBHID} + +UNITTEST_ARGS?= + +.if (${UNITTEST_VERBOSE:L} != "no") +UNITTEST_ARGS+= -v +.endif +.if (${UNITTEST_FAST:L} != "no") +UNITTEST_ARGS+= -f +.elif (${UNITTEST_SLOW:L} != "no") +UNITTEST_ARGS+= -F +.endif diff --git a/crypto/openssh/regress/unittests/authopt/tests.c b/crypto/openssh/regress/unittests/authopt/tests.c index 0e8aacb91699..d9e190305e76 100644 --- a/crypto/openssh/regress/unittests/authopt/tests.c +++ b/crypto/openssh/regress/unittests/authopt/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.1 2018/03/03 03:16:17 djm Exp $ */ +/* $OpenBSD: tests.c,v 1.3 2021/12/14 21:25:27 deraadt Exp $ */ /* * Regress test for keys options functions. @@ -6,14 +6,17 @@ * Placed in the public domain */ +#include "includes.h" + #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> +#ifdef HAVE_STDINT_H #include <stdint.h> +#endif #include <stdlib.h> #include <string.h> -#include "test_helper.h" +#include "../test_helper/test_helper.h" #include "sshkey.h" #include "authfile.h" @@ -268,6 +271,8 @@ test_authkeys_parse(void) } while (0) ARRAY_TEST("environment", "environment=\"foo=1\",environment=\"bar=2\"", env, nenv, "foo=1,bar=2"); + ARRAY_TEST("environment", "environment=\"foo=1\",environment=\"foo=2\"", + env, nenv, "foo=1"); ARRAY_TEST("permitopen", "permitopen=\"foo:123\",permitopen=\"bar:*\"", permitopen, npermitopen, "foo:123,bar:*"); #undef ARRAY_TEST diff --git a/crypto/openssh/regress/unittests/bitmap/tests.c b/crypto/openssh/regress/unittests/bitmap/tests.c index 23025f90af82..576b863f4066 100644 --- a/crypto/openssh/regress/unittests/bitmap/tests.c +++ b/crypto/openssh/regress/unittests/bitmap/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.1 2015/01/15 07:36:28 djm Exp $ */ +/* $OpenBSD: tests.c,v 1.2 2021/12/14 21:25:27 deraadt Exp $ */ /* * Regress test for bitmap.h bitmap API * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H #include <stdint.h> @@ -16,7 +15,9 @@ #include <stdlib.h> #include <string.h> +#ifdef WITH_OPENSSL #include <openssl/bn.h> +#endif #include "../test_helper/test_helper.h" @@ -27,6 +28,7 @@ void tests(void) { +#ifdef WITH_OPENSSL struct bitmap *b; BIGNUM *bn; size_t len; @@ -131,5 +133,6 @@ tests(void) bitmap_free(b); BN_free(bn); TEST_DONE(); +#endif } diff --git a/crypto/openssh/regress/unittests/conversion/Makefile b/crypto/openssh/regress/unittests/conversion/Makefile index 8b2a09cc39fe..5793c4934845 100644 --- a/crypto/openssh/regress/unittests/conversion/Makefile +++ b/crypto/openssh/regress/unittests/conversion/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.2 2017/12/21 00:41:22 djm Exp $ +# $OpenBSD: Makefile,v 1.4 2021/01/09 12:24:30 dtucker Exp $ PROG=test_conversion SRCS=tests.c @@ -6,6 +6,7 @@ SRCS=tests.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c SRCS+=atomicio.c misc.c xmalloc.c log.c uidswap.c cleanup.c fatal.c ssherr.c +SRCS+=match.c addr.c addrmatch.c REGRESS_TARGETS=run-regress-${PROG} diff --git a/crypto/openssh/regress/unittests/conversion/tests.c b/crypto/openssh/regress/unittests/conversion/tests.c index 6dd77ef42548..5b526f7afa07 100644 --- a/crypto/openssh/regress/unittests/conversion/tests.c +++ b/crypto/openssh/regress/unittests/conversion/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.1 2017/03/14 01:20:29 dtucker Exp $ */ +/* $OpenBSD: tests.c,v 1.4 2021/12/14 21:25:27 deraadt Exp $ */ /* * Regress test for conversions * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H #include <stdint.h> @@ -26,26 +25,28 @@ tests(void) char buf[1024]; TEST_START("conversion_convtime"); - ASSERT_LONG_EQ(convtime("0"), 0); - ASSERT_LONG_EQ(convtime("1"), 1); - ASSERT_LONG_EQ(convtime("1S"), 1); + ASSERT_INT_EQ(convtime("0"), 0); + ASSERT_INT_EQ(convtime("1"), 1); + ASSERT_INT_EQ(convtime("1S"), 1); /* from the examples in the comment above the function */ - ASSERT_LONG_EQ(convtime("90m"), 5400); - ASSERT_LONG_EQ(convtime("1h30m"), 5400); - ASSERT_LONG_EQ(convtime("2d"), 172800); - ASSERT_LONG_EQ(convtime("1w"), 604800); + ASSERT_INT_EQ(convtime("90m"), 5400); + ASSERT_INT_EQ(convtime("1h30m"), 5400); + ASSERT_INT_EQ(convtime("2d"), 172800); + ASSERT_INT_EQ(convtime("1w"), 604800); /* negative time is not allowed */ - ASSERT_LONG_EQ(convtime("-7"), -1); - ASSERT_LONG_EQ(convtime("-9d"), -1); + ASSERT_INT_EQ(convtime("-7"), -1); + ASSERT_INT_EQ(convtime("-9d"), -1); /* overflow */ - snprintf(buf, sizeof buf, "%llu", (unsigned long long)LONG_MAX + 1); - ASSERT_LONG_EQ(convtime(buf), -1); + snprintf(buf, sizeof buf, "%llu", (unsigned long long)INT_MAX); + ASSERT_INT_EQ(convtime(buf), INT_MAX); + snprintf(buf, sizeof buf, "%llu", (unsigned long long)INT_MAX + 1); + ASSERT_INT_EQ(convtime(buf), -1); /* overflow with multiplier */ - snprintf(buf, sizeof buf, "%lluM", (unsigned long long)LONG_MAX/60 + 1); - ASSERT_LONG_EQ(convtime(buf), -1); - ASSERT_LONG_EQ(convtime("1000000000000000000000w"), -1); + snprintf(buf, sizeof buf, "%lluM", (unsigned long long)INT_MAX/60 + 1); + ASSERT_INT_EQ(convtime(buf), -1); + ASSERT_INT_EQ(convtime("1000000000000000000000w"), -1); TEST_DONE(); } diff --git a/crypto/openssh/regress/unittests/hostkeys/Makefile b/crypto/openssh/regress/unittests/hostkeys/Makefile index 3368851225c5..04d93359acaa 100644 --- a/crypto/openssh/regress/unittests/hostkeys/Makefile +++ b/crypto/openssh/regress/unittests/hostkeys/Makefile @@ -1,19 +1,21 @@ -# $OpenBSD: Makefile,v 1.4 2017/12/21 00:41:22 djm Exp $ +# $OpenBSD: Makefile,v 1.10 2023/01/15 23:35:10 djm Exp $ PROG=test_hostkeys SRCS=tests.c test_iterate.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c -SRCS+=atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c ssh-dss.c -SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c +SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c +SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c -SRCS+=addrmatch.c bitmap.c hostfile.c -SRCS+=ed25519.c hash.c ge25519.c fe25519.c sc25519.c verify.c -SRCS+=cipher-chachapoly.c chacha.c poly1305.c +SRCS+=addr.c addrmatch.c bitmap.c hostfile.c +SRCS+=ed25519.c hash.c +SRCS+=cipher-chachapoly.c chacha.c poly1305.c ssh-ecdsa-sk.c ssh-sk.c +SRCS+=ssh-ed25519-sk.c sk-usbhid.c SRCS+=digest-openssl.c #SRCS+=digest-libc.c +SRCS+=utf8.c REGRESS_TARGETS=run-regress-${PROG} diff --git a/crypto/openssh/regress/unittests/hostkeys/mktestdata.sh b/crypto/openssh/regress/unittests/hostkeys/mktestdata.sh index 5a46de990dca..5a46de990dca 100755..100644 --- a/crypto/openssh/regress/unittests/hostkeys/mktestdata.sh +++ b/crypto/openssh/regress/unittests/hostkeys/mktestdata.sh diff --git a/crypto/openssh/regress/unittests/hostkeys/test_iterate.c b/crypto/openssh/regress/unittests/hostkeys/test_iterate.c index d6963bd2a30f..7efb8e1b9cc6 100644 --- a/crypto/openssh/regress/unittests/hostkeys/test_iterate.c +++ b/crypto/openssh/regress/unittests/hostkeys/test_iterate.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_iterate.c,v 1.6 2018/07/16 03:09:59 djm Exp $ */ +/* $OpenBSD: test_iterate.c,v 1.9 2024/01/11 01:45:58 djm Exp $ */ /* * Regress test for hostfile.h hostkeys_foreach() * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H #include <stdint.h> @@ -57,7 +56,7 @@ check(struct hostkey_foreach_line *l, void *_ctx) int parse_key = (ctx->flags & HKF_WANT_PARSE_KEY) != 0; const int matching = (ctx->flags & HKF_WANT_MATCH) != 0; u_int expected_status, expected_match; - int expected_keytype; + int expected_keytype, skip = 0; test_subtest_info("entry %zu/%zu, file line %ld", ctx->i + 1, ctx->nexpected, l->linenum); @@ -92,13 +91,28 @@ check(struct hostkey_foreach_line *l, void *_ctx) #ifndef OPENSSL_HAS_ECC if (expected->l.keytype == KEY_ECDSA || - expected->no_parse_keytype == KEY_ECDSA) { + expected->no_parse_keytype == KEY_ECDSA) + skip = 1; +#endif /* OPENSSL_HAS_ECC */ +#ifndef WITH_DSA + if (expected->l.keytype == KEY_DSA || + expected->no_parse_keytype == KEY_DSA) + skip = 1; +#endif +#ifndef WITH_OPENSSL + if (expected->l.keytype == KEY_DSA || + expected->no_parse_keytype == KEY_DSA || + expected->l.keytype == KEY_RSA || + expected->no_parse_keytype == KEY_RSA || + expected->l.keytype == KEY_ECDSA || + expected->no_parse_keytype == KEY_ECDSA) + skip = 1; +#endif /* WITH_OPENSSL */ + if (skip) { expected_status = HKF_STATUS_INVALID; expected_keytype = KEY_UNSPEC; parse_key = 0; } -#endif - UPDATE_MATCH_STATUS(match_host_p); UPDATE_MATCH_STATUS(match_host_s); UPDATE_MATCH_STATUS(match_ipv4); @@ -145,7 +159,19 @@ prepare_expected(struct expected *expected, size_t n) #ifndef OPENSSL_HAS_ECC if (expected[i].l.keytype == KEY_ECDSA) continue; +#endif /* OPENSSL_HAS_ECC */ +#ifndef WITH_DSA + if (expected[i].l.keytype == KEY_DSA) + continue; #endif +#ifndef WITH_OPENSSL + switch (expected[i].l.keytype) { + case KEY_RSA: + case KEY_DSA: + case KEY_ECDSA: + continue; + } +#endif /* WITH_OPENSSL */ ASSERT_INT_EQ(sshkey_load_public( test_data_file(expected[i].key_file), &expected[i].l.key, NULL), 0); @@ -176,6 +202,7 @@ struct expected expected_full[] = { KEY_UNSPEC, /* key type */ NULL, /* deserialised key */ NULL, /* comment */ + 0, /* note */ } }, { "dsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, @@ -189,6 +216,7 @@ struct expected expected_full[] = { KEY_DSA, NULL, /* filled at runtime */ "DSA #1", + 0, } }, { "ecdsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, @@ -202,6 +230,7 @@ struct expected expected_full[] = { KEY_ECDSA, NULL, /* filled at runtime */ "ECDSA #1", + 0, } }, { "ed25519_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, @@ -215,6 +244,7 @@ struct expected expected_full[] = { KEY_ED25519, NULL, /* filled at runtime */ "ED25519 #1", + 0, } }, { "rsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, @@ -228,6 +258,7 @@ struct expected expected_full[] = { KEY_RSA, NULL, /* filled at runtime */ "RSA #1", + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -241,6 +272,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -254,6 +286,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { "dsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, @@ -267,6 +300,7 @@ struct expected expected_full[] = { KEY_DSA, NULL, /* filled at runtime */ "DSA #2", + 0, } }, { "ecdsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, @@ -280,6 +314,7 @@ struct expected expected_full[] = { KEY_ECDSA, NULL, /* filled at runtime */ "ECDSA #2", + 0, } }, { "ed25519_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, @@ -293,6 +328,7 @@ struct expected expected_full[] = { KEY_ED25519, NULL, /* filled at runtime */ "ED25519 #2", + 0, } }, { "rsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, @@ -306,6 +342,7 @@ struct expected expected_full[] = { KEY_RSA, NULL, /* filled at runtime */ "RSA #2", + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -319,6 +356,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -332,6 +370,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { "dsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, @@ -345,6 +384,7 @@ struct expected expected_full[] = { KEY_DSA, NULL, /* filled at runtime */ "DSA #3", + 0, } }, { "ecdsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, @@ -358,6 +398,7 @@ struct expected expected_full[] = { KEY_ECDSA, NULL, /* filled at runtime */ "ECDSA #3", + 0, } }, { "ed25519_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, @@ -371,6 +412,7 @@ struct expected expected_full[] = { KEY_ED25519, NULL, /* filled at runtime */ "ED25519 #3", + 0, } }, { "rsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, @@ -384,6 +426,7 @@ struct expected expected_full[] = { KEY_RSA, NULL, /* filled at runtime */ "RSA #3", + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -397,6 +440,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -410,6 +454,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { "dsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, { NULL, @@ -423,6 +468,7 @@ struct expected expected_full[] = { KEY_DSA, NULL, /* filled at runtime */ "DSA #5", + 0, } }, { "ecdsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, { NULL, @@ -436,6 +482,7 @@ struct expected expected_full[] = { KEY_ECDSA, NULL, /* filled at runtime */ "ECDSA #5", + 0, } }, { "ed25519_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, { NULL, @@ -449,6 +496,7 @@ struct expected expected_full[] = { KEY_ED25519, NULL, /* filled at runtime */ "ED25519 #5", + 0, } }, { "rsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, { NULL, @@ -462,6 +510,7 @@ struct expected expected_full[] = { KEY_RSA, NULL, /* filled at runtime */ "RSA #5", + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -475,6 +524,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, /* * The next series have each key listed multiple times, as the @@ -493,6 +543,7 @@ struct expected expected_full[] = { KEY_DSA, NULL, /* filled at runtime */ "DSA #6", + 0, } }, { "dsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, { NULL, @@ -506,6 +557,7 @@ struct expected expected_full[] = { KEY_DSA, NULL, /* filled at runtime */ "DSA #6", + 0, } }, { "dsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, { NULL, @@ -519,6 +571,7 @@ struct expected expected_full[] = { KEY_DSA, NULL, /* filled at runtime */ "DSA #6", + 0, } }, { "ecdsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, { NULL, @@ -532,6 +585,7 @@ struct expected expected_full[] = { KEY_ECDSA, NULL, /* filled at runtime */ "ECDSA #6", + 0, } }, { "ecdsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, { NULL, @@ -545,6 +599,7 @@ struct expected expected_full[] = { KEY_ECDSA, NULL, /* filled at runtime */ "ECDSA #6", + 0, } }, { "ecdsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, { NULL, @@ -558,6 +613,7 @@ struct expected expected_full[] = { KEY_ECDSA, NULL, /* filled at runtime */ "ECDSA #6", + 0, } }, { "ed25519_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, { NULL, @@ -571,6 +627,7 @@ struct expected expected_full[] = { KEY_ED25519, NULL, /* filled at runtime */ "ED25519 #6", + 0, } }, { "ed25519_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, { NULL, @@ -584,6 +641,7 @@ struct expected expected_full[] = { KEY_ED25519, NULL, /* filled at runtime */ "ED25519 #6", + 0, } }, { "ed25519_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, { NULL, @@ -597,6 +655,7 @@ struct expected expected_full[] = { KEY_ED25519, NULL, /* filled at runtime */ "ED25519 #6", + 0, } }, { "rsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, { NULL, @@ -610,6 +669,7 @@ struct expected expected_full[] = { KEY_RSA, NULL, /* filled at runtime */ "RSA #6", + 0, } }, { "rsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, { NULL, @@ -623,6 +683,7 @@ struct expected expected_full[] = { KEY_RSA, NULL, /* filled at runtime */ "RSA #6", + 0, } }, { "rsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, { NULL, @@ -636,6 +697,7 @@ struct expected expected_full[] = { KEY_RSA, NULL, /* filled at runtime */ "RSA #6", + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -649,6 +711,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -662,6 +725,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -675,6 +739,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { "ed25519_4.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, @@ -688,6 +753,7 @@ struct expected expected_full[] = { KEY_ED25519, NULL, /* filled at runtime */ "ED25519 #4", + 0, } }, { "ecdsa_4.pub" , -1, -1, HKF_MATCH_HOST, 0, 0, 0, -1, { NULL, @@ -701,6 +767,7 @@ struct expected expected_full[] = { KEY_ECDSA, NULL, /* filled at runtime */ "ECDSA #4", + 0, } }, { "dsa_4.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, 0, 0, -1, { NULL, @@ -714,6 +781,7 @@ struct expected expected_full[] = { KEY_DSA, NULL, /* filled at runtime */ "DSA #4", + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -727,6 +795,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -740,6 +809,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, @@ -753,6 +823,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, @@ -766,6 +837,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, HKF_MATCH_HOST, 0, 0, 0, -1, { NULL, @@ -779,6 +851,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, @@ -792,6 +865,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, NULL, + 0, } }, { NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, @@ -805,6 +879,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, /* filled at runtime */ NULL, + 0, } }, { NULL, HKF_STATUS_OK, KEY_RSA, HKF_MATCH_HOST, 0, 0, 0, -1, { NULL, @@ -818,6 +893,7 @@ struct expected expected_full[] = { KEY_UNSPEC, NULL, /* filled at runtime */ NULL, + 0, } }, }; @@ -835,7 +911,7 @@ test_iterate(void) ctx.flags = HKF_WANT_PARSE_KEY; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, NULL, NULL, ctx.flags), 0); + check, &ctx, NULL, NULL, ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -846,7 +922,7 @@ test_iterate(void) ctx.flags = 0; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, NULL, NULL, ctx.flags), 0); + check, &ctx, NULL, NULL, ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -858,7 +934,7 @@ test_iterate(void) ctx.match_host_p = 1; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "prometheus.example.com", NULL, ctx.flags), 0); + check, &ctx, "prometheus.example.com", NULL, ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -870,7 +946,7 @@ test_iterate(void) ctx.match_host_s = 1; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "sisyphus.example.com", NULL, ctx.flags), 0); + check, &ctx, "sisyphus.example.com", NULL, ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -882,7 +958,7 @@ test_iterate(void) ctx.match_host_p = 1; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "prometheus.example.com", NULL, ctx.flags), 0); + check, &ctx, "prometheus.example.com", NULL, ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -894,7 +970,7 @@ test_iterate(void) ctx.match_host_s = 1; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "sisyphus.example.com", NULL, ctx.flags), 0); + check, &ctx, "sisyphus.example.com", NULL, ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -905,7 +981,7 @@ test_iterate(void) ctx.flags = 0; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "actaeon.example.org", NULL, ctx.flags), 0); + check, &ctx, "actaeon.example.org", NULL, ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -916,7 +992,7 @@ test_iterate(void) ctx.flags = HKF_WANT_MATCH; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "actaeon.example.org", NULL, ctx.flags), 0); + check, &ctx, "actaeon.example.org", NULL, ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -928,7 +1004,7 @@ test_iterate(void) ctx.match_ipv4 = 1; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "tiresias.example.org", "192.0.2.1", ctx.flags), 0); + check, &ctx, "tiresias.example.org", "192.0.2.1", ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -940,7 +1016,8 @@ test_iterate(void) ctx.match_ipv6 = 1; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "tiresias.example.org", "2001:db8::1", ctx.flags), 0); + check, &ctx, "tiresias.example.org", "2001:db8::1", + ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -952,7 +1029,7 @@ test_iterate(void) ctx.match_ipv4 = 1; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "tiresias.example.org", "192.0.2.1", ctx.flags), 0); + check, &ctx, "tiresias.example.org", "192.0.2.1", ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -964,7 +1041,8 @@ test_iterate(void) ctx.match_ipv6 = 1; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "tiresias.example.org", "2001:db8::1", ctx.flags), 0); + check, &ctx, "tiresias.example.org", "2001:db8::1", + ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -975,7 +1053,8 @@ test_iterate(void) ctx.flags = 0; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "tiresias.example.org", "192.168.0.1", ctx.flags), 0); + check, &ctx, "tiresias.example.org", "192.168.0.1", + ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -986,7 +1065,7 @@ test_iterate(void) ctx.flags = HKF_WANT_MATCH; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "tiresias.example.org", "::1", ctx.flags), 0); + check, &ctx, "tiresias.example.org", "::1", ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -999,7 +1078,7 @@ test_iterate(void) ctx.match_ipv4 = 1; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "sisyphus.example.com", "192.0.2.1", ctx.flags), 0); + check, &ctx, "sisyphus.example.com", "192.0.2.1", ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -1013,7 +1092,7 @@ test_iterate(void) prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), check, &ctx, "prometheus.example.com", - "2001:db8::1", ctx.flags), 0); + "2001:db8::1", ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -1026,7 +1105,7 @@ test_iterate(void) ctx.match_ipv4 = 1; prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), - check, &ctx, "sisyphus.example.com", "192.0.2.1", ctx.flags), 0); + check, &ctx, "sisyphus.example.com", "192.0.2.1", ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); @@ -1040,7 +1119,7 @@ test_iterate(void) prepare_expected(expected_full, ctx.nexpected); ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"), check, &ctx, "prometheus.example.com", - "2001:db8::1", ctx.flags), 0); + "2001:db8::1", ctx.flags, 0), 0); cleanup_expected(expected_full, ctx.nexpected); TEST_DONE(); } diff --git a/crypto/openssh/regress/unittests/kex/Makefile b/crypto/openssh/regress/unittests/kex/Makefile index 5c61307a325a..981affe3cbee 100644 --- a/crypto/openssh/regress/unittests/kex/Makefile +++ b/crypto/openssh/regress/unittests/kex/Makefile @@ -1,20 +1,31 @@ -# $OpenBSD: Makefile,v 1.5 2017/12/21 00:41:22 djm Exp $ +# $OpenBSD: Makefile,v 1.14 2023/02/02 12:12:52 djm Exp $ PROG=test_kex -SRCS=tests.c test_kex.c +SRCS=tests.c test_kex.c test_proposal.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c -SRCS+=atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c ssh-dss.c -SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c +SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c +SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c -SRCS+=addrmatch.c bitmap.c packet.c dispatch.c canohost.c ssh_api.c -SRCS+=kex.c kexc25519.c kexc25519c.c kexc25519s.c kexdh.c kexdhc.c kexdhs.c -SRCS+=kexecdh.c kexecdhc.c kexecdhs.c kexgex.c kexgexc.c kexgexs.c -SRCS+=dh.c compat.c -SRCS+=ed25519.c hash.c ge25519.c fe25519.c sc25519.c verify.c -SRCS+=cipher-chachapoly.c chacha.c poly1305.c -SRCS+=smult_curve25519_ref.c +SRCS+=addr.c addrmatch.c bitmap.c packet.c dispatch.c canohost.c ssh_api.c +SRCS+=compat.c ed25519.c hash.c +SRCS+=cipher-chachapoly.c chacha.c poly1305.c ssh-ecdsa-sk.c ssh-sk.c +SRCS+=ssh-ed25519-sk.c sk-usbhid.c + +SRCS+= kex.c +SRCS+= dh.c +SRCS+= kexdh.c +SRCS+= kexecdh.c +SRCS+= kexgex.c +SRCS+= kexgexc.c +SRCS+= kexgexs.c +SRCS+= kexc25519.c +SRCS+= smult_curve25519_ref.c +SRCS+= kexgen.c +SRCS+= kexsntrup761x25519.c +SRCS+= sntrup761.c +SRCS+= utf8.c SRCS+=digest-openssl.c #SRCS+=digest-libc.c diff --git a/crypto/openssh/regress/unittests/kex/test_kex.c b/crypto/openssh/regress/unittests/kex/test_kex.c index 6e5999bb9edd..dc1014ea4492 100644 --- a/crypto/openssh/regress/unittests/kex/test_kex.c +++ b/crypto/openssh/regress/unittests/kex/test_kex.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_kex.c,v 1.2 2015/07/10 06:23:25 markus Exp $ */ +/* $OpenBSD: test_kex.c,v 1.7 2024/01/11 01:45:58 djm Exp $ */ /* * Regress test KEX * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H #include <stdint.h> @@ -24,8 +23,6 @@ #include "packet.h" #include "myproposal.h" -struct ssh *active_state = NULL; /* XXX - needed for linking */ - void kex_tests(void); static int do_debug = 0; @@ -139,20 +136,22 @@ do_kex_with_key(char *kex, int keytype, int bits) ASSERT_INT_EQ(ssh_init(&server2, 1, NULL), 0); ASSERT_PTR_NE(server2, NULL); ASSERT_INT_EQ(ssh_add_hostkey(server2, private), 0); - kex_free(server2->kex); /* XXX or should ssh_packet_set_state()? */ ASSERT_INT_EQ(ssh_packet_set_state(server2, state), 0); ASSERT_INT_EQ(sshbuf_len(state), 0); sshbuf_free(state); ASSERT_PTR_NE(server2->kex, NULL); /* XXX we need to set the callbacks */ - server2->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; - server2->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; +#ifdef WITH_OPENSSL + server2->kex->kex[KEX_DH_GRP1_SHA1] = kex_gen_server; + server2->kex->kex[KEX_DH_GRP14_SHA1] = kex_gen_server; server2->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; server2->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; #ifdef OPENSSL_HAS_ECC - server2->kex->kex[KEX_ECDH_SHA2] = kexecdh_server; -#endif - server2->kex->kex[KEX_C25519_SHA256] = kexc25519_server; + server2->kex->kex[KEX_ECDH_SHA2] = kex_gen_server; +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ + server2->kex->kex[KEX_C25519_SHA256] = kex_gen_server; + server2->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; server2->kex->load_host_public_key = server->kex->load_host_public_key; server2->kex->load_host_private_key = server->kex->load_host_private_key; server2->kex->sign = server->kex->sign; @@ -178,11 +177,15 @@ do_kex_with_key(char *kex, int keytype, int bits) static void do_kex(char *kex) { +#ifdef WITH_OPENSSL do_kex_with_key(kex, KEY_RSA, 2048); +#ifdef WITH_DSA do_kex_with_key(kex, KEY_DSA, 1024); +#endif #ifdef OPENSSL_HAS_ECC do_kex_with_key(kex, KEY_ECDSA, 256); -#endif +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ do_kex_with_key(kex, KEY_ED25519, 256); } @@ -190,13 +193,18 @@ void kex_tests(void) { do_kex("curve25519-sha256@libssh.org"); +#ifdef WITH_OPENSSL #ifdef OPENSSL_HAS_ECC do_kex("ecdh-sha2-nistp256"); do_kex("ecdh-sha2-nistp384"); do_kex("ecdh-sha2-nistp521"); -#endif +#endif /* OPENSSL_HAS_ECC */ do_kex("diffie-hellman-group-exchange-sha256"); do_kex("diffie-hellman-group-exchange-sha1"); do_kex("diffie-hellman-group14-sha1"); do_kex("diffie-hellman-group1-sha1"); +# ifdef USE_SNTRUP761X25519 + do_kex("sntrup761x25519-sha512@openssh.com"); +# endif /* USE_SNTRUP761X25519 */ +#endif /* WITH_OPENSSL */ } diff --git a/crypto/openssh/regress/unittests/kex/test_proposal.c b/crypto/openssh/regress/unittests/kex/test_proposal.c new file mode 100644 index 000000000000..fa4192bb661c --- /dev/null +++ b/crypto/openssh/regress/unittests/kex/test_proposal.c @@ -0,0 +1,124 @@ +/* $OpenBSD: test_proposal.c,v 1.2 2023/03/06 12:15:47 dtucker Exp $ */ +/* + * Regress test KEX + * + * Placed in the public domain + */ + +#include "includes.h" + +#include <sys/types.h> +#include <signal.h> +#include <stdio.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif +#include <stdlib.h> +#include <string.h> + +#include "../test_helper/test_helper.h" + +#include "cipher.h" +#include "compat.h" +#include "ssherr.h" +#include "sshbuf.h" +#include "kex.h" +#include "myproposal.h" +#include "packet.h" +#include "xmalloc.h" + +void kex_proposal_tests(void); +void kex_proposal_populate_tests(void); + +#define CURVE25519 "curve25519-sha256@libssh.org" +#define DHGEX1 "diffie-hellman-group-exchange-sha1" +#define DHGEX256 "diffie-hellman-group-exchange-sha256" +#define KEXALGOS CURVE25519","DHGEX256","DHGEX1 +void +kex_proposal_tests(void) +{ + size_t i; + struct ssh ssh; + char *result, *out, *in; + struct { + char *in; /* TODO: make this const */ + char *out; + int compat; + } tests[] = { + { KEXALGOS, KEXALGOS, 0}, + { KEXALGOS, DHGEX256","DHGEX1, SSH_BUG_CURVE25519PAD }, + { KEXALGOS, CURVE25519, SSH_OLD_DHGEX }, + { "a,"KEXALGOS, "a", SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX }, + /* TODO: enable once compat_kex_proposal doesn't fatal() */ + /* { KEXALGOS, "", SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX }, */ + }; + + TEST_START("compat_kex_proposal"); + for (i = 0; i < sizeof(tests) / sizeof(*tests); i++) { + ssh.compat = tests[i].compat; + /* match entire string */ + result = compat_kex_proposal(&ssh, tests[i].in); + ASSERT_STRING_EQ(result, tests[i].out); + free(result); + /* match at end */ + in = kex_names_cat("a", tests[i].in); + out = kex_names_cat("a", tests[i].out); + result = compat_kex_proposal(&ssh, in); + ASSERT_STRING_EQ(result, out); + free(result); free(in); free(out); + /* match at start */ + in = kex_names_cat(tests[i].in, "a"); + out = kex_names_cat(tests[i].out, "a"); + result = compat_kex_proposal(&ssh, in); + ASSERT_STRING_EQ(result, out); + free(result); free(in); free(out); + /* match in middle */ + xasprintf(&in, "a,%s,b", tests[i].in); + if (*(tests[i].out) == '\0') + out = xstrdup("a,b"); + else + xasprintf(&out, "a,%s,b", tests[i].out); + result = compat_kex_proposal(&ssh, in); + ASSERT_STRING_EQ(result, out); + free(result); free(in); free(out); + } + TEST_DONE(); +} + +void +kex_proposal_populate_tests(void) +{ + char *prop[PROPOSAL_MAX], *kexalgs, *ciphers, *macs, *hkalgs; + const char *comp = compression_alg_list(0); + int i; + struct ssh ssh; + struct kex kex; + + kexalgs = kex_alg_list(','); + ciphers = cipher_alg_list(',', 0); + macs = mac_alg_list(','); + hkalgs = kex_alg_list(','); + + ssh.kex = &kex; + TEST_START("compat_kex_proposal_populate"); + for (i = 0; i <= 1; i++) { + kex.server = i; + for (ssh.compat = 0; ssh.compat < 0x40000000; ) { + kex_proposal_populate_entries(&ssh, prop, NULL, NULL, + NULL, NULL, NULL); + kex_proposal_free_entries(prop); + kex_proposal_populate_entries(&ssh, prop, kexalgs, + ciphers, macs, hkalgs, comp); + kex_proposal_free_entries(prop); + if (ssh.compat == 0) + ssh.compat = 1; + else + ssh.compat <<= 1; + } + } + + free(kexalgs); + free(ciphers); + free(macs); + free(hkalgs); +} diff --git a/crypto/openssh/regress/unittests/kex/tests.c b/crypto/openssh/regress/unittests/kex/tests.c index e7036ec17f7b..d3044f033767 100644 --- a/crypto/openssh/regress/unittests/kex/tests.c +++ b/crypto/openssh/regress/unittests/kex/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.1 2015/01/15 23:41:29 markus Exp $ */ +/* $OpenBSD: tests.c,v 1.3 2023/03/06 12:15:47 dtucker Exp $ */ /* * Placed in the public domain */ @@ -6,9 +6,13 @@ #include "../test_helper/test_helper.h" void kex_tests(void); +void kex_proposal_tests(void); +void kex_proposal_populate_tests(void); void tests(void) { kex_tests(); + kex_proposal_tests(); + kex_proposal_populate_tests(); } diff --git a/crypto/openssh/regress/unittests/match/Makefile b/crypto/openssh/regress/unittests/match/Makefile index 87e75826ac27..939163d30ef5 100644 --- a/crypto/openssh/regress/unittests/match/Makefile +++ b/crypto/openssh/regress/unittests/match/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.4 2017/12/21 03:01:49 djm Exp $ +# $OpenBSD: Makefile,v 1.5 2021/01/09 12:24:31 dtucker Exp $ PROG=test_match SRCS=tests.c @@ -6,7 +6,7 @@ SRCS=tests.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c SRCS+=match.c misc.c log.c uidswap.c fatal.c ssherr.c addrmatch.c xmalloc.c -SRCS+=cleanup.c atomicio.c +SRCS+=cleanup.c atomicio.c addr.c REGRESS_TARGETS=run-regress-${PROG} diff --git a/crypto/openssh/regress/unittests/match/tests.c b/crypto/openssh/regress/unittests/match/tests.c index 3d9af55f2849..f00d1f9348fc 100644 --- a/crypto/openssh/regress/unittests/match/tests.c +++ b/crypto/openssh/regress/unittests/match/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.5 2018/07/04 13:51:45 djm Exp $ */ +/* $OpenBSD: tests.c,v 1.8 2021/12/14 21:25:27 deraadt Exp $ */ /* * Regress test for matching functions * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H #include <stdint.h> @@ -105,7 +104,7 @@ tests(void) #define CHECK_FILTER(string,filter,expected) \ do { \ - char *result = match_filter_blacklist((string), (filter)); \ + char *result = match_filter_denylist((string), (filter)); \ ASSERT_STRING_EQ(result, expected); \ free(result); \ } while (0) diff --git a/crypto/openssh/regress/unittests/misc/test_argv.c b/crypto/openssh/regress/unittests/misc/test_argv.c new file mode 100644 index 000000000000..682863e73ba9 --- /dev/null +++ b/crypto/openssh/regress/unittests/misc/test_argv.c @@ -0,0 +1,186 @@ +/* $OpenBSD: test_argv.c,v 1.4 2021/12/14 21:25:27 deraadt Exp $ */ +/* + * Regress test for misc argv handling functions. + * + * Placed in the public domain. + */ + +#include "includes.h" + +#include <sys/types.h> +#include <stdio.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif +#include <stdlib.h> +#include <string.h> + +#include "../test_helper/test_helper.h" + +#include "log.h" +#include "misc.h" + +void test_argv(void); + +void +test_argv(void) +{ + char **av = NULL; + int ac = 0; + +#define RESET_ARGV() \ + do { \ + argv_free(av, ac); \ + av = NULL; \ + ac = -1; \ + } while (0) + + TEST_START("empty args"); + ASSERT_INT_EQ(argv_split("", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 0); + ASSERT_PTR_NE(av, NULL); + ASSERT_PTR_EQ(av[0], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split(" ", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 0); + ASSERT_PTR_NE(av, NULL); + ASSERT_PTR_EQ(av[0], NULL); + RESET_ARGV(); + TEST_DONE(); + + TEST_START("trivial args"); + ASSERT_INT_EQ(argv_split("leamas", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "leamas"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("smiley leamas", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 2); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "smiley"); + ASSERT_STRING_EQ(av[1], "leamas"); + ASSERT_PTR_EQ(av[2], NULL); + RESET_ARGV(); + TEST_DONE(); + + TEST_START("quoted"); + ASSERT_INT_EQ(argv_split("\"smiley\"", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "smiley"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("leamas \" smiley \"", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 2); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "leamas"); + ASSERT_STRING_EQ(av[1], " smiley "); + ASSERT_PTR_EQ(av[2], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("\"smiley leamas\"", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "smiley leamas"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("smiley\" leamas\" liz", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 2); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "smiley leamas"); + ASSERT_STRING_EQ(av[1], "liz"); + ASSERT_PTR_EQ(av[2], NULL); + RESET_ARGV(); + TEST_DONE(); + + TEST_START("escaped"); + ASSERT_INT_EQ(argv_split("\\\"smiley\\'", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "\"smiley'"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("'\\'smiley\\\"'", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "'smiley\""); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("smiley\\'s leamas\\'", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 2); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "smiley's"); + ASSERT_STRING_EQ(av[1], "leamas'"); + ASSERT_PTR_EQ(av[2], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("leamas\\\\smiley", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "leamas\\smiley"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("leamas\\\\ \\\\smiley", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 2); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "leamas\\"); + ASSERT_STRING_EQ(av[1], "\\smiley"); + ASSERT_PTR_EQ(av[2], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("smiley\\ leamas", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "smiley leamas"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + TEST_DONE(); + + TEST_START("quoted escaped"); + ASSERT_INT_EQ(argv_split("'smiley\\ leamas'", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "smiley\\ leamas"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("\"smiley\\ leamas\"", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "smiley\\ leamas"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + TEST_DONE(); + + TEST_START("comments"); + ASSERT_INT_EQ(argv_split("# gold", &ac, &av, 0), 0); + ASSERT_INT_EQ(ac, 2); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "#"); + ASSERT_STRING_EQ(av[1], "gold"); + ASSERT_PTR_EQ(av[2], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("# gold", &ac, &av, 1), 0); + ASSERT_INT_EQ(ac, 0); + ASSERT_PTR_NE(av, NULL); + ASSERT_PTR_EQ(av[0], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("leamas#gold", &ac, &av, 1), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "leamas#gold"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("\"leamas # gold\"", &ac, &av, 1), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "leamas # gold"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + ASSERT_INT_EQ(argv_split("\"leamas\"#gold", &ac, &av, 1), 0); + ASSERT_INT_EQ(ac, 1); + ASSERT_PTR_NE(av, NULL); + ASSERT_STRING_EQ(av[0], "leamas#gold"); + ASSERT_PTR_EQ(av[1], NULL); + RESET_ARGV(); + TEST_DONE(); + + /* XXX test char *argv_assemble(int argc, char **argv) */ +} diff --git a/crypto/openssh/regress/unittests/misc/test_convtime.c b/crypto/openssh/regress/unittests/misc/test_convtime.c new file mode 100644 index 000000000000..4794dbd9daae --- /dev/null +++ b/crypto/openssh/regress/unittests/misc/test_convtime.c @@ -0,0 +1,121 @@ +/* $OpenBSD: test_convtime.c,v 1.3 2022/08/11 01:57:50 djm Exp $ */ +/* + * Regress test for misc time conversion functions. + * + * Placed in the public domain. + */ + +#include "includes.h" + +#include <sys/types.h> +#include <limits.h> +#include <stdio.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif +#include <stdlib.h> +#include <string.h> + +#include "../test_helper/test_helper.h" + +#include "log.h" +#include "misc.h" +#include "ssherr.h" + +void test_convtime(void); + +void +test_convtime(void) +{ + char buf[1024]; + uint64_t t; + + TEST_START("misc_convtime"); + ASSERT_INT_EQ(convtime("0"), 0); + ASSERT_INT_EQ(convtime("1"), 1); + ASSERT_INT_EQ(convtime("2s"), 2); + ASSERT_INT_EQ(convtime("3m"), 180); + ASSERT_INT_EQ(convtime("1m30"), 90); + ASSERT_INT_EQ(convtime("1m30s"), 90); + ASSERT_INT_EQ(convtime("1h1s"), 3601); + ASSERT_INT_EQ(convtime("1h30m"), 90 * 60); + ASSERT_INT_EQ(convtime("1d"), 24 * 60 * 60); + ASSERT_INT_EQ(convtime("1w"), 7 * 24 * 60 * 60); + ASSERT_INT_EQ(convtime("1w2d3h4m5"), 788645); + ASSERT_INT_EQ(convtime("1w2d3h4m5s"), 788645); + /* any negative number or error returns -1 */ + ASSERT_INT_EQ(convtime("-1"), -1); + ASSERT_INT_EQ(convtime(""), -1); + ASSERT_INT_EQ(convtime("trout"), -1); + ASSERT_INT_EQ(convtime("-77"), -1); + /* boundary conditions */ + snprintf(buf, sizeof buf, "%llu", (long long unsigned)INT_MAX); + ASSERT_INT_EQ(convtime(buf), INT_MAX); + snprintf(buf, sizeof buf, "%llu", (long long unsigned)INT_MAX + 1); + ASSERT_INT_EQ(convtime(buf), -1); + ASSERT_INT_EQ(convtime("3550w5d3h14m7s"), 2147483647); +#if INT_MAX == 2147483647 + ASSERT_INT_EQ(convtime("3550w5d3h14m8s"), -1); +#endif + TEST_DONE(); + + /* XXX timezones/DST make verification of this tricky */ + /* XXX maybe setenv TZ and tzset() to make it unambiguous? */ + TEST_START("misc_parse_absolute_time"); + ASSERT_INT_EQ(parse_absolute_time("20000101", &t), 0); + ASSERT_INT_EQ(parse_absolute_time("200001011223", &t), 0); + ASSERT_INT_EQ(parse_absolute_time("20000101122345", &t), 0); + + /* forced UTC TZ */ + ASSERT_INT_EQ(parse_absolute_time("20000101Z", &t), 0); + ASSERT_U64_EQ(t, 946684800); + ASSERT_INT_EQ(parse_absolute_time("200001011223Z", &t), 0); + ASSERT_U64_EQ(t, 946729380); + ASSERT_INT_EQ(parse_absolute_time("20000101122345Z", &t), 0); + ASSERT_U64_EQ(t, 946729425); + ASSERT_INT_EQ(parse_absolute_time("20000101UTC", &t), 0); + ASSERT_U64_EQ(t, 946684800); + ASSERT_INT_EQ(parse_absolute_time("200001011223UTC", &t), 0); + ASSERT_U64_EQ(t, 946729380); + ASSERT_INT_EQ(parse_absolute_time("20000101122345UTC", &t), 0); + ASSERT_U64_EQ(t, 946729425); + + /* Bad month */ + ASSERT_INT_EQ(parse_absolute_time("20001301", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("20000001", &t), + SSH_ERR_INVALID_FORMAT); + /* Incomplete */ + ASSERT_INT_EQ(parse_absolute_time("2", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("2000", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("20000", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("200001", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("2000010", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("200001010", &t), + SSH_ERR_INVALID_FORMAT); + /* Bad day, hour, minute, second */ + ASSERT_INT_EQ(parse_absolute_time("20000199", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("200001019900", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("200001010099", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("20000101000099", &t), + SSH_ERR_INVALID_FORMAT); + /* Invalid TZ specifier */ + ASSERT_INT_EQ(parse_absolute_time("20000101ZZ", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("20000101PDT", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("20000101U", &t), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(parse_absolute_time("20000101UTCUTC", &t), + SSH_ERR_INVALID_FORMAT); + + TEST_DONE(); +} diff --git a/crypto/openssh/regress/unittests/misc/test_expand.c b/crypto/openssh/regress/unittests/misc/test_expand.c new file mode 100644 index 000000000000..6f2cd8adbedd --- /dev/null +++ b/crypto/openssh/regress/unittests/misc/test_expand.c @@ -0,0 +1,89 @@ +/* $OpenBSD: test_expand.c,v 1.3 2021/12/14 21:25:27 deraadt Exp $ */ +/* + * Regress test for misc string expansion functions. + * + * Placed in the public domain. + */ + +#include "includes.h" + +#include <sys/types.h> +#include <stdio.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif +#include <stdlib.h> +#include <string.h> + +#include "../test_helper/test_helper.h" + +#include "log.h" +#include "misc.h" + +void test_expand(void); + +void +test_expand(void) +{ + int parseerr; + char *ret; + + TEST_START("dollar_expand"); + ASSERT_INT_EQ(setenv("FOO", "bar", 1), 0); + ASSERT_INT_EQ(setenv("BAR", "baz", 1), 0); + (void)unsetenv("BAZ"); +#define ASSERT_DOLLAR_EQ(x, y) do { \ + char *str = dollar_expand(NULL, (x)); \ + ASSERT_STRING_EQ(str, (y)); \ + free(str); \ +} while(0) + ASSERT_DOLLAR_EQ("${FOO}", "bar"); + ASSERT_DOLLAR_EQ(" ${FOO}", " bar"); + ASSERT_DOLLAR_EQ("${FOO} ", "bar "); + ASSERT_DOLLAR_EQ(" ${FOO} ", " bar "); + ASSERT_DOLLAR_EQ("${FOO}${BAR}", "barbaz"); + ASSERT_DOLLAR_EQ(" ${FOO} ${BAR}", " bar baz"); + ASSERT_DOLLAR_EQ("${FOO}${BAR} ", "barbaz "); + ASSERT_DOLLAR_EQ(" ${FOO} ${BAR} ", " bar baz "); + ASSERT_DOLLAR_EQ("$", "$"); + ASSERT_DOLLAR_EQ(" $", " $"); + ASSERT_DOLLAR_EQ("$ ", "$ "); + + /* suppress error messages for error handing tests */ + log_init("test_misc", SYSLOG_LEVEL_QUIET, SYSLOG_FACILITY_AUTH, 1); + /* error checking, non existent variable */ + ret = dollar_expand(&parseerr, "a${BAZ}"); + ASSERT_PTR_EQ(ret, NULL); ASSERT_INT_EQ(parseerr, 0); + ret = dollar_expand(&parseerr, "${BAZ}b"); + ASSERT_PTR_EQ(ret, NULL); ASSERT_INT_EQ(parseerr, 0); + ret = dollar_expand(&parseerr, "a${BAZ}b"); + ASSERT_PTR_EQ(ret, NULL); ASSERT_INT_EQ(parseerr, 0); + /* invalid format */ + ret = dollar_expand(&parseerr, "${"); + ASSERT_PTR_EQ(ret, NULL); ASSERT_INT_EQ(parseerr, 1); + ret = dollar_expand(&parseerr, "${F"); + ASSERT_PTR_EQ(ret, NULL); ASSERT_INT_EQ(parseerr, 1); + ret = dollar_expand(&parseerr, "${FO"); + ASSERT_PTR_EQ(ret, NULL); ASSERT_INT_EQ(parseerr, 1); + /* empty variable name */ + ret = dollar_expand(&parseerr, "${}"); + ASSERT_PTR_EQ(ret, NULL); ASSERT_INT_EQ(parseerr, 1); + /* restore loglevel to default */ + log_init("test_misc", SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_AUTH, 1); + TEST_DONE(); + + TEST_START("percent_expand"); + ASSERT_STRING_EQ(percent_expand("%%", "%h", "foo", NULL), "%"); + ASSERT_STRING_EQ(percent_expand("%h", "h", "foo", NULL), "foo"); + ASSERT_STRING_EQ(percent_expand("%h ", "h", "foo", NULL), "foo "); + ASSERT_STRING_EQ(percent_expand(" %h", "h", "foo", NULL), " foo"); + ASSERT_STRING_EQ(percent_expand(" %h ", "h", "foo", NULL), " foo "); + ASSERT_STRING_EQ(percent_expand(" %a%b ", "a", "foo", "b", "bar", NULL), + " foobar "); + TEST_DONE(); + + TEST_START("percent_dollar_expand"); + ASSERT_STRING_EQ(percent_dollar_expand("%h${FOO}", "h", "foo", NULL), + "foobar"); + TEST_DONE(); +} diff --git a/crypto/openssh/regress/unittests/misc/test_hpdelim.c b/crypto/openssh/regress/unittests/misc/test_hpdelim.c new file mode 100644 index 000000000000..d423023dc3d2 --- /dev/null +++ b/crypto/openssh/regress/unittests/misc/test_hpdelim.c @@ -0,0 +1,82 @@ +/* $OpenBSD: test_hpdelim.c,v 1.2 2022/02/06 22:58:33 dtucker Exp $ */ +/* + * Regress test for misc hpdelim() and co + * + * Placed in the public domain. + */ + +#include "includes.h" + +#include <sys/types.h> +#include <stdio.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif +#include <stdlib.h> +#include <string.h> + +#include "../test_helper/test_helper.h" + +#include "log.h" +#include "misc.h" +#include "xmalloc.h" + +void test_hpdelim(void); + +void +test_hpdelim(void) +{ + char *orig, *str, *cp, *port; + +#define START_STRING(x) orig = str = xstrdup(x) +#define DONE_STRING() free(orig) + + TEST_START("hpdelim host only"); + START_STRING("host"); + cp = hpdelim(&str); + ASSERT_STRING_EQ(cp, "host"); + ASSERT_PTR_EQ(str, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("hpdelim :port"); + START_STRING(":1234"); + cp = hpdelim(&str); + ASSERT_STRING_EQ(cp, ""); + ASSERT_PTR_NE(str, NULL); + port = hpdelim(&str); + ASSERT_STRING_EQ(port, "1234"); + ASSERT_PTR_EQ(str, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("hpdelim host:port"); + START_STRING("host:1234"); + cp = hpdelim(&str); + ASSERT_STRING_EQ(cp, "host"); + ASSERT_PTR_NE(str, NULL); + port = hpdelim(&str); + ASSERT_STRING_EQ(port, "1234"); + ASSERT_PTR_EQ(str, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("hpdelim [host]:port"); + START_STRING("[::1]:1234"); + cp = hpdelim(&str); + ASSERT_STRING_EQ(cp, "[::1]"); + ASSERT_PTR_NE(str, NULL); + port = hpdelim(&str); + ASSERT_STRING_EQ(port, "1234"); + ASSERT_PTR_EQ(str, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("hpdelim missing ] error"); + START_STRING("[::1:1234"); + cp = hpdelim(&str); + ASSERT_PTR_EQ(cp, NULL); + DONE_STRING(); + TEST_DONE(); + +} diff --git a/crypto/openssh/regress/unittests/misc/test_parse.c b/crypto/openssh/regress/unittests/misc/test_parse.c new file mode 100644 index 000000000000..1f1ea31d149c --- /dev/null +++ b/crypto/openssh/regress/unittests/misc/test_parse.c @@ -0,0 +1,85 @@ +/* $OpenBSD: test_parse.c,v 1.2 2021/12/14 21:25:27 deraadt Exp $ */ +/* + * Regress test for misc user/host/URI parsing functions. + * + * Placed in the public domain. + */ + +#include "includes.h" + +#include <sys/types.h> +#include <stdio.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif +#include <stdlib.h> +#include <string.h> + +#include "../test_helper/test_helper.h" + +#include "log.h" +#include "misc.h" + +void test_parse(void); + +void +test_parse(void) +{ + int port; + char *user, *host, *path; + + TEST_START("misc_parse_user_host_path"); + ASSERT_INT_EQ(parse_user_host_path("someuser@some.host:some/path", + &user, &host, &path), 0); + ASSERT_STRING_EQ(user, "someuser"); + ASSERT_STRING_EQ(host, "some.host"); + ASSERT_STRING_EQ(path, "some/path"); + free(user); free(host); free(path); + TEST_DONE(); + + TEST_START("misc_parse_user_ipv4_path"); + ASSERT_INT_EQ(parse_user_host_path("someuser@1.22.33.144:some/path", + &user, &host, &path), 0); + ASSERT_STRING_EQ(user, "someuser"); + ASSERT_STRING_EQ(host, "1.22.33.144"); + ASSERT_STRING_EQ(path, "some/path"); + free(user); free(host); free(path); + TEST_DONE(); + + TEST_START("misc_parse_user_[ipv4]_path"); + ASSERT_INT_EQ(parse_user_host_path("someuser@[1.22.33.144]:some/path", + &user, &host, &path), 0); + ASSERT_STRING_EQ(user, "someuser"); + ASSERT_STRING_EQ(host, "1.22.33.144"); + ASSERT_STRING_EQ(path, "some/path"); + free(user); free(host); free(path); + TEST_DONE(); + + TEST_START("misc_parse_user_[ipv4]_nopath"); + ASSERT_INT_EQ(parse_user_host_path("someuser@[1.22.33.144]:", + &user, &host, &path), 0); + ASSERT_STRING_EQ(user, "someuser"); + ASSERT_STRING_EQ(host, "1.22.33.144"); + ASSERT_STRING_EQ(path, "."); + free(user); free(host); free(path); + TEST_DONE(); + + TEST_START("misc_parse_user_ipv6_path"); + ASSERT_INT_EQ(parse_user_host_path("someuser@[::1]:some/path", + &user, &host, &path), 0); + ASSERT_STRING_EQ(user, "someuser"); + ASSERT_STRING_EQ(host, "::1"); + ASSERT_STRING_EQ(path, "some/path"); + free(user); free(host); free(path); + TEST_DONE(); + + TEST_START("misc_parse_uri"); + ASSERT_INT_EQ(parse_uri("ssh", "ssh://someuser@some.host:22/some/path", + &user, &host, &port, &path), 0); + ASSERT_STRING_EQ(user, "someuser"); + ASSERT_STRING_EQ(host, "some.host"); + ASSERT_INT_EQ(port, 22); + ASSERT_STRING_EQ(path, "some/path"); + free(user); free(host); free(path); + TEST_DONE(); +} diff --git a/crypto/openssh/regress/unittests/misc/test_ptimeout.c b/crypto/openssh/regress/unittests/misc/test_ptimeout.c new file mode 100644 index 000000000000..cc58ee8547c3 --- /dev/null +++ b/crypto/openssh/regress/unittests/misc/test_ptimeout.c @@ -0,0 +1,91 @@ +/* $OpenBSD: test_ptimeout.c,v 1.1 2023/01/06 02:59:50 djm Exp $ */ +/* + * Regress test for misc poll/ppoll timeout helpers. + * + * Placed in the public domain. + */ + +#include "includes.h" + +#include <sys/types.h> +#include <stdio.h> +#ifdef HAVE_STDINT_H +# include <stdint.h> +#endif +#include <stdlib.h> +#include <string.h> +#ifdef HAVE_POLL_H +# include <poll.h> +#endif +#include <time.h> + +#include "../test_helper/test_helper.h" + +#include "log.h" +#include "misc.h" + +void test_ptimeout(void); + +void +test_ptimeout(void) +{ + struct timespec pt, *ts; + + TEST_START("ptimeout_init"); + ptimeout_init(&pt); + ASSERT_PTR_EQ(ptimeout_get_tsp(&pt), NULL); + ASSERT_INT_EQ(ptimeout_get_ms(&pt), -1); + TEST_DONE(); + + TEST_START("ptimeout_deadline_sec"); + ptimeout_deadline_sec(&pt, 100); + ptimeout_deadline_sec(&pt, 200); + ASSERT_INT_EQ(ptimeout_get_ms(&pt), 100 * 1000); + ts = ptimeout_get_tsp(&pt); + ASSERT_PTR_NE(ts, NULL); + ASSERT_LONG_EQ(ts->tv_nsec, 0); + ASSERT_LONG_EQ(ts->tv_sec, 100); + TEST_DONE(); + + TEST_START("ptimeout_deadline_ms"); + ptimeout_deadline_ms(&pt, 50123); + ptimeout_deadline_ms(&pt, 50500); + ASSERT_INT_EQ(ptimeout_get_ms(&pt), 50123); + ts = ptimeout_get_tsp(&pt); + ASSERT_PTR_NE(ts, NULL); + ASSERT_LONG_EQ(ts->tv_nsec, 123 * 1000000); + ASSERT_LONG_EQ(ts->tv_sec, 50); + TEST_DONE(); + + TEST_START("ptimeout zero"); + ptimeout_init(&pt); + ptimeout_deadline_ms(&pt, 0); + ASSERT_INT_EQ(ptimeout_get_ms(&pt), 0); + ts = ptimeout_get_tsp(&pt); + ASSERT_PTR_NE(ts, NULL); + ASSERT_LONG_EQ(ts->tv_nsec, 0); + ASSERT_LONG_EQ(ts->tv_sec, 0); + TEST_DONE(); + + TEST_START("ptimeout_deadline_monotime"); + ptimeout_init(&pt); + ptimeout_deadline_monotime(&pt, monotime() + 100); + ASSERT_INT_GT(ptimeout_get_ms(&pt), 50000); + ASSERT_INT_LT(ptimeout_get_ms(&pt), 200000); + ts = ptimeout_get_tsp(&pt); + ASSERT_PTR_NE(ts, NULL); + ASSERT_LONG_GT(ts->tv_sec, 50); + ASSERT_LONG_LT(ts->tv_sec, 200); + TEST_DONE(); + + TEST_START("ptimeout_deadline_monotime past"); + ptimeout_init(&pt); + ptimeout_deadline_monotime(&pt, monotime() + 100); + ptimeout_deadline_monotime(&pt, monotime() - 100); + ASSERT_INT_EQ(ptimeout_get_ms(&pt), 0); + ts = ptimeout_get_tsp(&pt); + ASSERT_PTR_NE(ts, NULL); + ASSERT_LONG_EQ(ts->tv_nsec, 0); + ASSERT_LONG_EQ(ts->tv_sec, 0); + TEST_DONE(); +} diff --git a/crypto/openssh/regress/unittests/misc/test_strdelim.c b/crypto/openssh/regress/unittests/misc/test_strdelim.c new file mode 100644 index 000000000000..f7bea4bfe8f7 --- /dev/null +++ b/crypto/openssh/regress/unittests/misc/test_strdelim.c @@ -0,0 +1,201 @@ +/* $OpenBSD: test_strdelim.c,v 1.3 2021/12/14 21:25:27 deraadt Exp $ */ +/* + * Regress test for misc strdelim() and co + * + * Placed in the public domain. + */ + +#include "includes.h" + +#include <sys/types.h> +#include <stdio.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif +#include <stdlib.h> +#include <string.h> + +#include "../test_helper/test_helper.h" + +#include "log.h" +#include "misc.h" +#include "xmalloc.h" + +void test_strdelim(void); + +void +test_strdelim(void) +{ + char *orig, *str, *cp; + +#define START_STRING(x) orig = str = xstrdup(x) +#define DONE_STRING() free(orig) + + TEST_START("empty"); + START_STRING(""); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, ""); /* XXX arguable */ + cp = strdelim(&str); + ASSERT_PTR_EQ(cp, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("whitespace"); + START_STRING(" "); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, ""); /* XXX better as NULL */ + ASSERT_STRING_EQ(str, ""); + DONE_STRING(); + TEST_DONE(); + + TEST_START("trivial"); + START_STRING("blob"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob"); + cp = strdelim(&str); + ASSERT_PTR_EQ(cp, NULL); + ASSERT_PTR_EQ(str, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("trivial whitespace"); + START_STRING("blob "); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob"); + ASSERT_STRING_EQ(str, ""); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, ""); /* XXX better as NULL */ + ASSERT_PTR_EQ(str, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("multi"); + START_STRING("blob1 blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob1"); + ASSERT_STRING_EQ(str, "blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob2"); + ASSERT_PTR_EQ(str, NULL); + cp = strdelim(&str); + ASSERT_PTR_EQ(cp, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("multi whitespace"); + START_STRING("blob1 blob2 "); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob1"); + ASSERT_STRING_EQ(str, "blob2 "); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, ""); /* XXX better as NULL */ + ASSERT_PTR_EQ(str, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("multi equals"); + START_STRING("blob1=blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob1"); + ASSERT_STRING_EQ(str, "blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob2"); + ASSERT_PTR_EQ(str, NULL); + cp = strdelim(&str); + ASSERT_PTR_EQ(cp, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("multi too many equals"); + START_STRING("blob1==blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob1"); /* XXX better returning NULL early */ + ASSERT_STRING_EQ(str, "=blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, ""); + ASSERT_STRING_EQ(str, "blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob2"); /* XXX should (but can't) reject */ + ASSERT_PTR_EQ(str, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("multi equals strdelimw"); + START_STRING("blob1=blob2"); + cp = strdelimw(&str); + ASSERT_STRING_EQ(cp, "blob1=blob2"); + ASSERT_PTR_EQ(str, NULL); + cp = strdelimw(&str); + ASSERT_PTR_EQ(cp, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("quoted"); + START_STRING("\"blob\""); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, ""); /* XXX better as NULL */ + ASSERT_PTR_EQ(str, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("quoted multi"); + START_STRING("\"blob1\" blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob1"); + ASSERT_STRING_EQ(str, "blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob2"); + ASSERT_PTR_EQ(str, NULL); + cp = strdelim(&str); + ASSERT_PTR_EQ(cp, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("quoted multi reverse"); + START_STRING("blob1 \"blob2\""); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob1"); + ASSERT_STRING_EQ(str, "\"blob2\""); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob2"); + ASSERT_STRING_EQ(str, ""); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, ""); /* XXX better as NULL */ + ASSERT_PTR_EQ(str, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("quoted multi middle"); + START_STRING("blob1 \"blob2\" blob3"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob1"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob2"); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob3"); + cp = strdelim(&str); + ASSERT_PTR_EQ(cp, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("badquote"); + START_STRING("\"blob"); + cp = strdelim(&str); + ASSERT_PTR_EQ(cp, NULL); + DONE_STRING(); + TEST_DONE(); + + TEST_START("oops quote"); + START_STRING("\"blob\\\""); + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, "blob\\"); /* XXX wrong */ + cp = strdelim(&str); + ASSERT_STRING_EQ(cp, ""); + DONE_STRING(); + TEST_DONE(); + +} diff --git a/crypto/openssh/regress/unittests/misc/tests.c b/crypto/openssh/regress/unittests/misc/tests.c new file mode 100644 index 000000000000..32699541413e --- /dev/null +++ b/crypto/openssh/regress/unittests/misc/tests.c @@ -0,0 +1,41 @@ +/* $OpenBSD: tests.c,v 1.10 2023/01/06 02:59:50 djm Exp $ */ +/* + * Regress test for misc helper functions. + * + * Placed in the public domain. + */ + +#include "includes.h" + +#include <sys/types.h> +#include <stdio.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif +#include <stdlib.h> +#include <string.h> + +#include "../test_helper/test_helper.h" + +#include "log.h" +#include "misc.h" + +void test_parse(void); +void test_convtime(void); +void test_expand(void); +void test_argv(void); +void test_strdelim(void); +void test_hpdelim(void); +void test_ptimeout(void); + +void +tests(void) +{ + test_parse(); + test_convtime(); + test_expand(); + test_argv(); + test_strdelim(); + test_hpdelim(); + test_ptimeout(); +} diff --git a/crypto/openssh/regress/unittests/sshbuf/Makefile b/crypto/openssh/regress/unittests/sshbuf/Makefile index 81d4f27a6132..a8ddfaf7ed24 100644 --- a/crypto/openssh/regress/unittests/sshbuf/Makefile +++ b/crypto/openssh/regress/unittests/sshbuf/Makefile @@ -1,6 +1,6 @@ -# $OpenBSD: Makefile,v 1.6 2017/12/21 00:41:22 djm Exp $ +# $OpenBSD: Makefile,v 1.10 2021/01/09 12:24:31 dtucker Exp $ -.include <bsd.regress.mk> +# $OpenBSD: Makefile,v 1.8 2020/01/26 00:09:50 djm Exp $ PROG=test_sshbuf SRCS=tests.c @@ -14,9 +14,9 @@ SRCS+=test_sshbuf_fixed.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c -SRCS+=atomicio.c +SRCS+=sshbuf-io.c atomicio.c misc.c xmalloc.c log.c fatal.c ssherr.c cleanup.c +SRCS+=match.c addr.c addrmatch.c run-regress-${PROG}: ${PROG} - env ${TEST_ENV} ./${PROG} - + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} diff --git a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf.c b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf.c index ee77d6934a4d..e22b390fe33d 100644 --- a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf.c +++ b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_sshbuf.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */ +/* $OpenBSD: test_sshbuf.c,v 1.2 2021/12/14 21:25:27 deraadt Exp $ */ /* * Regress test for sshbuf.h buffer API * @@ -9,7 +9,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H # include <stdint.h> @@ -24,6 +23,10 @@ void sshbuf_tests(void); +#ifndef roundup +#define roundup(x, y) ((((x)+((y)-1))/(y))*(y)) +#endif + void sshbuf_tests(void) { diff --git a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_fixed.c b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_fixed.c index df4925f7c6f6..dff77f042152 100644 --- a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_fixed.c +++ b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_fixed.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_sshbuf_fixed.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */ +/* $OpenBSD: test_sshbuf_fixed.c,v 1.2 2021/12/14 21:25:27 deraadt Exp $ */ /* * Regress test for sshbuf.h buffer API * @@ -9,7 +9,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H # include <stdint.h> diff --git a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_fuzz.c b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_fuzz.c index c52376b531a3..c0b809dcde1b 100644 --- a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_fuzz.c +++ b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_fuzz.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_sshbuf_fuzz.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */ +/* $OpenBSD: test_sshbuf_fuzz.c,v 1.4 2021/12/18 06:53:59 anton Exp $ */ /* * Regress test for sshbuf.h buffer API * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H # include <stdint.h> @@ -30,10 +29,15 @@ sshbuf_fuzz_tests(void) { struct sshbuf *p1; u_char *dp; - size_t sz, sz2, i; + size_t sz, sz2, i, ntests = NUM_FUZZ_TESTS; u_int32_t r; int ret; + if (test_is_fast()) + ntests >>= 2; + if (test_is_slow()) + ntests <<= 2; + /* NB. uses sshbuf internals */ TEST_START("fuzz alloc/dealloc"); p1 = sshbuf_new(); @@ -41,7 +45,7 @@ sshbuf_fuzz_tests(void) ASSERT_PTR_NE(p1, NULL); ASSERT_PTR_NE(sshbuf_ptr(p1), NULL); ASSERT_MEM_ZERO_NE(sshbuf_ptr(p1), sshbuf_len(p1)); - for (i = 0; i < NUM_FUZZ_TESTS; i++) { + for (i = 0; i < ntests; i++) { r = arc4random_uniform(10); if (r == 0) { /* 10% chance: small reserve */ diff --git a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_basic.c b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_basic.c index 966e8432b2d6..3da413edd35c 100644 --- a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_basic.c +++ b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_basic.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_sshbuf_getput_basic.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */ +/* $OpenBSD: test_sshbuf_getput_basic.c,v 1.3 2021/12/14 21:25:27 deraadt Exp $ */ /* * Regress test for sshbuf.h buffer API * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H # include <stdint.h> @@ -481,4 +480,233 @@ sshbuf_getput_basic_tests(void) ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp3, sizeof(bn_exp3)); sshbuf_free(p1); TEST_DONE(); + + TEST_START("sshbuf_peek_u64"); + p1 = sshbuf_new(); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0); + ASSERT_INT_EQ(sshbuf_peek_u64(p1, 0, &v64), 0); + ASSERT_U64_EQ(v64, 0x1122334455667788ULL); + ASSERT_INT_EQ(sshbuf_peek_u64(p1, 2, &v64), 0); + ASSERT_U64_EQ(v64, 0x3344556677880099ULL); + ASSERT_INT_EQ(sshbuf_peek_u64(p1, 3, &v64), SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_peek_u64(p1, sizeof(x), &v64), + SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_peek_u64(p1, 1000, &v64), + SSH_ERR_MESSAGE_INCOMPLETE); + sshbuf_free(p1); + TEST_DONE(); + + TEST_START("sshbuf_peek_u32"); + p1 = sshbuf_new(); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0); + ASSERT_INT_EQ(sshbuf_peek_u32(p1, 0, &v32), 0); + ASSERT_U32_EQ(v32, 0x11223344); + ASSERT_INT_EQ(sshbuf_peek_u32(p1, 6, &v32), 0); + ASSERT_U32_EQ(v32, 0x77880099); + ASSERT_INT_EQ(sshbuf_peek_u32(p1, 7, &v32), SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_peek_u32(p1, sizeof(x), &v32), + SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_peek_u32(p1, 1000, &v32), + SSH_ERR_MESSAGE_INCOMPLETE); + sshbuf_free(p1); + TEST_DONE(); + + TEST_START("sshbuf_peek_u16"); + p1 = sshbuf_new(); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0); + ASSERT_INT_EQ(sshbuf_peek_u16(p1, 0, &v16), 0); + ASSERT_U16_EQ(v16, 0x1122); + ASSERT_INT_EQ(sshbuf_peek_u16(p1, 8, &v16), 0); + ASSERT_U16_EQ(v16, 0x99); + ASSERT_INT_EQ(sshbuf_peek_u16(p1, 9, &v16), SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_peek_u16(p1, sizeof(x), &v16), + SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_peek_u16(p1, 1000, &v16), + SSH_ERR_MESSAGE_INCOMPLETE); + sshbuf_free(p1); + TEST_DONE(); + + TEST_START("sshbuf_peek_u8"); + p1 = sshbuf_new(); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0); + ASSERT_INT_EQ(sshbuf_peek_u8(p1, 0, &v8), 0); + ASSERT_U8_EQ(v8, 0x11); + ASSERT_INT_EQ(sshbuf_peek_u8(p1, 9, &v8), 0); + ASSERT_U8_EQ(v8, 0x99); + ASSERT_INT_EQ(sshbuf_peek_u8(p1, sizeof(x), &v8), + SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_peek_u8(p1, 1000, &v8), + SSH_ERR_MESSAGE_INCOMPLETE); + sshbuf_free(p1); + TEST_DONE(); + + TEST_START("sshbuf_poke_u64"); + p1 = sshbuf_new(); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke at start of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u64(p1, 0, 0xa1b2c3d4e5f60718ULL), 0); + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "a1b2c3d4e5f607180000"); + free(s2); + sshbuf_reset(p1); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke aligned with end of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u64(p1, 2, 0xa1b2c3d4e5f60718ULL), 0); + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "0000a1b2c3d4e5f60718"); + free(s2); + sshbuf_reset(p1); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke past end of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u64(p1, 3, 0xa1b2c3d4e5f60718ULL), + SSH_ERR_NO_BUFFER_SPACE); + ASSERT_INT_EQ(sshbuf_poke_u64(p1, 10, 0xa1b2c3d4e5f60718ULL), + SSH_ERR_NO_BUFFER_SPACE); + ASSERT_INT_EQ(sshbuf_poke_u64(p1, 1000, 0xa1b2c3d4e5f60718ULL), + SSH_ERR_NO_BUFFER_SPACE); + /* ensure failed pokes do not modify buffer */ + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "00000000000000000000"); + sshbuf_free(p1); + TEST_DONE(); + + TEST_START("sshbuf_poke_u32"); + p1 = sshbuf_new(); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke at start of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u32(p1, 0, 0xa1b2c3d4), 0); + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "a1b2c3d4000000000000"); + free(s2); + sshbuf_reset(p1); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke aligned with end of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u32(p1, 6, 0xa1b2c3d4), 0); + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "000000000000a1b2c3d4"); + free(s2); + sshbuf_reset(p1); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke past end of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u32(p1, 7, 0xa1b2c3d4), + SSH_ERR_NO_BUFFER_SPACE); + ASSERT_INT_EQ(sshbuf_poke_u32(p1, 10, 0xa1b2c3d4), + SSH_ERR_NO_BUFFER_SPACE); + ASSERT_INT_EQ(sshbuf_poke_u32(p1, 1000, 0xa1b2c3d4), + SSH_ERR_NO_BUFFER_SPACE); + /* ensure failed pokes do not modify buffer */ + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "00000000000000000000"); + sshbuf_free(p1); + TEST_DONE(); + + TEST_START("sshbuf_poke_u16"); + p1 = sshbuf_new(); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke at start of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u16(p1, 0, 0xa1b2), 0); + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "a1b20000000000000000"); + free(s2); + sshbuf_reset(p1); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke aligned with end of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u16(p1, 8, 0xa1b2), 0); + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "0000000000000000a1b2"); + free(s2); + sshbuf_reset(p1); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke past end of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u16(p1, 9, 0xa1b2), + SSH_ERR_NO_BUFFER_SPACE); + ASSERT_INT_EQ(sshbuf_poke_u16(p1, 10, 0xa1b2), + SSH_ERR_NO_BUFFER_SPACE); + ASSERT_INT_EQ(sshbuf_poke_u16(p1, 1000, 0xa1b2), + SSH_ERR_NO_BUFFER_SPACE); + /* ensure failed pokes do not modify buffer */ + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "00000000000000000000"); + sshbuf_free(p1); + TEST_DONE(); + + TEST_START("sshbuf_poke_u8"); + p1 = sshbuf_new(); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke at start of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u8(p1, 0, 0xa1), 0); + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "a1000000000000000000"); + free(s2); + sshbuf_reset(p1); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke aligned with end of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u8(p1, 9, 0xa1), 0); + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "000000000000000000a1"); + free(s2); + sshbuf_reset(p1); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke past end of buffer */ + ASSERT_INT_EQ(sshbuf_poke_u8(p1, 10, 0xa1), SSH_ERR_NO_BUFFER_SPACE); + ASSERT_INT_EQ(sshbuf_poke_u8(p1, 1000, 0xa1), SSH_ERR_NO_BUFFER_SPACE); + /* ensure failed pokes do not modify buffer */ + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "00000000000000000000"); + sshbuf_free(p1); + TEST_DONE(); + + TEST_START("sshbuf_poke"); + p1 = sshbuf_new(); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke at start of buffer */ + ASSERT_INT_EQ(sshbuf_poke(p1, 0, "hello!", 6), 0); + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "68656c6c6f2100000000"); + free(s2); + sshbuf_reset(p1); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke aligned with end of buffer */ + ASSERT_INT_EQ(sshbuf_poke(p1, 4, "hello!", 6), 0); + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "0000000068656c6c6f21"); + free(s2); + sshbuf_reset(p1); + ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0); + /* poke past end of buffer */ + ASSERT_INT_EQ(sshbuf_poke(p1, 7, "hello!", 6), + SSH_ERR_NO_BUFFER_SPACE); + ASSERT_INT_EQ(sshbuf_poke(p1, 10, "hello!", 6), + SSH_ERR_NO_BUFFER_SPACE); + ASSERT_INT_EQ(sshbuf_poke(p1, 1000, "hello!", 6), + SSH_ERR_NO_BUFFER_SPACE); + /* ensure failed pokes do not modify buffer */ + s2 = sshbuf_dtob16(p1); + ASSERT_PTR_NE(s2, NULL); + ASSERT_STRING_EQ(s2, "00000000000000000000"); + sshbuf_free(p1); + TEST_DONE(); } diff --git a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c index a68e1329e40b..e3620e97fe99 100644 --- a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c +++ b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_sshbuf_getput_crypto.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */ +/* $OpenBSD: test_sshbuf_getput_crypto.c,v 1.3 2021/12/14 21:25:27 deraadt Exp $ */ /* * Regress test for sshbuf.h buffer API * @@ -7,8 +7,9 @@ #include "includes.h" +#ifdef WITH_OPENSSL + #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H # include <stdint.h> @@ -33,7 +34,6 @@ sshbuf_getput_crypto_tests(void) { struct sshbuf *p1; BIGNUM *bn, *bn2; - /* This one has num_bits != num_bytes * 8 to test bignum1 encoding */ const char *hexbn1 = "0102030405060708090a0b0c0d0e0f10"; /* This one has MSB set to test bignum2 encoding negative-avoidance */ const char *hexbn2 = "f0e0d0c0b0a0908070605040302010007fff11"; @@ -77,54 +77,6 @@ sshbuf_getput_crypto_tests(void) ASSERT_INT_GT(BN_hex2bn(&bnn, b), 0); \ } while (0) - TEST_START("sshbuf_put_bignum1"); - MKBN(hexbn1, bn); - p1 = sshbuf_new(); - ASSERT_PTR_NE(p1, NULL); - ASSERT_INT_EQ(sshbuf_put_bignum1(p1, bn), 0); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn1) + 2); - ASSERT_U16_EQ(PEEK_U16(sshbuf_ptr(p1)), (u_int16_t)BN_num_bits(bn)); - ASSERT_MEM_EQ(sshbuf_ptr(p1) + 2, expbn1, sizeof(expbn1)); - BN_free(bn); - sshbuf_free(p1); - TEST_DONE(); - - TEST_START("sshbuf_put_bignum1 limited"); - MKBN(hexbn1, bn); - p1 = sshbuf_new(); - ASSERT_PTR_NE(p1, NULL); - ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn1) + 1), 0); - r = sshbuf_put_bignum1(p1, bn); - ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0); - BN_free(bn); - sshbuf_free(p1); - TEST_DONE(); - - TEST_START("sshbuf_put_bignum1 bn2"); - MKBN(hexbn2, bn); - p1 = sshbuf_new(); - ASSERT_PTR_NE(p1, NULL); - ASSERT_INT_EQ(sshbuf_put_bignum1(p1, bn), 0); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 2); - ASSERT_U16_EQ(PEEK_U16(sshbuf_ptr(p1)), (u_int16_t)BN_num_bits(bn)); - ASSERT_MEM_EQ(sshbuf_ptr(p1) + 2, expbn2, sizeof(expbn2)); - BN_free(bn); - sshbuf_free(p1); - TEST_DONE(); - - TEST_START("sshbuf_put_bignum1 bn2 limited"); - MKBN(hexbn2, bn); - p1 = sshbuf_new(); - ASSERT_PTR_NE(p1, NULL); - ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn1) + 1), 0); - r = sshbuf_put_bignum1(p1, bn); - ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0); - BN_free(bn); - sshbuf_free(p1); - TEST_DONE(); - TEST_START("sshbuf_put_bignum2"); MKBN(hexbn1, bn); p1 = sshbuf_new(); @@ -174,88 +126,6 @@ sshbuf_getput_crypto_tests(void) sshbuf_free(p1); TEST_DONE(); - TEST_START("sshbuf_get_bignum1"); - MKBN(hexbn1, bn); - p1 = sshbuf_new(); - ASSERT_PTR_NE(p1, NULL); - ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0); - ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1)), 0); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1)); - ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0); - bn2 = BN_new(); - ASSERT_INT_EQ(sshbuf_get_bignum1(p1, bn2), 0); - ASSERT_BIGNUM_EQ(bn, bn2); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2); - BN_free(bn); - BN_free(bn2); - sshbuf_free(p1); - TEST_DONE(); - - TEST_START("sshbuf_get_bignum1 truncated"); - MKBN(hexbn1, bn); - p1 = sshbuf_new(); - ASSERT_PTR_NE(p1, NULL); - ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0); - ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1) - 1), 0); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1) - 1); - bn2 = BN_new(); - r = sshbuf_get_bignum1(p1, bn2); - ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1) - 1); - BN_free(bn); - BN_free(bn2); - sshbuf_free(p1); - TEST_DONE(); - - TEST_START("sshbuf_get_bignum1 giant"); - MKBN(hexbn1, bn); - p1 = sshbuf_new(); - ASSERT_PTR_NE(p1, NULL); - ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xffff), 0); - ASSERT_INT_EQ(sshbuf_reserve(p1, (0xffff + 7) / 8, NULL), 0); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + ((0xffff + 7) / 8)); - bn2 = BN_new(); - r = sshbuf_get_bignum1(p1, bn2); - ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_TOO_LARGE); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + ((0xffff + 7) / 8)); - BN_free(bn); - BN_free(bn2); - sshbuf_free(p1); - TEST_DONE(); - - TEST_START("sshbuf_get_bignum1 bn2"); - MKBN(hexbn2, bn); - p1 = sshbuf_new(); - ASSERT_PTR_NE(p1, NULL); - ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0); - ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2)); - ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0); - bn2 = BN_new(); - ASSERT_INT_EQ(sshbuf_get_bignum1(p1, bn2), 0); - ASSERT_BIGNUM_EQ(bn, bn2); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2); - BN_free(bn); - BN_free(bn2); - sshbuf_free(p1); - TEST_DONE(); - - TEST_START("sshbuf_get_bignum1 bn2 truncated"); - MKBN(hexbn2, bn); - p1 = sshbuf_new(); - ASSERT_PTR_NE(p1, NULL); - ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0); - ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2) - 1), 0); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2) - 1); - bn2 = BN_new(); - r = sshbuf_get_bignum1(p1, bn2); - ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE); - ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2) - 1); - BN_free(bn); - BN_free(bn2); - sshbuf_free(p1); - TEST_DONE(); - TEST_START("sshbuf_get_bignum2"); MKBN(hexbn1, bn); p1 = sshbuf_new(); @@ -264,8 +134,8 @@ sshbuf_getput_crypto_tests(void) ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1)), 0); ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4 + sizeof(expbn1)); ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0); - bn2 = BN_new(); - ASSERT_INT_EQ(sshbuf_get_bignum2(p1, bn2), 0); + bn2 = NULL; + ASSERT_INT_EQ(sshbuf_get_bignum2(p1, &bn2), 0); ASSERT_BIGNUM_EQ(bn, bn2); ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2); BN_free(bn); @@ -279,8 +149,8 @@ sshbuf_getput_crypto_tests(void) ASSERT_PTR_NE(p1, NULL); ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn)), 0); ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1) - 1), 0); - bn2 = BN_new(); - r = sshbuf_get_bignum2(p1, bn2); + bn2 = NULL; + r = sshbuf_get_bignum2(p1, &bn2); ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE); ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn1) + 3); BN_free(bn); @@ -294,8 +164,8 @@ sshbuf_getput_crypto_tests(void) ASSERT_PTR_NE(p1, NULL); ASSERT_INT_EQ(sshbuf_put_u32(p1, 65536), 0); ASSERT_INT_EQ(sshbuf_reserve(p1, 65536, NULL), 0); - bn2 = BN_new(); - r = sshbuf_get_bignum2(p1, bn2); + bn2 = NULL; + r = sshbuf_get_bignum2(p1, &bn2); ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_TOO_LARGE); ASSERT_SIZE_T_EQ(sshbuf_len(p1), 65536 + 4); BN_free(bn); @@ -312,8 +182,8 @@ sshbuf_getput_crypto_tests(void) ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0); ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4 + 1 + sizeof(expbn2)); ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0); - bn2 = BN_new(); - ASSERT_INT_EQ(sshbuf_get_bignum2(p1, bn2), 0); + bn2 = NULL; + ASSERT_INT_EQ(sshbuf_get_bignum2(p1, &bn2), 0); ASSERT_BIGNUM_EQ(bn, bn2); ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2); BN_free(bn); @@ -328,8 +198,8 @@ sshbuf_getput_crypto_tests(void) ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn) + 1), 0); ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x00), 0); ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2) - 1), 0); - bn2 = BN_new(); - r = sshbuf_get_bignum2(p1, bn2); + bn2 = NULL; + r = sshbuf_get_bignum2(p1, &bn2); ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE); ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 1 + 4 - 1); BN_free(bn); @@ -343,8 +213,8 @@ sshbuf_getput_crypto_tests(void) ASSERT_PTR_NE(p1, NULL); ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn)), 0); ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0); - bn2 = BN_new(); - r = sshbuf_get_bignum2(p1, bn2); + bn2 = NULL; + r = sshbuf_get_bignum2(p1, &bn2); ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_IS_NEGATIVE); ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 4); BN_free(bn); @@ -407,3 +277,4 @@ sshbuf_getput_crypto_tests(void) #endif } +#endif /* WITH_OPENSSL */ diff --git a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c index c6b5c29d176b..3b4895895ef1 100644 --- a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c +++ b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_sshbuf_getput_fuzz.c,v 1.2 2014/05/02 02:54:00 djm Exp $ */ +/* $OpenBSD: test_sshbuf_getput_fuzz.c,v 1.5 2021/12/14 21:25:27 deraadt Exp $ */ /* * Regress test for sshbuf.h buffer API * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H # include <stdint.h> @@ -16,11 +15,13 @@ #include <stdlib.h> #include <string.h> +#ifdef WITH_OPENSSL #include <openssl/bn.h> #include <openssl/objects.h> #ifdef OPENSSL_HAS_NISTP256 # include <openssl/ec.h> #endif +#endif #include "../test_helper/test_helper.h" #include "ssherr.h" @@ -32,10 +33,12 @@ static void attempt_parse_blob(u_char *blob, size_t len) { struct sshbuf *p1; +#ifdef WITH_OPENSSL BIGNUM *bn; #if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) EC_KEY *eck; -#endif +#endif /* defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) */ +#endif /* WITH_OPENSSL */ u_char *s; size_t l; u_int8_t u8; @@ -54,18 +57,17 @@ attempt_parse_blob(u_char *blob, size_t len) bzero(s, l); free(s); } - bn = BN_new(); - sshbuf_get_bignum1(p1, bn); - BN_clear_free(bn); - bn = BN_new(); - sshbuf_get_bignum2(p1, bn); +#ifdef WITH_OPENSSL + bn = NULL; + sshbuf_get_bignum2(p1, &bn); BN_clear_free(bn); #if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) eck = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ASSERT_PTR_NE(eck, NULL); sshbuf_get_eckey(p1, eck); EC_KEY_free(eck); -#endif +#endif /* defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) */ +#endif /* WITH_OPENSSL */ sshbuf_free(p1); } @@ -92,10 +94,6 @@ sshbuf_getput_fuzz_tests(void) /* string */ 0x00, 0x00, 0x00, 0x09, 'O', ' ', 'G', 'o', 'r', 'g', 'o', 'n', '!', - /* bignum1 */ - 0x79, - 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, - 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, /* bignum2 */ 0x00, 0x00, 0x00, 0x14, 0x00, @@ -115,11 +113,15 @@ sshbuf_getput_fuzz_tests(void) 0x55, 0x0f, 0x69, 0xd8, 0x0e, 0xc2, 0x3c, 0xd4, }; struct fuzz *fuzz; + u_int fuzzers = FUZZ_1_BIT_FLIP | FUZZ_2_BIT_FLIP | + FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP | + FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END; + + if (test_is_fast()) + fuzzers &= ~(FUZZ_2_BYTE_FLIP|FUZZ_2_BIT_FLIP); TEST_START("fuzz blob parsing"); - fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | FUZZ_2_BIT_FLIP | - FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP | - FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END, blob, sizeof(blob)); + fuzz = fuzz_begin(fuzzers, blob, sizeof(blob)); TEST_ONERROR(onerror, fuzz); for(; !fuzz_done(fuzz); fuzz_next(fuzz)) attempt_parse_blob(blob, sizeof(blob)); diff --git a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_misc.c b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_misc.c index 762a6c31c037..249ecf235764 100644 --- a/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_misc.c +++ b/crypto/openssh/regress/unittests/sshbuf/test_sshbuf_misc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_sshbuf_misc.c,v 1.2 2016/05/03 13:48:33 djm Exp $ */ +/* $OpenBSD: test_sshbuf_misc.c,v 1.5 2021/12/14 21:25:27 deraadt Exp $ */ /* * Regress test for sshbuf.h buffer API * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <stdio.h> #ifdef HAVE_STDINT_H # include <stdint.h> @@ -19,6 +18,7 @@ #include "../test_helper/test_helper.h" #include "sshbuf.h" +#include "ssherr.h" void sshbuf_misc_tests(void); @@ -26,7 +26,7 @@ void sshbuf_misc_tests(void) { struct sshbuf *p1; - char tmp[512], *p; + char tmp[512], msg[] = "imploring ping silence ping over", *p; FILE *out; size_t sz; @@ -60,48 +60,48 @@ sshbuf_misc_tests(void) sshbuf_free(p1); TEST_DONE(); - TEST_START("sshbuf_dtob64 len 1"); + TEST_START("sshbuf_dtob64_string len 1"); p1 = sshbuf_new(); ASSERT_PTR_NE(p1, NULL); ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0); - p = sshbuf_dtob64(p1); + p = sshbuf_dtob64_string(p1, 0); ASSERT_PTR_NE(p, NULL); ASSERT_STRING_EQ(p, "EQ=="); free(p); sshbuf_free(p1); TEST_DONE(); - TEST_START("sshbuf_dtob64 len 2"); + TEST_START("sshbuf_dtob64_string len 2"); p1 = sshbuf_new(); ASSERT_PTR_NE(p1, NULL); ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0); ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x22), 0); - p = sshbuf_dtob64(p1); + p = sshbuf_dtob64_string(p1, 0); ASSERT_PTR_NE(p, NULL); ASSERT_STRING_EQ(p, "ESI="); free(p); sshbuf_free(p1); TEST_DONE(); - TEST_START("sshbuf_dtob64 len 3"); + TEST_START("sshbuf_dtob64_string len 3"); p1 = sshbuf_new(); ASSERT_PTR_NE(p1, NULL); ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0); ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x22), 0); ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x33), 0); - p = sshbuf_dtob64(p1); + p = sshbuf_dtob64_string(p1, 0); ASSERT_PTR_NE(p, NULL); ASSERT_STRING_EQ(p, "ESIz"); free(p); sshbuf_free(p1); TEST_DONE(); - TEST_START("sshbuf_dtob64 len 8191"); + TEST_START("sshbuf_dtob64_string len 8191"); p1 = sshbuf_new(); ASSERT_PTR_NE(p1, NULL); ASSERT_INT_EQ(sshbuf_reserve(p1, 8192, NULL), 0); bzero(sshbuf_mutable_ptr(p1), 8192); - p = sshbuf_dtob64(p1); + p = sshbuf_dtob64_string(p1, 0); ASSERT_PTR_NE(p, NULL); ASSERT_SIZE_T_EQ(strlen(p), ((8191 + 2) / 3) * 4); free(p); @@ -163,5 +163,55 @@ sshbuf_misc_tests(void) ASSERT_PTR_EQ(p, NULL); sshbuf_free(p1); TEST_DONE(); + + TEST_START("sshbuf_cmp"); + p1 = sshbuf_from(msg, sizeof(msg) - 1); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_cmp(p1, 0, "i", 1), 0); + ASSERT_INT_EQ(sshbuf_cmp(p1, 0, "j", 1), SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(sshbuf_cmp(p1, 0, "imploring", 9), 0); + ASSERT_INT_EQ(sshbuf_cmp(p1, 0, "implored", 9), SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(sshbuf_cmp(p1, 10, "ping", 4), 0); + ASSERT_INT_EQ(sshbuf_cmp(p1, 10, "ring", 4), SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(sshbuf_cmp(p1, 28, "over", 4), 0); + ASSERT_INT_EQ(sshbuf_cmp(p1, 28, "rove", 4), SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(sshbuf_cmp(p1, 28, "overt", 5), + SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_cmp(p1, 32, "ping", 4), + SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_cmp(p1, 1000, "silence", 7), + SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_cmp(p1, 0, msg, sizeof(msg) - 1), 0); + TEST_DONE(); + + TEST_START("sshbuf_find"); + p1 = sshbuf_from(msg, sizeof(msg) - 1); + ASSERT_PTR_NE(p1, NULL); + ASSERT_INT_EQ(sshbuf_find(p1, 0, "i", 1, &sz), 0); + ASSERT_SIZE_T_EQ(sz, 0); + ASSERT_INT_EQ(sshbuf_find(p1, 0, "j", 1, &sz), SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(sshbuf_find(p1, 0, "imploring", 9, &sz), 0); + ASSERT_SIZE_T_EQ(sz, 0); + ASSERT_INT_EQ(sshbuf_find(p1, 0, "implored", 9, &sz), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(sshbuf_find(p1, 3, "ping", 4, &sz), 0); + ASSERT_SIZE_T_EQ(sz, 10); + ASSERT_INT_EQ(sshbuf_find(p1, 11, "ping", 4, &sz), 0); + ASSERT_SIZE_T_EQ(sz, 23); + ASSERT_INT_EQ(sshbuf_find(p1, 20, "over", 4, &sz), 0); + ASSERT_SIZE_T_EQ(sz, 28); + ASSERT_INT_EQ(sshbuf_find(p1, 28, "over", 4, &sz), 0); + ASSERT_SIZE_T_EQ(sz, 28); + ASSERT_INT_EQ(sshbuf_find(p1, 28, "rove", 4, &sz), + SSH_ERR_INVALID_FORMAT); + ASSERT_INT_EQ(sshbuf_find(p1, 28, "overt", 5, &sz), + SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_find(p1, 32, "ping", 4, &sz), + SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_find(p1, 1000, "silence", 7, &sz), + SSH_ERR_MESSAGE_INCOMPLETE); + ASSERT_INT_EQ(sshbuf_find(p1, 0, msg + 1, sizeof(msg) - 2, &sz), 0); + ASSERT_SIZE_T_EQ(sz, 1); + TEST_DONE(); } diff --git a/crypto/openssh/regress/unittests/sshbuf/tests.c b/crypto/openssh/regress/unittests/sshbuf/tests.c index 1557e43421ac..29916a10bc5b 100644 --- a/crypto/openssh/regress/unittests/sshbuf/tests.c +++ b/crypto/openssh/regress/unittests/sshbuf/tests.c @@ -20,7 +20,9 @@ tests(void) { sshbuf_tests(); sshbuf_getput_basic_tests(); +#ifdef WITH_OPENSSL sshbuf_getput_crypto_tests(); +#endif sshbuf_misc_tests(); sshbuf_fuzz_tests(); sshbuf_getput_fuzz_tests(); diff --git a/crypto/openssh/regress/unittests/sshkey/Makefile b/crypto/openssh/regress/unittests/sshkey/Makefile index 1c940bec640b..cd0f44d13d24 100644 --- a/crypto/openssh/regress/unittests/sshkey/Makefile +++ b/crypto/openssh/regress/unittests/sshkey/Makefile @@ -1,24 +1,26 @@ -# $OpenBSD: Makefile,v 1.5 2017/12/21 00:41:22 djm Exp $ +# $OpenBSD: Makefile,v 1.12 2023/01/15 23:35:10 djm Exp $ PROG=test_sshkey SRCS=tests.c test_sshkey.c test_file.c test_fuzz.c common.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c -SRCS+=atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c ssh-dss.c -SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c +SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c +SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c -SRCS+=addrmatch.c bitmap.c -SRCS+=ed25519.c hash.c ge25519.c fe25519.c sc25519.c verify.c -SRCS+=cipher-chachapoly.c chacha.c poly1305.c +SRCS+=addr.c addrmatch.c bitmap.c +SRCS+=ed25519.c hash.c +SRCS+=cipher-chachapoly.c chacha.c poly1305.c ssh-ecdsa-sk.c ssh-sk.c +SRCS+=ssh-ed25519-sk.c sk-usbhid.c SRCS+=digest-openssl.c #SRCS+=digest-libc.c +SRCS+=utf8.c REGRESS_TARGETS=run-regress-${PROG} run-regress-${PROG}: ${PROG} - env ${TEST_ENV} ./${PROG} -d ${.CURDIR}/testdata + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} -d ${.CURDIR}/testdata .include <bsd.regress.mk> diff --git a/crypto/openssh/regress/unittests/sshkey/common.c b/crypto/openssh/regress/unittests/sshkey/common.c index e63465c47f7b..51b0d92e1d07 100644 --- a/crypto/openssh/regress/unittests/sshkey/common.c +++ b/crypto/openssh/regress/unittests/sshkey/common.c @@ -1,4 +1,4 @@ -/* $OpenBSD: common.c,v 1.3 2018/09/13 09:03:20 djm Exp $ */ +/* $OpenBSD: common.c,v 1.5 2021/12/14 21:25:27 deraadt Exp $ */ /* * Helpers for key API tests * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <sys/stat.h> #include <fcntl.h> #include <stdio.h> @@ -19,13 +18,15 @@ #include <string.h> #include <unistd.h> +#ifdef WITH_OPENSSL #include <openssl/bn.h> #include <openssl/rsa.h> #include <openssl/dsa.h> #include <openssl/objects.h> #ifdef OPENSSL_HAS_NISTP256 # include <openssl/ec.h> -#endif +#endif /* OPENSSL_HAS_NISTP256 */ +#endif /* WITH_OPENSSL */ #include "openbsd-compat/openssl-compat.h" @@ -41,13 +42,10 @@ struct sshbuf * load_file(const char *name) { - int fd; - struct sshbuf *ret; + struct sshbuf *ret = NULL; - ASSERT_PTR_NE(ret = sshbuf_new(), NULL); - ASSERT_INT_NE(fd = open(test_data_file(name), O_RDONLY), -1); - ASSERT_INT_EQ(sshkey_load_file(fd, ret), 0); - close(fd); + ASSERT_INT_EQ(sshbuf_load_file(test_data_file(name), &ret), 0); + ASSERT_PTR_NE(ret, NULL); return ret; } @@ -72,6 +70,7 @@ load_text_file(const char *name) return ret; } +#ifdef WITH_OPENSSL BIGNUM * load_bignum(const char *name) { @@ -160,4 +159,5 @@ dsa_priv_key(struct sshkey *k) DSA_get0_key(k->dsa, NULL, &priv_key); return priv_key; } +#endif /* WITH_OPENSSL */ diff --git a/crypto/openssh/regress/unittests/sshkey/mktestdata.sh b/crypto/openssh/regress/unittests/sshkey/mktestdata.sh index 93da34c64671..fcd78e990e8b 100755 --- a/crypto/openssh/regress/unittests/sshkey/mktestdata.sh +++ b/crypto/openssh/regress/unittests/sshkey/mktestdata.sh @@ -1,5 +1,5 @@ #!/bin/sh -# $OpenBSD: mktestdata.sh,v 1.7 2018/09/12 01:36:45 djm Exp $ +# $OpenBSD: mktestdata.sh,v 1.11 2020/06/19 03:48:49 djm Exp $ PW=mekmitasdigoat @@ -56,8 +56,8 @@ ecdsa_params() { awk '/^pub:/,/^ASN1 OID:/' | #\ grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.pub openssl ec -noout -text -in $_in | \ - grep "ASN1 OID:" | tr -d '\n' | \ - sed 's/.*: //;s/ *$//' > ${_outbase}.curve + grep "ASN1 OID:" | \ + sed 's/.*: //;s/ *$//' | tr -d '\n' > ${_outbase}.curve for x in priv pub curve ; do echo "" >> ${_outbase}.$x echo ============ ${_outbase}.$x @@ -70,6 +70,15 @@ set -ex cd testdata +if [ -f ../../../misc/sk-dummy/sk-dummy.so ] ; then + SK_DUMMY=../../../misc/sk-dummy/sk-dummy.so +elif [ -f ../../../misc/sk-dummy/obj/sk-dummy.so ] ; then + SK_DUMMY=../../../misc/sk-dummy/obj/sk-dummy.so +else + echo "Can't find sk-dummy.so" 1>&2 + exit 1 +fi + rm -f rsa_1 dsa_1 ecdsa_1 ed25519_1 rm -f rsa_2 dsa_2 ecdsa_2 ed25519_2 rm -f rsa_n dsa_n ecdsa_n # new-format keys @@ -77,35 +86,52 @@ rm -f rsa_1_pw dsa_1_pw ecdsa_1_pw ed25519_1_pw rm -f rsa_n_pw dsa_n_pw ecdsa_n_pw rm -f pw *.pub *.bn.* *.param.* *.fp *.fp.bb -ssh-keygen -t rsa -b 1024 -C "RSA test key #1" -N "" -f rsa_1 -ssh-keygen -t dsa -b 1024 -C "DSA test key #1" -N "" -f dsa_1 -ssh-keygen -t ecdsa -b 256 -C "ECDSA test key #1" -N "" -f ecdsa_1 +ssh-keygen -t rsa -b 1024 -C "RSA test key #1" -N "" -f rsa_1 -m PEM +ssh-keygen -t dsa -b 1024 -C "DSA test key #1" -N "" -f dsa_1 -m PEM +ssh-keygen -t ecdsa -b 256 -C "ECDSA test key #1" -N "" -f ecdsa_1 -m PEM ssh-keygen -t ed25519 -C "ED25519 test key #1" -N "" -f ed25519_1 +ssh-keygen -w "$SK_DUMMY" -t ecdsa-sk -C "ECDSA-SK test key #1" \ + -N "" -f ecdsa_sk1 +ssh-keygen -w "$SK_DUMMY" -t ed25519-sk -C "ED25519-SK test key #1" \ + -N "" -f ed25519_sk1 + -ssh-keygen -t rsa -b 2048 -C "RSA test key #2" -N "" -f rsa_2 -ssh-keygen -t dsa -b 1024 -C "DSA test key #2" -N "" -f dsa_2 -ssh-keygen -t ecdsa -b 521 -C "ECDSA test key #2" -N "" -f ecdsa_2 -ssh-keygen -t ed25519 -C "ED25519 test key #1" -N "" -f ed25519_2 +ssh-keygen -t rsa -b 2048 -C "RSA test key #2" -N "" -f rsa_2 -m PEM +ssh-keygen -t dsa -b 1024 -C "DSA test key #2" -N "" -f dsa_2 -m PEM +ssh-keygen -t ecdsa -b 521 -C "ECDSA test key #2" -N "" -f ecdsa_2 -m PEM +ssh-keygen -t ed25519 -C "ED25519 test key #2" -N "" -f ed25519_2 +ssh-keygen -w "$SK_DUMMY" -t ecdsa-sk -C "ECDSA-SK test key #2" \ + -N "" -f ecdsa_sk2 +ssh-keygen -w "$SK_DUMMY" -t ed25519-sk -C "ED25519-SK test key #2" \ + -N "" -f ed25519_sk2 cp rsa_1 rsa_n cp dsa_1 dsa_n cp ecdsa_1 ecdsa_n +ssh-keygen -pf rsa_n -N "" +ssh-keygen -pf dsa_n -N "" +ssh-keygen -pf ecdsa_n -N "" + cp rsa_1 rsa_1_pw cp dsa_1 dsa_1_pw cp ecdsa_1 ecdsa_1_pw cp ed25519_1 ed25519_1_pw +cp ecdsa_sk1 ecdsa_sk1_pw +cp ed25519_sk1 ed25519_sk1_pw cp rsa_1 rsa_n_pw cp dsa_1 dsa_n_pw cp ecdsa_1 ecdsa_n_pw -ssh-keygen -pf rsa_1_pw -N "$PW" -ssh-keygen -pf dsa_1_pw -N "$PW" -ssh-keygen -pf ecdsa_1_pw -N "$PW" +ssh-keygen -pf rsa_1_pw -m PEM -N "$PW" +ssh-keygen -pf dsa_1_pw -m PEM -N "$PW" +ssh-keygen -pf ecdsa_1_pw -m PEM -N "$PW" ssh-keygen -pf ed25519_1_pw -N "$PW" -ssh-keygen -opf rsa_n_pw -N "$PW" -ssh-keygen -opf dsa_n_pw -N "$PW" -ssh-keygen -opf ecdsa_n_pw -N "$PW" +ssh-keygen -pf ecdsa_sk1_pw -m PEM -N "$PW" +ssh-keygen -pf ed25519_sk1_pw -N "$PW" +ssh-keygen -pf rsa_n_pw -N "$PW" +ssh-keygen -pf dsa_n_pw -N "$PW" +ssh-keygen -pf ecdsa_n_pw -N "$PW" rsa_params rsa_1 rsa_1.param rsa_params rsa_2 rsa_2.param @@ -113,7 +139,7 @@ dsa_params dsa_1 dsa_1.param dsa_params dsa_1 dsa_1.param ecdsa_params ecdsa_1 ecdsa_1.param ecdsa_params ecdsa_2 ecdsa_2.param -# XXX ed25519 params +# XXX ed25519, *sk params ssh-keygen -s rsa_2 -I hugo -n user1,user2 \ -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \ @@ -127,6 +153,13 @@ ssh-keygen -s rsa_2 -I hugo -n user1,user2 \ ssh-keygen -s rsa_2 -I hugo -n user1,user2 \ -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \ -V 19990101:20110101 -z 4 ed25519_1.pub +ssh-keygen -s rsa_2 -I hugo -n user1,user2 \ + -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \ + -V 19990101:20110101 -z 4 ecdsa_sk1.pub +ssh-keygen -s rsa_2 -I hugo -n user1,user2 \ + -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \ + -V 19990101:20110101 -z 4 ed25519_sk1.pub + # Make a few RSA variant signature too. cp rsa_1 rsa_1_sha1 @@ -148,30 +181,42 @@ ssh-keygen -s ecdsa_1 -I julius -n host1,host2 -h \ -V 19990101:20110101 -z 7 ecdsa_1.pub ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \ -V 19990101:20110101 -z 8 ed25519_1.pub +ssh-keygen -s ecdsa_1 -I julius -n host1,host2 -h \ + -V 19990101:20110101 -z 7 ecdsa_sk1.pub +ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \ + -V 19990101:20110101 -z 8 ed25519_sk1.pub ssh-keygen -lf rsa_1 | awk '{print $2}' > rsa_1.fp ssh-keygen -lf dsa_1 | awk '{print $2}' > dsa_1.fp ssh-keygen -lf ecdsa_1 | awk '{print $2}' > ecdsa_1.fp ssh-keygen -lf ed25519_1 | awk '{print $2}' > ed25519_1.fp +ssh-keygen -lf ecdsa_sk1 | awk '{print $2}' > ecdsa_sk1.fp +ssh-keygen -lf ed25519_sk1 | awk '{print $2}' > ed25519_sk1.fp ssh-keygen -lf rsa_2 | awk '{print $2}' > rsa_2.fp ssh-keygen -lf dsa_2 | awk '{print $2}' > dsa_2.fp ssh-keygen -lf ecdsa_2 | awk '{print $2}' > ecdsa_2.fp ssh-keygen -lf ed25519_2 | awk '{print $2}' > ed25519_2.fp +ssh-keygen -lf ecdsa_sk2 | awk '{print $2}' > ecdsa_sk2.fp +ssh-keygen -lf ed25519_sk2 | awk '{print $2}' > ed25519_sk2.fp +ssh-keygen -lf rsa_1-cert.pub | awk '{print $2}' > rsa_1-cert.fp ssh-keygen -lf dsa_1-cert.pub | awk '{print $2}' > dsa_1-cert.fp ssh-keygen -lf ecdsa_1-cert.pub | awk '{print $2}' > ecdsa_1-cert.fp ssh-keygen -lf ed25519_1-cert.pub | awk '{print $2}' > ed25519_1-cert.fp -ssh-keygen -lf rsa_1-cert.pub | awk '{print $2}' > rsa_1-cert.fp +ssh-keygen -lf ecdsa_sk1-cert.pub | awk '{print $2}' > ecdsa_sk1-cert.fp +ssh-keygen -lf ed25519_sk1-cert.pub | awk '{print $2}' > ed25519_sk1-cert.fp ssh-keygen -Bf rsa_1 | awk '{print $2}' > rsa_1.fp.bb ssh-keygen -Bf dsa_1 | awk '{print $2}' > dsa_1.fp.bb ssh-keygen -Bf ecdsa_1 | awk '{print $2}' > ecdsa_1.fp.bb ssh-keygen -Bf ed25519_1 | awk '{print $2}' > ed25519_1.fp.bb +ssh-keygen -Bf ecdsa_sk1 | awk '{print $2}' > ecdsa_sk1.fp.bb +ssh-keygen -Bf ed25519_sk1 | awk '{print $2}' > ed25519_sk1.fp.bb ssh-keygen -Bf rsa_2 | awk '{print $2}' > rsa_2.fp.bb ssh-keygen -Bf dsa_2 | awk '{print $2}' > dsa_2.fp.bb ssh-keygen -Bf ecdsa_2 | awk '{print $2}' > ecdsa_2.fp.bb ssh-keygen -Bf ed25519_2 | awk '{print $2}' > ed25519_2.fp.bb - -# XXX Extend ssh-keygen to do detached signatures (better to test/fuzz against) +ssh-keygen -Bf ecdsa_sk2 | awk '{print $2}' > ecdsa_sk2.fp.bb +ssh-keygen -Bf ed25519_sk2 | awk '{print $2}' > ed25519_sk2.fp.bb echo "$PW" > pw diff --git a/crypto/openssh/regress/unittests/sshkey/test_file.c b/crypto/openssh/regress/unittests/sshkey/test_file.c index 65610dacc7f6..45284059657b 100644 --- a/crypto/openssh/regress/unittests/sshkey/test_file.c +++ b/crypto/openssh/regress/unittests/sshkey/test_file.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_file.c,v 1.8 2018/09/13 09:03:20 djm Exp $ */ +/* $OpenBSD: test_file.c,v 1.11 2024/01/11 01:45:58 djm Exp $ */ /* * Regress test for sshkey.h key management API * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <sys/stat.h> #include <fcntl.h> #include <stdio.h> @@ -19,13 +18,15 @@ #include <string.h> #include <unistd.h> +#ifdef WITH_OPENSSL #include <openssl/bn.h> #include <openssl/rsa.h> #include <openssl/dsa.h> #include <openssl/objects.h> #ifdef OPENSSL_HAS_NISTP256 # include <openssl/ec.h> -#endif +#endif /* OPENSSL_HAS_NISTP256 */ +#endif /* WITH_OPENSSL */ #include "../test_helper/test_helper.h" @@ -44,7 +45,9 @@ sshkey_file_tests(void) { struct sshkey *k1, *k2; struct sshbuf *buf, *pw; +#ifdef WITH_OPENSSL BIGNUM *a, *b, *c; +#endif char *cp; TEST_START("load passphrase"); @@ -52,6 +55,7 @@ sshkey_file_tests(void) TEST_DONE(); +#ifdef WITH_OPENSSL TEST_START("parse RSA from private"); buf = load_file("rsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -161,6 +165,7 @@ sshkey_file_tests(void) sshkey_free(k1); +#ifdef WITH_DSA TEST_START("parse DSA from private"); buf = load_file("dsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -251,6 +256,7 @@ sshkey_file_tests(void) TEST_DONE(); sshkey_free(k1); +#endif #ifdef OPENSSL_HAS_ECC TEST_START("parse ECDSA from private"); @@ -262,6 +268,7 @@ sshkey_file_tests(void) ASSERT_STRING_EQ((const char *)sshbuf_ptr(buf), OBJ_nid2sn(k1->ecdsa_nid)); sshbuf_free(buf); +#ifndef OPENSSL_IS_BORINGSSL /* lacks EC_POINT_point2bn() */ a = load_bignum("ecdsa_1.param.priv"); b = load_bignum("ecdsa_1.param.pub"); c = EC_POINT_point2bn(EC_KEY_get0_group(k1->ecdsa), @@ -273,6 +280,7 @@ sshkey_file_tests(void) BN_free(a); BN_free(b); BN_free(c); +#endif /* OPENSSL_IS_BORINGSSL */ TEST_DONE(); TEST_START("parse ECDSA from private w/ passphrase"); @@ -350,6 +358,7 @@ sshkey_file_tests(void) sshkey_free(k1); #endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ TEST_START("parse Ed25519 from private"); buf = load_file("ed25519_1"); @@ -416,6 +425,139 @@ sshkey_file_tests(void) sshkey_free(k1); +#ifdef ENABLE_SK +#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) + TEST_START("parse ECDSA-SK from private"); + buf = load_file("ecdsa_sk1"); + ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); + sshbuf_free(buf); + ASSERT_PTR_NE(k1, NULL); + ASSERT_INT_EQ(k1->type, KEY_ECDSA_SK); + TEST_DONE(); + + TEST_START("parse ECDSA-SK from private w/ passphrase"); + buf = load_file("ecdsa_sk1_pw"); + ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, + (const char *)sshbuf_ptr(pw), &k2, NULL), 0); + sshbuf_free(buf); + ASSERT_PTR_NE(k2, NULL); + ASSERT_INT_EQ(sshkey_equal(k1, k2), 1); + sshkey_free(k2); + TEST_DONE(); + + TEST_START("load ECDSA-SK from public"); + ASSERT_INT_EQ(sshkey_load_public(test_data_file("ecdsa_sk1.pub"), &k2, + NULL), 0); + ASSERT_PTR_NE(k2, NULL); + ASSERT_INT_EQ(sshkey_equal(k1, k2), 1); + sshkey_free(k2); + TEST_DONE(); + + TEST_START("load ECDSA-SK cert"); + ASSERT_INT_EQ(sshkey_load_cert(test_data_file("ecdsa_sk1"), &k2), 0); + ASSERT_PTR_NE(k2, NULL); + ASSERT_INT_EQ(k2->type, KEY_ECDSA_SK_CERT); + ASSERT_INT_EQ(sshkey_equal(k1, k2), 0); + ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1); + TEST_DONE(); + + TEST_START("ECDSA-SK key hex fingerprint"); + buf = load_text_file("ecdsa_sk1.fp"); + cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA256, SSH_FP_BASE64); + ASSERT_PTR_NE(cp, NULL); + ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf)); + sshbuf_free(buf); + free(cp); + TEST_DONE(); + + TEST_START("ECDSA-SK cert hex fingerprint"); + buf = load_text_file("ecdsa_sk1-cert.fp"); + cp = sshkey_fingerprint(k2, SSH_DIGEST_SHA256, SSH_FP_BASE64); + ASSERT_PTR_NE(cp, NULL); + ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf)); + sshbuf_free(buf); + free(cp); + sshkey_free(k2); + TEST_DONE(); + + TEST_START("ECDSA-SK key bubblebabble fingerprint"); + buf = load_text_file("ecdsa_sk1.fp.bb"); + cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA1, SSH_FP_BUBBLEBABBLE); + ASSERT_PTR_NE(cp, NULL); + ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf)); + sshbuf_free(buf); + free(cp); + TEST_DONE(); + + sshkey_free(k1); +#endif + + TEST_START("parse Ed25519-SK from private"); + buf = load_file("ed25519_sk1"); + ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); + sshbuf_free(buf); + ASSERT_PTR_NE(k1, NULL); + ASSERT_INT_EQ(k1->type, KEY_ED25519_SK); + /* XXX check key contents */ + TEST_DONE(); + + TEST_START("parse Ed25519-SK from private w/ passphrase"); + buf = load_file("ed25519_sk1_pw"); + ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, + (const char *)sshbuf_ptr(pw), &k2, NULL), 0); + sshbuf_free(buf); + ASSERT_PTR_NE(k2, NULL); + ASSERT_INT_EQ(sshkey_equal(k1, k2), 1); + sshkey_free(k2); + TEST_DONE(); + + TEST_START("load Ed25519-SK from public"); + ASSERT_INT_EQ(sshkey_load_public(test_data_file("ed25519_sk1.pub"), + &k2, NULL), 0); + ASSERT_PTR_NE(k2, NULL); + ASSERT_INT_EQ(sshkey_equal(k1, k2), 1); + sshkey_free(k2); + TEST_DONE(); + + TEST_START("load Ed25519-SK cert"); + ASSERT_INT_EQ(sshkey_load_cert(test_data_file("ed25519_sk1"), &k2), 0); + ASSERT_PTR_NE(k2, NULL); + ASSERT_INT_EQ(k2->type, KEY_ED25519_SK_CERT); + ASSERT_INT_EQ(sshkey_equal(k1, k2), 0); + ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1); + TEST_DONE(); + + TEST_START("Ed25519-SK key hex fingerprint"); + buf = load_text_file("ed25519_sk1.fp"); + cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA256, SSH_FP_BASE64); + ASSERT_PTR_NE(cp, NULL); + ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf)); + sshbuf_free(buf); + free(cp); + TEST_DONE(); + + TEST_START("Ed25519-SK cert hex fingerprint"); + buf = load_text_file("ed25519_sk1-cert.fp"); + cp = sshkey_fingerprint(k2, SSH_DIGEST_SHA256, SSH_FP_BASE64); + ASSERT_PTR_NE(cp, NULL); + ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf)); + sshbuf_free(buf); + free(cp); + sshkey_free(k2); + TEST_DONE(); + + TEST_START("Ed25519-SK key bubblebabble fingerprint"); + buf = load_text_file("ed25519_sk1.fp.bb"); + cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA1, SSH_FP_BUBBLEBABBLE); + ASSERT_PTR_NE(cp, NULL); + ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf)); + sshbuf_free(buf); + free(cp); + TEST_DONE(); + + sshkey_free(k1); +#endif /* ENABLE_SK */ + sshbuf_free(pw); } diff --git a/crypto/openssh/regress/unittests/sshkey/test_fuzz.c b/crypto/openssh/regress/unittests/sshkey/test_fuzz.c index d3b0c92b47a0..0aff7c9bf4e4 100644 --- a/crypto/openssh/regress/unittests/sshkey/test_fuzz.c +++ b/crypto/openssh/regress/unittests/sshkey/test_fuzz.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_fuzz.c,v 1.8 2017/12/21 00:41:22 djm Exp $ */ +/* $OpenBSD: test_fuzz.c,v 1.14 2024/01/11 01:45:58 djm Exp $ */ /* * Fuzz tests for key parsing * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <sys/stat.h> #include <fcntl.h> #include <stdio.h> @@ -19,6 +18,7 @@ #include <string.h> #include <unistd.h> +#ifdef WITH_OPENSSL #include <openssl/bn.h> #include <openssl/rsa.h> #include <openssl/dsa.h> @@ -26,6 +26,7 @@ #ifdef OPENSSL_HAS_NISTP256 # include <openssl/ec.h> #endif +#endif #include "../test_helper/test_helper.h" @@ -51,14 +52,16 @@ public_fuzz(struct sshkey *k) struct sshkey *k1; struct sshbuf *buf; struct fuzz *fuzz; + u_int fuzzers = FUZZ_1_BIT_FLIP | FUZZ_1_BYTE_FLIP | + FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END; + if (test_is_fast()) + fuzzers &= ~FUZZ_1_BIT_FLIP; + if (test_is_slow()) + fuzzers |= FUZZ_2_BIT_FLIP | FUZZ_2_BYTE_FLIP; ASSERT_PTR_NE(buf = sshbuf_new(), NULL); ASSERT_INT_EQ(sshkey_putb(k, buf), 0); - /* XXX need a way to run the tests in "slow, but complete" mode */ - fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | /* XXX too slow FUZZ_2_BIT_FLIP | */ - FUZZ_1_BYTE_FLIP | /* XXX too slow FUZZ_2_BYTE_FLIP | */ - FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END, - sshbuf_mutable_ptr(buf), sshbuf_len(buf)); + fuzz = fuzz_begin(fuzzers, sshbuf_mutable_ptr(buf), sshbuf_len(buf)); ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(buf), sshbuf_len(buf), &k1), 0); sshkey_free(k1); @@ -77,13 +80,19 @@ sig_fuzz(struct sshkey *k, const char *sig_alg) struct fuzz *fuzz; u_char *sig, c[] = "some junk to be signed"; size_t l; + u_int fuzzers = FUZZ_1_BIT_FLIP | FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP | + FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END; + + if (test_is_fast()) + fuzzers &= ~FUZZ_2_BYTE_FLIP; + if (test_is_slow()) + fuzzers |= FUZZ_2_BIT_FLIP; - ASSERT_INT_EQ(sshkey_sign(k, &sig, &l, c, sizeof(c), sig_alg, 0), 0); + ASSERT_INT_EQ(sshkey_sign(k, &sig, &l, c, sizeof(c), + sig_alg, NULL, NULL, 0), 0); ASSERT_SIZE_T_GT(l, 0); - fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | /* too slow FUZZ_2_BIT_FLIP | */ - FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP | - FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END, sig, l); - ASSERT_INT_EQ(sshkey_verify(k, sig, l, c, sizeof(c), NULL, 0), 0); + fuzz = fuzz_begin(fuzzers, sig, l); + ASSERT_INT_EQ(sshkey_verify(k, sig, l, c, sizeof(c), NULL, 0, NULL), 0); free(sig); TEST_ONERROR(onerror, fuzz); for(; !fuzz_done(fuzz); fuzz_next(fuzz)) { @@ -91,20 +100,22 @@ sig_fuzz(struct sshkey *k, const char *sig_alg) if (fuzz_matches_original(fuzz)) continue; ASSERT_INT_NE(sshkey_verify(k, fuzz_ptr(fuzz), fuzz_len(fuzz), - c, sizeof(c), NULL, 0), 0); + c, sizeof(c), NULL, 0, NULL), 0); } fuzz_cleanup(fuzz); } +#define NUM_FAST_BASE64_TESTS 1024 + void sshkey_fuzz_tests(void) { struct sshkey *k1; struct sshbuf *buf, *fuzzed; struct fuzz *fuzz; - int r; - + int r, i; +#ifdef WITH_OPENSSL TEST_START("fuzz RSA private"); buf = load_file("rsa_1"); fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf), @@ -114,12 +125,14 @@ sshkey_fuzz_tests(void) sshbuf_free(buf); ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL); TEST_ONERROR(onerror, fuzz); - for(; !fuzz_done(fuzz); fuzz_next(fuzz)) { + for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) { r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz)); ASSERT_INT_EQ(r, 0); if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0) sshkey_free(k1); sshbuf_reset(fuzzed); + if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS) + break; } sshbuf_free(fuzzed); fuzz_cleanup(fuzz); @@ -134,17 +147,20 @@ sshkey_fuzz_tests(void) sshbuf_free(buf); ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL); TEST_ONERROR(onerror, fuzz); - for(; !fuzz_done(fuzz); fuzz_next(fuzz)) { + for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) { r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz)); ASSERT_INT_EQ(r, 0); if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0) sshkey_free(k1); sshbuf_reset(fuzzed); + if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS) + break; } sshbuf_free(fuzzed); fuzz_cleanup(fuzz); TEST_DONE(); +#ifdef WITH_DSA TEST_START("fuzz DSA private"); buf = load_file("dsa_1"); fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf), @@ -154,12 +170,14 @@ sshkey_fuzz_tests(void) sshbuf_free(buf); ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL); TEST_ONERROR(onerror, fuzz); - for(; !fuzz_done(fuzz); fuzz_next(fuzz)) { + for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) { r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz)); ASSERT_INT_EQ(r, 0); if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0) sshkey_free(k1); sshbuf_reset(fuzzed); + if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS) + break; } sshbuf_free(fuzzed); fuzz_cleanup(fuzz); @@ -174,16 +192,19 @@ sshkey_fuzz_tests(void) sshbuf_free(buf); ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL); TEST_ONERROR(onerror, fuzz); - for(; !fuzz_done(fuzz); fuzz_next(fuzz)) { + for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) { r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz)); ASSERT_INT_EQ(r, 0); if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0) sshkey_free(k1); sshbuf_reset(fuzzed); + if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS) + break; } sshbuf_free(fuzzed); fuzz_cleanup(fuzz); TEST_DONE(); +#endif #ifdef OPENSSL_HAS_ECC TEST_START("fuzz ECDSA private"); @@ -195,12 +216,14 @@ sshkey_fuzz_tests(void) sshbuf_free(buf); ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL); TEST_ONERROR(onerror, fuzz); - for(; !fuzz_done(fuzz); fuzz_next(fuzz)) { + for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) { r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz)); ASSERT_INT_EQ(r, 0); if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0) sshkey_free(k1); sshbuf_reset(fuzzed); + if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS) + break; } sshbuf_free(fuzzed); fuzz_cleanup(fuzz); @@ -215,17 +238,20 @@ sshkey_fuzz_tests(void) sshbuf_free(buf); ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL); TEST_ONERROR(onerror, fuzz); - for(; !fuzz_done(fuzz); fuzz_next(fuzz)) { + for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) { r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz)); ASSERT_INT_EQ(r, 0); if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0) sshkey_free(k1); sshbuf_reset(fuzzed); + if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS) + break; } sshbuf_free(fuzzed); fuzz_cleanup(fuzz); TEST_DONE(); -#endif +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ TEST_START("fuzz Ed25519 private"); buf = load_file("ed25519_1"); @@ -236,17 +262,20 @@ sshkey_fuzz_tests(void) sshbuf_free(buf); ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL); TEST_ONERROR(onerror, fuzz); - for(; !fuzz_done(fuzz); fuzz_next(fuzz)) { + for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) { r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz)); ASSERT_INT_EQ(r, 0); if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0) sshkey_free(k1); sshbuf_reset(fuzzed); + if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS) + break; } sshbuf_free(fuzzed); fuzz_cleanup(fuzz); TEST_DONE(); +#ifdef WITH_OPENSSL TEST_START("fuzz RSA public"); buf = load_file("rsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -261,6 +290,7 @@ sshkey_fuzz_tests(void) sshkey_free(k1); TEST_DONE(); +#ifdef WITH_DSA TEST_START("fuzz DSA public"); buf = load_file("dsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -274,6 +304,7 @@ sshkey_fuzz_tests(void) public_fuzz(k1); sshkey_free(k1); TEST_DONE(); +#endif #ifdef OPENSSL_HAS_ECC TEST_START("fuzz ECDSA public"); @@ -289,7 +320,8 @@ sshkey_fuzz_tests(void) public_fuzz(k1); sshkey_free(k1); TEST_DONE(); -#endif +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ TEST_START("fuzz Ed25519 public"); buf = load_file("ed25519_1"); @@ -305,6 +337,7 @@ sshkey_fuzz_tests(void) sshkey_free(k1); TEST_DONE(); +#ifdef WITH_OPENSSL TEST_START("fuzz RSA sig"); buf = load_file("rsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -329,6 +362,7 @@ sshkey_fuzz_tests(void) sshkey_free(k1); TEST_DONE(); +#ifdef WITH_DSA TEST_START("fuzz DSA sig"); buf = load_file("dsa_1"); ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); @@ -336,6 +370,7 @@ sshkey_fuzz_tests(void) sig_fuzz(k1, NULL); sshkey_free(k1); TEST_DONE(); +#endif #ifdef OPENSSL_HAS_ECC TEST_START("fuzz ECDSA sig"); @@ -345,7 +380,8 @@ sshkey_fuzz_tests(void) sig_fuzz(k1, NULL); sshkey_free(k1); TEST_DONE(); -#endif +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ TEST_START("fuzz Ed25519 sig"); buf = load_file("ed25519_1"); @@ -356,5 +392,6 @@ sshkey_fuzz_tests(void) TEST_DONE(); /* XXX fuzz decoded new-format blobs too */ +/* XXX fuzz XMSS too */ } diff --git a/crypto/openssh/regress/unittests/sshkey/test_sshkey.c b/crypto/openssh/regress/unittests/sshkey/test_sshkey.c index 3415ed68196a..87ec500c1dcd 100644 --- a/crypto/openssh/regress/unittests/sshkey/test_sshkey.c +++ b/crypto/openssh/regress/unittests/sshkey/test_sshkey.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_sshkey.c,v 1.17 2018/09/13 09:03:20 djm Exp $ */ +/* $OpenBSD: test_sshkey.c,v 1.24 2024/01/11 01:45:58 djm Exp $ */ /* * Regress test for sshkey.h key management API * @@ -8,7 +8,6 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <paths.h> #include <stdio.h> #ifdef HAVE_STDINT_H @@ -17,12 +16,14 @@ #include <stdlib.h> #include <string.h> +#ifdef WITH_OPENSSL #include <openssl/bn.h> #include <openssl/rsa.h> #include <openssl/dsa.h> #if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) # include <openssl/ec.h> #endif +#endif #include "../test_helper/test_helper.h" @@ -51,9 +52,10 @@ put_opt(struct sshbuf *b, const char *name, const char *value) sshbuf_free(sect); } +#ifdef WITH_OPENSSL static void -build_cert(struct sshbuf *b, const struct sshkey *k, const char *type, - const struct sshkey *sign_key, const struct sshkey *ca_key, +build_cert(struct sshbuf *b, struct sshkey *k, const char *type, + struct sshkey *sign_key, struct sshkey *ca_key, const char *sig_alg) { struct sshbuf *ca_buf, *pk, *principals, *critopts, *exts; @@ -101,7 +103,7 @@ build_cert(struct sshbuf *b, const struct sshkey *k, const char *type, ASSERT_INT_EQ(sshbuf_put_string(b, NULL, 0), 0); /* reserved */ ASSERT_INT_EQ(sshbuf_put_stringb(b, ca_buf), 0); /* signature key */ ASSERT_INT_EQ(sshkey_sign(sign_key, &sigblob, &siglen, - sshbuf_ptr(b), sshbuf_len(b), sig_alg, 0), 0); + sshbuf_ptr(b), sshbuf_len(b), sig_alg, NULL, NULL, 0), 0); ASSERT_INT_EQ(sshbuf_put_string(b, sigblob, siglen), 0); /* signature */ free(sigblob); @@ -111,6 +113,7 @@ build_cert(struct sshbuf *b, const struct sshkey *k, const char *type, sshbuf_free(principals); sshbuf_free(pk); } +#endif /* WITH_OPENSSL */ static void signature_test(struct sshkey *k, struct sshkey *bad, const char *sig_alg, @@ -119,14 +122,15 @@ signature_test(struct sshkey *k, struct sshkey *bad, const char *sig_alg, size_t len; u_char *sig; - ASSERT_INT_EQ(sshkey_sign(k, &sig, &len, d, l, sig_alg, 0), 0); + ASSERT_INT_EQ(sshkey_sign(k, &sig, &len, d, l, sig_alg, + NULL, NULL, 0), 0); ASSERT_SIZE_T_GT(len, 8); ASSERT_PTR_NE(sig, NULL); - ASSERT_INT_EQ(sshkey_verify(k, sig, len, d, l, NULL, 0), 0); - ASSERT_INT_NE(sshkey_verify(bad, sig, len, d, l, NULL, 0), 0); + ASSERT_INT_EQ(sshkey_verify(k, sig, len, d, l, NULL, 0, NULL), 0); + ASSERT_INT_NE(sshkey_verify(bad, sig, len, d, l, NULL, 0, NULL), 0); /* Fuzz test is more comprehensive, this is just a smoke test */ sig[len - 5] ^= 0x10; - ASSERT_INT_NE(sshkey_verify(k, sig, len, d, l, NULL, 0), 0); + ASSERT_INT_NE(sshkey_verify(k, sig, len, d, l, NULL, 0, NULL), 0); free(sig); } @@ -141,7 +145,7 @@ banana(u_char *s, size_t l) memcpy(s + o, "nanananana", l - o); break; } - memcpy(s + o, banana, sizeof(the_banana)); + memcpy(s + o, the_banana, sizeof(the_banana)); } } @@ -177,11 +181,14 @@ get_private(const char *n) void sshkey_tests(void) { - struct sshkey *k1, *k2, *k3, *k4, *kr, *kd, *kf; + struct sshkey *k1 = NULL, *k2 = NULL, *k3 = NULL, *kf = NULL; +#ifdef WITH_OPENSSL + struct sshkey *k4 = NULL, *kr = NULL, *kd = NULL; #ifdef OPENSSL_HAS_ECC - struct sshkey *ke; -#endif - struct sshbuf *b; + struct sshkey *ke = NULL; +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ + struct sshbuf *b = NULL; TEST_START("new invalid"); k1 = sshkey_new(-42); @@ -194,6 +201,7 @@ sshkey_tests(void) sshkey_free(k1); TEST_DONE(); +#ifdef WITH_OPENSSL TEST_START("new/free KEY_RSA"); k1 = sshkey_new(KEY_RSA); ASSERT_PTR_NE(k1, NULL); @@ -201,12 +209,14 @@ sshkey_tests(void) sshkey_free(k1); TEST_DONE(); +#ifdef WITH_DSA TEST_START("new/free KEY_DSA"); k1 = sshkey_new(KEY_DSA); ASSERT_PTR_NE(k1, NULL); ASSERT_PTR_NE(k1->dsa, NULL); sshkey_free(k1); TEST_DONE(); +#endif #ifdef OPENSSL_HAS_ECC TEST_START("new/free KEY_ECDSA"); @@ -238,12 +248,14 @@ sshkey_tests(void) ASSERT_PTR_EQ(k1, NULL); TEST_DONE(); +#ifdef WITH_DSA TEST_START("generate KEY_DSA wrong bits"); ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 2048, &k1), SSH_ERR_KEY_LENGTH); ASSERT_PTR_EQ(k1, NULL); sshkey_free(k1); TEST_DONE(); +#endif #ifdef OPENSSL_HAS_ECC TEST_START("generate KEY_ECDSA wrong bits"); @@ -266,6 +278,7 @@ sshkey_tests(void) ASSERT_INT_EQ(BN_num_bits(rsa_n(kr)), 1024); TEST_DONE(); +#ifdef WITH_DSA TEST_START("generate KEY_DSA"); ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &kd), 0); ASSERT_PTR_NE(kd, NULL); @@ -273,6 +286,7 @@ sshkey_tests(void) ASSERT_PTR_NE(dsa_g(kd), NULL); ASSERT_PTR_NE(dsa_priv_key(kd), NULL); TEST_DONE(); +#endif #ifdef OPENSSL_HAS_ECC TEST_START("generate KEY_ECDSA"); @@ -282,7 +296,8 @@ sshkey_tests(void) ASSERT_PTR_NE(EC_KEY_get0_public_key(ke->ecdsa), NULL); ASSERT_PTR_NE(EC_KEY_get0_private_key(ke->ecdsa), NULL); TEST_DONE(); -#endif +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ TEST_START("generate KEY_ED25519"); ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &kf), 0); @@ -292,6 +307,7 @@ sshkey_tests(void) ASSERT_PTR_NE(kf->ed25519_sk, NULL); TEST_DONE(); +#ifdef WITH_OPENSSL TEST_START("demote KEY_RSA"); ASSERT_INT_EQ(sshkey_from_private(kr, &k1), 0); ASSERT_PTR_NE(k1, NULL); @@ -308,6 +324,7 @@ sshkey_tests(void) sshkey_free(k1); TEST_DONE(); +#ifdef WITH_DSA TEST_START("demote KEY_DSA"); ASSERT_INT_EQ(sshkey_from_private(kd, &k1), 0); ASSERT_PTR_NE(k1, NULL); @@ -322,6 +339,7 @@ sshkey_tests(void) ASSERT_INT_EQ(sshkey_equal(kd, k1), 1); sshkey_free(k1); TEST_DONE(); +#endif #ifdef OPENSSL_HAS_ECC TEST_START("demote KEY_ECDSA"); @@ -339,7 +357,8 @@ sshkey_tests(void) ASSERT_INT_EQ(sshkey_equal(ke, k1), 1); sshkey_free(k1); TEST_DONE(); -#endif +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ TEST_START("demote KEY_ED25519"); ASSERT_INT_EQ(sshkey_from_private(kf, &k1), 0); @@ -355,38 +374,41 @@ sshkey_tests(void) sshkey_free(k1); TEST_DONE(); +#ifdef WITH_OPENSSL TEST_START("equal mismatched key types"); ASSERT_INT_EQ(sshkey_equal(kd, kr), 0); #ifdef OPENSSL_HAS_ECC ASSERT_INT_EQ(sshkey_equal(kd, ke), 0); ASSERT_INT_EQ(sshkey_equal(kr, ke), 0); ASSERT_INT_EQ(sshkey_equal(ke, kf), 0); -#endif +#endif /* OPENSSL_HAS_ECC */ ASSERT_INT_EQ(sshkey_equal(kd, kf), 0); TEST_DONE(); +#endif /* WITH_OPENSSL */ TEST_START("equal different keys"); +#ifdef WITH_OPENSSL ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1024, &k1), 0); ASSERT_INT_EQ(sshkey_equal(kr, k1), 0); sshkey_free(k1); - ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &k1), 0); - ASSERT_INT_EQ(sshkey_equal(kd, k1), 0); - sshkey_free(k1); #ifdef OPENSSL_HAS_ECC ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &k1), 0); ASSERT_INT_EQ(sshkey_equal(ke, k1), 0); sshkey_free(k1); -#endif +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &k1), 0); ASSERT_INT_EQ(sshkey_equal(kf, k1), 0); sshkey_free(k1); TEST_DONE(); +#ifdef WITH_OPENSSL sshkey_free(kr); sshkey_free(kd); #ifdef OPENSSL_HAS_ECC sshkey_free(ke); -#endif +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ sshkey_free(kf); TEST_START("certify key"); @@ -423,7 +445,7 @@ sshkey_tests(void) put_opt(k1->cert->extensions, "permit-X11-forwarding", NULL); put_opt(k1->cert->extensions, "permit-agent-forwarding", NULL); ASSERT_INT_EQ(sshkey_from_private(k2, &k1->cert->signature_key), 0); - ASSERT_INT_EQ(sshkey_certify(k1, k2, NULL), 0); + ASSERT_INT_EQ(sshkey_certify(k1, k2, NULL, NULL, NULL), 0); b = sshbuf_new(); ASSERT_PTR_NE(b, NULL); ASSERT_INT_EQ(sshkey_putb(k1, b), 0); @@ -435,6 +457,7 @@ sshkey_tests(void) sshbuf_reset(b); TEST_DONE(); +#ifdef WITH_OPENSSL TEST_START("sign and verify RSA"); k1 = get_private("rsa_1"); ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_2.pub"), &k2, @@ -462,6 +485,7 @@ sshkey_tests(void) sshkey_free(k2); TEST_DONE(); +#ifdef WITH_DSA TEST_START("sign and verify DSA"); k1 = get_private("dsa_1"); ASSERT_INT_EQ(sshkey_load_public(test_data_file("dsa_2.pub"), &k2, @@ -470,6 +494,7 @@ sshkey_tests(void) sshkey_free(k1); sshkey_free(k2); TEST_DONE(); +#endif #ifdef OPENSSL_HAS_ECC TEST_START("sign and verify ECDSA"); @@ -480,7 +505,8 @@ sshkey_tests(void) sshkey_free(k1); sshkey_free(k2); TEST_DONE(); -#endif +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ TEST_START("sign and verify ED25519"); k1 = get_private("ed25519_1"); @@ -491,6 +517,7 @@ sshkey_tests(void) sshkey_free(k2); TEST_DONE(); +#ifdef WITH_OPENSSL TEST_START("nested certificate"); ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1"), &k1), 0); ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2, @@ -505,5 +532,5 @@ sshkey_tests(void) sshkey_free(k3); sshbuf_free(b); TEST_DONE(); - +#endif /* WITH_OPENSSL */ } diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/dsa_n b/crypto/openssh/regress/unittests/sshkey/testdata/dsa_n index d3f24824f8d5..657624e0e72f 100644 --- a/crypto/openssh/regress/unittests/sshkey/testdata/dsa_n +++ b/crypto/openssh/regress/unittests/sshkey/testdata/dsa_n @@ -1,12 +1,21 @@ ------BEGIN DSA PRIVATE KEY----- -MIIBvAIBAAKBgQD6kutNFRsHTwEAv6d39Lhsqy1apdHBZ9c2HfyRr7WmypyGIy2m -Ka43vzXI8CNwmRSYs+A6d0vJC7Pl+f9QzJ/04NWOA+MiwfurwrR3CRe61QRYb8Py -mcHOxueHs95IcjrbIPNn86cjnPP5qvv/guUzCjuww4zBdJOXpligrGt2XwIVAKMD -/50qQy7j8JaMk+1+Xtg1pK01AoGBAO7l9QVVbSSoy5lq6cOtvpf8UlwOa6+zBwbl -o4gmFd1RwX1yWkA8kQ7RrhCSg8Hc6mIGnKRgKRli/3LgbSfZ0obFJehkRtEWtN4P -h8fVUeS74iQbIwFQeKlYHIlNTRoGtAbdi3nHdV+BBkEQc1V3rjqYqhjOoz/yNsgz -LND26HrdAoGBAOdXpyfmobEBaOqZAuvgj1P0uhjG2P31Ufurv22FWPBU3A9qrkxb -OXwE0LwvjCvrsQV/lrYhJz/tiys40VeahulWZE5SAHMXGIf95LiLSgaXMjko7joo -t+LK84ltLymwZ4QMnYjnZSSclf1UuyQMcUtb34+I0u9Ycnyhp2mSFsQtAhRYIbQ5 -KfXsZuBPuWe5FJz3ldaEgw== ------END DSA PRIVATE KEY----- +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABswAAAAdzc2gtZH +NzAAAAgQD6kutNFRsHTwEAv6d39Lhsqy1apdHBZ9c2HfyRr7WmypyGIy2mKa43vzXI8CNw +mRSYs+A6d0vJC7Pl+f9QzJ/04NWOA+MiwfurwrR3CRe61QRYb8PymcHOxueHs95IcjrbIP +Nn86cjnPP5qvv/guUzCjuww4zBdJOXpligrGt2XwAAABUAowP/nSpDLuPwloyT7X5e2DWk +rTUAAACBAO7l9QVVbSSoy5lq6cOtvpf8UlwOa6+zBwblo4gmFd1RwX1yWkA8kQ7RrhCSg8 +Hc6mIGnKRgKRli/3LgbSfZ0obFJehkRtEWtN4Ph8fVUeS74iQbIwFQeKlYHIlNTRoGtAbd +i3nHdV+BBkEQc1V3rjqYqhjOoz/yNsgzLND26HrdAAAAgQDnV6cn5qGxAWjqmQLr4I9T9L +oYxtj99VH7q79thVjwVNwPaq5MWzl8BNC8L4wr67EFf5a2ISc/7YsrONFXmobpVmROUgBz +FxiH/eS4i0oGlzI5KO46KLfiyvOJbS8psGeEDJ2I52UknJX9VLskDHFLW9+PiNLvWHJ8oa +dpkhbELQAAAdhWTOFbVkzhWwAAAAdzc2gtZHNzAAAAgQD6kutNFRsHTwEAv6d39Lhsqy1a +pdHBZ9c2HfyRr7WmypyGIy2mKa43vzXI8CNwmRSYs+A6d0vJC7Pl+f9QzJ/04NWOA+Miwf +urwrR3CRe61QRYb8PymcHOxueHs95IcjrbIPNn86cjnPP5qvv/guUzCjuww4zBdJOXplig +rGt2XwAAABUAowP/nSpDLuPwloyT7X5e2DWkrTUAAACBAO7l9QVVbSSoy5lq6cOtvpf8Ul +wOa6+zBwblo4gmFd1RwX1yWkA8kQ7RrhCSg8Hc6mIGnKRgKRli/3LgbSfZ0obFJehkRtEW +tN4Ph8fVUeS74iQbIwFQeKlYHIlNTRoGtAbdi3nHdV+BBkEQc1V3rjqYqhjOoz/yNsgzLN +D26HrdAAAAgQDnV6cn5qGxAWjqmQLr4I9T9LoYxtj99VH7q79thVjwVNwPaq5MWzl8BNC8 +L4wr67EFf5a2ISc/7YsrONFXmobpVmROUgBzFxiH/eS4i0oGlzI5KO46KLfiyvOJbS8psG +eEDJ2I52UknJX9VLskDHFLW9+PiNLvWHJ8oadpkhbELQAAABRYIbQ5KfXsZuBPuWe5FJz3 +ldaEgwAAAAAB +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_n b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_n index 80382b62d2db..9694f32e4407 100644 --- a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_n +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_n @@ -1,5 +1,8 @@ ------BEGIN EC PRIVATE KEY----- -MHcCAQEEIPPNyUAnjvFr+eT/7t/IyjuQQd/aLFiTY92LB9gIjyrMoAoGCCqGSM49 -AwEHoUQDQgAEDFlblkOrW9ydKVhtM+9AY3c9saBE7SG3lFx38nBavkADDaI9jh3/ -kvG/Jt9vpm22qwoklTCGDfzCkXkIKaWlBw== ------END EC PRIVATE KEY----- +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS +1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQQMWVuWQ6tb3J0pWG0z70Bjdz2xoETt +IbeUXHfycFq+QAMNoj2OHf+S8b8m32+mbbarCiSVMIYN/MKReQgppaUHAAAAoFrmmZBa5p +mQAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAxZW5ZDq1vcnSlY +bTPvQGN3PbGgRO0ht5Rcd/JwWr5AAw2iPY4d/5Lxvybfb6ZttqsKJJUwhg38wpF5CCmlpQ +cAAAAhAPPNyUAnjvFr+eT/7t/IyjuQQd/aLFiTY92LB9gIjyrMAAAAAAECAwQFBgc= +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1 b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1 new file mode 100644 index 000000000000..b51fb73d6386 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1 @@ -0,0 +1,13 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2 +RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQRnVT5Cji1D +Ge2+q2X0vATh6LYnODV+DJrshJorr5GnipW29RfuaDXs0WB6XBej9dOLazVRDjQrtV19Qg +O6cfkFAAAABHNzaDoAAAGQuPdnP7j3Zz8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv +cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEZ1U+Qo4tQxntvqtl9LwE4ei2Jzg1fgya7I +SaK6+Rp4qVtvUX7mg17NFgelwXo/XTi2s1UQ40K7VdfUIDunH5BQAAAARzc2g6AQAAAOMt +LS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KTUhjQ0FRRUVJRURmVFB4YzA0alN5Zk +Z5NlhoV1pTVlpzcnU5ZFlaSVpTOWhjeVFhcDlVT29Bb0dDQ3FHU000OQpBd0VIb1VRRFFn +QUVaMVUrUW80dFF4bnR2cXRsOUx3RTRlaTJKemcxZmd5YTdJU2FLNitScDRxVnR2VVg3bW +cxCjdORmdlbHdYby9YVGkyczFVUTQwSzdWZGZVSUR1bkg1QlE9PQotLS0tLUVORCBFQyBQ +UklWQVRFIEtFWS0tLS0tCgAAAAAAAAAURUNEU0EtU0sgdGVzdCBrZXkgIzEBAgMEBQ== +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1-cert.fp b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1-cert.fp new file mode 100644 index 000000000000..d1921451d740 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1-cert.fp @@ -0,0 +1 @@ +SHA256:Go7HO0CVPYG+BSDSk9ZUJBKGSrtBExp6obTa9iqzIUo diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1-cert.pub b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1-cert.pub new file mode 100644 index 000000000000..9586c61a7d69 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1-cert.pub @@ -0,0 +1 @@ +sk-ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAK3NrLWVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgE012YoSBE9hEC2FRzblcSx784JNo2A4g611A7I75YMMAAAAIbmlzdHAyNTYAAABBBGdVPkKOLUMZ7b6rZfS8BOHotic4NX4MmuyEmiuvkaeKlbb1F+5oNezRYHpcF6P104trNVEONCu1XX1CA7px+QUAAAAEc3NoOgAAAAAAAAAHAAAAAgAAAAZqdWxpdXMAAAASAAAABWhvc3QxAAAABWhvc3QyAAAAADaLg2AAAAAATR3h4AAAAAAAAAAAAAAAAAAAAGgAAAATZWNkc2Etc2hhMi1uaXN0cDI1NgAAAAhuaXN0cDI1NgAAAEEEAlTtPiWUHubBeCys4Xp0QF91dYARpkyqtCnzg10HRS+ZDgkMrSUvPPG+Ge8iqtnB951MBxDq9FqDFIkhQBYXDAAAAGQAAAATZWNkc2Etc2hhMi1uaXN0cDI1NgAAAEkAAAAhALY+eXRJjVGnMk38Sm5S+H5CloNq757ypsoxt+WYoadtAAAAIA42/mAhUfLij1GY7wl+OFrI+icB/t4tGiEUZmhx6Foo ECDSA-SK test key #1 diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1.fp b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1.fp new file mode 100644 index 000000000000..d1921451d740 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1.fp @@ -0,0 +1 @@ +SHA256:Go7HO0CVPYG+BSDSk9ZUJBKGSrtBExp6obTa9iqzIUo diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1.fp.bb b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1.fp.bb new file mode 100644 index 000000000000..cb9f4dd0dc8d --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1.fp.bb @@ -0,0 +1 @@ +xovem-sacac-dageg-vovoc-symyz-bozal-cibiv-cyvat-vylyn-romib-hoxax diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1.pub b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1.pub new file mode 100644 index 000000000000..c3b21e02b1f3 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1.pub @@ -0,0 +1 @@ +sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGdVPkKOLUMZ7b6rZfS8BOHotic4NX4MmuyEmiuvkaeKlbb1F+5oNezRYHpcF6P104trNVEONCu1XX1CA7px+QUAAAAEc3NoOg== ECDSA-SK test key #1 diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1_pw b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1_pw new file mode 100644 index 000000000000..4fa23a7383e3 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk1_pw @@ -0,0 +1,14 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABB6vcJVx2 +cPc7yYRROup8VnAAAAEAAAAAEAAAB/AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3Bl +bnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGdVPkKOLUMZ7b6rZfS8BOHotic4NX4MmuyEmi +uvkaeKlbb1F+5oNezRYHpcF6P104trNVEONCu1XX1CA7px+QUAAAAEc3NoOgAAAZBrvCxe +xFz0bvzXwaPhrUHBeNCoZy/wNKDx0kxlxUPuA+lgOvy5l3lT3yxxd0qj5PQB+NTcuz8AAE +1f7aSWQNZSifox3COsBGoHV9C8i+glcxiBKheAZD+EBnRGjG8kbcaLhuYDW/I39qNe8lHW +YSDjmvsT55Hy0IAtVRAXizDoXKNdFPTZisC67WyOSJ3ED7Fy4bfT4ApbvhoFTwjikZBEhy +LOad1sbJa4eT19TsskYfQdnJf8sjAmCMOZY4ZV0FiNW5XZOp8nIal1oyULPfzTAm6oaeFN +0ImCSU3U8h4wUQ8q/3XvBWtTKycZaoou0AwPoP0QN95Ywte7FHezNPb/n8KD7k0S6h9XAX +UcBeCe5NHyov/0ZzA2p737hzm3w+MXGOboTQMu8WFXeGh4m7QH2o8ZJdgBhM5JF17uii+Q +ppGoPWHf33MXwB3wxWmKZ0ua0f9AVLkQ2DfFszUoBJE/kcHRd4kj4Q4FWXeMBN0GoH8gdE +gRWIlxn2/FAOce/BFPzzdP87H0jwz7SdcuVO1L +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2 b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2 new file mode 100644 index 000000000000..19db5a3f5690 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2 @@ -0,0 +1,13 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2 +RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQSTl+SR6rTg +lOZmcQkCtJ3Pd+lWinezo/gHk4oZdZcTQsmEYs766BlWGuB2Bz3qQRLa6cXsP+4K9kAjAJ +7zdoFUAAAABHNzaDoAAAGQ1qllJtapZSYAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv +cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEk5fkkeq04JTmZnEJArSdz3fpVop3s6P4B5 +OKGXWXE0LJhGLO+ugZVhrgdgc96kES2unF7D/uCvZAIwCe83aBVAAAAARzc2g6AQAAAOMt +LS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KTUhjQ0FRRUVJSkxwVkxnSTVvdkRlOW +VMWmZodCs5WWlMaitnam0rTXhHTXg5NndiRWw0Wm9Bb0dDQ3FHU000OQpBd0VIb1VRRFFn +QUVrNWZra2VxMDRKVG1abkVKQXJTZHozZnBWb3AzczZQNEI1T0tHWFdYRTBMSmhHTE8rdW +daClZocmdkZ2M5NmtFUzJ1bkY3RC91Q3ZaQUl3Q2U4M2FCVkE9PQotLS0tLUVORCBFQyBQ +UklWQVRFIEtFWS0tLS0tCgAAAAAAAAAURUNEU0EtU0sgdGVzdCBrZXkgIzIBAgMEBQ== +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2.fp b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2.fp new file mode 100644 index 000000000000..1bc99ea0d7a4 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2.fp @@ -0,0 +1 @@ +SHA256:pz8VkgtRY3r50F4zSuzRlmq9c6vPTpJXLKKOgkyUcKE diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2.fp.bb b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2.fp.bb new file mode 100644 index 000000000000..bfee7658a606 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2.fp.bb @@ -0,0 +1 @@ +xobel-gavur-gorym-pedop-rarob-bunek-gucer-lofeg-syhaf-fylur-zoxix diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2.pub b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2.pub new file mode 100644 index 000000000000..2629d9509ed2 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ecdsa_sk2.pub @@ -0,0 +1 @@ +sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBJOX5JHqtOCU5mZxCQK0nc936VaKd7Oj+AeTihl1lxNCyYRizvroGVYa4HYHPepBEtrpxew/7gr2QCMAnvN2gVQAAAAEc3NoOg== ECDSA-SK test key #2 diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_1_pw b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_1_pw index c3b7ae7f811b..da94d2b8e2e4 100644 --- a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_1_pw +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_1_pw @@ -1,8 +1,8 @@ -----BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABCus+kaow -AUjHphacvRp98dAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIFOG6kY7Rf4UtCFv -PwKgo/BztXck2xC4a2WyA34XtIwZAAAAoJaqqgiYQuElraJAmYOm7Tb4nJ3eI4oj9mQ52M -/Yd+ION2Ur1v8BDewpDX+LHEYgKHo3Mlmcn2UyF+QJ+7xUCW7QCtk/4szrJzw74DlEl6mH -T8PT/f/av7PpECBD/YD3NoDlB9OWm/Q4sHcxfBEKfTGD7s2Onn71HgrdEOPqd4Sj/IQigR -drfjtXEMlD32k9n3dd2eS9x7AHWYaGFEMkOcY= +b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABDKT56mBA +tXIMsWqmuuA2gdAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIFOG6kY7Rf4UtCFv +PwKgo/BztXck2xC4a2WyA34XtIwZAAAAoC13U47yfUOSZJePNUAwWXuFOk3aOKwPM5PMvK +0zwRnMZZjgn+tsMAYPwhsT3Mx3h5QzvVGFyFEqsiK7j4vAotD+LVQeBN5TwWbUBx4lnoGs +3iAfYVDakO/gNvVBDDGOqv5kdCc4cgn5HacjHQLKOAx6KzHe7JFn7uCywMdVVQjlpI6LHb +mHkaKiVX/C2oiRnsoe17HZ8Fxyt3vd1qNM8BE= -----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1 b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1 new file mode 100644 index 000000000000..4196d9c6a2de --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1 @@ -0,0 +1,8 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2 +gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACAhaP5OS1PPOt7uumAvXlDtte9EHbqIT1EZEJ2y +2v3XMwAAAARzc2g6AAAAuBocY6UaHGOlAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2 +9tAAAAICFo/k5LU8863u66YC9eUO2170QduohPURkQnbLa/dczAAAABHNzaDoBAAAAQJYq +lGHhFoA25/q8X/rdTqDAb7dhqs4ehhd/w8x99CwiIWj+TktTzzre7rpgL15Q7bXvRB26iE +9RGRCdstr91zMAAAAAAAAAFkVEMjU1MTktU0sgdGVzdCBrZXkgIzEBAgM= +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1-cert.fp b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1-cert.fp new file mode 100644 index 000000000000..a6bb1a99cb32 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1-cert.fp @@ -0,0 +1 @@ +SHA256:6WZVJ44bqhAWLVP4Ns0TDkoSQSsZo/h2K+mEvOaNFbw diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1-cert.pub b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1-cert.pub new file mode 100644 index 000000000000..3c72c268df94 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1-cert.pub @@ -0,0 +1 @@ +sk-ssh-ed25519-cert-v01@openssh.com AAAAI3NrLXNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIJr7CuMntQKvHoUshx374fJLFEkyxKsEOBA1H6hk5scoAAAAICFo/k5LU8863u66YC9eUO2170QduohPURkQnbLa/dczAAAABHNzaDoAAAAAAAAACAAAAAIAAAAGanVsaXVzAAAAEgAAAAVob3N0MQAAAAVob3N0MgAAAAA2i4NgAAAAAE0d4eAAAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIOo/0xneV3iM2qWEo5RUwvUYa2bjff292T5vvuXRomGQAAAAUwAAAAtzc2gtZWQyNTUxOQAAAECgsRGLDh1SI3m66MRp9D2iLP4wabQ0OrDgGidk7LsVn2XZHV5jBZN1RtNfe6PBMeVzfRtGUzOg18sO7H7uU+EC ED25519-SK test key #1 diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1.fp b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1.fp new file mode 100644 index 000000000000..a6bb1a99cb32 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1.fp @@ -0,0 +1 @@ +SHA256:6WZVJ44bqhAWLVP4Ns0TDkoSQSsZo/h2K+mEvOaNFbw diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1.fp.bb b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1.fp.bb new file mode 100644 index 000000000000..1bfe20a4803a --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1.fp.bb @@ -0,0 +1 @@ +xucac-vusip-tydoz-dudad-nerif-raran-tezun-cogyd-pamoh-bahef-ruxix diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1.pub b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1.pub new file mode 100644 index 000000000000..60fe00c3949b --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1.pub @@ -0,0 +1 @@ +sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAICFo/k5LU8863u66YC9eUO2170QduohPURkQnbLa/dczAAAABHNzaDo= ED25519-SK test key #1 diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1_pw b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1_pw new file mode 100644 index 000000000000..1c29ff07fe5c --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk1_pw @@ -0,0 +1,9 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABDr5R9Yf/ +ucEh0Ns6c34tcIAAAAEAAAAAEAAABKAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29t +AAAAICFo/k5LU8863u66YC9eUO2170QduohPURkQnbLa/dczAAAABHNzaDoAAADA2T6owx +OSgKz4DvLnS3UJ/renbuew5mbkIWB1/y8xd3y5Usm08iUCAlKxep9dVRQvmyoTrc/7rHOM +DkokNw+WgKambnlYT/9QfqViZ9iCBtbdmhLM6ksUCgQefvquRyXoJxlWstjXUll6Ru+ZbT +H//Ss8C1bYtAiXR68OQ+rhDrvQxA9P8J1sGIlkuV3h8YXddSpyBW2Sn0LTHHBXYZo86cXZ +G4Lnc8aGYm65eqdHgkfRmht3eS8DTdzEBfBNH5Ml +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2 b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2 new file mode 100644 index 000000000000..b9b748966bca --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2 @@ -0,0 +1,8 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2 +gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACAV8fu1Sc31QLK2R/zGPdN3ve5xuFvDc7mEAWxb +aI+YcwAAAARzc2g6AAAAuJCMX5uQjF+bAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2 +9tAAAAIBXx+7VJzfVAsrZH/MY903e97nG4W8NzuYQBbFtoj5hzAAAABHNzaDoBAAAAQObE +PajcKI1W30EKOhBb6u+Fgx464kf7EjnqDSg4l7gAFfH7tUnN9UCytkf8xj3Td73ucbhbw3 +O5hAFsW2iPmHMAAAAAAAAAFkVEMjU1MTktU0sgdGVzdCBrZXkgIzIBAgM= +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2.fp b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2.fp new file mode 100644 index 000000000000..1c4369a00768 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2.fp @@ -0,0 +1 @@ +SHA256:b9BVPS5vuU4yu/FgweojLLg6zbfmBBoWLUgibdxxsoo diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2.fp.bb b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2.fp.bb new file mode 100644 index 000000000000..f5fd9efd8f9f --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2.fp.bb @@ -0,0 +1 @@ +xemac-tizim-dihep-supar-zupib-cukak-pasis-febeg-dyguv-hutec-dyxox diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2.pub b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2.pub new file mode 100644 index 000000000000..c7ed9f524a49 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshkey/testdata/ed25519_sk2.pub @@ -0,0 +1 @@ +sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBXx+7VJzfVAsrZH/MY903e97nG4W8NzuYQBbFtoj5hzAAAABHNzaDo= ED25519-SK test key #2 diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1 b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1 Binary files differdeleted file mode 100644 index 161cc04dc700..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1 +++ /dev/null diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.fp b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.fp deleted file mode 100644 index 21b3d1a9a128..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.fp +++ /dev/null @@ -1 +0,0 @@ -SHA256:/kk7K9S9kwYFiFilnZYFwCsQJweI/SGQVR2nIa8VBhE diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.fp.bb b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.fp.bb deleted file mode 100644 index 62991b3e0bbe..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.fp.bb +++ /dev/null @@ -1 +0,0 @@ -xilil-nabyf-gynih-duheb-gokyp-bofet-nekac-bosod-lozin-kuvyh-poxix diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.param.n b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.param.n deleted file mode 100644 index 9a2549bbbd15..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.param.n +++ /dev/null @@ -1 +0,0 @@ -00ce8ca77a556eba887f9a866c084a6402785354a81c10854d343181fa09351223a65f99915f8433d11a9c41677d307c03c3a39865b83e7172d2c1d878333c980438d6e4462106a0065cd75cfea7ca7f21538bf2f43f2af49cacee51b22e3bdcc5e87b59cc691f7c6942a77ef13bfdfb24300777b727348d0ba7900ba06b886729 diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.pub b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.pub deleted file mode 100644 index f665b0d64d1e..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1.pub +++ /dev/null @@ -1 +0,0 @@ -1024 65537 145043942670517902781741650890610683756045780348507433188994725700923246927874581962206512480287863636935077725837494808988986557337885675565086448774391442851909709751605441036910145362277967349042489937363543710406342212883803780768870873303921572812138116796733586484633244057911618360651775855949808953129 RSA1 test key #1 diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1_pw b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1_pw Binary files differdeleted file mode 100644 index e73c6794ade5..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_1_pw +++ /dev/null diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2 b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2 Binary files differdeleted file mode 100644 index 1d672ddea393..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2 +++ /dev/null diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.fp b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.fp deleted file mode 100644 index 00516d521fba..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.fp +++ /dev/null @@ -1 +0,0 @@ -SHA256:JaOeRCnLl/TLe7vn1+aQ4ONyKZCUhK5x3k4VHilmbpE diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.fp.bb b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.fp.bb deleted file mode 100644 index b4989a588d88..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.fp.bb +++ /dev/null @@ -1 +0,0 @@ -xipag-zohut-zepuk-pisyv-kamog-pupus-netud-tudis-melup-cynov-gaxox diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.param.n b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.param.n deleted file mode 100644 index 25d438d06207..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.param.n +++ /dev/null @@ -1 +0,0 @@ -00cab091b57a154740c1bb7020f46a21a19dc40f647db2aab1babd30cabe241f0437391e68376ba35e48c624b8eaf6b59424d4c1a848c9fd1ef5cdc7c1b7f5e5df23b7ad513b79021286d38c52fdfae35656659e8649b2bf8bedf7c99664e45534007bd1c5dc3de1dafdf2d34ad087155951aa0f3d500b36d0d804bbccdef15ab31ca3dd40bdf5196065a97f397ef576caffb606be8232f6e0614aea0e979b9584296673fabb1dbd9f3212495c428842a2ab1f1768dd424fb6fdceeeab9126cacdfc834f0a0d09ba73ad8360d183ba85bb1565555cc6a536eb8d06df1a1e841107c021ae28a2d8b3465f9d8b58ef4045aea1c4ad7f8bf639574d6b142af67b4eb3 diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.pub b/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.pub deleted file mode 100644 index acab6dda6e62..000000000000 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa1_2.pub +++ /dev/null @@ -1 +0,0 @@ -2048 65537 25587207108642486834576012232250034427766229965612147538722032399009467293691448851087324679403117563681753304072089087252850866332601294130674473984011813227791089686736237645788471744456489819306046398653719249100878753563464696688916667605969658659855996383142110932332560049231682024775766802333675397528993897914717996946881193454997890776063024953924432026083898531677702536941151535135950834711001926404724453460085864892836473957600610133803037286539329764689125111700732309717375455919436557475211197800228646235077584780367991159670572954337165006813357814232200750568307753718414790655085790471723847208627 RSA1 test key #2 diff --git a/crypto/openssh/regress/unittests/sshkey/testdata/rsa_n b/crypto/openssh/regress/unittests/sshkey/testdata/rsa_n index 5de3f8422e89..b8e585e5188a 100644 --- a/crypto/openssh/regress/unittests/sshkey/testdata/rsa_n +++ b/crypto/openssh/regress/unittests/sshkey/testdata/rsa_n @@ -1,15 +1,16 @@ ------BEGIN RSA PRIVATE KEY----- -MIICXAIBAAKBgQDLV5lUTt7FrADseB/CGhEZzpoojjEW5y8+ePvLppmK3MmMI18u -d6vxzpK3bwZLYkVSyfJYI0HmIuGhdu7yMrW6wb84gbq8C31Xoe9EORcIUuGSvDKd -NSM1SjlhDquRblDFB8kToqXyx1lqrXecXylxIUOL0jE+u0rU1967pDJx+wIDAQAB -AoGAXyj5mpjmbD+YlxGIWz/zrM4hGsWgd4VteKEJxT6MMI4uzCRpkMd0ck8oHiwZ -GAI/SwUzIsgtONQuH3AXVsUgghW4Ynn+8ksEv0IZ918WDMDwqvqkyrVzsOsZzqYj -Pf8DUDKCpwFjnlknJ04yvWBZvVhWtY4OiZ8GV0Ttsu3k+GECQQD1YHfvBb5FdJBv -Uhde2Il+jaFia8mwVVNNaiD2ECxXx6CzGz54ZLEB9NPVfDUZK8lJ4UJDqelWNh3i -PF3RefWDAkEA1CVBzAFL4mNwpleVPzrfy69xP3gWOa26MxM/GE6zx9jC7HgQ3KPa -WKdG/FuHs085aTRDaDLmGcZ8IvMuu7NgKQJAcIOKmxR0Gd8IN7NZugjqixggb0Pj -mLKXXwESGiJyYtHL0zTj4Uqyi6Ya2GJ66o7UXscmnmYz828fJtTtZBdbRwJBALfi -C2QvA32Zv/0PEXibKXy996WSC4G3ShwXZKtHHKHvCxY5BDSbehk59VesZrVPyG2e -NYdOBxD0cIlCzJE56/ECQAndVkxvO8hwyEFGGwF3faHIAe/OxVb+MjaU25//Pe1/ -h/e6tlCk4w9CODpyV685gV394eYwMcGDcIkipTNUDZs= ------END RSA PRIVATE KEY----- +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAlwAAAAdzc2gtcn +NhAAAAAwEAAQAAAIEAy1eZVE7exawA7HgfwhoRGc6aKI4xFucvPnj7y6aZitzJjCNfLner +8c6St28GS2JFUsnyWCNB5iLhoXbu8jK1usG/OIG6vAt9V6HvRDkXCFLhkrwynTUjNUo5YQ +6rkW5QxQfJE6Kl8sdZaq13nF8pcSFDi9IxPrtK1Nfeu6QycfsAAAH4to4I7raOCO4AAAAH +c3NoLXJzYQAAAIEAy1eZVE7exawA7HgfwhoRGc6aKI4xFucvPnj7y6aZitzJjCNfLner8c +6St28GS2JFUsnyWCNB5iLhoXbu8jK1usG/OIG6vAt9V6HvRDkXCFLhkrwynTUjNUo5YQ6r +kW5QxQfJE6Kl8sdZaq13nF8pcSFDi9IxPrtK1Nfeu6QycfsAAAADAQABAAAAgF8o+ZqY5m +w/mJcRiFs/86zOIRrFoHeFbXihCcU+jDCOLswkaZDHdHJPKB4sGRgCP0sFMyLILTjULh9w +F1bFIIIVuGJ5/vJLBL9CGfdfFgzA8Kr6pMq1c7DrGc6mIz3/A1AygqcBY55ZJydOMr1gWb +1YVrWODomfBldE7bLt5PhhAAAAQAndVkxvO8hwyEFGGwF3faHIAe/OxVb+MjaU25//Pe1/ +h/e6tlCk4w9CODpyV685gV394eYwMcGDcIkipTNUDZsAAABBAPVgd+8FvkV0kG9SF17YiX +6NoWJrybBVU01qIPYQLFfHoLMbPnhksQH009V8NRkryUnhQkOp6VY2HeI8XdF59YMAAABB +ANQlQcwBS+JjcKZXlT8638uvcT94FjmtujMTPxhOs8fYwux4ENyj2linRvxbh7NPOWk0Q2 +gy5hnGfCLzLruzYCkAAAAAAQID +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshkey/tests.c b/crypto/openssh/regress/unittests/sshkey/tests.c index 13f265cdb91b..78aa9223d42b 100644 --- a/crypto/openssh/regress/unittests/sshkey/tests.c +++ b/crypto/openssh/regress/unittests/sshkey/tests.c @@ -7,8 +7,6 @@ #include "includes.h" -#include <openssl/evp.h> - #include "../test_helper/test_helper.h" void sshkey_tests(void); @@ -18,9 +16,6 @@ void sshkey_fuzz_tests(void); void tests(void) { - OpenSSL_add_all_algorithms(); - ERR_load_CRYPTO_strings(); - sshkey_tests(); sshkey_file_tests(); sshkey_fuzz_tests(); diff --git a/crypto/openssh/regress/unittests/sshsig/Makefile b/crypto/openssh/regress/unittests/sshsig/Makefile new file mode 100644 index 000000000000..bc3c6c739d48 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/Makefile @@ -0,0 +1,25 @@ +# $OpenBSD: Makefile,v 1.3 2023/01/15 23:35:10 djm Exp $ + +PROG=test_sshsig +SRCS=tests.c + +# From usr.bin/ssh +SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c +SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c +SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c +SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c +SRCS+=addr.c addrmatch.c bitmap.c sshsig.c +SRCS+=ed25519.c hash.c +SRCS+=cipher-chachapoly.c chacha.c poly1305.c ssh-ecdsa-sk.c ssh-sk.c +SRCS+=ssh-ed25519-sk.c sk-usbhid.c + +SRCS+=digest-openssl.c +#SRCS+=digest-libc.c +SRCS+=utf8.c + +REGRESS_TARGETS=run-regress-${PROG} + +run-regress-${PROG}: ${PROG} + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} -d ${.CURDIR}/testdata + +.include <bsd.regress.mk> diff --git a/crypto/openssh/regress/unittests/sshsig/mktestdata.sh b/crypto/openssh/regress/unittests/sshsig/mktestdata.sh new file mode 100755 index 000000000000..d2300f9c6ee1 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/mktestdata.sh @@ -0,0 +1,42 @@ +#!/bin/sh +# $OpenBSD: mktestdata.sh,v 1.1 2020/06/19 04:32:09 djm Exp $ + +NAMESPACE=unittest + +set -ex + +cd testdata + +if [ -f ../../../misc/sk-dummy/sk-dummy.so ] ; then + SK_DUMMY=../../../misc/sk-dummy/sk-dummy.so +elif [ -f ../../../misc/sk-dummy/obj/sk-dummy.so ] ; then + SK_DUMMY=../../../misc/sk-dummy/obj/sk-dummy.so +else + echo "Can't find sk-dummy.so" 1>&2 + exit 1 +fi + +rm -f signed-data namespace +rm -f rsa dsa ecdsa ed25519 ecdsa_sk ed25519_sk +rm -f rsa.sig dsa.sig ecdsa.sig ed25519.sig ecdsa_sk.sig ed25519_sk.sig + +printf "This is a test, this is only a test" > signed-data +printf "$NAMESPACE" > namespace + +ssh-keygen -t rsa -C "RSA test" -N "" -f rsa -m PEM +ssh-keygen -t dsa -C "DSA test" -N "" -f dsa -m PEM +ssh-keygen -t ecdsa -C "ECDSA test" -N "" -f ecdsa -m PEM +ssh-keygen -t ed25519 -C "ED25519 test key" -N "" -f ed25519 +ssh-keygen -w "$SK_DUMMY" -t ecdsa-sk -C "ECDSA-SK test key" \ + -N "" -f ecdsa_sk +ssh-keygen -w "$SK_DUMMY" -t ed25519-sk -C "ED25519-SK test key" \ + -N "" -f ed25519_sk + +ssh-keygen -Y sign -f rsa -n $NAMESPACE - < signed-data > rsa.sig +ssh-keygen -Y sign -f dsa -n $NAMESPACE - < signed-data > dsa.sig +ssh-keygen -Y sign -f ecdsa -n $NAMESPACE - < signed-data > ecdsa.sig +ssh-keygen -Y sign -f ed25519 -n $NAMESPACE - < signed-data > ed25519.sig +ssh-keygen -w "$SK_DUMMY" \ + -Y sign -f ecdsa_sk -n $NAMESPACE - < signed-data > ecdsa_sk.sig +ssh-keygen -w "$SK_DUMMY" \ + -Y sign -f ed25519_sk -n $NAMESPACE - < signed-data > ed25519_sk.sig diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/dsa b/crypto/openssh/regress/unittests/sshsig/testdata/dsa new file mode 100644 index 000000000000..7c0063efcdf5 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/dsa @@ -0,0 +1,12 @@ +-----BEGIN DSA PRIVATE KEY----- +MIIBuwIBAAKBgQCXpndQdz2mQVnk+lYOF3nxDT+h6SiJmUvBFhnFWBv8tG4pTOkb +EwGufLEzGpzjTj+3bjVau7LFt37AFrqs4Num272BWNsYNIjOlGPgq7Xjv32FN00x +JYh1DoRs1cGGnvohlsWEamGGhTHD1a9ipctPEBV+NrxtZMrl+pO/ZZg8vQIVAKJB +P3iNYSpSuW74+q4WxLCuK8O3AoGAQldE+BIuxlvoG1IFiWesx0CU+H2KO0SEZc9A +SX/qjOabh0Fb78ofTlEf9gWHFfat8SvSJQIOPMVlb76Lio8AAMT8Eaa/qQKKYmQL +dNq4MLhhjxx5KLGt6J2JyFPExCv+qnHYHD59ngtLwKyqGjpSC8LPLktdXn8W/Aad +Ly1K7+MCgYBsMHBczhSeUh8w7i20CVg4OlNTmfJRVU2tO6OpMxZ/quitRm3hLKSN +u4xRkvHJwi4LhQtv1SXvLI5gs5P3gCG8tsIAiyCqLinHha63iBdJpqhnV/x/j7dB +yJr3xJbnmLdWLkkCtNk1Ir1/CuEz+ufAyLGdKWksEAu1UUlb501BkwIVAILIa3Rg +0h7J9lQpHJphvF3K0M1T +-----END DSA PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/dsa.pub b/crypto/openssh/regress/unittests/sshsig/testdata/dsa.pub new file mode 100644 index 000000000000..e77aa7ef41a0 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/dsa.pub @@ -0,0 +1 @@ +ssh-dss AAAAB3NzaC1kc3MAAACBAJemd1B3PaZBWeT6Vg4XefENP6HpKImZS8EWGcVYG/y0bilM6RsTAa58sTManONOP7duNVq7ssW3fsAWuqzg26bbvYFY2xg0iM6UY+CrteO/fYU3TTEliHUOhGzVwYae+iGWxYRqYYaFMcPVr2Kly08QFX42vG1kyuX6k79lmDy9AAAAFQCiQT94jWEqUrlu+PquFsSwrivDtwAAAIBCV0T4Ei7GW+gbUgWJZ6zHQJT4fYo7RIRlz0BJf+qM5puHQVvvyh9OUR/2BYcV9q3xK9IlAg48xWVvvouKjwAAxPwRpr+pAopiZAt02rgwuGGPHHkosa3onYnIU8TEK/6qcdgcPn2eC0vArKoaOlILws8uS11efxb8Bp0vLUrv4wAAAIBsMHBczhSeUh8w7i20CVg4OlNTmfJRVU2tO6OpMxZ/quitRm3hLKSNu4xRkvHJwi4LhQtv1SXvLI5gs5P3gCG8tsIAiyCqLinHha63iBdJpqhnV/x/j7dByJr3xJbnmLdWLkkCtNk1Ir1/CuEz+ufAyLGdKWksEAu1UUlb501Bkw== DSA test diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/dsa.sig b/crypto/openssh/regress/unittests/sshsig/testdata/dsa.sig new file mode 100644 index 000000000000..0b14ad6b8a7b --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/dsa.sig @@ -0,0 +1,13 @@ +-----BEGIN SSH SIGNATURE----- +U1NIU0lHAAAAAQAAAbEAAAAHc3NoLWRzcwAAAIEAl6Z3UHc9pkFZ5PpWDhd58Q0/oekoiZ +lLwRYZxVgb/LRuKUzpGxMBrnyxMxqc404/t241Wruyxbd+wBa6rODbptu9gVjbGDSIzpRj +4Ku14799hTdNMSWIdQ6EbNXBhp76IZbFhGphhoUxw9WvYqXLTxAVfja8bWTK5fqTv2WYPL +0AAAAVAKJBP3iNYSpSuW74+q4WxLCuK8O3AAAAgEJXRPgSLsZb6BtSBYlnrMdAlPh9ijtE +hGXPQEl/6ozmm4dBW+/KH05RH/YFhxX2rfEr0iUCDjzFZW++i4qPAADE/BGmv6kCimJkC3 +TauDC4YY8ceSixreidichTxMQr/qpx2Bw+fZ4LS8Csqho6UgvCzy5LXV5/FvwGnS8tSu/j +AAAAgGwwcFzOFJ5SHzDuLbQJWDg6U1OZ8lFVTa07o6kzFn+q6K1GbeEspI27jFGS8cnCLg +uFC2/VJe8sjmCzk/eAIby2wgCLIKouKceFrreIF0mmqGdX/H+Pt0HImvfElueYt1YuSQK0 +2TUivX8K4TP658DIsZ0paSwQC7VRSVvnTUGTAAAACHVuaXR0ZXN0AAAAAAAAAAZzaGE1MT +IAAAA3AAAAB3NzaC1kc3MAAAAodi5lr0pqBpO76OY4N1CtfR85BCgZ95qfVjP/e9lToj0q +lwjSJJXUjw== +-----END SSH SIGNATURE----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa new file mode 100644 index 000000000000..55fb440e01d4 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIFg0ZCSEB5LNeLsXYL25g3kqEWsqh52DR+yNOjyQJqyZoAoGCCqGSM49 +AwEHoUQDQgAE3sud88FV0N8FPspZSV7LWqj6uPPLRZiSsenNuEYAteWPyDgrZsWb +LzXBuUJucepaCNuW/QWgHBRbrjWj3ERm3A== +-----END EC PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa.pub b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa.pub new file mode 100644 index 000000000000..14ec6cf1230c --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa.pub @@ -0,0 +1 @@ +ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBN7LnfPBVdDfBT7KWUley1qo+rjzy0WYkrHpzbhGALXlj8g4K2bFmy81wblCbnHqWgjblv0FoBwUW641o9xEZtw= ECDSA test diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa.sig b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa.sig new file mode 100644 index 000000000000..79781570cda1 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa.sig @@ -0,0 +1,7 @@ +-----BEGIN SSH SIGNATURE----- +U1NIU0lHAAAAAQAAAGgAAAATZWNkc2Etc2hhMi1uaXN0cDI1NgAAAAhuaXN0cDI1NgAAAE +EE3sud88FV0N8FPspZSV7LWqj6uPPLRZiSsenNuEYAteWPyDgrZsWbLzXBuUJucepaCNuW +/QWgHBRbrjWj3ERm3AAAAAh1bml0dGVzdAAAAAAAAAAGc2hhNTEyAAAAZQAAABNlY2RzYS +1zaGEyLW5pc3RwMjU2AAAASgAAACEAycVNsTlE+XEZYyYiDxWZlliruf/pPMhEEMR/XLdQ +a4MAAAAhALQt+5gES7L3uKGptHB6UZQMuZ2WyI0C6FJs4v6AtMIU +-----END SSH SIGNATURE----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk new file mode 100644 index 000000000000..62ae44cb09ee --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk @@ -0,0 +1,13 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2 +RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQSg1WuY0XE+ +VexOsrJsFYuxyVoe6eQ/oXmyz2pEHKZw9moyWehv+Fs7oZWFp3JVmOtybKQ6dvfUZYauQE +/Ov4PAAAAABHNzaDoAAAGI6iV41+oleNcAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv +cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEoNVrmNFxPlXsTrKybBWLsclaHunkP6F5ss +9qRBymcPZqMlnob/hbO6GVhadyVZjrcmykOnb31GWGrkBPzr+DwAAAAARzc2g6AQAAAOMt +LS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KTUhjQ0FRRUVJQm9oeW54M2tpTFVEeS +t5UjU3WXBXSU5KektnU1p6WnV2VTljYXFla3JGcW9Bb0dDQ3FHU000OQpBd0VIb1VRRFFn +QUVvTlZybU5GeFBsWHNUckt5YkJXTHNjbGFIdW5rUDZGNXNzOXFSQnltY1BacU1sbm9iL2 +hiCk82R1ZoYWR5VlpqcmNteWtPbmIzMUdXR3JrQlB6citEd0E9PQotLS0tLUVORCBFQyBQ +UklWQVRFIEtFWS0tLS0tCgAAAAAAAAARRUNEU0EtU0sgdGVzdCBrZXk= +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk.pub b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk.pub new file mode 100644 index 000000000000..385ebf15b142 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk.pub @@ -0,0 +1 @@ +sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBKDVa5jRcT5V7E6ysmwVi7HJWh7p5D+hebLPakQcpnD2ajJZ6G/4WzuhlYWnclWY63JspDp299Rlhq5AT86/g8AAAAAEc3NoOg== ECDSA-SK test key diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk.sig b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk.sig new file mode 100644 index 000000000000..86de36063174 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk.sig @@ -0,0 +1,8 @@ +-----BEGIN SSH SIGNATURE----- +U1NIU0lHAAAAAQAAAH8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQ +AAAAhuaXN0cDI1NgAAAEEEoNVrmNFxPlXsTrKybBWLsclaHunkP6F5ss9qRBymcPZqMlno +b/hbO6GVhadyVZjrcmykOnb31GWGrkBPzr+DwAAAAARzc2g6AAAACHVuaXR0ZXN0AAAAAA +AAAAZzaGE1MTIAAAB3AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20A +AABIAAAAIHohGwyy8iKT3zwd1TYA9V/Ioo7h/3zCJUtyq/Qigt/HAAAAIGzidTwq7D/kFa +7Xjcp/KkdbIs4MfQpfAW/0OciajlpzARI0Vng= +-----END SSH SIGNATURE----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk_webauthn.pub b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk_webauthn.pub new file mode 100644 index 000000000000..1597302ce70d --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk_webauthn.pub @@ -0,0 +1 @@ +sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBBRGwDjs4HhJFcn4tJ5Gr72KcmRmCS1OirETxaXvnsNApgoOLF1a/7rxldfSMHm73eT1nhHe97W8qicPPEAKDJQAAAALbWluZHJvdC5vcmc= diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk_webauthn.sig b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk_webauthn.sig new file mode 100644 index 000000000000..4bdd8edc681a --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ecdsa_sk_webauthn.sig @@ -0,0 +1,13 @@ +-----BEGIN SSH SIGNATURE----- +U1NIU0lHAAAAAQAAAIYAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQ +AAAAhuaXN0cDI1NgAAAEEEFEbAOOzgeEkVyfi0nkavvYpyZGYJLU6KsRPFpe+ew0CmCg4s +XVr/uvGV19Iwebvd5PWeEd73tbyqJw88QAoMlAAAAAttaW5kcm90Lm9yZwAAAAh1bml0dG +VzdAAAAAAAAAAGc2hhNTEyAAABhwAAACt3ZWJhdXRobi1zay1lY2RzYS1zaGEyLW5pc3Rw +MjU2QG9wZW5zc2guY29tAAAASQAAACBj2oMT9tb5wRXe6mdmf4/lgAO8wrgr95ouozwNg4 +itnQAAACEAtU9g5wz3HchUiLfLD6plr9T4TiJ32lVCrATSjpiy0SMBAAADHwAAABdodHRw +czovL3d3dy5taW5kcm90Lm9yZwAAAON7InR5cGUiOiJ3ZWJhdXRobi5nZXQiLCJjaGFsbG +VuZ2UiOiJVMU5JVTBsSEFBQUFDSFZ1YVhSMFpYTjBBQUFBQUFBQUFBWnphR0UxTVRJQUFB +QkFMTHU4WmdjU3h0Nk1zRlV6dWlaZ0c2R3dNZEo5ZDd4ZUU3WW9SSXcwZzlpSEpfd3NGRD +cxbzRXbHllenZGV0VqYnFRMHFDN0Z3R3Bqa2pVUVAtTmQ2dyIsIm9yaWdpbiI6Imh0dHBz +Oi8vd3d3Lm1pbmRyb3Qub3JnIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQAAAAA= +-----END SSH SIGNATURE----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ed25519 b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519 new file mode 100644 index 000000000000..b44a63d3ea60 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519 @@ -0,0 +1,7 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACCJYs0iDdw0Fe/FTzY1b78I4H/j+R6mz2AmLtwTjHYwBAAAAJjpGas/6Rmr +PwAAAAtzc2gtZWQyNTUxOQAAACCJYs0iDdw0Fe/FTzY1b78I4H/j+R6mz2AmLtwTjHYwBA +AAAEDpSKRA1QKW6kYiQftGRWh+H0fNekzYLG6c3bzseoCpEolizSIN3DQV78VPNjVvvwjg +f+P5HqbPYCYu3BOMdjAEAAAAEEVEMjU1MTkgdGVzdCBrZXkBAgMEBQ== +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ed25519.pub b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519.pub new file mode 100644 index 000000000000..b078e4516fbe --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIlizSIN3DQV78VPNjVvvwjgf+P5HqbPYCYu3BOMdjAE ED25519 test key diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ed25519.sig b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519.sig new file mode 100644 index 000000000000..8e8ff2a8ac19 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519.sig @@ -0,0 +1,6 @@ +-----BEGIN SSH SIGNATURE----- +U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgiWLNIg3cNBXvxU82NW+/COB/4/ +keps9gJi7cE4x2MAQAAAAIdW5pdHRlc3QAAAAAAAAABnNoYTUxMgAAAFMAAAALc3NoLWVk +MjU1MTkAAABAihQsbUzuNEFflk5Tw1+H9aLS7tZQk0RG8KW1DtOmDYYnWe3D3UKiG3fcJa +DNg4vBWp1j1gLRiBMOF+gwYNegDg== +-----END SSH SIGNATURE----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ed25519_sk b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519_sk new file mode 100644 index 000000000000..3a434ecb9417 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519_sk @@ -0,0 +1,8 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2 +gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACCbGg2F0GK7nOm4pQmAyCuGEjnhvs5q0TtjPbdN +//+yxwAAAARzc2g6AAAAuBw56jAcOeowAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2 +9tAAAAIJsaDYXQYruc6bilCYDIK4YSOeG+zmrRO2M9t03//7LHAAAABHNzaDoBAAAAQFXc +6dCwWewIk1EBofAouGZApW8+s0XekXenxtb78+x0mxoNhdBiu5zpuKUJgMgrhhI54b7Oat +E7Yz23Tf//sscAAAAAAAAAE0VEMjU1MTktU0sgdGVzdCBrZXkBAgMEBQY= +-----END OPENSSH PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ed25519_sk.pub b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519_sk.pub new file mode 100644 index 000000000000..71051ec3b217 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519_sk.pub @@ -0,0 +1 @@ +sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJsaDYXQYruc6bilCYDIK4YSOeG+zmrRO2M9t03//7LHAAAABHNzaDo= ED25519-SK test key diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/ed25519_sk.sig b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519_sk.sig new file mode 100644 index 000000000000..49b6818da59f --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/ed25519_sk.sig @@ -0,0 +1,7 @@ +-----BEGIN SSH SIGNATURE----- +U1NIU0lHAAAAAQAAAEoAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgmxoNhd +Biu5zpuKUJgMgrhhI54b7OatE7Yz23Tf//sscAAAAEc3NoOgAAAAh1bml0dGVzdAAAAAAA +AAAGc2hhNTEyAAAAZwAAABpzay1zc2gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAAEAi+7eTjW +/+LQ2M+sCD+KFtH1n7VFFJon/SZFsxODyV8cWTlFKj617Ys1Ur5TV6uaEXQhck8rBA2oQI +HTPANLIPARI0Vng= +-----END SSH SIGNATURE----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/namespace b/crypto/openssh/regress/unittests/sshsig/testdata/namespace new file mode 100644 index 000000000000..1570cd548baa --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/namespace @@ -0,0 +1 @@ +unittest
\ No newline at end of file diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/rsa b/crypto/openssh/regress/unittests/sshsig/testdata/rsa new file mode 100644 index 000000000000..228fad7978e9 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/rsa @@ -0,0 +1,39 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIG4wIBAAKCAYEA386lmjRHtJpyj87BrS+ssMmtvc/1SPN0gXTPs9jZ1hYAq98P +ca3/RYVM4HaSu6COztQJ2ZnZD3Te/XeBnIU2mfuvQEl+DiwisGeNglVyRCi7787f +PFFfcxzZfDa7EB2qY8S3oaSGZK8QqzuGwmGAImjlQXz6J+HCd/eD/58GoCSSirIE +CFWCAt+uNrOC/EmgAzsbfcfaIbbVzA40tlgU3hO2J42kddz8CisDTtDKQABFcOaQ +ZycSfn7HDP+WgXLXXBUI9wVM1Tif1f+9MX08xIsvCvGzo7yLgbbTFLSGr5SkA+tO +rYuoA7V8fge0id/3pnVtG1Ui3I7vejeAwf0HZqtFeBEnOwkIJFmZeMtFeOVf+4ki +4h1rDqAvSscNvMtLp6OXpbAATATAuEWEkIQBl1rngnEe0iC9iU9itKMW6qJ4FtIb +4ACH1EoU1x8vqrFecg2hvqfk5CZBJIbV28JFuGjac3OxBZ17Fqb8ljomUir1GrET +2z66NMgb5TjDD7BVAgMBAAECggGACfjDGCPMLhfTkuS7bGP7ZcUWoKZrX1y5jCsQ +NgsraYaBcSb3ITGHdimCS139G68DreN0rOVV7oJejRyOAdNNo367SDn+C9ObmBCF +FZGJDdBiz0SAXceiYRaf+hDWNNmdheR16hXShxnlvDtivbZqZx4VWN2gp7Y/W+kD +UJhdSzVV8igMVfK5YDdnI7jL1UHSh1JS3z/QUEA9NmJLpvQ1uc9XBlwhP78g27Me +6pwS5tccQPOE65OqF0i+xa19nzbmnC940Y34yZeI/UE+PYaO2+asapvOfu/sboBH +Yb5BuWXVEkSeRWI23SpuZbmfNTtVgiRoRqOvqM4G88LkhYjZ6xpDggxQwJiShiiD +oWCucs0v3pX8H8/LbGs8l50SGI5nzUqAdZ7/QQucU/GuDiQtampntkLEDgf9KIw/ +SDrtCw1E9fnCWj4Z71IYfepY9bVY6QUEcfTdnDcYSY1Z5tVpzeMHVLeo0lbNVZv9 +2qmPnjjP/IvWbjjwu/PHpUWkUs0BAoHBAPx4YwPXWYgWnesMKXkjAHyO5KA4EyBr ++rcEmOZkZDibC8PKYzIK2ztptuthahVovW20R/QJhJkO5teGZMeGPFq+floCeC5P +la9CEYGYcTrzgSe1QM9IGMr1vGI1KIWck7VkJ0bkKoY40uIJSVZxnyG9pEpcwYSp +tnOqA/f5YZUFctWvXUz46OfiLKstXLrcrGIU7YRmLv2rW9twnpJYTzE98g3KpVJ2 +TI1pyvrDTdGeAQUTGCAjpviY6XR5d020vQKBwQDi76wsGLQ3XLI+OAE95Ljo0Mcl ++KdJPVVQPq/VcjKgZQndFloflMRrmgNHme9gmsHOrf8DLZvEDbtT+gbmWslMFZQ9 +om1kR404gfuGmfIYdBdOwWjuBLsZs3pfqDB4Xa3NkxljwOMYTp035n0r2UMFaSy3 +gvpW7fsdPOGAJsqNhSw/JNHcokHeBm7VbV0aD7tSyIghmARb5c98fmrSPbiEo8mP +ITIZlgbfZCq2KuXY4q16R3QvlpuSwitVobLR/3kCgcEAueH5JM7dQHFGe9RMhL/c +j9i1Q7GFg4183lsoKBkqIPMmylSsjB+qIihHYS4r6O9g6PCfOXH4iqiKFY0BjlWr +AjTW2naO/aniz1KZiQ0v8PNv2Eh/Gx4+AtDCjpwM5bLOnfLLaEp9dK1JttqXgGnP +fAwgdg+s+3votWgr29tkmU+VqPagfxeUg4Xm1XFkoL/wu5Yk+iIx3trXms1kMuOK +CvtMyBK3fetTmZqWs+Iv3XGz1oSkcqVNPiN3XyY/TJsRAoG/Q17jvjOXTNg4EkCO +HdHJE1Tnyl4HS7bpnOj/Sl6cqQFV7Ey2dKm1pjwSvS714bgP0UvWaRshIxLwif2w +DrLlD7FYUPPnhd24Dw6HnW4WcSwFv1uryv2cjgS6T6ueuB0Xe/AvmW2p/Y1ZHz9N +6baWLwUKQXCg4S3FXui0CVd6yoi+mgBUTSveYguG29WbziDde7YMs+xtXtravhrJ +m6C3Jql5LQSt2uqvH6KdC3ewxLKGzcZot7f+d5MtSj6216ECgcEA9PGmWeUkhVuW +Xz2c9iBeHwCtmDso7gVwxNnHqdqirB4f1nDCGbrJS7hz5Ss7/wfzekP2W5if2P6U +JPUdfykAQgALNn1twAtj1a+UAp31ZWu8JK/Qzt4hLJPBxzMo7MenJq189JmYmDnm +6D5d9vDLCW15gCZua89GZa8K8V50lYyeHBOHAyzNTfNlnMBkHyP645+nqpuEWzIT +3mCe2OAbl60o8VvvVUlAQyQ/ObLq37HHEoDu0U/YAnP157cxpa84 +-----END RSA PRIVATE KEY----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/rsa.pub b/crypto/openssh/regress/unittests/sshsig/testdata/rsa.pub new file mode 100644 index 000000000000..30142ac0aee3 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/rsa.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDfzqWaNEe0mnKPzsGtL6ywya29z/VI83SBdM+z2NnWFgCr3w9xrf9FhUzgdpK7oI7O1AnZmdkPdN79d4GchTaZ+69ASX4OLCKwZ42CVXJEKLvvzt88UV9zHNl8NrsQHapjxLehpIZkrxCrO4bCYYAiaOVBfPon4cJ394P/nwagJJKKsgQIVYIC3642s4L8SaADOxt9x9ohttXMDjS2WBTeE7YnjaR13PwKKwNO0MpAAEVw5pBnJxJ+fscM/5aBctdcFQj3BUzVOJ/V/70xfTzEiy8K8bOjvIuBttMUtIavlKQD606ti6gDtXx+B7SJ3/emdW0bVSLcju96N4DB/Qdmq0V4ESc7CQgkWZl4y0V45V/7iSLiHWsOoC9Kxw28y0uno5elsABMBMC4RYSQhAGXWueCcR7SIL2JT2K0oxbqongW0hvgAIfUShTXHy+qsV5yDaG+p+TkJkEkhtXbwkW4aNpzc7EFnXsWpvyWOiZSKvUasRPbPro0yBvlOMMPsFU= RSA test diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/rsa.sig b/crypto/openssh/regress/unittests/sshsig/testdata/rsa.sig new file mode 100644 index 000000000000..15a032e0100b --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/rsa.sig @@ -0,0 +1,19 @@ +-----BEGIN SSH SIGNATURE----- +U1NIU0lHAAAAAQAAAZcAAAAHc3NoLXJzYQAAAAMBAAEAAAGBAN/OpZo0R7Saco/Owa0vrL +DJrb3P9UjzdIF0z7PY2dYWAKvfD3Gt/0WFTOB2krugjs7UCdmZ2Q903v13gZyFNpn7r0BJ +fg4sIrBnjYJVckQou+/O3zxRX3Mc2Xw2uxAdqmPEt6GkhmSvEKs7hsJhgCJo5UF8+ifhwn +f3g/+fBqAkkoqyBAhVggLfrjazgvxJoAM7G33H2iG21cwONLZYFN4TtieNpHXc/AorA07Q +ykAARXDmkGcnEn5+xwz/loFy11wVCPcFTNU4n9X/vTF9PMSLLwrxs6O8i4G20xS0hq+UpA +PrTq2LqAO1fH4HtInf96Z1bRtVItyO73o3gMH9B2arRXgRJzsJCCRZmXjLRXjlX/uJIuId +aw6gL0rHDbzLS6ejl6WwAEwEwLhFhJCEAZda54JxHtIgvYlPYrSjFuqieBbSG+AAh9RKFN +cfL6qxXnINob6n5OQmQSSG1dvCRbho2nNzsQWdexam/JY6JlIq9RqxE9s+ujTIG+U4ww+w +VQAAAAh1bml0dGVzdAAAAAAAAAAGc2hhNTEyAAABlAAAAAxyc2Etc2hhMi01MTIAAAGACi +nEpBrQxZi0yOrrT6h98JFfZh0XXioih4fzmvtoV0yOReWClS+otGgXoJyZHcbaKNOjDwSM +rIkUoX6OUJmtHYP0HRELnKw35m33LdBPXpFGS4tRS7NeSpvc04KtjT6jYXY9FjWy5hcn17 +Sxc/3DnJqLgJBur8acY7FeIzpWmKixPd/dGkEjdWoD9gO6szLczGuQgrOdYmSRL4yKadTJ +lVjz5OSeKSYYGQy33US2XQassRRNYf4e9byTA3DKvHa/OcTt7lFerea0kZdDpAboqffz7T +Yaw/hFskAYLIEdTW3aoXBGHSOvu8AkDOtb7qwuxGSQ27pjkDLDNsp1ceCFaCaQ6X83RZuK +ACv9JUBI5KaSf81e0bs0KezJKkhB9czeZ6dk96qISbgayEBnvhYgXvUDKtHn7HzNlCJKfK +5ABhNxfGG2CD+NKqcrndwFgS1sQO3hbA84zPQb26ShBovT8ytHBmW1F8ZK4O9Bz61Q6EZK +vs/u6xP6LUean/so5daa +-----END SSH SIGNATURE----- diff --git a/crypto/openssh/regress/unittests/sshsig/testdata/signed-data b/crypto/openssh/regress/unittests/sshsig/testdata/signed-data new file mode 100644 index 000000000000..7df4bedd135c --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/testdata/signed-data @@ -0,0 +1 @@ +This is a test, this is only a test
\ No newline at end of file diff --git a/crypto/openssh/regress/unittests/sshsig/tests.c b/crypto/openssh/regress/unittests/sshsig/tests.c new file mode 100644 index 000000000000..80966bdd2c27 --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/tests.c @@ -0,0 +1,144 @@ +/* $OpenBSD: tests.c,v 1.4 2024/01/11 01:45:59 djm Exp $ */ +/* + * Regress test for sshbuf.h buffer API + * + * Placed in the public domain + */ + +#include "includes.h" + +#include <sys/types.h> +#include <sys/stat.h> +#include <fcntl.h> +#include <stdio.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#ifdef WITH_OPENSSL +#include <openssl/evp.h> +#include <openssl/crypto.h> +#endif + +#include "ssherr.h" +#include "authfile.h" +#include "sshkey.h" +#include "sshbuf.h" +#include "sshsig.h" +#include "log.h" + +#include "../test_helper/test_helper.h" + +static struct sshbuf * +load_file(const char *name) +{ + struct sshbuf *ret = NULL; + + ASSERT_INT_EQ(sshbuf_load_file(test_data_file(name), &ret), 0); + ASSERT_PTR_NE(ret, NULL); + return ret; +} + +static struct sshkey * +load_key(const char *name) +{ + struct sshkey *ret = NULL; + ASSERT_INT_EQ(sshkey_load_public(test_data_file(name), &ret, NULL), 0); + ASSERT_PTR_NE(ret, NULL); + return ret; +} + +static void +check_sig(const char *keyname, const char *signame, const struct sshbuf *msg, + const char *namespace) +{ + struct sshkey *k, *sign_key; + struct sshbuf *sig, *rawsig; + struct sshkey_sig_details *sig_details; + + k = load_key(keyname); + sig = load_file(signame); + sign_key = NULL; + sig_details = NULL; + rawsig = NULL; + ASSERT_INT_EQ(sshsig_dearmor(sig, &rawsig), 0); + ASSERT_INT_EQ(sshsig_verifyb(rawsig, msg, namespace, + &sign_key, &sig_details), 0); + ASSERT_INT_EQ(sshkey_equal(k, sign_key), 1); + sshkey_free(k); + sshkey_free(sign_key); + sshkey_sig_details_free(sig_details); + sshbuf_free(sig); + sshbuf_free(rawsig); +} + +void +tests(void) +{ + struct sshbuf *msg; + char *namespace; + +#if 0 + log_init("test_sshsig", SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 1); +#endif + +#ifdef WITH_OPENSSL + OpenSSL_add_all_algorithms(); + ERR_load_crypto_strings(); +#endif + + TEST_START("load data"); + msg = load_file("namespace"); + namespace = sshbuf_dup_string(msg); + ASSERT_PTR_NE(namespace, NULL); + sshbuf_free(msg); + msg = load_file("signed-data"); + TEST_DONE(); + +#ifdef WITH_OPENSSL + TEST_START("check RSA signature"); + check_sig("rsa.pub", "rsa.sig", msg, namespace); + TEST_DONE(); + +#ifdef WITH_DSA + TEST_START("check DSA signature"); + check_sig("dsa.pub", "dsa.sig", msg, namespace); + TEST_DONE(); +#endif + +#ifdef OPENSSL_HAS_ECC + TEST_START("check ECDSA signature"); + check_sig("ecdsa.pub", "ecdsa.sig", msg, namespace); + TEST_DONE(); +#endif +#endif + + TEST_START("check ED25519 signature"); + check_sig("ed25519.pub", "ed25519.sig", msg, namespace); + TEST_DONE(); + +#ifdef ENABLE_SK +#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) + TEST_START("check ECDSA-SK signature"); + check_sig("ecdsa_sk.pub", "ecdsa_sk.sig", msg, namespace); + TEST_DONE(); +#endif + + TEST_START("check ED25519-SK signature"); + check_sig("ed25519_sk.pub", "ed25519_sk.sig", msg, namespace); + TEST_DONE(); + +#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) + TEST_START("check ECDSA-SK webauthn signature"); + check_sig("ecdsa_sk_webauthn.pub", "ecdsa_sk_webauthn.sig", + msg, namespace); + TEST_DONE(); +#endif +#endif /* ENABLE_SK */ + + sshbuf_free(msg); + free(namespace); +} diff --git a/crypto/openssh/regress/unittests/sshsig/webauthn.html b/crypto/openssh/regress/unittests/sshsig/webauthn.html new file mode 100644 index 000000000000..5c9a32e9e47f --- /dev/null +++ b/crypto/openssh/regress/unittests/sshsig/webauthn.html @@ -0,0 +1,766 @@ +<html> +<head> +<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> +<title>webauthn test</title> +</head> +<body onload="init()"> +<h1>webauthn test</h1> +<p> +This is a demo/test page for generating FIDO keys and signatures in SSH +formats. The page initially displays a form to generate a FIDO key and +convert it to a SSH public key. +</p> +<p> +Once a key has been generated, an additional form will be displayed to +allow signing of data using the just-generated key. The data may be signed +as either a raw SSH signature or wrapped in a sshsig message (the latter is +easier to test using command-line tools. +</p> +<p> +Lots of debugging is printed along the way. +</p> +<h2>Enroll</h2> +<span id="error" style="color: #800; font-weight: bold; font-size: 150%;"></span> +<form id="enrollform"> +<table> +<tr> +<td><b>Username:</b></td> +<td><input id="username" type="text" size="20" name="user" value="test" /></td> +</tr> +<tr><td></td><td><input id="assertsubmit" type="submit" value="submit" /></td></tr> +</table> +</form> +<span id="enrollresult" style="visibility: hidden;"> +<h2>clientData</h2> +<pre id="enrollresultjson" style="color: #008; font-family: monospace;"></pre> +<h2>attestationObject raw</h2> +<pre id="enrollresultraw" style="color: #008; font-family: monospace;"></pre> +<h2>attestationObject</h2> +<pre id="enrollresultattestobj" style="color: #008; font-family: monospace;"></pre> +<h2>key handle</h2> +<pre id="keyhandle" style="color: #008; font-family: monospace;"></pre> +<h2>authData raw</h2> +<pre id="enrollresultauthdataraw" style="color: #008; font-family: monospace;"></pre> +<h2>authData</h2> +<pre id="enrollresultauthdata" style="color: #008; font-family: monospace;"></pre> +<h2>SSH pubkey blob</h2> +<pre id="enrollresultpkblob" style="color: #008; font-family: monospace;"></pre> +<h2>SSH pubkey string</h2> +<pre id="enrollresultpk" style="color: #008; font-family: monospace;"></pre> +<h2>SSH private key string</h2> +<pre id="enrollresultprivkey" style="color: #008; font-family: monospace;"></pre> +</span> +<span id="assertsection" style="visibility: hidden;"> +<h2>Assert</h2> +<form id="assertform"> +<span id="asserterror" style="color: #800; font-weight: bold;"></span> +<table> +<tr> +<td><b>Data to sign:</b></td> +<td><input id="message" type="text" size="20" name="message" value="test" /></td> +</tr> +<tr> +<td><input id="message_sshsig" type="checkbox" checked /> use sshsig format</td> +</tr> +<tr> +<td><b>Signature namespace:</b></td> +<td><input id="message_namespace" type="text" size="20" name="namespace" value="test" /></td> +</tr> +<tr><td></td><td><input type="submit" value="submit" /></td></tr> +</table> +</form> +</span> +<span id="assertresult" style="visibility: hidden;"> +<h2>clientData</h2> +<pre id="assertresultjson" style="color: #008; font-family: monospace;"></pre> +<h2>signature raw</h2> +<pre id="assertresultsigraw" style="color: #008; font-family: monospace;"></pre> +<h2>authenticatorData raw</h2> +<pre id="assertresultauthdataraw" style="color: #008; font-family: monospace;"></pre> +<h2>authenticatorData</h2> +<pre id="assertresultauthdata" style="color: #008; font-family: monospace;"></pre> +<h2>signature in SSH format</h2> +<pre id="assertresultsshsigraw" style="color: #008; font-family: monospace;"></pre> +<h2>signature in SSH format (base64 encoded)</h2> +<pre id="assertresultsshsigb64" style="color: #008; font-family: monospace;"></pre> +</span> +</body> +<script> +// ------------------------------------------------------------------ +// a crappy CBOR decoder - 20200401 djm@openbsd.org + +var CBORDecode = function(buffer) { + this.buf = buffer + this.v = new DataView(buffer) + this.offset = 0 +} + +CBORDecode.prototype.empty = function() { + return this.offset >= this.buf.byteLength +} + +CBORDecode.prototype.getU8 = function() { + let r = this.v.getUint8(this.offset) + this.offset += 1 + return r +} + +CBORDecode.prototype.getU16 = function() { + let r = this.v.getUint16(this.offset) + this.offset += 2 + return r +} + +CBORDecode.prototype.getU32 = function() { + let r = this.v.getUint32(this.offset) + this.offset += 4 + return r +} + +CBORDecode.prototype.getU64 = function() { + let r = this.v.getUint64(this.offset) + this.offset += 8 + return r +} + +CBORDecode.prototype.getCBORTypeLen = function() { + let tl, t, l + tl = this.getU8() + t = (tl & 0xe0) >> 5 + l = tl & 0x1f + return [t, this.decodeInteger(l)] +} + +CBORDecode.prototype.decodeInteger = function(len) { + switch (len) { + case 0x18: return this.getU8() + case 0x19: return this.getU16() + case 0x20: return this.getU32() + case 0x21: return this.getU64() + default: + if (len <= 23) { + return len + } + throw new Error("Unsupported int type 0x" + len.toString(16)) + } +} + +CBORDecode.prototype.decodeNegint = function(len) { + let r = -(this.decodeInteger(len) + 1) + return r +} + +CBORDecode.prototype.decodeByteString = function(len) { + let r = this.buf.slice(this.offset, this.offset + len) + this.offset += len + return r +} + +CBORDecode.prototype.decodeTextString = function(len) { + let u8dec = new TextDecoder('utf-8') + r = u8dec.decode(this.decodeByteString(len)) + return r +} + +CBORDecode.prototype.decodeArray = function(len, level) { + let r = [] + for (let i = 0; i < len; i++) { + let v = this.decodeInternal(level) + r.push(v) + // console.log("decodeArray level " + level.toString() + " index " + i.toString() + " value " + JSON.stringify(v)) + } + return r +} + +CBORDecode.prototype.decodeMap = function(len, level) { + let r = {} + for (let i = 0; i < len; i++) { + let k = this.decodeInternal(level) + let v = this.decodeInternal(level) + r[k] = v + // console.log("decodeMap level " + level.toString() + " key " + k.toString() + " value " + JSON.stringify(v)) + // XXX check string keys, duplicates + } + return r +} + +CBORDecode.prototype.decodePrimitive = function(t) { + switch (t) { + case 20: return false + case 21: return true + case 22: return null + case 23: return undefined + default: + throw new Error("Unsupported primitive 0x" + t.toString(2)) + } +} + +CBORDecode.prototype.decodeInternal = function(level) { + if (level > 256) { + throw new Error("CBOR nesting too deep") + } + let t, l, r + [t, l] = this.getCBORTypeLen() + // console.log("decode level " + level.toString() + " type " + t.toString() + " len " + l.toString()) + switch (t) { + case 0: + r = this.decodeInteger(l) + break + case 1: + r = this.decodeNegint(l) + break + case 2: + r = this.decodeByteString(l) + break + case 3: + r = this.decodeTextString(l) + break + case 4: + r = this.decodeArray(l, level + 1) + break + case 5: + r = this.decodeMap(l, level + 1) + break + case 6: + console.log("XXX ignored semantic tag " + this.decodeInteger(l).toString()) + break; + case 7: + r = this.decodePrimitive(l) + break + default: + throw new Error("Unsupported type 0x" + t.toString(2) + " len " + l.toString()) + } + // console.log("decode level " + level.toString() + " value " + JSON.stringify(r)) + return r +} + +CBORDecode.prototype.decode = function() { + return this.decodeInternal(0) +} + +// ------------------------------------------------------------------ +// a crappy SSH message packer - 20200401 djm@openbsd.org + +var SSHMSG = function() { + this.r = [] +} + +SSHMSG.prototype.length = function() { + let len = 0 + for (buf of this.r) { + len += buf.length + } + return len +} + +SSHMSG.prototype.serialise = function() { + let r = new ArrayBuffer(this.length()) + let v = new Uint8Array(r) + let offset = 0 + for (buf of this.r) { + v.set(buf, offset) + offset += buf.length + } + if (offset != r.byteLength) { + throw new Error("djm can't count") + } + return r +} + +SSHMSG.prototype.serialiseBase64 = function(v) { + let b = this.serialise() + return btoa(String.fromCharCode(...new Uint8Array(b))); +} + +SSHMSG.prototype.putU8 = function(v) { + this.r.push(new Uint8Array([v])) +} + +SSHMSG.prototype.putU32 = function(v) { + this.r.push(new Uint8Array([ + (v >> 24) & 0xff, + (v >> 16) & 0xff, + (v >> 8) & 0xff, + (v & 0xff) + ])) +} + +SSHMSG.prototype.put = function(v) { + this.r.push(new Uint8Array(v)) +} + +SSHMSG.prototype.putStringRaw = function(v) { + let enc = new TextEncoder(); + let venc = enc.encode(v) + this.put(venc) +} + +SSHMSG.prototype.putString = function(v) { + let enc = new TextEncoder(); + let venc = enc.encode(v) + this.putU32(venc.length) + this.put(venc) +} + +SSHMSG.prototype.putSSHMSG = function(v) { + let msg = v.serialise() + this.putU32(msg.byteLength) + this.put(msg) +} + +SSHMSG.prototype.putBytes = function(v) { + this.putU32(v.byteLength) + this.put(v) +} + +SSHMSG.prototype.putECPoint = function(x, y) { + let x8 = new Uint8Array(x) + let y8 = new Uint8Array(y) + this.putU32(1 + x8.length + y8.length) + this.putU8(0x04) // Uncompressed point format. + this.put(x8) + this.put(y8) +} + +// ------------------------------------------------------------------ +// webauthn to SSH glue - djm@openbsd.org 20200408 + +function error(msg, ...args) { + document.getElementById("error").innerText = msg + console.log(msg) + for (const arg of args) { + console.dir(arg) + } +} +function hexdump(buf) { + const hex = Array.from(new Uint8Array(buf)).map( + b => b.toString(16).padStart(2, "0")) + const fmt = new Array() + for (let i = 0; i < hex.length; i++) { + if ((i % 16) == 0) { + // Prepend length every 16 bytes. + fmt.push(i.toString(16).padStart(4, "0")) + fmt.push(" ") + } + fmt.push(hex[i]) + fmt.push(" ") + if ((i % 16) == 15) { + fmt.push("\n") + } + } + return fmt.join("") +} +function enrollform_submit(event) { + event.preventDefault(); + console.log("submitted") + username = event.target.elements.username.value + if (username === "") { + error("no username specified") + return false + } + enrollStart(username) +} +function enrollStart(username) { + let challenge = new Uint8Array(32) + window.crypto.getRandomValues(challenge) + let userid = new Uint8Array(8) + window.crypto.getRandomValues(userid) + + console.log("challenge:" + btoa(challenge)) + console.log("userid:" + btoa(userid)) + + let pkopts = { + challenge: challenge, + rp: { + name: window.location.host, + id: window.location.host, + }, + user: { + id: userid, + name: username, + displayName: username, + }, + authenticatorSelection: { + authenticatorAttachment: "cross-platform", + userVerification: "discouraged", + }, + pubKeyCredParams: [{alg: -7, type: "public-key"}], // ES256 + timeout: 30 * 1000, + }; + console.dir(pkopts) + window.enrollOpts = pkopts + let credpromise = navigator.credentials.create({ publicKey: pkopts }); + credpromise.then(enrollSuccess, enrollFailure) +} +function enrollFailure(result) { + error("Enroll failed", result) +} +function enrollSuccess(result) { + console.log("Enroll succeeded") + console.dir(result) + window.enrollResult = result + document.getElementById("enrollresult").style.visibility = "visible" + + // Show the clientData + let u8dec = new TextDecoder('utf-8') + clientData = u8dec.decode(result.response.clientDataJSON) + document.getElementById("enrollresultjson").innerText = clientData + + // Show the raw key handle. + document.getElementById("keyhandle").innerText = hexdump(result.rawId) + + // Decode and show the attestationObject + document.getElementById("enrollresultraw").innerText = hexdump(result.response.attestationObject) + let aod = new CBORDecode(result.response.attestationObject) + let attestationObject = aod.decode() + console.log("attestationObject") + console.dir(attestationObject) + document.getElementById("enrollresultattestobj").innerText = JSON.stringify(attestationObject) + + // Decode and show the authData + document.getElementById("enrollresultauthdataraw").innerText = hexdump(attestationObject.authData) + let authData = decodeAuthenticatorData(attestationObject.authData, true) + console.log("authData") + console.dir(authData) + window.enrollAuthData = authData + document.getElementById("enrollresultauthdata").innerText = JSON.stringify(authData) + + // Reformat the pubkey as a SSH key for easy verification + window.rawKey = reformatPubkey(authData.attestedCredentialData.credentialPublicKey, window.enrollOpts.rp.id) + console.log("SSH pubkey blob") + console.dir(window.rawKey) + document.getElementById("enrollresultpkblob").innerText = hexdump(window.rawKey) + let pk64 = btoa(String.fromCharCode(...new Uint8Array(window.rawKey))); + let pk = "sk-ecdsa-sha2-nistp256@openssh.com " + pk64 + document.getElementById("enrollresultpk").innerText = pk + + // Format a private key too. + flags = 0x01 // SSH_SK_USER_PRESENCE_REQD + window.rawPrivkey = reformatPrivkey(authData.attestedCredentialData.credentialPublicKey, window.enrollOpts.rp.id, result.rawId, flags) + let privkeyFileBlob = privkeyFile(window.rawKey, window.rawPrivkey, window.enrollOpts.user.name, window.enrollOpts.rp.id) + let privk64 = btoa(String.fromCharCode(...new Uint8Array(privkeyFileBlob))); + let privkey = "-----BEGIN OPENSSH PRIVATE KEY-----\n" + wrapString(privk64, 70) + "-----END OPENSSH PRIVATE KEY-----\n" + document.getElementById("enrollresultprivkey").innerText = privkey + + // Success: show the assertion form. + document.getElementById("assertsection").style.visibility = "visible" +} + +function decodeAuthenticatorData(authData, expectCred) { + let r = new Object() + let v = new DataView(authData) + + r.rpIdHash = authData.slice(0, 32) + r.flags = v.getUint8(32) + r.signCount = v.getUint32(33) + + // Decode attestedCredentialData if present. + let offset = 37 + let acd = new Object() + if (expectCred) { + acd.aaguid = authData.slice(offset, offset+16) + offset += 16 + let credentialIdLength = v.getUint16(offset) + offset += 2 + acd.credentialIdLength = credentialIdLength + acd.credentialId = authData.slice(offset, offset+credentialIdLength) + offset += credentialIdLength + r.attestedCredentialData = acd + } + console.log("XXXXX " + offset.toString()) + let pubkeyrest = authData.slice(offset, authData.byteLength) + let pkdecode = new CBORDecode(pubkeyrest) + if (expectCred) { + // XXX unsafe: doesn't mandate COSE canonical format. + acd.credentialPublicKey = pkdecode.decode() + } + if (!pkdecode.empty()) { + // Decode extensions if present. + r.extensions = pkdecode.decode() + } + return r +} + +function wrapString(s, l) { + ret = "" + for (i = 0; i < s.length; i += l) { + ret += s.slice(i, i + l) + "\n" + } + return ret +} + +function checkPubkey(pk) { + // pk is in COSE format. We only care about a tiny subset. + if (pk[1] != 2) { + console.dir(pk) + throw new Error("pubkey is not EC") + } + if (pk[-1] != 1) { + throw new Error("pubkey is not in P256") + } + if (pk[3] != -7) { + throw new Error("pubkey is not ES256") + } + if (pk[-2].byteLength != 32 || pk[-3].byteLength != 32) { + throw new Error("pubkey EC coords have bad length") + } +} + +function reformatPubkey(pk, rpid) { + checkPubkey(pk) + let msg = new SSHMSG() + msg.putString("sk-ecdsa-sha2-nistp256@openssh.com") // Key type + msg.putString("nistp256") // Key curve + msg.putECPoint(pk[-2], pk[-3]) // EC key + msg.putString(rpid) // RP ID + return msg.serialise() +} + +function reformatPrivkey(pk, rpid, kh, flags) { + checkPubkey(pk) + let msg = new SSHMSG() + msg.putString("sk-ecdsa-sha2-nistp256@openssh.com") // Key type + msg.putString("nistp256") // Key curve + msg.putECPoint(pk[-2], pk[-3]) // EC key + msg.putString(rpid) // RP ID + msg.putU8(flags) // flags + msg.putBytes(kh) // handle + msg.putString("") // reserved + return msg.serialise() +} + +function privkeyFile(pub, priv, user, rp) { + let innerMsg = new SSHMSG() + innerMsg.putU32(0xdeadbeef) // check byte + innerMsg.putU32(0xdeadbeef) // check byte + innerMsg.put(priv) // privkey + innerMsg.putString("webauthn.html " + user + "@" + rp) // comment + // Pad to cipher blocksize (8). + p = 1 + while (innerMsg.length() % 8 != 0) { + innerMsg.putU8(p++) + } + let msg = new SSHMSG() + msg.putStringRaw("openssh-key-v1") // Magic + msg.putU8(0) // \0 terminate + msg.putString("none") // cipher + msg.putString("none") // KDF + msg.putString("") // KDF options + msg.putU32(1) // nkeys + msg.putBytes(pub) // pubkey + msg.putSSHMSG(innerMsg) // inner + //msg.put(innerMsg.serialise()) // inner + return msg.serialise() +} + +async function assertform_submit(event) { + event.preventDefault(); + console.log("submitted") + message = event.target.elements.message.value + if (message === "") { + error("no message specified") + return false + } + let enc = new TextEncoder() + let encmsg = enc.encode(message) + window.assertSignRaw = !event.target.elements.message_sshsig.checked + console.log("using sshsig ", !window.assertSignRaw) + if (window.assertSignRaw) { + assertStart(encmsg) + return + } + // Format a sshsig-style message. + window.sigHashAlg = "sha512" + let msghash = await crypto.subtle.digest("SHA-512", encmsg); + console.log("raw message hash") + console.dir(msghash) + window.sigNamespace = event.target.elements.message_namespace.value + let sigbuf = new SSHMSG() + sigbuf.put(enc.encode("SSHSIG")) + sigbuf.putString(window.sigNamespace) + sigbuf.putU32(0) // Reserved string + sigbuf.putString(window.sigHashAlg) + sigbuf.putBytes(msghash) + let msg = sigbuf.serialise() + console.log("sigbuf") + console.dir(msg) + assertStart(msg) +} + +function assertStart(message) { + let assertReqOpts = { + challenge: message, + rpId: window.location.host, + allowCredentials: [{ + type: 'public-key', + id: window.enrollResult.rawId, + }], + userVerification: "discouraged", + timeout: (30 * 1000), + } + console.log("assertReqOpts") + console.dir(assertReqOpts) + window.assertReqOpts = assertReqOpts + let assertpromise = navigator.credentials.get({ + publicKey: assertReqOpts + }); + assertpromise.then(assertSuccess, assertFailure) +} +function assertFailure(result) { + error("Assertion failed", result) +} +function linewrap(s) { + const linelen = 70 + let ret = "" + for (let i = 0; i < s.length; i += linelen) { + end = i + linelen + if (end > s.length) { + end = s.length + } + if (i > 0) { + ret += "\n" + } + ret += s.slice(i, end) + } + return ret + "\n" +} +function assertSuccess(result) { + console.log("Assertion succeeded") + console.dir(result) + window.assertResult = result + document.getElementById("assertresult").style.visibility = "visible" + + // show the clientData. + let u8dec = new TextDecoder('utf-8') + clientData = u8dec.decode(result.response.clientDataJSON) + document.getElementById("assertresultjson").innerText = clientData + + // show the signature. + document.getElementById("assertresultsigraw").innerText = hexdump(result.response.signature) + + // decode and show the authData. + document.getElementById("assertresultauthdataraw").innerText = hexdump(result.response.authenticatorData) + authData = decodeAuthenticatorData(result.response.authenticatorData, false) + document.getElementById("assertresultauthdata").innerText = JSON.stringify(authData) + + // Parse and reformat the signature to an SSH style signature. + let sshsig = reformatSignature(result.response.signature, clientData, authData) + document.getElementById("assertresultsshsigraw").innerText = hexdump(sshsig) + let sig64 = btoa(String.fromCharCode(...new Uint8Array(sshsig))); + if (window.assertSignRaw) { + document.getElementById("assertresultsshsigb64").innerText = sig64 + } else { + document.getElementById("assertresultsshsigb64").innerText = + "-----BEGIN SSH SIGNATURE-----\n" + linewrap(sig64) + + "-----END SSH SIGNATURE-----\n"; + } +} + +function reformatSignature(sig, clientData, authData) { + if (sig.byteLength < 2) { + throw new Error("signature is too short") + } + let offset = 0 + let v = new DataView(sig) + // Expect an ASN.1 SEQUENCE that exactly spans the signature. + if (v.getUint8(offset) != 0x30) { + throw new Error("signature not an ASN.1 sequence") + } + offset++ + let seqlen = v.getUint8(offset) + offset++ + if ((seqlen & 0x80) != 0 || seqlen != sig.byteLength - offset) { + throw new Error("signature has unexpected length " + seqlen.toString() + " vs expected " + (sig.byteLength - offset).toString()) + } + + // Parse 'r' INTEGER value. + if (v.getUint8(offset) != 0x02) { + throw new Error("signature r not an ASN.1 integer") + } + offset++ + let rlen = v.getUint8(offset) + offset++ + if ((rlen & 0x80) != 0 || rlen > sig.byteLength - offset) { + throw new Error("signature r has unexpected length " + rlen.toString() + " vs buffer " + (sig.byteLength - offset).toString()) + } + let r = sig.slice(offset, offset + rlen) + offset += rlen + console.log("sig_r") + console.dir(r) + + // Parse 's' INTEGER value. + if (v.getUint8(offset) != 0x02) { + throw new Error("signature r not an ASN.1 integer") + } + offset++ + let slen = v.getUint8(offset) + offset++ + if ((slen & 0x80) != 0 || slen > sig.byteLength - offset) { + throw new Error("signature s has unexpected length " + slen.toString() + " vs buffer " + (sig.byteLength - offset).toString()) + } + let s = sig.slice(offset, offset + slen) + console.log("sig_s") + console.dir(s) + offset += slen + + if (offset != sig.byteLength) { + throw new Error("unexpected final offset during signature parsing " + offset.toString() + " expected " + sig.byteLength.toString()) + } + + // Reformat as an SSH signature. + let clientDataParsed = JSON.parse(clientData) + let innersig = new SSHMSG() + innersig.putBytes(r) + innersig.putBytes(s) + + let rawsshsig = new SSHMSG() + rawsshsig.putString("webauthn-sk-ecdsa-sha2-nistp256@openssh.com") + rawsshsig.putSSHMSG(innersig) + rawsshsig.putU8(authData.flags) + rawsshsig.putU32(authData.signCount) + rawsshsig.putString(clientDataParsed.origin) + rawsshsig.putString(clientData) + if (authData.extensions == undefined) { + rawsshsig.putU32(0) + } else { + rawsshsig.putBytes(authData.extensions) + } + + if (window.assertSignRaw) { + return rawsshsig.serialise() + } + // Format as SSHSIG. + let enc = new TextEncoder() + let sshsig = new SSHMSG() + sshsig.put(enc.encode("SSHSIG")) + sshsig.putU32(0x01) // Signature version. + sshsig.putBytes(window.rawKey) + sshsig.putString(window.sigNamespace) + sshsig.putU32(0) // Reserved string + sshsig.putString(window.sigHashAlg) + sshsig.putBytes(rawsshsig.serialise()) + return sshsig.serialise() +} + +function toggleNamespaceVisibility() { + const assertsigtype = document.getElementById('message_sshsig'); + const assertsignamespace = document.getElementById('message_namespace'); + assertsignamespace.disabled = !assertsigtype.checked; +} + +function init() { + if (document.location.protocol != "https:") { + error("This page must be loaded via https") + const assertsubmit = document.getElementById('assertsubmit') + assertsubmit.disabled = true + } + const enrollform = document.getElementById('enrollform'); + enrollform.addEventListener('submit', enrollform_submit); + const assertform = document.getElementById('assertform'); + assertform.addEventListener('submit', assertform_submit); + const assertsigtype = document.getElementById('message_sshsig'); + assertsigtype.onclick = toggleNamespaceVisibility; +} +</script> + +</html> diff --git a/crypto/openssh/regress/unittests/test_helper/test_helper.c b/crypto/openssh/regress/unittests/test_helper/test_helper.c index 4cc70852c044..e23128aa5599 100644 --- a/crypto/openssh/regress/unittests/test_helper/test_helper.c +++ b/crypto/openssh/regress/unittests/test_helper/test_helper.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_helper.c,v 1.8 2018/02/08 08:46:20 djm Exp $ */ +/* $OpenBSD: test_helper.c,v 1.13 2021/12/14 21:25:27 deraadt Exp $ */ /* * Copyright (c) 2011 Damien Miller <djm@mindrot.org> * @@ -20,9 +20,9 @@ #include "includes.h" #include <sys/types.h> -#include <sys/param.h> #include <sys/uio.h> +#include <stdarg.h> #include <fcntl.h> #include <stdio.h> #ifdef HAVE_STDINT_H @@ -34,12 +34,18 @@ #include <unistd.h> #include <signal.h> +#ifdef WITH_OPENSSL #include <openssl/bn.h> +#include <openssl/err.h> +#endif #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS) # include <vis.h> #endif +#define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) + +#include "entropy.h" #include "test_helper.h" #include "atomicio.h" @@ -115,12 +121,19 @@ static test_onerror_func_t *test_onerror = NULL; static void *onerror_ctx = NULL; static const char *data_dir = NULL; static char subtest_info[512]; +static int fast = 0; +static int slow = 0; int main(int argc, char **argv) { int ch; + seed_rng(); +#ifdef WITH_OPENSSL + ERR_load_crypto_strings(); +#endif + /* Handle systems without __progname */ if (__progname == NULL) { __progname = strrchr(argv[0], '/'); @@ -134,8 +147,14 @@ main(int argc, char **argv) } } - while ((ch = getopt(argc, argv, "vqd:")) != -1) { + while ((ch = getopt(argc, argv, "Ffvqd:")) != -1) { switch (ch) { + case 'F': + slow = 1; + break; + case 'f': + fast = 1; + break; case 'd': data_dir = optarg; break; @@ -167,17 +186,29 @@ main(int argc, char **argv) } int -test_is_verbose() +test_is_verbose(void) { return verbose_mode; } int -test_is_quiet() +test_is_quiet(void) { return quiet_mode; } +int +test_is_fast(void) +{ + return fast; +} + +int +test_is_slow(void) +{ + return slow; +} + const char * test_data_file(const char *name) { @@ -262,6 +293,7 @@ test_subtest_info(const char *fmt, ...) void ssl_err_check(const char *file, int line) { +#ifdef WITH_OPENSSL long openssl_error = ERR_get_error(); if (openssl_error == 0) @@ -269,6 +301,10 @@ ssl_err_check(const char *file, int line) fprintf(stderr, "\n%s:%d: uncaught OpenSSL error: %s", file, line, ERR_error_string(openssl_error, NULL)); +#else /* WITH_OPENSSL */ + fprintf(stderr, "\n%s:%d: uncaught OpenSSL error ", + file, line); +#endif /* WITH_OPENSSL */ abort(); } @@ -313,6 +349,7 @@ test_header(const char *file, int line, const char *a1, const char *a2, a2 != NULL ? ", " : "", a2 != NULL ? a2 : ""); } +#ifdef WITH_OPENSSL void assert_bignum(const char *file, int line, const char *a1, const char *a2, const BIGNUM *aa1, const BIGNUM *aa2, enum test_predicate pred) @@ -325,6 +362,7 @@ assert_bignum(const char *file, int line, const char *a1, const char *a2, fprintf(stderr, "%12s = 0x%s\n", a2, BN_bn2hex(aa2)); test_die(); } +#endif void assert_string(const char *file, int line, const char *a1, const char *a2, @@ -366,6 +404,8 @@ assert_mem(const char *file, int line, const char *a1, const char *a2, const void *aa1, const void *aa2, size_t l, enum test_predicate pred) { int r; + char *aa1_tohex = NULL; + char *aa2_tohex = NULL; if (l == 0) return; @@ -376,8 +416,12 @@ assert_mem(const char *file, int line, const char *a1, const char *a2, r = memcmp(aa1, aa2, l); TEST_CHECK_INT(r, pred); test_header(file, line, a1, a2, "STRING", pred); - fprintf(stderr, "%12s = %s (len %zu)\n", a1, tohex(aa1, MIN(l, 256)), l); - fprintf(stderr, "%12s = %s (len %zu)\n", a2, tohex(aa2, MIN(l, 256)), l); + aa1_tohex = tohex(aa1, MINIMUM(l, 256)); + aa2_tohex = tohex(aa2, MINIMUM(l, 256)); + fprintf(stderr, "%12s = %s (len %zu)\n", a1, aa1_tohex, l); + fprintf(stderr, "%12s = %s (len %zu)\n", a2, aa2_tohex, l); + free(aa1_tohex); + free(aa2_tohex); test_die(); } @@ -402,6 +446,7 @@ assert_mem_filled(const char *file, int line, const char *a1, size_t where = -1; int r; char tmp[64]; + char *aa1_tohex = NULL; if (l == 0) return; @@ -411,8 +456,10 @@ assert_mem_filled(const char *file, int line, const char *a1, r = memvalcmp(aa1, v, l, &where); TEST_CHECK_INT(r, pred); test_header(file, line, a1, NULL, "MEM_ZERO", pred); + aa1_tohex = tohex(aa1, MINIMUM(l, 20)); fprintf(stderr, "%20s = %s%s (len %zu)\n", a1, - tohex(aa1, MIN(l, 20)), l > 20 ? "..." : "", l); + aa1_tohex, l > 20 ? "..." : "", l); + free(aa1_tohex); snprintf(tmp, sizeof(tmp), "(%s)[%zu]", a1, where); fprintf(stderr, "%20s = 0x%02x (expected 0x%02x)\n", tmp, ((u_char *)aa1)[where], v); diff --git a/crypto/openssh/regress/unittests/test_helper/test_helper.h b/crypto/openssh/regress/unittests/test_helper/test_helper.h index 6da0066e907a..66302201cec3 100644 --- a/crypto/openssh/regress/unittests/test_helper/test_helper.h +++ b/crypto/openssh/regress/unittests/test_helper/test_helper.h @@ -1,4 +1,4 @@ -/* $OpenBSD: test_helper.h,v 1.8 2018/02/08 08:46:20 djm Exp $ */ +/* $OpenBSD: test_helper.h,v 1.9 2018/10/17 23:28:05 djm Exp $ */ /* * Copyright (c) 2011 Damien Miller <djm@mindrot.org> * @@ -27,8 +27,10 @@ # include <stdint.h> #endif +#ifdef WITH_OPENSSL #include <openssl/bn.h> #include <openssl/err.h> +#endif enum test_predicate { TEST_EQ, TEST_NE, TEST_LT, TEST_LE, TEST_GT, TEST_GE @@ -45,12 +47,16 @@ void set_onerror_func(test_onerror_func_t *f, void *ctx); void test_done(void); int test_is_verbose(void); int test_is_quiet(void); +int test_is_fast(void); +int test_is_slow(void); void test_subtest_info(const char *fmt, ...) __attribute__((format(printf, 1, 2))); void ssl_err_check(const char *file, int line); +#ifdef WITH_OPENSSL void assert_bignum(const char *file, int line, const char *a1, const char *a2, const BIGNUM *aa1, const BIGNUM *aa2, enum test_predicate pred); +#endif void assert_string(const char *file, int line, const char *a1, const char *a2, const char *aa1, const char *aa2, enum test_predicate pred); diff --git a/crypto/openssh/regress/unittests/utf8/tests.c b/crypto/openssh/regress/unittests/utf8/tests.c index f0bbca5096f0..8cf524ddb210 100644 --- a/crypto/openssh/regress/unittests/utf8/tests.c +++ b/crypto/openssh/regress/unittests/utf8/tests.c @@ -9,7 +9,9 @@ #include "includes.h" #include <locale.h> +#include <stdarg.h> #include <string.h> +#include <stdio.h> #include "../test_helper/test_helper.h" |