aboutsummaryrefslogtreecommitdiff
path: root/tests/pkd
AgeCommit message (Collapse)AuthorFilesLines
2024-03-08Rework the coverage buildJakub Jelen1-1/+4
This reworks it to avoid a need to special build type and adding the flags only to the targets that need it (skipping testing wrappers which break with them). It also updates the CodeCoverage module from the following URL: https://github.com/bilke/cmake-modules/blob/master/CodeCoverage.cmake Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2024-02-22cmake: use imported targets for OpenSSL and zlibGregor Jasny1-1/+0
Imported targets are highly preferred over the individual variables for includes and libs because they will be used in a coherent way and any spelling mistakes or unavailability won't go unnoticed. Also it will prevent bugs like conan-io/conan-center-index#16900 or using mismatching header/libs combinations. Signed-off-by: Gregor Jasny <gjasny@googlemail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2024-02-13tests:pkd: Add missing includes for cmockaAndreas Schneider2-0/+2
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-06-26Deprecate SSH_BIND_OPTIONS_{RSA,ECDSA}KEY in favor of generic HOSTKEYJakub Jelen1-5/+3
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-06-01Remove remained HAVE_DSA ifdefs and WITH_DSANorbert Pocs1-26/+0
Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-06-01pkd_hello: Run chacha20 tests on dropbear tooNorbert Pocs1-8/+17
Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-02-02Remove support for DSA KeysMohammad Shehar Yaar Tausif5-212/+1
Solving issue #110. The original work is at !231 Some changes were needed because the newly added features in master through time Signed-off-by: Mohammad Shehar Yaar Tausif <sheharyaar48@gmail.com> Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-11-22tests/pkd: adjust usage of argv stringsJon Simons2-6/+8
Adjust some subtle usage of argv string handling in the pkd test options: rather than conditionally overwrite the two mkdtemp strings with a newly-allocated buffer to be later freed, keep the original const argv pointer around in its own dedicated field. See also these changes in the same area that were due to the previous arrangement, which was a bit too subtle: - 61ce3310b864802a101cb01ff103f0bc2da936e6 - e1a8b359c181508d973da681b1c698db7a6dbd20 Addresses: - https://gitlab.com/libssh/libssh-mirror/-/merge_requests/320#note_1173911211 Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-11-22tests/pkd/pkd_hello.c: change fprintf indentationJon Simons1-3/+3
Although previously consistent with itself, change the fprintf indentation to bring second lines "to the left" to line up with the first fprintf argument instead of formatter string. Addresses: - https://gitlab.com/libssh/libssh-mirror/-/merge_requests/320#note_1173911235 Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-11-22tests/pkd: use -L in CMakeLists.txtJon Simons1-2/+2
Use the new `-L` flag for the pkd tests so that they use a unique temporary directory for scratch space while running. Note the choice of `pkd_scratch_XXXXXX` in contrast to a path living under `/tmp`: by using a relative path, one can gather the full set of log artifacts from the GitLab CI jobs in the event that there is a test failure. The logs contain lots of information to help pinpoint what went wrong. Resolves https://gitlab.com/libssh/libssh-mirror/-/issues/143. Testing notes: - In the GitLab CI jobs I can see the flag being used, and can observe that I am able to gather the full set of detailed `pkd` logs in the event of a legitimate test failure. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-11-22tests/pkd: support -L, --temp-dir=<mkdtemp-template>Jon Simons2-4/+101
Teach `pkd` a new flag `-L, --temp-dir=<mkdtemp-template>` to enable behavior whereby `pkd` creates a new temporary directory and uses it for a workspace while running. The original design of `pkd` assumed that it could freely use the current working directory from wherever it happened to be invoked. But, this could pose a problem when multiple `pkd` instances are run in parallel from the same working directory, due to the usage of various temporary files within that directory. To avoid the problem of multiple `pkd` instances interfering with each other, expose a `-L` flag for optionally specifying a `mkdtemp` template string such that a temporary scratch space is used instead. Testing notes: - I ran handfuls of iterations locally using the new flag and observed `pkd` is indeed using scratch space as desired. Resolves https://gitlab.com/libssh/libssh-mirror/-/issues/143. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-11-22tests/pkd: relax pthread_kill assert in `pkd_stop`Jon Simons1-1/+2
Relax the `pthread_kill` result assertion in `pkd_stop` to tolerate `ESRCH`, and guard against only `EINVAL` and `ENOTSUP`. On macOS what can happen is that the `pthread_kill` returns `ESRCH` due to the accept thread being already terminated. For that case, the teardown path should proceed to `pthread_join`. Testing notes: - On my macOS setup I consistently encountered `ESRCH` in this codepath, causing pkd tests to fail unnecessarily. With the change, I observe the tests passing. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-11-22tests/pkd: free socket wrapper string upon errorJon Simons1-3/+3
In e1a8b359c181508d973da681b1c698db7a6dbd20 a missing `free` was added to `pkd_cleanup_socket_wrapper` to free a string allocated for the socket wrapper directory name. Move that `free` such that it also runs in the error-out paths in `pkd_cleanup_socket_wrapper`, to avoid a leak in those cases, too. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-10-12examples: Fix build issue with new clang 15Jakub Jelen1-12/+12
The error was the following /builds/libssh/libssh-mirror/examples/sshnetcat.c:241:18: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] void cleanup_pcap(){ ^ void and similar Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2022-09-07tests: Set OPENSSL_ENABLE_SHA1_SIGNATURES=1 for all testsAndreas Schneider1-8/+7
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2022-06-09Add errno reset with strtoul callNorbert Pocs1-0/+1
Contaminated errno can happen before strtoul call, thereofore cleaning it before the call. The errno is not used for checking later in code if fail happens, therefore cleaning it right after error. Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2020-11-02tests: Disable *cbc ciphers in Dropbear testsJakub Jelen1-23/+42
These are disabled in latest since Dropbear 2020.79, while older do not support anything better than aes-ctr ciphers. We should implement some dynamic algorithm detection for dropbear too to increase test coverage. https://bugs.libssh.org/T252 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2020-09-29src/kex.c: removes DES and SHA1 from mac and kex algorithms by default.Sahana Prasad1-13/+20
Signed-off-by: Sahana Prasad <sahana@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2020-05-06cmake: Add autogenerated libssh_version.hHeiko Thiery1-0/+1
Set the cmake project verision to the autogenerated file to have a single point to set the version. This will be included in the libssh.h file. Pair-Programmed-With: Andreas Schneider <asn@cryptomilk.org> Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com> Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2020-04-20pkd: Enable all hostkeysJakub Jelen1-0/+10
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2020-04-06kex: Add support for diffie-hellman-group14-sha256Anderson Toshiyuki Sasaki1-0/+8
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-12-23tests: Avoid needless assignment as reported by csbuildJakub Jelen1-1/+0
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-12-23pkd client run user executableAris Adamantiadis1-1/+1
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-12-23pkd: fix snprintf compiler warningAris Adamantiadis1-1/+1
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-12-23pkd: use detected OpenSSH supported key typesAris Adamantiadis1-25/+3
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-11-07cmake: Do not use cached LIBSSH_PUBLIC_INCLUDE_DIRSAndreas Schneider1-8/+6
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2019-11-07cmake: Rename static libraryAndreas Schneider1-1/+1
This is only compiled for tests and fuzzers! Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2019-11-07cmake:pkd: Don't use LIBSSH_LINK_LIBRARIESAndreas Schneider1-1/+0
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2019-10-25tests: Do not process server config during testsAnderson Toshiyuki Sasaki1-0/+8
In pkd tests, avoid processing the global server configuration file. This is to allow testing with algorithms not allowed in the global server configuration. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-26tests/pkd: Fix elif without expressionAnderson Toshiyuki Sasaki1-1/+1
This was introduced during fixes to run pkd tests in FIPS mode. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-06-13tests/pkd: Fix OpenSSH version checkAnderson Toshiyuki Sasaki1-5/+9
When running in FIPS mode, the OpenSSH version is not the first string printed by "ssh -V". This makes the parser to find the first occurrence of the version ignoring anything printed before it. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13tests/pkd: Check OpenSSH version only onceAnderson Toshiyuki Sasaki1-1/+5
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13tests/pkd: Add tests using certificates with SHA2 in signaturesAnderson Toshiyuki Sasaki3-1/+17
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13tests/pkd: Accept certificates with SHA2 in signaturesAnderson Toshiyuki Sasaki1-1/+1
Previously the server in pkd tests would not accept certificates using SHA2 in signatures. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13tests/pkd: Use only allowed algorithms if in FIPS modeAnderson Toshiyuki Sasaki3-185/+218
Use only allowed algorithms in FIPS mode. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-12server: Use default methods instead of allAnderson Toshiyuki Sasaki1-0/+16
Previously, when no methods were set, the server would enable all supported methods. This changes this behaviour by setting only the default methods. The server in pkd_daemon.c was changed to set explicitly all the supported methods to keep the previous behaviour. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-04-29tests:pkd: Fix size comparison (payload.len is size_t)Andreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2019-04-29server: fix queued USERAUTH_SUCCESS rekey bugJon Simons1-0/+5
Fix a bug with server-side rekeying where the session state at hand has been toggled to SSH_SESSION_STATE_AUTHENTICATED before performing the packet send of the SSH2_MSG_USERAUTH_SUCCESS message. Before this change, what can happen is that during the packet send, the SSH2_MSG_USERAUTH_SUCCESS message can end up being queued due to a small rekey data limit value. libssh server will then proceed to attempt to send KEX-related rekeying messages to the client before the client has received USERAUTH_SUCCESS. OpenSSH clients do not expect to undergo rekeying before having been authenticated, and so will exit with error when this happens. The behavior before and after can be observed with the pkd test making use of its new --rekey flag: ./pkd_hello -t torture_pkd_openssh_rsa_rsa_default -i1 --rekey=16 -v -v -v A new CMake test entry is added for the above variation and can be run with: ARGS="-R pkd_hello_rekey" make test Before the fix, the test will fail; after, the test succeeds while performing rekeying once every 16 bytes. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-04-29tests/pkd: support --rekey to set rekey data limitJon Simons3-0/+14
Support an optional --rekey input to set the SSH session rekey data limit using SSH_OPTIONS_REKEY_DATA. This flag can be used together with --buffer to test out server rekeying. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-04-29tests/pkd: support optional --buffer for test payloadJon Simons1-0/+6
Support an optional --buffer input for the pkd tests to enable testing with a larger payload than the default "hello\n". Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-04-29tests/pkd: input test payload bufferJon Simons3-3/+17
Move the pkd test payload buffer into the arguments struct, to make way for parameterizing the payload using command-line options. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-04-17tests/pkd: connect to openssh using certificatesBen Toews4-20/+84
Signed-off-by: Ben Toews <mastahyeti@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-02-22Add tests and implementation for Encrypt-then-MAC modeDirkjan Bussink1-33/+66
This adds the OpenSSH HMACs that do encrypt then mac. This is a more secure mode than the original HMAC. Newer AEAD ciphers like chacha20 and AES-GCM are already encrypt-then-mac, but this also adds it for older legacy clients that don't support those ciphers yet. Signed-off-by: Dirkjan Bussink <d.bussink@gmail.com> Reviewed-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-02-22Select ciphers for MAC tests that need a MACDirkjan Bussink1-1/+1
Signed-off-by: Dirkjan Bussink <d.bussink@gmail.com> Reviewed-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-02-07tests/pkd: repro rsa-sha2-{256,512} negotiation bugJon Simons2-6/+17
Add four passes to the pkd tests to exercise codepaths where an OpenSSH client requests these HostKeyAlgorithms combinations: * rsa-sha2-256 * rsa-sha2-512 * rsa-sha2-256,rsa-sha2-512 * rsa-sha2-512,rsa-sha2-256 The tests demonstrate that the third combination currently fails: libssh ends up choosing `rsa-sha2-512` instead of `rsa-sha2-256`, and the initial exchange fails on the client side citing a signature failure. Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-02-07Allow building without Group Exchange supportJakub Jelen1-60/+47
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-02-07kex: Disable diffie-hellman-group-exchange-sha1 by defaultJakub Jelen2-23/+50
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-02-07tests: Fix error messageJakub Jelen1-1/+1
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-01-24pkd: dh-group-exchange testcasesAris Adamantiadis1-4/+27
2018-11-23tests: Do not require all the crypto libs to build testsuiteJakub Jelen1-2/+0
This was failing when I tried to run the testsuite without gcrypt devel libraries installed. Signed-off-by: Jakub Jelen <jakuje@gmail.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-19 07:21:36 +0000