Skip to content

Commit 86499a5

Browse files
dgarskedgarske
authored
Merge pull request #762 from JacobBarthelmeh/kex
Add back in P521 and P384 by default when enabled
2 parents e7be0cd + c476e88 commit 86499a5

File tree

5 files changed

+259
-41
lines changed

5 files changed

+259
-41
lines changed

‎.github/workflows/sshd-test.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,3 +106,20 @@ jobs:
106106
touch sshd_config.txt
107107
./configure --enable-all LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DWOLFSSH_NO_FPKI -DWOLFSSH_NO_SFTP_TIMEOUT -DWOLFSSH_MAX_SFTP_RW=4000000 -DMAX_PATH_SZ=120" --enable-static --disable-shared && make
108108
sudo timeout --preserve-status -s 2 5 valgrind --error-exitcode=1 --leak-check=full ./apps/wolfsshd/wolfsshd -D -f sshd_config -h ./keys/server-key.pem -d -p 22222
109+
110+
- name: configure with debug
111+
working-directory: ./wolfssh/
112+
run : |
113+
./configure --enable-all --enable-debug LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DWOLFSSH_NO_FPKI -DWOLFSSH_NO_SFTP_TIMEOUT -DWOLFSSH_MAX_SFTP_RW=4000000 -DMAX_PATH_SZ=120"
114+
115+
- name: make
116+
working-directory: ./wolfssh/
117+
run: make
118+
119+
# ssh_kex_algos.sh requires debug output otherwise it is skipped
120+
- name: Run wolfSSHd tests with debug
121+
working-directory: ./wolfssh/apps/wolfsshd/test
122+
run: |
123+
git log -3
124+
sudo ./run_all_sshd_tests.sh --match ssh_kex_algos.sh
125+

‎apps/wolfsshd/test/run_all_sshd_tests.sh‎

Lines changed: 104 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,60 @@
22

33
echo "Running all wolfSSHd tests"
44

5-
if [ -z "$1" ]; then
6-
USER=$USER
7-
else
8-
USER=$1
9-
fi
5+
# Define an array of test cases
6+
test_cases=(
7+
"sshd_exec_test.sh"
8+
"sshd_term_size_test.sh"
9+
"sshd_large_sftp_test.sh"
10+
"sshd_bad_sftp_test.sh"
11+
"sshd_term_close_test.sh"
12+
"ssh_kex_algos.sh"
13+
)
14+
15+
# Set defaults
16+
USER=$USER
17+
18+
# Parse arguments
19+
MATCH=""
20+
EXCLUDE=""
21+
while [[ "$#" -gt 0 ]]; do
22+
case "$1" in
23+
--match)
24+
MATCH="$2"
25+
shift 2
26+
;;
27+
28+
--exclude)
29+
EXCLUDE="$2"
30+
shift 2
31+
;;
32+
33+
--user)
34+
USER="$2"
35+
shift 2
36+
;;
1037

11-
TEST_HOST=$2
12-
TEST_PORT=$3
38+
--host)
39+
TEST_HOST="$2"
40+
shift 2
41+
;;
42+
43+
--port)
44+
TEST_PORT="$2"
45+
shift 2
46+
;;
47+
48+
*)
49+
echo "Unknown option: $1"
50+
echo "Expecting --host <host> | --port <port> | --user <user> | --match <test case> | --exclude <test case>"
51+
echo "All test cases:"
52+
for test in "${test_cases[@]}"; do
53+
echo " $test"
54+
done
55+
exit 1
56+
;;
57+
esac
58+
done
1359

1460
TOTAL=0
1561
SKIPPED=0
@@ -57,41 +103,62 @@ run_test() {
57103
fi
58104
}
59105

60-
run_test "sshd_exec_test.sh"
61-
run_test "sshd_term_size_test.sh"
62-
run_test "sshd_large_sftp_test.sh"
63-
run_test "sshd_bad_sftp_test.sh"
64-
run_test "sshd_term_close_test.sh"
106+
# Run the tests
107+
if [[ -n "$MATCH" ]]; then
108+
if [[ " ${test_cases[*]} " =~ " $MATCH " ]]; then
109+
echo "Running test: $MATCH"
110+
run_test "$MATCH"
111+
else
112+
echo "Error: Test '$MATCH' not found."
113+
exit 1
114+
fi
115+
116+
if [ "$USING_LOCAL_HOST" == 1 ]; then
117+
printf "Shutting down test wolfSSHd\n"
118+
stop_wolfsshd
119+
fi
120+
else
121+
echo "Running all tests..."
122+
for test in "${test_cases[@]}"; do
123+
if [[ "$test" != "$EXCLUDE" ]]; then
124+
echo "Running test: $test"
125+
run_test "$test"
126+
else
127+
echo "Test '$test' is excluded. Skipping."
128+
SKIPPED=$((SKIPPED+1))
129+
fi
130+
done
65131

66-
#Github actions needs resolved for these test cases
67-
#run_test "error_return.sh"
68-
#run_test "sshd_login_grace_test.sh"
132+
#Github actions needs resolved for these test cases
133+
#run_test "error_return.sh"
134+
#run_test "sshd_login_grace_test.sh"
69135

70-
# add aditional tests here, check on var USING_LOCAL_HOST if can make sshd
71-
# server start/restart with changes
136+
# add aditional tests here, check on var USING_LOCAL_HOST if can make sshd
137+
# server start/restart with changes
72138

73-
if [ "$USING_LOCAL_HOST" == 1 ]; then
74-
printf "Shutting down test wolfSSHd\n"
75-
stop_wolfsshd
76-
fi
139+
if [ "$USING_LOCAL_HOST" == 1 ]; then
140+
printf "Shutting down test wolfSSHd\n"
141+
stop_wolfsshd
142+
fi
77143

78-
# these tests require setting up an sshd
79-
if [ "$USING_LOCAL_HOST" == 1 ]; then
80-
run_test "sshd_forcedcmd_test.sh"
81-
run_test "sshd_window_full_test.sh"
82-
else
83-
printf "Skipping tests that need to setup local SSHD\n"
84-
SKIPPED=$((SKIPPED+2))
85-
fi
144+
# these tests require setting up an sshd
145+
if [ "$USING_LOCAL_HOST" == 1 ]; then
146+
run_test "sshd_forcedcmd_test.sh"
147+
run_test "sshd_window_full_test.sh"
148+
else
149+
printf "Skipping tests that need to setup local SSHD\n"
150+
SKIPPED=$((SKIPPED+2))
151+
fi
86152

87-
# these tests run with X509 sshd-config loaded
88-
if [ "$USING_LOCAL_HOST" == 1 ]; then
89-
start_wolfsshd "sshd_config_test_x509"
90-
fi
91-
run_test "sshd_x509_test.sh"
92-
if [ "$USING_LOCAL_HOST" == 1 ]; then
93-
printf "Shutting down test wolfSSHd\n"
94-
stop_wolfsshd
153+
# these tests run with X509 sshd-config loaded
154+
if [ "$USING_LOCAL_HOST" == 1 ]; then
155+
start_wolfsshd "sshd_config_test_x509"
156+
fi
157+
run_test "sshd_x509_test.sh"
158+
if [ "$USING_LOCAL_HOST" == 1 ]; then
159+
printf "Shutting down test wolfSSHd\n"
160+
stop_wolfsshd
161+
fi
95162
fi
96163

97164
printf "All tests ran, $TOTAL passed, $SKIPPED skipped\n"

‎apps/wolfsshd/test/ssh_kex_algos.sh‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
#!/bin/sh
2+
3+
# sshd local test
4+
5+
ROOT_PWD=$(pwd)
6+
cd ../../..
7+
8+
TEST_CLIENT="./apps/wolfssh/wolfssh"
9+
PRIVATE_KEY="./keys/hansel-key-ecc.der"
10+
PUBLIC_KEY="./keys/hansel-key-ecc.pub"
11+
12+
if [ -z "$1" ] || [ -z "$2" ] || [ -z "$3" ]; then
13+
echo "expecting host and port as arguments"
14+
echo "$0 127.0.0.1 22222 $USER"
15+
exit 1
16+
fi
17+
HOST_IP="$1"
18+
HOST_PORT="$2"
19+
USER_SET="$3"
20+
21+
# check if wolfssh app was compiled
22+
OUTPUT=$("$TEST_CLIENT" -V)
23+
RESULT=$?
24+
if [ "$RESULT" != 0 ]; then
25+
echo "wolfSSH app not compiled in";
26+
exit 77
27+
fi
28+
29+
# Debug mode needs to be on to inspect the debug output
30+
printf "$OUTPUT" | grep "DEBUG"
31+
RESULT=$?
32+
if [ "$RESULT" != 0 ]; then
33+
echo "wolfSSH app not compiled with debug mode";
34+
exit 77
35+
fi
36+
37+
# returns variable SUPPORTED as 1 or 0
38+
test_if_supported() {
39+
SUPPORTED=0
40+
TEXT=$(./examples/client/client -E -u $USER_SET | grep "$1")
41+
if [ $? = 0 ]; then
42+
SUPPORTED=1
43+
fi
44+
printf "$1 , $SUPPORTED\n"
45+
}
46+
47+
# test which algo's are supported
48+
printf "Algo , Supported?\n"
49+
test_if_supported "p256"
50+
HAVE_P256=$SUPPORTED
51+
test_if_supported "p384"
52+
HAVE_P384=$SUPPORTED
53+
test_if_supported "p521"
54+
HAVE_P521=$SUPPORTED
55+
printf "\n"
56+
57+
58+
# Looks through the variable OUTPUT for the block of text containg the server
59+
# host key algorithms sent.
60+
find_substring_of_algos() {
61+
# Extract the substring between start and end lines
62+
SUBSTRING=$(printf "$OUTPUT" | grep -A20 "Server Host Key Algorithms")
63+
SUBSTRING=$(printf "$SUBSTRING" | grep -v -A15 "DKI: Enc Algorithms")
64+
}
65+
66+
# take input argument $1 and checks if it is in the SUBSTRING
67+
test_for_algo_name() {
68+
#printf "substring found = $substring"
69+
if echo "$SUBSTRING" | grep -q "$1"; then
70+
printf "Found $1\n"
71+
EXISTS=1
72+
else
73+
printf "Did not find $1\n"
74+
EXISTS=0
75+
fi
76+
}
77+
78+
# Expecting to find the algo name $1
79+
test_for_algo_name_success() {
80+
test_for_algo_name "$1"
81+
if [ $EXISTS != 1 ]; then
82+
printf "Error finding algo name $1\n"
83+
printf "Searched in :\n$SUBSTRING\n"
84+
exit 1
85+
fi
86+
}
87+
88+
# Expecting to not find the algo name $1
89+
test_for_algo_name_fail() {
90+
test_for_algo_name "$1"
91+
if [ $EXISTS = 1 ]; then
92+
printf "Error expected to not find algo name $1\n"
93+
printf "Searched in :\n$SUBSTRING\n"
94+
exit 1
95+
fi
96+
}
97+
98+
echo "$TEST_CLIENT -p $HOST_PORT $USER_SET@$HOST_IP"
99+
OUTPUT=$(timeout 1 "$TEST_CLIENT" -p "$HOST_PORT" "$USER_SET"@"$HOST_IP" 2>&1)
100+
find_substring_of_algos
101+
102+
if [ $HAVE_P256 = 1 ]; then
103+
test_for_algo_name_success "ecdsa-sha2-nistp256"
104+
else
105+
test_for_algo_name_fail "ecdsa-sha2-nistp256"
106+
fi
107+
108+
if [ $HAVE_P384 = 1 ]; then
109+
test_for_algo_name_success "ecdsa-sha2-nistp384"
110+
else
111+
test_for_algo_name_fail "ecdsa-sha2-nistp384"
112+
fi
113+
114+
if [ $HAVE_P521 = 1 ]; then
115+
test_for_algo_name_success "ecdsa-sha2-nistp521"
116+
else
117+
test_for_algo_name_fail "ecdsa-sha2-nistp521"
118+
fi
119+
120+
exit 0
121+

‎src/internal.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -750,9 +750,18 @@ static const char cannedKeyAlgoNames[] =
750750
#ifndef WOLFSSH_NO_RSA_SHA2_256
751751
"rsa-sha2-256,"
752752
#endif/* WOLFSSH_NO_RSA_SHA2_256 */
753+
#ifndef WOLFSSH_NO_RSA_SHA2_512
754+
"rsa-sha2-512",
755+
#endif /* WOLFSSH_NO_RSA_SHA2_512 */
753756
#ifndef WOLFSSH_NO_ECDSA_SHA2_NISTP256
754757
"ecdsa-sha2-nistp256,"
755758
#endif /* WOLFSSH_NO_ECDSA_SHA2_NISTP256 */
759+
#ifndef WOLFSSH_NO_ECDSA_SHA2_NISTP384
760+
"ecdsa-sha2-nistp384,"
761+
#endif /* WOLFSSH_NO_ECDSA_SHA2_NISTP384 */
762+
#ifndef WOLFSSH_NO_ECDSA_SHA2_NISTP521
763+
"ecdsa-sha2-nistp521,"
764+
#endif /* WOLFSSH_NO_ECDSA_SHA2_NISTP521 */
756765
#ifdef WOLFSSH_CERTS
757766
#ifndef WOLFSSH_NO_ECDSA_SHA2_NISTP256
758767
"x509v3-ecdsa-sha2-nistp256,"

‎wolfssh/internal.h‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -154,12 +154,14 @@ extern "C" {
154154
#define WOLFSSH_NO_ECDH_SHA2_NISTP256
155155
#endif
156156
#if defined(WOLFSSH_NO_ECDH) \
157-
|| !defined(WOLFSSL_SHA384) || !defined(HAVE_ECC384)
157+
|| !defined(WOLFSSL_SHA384) || \
158+
(!defined(HAVE_ECC384) && !defined(HAVE_ALL_CURVES))
158159
#undef WOLFSSH_NO_ECDH_SHA2_NISTP384
159160
#define WOLFSSH_NO_ECDH_SHA2_NISTP384
160161
#endif
161162
#if defined(WOLFSSH_NO_ECDH) \
162-
|| !defined(WOLFSSL_SHA512) || !defined(HAVE_ECC521)
163+
|| !defined(WOLFSSL_SHA512) || \
164+
(!defined(HAVE_ECC521) && !defined(HAVE_ALL_CURVES))
163165
#undef WOLFSSH_NO_ECDH_SHA2_NISTP521
164166
#define WOLFSSH_NO_ECDH_SHA2_NISTP521
165167
#endif
@@ -218,12 +220,14 @@ extern "C" {
218220
#define WOLFSSH_NO_ECDSA_SHA2_NISTP256
219221
#endif
220222
#if defined(WOLFSSH_NO_ECDSA) || \
221-
!defined(WOLFSSL_SHA384) || !defined(HAVE_ECC384)
223+
!defined(WOLFSSL_SHA384) || \
224+
(!defined(HAVE_ECC384) && !defined(HAVE_ALL_CURVES))
222225
#undef WOLFSSH_NO_ECDSA_SHA2_NISTP384
223226
#define WOLFSSH_NO_ECDSA_SHA2_NISTP384
224227
#endif
225228
#if defined(WOLFSSH_NO_ECDSA) || \
226-
!defined(WOLFSSL_SHA512) || !defined(HAVE_ECC521)
229+
!defined(WOLFSSL_SHA512) || \
230+
(!defined(HAVE_ECC521) && !defined(HAVE_ALL_CURVES))
227231
#undef WOLFSSH_NO_ECDSA_SHA2_NISTP521
228232
#define WOLFSSH_NO_ECDSA_SHA2_NISTP521
229233
#endif

0 commit comments

Comments
 (0)