Skip to content

Commit f44f124

Browse files
daztuckerdaztucker
committed
upstream: Test all mutually supported algorithms,
using dropbear's new -Q option to query its algorithms where possible. OpenBSD-Regress-ID: 7e1fa733dec3bfa9f8931e535a9397209b5953f3
1 parent 0cadf7e commit f44f124

1 file changed

Lines changed: 177 additions & 25 deletions

File tree

‎regress/dropbear-server.sh‎

Lines changed: 177 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,14 @@
1-
# $OpenBSD: dropbear-server.sh,v 1.2 2025/06/29 05:35:00 dtucker Exp $
1+
# $OpenBSD: dropbear-server.sh,v 1.3 2026/05/27 23:04:36 dtucker Exp $
22
# Placed in the Public Domain.
33

44
tid="dropbear server"
55

6+
authkeydir=/var/run/dropbear-regress
7+
8+
if [ -z "$SUDO" -a ! -w /var/run ]; then
9+
skip "need SUDO to create dir in /var/run, test won't work without it"
10+
fi
11+
612
if test "x$REGRESS_INTEROP_DROPBEAR" != "xyes" ; then
713
skip "dropbear interop tests not enabled"
814
fi
@@ -21,37 +27,158 @@ else
2127
trace "dropbear version $ver (${major}.${minor}) ok"
2228
fi
2329

24-
if [ -z "$SUDO" -a ! -w /var/run ]; then
25-
skip "need SUDO to create dir in /var/run, test won't work without"
30+
# Dropbear versions 2026.91 and earlier only support 4 hostkeys in total,
31+
# however this was increased shortly after that release. Test for this.
32+
$SUDO $DROPBEARCONVERT openssh dropbear "$OBJ/host.ed25519" "$OBJ/db.25519" >/dev/null 2>&1
33+
$SUDO chown $USER $OBJ/$dbkey
34+
k="-r $OBJ/db.ed25519"
35+
if $DROPBEAR $k $k $k $k $k -V >/dev/null 2>&1; then
36+
limit_4_hostkeys=no
37+
else
38+
trace "dropbear supports only 4 host keys"
39+
limit_4_hostkeys=yes
2640
fi
27-
authkeydir=/var/run/dropbear-regress
2841

29-
ciphers=`$DBCLIENT -c help hst 2>&1 | awk '/ ciphers: /{print $4}' | tr ',' ' '`
30-
macs=`$DBCLIENT -m help hst 2>&1 | awk '/ MACs: /{print $4}' | tr ',' ' '`
31-
if [ -z "$macs" ] || [ -z "$ciphers" ]; then
32-
skip "dbclient query ciphers '$ciphers' or macs '$macs' failed"
42+
#
43+
# Determine the set of algos supported by the Dropbear we're testing against.
44+
#
45+
if $DROPBEAR -Q help >/dev/null 2>&1; then
46+
# We can directly query the server for supported algos.
47+
dbciphers=`$DROPBEAR -Q cipher`
48+
dbmacs=`$DROPBEAR -Q mac`
49+
dbkexs=`$DROPBEAR -Q kex`
50+
dbhkalgs=`$DROPBEAR -Q sig`
51+
dbpktypes=`$DROPBEAR -Q sig`
52+
else
53+
# We infer ciphers and macs from dbclient and hard code the rest.
54+
# Since this test only supports back to Dropbear 2025.07 (due to the
55+
# need for '-D') we have a pretty good idea what to hard code.
56+
dbciphers=`$DBCLIENT -c help hst 2>&1 | awk '/ ciphers: /{print $4}' | tr ',' ' '`
57+
dbmacs=`$DBCLIENT -m help hst 2>&1 | awk '/ MACs: /{print $4}' | tr ',' ' '`
58+
dbkexs="curve25519-sha256 curve25519-sha256@libssh.org"
59+
dbkexs="$dbkexs diffie-hellman-group14-sha256"
60+
dbkexs="$dbkexs ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521"
61+
dbkexs="$dbkexs sntrup761x25519-sha512 mlkem768x25519-sha256"
62+
dbhkalgs="ssh-ed25519 ecdsa-sha2-nistp256 ecdsa-sha2-nistp521 rsa-sha2-256"
63+
dbpktypes="ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521"
64+
dbpktypes="$dbpktypes ssh-ed25519 rsa-sha2-256"
3365
fi
3466

67+
if [ -z "$dbmacs" ] || [ -z "$dbciphers" ] || [ -z "$dbkexs" ] || \
68+
[ -z "$dbhkalgs" ] || [ -z "$dbpktypes" ]; then
69+
fail "query ciphers '$dbciphers' macs '$dbmacs' kexs '$dbkexs' " \
70+
"dbhkalgs '$dbhkalgs' or bpktypes '$bpktypes' failed"
71+
fi
72+
73+
#
74+
# Filter out ciphers, macs and kexes not supported by the OpenSSH we're testing
75+
# and put the ones we want into ciphers, macs and kexes.
76+
#
77+
ciphers=""
78+
for c in $dbciphers; do
79+
if $SSH -Q Ciphers | grep -E "^$c\$" >/dev/null; then
80+
ciphers="$ciphers $c"
81+
else
82+
trace "ssh does not support cipher '$c'"
83+
fi
84+
done
85+
86+
macs=""
87+
for m in $dbmacs; do
88+
if $SSH -Q MACs | grep -E "^$m\$" >/dev/null; then
89+
macs="$macs $m"
90+
else
91+
trace "ssh does not support mac '$m'"
92+
fi
93+
done
94+
95+
kexs=""
96+
for k in $dbkexs; do
97+
if $SSH -Q KexAlgorithms | grep -E "^$k\$" >/dev/null; then
98+
kexs="$kexs $k"
99+
else
100+
trace "ssh does not support kex '$k'"
101+
fi
102+
done
103+
104+
#
105+
# Now filter by supported HostKeyAlgorithms. The key types are not a 1:1
106+
# correlation with the algos, so we first check that the algo is supported,
107+
# and if so put it in hkalgs add the appropriate key type to keytypes for
108+
# later deduplication and processing.
109+
#
110+
hkalgs=""
111+
keytypes=""
112+
for alg in $dbhkalgs; do
113+
if ! $SSH -Q HostKeyAlgorithms | grep -E "^$alg\$" >/dev/null; then
114+
trace "ssh does not support $alg"
115+
alg=""
116+
fi
117+
118+
kt="$alg"
119+
case "$alg" in
120+
sk-*)
121+
trace "omitting sk alg $alg"
122+
alg=""
123+
;;
124+
ecdsa-sha2-nistp384)
125+
if [ "$limit_4_hostkeys" = "yes" ]; then
126+
trace "dropbear host key limit=4, omitting $alg"
127+
alg=""
128+
fi
129+
;;
130+
rsa-sha2*)
131+
kt=ssh-rsa
132+
;;
133+
esac
134+
135+
if [ "$alg" != "" ]; then
136+
hkalgs="$hkalgs $alg"
137+
keytypes="$keytypes $kt"
138+
fi
139+
done
140+
141+
#
142+
# Deduplicate key types (because the various RSA hostkey algos use the same
143+
# type and Dropbear has a limit on the number of hostkeys it'll load) and
144+
# construct hkeyopts to be passed to dropbear command line.
145+
#
146+
hkeyopts=""
147+
for kt in `for i in $keytypes; do echo $i; done | sort -u`; do
148+
key="host.$kt"
149+
dbkey="db.$kt"
150+
trace "convert hostkey '$key' to '$dbkey'"
151+
if $SUDO $DROPBEARCONVERT openssh dropbear "$OBJ/$key" \
152+
"$OBJ/$dbkey" >/dev/null 2>&1; then
153+
if [ ! -f "$OBJ/$dbkey" ]; then
154+
fail "convert $key to $dbkey"
155+
fi
156+
$SUDO chown $USER $OBJ/$dbkey
157+
fi
158+
trace "hkeyopts add -r $OBJ/db.$kt"
159+
hkeyopts="$hkeyopts -r $OBJ/db.$kt"
160+
done
161+
162+
pktypes=""
163+
for pk in $dbpktypes; do
164+
if $SSH -Q PubkeyAcceptedAlgorithms | grep -E "^$pk\$" >/dev/null; then
165+
case "$pk" in
166+
sk-*) ;;
167+
*) pktypes="$pktypes $pk" ;;
168+
esac
169+
else
170+
trace "ssh does not support pubkey type '$pk'"
171+
fi
172+
done
173+
35174
# Set up authorized_keys for dropbear.
36175
umask 077
37176
$SUDO mkdir -p $authkeydir
38177
$SUDO chown -R $USER $authkeydir
39178
cp $OBJ/authorized_keys_$USER $authkeydir/authorized_keys
40179

41-
for i in `$SUDO $SSHD -f $OBJ/sshd_config -T | grep -v sk- | \
42-
awk '$1=="hostkey" {print $2}'`; do
43-
file=`basename "$i"`
44-
file=`echo "$file" | sed s/^host\./db\./g`
45-
if $SUDO $DROPBEARCONVERT openssh dropbear "$i" "$OBJ/$file" \
46-
>/dev/null 2>&1; then
47-
$SUDO chown $USER $OBJ/$file
48-
hkeys="-r $OBJ/$file"
49-
fi
50-
done
51-
52180
rm -f $OBJ/dropbear.pid
53-
$DROPBEAR -D $authkeydir -p $PORT -P $OBJ/dropbear.pid $hkeys -E \
54-
2>$OBJ/sshd.log
181+
$DROPBEAR -E -D $authkeydir -p $PORT -P $OBJ/dropbear.pid $hkeyopts 2>>$OBJ/sshd.log
55182
if [ $? -ne 0 ]; then
56183
fatal "starting dropbear server failed"
57184
fi
@@ -62,15 +189,40 @@ done
62189
pid=`cat $OBJ/dropbear.pid`
63190
trap "kill $pid; $SUDO rm -rf $authkeydir" 0
64191

192+
trace ciphers $ciphers
193+
trace macs $macs
194+
trace kexs $kexs
195+
trace hkalgs $hkalgs
196+
trace pktypes $pktypes
197+
65198
for c in $ciphers; do
66-
for m in $macs; do
67-
trace "$tid: cipher $c mac $m hk $hk"
199+
case "$c" in
200+
chacha20-poly1305@openssh.com|aes*-gcm@openssh.com)
201+
tmpmacs="<implicit>" ;;
202+
*)
203+
tmpmacs="$macs" ;;
204+
esac
205+
206+
for m in $tmpmacs; do
207+
for k in $kexs; do
208+
for hk in $hkalgs; do
209+
for pk in $pktypes; do
210+
verbose "$tid: cipher $c mac $m kex $k hkalg $hk pk $pk"
68211
rm -f ${COPY}
69-
${SSH} -F $OBJ/ssh_config -oCiphers=$c -oMacs=$m \
70-
somehost cat ${DATA} > ${COPY}
212+
if [ "$m" = "<implicit>" ]; then
213+
macopts=""
214+
else
215+
macopts="-oMacs=$m"
216+
fi
217+
${SSH} -F $OBJ/ssh_config -oCiphers=$c $macopts -oKexAlgorithms=$k \
218+
-oHostKeyAlgorithms=$hk -oPubkeyAcceptedAlgorithms=$pk \
219+
somehost cat ${DATA} > ${COPY}
71220
if [ $? -ne 0 ]; then
72221
fail "connect dropbear server failed"
73222
fi
74223
cmp ${DATA} ${COPY} || fail "corrupted copy"
224+
done
225+
done
226+
done
75227
done
76228
done

0 commit comments

Comments
 (0)