RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: Use aes128-ctr for MAC tests since default has implicit MAC. 

Also verify that the Cipher or MAC we intended to use is actually the one
selected during the test.

OpenBSD-Regress-ID: ff43fed30552afe23d1364526fe8cf88cbfafe1d
This commit is contained in:
dtucker@openbsd.org 2024-08-22 10:21:02 +00:00 committed by Darren Tucker
parent ebc890b8b4
commit 7e75e3f57c
No known key found for this signature in database
1 changed files with 19 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
regress/rekey.sh
View File

@ -1,4 +1,4 @@
# $OpenBSD: rekey.sh,v 1.28 2024/08/21 10:33:27 dtucker Exp $ # $OpenBSD: rekey.sh,v 1.29 2024/08/22 10:21:02 dtucker Exp $
# Placed in the Public Domain. # Placed in the Public Domain.
tid="rekey" tid="rekey"
@ -28,6 +28,11 @@ ssh_data_rekeying()
echo "$_kexopt" >> $OBJ/sshd_proxy echo "$_kexopt" >> $OBJ/sshd_proxy
_opts="$_opts -o$_kexopt" _opts="$_opts -o$_kexopt"
fi fi
case "$_kexopt" in
MACs=*)
# default chacha20-poly1305 cipher has implicit MAC
_opts="$_opts -oCiphers=aes128-ctr" ;;
esac
trace bytes $_bytes kex $_kexopt opts $_opts trace bytes $_bytes kex $_kexopt opts $_opts
rm -f ${COPY} ${COPY2} ${LOG} rm -f ${COPY} ${COPY2} ${LOG}
# Create data file just big enough to reach rekey threshold. # Create data file just big enough to reach rekey threshold.
@ -40,16 +45,22 @@ ssh_data_rekeying()
cmp ${COPY} ${COPY2} || fail "corrupted copy ($@)" cmp ${COPY} ${COPY2} || fail "corrupted copy ($@)"
n=`grep 'NEWKEYS sent' ${LOG} | wc -l` n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
n=`expr $n - 1` n=`expr $n - 1`
_want=`echo $_kexopt | cut -f2 -d=`
_got=""
case "$_kexopt" in case "$_kexopt" in
KexAlgorithms*) KexAlgorithms=*)
_want=`echo $_kexopt | cut -f2 -d=`
_got=`awk '/kex: algorithm: /{print $4}' ${LOG} | \ _got=`awk '/kex: algorithm: /{print $4}' ${LOG} | \
tr -d '\r' | sort -u` tr -d '\r' | sort -u` ;;
if [ "$_want" != "$_got" ]; then Ciphers=*)
fail "expected kex $_want, got $_got" _got=`awk '/kex: client->server cipher:/{print $5}' ${LOG} | \
fi tr -d '\r' | sort -u` ;;
;; MACs=*)
_got=`awk '/kex: client->server cipher:/{print $7}' ${LOG} | \
tr -d '\r' | sort -u` ;;
esac esac
if [ "$_want" != "$_got" ]; then
fail "unexpected algorithm, want $_want, got $_got"
fi
trace "$n rekeying(s)" trace "$n rekeying(s)"
if [ $n -lt 1 ]; then if [ $n -lt 1 ]; then
fail "no rekeying occurred ($@)" fail "no rekeying occurred ($@)"