1296633Sdes# $OpenBSD: rekey.sh,v 1.17 2016/01/29 05:18:15 dtucker Exp $ 2124208Sdes# Placed in the Public Domain. 3124208Sdes 4255670Sdestid="rekey" 5124208Sdes 6255670SdesLOG=${TEST_SSH_LOGFILE} 7124208Sdes 8255670Sdesrm -f ${LOG} 9294328Sdescp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak 10124208Sdes 11261320Sdes# Test rekeying based on data volume only. 12261320Sdes# Arguments will be passed to ssh. 13261320Sdesssh_data_rekeying() 14261320Sdes{ 15294328Sdes _kexopt=$1 ; shift 16294328Sdes _opts="$@" 17294328Sdes if ! test -z "$_kexopts" ; then 18294328Sdes cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 19294328Sdes echo "$_kexopt" >> $OBJ/sshd_proxy 20294328Sdes _opts="$_opts -o$_kexopt" 21294328Sdes fi 22255670Sdes rm -f ${COPY} ${LOG} 23294328Sdes _opts="$_opts -oCompression=no" 24294328Sdes ${SSH} <${DATA} $_opts -v -F $OBJ/ssh_proxy somehost "cat > ${COPY}" 25124208Sdes if [ $? -ne 0 ]; then 26261320Sdes fail "ssh failed ($@)" 27124208Sdes fi 28261320Sdes cmp ${DATA} ${COPY} || fail "corrupted copy ($@)" 29124208Sdes n=`grep 'NEWKEYS sent' ${LOG} | wc -l` 30124208Sdes n=`expr $n - 1` 31124208Sdes trace "$n rekeying(s)" 32124208Sdes if [ $n -lt 1 ]; then 33261320Sdes fail "no rekeying occured ($@)" 34124208Sdes fi 35261320Sdes} 36261320Sdes 37261320Sdesincrease_datafile_size 300 38261320Sdes 39261320Sdesopts="" 40261320Sdesfor i in `${SSH} -Q kex`; do 41261320Sdes opts="$opts KexAlgorithms=$i" 42124208Sdesdone 43261320Sdesfor i in `${SSH} -Q cipher`; do 44261320Sdes opts="$opts Ciphers=$i" 45261320Sdesdone 46261320Sdesfor i in `${SSH} -Q mac`; do 47261320Sdes opts="$opts MACs=$i" 48261320Sdesdone 49255670Sdes 50261320Sdesfor opt in $opts; do 51261320Sdes verbose "client rekey $opt" 52294328Sdes ssh_data_rekeying "$opt" -oRekeyLimit=256k 53261320Sdesdone 54261320Sdes 55261320Sdes# AEAD ciphers are magical so test with all KexAlgorithms 56261320Sdesif ${SSH} -Q cipher-auth | grep '^.*$' >/dev/null 2>&1 ; then 57261320Sdes for c in `${SSH} -Q cipher-auth`; do 58261320Sdes for kex in `${SSH} -Q kex`; do 59261320Sdes verbose "client rekey $c $kex" 60294328Sdes ssh_data_rekeying "KexAlgorithms=$kex" -oRekeyLimit=256k -oCiphers=$c 61261320Sdes done 62261320Sdes done 63261320Sdesfi 64261320Sdes 65261320Sdesfor s in 16 1k 128k 256k; do 66261320Sdes verbose "client rekeylimit ${s}" 67294328Sdes ssh_data_rekeying "" -oCompression=no -oRekeyLimit=$s 68261320Sdesdone 69261320Sdes 70255670Sdesfor s in 5 10; do 71255670Sdes verbose "client rekeylimit default ${s}" 72255670Sdes rm -f ${COPY} ${LOG} 73261320Sdes ${SSH} < ${DATA} -oCompression=no -oRekeyLimit="default $s" -F \ 74261320Sdes $OBJ/ssh_proxy somehost "cat >${COPY};sleep $s;sleep 3" 75255670Sdes if [ $? -ne 0 ]; then 76255670Sdes fail "ssh failed" 77255670Sdes fi 78261320Sdes cmp ${DATA} ${COPY} || fail "corrupted copy" 79255670Sdes n=`grep 'NEWKEYS sent' ${LOG} | wc -l` 80255670Sdes n=`expr $n - 1` 81255670Sdes trace "$n rekeying(s)" 82255670Sdes if [ $n -lt 1 ]; then 83255670Sdes fail "no rekeying occured" 84255670Sdes fi 85255670Sdesdone 86255670Sdes 87255670Sdesfor s in 5 10; do 88255670Sdes verbose "client rekeylimit default ${s} no data" 89255670Sdes rm -f ${COPY} ${LOG} 90255670Sdes ${SSH} -oCompression=no -oRekeyLimit="default $s" -F \ 91255670Sdes $OBJ/ssh_proxy somehost "sleep $s;sleep 3" 92255670Sdes if [ $? -ne 0 ]; then 93255670Sdes fail "ssh failed" 94255670Sdes fi 95255670Sdes n=`grep 'NEWKEYS sent' ${LOG} | wc -l` 96255670Sdes n=`expr $n - 1` 97255670Sdes trace "$n rekeying(s)" 98255670Sdes if [ $n -lt 1 ]; then 99255670Sdes fail "no rekeying occured" 100255670Sdes fi 101255670Sdesdone 102255670Sdes 103294332Sdesfor s in 16 1k 128k 256k; do 104294332Sdes verbose "server rekeylimit ${s}" 105294332Sdes cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 106294332Sdes echo "rekeylimit ${s}" >>$OBJ/sshd_proxy 107294332Sdes rm -f ${COPY} ${LOG} 108294332Sdes ${SSH} -oCompression=no -F $OBJ/ssh_proxy somehost "cat ${DATA}" \ 109294332Sdes > ${COPY} 110294332Sdes if [ $? -ne 0 ]; then 111294332Sdes fail "ssh failed" 112294332Sdes fi 113294332Sdes cmp ${DATA} ${COPY} || fail "corrupted copy" 114294332Sdes n=`grep 'NEWKEYS sent' ${LOG} | wc -l` 115294332Sdes n=`expr $n - 1` 116294332Sdes trace "$n rekeying(s)" 117294332Sdes if [ $n -lt 1 ]; then 118294332Sdes fail "no rekeying occured" 119294332Sdes fi 120294332Sdesdone 121294332Sdes 122255670Sdesfor s in 5 10; do 123255670Sdes verbose "server rekeylimit default ${s} no data" 124294332Sdes cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy 125294332Sdes echo "rekeylimit default ${s}" >>$OBJ/sshd_proxy 126255670Sdes rm -f ${COPY} ${LOG} 127255670Sdes ${SSH} -oCompression=no -F $OBJ/ssh_proxy somehost "sleep $s;sleep 3" 128255670Sdes if [ $? -ne 0 ]; then 129255670Sdes fail "ssh failed" 130255670Sdes fi 131255670Sdes n=`grep 'NEWKEYS sent' ${LOG} | wc -l` 132255670Sdes n=`expr $n - 1` 133255670Sdes trace "$n rekeying(s)" 134255670Sdes if [ $n -lt 1 ]; then 135255670Sdes fail "no rekeying occured" 136255670Sdes fi 137255670Sdesdone 138255670Sdes 139255670Sdesverbose "rekeylimit parsing" 140296633Sdesfor size in 16 1k 1K 1m 1M 1g 1G 4G 8G; do 141255670Sdes for time in 1 1m 1M 1h 1H 1d 1D 1w 1W; do 142255670Sdes case $size in 143255670Sdes 16) bytes=16 ;; 144255670Sdes 1k|1K) bytes=1024 ;; 145255670Sdes 1m|1M) bytes=1048576 ;; 146255670Sdes 1g|1G) bytes=1073741824 ;; 147296633Sdes 4g|4G) bytes=4294967296 ;; 148296633Sdes 8g|8G) bytes=8589934592 ;; 149255670Sdes esac 150255670Sdes case $time in 151255670Sdes 1) seconds=1 ;; 152255670Sdes 1m|1M) seconds=60 ;; 153255670Sdes 1h|1H) seconds=3600 ;; 154255670Sdes 1d|1D) seconds=86400 ;; 155255670Sdes 1w|1W) seconds=604800 ;; 156255670Sdes esac 157255670Sdes 158255670Sdes b=`$SUDO ${SSHD} -T -o "rekeylimit $size $time" -f $OBJ/sshd_proxy | \ 159255670Sdes awk '/rekeylimit/{print $2}'` 160255670Sdes s=`$SUDO ${SSHD} -T -o "rekeylimit $size $time" -f $OBJ/sshd_proxy | \ 161255670Sdes awk '/rekeylimit/{print $3}'` 162255670Sdes 163255670Sdes if [ "$bytes" != "$b" ]; then 164261320Sdes fatal "rekeylimit size: expected $bytes bytes got $b" 165255670Sdes fi 166255670Sdes if [ "$seconds" != "$s" ]; then 167261320Sdes fatal "rekeylimit time: expected $time seconds got $s" 168255670Sdes fi 169255670Sdes done 170255670Sdesdone 171255670Sdes 172255670Sdesrm -f ${COPY} ${DATA} 173