diff --git a/.depend b/.depend index 152905fb7b78..3e64eb84a6a5 100644 --- a/.depend +++ b/.depend @@ -79,6 +79,7 @@ loginrec.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-comp logintest.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h loginrec.h mac.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h digest.h hmac.h umac.h mac.h misc.h ssherr.h sshbuf.h openbsd-compat/openssl-compat.h match.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h match.h misc.h +misc-agent.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h digest.h log.h ssherr.h misc.h pathnames.h ssh.h xmalloc.h misc.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h misc.h log.h ssherr.h ssh.h sshbuf.h moduli.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h monitor.o: chacha.h poly1305.h cipher-aesctr.h rijndael.h kex.h mac.h crypto_api.h dh.h packet.h dispatch.h auth-options.h sshpty.h channels.h session.h sshlogin.h canohost.h log.h ssherr.h misc.h servconf.h monitor.h monitor_wrap.h monitor_fdpass.h compat.h ssh2.h authfd.h match.h sk-api.h srclimit.h @@ -128,7 +129,6 @@ sntrup761.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-com srclimit.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h addr.h canohost.h log.h ssherr.h misc.h srclimit.h xmalloc.h servconf.h openbsd-compat/sys-queue.h match.h ssh-add.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h log.h ssherr.h sshkey.h sshbuf.h authfd.h authfile.h pathnames.h misc.h digest.h ssh-sk.h sk-api.h hostfile.h ssh-agent.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h sshbuf.h sshkey.h authfd.h log.h ssherr.h misc.h digest.h match.h msg.h pathnames.h ssh-pkcs11.h sk-api.h myproposal.h -ssh-dss.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssh-ecdsa-sk.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/openssl-compat.h sshbuf.h ssherr.h digest.h sshkey.h ssh-ecdsa.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssh-ed25519-sk.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h crypto_api.h log.h ssherr.h sshbuf.h sshkey.h ssh.h digest.h diff --git a/.github/agents/merge-upstream.agent.md b/.github/agents/merge-upstream.agent.md new file mode 100644 index 000000000000..775b9fa3b9c3 --- /dev/null +++ b/.github/agents/merge-upstream.agent.md @@ -0,0 +1,583 @@ +--- +name: merge-upstream +description: Assist with merging upstream OpenSSH commits into the PowerShell fork. +tools: + ['vscode', 'execute', 'read', 'edit', 'search', 'web', 'agent', 'openssh-server/*', 'todo'] +--- +# OpenSSH Upstream Merge Agent + +## Agent Purpose +This agent assists with merging upstream OpenSSH commits into the PowerShell fork (PowerShell/openssh-portable). It handles the complete workflow from environment verification through pull request submission. + +**Note:** This agent has access to specialized MCP (Model Context Protocol) tools that automate commit analysis and CI status checking. When available, use the MCP tools instead of running scripts manually. + +## Agent Capabilities + +### Core Functions +- **Environment verification and setup** +- **Commit group analysis** using Get-CommitGroups MCP tool +- **Two-phase merge**: scratch branch (incremental merge + resolution recording) then real branch (single merge + replay) +- **Windows-specific build system updates** +- **Compilation and testing** +- **Documentation and PR preparation** + +### Key Tools Available + +1. **Get-CommitGroups MCP Tool** - Groups commits by CI presence or success + - **Access**: Available via MCP server + - **MCP Tool Name**: `mcp_openssh-server_Get_CommitGroups` + - **Parameters**: + - `GitHubTag` (string, optional): GitHub tag to start from (e.g., "V_10_0_P2") + - `StartCommit` (string, optional): Commit SHA to start from + - `EndCommit` (string, optional): Commit SHA to end at (default: HEAD - most recent upstream commit) + - `FirstChunkOnly` (boolean, optional): Stop after finding first chunk + - `GroupByCIPresence` (boolean, optional): Group by CI presence instead of CI success + - **Recommended Usage**: Always use `-FirstChunkOnly -GroupByCIPresence` for incremental merging + - **Usage**: Use the MCP tool function directly - it handles all GitHub API calls + - **If tool unavailable**: ERROR - This tool is required for the merge workflow + +2. **Start-OpenSSHBuild MCP Tool** - Build automation + - **MCP Tool Name**: `mcp_openssh-server_Start_OpenSSHBuild` + - **Parameters**: + - `Configuration` (string, optional): Build configuration - "Debug" or "Release" (default: "Release") + - `Architecture` (string, optional): Target architecture - "x64", "x86", "ARM", "ARM64" (default: "x64") + - `Clean` (boolean, optional): Perform clean build (default: false) + - **If tool unavailable**: ERROR - This tool is required for the merge workflow + +3. **Test-OpenSSHFunctionality MCP Tool** - Functional testing + - **MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHFunctionality` + - **Parameters**: + - `Configuration` (string, optional): Build configuration - "Debug" or "Release" (default: "Release") + - `Architecture` (string, optional): Target architecture - "x64", "x86", "ARM", "ARM64" (default: "x64") + - `SkipFirewall` (boolean, optional): Skip firewall configuration (default: false) + - `NoCleanup` (boolean, optional): Skip cleanup for debugging (default: false) + - **If tool unavailable**: ERROR - This tool is required for the merge workflow + + **Validation scenario override:** + - If prompt input declares `Validation scenario=entra-id-debug-localhost`, do not use temporary local-user/password validation. + - Instead, run `sshd -ddd` in one terminal and validate with `ssh localhost` from a second terminal. + - Use this only on machines where the Entra-ID admin account already has key-based auth configured. + +4. **Get-ConflictContext MCP Tool** - Three-way conflict context for high-complexity conflicts + - **MCP Tool Name**: `mcp_openssh-server_Get_ConflictContext` + - **When to use**: ONLY when `assess_conflict_complexity()` returns `HIGH_COMPLEXITY` + - **Parameters**: + - `FilePath` (string, required): Path to the conflicted file relative to the repository root + - `CommitHash` (string, required): The upstream commit SHA being cherry-picked that caused the conflict + - `ContextLines` (integer, optional): Lines of context above/below each hunk match (default: 40) + - `MaxTotalLines` (integer, optional): Maximum total lines across all three versions and all hunks (default: 150 — ~50 per version). Increase if broader context is needed. + - **What it returns**: For each hunk in the upstream diff — excerpts from three versions: + - `UpstreamBefore`: The file as it existed in upstream *before* this commit + - `UpstreamAfter`: The file in upstream *after* this commit + - `OurFork`: The corresponding region in our fork (located by content-anchor matching, not line numbers) + - **Budget**: `max(10, floor(MaxTotalLines / 3 / hunkCount))` lines per version per hunk; a warning is added to `Message` if the 10-line minimum floor is applied + - **If tool unavailable**: Fall back to reading the conflicted file directly and using `Invoke_Git Operation="Show"` and `Operation="Diff"` to gather context manually + +5. **Save-MergeResolution MCP Tool** - Records conflict resolution decisions + - **MCP Tool Name**: `mcp_openssh-server_Save_MergeResolution` + - **When to use**: After resolving each conflicted file during the scratch-branch phase + - **Parameters**: + - `FilePath` (string, required): Resolved file path relative to repo root + - `Strategy` (string, required): One of `accept_upstream`, `ifdef_windows`, `ifndef_windows`, `combine`, `manual` + - `Rationale` (string, required): Why this strategy was chosen + - `BatchNumber` (int, required): Current batch number + - `UpstreamCommits` (string, optional): Comma-separated SHAs of upstream commits touching this file + - `MergeTarget` (string, optional): Final upstream ref (only needed on first call to initialise the log) + - **If tool unavailable**: Agent should manually track resolutions in session memory + +6. **Replay-MergeResolutions MCP Tool** - Replays saved resolutions onto merge conflicts + - **MCP Tool Name**: `mcp_openssh-server_Replay_MergeResolutions` + - **When to use**: During the real-branch phase after `git merge` produces conflicts + - **Parameters**: + - `DryRun` (boolean, optional): Preview without modifying files (default: false) + - **Returns**: `ResolvedFiles[]`, `UnmatchedFiles[]`, `FailedFiles[]` + - **If tool unavailable**: Agent should manually re-resolve using strategies from session memory + +7. **Git** - Version control operations + - Merge: `Invoke-Git Operation="Merge" CommitHash=""` (uses `--no-ff`) + - MergeContinue / MergeAbort for conflict flow + - Cherry-pick operations remain available for other use cases + - Status: `git status` + - Remotes: `origin`, `upstream-pwsh`, `upstream` + +## Workflow Phases + +### Phase 0: Research and Planning +**Objective:** Understand the merge scope, requirements, and context + +**Steps:** +1. **Read all merge instructions** from `.github/instructions/merge/` folder: + - `merge-process-overview.instructions.md` - Primary merge workflow and process overview + - `research.instructions.md` - Research methodology and analysis requirements + - `merge-details.instructions.md` - Detailed conflict resolution strategies and patterns + +2. **Analyze upstream changes:** + - Review release notes for target version + - Identify breaking changes and new features + - Note security fixes and critical updates + - Assess Windows-specific impact + +3. **Review historical context:** + - Examine previous merge PRs for patterns + - Identify recurring conflict areas + - Note Windows-specific workarounds from past merges + - Document lessons learned from previous merges + +**Success Criteria:** +- All merge instructions read and understood +- Upstream changes analyzed and documented +- Ready to proceed with environment setup + +### Phase 1: Pre-Merge Setup +**Objective:** Verify environment and establish baseline + +**Steps:** +1. **Run prerequisite verification via MCP tool:** + - **MCP Tool Name**: `mcp_openssh-server_Test_MergePrerequisites` + - **Parameters**: + - `TargetVersion` (string, required): Upstream version/tag to start from (e.g., "V_10_0_P2") + - `EndCommit` (string, optional): Commit SHA to end at (default: HEAD - most recent upstream commit) + - `SkipBaselineBuild` (boolean, optional): Skip baseline build check (default: false) + + This single tool verifies: + - Git, PowerShell, Visual Studio are available + - Repository remotes are configured (origin, upstream, upstream-pwsh) + - Target version/tag exists in upstream + - Working directory is clean (no uncommitted changes) + - Baseline build passes from current branch + - First commit batch is identified + +2. **Proceed only if tool reports success:** + - Tool must return `Success: true` + - Tool must display "ALL PREREQUISITES MET" + - If tool fails, fix reported issues before continuing + +3. **Establish baseline warning count:** + - **MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHBuild` + - **Parameters**: `Configuration="Release"`, `Architecture="x64"` + - Parse and document the current warning count and categories + - This baseline will be used to detect new warnings introduced during merge + - Store baseline for comparison after each build + +4. **Enable git rerere** (records conflict resolutions for automatic replay): + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Config", Key="rerere.enabled", Value="true" + ``` + +5. **Create merge branch and scratch branch:** + ```pwsh + # Create the real merge branch (will receive the final single merge) + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="CreateBranch", Branch="merge-v-" + # Example: Branch="merge-v10.0P2-20260109" + + # Create the scratch branch from the same point (for incremental merges) + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="CreateBranch", Branch="scratch-merge-v-" + ``` + +**Success Criteria:** +- Prerequisite tool reports all checks passed +- Baseline warning count established and documented +- `rerere.enabled` set to `true` +- Both merge branch and scratch branch created +- Currently on the scratch branch +- Ready to begin Phase 2 (scratch-branch incremental merge) + +### Phase 2: Scratch Branch — Incremental Merge +**Objective:** Merge commits in batches on the scratch branch, recording every conflict resolution for later replay. + +The scratch branch uses `git merge` (not cherry-pick) at each batch boundary. This ensures conflict markers match the final single merge, maximising `git rerere` hit rate. + +**Steps:** +1. **Get first commit batch** using Get-CommitGroups MCP tool: + - **MCP Tool Name**: `mcp_openssh-server_Get_CommitGroups` + - **Parameters**: + - For first batch: `GitHubTag="V_10_0_P2"`, `EndCommit=""`, `FirstChunkOnly=true`, `GroupByCIPresence=true` + - For subsequent batches: `StartCommit=""`, `EndCommit=""`, `FirstChunkOnly=true`, `GroupByCIPresence=true` + - **Note**: If `EndCommit` is not specified, the tool will merge up to the most recent upstream commit (HEAD) + + **The tool returns structured data:** + ```json + { + "ChunkNumber": 1, + "StartCommit": "609fe2c", + "EndCommit": "6fb728d", + "StartCommitFull": "609fe2cae2459d721ac11d23cd27b8a94397ef3c", + "EndCommitFull": "6fb728df50c1afd338cb0223a84ce24579577eff", + "CommitCount": 12, + "StartMessage": "upstream: rework the text for -3 to make it clearer", + "EndMessage": "Run all tests on Cygwin again." + } + ``` + +2. **Display batch information** for verification. + +3. **Merge the batch endpoint:** + ```pwsh + # Merge all commits up to the batch endpoint + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Merge", CommitHash=$result.EndCommitFull + ``` + This brings in all commits from the previous merge point through `EndCommitFull` in a single merge. The `--no-ff` flag ensures a merge commit is always created. + +4. **If conflicts occur, resolve and record each one:** + - For each conflicted file reported in the merge result's `ConflictedFiles`: + a. Resolve the conflict following Windows preservation patterns + b. **Record the resolution** using Save-MergeResolution: + ```pwsh + # MCP Tool: mcp_openssh-server_Save_MergeResolution + # FilePath="", Strategy="", Rationale="", + # BatchNumber=, UpstreamCommits="" + # (On first call, also set MergeTarget="upstream/") + ``` + c. Stage the resolved file: `Invoke-Git Operation="Add" Path=""` + - `git rerere` will also automatically record the resolution. + +5. **Complete the merge:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="MergeContinue" + ``` + +**Conflict Resolution Patterns:** +- **Windows-specific code:** Preserve with `#ifdef WINDOWS` +- **Removed featureand Validation +**Objective:** Build successfully and validate if CI was successful + +**MANDATORY:** Build after each commit batch before proceeding to next batch. + +**Steps:** +1. **Build the merged code:** + - **MCP Tool Name**: `mcp_openssh-server_Start_OpenSSHBuild` + - **Parameters**: `Configuration="Release"`, `Architecture="x64"` + +2. **If build fails, fix compilation errors:** + - Document all compilation errors from build output + - Fix source code issues (add Windows compatibility defines, update function signatures, add platform guards) + - Update Visual Studio project files (add/remove source files, create projects for new binaries) + - Rebuild until successful + - Commit build fixes with detailed description + +3. **Check if batch ended with successful CI:** + - Inspect the chunk's end commit CI status from Get-CommitGroups output + - Look for commits ending with `CIStatus: "success"` in the detailed output + +4. **If CI was successful, run validation tests:** + - **MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHFunctionality` + - **Parameters**: (use defaults for Release/x64) + + This test installs service, creates test user, validates SSH connectivity. + If tests fail, fix issues and commit fixes. + **Do not proceed** to next batch until tests pass. + +5. **If CI was not successful (or no CI), skip validation:** + - Build success is sufficient to proceed + - Validation will be performed at next successful CI checkpoint + +**Common Build Fixes:** +- Missing source files in .vcxproj files +- Removed files still referenced in projects +- Missing function implementations (add to win32compat) + +**Success Criteria:** +- Clean build with no errors +- All expected binaries generated +- If batch had successful CI: validation tests pass +- If batch had no/failed CI: build success is sufficient + +### Phase 4: Summary and Approval +**Objective:** Summarize changes and get approval before proceeding + +**MANDATORY:** Before proceeding to the next commit batch, provide summary and wait for user approval. + +**Steps:** +1. **Generate batch summary:** + ```markdown + ## Batch Completion Summary + + **Batch:** [StartCommit]..[EndCommit] ( commits) + **End Commit CI Status:** + + ### Changes in this Batch: + - + - + - + + ### Conflicts Resolved: + - : + - : + + ### Build Status: + - Build: ✅ Success / ❌ Failed + - Build fixes applied: + + ### Validation Status: + - Validation tests: ✅ Passed / ⏭️ Skipped (no successful CI) / ❌ Failed + - Test fixes applied: + + ### Next Steps: + - Next batch will start from commit: + - Estimated remaining batches: + + **Ready to proceed to next batch?** + ``` + +2. **Wait for user response:** + - User responds "yes" / "continue" / "proceed" → Continue to Phase 5 + - User responds "no" / "stop" / "wait" → Pause and await further instructions + - User provides feedback → Address concerns and re-summarize + +**Success Criteria:** +- Summary provided with all required information +- User approval received to proceed + +### Phase 5: Scratch Branch Iteration +**Objective:** Process remaining commit batches on the scratch branch until all upstream commits are merged. + +**Steps:** +1. **Return to Phase 2** with `-StartCommit` set to previous batch's end commit and `-EndCommit` set to target end commit +2. **Repeat Phases 2-4** for each batch: + - Get next batch with Get-CommitGroups (passing both StartCommit and EndCommit) + - Merge batch endpoint (`Invoke-Git Merge`) + - Resolve conflicts and record with Save-MergeResolution + - Build (mandatory) + - Validate (if batch ends with successful CI) + - Summarize and get approval +3. **Continue** until the target end commit is reached (or HEAD if no end commit was specified) +4. **Final scratch-branch validation:** + - **MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHFunctionality` + - **Parameters**: (use defaults for Release/x64) + +**Success Criteria:** +- All commit batches processed on scratch branch +- Build remains stable after each batch +- All successful CI checkpoints validated +- Resolution log (`.git/merge-resolution-log.json`) contains all conflict resolutions +- Ready to proceed to real-branch single merge + +### Phase 6: Real Branch — Single Merge +**Objective:** Produce clean history on the real merge branch with a single merge commit preserving all upstream SHAs. + +**Steps:** +1. **Switch to the real merge branch:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Checkout", Target="merge-v-" + ``` + +2. **Perform a single merge** of the final upstream target: + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Merge", CommitHash="" + ``` + This creates one merge commit. `git rerere` will automatically apply resolutions it recorded during the scratch phase. + +3. **Replay remaining resolutions** from the log: + ```pwsh + # MCP Tool: mcp_openssh-server_Replay_MergeResolutions + # (no parameters needed — reads from .git/merge-resolution-log.json) + ``` + The tool reports: + - `ResolvedFiles`: Files auto-resolved from the log + - `UnmatchedFiles`: Conflicted files not in the log (resolve manually) + - `FailedFiles`: Files where replay failed (resolve manually) + +4. **Resolve any remaining unmatched conflicts:** + - Use the resolution log's strategies and rationale as guidance + - These are typically files where the merge produced different conflict regions than the scratch-branch merge + +5. **Complete the merge:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="MergeContinue" + ``` + +6. **Apply build fixes** as separate commits after the merge commit: + - Review build fixes from the scratch branch + - Apply the same fixes (config.h.vs updates, .vcxproj changes, etc.) + - Commit with descriptive messages + - **CRITICAL: Restore paths.targets before committing:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Checkout", Target=".\contrib\win32\openssh\paths.targets" + ``` + +7. **Build and validate on the real branch:** + - Build: `mcp_openssh-server_Start_OpenSSHBuild` (Release/x64) + - Check warnings: `mcp_openssh-server_Test_OpenSSHBuild` + - Validate: `mcp_openssh-server_Test_OpenSSHFunctionality` + +8. **Clean up scratch branch:** + ```pwsh + # The scratch branch is no longer needed + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Checkout", Target="merge-v-" + # Then delete scratch: git branch -D scratch-merge-v- + ``` + +**Success Criteria:** +- Real branch has exactly one merge commit (plus build fix commits) +- All upstream commits appear in the DAG with original SHAs +- `git log --first-parent` shows a clean merge history +- Build succeeds and functionality tests pass +- Scratch branch deleted + +### Phase 7: Documentation and PR +**Objective:** Document changes and submit for review + +**Steps:** +1. Review all merge commits for clarity +2. Document major conflict resolutions +3. Note any Windows-specific changes +4. Push branch: `git push origin merge-v-` +5. Create PR with comprehensive description +6. Add labels and request reviewers + +**PR Description Template:** +```markdown +## Merge OpenSSH + +This PR merges upstream OpenSSH commits from through . + +### Commit Groups +- Batch 1: to ( commits) +- Batch 2: to ( commits) +... + +### Major Changes +- [List significant upstream changes] + +### Windows-Specific Resolutions +- [List Windows compatibility fixes] +- [List build system updates] + +### Testing +- [x] Builds successfully (x64) +- [x] Service starts and runs +- [x] SSH connections work +- [x] Basic operations verified + +### Known Issues +- [List any known limitations or issues] +``` + +**Success Criteria:** +- PR created with complete description +- All CI checks passing +- Reviewers assigned + +## Decision Points + +### When to Use Commit Groups +- **High complexity merge:** >100 commits, significant changes +- **Medium complexity merge:** 50-100 commits, moderate changes +- **Low complexity merge:** <50 commits, minor changes → single merge OK + +### Conflict Resolution Strategy +**Always preserve:** +- Windows-specific functionality in `#ifdef WINDOWS` blocks +- Security fixes from upstream +- Build system integrity + +**Accept upstream for:** +- Removed deprecated features (e.g., DSA) +- Algorithm updates +- API modernization + +**Combine when:** +- Both sides add different functionality +- Windows needs additional compatibility code +- Upstream changes affect Windows-specific code + +## Key Files to Monitor + +### Frequently Modified +- `config.h` / `config.h.vs` - Configuration defines +- `*.vcxproj` - Visual Studio project files +- `contrib/win32/win32compat/*` - Windows compatibility layer + +### Conflict Hotspots +- Authentication code (`auth*.c`) +- Platform-specific code (`platform*.c`) + +## Recovery Procedures + +### Abort Merge +```bash +git merge --abort +git clean -fd +git reset --hard +``` + +### Abort Cherry-Pick (if used outside merge workflow) +```bash +git cherry-pick --abort +git clean -fd +git reset --hard +``` + +### Restart Scratch Branch +```bash +# Delete the scratch branch and recreate from the merge branch +git checkout merge-v- +git branch -D scratch-merge-v- +git checkout -b scratch-merge-v- +# Re-enable rerere if needed +git config rerere.enabled true +``` + +### Restart from Checkpoint +```bash +git checkout merge-v- +git log --oneline -5 # Verify last successful state +# Continue from there (or recreate scratch branch) +``` + +### Build Failure Recovery +1. Check build log: `contrib\win32\openssh\OpenSSHReleasex64.log` +2. Search for "error C" or "error LNK" +3. Fix errors in order (compilation before linking) +4. Commit fixes separately for clarity + +## Best Practices + +### Commit Organization +- One logical fix per commit +- Clear commit messages explaining Windows-specific changes +- Reference upstream commit SHAs when applicable + +### Testing Between Batches +- Build after each batch +- Quick smoke test (service start, simple connection) +- Full test only after all batches complete + +### Documentation +- Comment complex conflict resolutions in code +- Note Windows-specific workarounds +- Link to upstream issues/PRs when relevant + +## Success Metrics +- ✅ All commits from target range merged +- ✅ Clean build with no warnings +- ✅ All tests passing +- ✅ SSH service functional +- ✅ PR approved and merged +- ✅ No regressions reported in first 48 hours + +## Reference Links + +### Repository Links +- [Upstream OpenSSH](https://github.com/openssh/openssh-portable) +- [PowerShell Fork](https://github.com/PowerShell/openssh-portable) + +### Instruction Documents (Phase 0 Required Reading) +- [Merge Process Overview](../instructions/merge/merge-process-overview.instructions.md) +- [Research Instructions](../instructions/merge/research.instructions.md) +- [Merge Details Instructions](../instructions/merge/merge-details.instructions.md) + +### Additional Instructions +- [Build Instructions](../instructions/build.instructions.md) +- [Setup Instructions](../instructions/setup.instructions.md) +- [Testing Instructions](../instructions/testing.instructions.md) diff --git a/.github/ci-status.md b/.github/ci-status.md index 68275715dfb1..d47e59e1e5ea 100644 --- a/.github/ci-status.md +++ b/.github/ci-status.md @@ -6,6 +6,10 @@ master : [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh) [![Coverity Status](https://scan.coverity.com/projects/21341/badge.svg)](https://scan.coverity.com/projects/openssh-portable) +10.0 : +[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_10_0)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_10_0) +[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_10_0)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_10_0) + 9.9 : [![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_9_9)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_9) [![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_9)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_9) diff --git a/.github/instructions/agent-communication.instructions.md b/.github/instructions/agent-communication.instructions.md new file mode 100644 index 000000000000..eb5242163023 --- /dev/null +++ b/.github/instructions/agent-communication.instructions.md @@ -0,0 +1,139 @@ +--- +applyTo: "**/*" +--- + +# AI Agent Communication Guidelines + +## Overview +This document establishes how AI agents should communicate with users throughout their interactions. These guidelines apply to **all agent operations** in this workspace. For merge-specific communication templates, see [agent-communication-merge.instructions.md](./merge/agent-communication-merge.instructions.md). + +## Core Principle: Tool Output vs Agent Communication + +### Distinction + +**1. MCP Tool Execution (Write-Host is acceptable):** +- When MCP tools execute PowerShell scripts, those scripts may use `Write-Host` for output +- This is normal and expected behavior for the tool itself +- The agent receives this output and can parse it +- Example: `Test-OpenSSHFunctionality.ps1` uses `Write-Host` to display test progress + +**2. Agent-to-User Communication (Use chat messages ONLY):** +- AI agents **MUST** communicate with users through chat messages, not `Write-Host` +- **DO NOT** invoke `Write-Host` or other console output commands from the agent +- Instead, present information conversationally in your responses +- Parse tool output and summarize it in chat messages + +## Communication Standards + +### ❌ INCORRECT: Agent Using Write-Host +```pwsh +Write-Host "Starting merge process..." +Write-Host "Build succeeded!" -ForegroundColor Green +Write-Host "Found 3 conflicts in auth.c" +``` + +### ✅ CORRECT: Agent Using Chat Messages +``` +Starting the merge process. I'll cherry-pick the commits in this batch and then build. + +The build succeeded! All 14 executables were created successfully. + +Found 3 conflicts in auth.c. Analyzing the conflict types to determine the resolution strategy. +``` + +## Pseudocode Implementation Guidance + +When you see pseudocode functions in instruction files like: +- `update_progress()` +- `generate_test_report()` +- `log()` +- `append_to_progress_log()` + +These represent **conceptual operations**. Implement them by: +1. Generating the information/report internally +2. Communicating the results to the user via chat messages +3. **NOT** by executing `Write-Host` or similar PowerShell output commands + +### Example: Pseudocode to Implementation + +**Pseudocode:** +```pseudocode +FUNCTION update_progress(phase, status, details): + log(f"Phase {phase}: {status}") + IF status == "FAILURE": + generate_failure_report(details) +``` + +**Correct Agent Implementation:** +``` +[Agent analyzes the phase and status] +[Agent sends chat message]: "Phase 1: Conflict Resolution - Completed successfully. Resolved 5 conflicts across 3 files." +``` + +**Incorrect Agent Implementation:** +```pwsh +Write-Host "Phase 1: Conflict Resolution - Completed successfully" +``` + +## Best Practices + +### 1. Be Conversational +- Write naturally, as if speaking to a colleague +- Avoid overly formal or robotic language +- Use active voice + +### 2. Provide Context +- Explain what you're doing and why +- Help users understand the current state +- Highlight important information + +### 3. Use Structured Formatting When Helpful +- Use markdown formatting for clarity +- Use bullet points for lists +- Use code blocks for commands or file paths +- Use file links when referencing specific files + +### 4. Progressive Disclosure +- Start with high-level summaries +- Provide details when relevant +- Don't overwhelm with unnecessary information + +### 5. Clear Status Indicators +Use clear language for status: +- ✅ "succeeded", "completed successfully", "passed" +- ❌ "failed", "encountered errors", "did not pass" +- ⚠️ "warning", "requires attention", "partial success" + +## Examples + +### Good: Progress Update +``` +Analyzing the upstream changes between the last merge commit and V_10_0_P2. Found 127 commits with 8 security fixes and 3 build system changes that will require Visual Studio project updates. +``` + +### Good: Error Report +``` +The build failed with 4 compilation errors: +- auth.c: Missing include for Windows compatibility header +- sshd.c: Undefined reference to fork() - needs Windows equivalent +- config.h.vs: Missing preprocessor definition for HAVE_SETRESUID + +I'll add the Windows compatibility fixes now. +``` + +### Good: Success Report +``` +Testing completed successfully! The SSH service installed, started, and accepted connections. The test command executed correctly with expected output. +``` + +## Merge-Specific Guidelines + +For detailed merge workflow communication templates, including exact formats for tool output summaries and commit batch summaries, see: +- [Merge-Specific Agent Communication Guidelines](./merge/agent-communication-merge.instructions.md) + +## Summary + +- **Tools can use Write-Host** - MCP tools and PowerShell scripts may output to console +- **Agents use chat only** - All agent communication must be via chat messages +- **Parse, don't echo** - Parse tool output and present summaries conversationally +- **Be clear and helpful** - Provide context, use formatting, and communicate status clearly diff --git a/.github/instructions/build.instructions.md b/.github/instructions/build.instructions.md new file mode 100644 index 000000000000..fd2a73856920 --- /dev/null +++ b/.github/instructions/build.instructions.md @@ -0,0 +1,364 @@ +--- +applyTo: "**/*" +--- + +# Build Instructions for AI Agents + +## Overview +This document provides comprehensive build instructions for OpenSSH-Portable on Windows, specifically tailored for AI agents performing upstream merges. + +## Prerequisites Verification + +### Check Required Tools +```pwsh +# Verify PowerShell version +$PSVersionTable.PSVersion + +# Verify Visual Studio installation +Get-ChildItem "C:\Program Files*\Microsoft Visual Studio\*\*\MSBuild\Current\Bin\msbuild.exe" + +# Verify Windows SDK +Get-ChildItem "C:\Program Files*\Windows Kits\10\bin" -Directory + +# Verify Git +git --version +``` + +## Build Process + +### Using MCP Build Tools (Recommended) + +The repository includes MCP tools that automate the build and error analysis process. + +#### Build +Use the Start-OpenSSHBuild MCP tool: +- **MCP Tool Name**: `mcp_openssh-server_Start_OpenSSHBuild` +- **Parameters**: + - `Configuration` (optional): "Debug" or "Release" (default: "Release") + - `Architecture` (optional): "x64", "x86", "ARM", "ARM64" (default: "x64") + - `Clean` (optional): Perform clean build (default: false) + +**Examples:** +- Incremental build: `Configuration="Release"`, `Architecture="x64"` +- Clean build: `Configuration="Release"`, `Architecture="x64"`, `Clean=true` + +#### Test Existing Build (on failure only) +Use the Test-OpenSSHBuild MCP tool when a build fails: +- **MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHBuild` +- **Parameters**: `Configuration="Release"`, `Architecture="x64"` + +## Compiler Warning Policy + +### Overview +All new compiler warnings introduced during the merge process must be reported to users and require approval before proceeding. This ensures code quality is maintained and potential issues are not overlooked. + +### Baseline Establishment +1. **Before starting the merge**, establish a baseline warning count: + - Run Test-OpenSSHBuild on the current branch (before any merge commits) + - Document the total warning count and warning categories + - Store this as the baseline for comparison + +2. **After each build during merge**, compare warnings against baseline: + - Run Test-OpenSSHBuild after every successful build (not just failures) + - Compare current warning count to baseline + - Identify any new warnings introduced + +### Warning Categorization +Attempt to categorize warnings to help users make informed decisions: + +**Common Warning Categories:** +- **Deprecated APIs**: Use of functions/APIs marked as deprecated +- **Type Conversions**: Implicit type conversions that may lose data +- **Unused Variables/Functions**: Declared but unused code elements +- **Potential Bugs**: Logic issues that may cause runtime problems +- **Security-Related**: Potential security vulnerabilities (buffer overruns, etc.) +- **Platform-Specific**: Windows-specific compatibility warnings + +**Note:** Categorization helps users make decisions, but **all new warnings require user approval regardless of predicted severity**. + +### User Approval Requirement +**Critical Rule**: No threshold - every new warning requires user input. + +1. **When new warnings are detected:** + - Report warning count delta (baseline vs current) + - List each new warning with: + - File and line number + - Warning code and message + - Attempted category classification + - Request user decision: fix warnings or proceed as-is + +2. **User must explicitly approve:** + - Fixing warnings before continuing + - Proceeding with warnings (acknowledging they will remain) + - Do NOT automatically proceed if new warnings appear + +3. **Update baseline if user approves proceeding:** + - If user approves proceeding with new warnings, update baseline + - This prevents re-reporting the same warnings in subsequent batches + +## Compilation Error Resolution + +### Common Error Categories + +#### 1. Missing Preprocessor Definitions +**Symptoms:** +``` +error C2065: 'SOME_DEFINE': undeclared identifier +``` + +**Resolution:** +```pwsh +# Edit config.h.vs file +notepad .\contrib\win32\openssh\config.h.vs + +# Add missing definitions (example) +#define SOME_DEFINE 1 +``` + +#### 2. Missing Windows Equivalents +**Symptoms:** +``` +error C3861: 'fork': identifier not found +error C3861: 'signal': identifier not found +``` + +**Resolution Pattern:** +```c +// In source file, add Windows compatibility +#ifdef WINDOWS + // Use Windows equivalent or win32compat function + HANDLE process = CreateProcess(...); +#else + // Original Unix code + pid_t pid = fork(); +#endif +``` + +#### 3. Build System Inconsistencies +**Symptoms:** +``` +error MSB3073: The command exited with code 1 +fatal error C1083: Cannot open source file: 'newfile.c' +``` + +**AI Agent Resolution Process:** +1. **Check Makefile changes:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Diff", Range="upstream-pwsh/latestw_all..upstream/", Path="Makefile.in" + ``` + +2. **Identify new/removed source files:** + ```bash + # Look for patterns like: + # ssh_SOURCES = ssh.c readconf.c clientloop.c sshtty.c \ + # sshconnect.c sshconnect2.c mux.c newfile.c + ``` + +3. **Update Visual Studio projects:** + ```xml + + + ``` + + **Important:** Visual Studio project files (`.vcxproj`) use Windows-style line endings (`\r\n`). When programmatically adding lines to these files, ensure you use `\r\n` instead of just `\n` to maintain consistency with the existing file format. This prevents Git from showing the entire file as changed. + +4. **Update solution if new binaries added:** + ``` + # Check for new programs in Makefile: + # bin_PROGRAMS = ssh sshd ssh-add ssh-keygen ssh-keyscan ssh-copy-id scp sftp sftp-server ssh-pkcs11-helper ssh-sk-helper ssh-agent new-binary + ``` + +### Step-by-Step Error Resolution + +#### AI Agent Workflow: +1. **Run the build** + - Use: **Start-OpenSSHBuild** — `mcp_openssh-server_Start_OpenSSHBuild` with `Configuration` and `Architecture`. +2. **If build succeeded**, skip log parsing and proceed. +3. **If build failed**, **parse errors** using **Test-OpenSSHBuild** — `mcp_openssh-server_Test_OpenSSHBuild`. +4. **Categorize error types** (preprocessor, Windows compatibility, build system). +5. **Apply appropriate resolution strategy** (see error categories above) and **rebuild** with Start-OpenSSHBuild. +6. **CRITICAL: Before committing, restore paths.targets**: + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Checkout", Target=".\contrib\win32\openssh\paths.targets" + ``` +7. **Commit fixes with detailed message** (only actual code changes, not paths.targets). + +#### Reading Build Logs and Errors (on failure only) +Use the **Test-OpenSSHBuild** MCP tool to read build logs and parse errors **only when the build fails**: +- **MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHBuild` +- **Parameters**: `Configuration="Release"`, `Architecture="x64"` + +**Why use this tool:** +- Automatically locates and parses the build log file +- Provides structured error output with file paths, codes, and messages +- Groups errors and warnings for easier analysis +- Works reliably in MCP context where direct file reading may not be available + +**DO NOT** attempt to read log files directly with `Get-Content` or similar commands. +**DO NOT** try to locate log files manually. + +### Build Tools Invocation Policy + +- Use `Start-OpenSSHBuild.ps1` to run the build for each chunk/batch. +- **ALWAYS invoke `Test-OpenSSHBuild.ps1` after every build** (success or failure): + - On build failure: Parse errors and warnings to fix issues + - On build success: Parse warnings to compare against baseline +- Compare warning count against established baseline +- If new warnings detected, report to user and request approval before proceeding +- Do NOT skip `Test-OpenSSHBuild.ps1` even when build succeeds - warning checks are mandatory. + +#### Alternative: Direct MSBuild (Terminal Only) +Only use this when running directly in a terminal (not via MCP): +```pwsh +& "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin\MSBuild.exe" .\contrib\win32\openssh\Win32-OpenSSH.sln /p:Configuration=Release /p:Platform=x64 /v:detailed +``` + +### Important Note: paths.targets File Modification + +**The build process automatically modifies `.\contrib\win32\openssh\paths.targets`** to update SDK version paths based on the currently installed Windows SDK. This is normal and expected behavior. + +**Before committing any changes:** +```pwsh +# Check if paths.targets was modified by the build: +# MCP Tool: mcp_openssh-server_Invoke_Git +# Operation="Status" +# Check if paths.targets appears in result.ModifiedFiles + +# If it shows as modified, restore it to a clean state: +# MCP Tool: mcp_openssh-server_Invoke_Git +# Operation="Checkout", Target=".\contrib\win32\openssh\paths.targets" +``` + +**Why this happens:** +- MSBuild automatically updates SDK paths to match your local environment +- These changes are environment-specific and should not be committed +- The file will be modified on every build + +**AI Agent Workflow (CRITICAL):** +1. **ALWAYS restore paths.targets before committing**: + ```pwsh + # This MUST be done before every commit + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Checkout", Target=".\contrib\win32\openssh\paths.targets" + ``` +2. Only commit actual code changes, not build-generated path updates +3. Verify with Invoke-Git `Operation="Status"` that paths.targets is not in `ModifiedFiles` before committing + +## Project File Management + +### Understanding the Project Structure +``` +contrib\win32\openssh\ +├── Win32-OpenSSH.sln # Main solution file +├── libssh.vcxproj # Core SSH library +├── ssh.vcxproj # SSH client +├── sshd.vcxproj # SSH server listener handling +├── sshd-auth.vcxproj # SSH server authentication handling +├── sshd-session.vcxproj # SSH server session handling +├── ssh-add.vcxproj # Key agent utility +├── ssh-agent.vcxproj # Authentication agent +├── ssh-keygen.vcxproj # Key generation utility +├── ssh-keyscan.vcxproj # Key scanning utility +└── ssh-pkcs11-helper.vcxproj # SSH PKCS11 helper +└── ssh-shell-host.vcxproj # SSH shell host +└── ssh-sk-helper.vcxproj # SSH SK helper +├── scp.vcxproj # Secure copy +├── sftp.vcxproj # Secure file transfer client +└── sftp-server.vcxproj # Secure file transfer server +``` + +### Adding New Projects (AI Agent Process) +1. **Identify new binary in Makefile:** + ```bash + grep "bin_PROGRAMS\|sbin_PROGRAMS" Makefile.in + ``` + +2. **Check Windows applicability:** + ```bash + # Skip Unix-only binaries like ssh-keysign + # Include utilities that work on Windows + ``` + +3. **Create new project file:** + ```pwsh + # Copy existing similar project + Copy-Item ssh.vcxproj ssh-newutil.vcxproj + ``` + +4. **Update project references:** + ```xml + + + ssh-newutil + ssh-newutil + + ``` + +5. **Add to solution:** + ``` + # Edit Win32-OpenSSH.sln to include new project + ``` + +**Important Note on Line Endings:** +Both `.vcxproj` and `.sln` files use Windows-style line endings (`\r\n`). When programmatically modifying these files: +- Use `\r\n` instead of `\n` when inserting new lines +- Maintain consistent line endings to avoid Git showing spurious changes +- Example in PowerShell: `$newLine = "`r`n"` +- Example in Python: `new_line = "\r\n"` + +## Validation and Testing + +### Build Verification Using MCP Tools +```pwsh +Use the Start-OpenSSHBuild MCP tool (recommended): +- **MCP Tool Name**: `mcp_openssh-server_Start_OpenSSHBuild` +- **Parameters**: `Configuration="Release"`, `Architecture="x64"` + +If the build fails, parse errors with: +- **MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHBuild` +- **Parameters**: `Configuration="Release"`, `Architecture="x64"` +**Expected Output (on failure):** +- Build failure status +- Parsed errors and warnings +- Build log location +``` +**Expected Artifacts (14 executables):** +- ssh.exe, sshd.exe, sshd-auth.exe, sshd-session.exe +- ssh-agent.exe, ssh-add.exe, ssh-keygen.exe, ssh-keyscan.exe +- scp.exe, sftp.exe, sftp-server.exe +- ssh-pkcs11-helper.exe, ssh-shellhost.exe, ssh-sk-helper.exe + +### Quick Functionality Test +```pwsh +# Verify version reporting +& ".\contrib\win32\openssh\x64\Release\ssh.exe" -V +``` + +## Troubleshooting Guide + +### Build Helper Module Issues +```pwsh +# Force reload module +Remove-Module OpenSSHBuildHelper -Force -ErrorAction SilentlyContinue +Import-Module .\contrib\win32\openssh\OpenSSHBuildHelper.psm1 -Force +``` + +### Path and Environment Issues +```pwsh +# Verify Visual Studio environment +& "${env:ProgramFiles}\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat" + +# Check MSBuild path +where.exe msbuild +``` + +### Permission Issues +```pwsh +# Ensure running as Administrator if needed +if (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) +{ + Write-Warning "Build may require Administrator privileges" +} +``` diff --git a/.github/instructions/getting-started.instructions.md b/.github/instructions/getting-started.instructions.md new file mode 100644 index 000000000000..d4f064517e42 --- /dev/null +++ b/.github/instructions/getting-started.instructions.md @@ -0,0 +1,28 @@ +### 🔧 General Repository Instructions +These instructions apply to any task involving the OpenSSH-Portable repository: + +- **[repository-overview.instructions.md](./repository-overview.instructions.md)** - Repository structure and Windows compatibility layer overview +- **[setup.instructions.md](./setup.instructions.md)** - Repository setup and environment configuration +- **[build.instructions.md](./build.instructions.md)** - Compilation procedures and error resolution +- **[testing.instructions.md](./testing.instructions.md)** - Validation and testing procedures + +### 🔀 Upstream Merge Task Instructions +These instructions are specific to performing upstream merges from openssh/openssh-portable: + +- **[merge/merge-process-overview.instructions.md](./merge/merge-process-overview.instructions.md)** - Primary merge workflow and process overview +- **[merge/merge-details.instructions.md](./merge/merge-details.instructions.md)** - Detailed conflict resolution strategies and patterns +- **[merge/research.instructions.md](./merge/research.instructions.md)** - Intelligence gathering and analysis procedures + +## Quick Start Guide + +### For Human Developers +1. Read [merge/merge-process-overview.instructions.md](./merge/merge-process-overview.instructions.md) for complete merge workflow overview +2. Follow phase-by-phase process +3. Reference general repository instructions ([setup](./setup.instructions.md), [build](./build.instructions.md), [testing](./testing.instructions.md)) as needed + +### For AI Agents +1. **Start here:** [merge/merge-process-overview.instructions.md](./merge/merge-process-overview.instructions.md) +2. **Understand the repository:** Review general instructions for setup, build, and testing procedures +3. **Follow systematic approach:** Check off each merge item before proceeding +4. **Use automation:** Leverage provided scripts in `tools/` directory +5. **Escalate if needed:** Document blockers and seek human guidance when complexity exceeds capabilities diff --git a/.github/instructions/merge/agent-communication-merge.instructions.md b/.github/instructions/merge/agent-communication-merge.instructions.md new file mode 100644 index 000000000000..80aa273e2ab9 --- /dev/null +++ b/.github/instructions/merge/agent-communication-merge.instructions.md @@ -0,0 +1,425 @@ +--- +applyTo: ".github/instructions/merge/**" +--- + +# Merge-Specific Agent Communication Guidelines + +## Overview +This document provides specific communication templates and guidelines for AI agents performing upstream merge operations. These guidelines **supplement** the high-level agent communication principles defined in [agent-communication.instructions.md](../agent-communication.instructions.md). + +**Key Points:** +- The high-level communication guidelines apply to ALL merge interactions +- This document adds merge-specific templates and formats +- Tool output templates are **MUST use** (exact format required) +- Batch summary templates are **SHOULD include** (flexible adaptation allowed) + +## MCP Tool Output Templates + +These templates define the **exact format** agents MUST use when communicating tool results to users. + +### 1. Start-OpenSSHBuild Tool Output + +**MUST use this format when reporting build results.** + +#### Success Scenario: +``` +Build completed successfully. All 14 executables were created: +- ssh.exe, sshd.exe, sshd-auth.exe, sshd-session.exe +- ssh-agent.exe, ssh-add.exe, ssh-keygen.exe, ssh-keyscan.exe +- scp.exe, sftp.exe, sftp-server.exe +- ssh-pkcs11-helper.exe, ssh-shellhost.exe, ssh-sk-helper.exe + +Configuration: Release | Architecture: x64 +``` + +#### Failure Scenario: +``` +Build failed with compilation errors. Analyzing the build log to identify issues. + +[After running Test-OpenSSHBuild] +Found X compilation errors: +- [file.c]: [brief error description] +- [file.c]: [brief error description] + +I'll resolve these errors now. +``` + +#### Success with New Warnings Scenario: +**MUST use this format when build succeeds but new warnings are detected.** + +``` +Build completed successfully. All 14 executables were created. + +However, new compiler warnings have been introduced: + +Baseline: X warnings → Current: Y warnings (ΔZ new warnings) + +New Warnings Detected: + +**Deprecated APIs (2):** +- [auth.c] (Line 145): C4996 - 'strcpy': This function may be unsafe. Consider using strcpy_s instead. +- [sshd.c] (Line 302): C4996 - 'GetVersion': was declared deprecated + +**Type Conversions (1):** +- [channels.c] (Line 89): C4244 - Conversion from 'size_t' to 'int', possible loss of data + +**Analysis:** +These warnings appear to be introduced by upstream changes. The deprecated API warnings may require Windows-specific alternatives, and the type conversion should be reviewed for potential data loss. + +How would you like to proceed? +1. Fix these warnings before continuing +2. Proceed with warnings (will update baseline) + +Please advise. +``` + +### 2. Test-OpenSSHBuild Tool Output + +**MUST use this format when reporting build error analysis.** + +#### When Build Failed: +``` +Build error analysis complete: + +Compilation Errors (X): +- [filename.c] (Line Y): [Error code] - [Brief description] +- [filename.c] (Line Y): [Error code] - [Brief description] + +Warnings (X): +- [filename.c] (Line Y): [Warning description] + +Error Categories: +- Missing preprocessor definitions: X +- Windows compatibility issues: X +- Build system inconsistencies: X +``` + +#### When Build Succeeded with No New Warnings: +``` +Build analysis complete: + +Compilation Errors: 0 +Warnings: X (no change from baseline) + +No new warnings introduced. Build is clean. +``` + +#### When Build Succeeded with New Warnings: +``` +Build analysis complete: + +Compilation Errors: 0 + +Warnings Comparison: +- Baseline: X warnings +- Current: Y warnings +- New warnings: Z + +New Warnings by Category: + +**Deprecated APIs (2):** +- [auth.c] (Line 145): C4996 - 'strcpy': This function may be unsafe +- [sshd.c] (Line 302): C4996 - 'GetVersion': was declared deprecated + +**Type Conversions (1):** +- [channels.c] (Line 89): C4244 - Conversion from 'size_t' to 'int' + +**Potential Bugs (0)** +**Security-Related (0)** +**Platform-Specific (0)** + +These new warnings require user approval before proceeding. +``` + +**Note:** ALWAYS invoke Test-OpenSSHBuild after every build to check for warnings, not just on failure. + +### 3. Test-OpenSSHFunctionality Tool Output + +**MUST use this format when reporting functionality test results.** + +#### Success Scenario: +``` +Functionality testing completed successfully! + +Test Results: +✅ Administrator privileges verified +✅ Test user created: [username] +✅ SSH service installed successfully +✅ SSH service started successfully +✅ Firewall rule configured +✅ SSH connection test passed +✅ Command execution verified: "echo hello world" returned expected output + +All test resources cleaned up. +``` + +#### Failure Scenario: +``` +Functionality testing failed. + +Test Progress: +✅ Administrator privileges verified +✅ Test user created: [username] +❌ SSH service installation failed + +Error: [Error message from tool] + +The test environment has been cleaned up. I'll investigate the service installation issue. +``` + +#### Partial Success Scenario: +``` +Functionality testing completed with warnings. + +Test Results: +✅ Administrator privileges verified +✅ Test user created: [username] +✅ SSH service installed successfully +✅ SSH service started successfully +⚠️ Firewall rule configuration skipped (SkipFirewall=true) +✅ SSH connection test passed +✅ Command execution verified + +Note: Firewall was not configured as requested. Ensure firewall rules exist if testing remote connections. +``` + +## Commit Batch Summary Template + +**SHOULD include these elements** when summarizing a commit batch. Adapt the format and detail level based on context. + +### Template Structure: + +``` +Processing batch [N] ([X] commits from [start_hash] to [end_hash]) + +Key Changes: +- [Category 1]: [Brief description] +- [Category 2]: [Brief description] +- [Category 3]: [Brief description] + +Files Modified: [X] files +Conflicts: [X] conflicts ([resolved/pending]) + +[Additional context if needed] +``` + +### Example - Simple Batch: +``` +Processing batch 1 (8 commits from a1b2c3d to e4f5a6b) + +Key Changes: +- Security fixes: Updated bounds checking in buffer handling +- Bug fixes: Corrected memory leak in session cleanup +- Documentation: Updated protocol specification comments + +Files Modified: 12 files +Conflicts: 2 conflicts (resolved) +``` + +### Example - Complex Batch: +``` +Processing batch 3 (15 commits from 7h8i9j0 to k1l2m3n) + +Key Changes: +- Build system: Added new source files for MLKEM support +- Authentication: Enhanced certificate validation logic +- Process management: Modified daemon initialization (requires Windows adaptation) +- Configuration: Added 3 new preprocessor definitions + +Files Modified: 28 files +Conflicts: 7 conflicts (5 resolved, 2 require manual review) + +Note: The daemon initialization changes use fork() which needs Windows CreateProcess() equivalent. +``` + +### Example - Minimal Batch: +``` +Processing batch 5 (3 commits from x7y8z9 to a0b1c2) + +Key Changes: +- Minor documentation updates +- Code formatting corrections + +Files Modified: 4 files +Conflicts: None +``` + +## Progress Update Templates + +**SHOULD include these elements** when communicating progress at different workflow phases. Adapt wording to context. + +### Pre-Merge Analysis Phase: +``` +Analyzing upstream changes from [last_merge_tag] to [target_version]... + +Found [X] commits to merge: +- [X] security fixes (HIGH PRIORITY) +- [X] bug fixes +- [X] feature additions +- [X] build system changes + +Grouping commits into batches for incremental merging. +``` + +### Conflict Resolution Phase: +``` +Resolving [X] conflicts in [filename]: + +- Conflict 1: [Brief description] → [Resolution strategy] +- Conflict 2: [Brief description] → [Resolution strategy] + +[X] conflicts resolved, [Y] remaining. +``` + +### Build Fixes Phase: +``` +Applying build fixes for iteration [N]: + +- Added Windows compatibility header to [file.c] +- Updated config.h.vs with [X] new definitions +- Added [source_file.c] to [project.vcxproj] + +Rebuilding... +``` + +### Testing Phase: +``` +Running functionality tests to validate the merge... + +[Use Test-OpenSSHFunctionality template from above] +``` + +### Cleanup Phase: +``` +Finalizing the merge: + +✅ Restored paths.targets to clean state +✅ Verified [X] commits applied successfully +✅ All builds passing +✅ Functionality tests passing + +Ready to commit and push. +``` + +### Scratch-to-Real Branch Transition: +``` +Scratch branch phase complete! + +Summary: +- Processed [N] batches on scratch branch +- Resolved [X] total conflicts across [Y] files +- All [N] batches built successfully +- Resolution log saved with [X] entries + +Switching to the real merge branch for the single final merge. +Recorded resolutions will be replayed automatically via git rerere and the resolution log. +``` + +### Real Branch Replay Report: +``` +Single merge completed on real branch. Resolution replay results: + +- Auto-resolved by git rerere: [X] files +- Replayed from resolution log: [Y] files +- Unmatched (manual resolution needed): [Z] files + - [file1]: [brief reason] + - [file2]: [brief reason] +- Failed replays: [W] files + +[If unmatched > 0]: Resolving the remaining [Z] files using strategies from the scratch phase... +[If all resolved]: All conflicts resolved. Applying build fixes as separate commits. +``` + +## Special Scenarios + +### When Seeking User Approval: +``` +Batch [N] is ready for review: + +Summary: +- [X] commits merged successfully +- Build: ✅ Passed +- Tests: ✅ Passed +- Conflicts: [X] resolved + +Changes include: [brief list] + +May I proceed with the next batch? +``` + +### When Requesting Manual Intervention: +``` +I've encountered a complex conflict that requires manual review: + +File: [filename] +Issue: [Description of the conflict complexity] +Context: [Why automated resolution isn't appropriate] + +Recommendation: [Suggested approach] + +Please advise on how to proceed. +``` + +### When Reporting Critical Issues: +``` +⚠️ CRITICAL: [Issue type detected] + +Details: +- [Specific problem] +- [Impact assessment] +- [Affected components] + +This requires immediate attention before proceeding with the merge. +``` + +## Integration with Pseudocode + +When implementing pseudocode patterns from merge-details.instructions.md, use these communication approaches: + +### update_progress() → Chat Message +```pseudocode +# Pseudocode: +update_progress("Build Fixes", "IN_PROGRESS", "Applied 3 fixes") + +# Agent Implementation (via chat): +"Applying build fixes (iteration 2): Added 3 Windows compatibility changes. Rebuilding now..." +``` + +### generate_test_report() → Structured Chat Message +```pseudocode +# Pseudocode: +report = generate_test_report(test_results) + +# Agent Implementation (via chat): +[Use Test-OpenSSHFunctionality template from above] +``` + +### log() → Contextual Chat Message +```pseudocode +# Pseudocode: +log(f"Skipping {binary} - Unix only") + +# Agent Implementation (via chat): +"Skipping ssh-keysign.exe - Unix-only binary not applicable to Windows build." +``` + +## Best Practices for Merge Communication + +1. **Always include commit hashes** when referencing specific commits (first 7 characters) +2. **Use file links** when referencing specific files: [filename](path/to/filename) +3. **Categorize changes** by type (security, bug fix, feature, build system, etc.) +4. **Highlight Windows-specific considerations** that required special handling +5. **Provide commit counts** to show progress and scope +6. **Be specific about conflict types** and resolution strategies used +7. **Report before and after** major operations (build, test, etc.) +8. **Update after each batch** to maintain transparency +9. **Use consistent terminology** aligned with the instruction files +10. **Mark critical items** with appropriate indicators (⚠️, ✅, ❌) + +## Summary + +- **Tool templates are REQUIRED** - Use exact formats for MCP tool output summaries +- **Batch templates are RECOMMENDED** - Include suggested elements but adapt to context +- **Supplement high-level guidelines** - All general communication principles still apply +- **Maintain transparency** - Keep users informed throughout the merge process +- **Be consistent** - Use standard terminology and formatting patterns diff --git a/.github/instructions/merge/merge-details.instructions.md b/.github/instructions/merge/merge-details.instructions.md new file mode 100644 index 000000000000..495f5ab7b0f3 --- /dev/null +++ b/.github/instructions/merge/merge-details.instructions.md @@ -0,0 +1,636 @@ +--- +applyTo: "**/*" +--- + +# Merge Instructions for AI Agents + +## Overview +This AI-specific documentation provides comprehensive instructions and algorithmic frameworks that AI agents can use to systematically approach the OpenSSH merge process with minimal human intervention while maintaining high quality and consistency. It combines conflict resolution strategies with automated decision-making processes. + +**Key Approach: Two-Phase Merge with Scratch Branch** +Instead of cherry-picking commits (which rewrites history), this framework implements a two-phase approach: + +1. **Scratch branch** — Incremental `git merge` at batch boundaries (grouped by CI presence). Build and run the full CI test suite after each batch. Every conflict resolution is recorded via `git rerere` and the Save-MergeResolution MCP tool. +2. **Real branch** — A single `git merge` of the final upstream target. Recorded resolutions replay automatically via `git rerere` and Replay-MergeResolutions. This produces one merge commit with all upstream SHAs intact. + +Benefits: +- Preserves upstream commit history exactly (original SHAs, authors, timestamps) +- Uses incremental merge on scratch branch so conflict markers match the final merge (maximising `rerere` replay) +- Builds after each batch on scratch branch (mandatory) for early error detection +- Runs the full CI test suite after each batch (mandatory), independent of upstream CI status +- Requires user approval before proceeding to next batch +- Allows for incremental progress and easier rollback +- Reduces complexity of conflict resolution + +## Decision Framework for AI Agents + +### Pre-Merge Analysis Algorithm +```pseudocode +FUNCTION analyze_upstream_changes(target_version): + // Step 1: Find last merged commit and determine range + last_upstream_commit = find_last_upstream_commit_in_fork() + commit_range = get_commit_range(last_upstream_commit, target_version) + + // Step 2: Fetch and analyze release notes + release_notes = fetch_release_notes(target_version) + risk_factors = [] + + FOR EACH change IN release_notes: + IF change.contains(["signal", "fork", "pipe", "process", "daemon", "service"]): + risk_factors.append({type: "PROCESS_MANAGEMENT", change: change}) + IF change.contains(["auth", "pam", "kerberos", "gssapi"]): + risk_factors.append({type: "AUTHENTICATION", change: change}) + IF change.contains(["build", "makefile", "configure", "autotools"]): + risk_factors.append({type: "BUILD_SYSTEM", change: change}) + IF change.contains(["security", "cve", "vulnerability"]): + risk_factors.append({type: "SECURITY", change: change, priority: "HIGH"}) +``` + +### Conflict Resolution Decision Tree +```pseudocode +FUNCTION resolve_conflict(file_path, conflict_content): + conflict_type = analyze_conflict_type(conflict_content) + + SWITCH conflict_type: + CASE "SECURITY_FIX": + // Always accept upstream security fixes + RETURN accept_upstream(conflict_content) + + CASE "BUILD_SYSTEM_CHANGE": + // Need to update Visual Studio projects + upstream_changes = extract_upstream_changes(conflict_content) + RETURN combine_with_windows_build_system(upstream_changes) + + CASE "PROCESS_MANAGEMENT": + // Unix fork/exec vs Windows CreateProcess + IF contains_fork_or_exec(conflict_content): + RETURN wrap_with_platform_ifdef(conflict_content) + ELSE: + RETURN analyze_compatibility(conflict_content) + + CASE "AUTHENTICATION": + // PAM/Kerberos vs Windows auth + RETURN preserve_windows_auth_with_upstream_features(conflict_content) + + CASE "CONFIGURATION": + // config.h vs config.h.vs changes + new_defines = extract_new_defines(conflict_content) + RETURN update_config_h_vs(new_defines) + + DEFAULT: + // Use historical pattern matching + similar_resolutions = find_similar_conflicts(file_path, conflict_content) + RETURN apply_similar_resolution_pattern(similar_resolutions[0]) +``` + +## Information Sources and Analysis + +### Primary References +- [Upstream release notes](https://www.openssh.com/releasenotes.html) - Pay special attention when merging new versions +- [Previous merge PRs](./research.instructions.md) - Review conflict resolution patterns +- Commit history and messages - Use Invoke-Git `Operation="Log"`, `Range="..upstream/"` to understand changes +- Local repository file comparison - Use 3-way diff tools + +### Analysis Commands +```pwsh +# View commit details for understanding changes: +# MCP Tool: mcp_openssh-server_Invoke_Git +# Operation="Show", CommitHash="" + +# Compare files between branches: +# MCP Tool: mcp_openssh-server_Invoke_Git +# Operation="Diff", Range="HEAD..upstream/", Path="" +``` + +## Conflict Resolution Strategies + +### 1. Taking Upstream Changes +**When to use:** Security fixes, bug fixes, feature improvements that don't conflict with Windows functionality. + +```c +// Example: Accept upstream security patch +<<<<<<< HEAD +// Windows-specific code +======= +// New upstream security fix +>>>>>>> upstream/V_X_Y_PZ +``` +**Resolution:** Take the upstream change completely. + +### 2. Combining Changes with Preprocessor Directives +**When to use:** Upstream changes that conflict with Windows-specific functionality but both are needed. + +```c +// Example: Combining platform-specific implementations +#ifdef WINDOWS + // Windows-specific implementation + return windows_specific_function(); +#else + // Upstream Unix implementation + return unix_specific_function(); +#endif /* WINDOWS */ +``` + +### 3. Excluding Changes with #ifndef WINDOWS +**When to use:** Upstream changes are not applicable to Windows or would break Windows functionality. + +```c +// Example: Excluding Unix-only functionality +#ifndef WINDOWS + // Unix-only code that doesn't apply to Windows + setup_unix_specific_feature(); +#endif /* !WINDOWS */ +``` + +## Automated Conflict Resolution Patterns + +### Pattern 1: Platform-Specific Code Wrapping +```c +// Input conflict: +<<<<<<< HEAD +void windows_specific_function() { + // Windows implementation +} +======= +void unix_specific_function() { + // New upstream Unix implementation +} +>>>>>>> upstream/version + +// AI Resolution: +#ifdef WINDOWS +void windows_specific_function() { + // Windows implementation +} +#else +void unix_specific_function() { + // New upstream Unix implementation +} +#endif /* WINDOWS */ +``` + +### Pattern 2: Configuration File Updates +```pseudocode +FUNCTION update_config_h_vs(upstream_config_changes): + config_vs_path = "./contrib/win32/openssh/config.h.vs" + current_config = read_file(config_vs_path) + + FOR EACH define IN upstream_config_changes: + IF define.is_windows_compatible(): + IF define NOT IN current_config: + add_define_to_config_vs(define, determine_windows_value(define)) + ELSE: + // Add comment explaining why it's not included + add_comment_to_config_vs(f"// {define.name} - Unix only, not applicable to Windows") + + write_file(config_vs_path, current_config) +``` + +### Pattern 3: Build System Synchronization +```pseudocode +FUNCTION sync_build_system(): + makefile_changes = get_makefile_changes() + + FOR EACH binary IN makefile_changes.new_binaries: + IF binary.is_windows_applicable(): + create_visual_studio_project(binary) + add_to_solution_file(binary) + ELSE: + log(f"Skipping {binary} - Unix only") + + FOR EACH binary IN makefile_changes.removed_binaries: + remove_visual_studio_project(binary) + remove_from_solution_file(binary) + + FOR EACH source_file IN makefile_changes.new_source_files: + target_project = determine_target_project(source_file) + add_source_to_project(target_project, source_file) + +// CRITICAL: When modifying .vcxproj or .sln files programmatically, +// ALWAYS use Windows line endings (\r\n) instead of Unix (\n). +// This prevents Git from showing the entire file as modified. +FUNCTION add_source_to_project(project_file, source_file): + // Example: Use \r\n for line endings + new_line = f" \r\n" + insert_into_project_file(project_file, new_line) +``` + +### Pattern 4: OpenSSH 10.3 Split-sshd State Ordering (Windows) + +When upstream changes split pre-auth work between `sshd-session` and `sshd-auth`, preserve the state/message ordering exactly. + +- `sshd-session` (listener/monitor side) should not perform banner exchange that upstream moved to `sshd-auth`. +- For Windows `FORK_NOT_SUPPORTED` post-auth child (`sshd-session -z`), monitor message order matters: + - Receive identification-exchange state first. + - Then receive authenticated user context. + +If this ordering is wrong, common symptoms are: +- pre-auth failures such as banner parsing or signature mismatches +- post-auth `Invalid user` with empty username +- monitor keystate errors like `incomplete message` + +## Common Conflict Patterns + +### File System Operations +- **Fork/exec calls** → Use Windows process creation APIs +- **Signal handling** → Use Windows event mechanisms +- **File permissions** → Adapt to Windows ACL model + +### Privsep and Monitor State Transitions (Windows) +- For split `sshd-session` / `sshd-auth` flows, keep sender/receiver message ordering identical across monitor channels. +- Do not add ad-hoc state shuttling unless both sender and receiver are updated in lockstep. +- When debugging, verify the first protocol failure point (banner exchange vs KEX vs post-auth keystate) before changing multiple stages at once. + +### Build System Changes +- **Makefile additions** → Update Visual Studio project files (use `\r\n` line endings) +- **New dependencies** → Check Windows compatibility +- **Compiler flags** → Translate to MSVC equivalents +- **Project file edits** → Maintain Windows line endings (`\r\n`) to avoid Git diffs + +### Configuration Changes +- **New config options** → Add to `./contrib/win32/openssh/config.h.vs` +- **Feature detection** → Verify Windows support +- **Default values** → Adjust for Windows environment + +## Resolution Workflow + +### For Each Conflict: +1. **Analyze the change** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Show", CommitHash="upstream/", Path="" + ``` + +2. **Check previous resolutions** + - Search previous merge PRs for similar conflicts + - Look for patterns in Windows-specific handling + +3. **Choose resolution strategy** + - Upstream change: Complete replacement + - Combined: Add preprocessor directives + - Excluded: Use `#ifndef WINDOWS` + +4. **Test the resolution** + - Ensure code compiles + - Verify simple ssh connection to local host works + - Check that upstream functionality is preserved where applicable + +5. **Document the decision** + - Add comments explaining the Windows-specific handling + - Note in commit message why this approach was chosen + +## Build Validation Automation + +### Iterative Build and Fix Process +```pseudocode +FUNCTION automated_build_fix(): + MAX_ITERATIONS = 10 + iteration = 0 + + WHILE iteration < MAX_ITERATIONS: + // Always start with Start-OpenSSHBuild.ps1 + build_result = start_openssh_build(Configuration="Release", Architecture="x64") + + // ALWAYS invoke Test-OpenSSHBuild.ps1 to check warnings (success or failure) + test_result = test_openssh_build(Configuration="Release", Architecture="x64", LogFile=build_result.log) + + IF build_result.success: + // Check for new warnings against baseline + new_warnings = compare_warnings_to_baseline(test_result.warnings, baseline_warnings) + IF new_warnings.count > 0: + categorized_warnings = categorize_warnings(new_warnings) + request_user_approval(categorized_warnings) + // Wait for user decision: fix warnings or proceed + RETURN SUCCESS + + // Build failed - parse errors + errors = test_result.errors + fixes_applied = [] + + FOR EACH error IN errors: + fix = determine_fix_strategy(error) + IF fix: + apply_fix(fix) + fixes_applied.append(fix) + + IF fixes_applied.empty(): + RETURN MANUAL_INTERVENTION_REQUIRED + + commit_build_fixes(fixes_applied, f"Build fixes iteration {iteration + 1}") + iteration += 1 + + RETURN MAX_ITERATIONS_EXCEEDED + +FUNCTION determine_fix_strategy(error): + SWITCH error.type: + CASE "MISSING_INCLUDE": + RETURN add_windows_include(error.missing_header) + CASE "UNDEFINED_FUNCTION": + RETURN add_windows_equivalent(error.function_name) + CASE "MISSING_DEFINE": + RETURN add_to_config_h_vs(error.define_name) + CASE "MISSING_SOURCE_FILE": + RETURN add_source_to_project(error.file_name) + DEFAULT: + RETURN null +``` + +### Build Tools Invocation Policy + +- Use `Start-OpenSSHBuild.ps1` to run the build for each chunk/batch. +- **ALWAYS invoke `Test-OpenSSHBuild.ps1` after every build** (success or failure): + - On build failure: Parse errors and warnings to fix issues + - On build success: Parse warnings to compare against baseline +- Compare warning count against established baseline +- If new warnings detected, report to user with categorization and request approval before proceeding +- Do NOT skip `Test-OpenSSHBuild.ps1` even when build succeeds - warning checks are mandatory. +- On the scratch branch, commit build fixes after each batch merge commit. +- On the real branch, apply the same build fixes as separate commits after the single merge commit. + +### Batch Test Invocation Policy (Scratch Branch) + +- After each batch merge is completed and builds cleanly, run the full CI test suite: + - **MCP Tool Name**: `mcp_openssh-server_Invoke_OpenSSHTests` + - **Parameters**: `Configuration="Release"`, `Architecture="x64"`, `TestSuite="All"` +- This is mandatory for every batch, regardless of whether the upstream endpoint commit had successful CI. +- If any suite fails, re-run only the failing suite while fixing (`TestSuite="Unit"`, `TestSuite="Bash"`, `TestSuite="E2E"`). +- For bash triage, run a single failing test with `BashTestFilePath`. +- Do not proceed to the next batch until the full suite passes (or user explicitly approves an exception). + +## Testing Automation Framework + +### Automated Test Execution +```pseudocode +FUNCTION execute_test_suite(): + test_results = {} + + // Phase 1: Build verification + test_results["build"] = verify_build_artifacts() + IF NOT test_results["build"].success: + RETURN test_results + + // Phase 2: Service setup + test_results["service_setup"] = setup_ssh_service() + IF NOT test_results["service_setup"].success: + RETURN test_results + + // Phase 3: Basic connectivity + test_results["connectivity"] = test_basic_ssh_connection() + + // Cleanup + cleanup_test_environment() + + RETURN test_results + +FUNCTION generate_test_report(test_results): + report = "# Automated Test Results\n\n" + + FOR EACH category, result IN test_results: + status = result.success ? "✅ PASS" : "❌ FAIL" + report += f"## {category}: {status}\n" + + IF NOT result.success: + report += f"Error: {result.error}\n" + report += f"Suggested Fix: {result.suggested_fix}\n" + + RETURN report +``` + +## Error Recovery Strategies + +### Automatic Rollback Points +```pseudocode +FUNCTION create_checkpoint(phase_name): + current_commit = get_current_commit_hash() + checkpoints[phase_name] = current_commit + tag_commit(f"checkpoint-{phase_name}", current_commit) + +FUNCTION rollback_to_checkpoint(phase_name): + IF phase_name IN checkpoints: + reset_to_commit(checkpoints[phase_name]) + RETURN SUCCESS + ELSE: + RETURN CHECKPOINT_NOT_FOUND + +// Usage in main workflow +create_checkpoint("pre-merge") +execute_merge() + +IF merge_conflicts_too_complex(): + rollback_to_checkpoint("pre-merge") + request_manual_intervention() +``` + +### Conflict Complexity Assessment +```pseudocode +FUNCTION assess_conflict_complexity(conflicts): + complexity_score = 0 + + FOR EACH conflict IN conflicts: + // File-based scoring + IF conflict.file.ends_with(".c", ".h"): + complexity_score += 2 + IF conflict.file.contains("auth", "pam", "kerberos"): + complexity_score += 5 + IF conflict.file == "config.h": + complexity_score += 3 + + // Content-based scoring + lines_in_conflict = conflict.content.split('\n').length + complexity_score += lines_in_conflict * 0.1 + + // Pattern-based scoring + IF conflict.content.contains("fork", "exec", "signal"): + complexity_score += 10 + IF conflict.content.contains("WIN32", "WINDOWS", "#ifdef"): + complexity_score -= 2 // Already has platform guards + + IF complexity_score > 50: + RETURN "HIGH_COMPLEXITY" + ELIF complexity_score > 20: + RETURN "MEDIUM_COMPLEXITY" + ELSE: + RETURN "LOW_COMPLEXITY" +``` + +### Using Get-ConflictContext for High-Complexity Conflicts + +When `assess_conflict_complexity()` returns `HIGH_COMPLEXITY`, invoke the `Get-ConflictContext` MCP tool **before** attempting to edit the file. It provides three-way context anchored to the actual changed regions, accounting for the fact that our fork's line numbers differ from upstream. + +```pseudocode +FUNCTION resolve_conflict(file_path, conflict_content, merge_batch_commit): + complexity = assess_conflict_complexity([{file: file_path, content: conflict_content}]) + + IF complexity == "HIGH_COMPLEXITY": + // Fetch three-way context before editing + // MCP Tool: mcp_openssh-server_Get_ConflictContext + // FilePath=file_path, CommitHash=merge_batch_commit + // + // If the default MaxTotalLines=150 is insufficient (e.g., many hunks or + // a large function), re-invoke with a higher value such as MaxTotalLines=300. + context = get_conflict_context(file_path, merge_batch_commit) + + FOR EACH hunk IN context.Hunks: + // Use all three excerpts to understand: + // hunk.UpstreamBefore — what the upstream code looked like before the commit + // hunk.UpstreamAfter — what the upstream commit changed it to + // hunk.OurFork — what our fork has in the corresponding region + // (Note field explains how the region was located) + determine_resolution_strategy(hunk) + + // Check Message for budget warnings and increase MaxTotalLines if needed + IF context.Message contains "minimum floor": + re_invoke_with_larger_budget(file_path, merge_batch_commit) + + resolved = apply_resolution_strategy(file_path, conflict_content) + + // Record the resolution for replay on the real branch + // MCP Tool: mcp_openssh-server_Save_MergeResolution + // FilePath=file_path, Strategy=, Rationale=, + // BatchNumber=, UpstreamCommits= + save_merge_resolution(file_path, strategy, rationale, batch_number) + + RETURN resolved +``` + +**Key behaviours of the tool:** +- **Binary files**: Returns `IsBinary=true` and no excerpts — resolve manually. +- **Unavailable versions**: A version returns `Lines=null` with a `Note` explaining why (e.g. file newly added by this commit). +- **Fork region location**: Uses sliding-window content matching against the diff's unchanged context lines. Falls back to the function name from the `@@` hunk header if the anchor score is too low. The `Note` field on each `OurFork` excerpt describes which strategy was used. +- **Budget warning**: If `MaxTotalLines` is too small to give each hunk 10 lines per version, a warning appears in `Message` — increase `MaxTotalLines` and re-invoke. + +## Anti-Patterns to Avoid + +### ❌ Don't Remove Upstream Code +```c +// WRONG: This will cause future merge conflicts +// Completely removing upstream additions +``` + +### ❌ Don't Modify Upstream Logic Without Guards +```c +// WRONG: Modifying upstream code without preprocessor protection +upstream_function_with_windows_modifications(); +``` + +### ✅ Do Use Preprocessor Guards +```c +// CORRECT: Preserve upstream code with conditional compilation +#ifdef WINDOWS + windows_alternative(); +#else + upstream_function(); +#endif +``` + +## Progress Tracking and Reporting + +### Automated Progress Updates +```pseudocode +FUNCTION update_progress(phase, status, details): + progress_entry = { + timestamp: current_timestamp(), + phase: phase, + status: status, // SUCCESS, FAILURE, IN_PROGRESS + details: details, + commit_hash: get_current_commit_hash() + } + + append_to_progress_log(progress_entry) + + IF status == "FAILURE": + generate_failure_report(phase, details) + suggest_recovery_actions(phase, details) + +FUNCTION generate_merge_summary(): + summary = { + total_conflicts: count_resolved_conflicts(), + build_iterations: count_build_fix_iterations(), + test_results: get_final_test_results(), + time_elapsed: calculate_total_time(), + commits_created: count_commits_since_start(), + complexity_rating: assess_overall_complexity() + } + + RETURN format_summary_report(summary) +``` + +## Integration with Development Workflow + +### Pull Request Preparation +```pseudocode +FUNCTION prepare_pull_request(): + // Generate comprehensive commit history + commit_history = get_commits_since_branch_creation() + + // Create PR description + pr_description = f""" +# Merge OpenSSH {target_version} to Windows Fork + +## Summary +{generate_merge_summary()} + +## Conflict Resolutions +{generate_conflict_resolution_summary()} + +## Testing Results +{generate_test_report(final_test_results)} + +## Files Modified +{list_modified_files()} + +## Breaking Changes +{identify_breaking_changes()} +""" + + RETURN { + title: f"Merge upstream OpenSSH {target_version}", + description: pr_description, + labels: ["upstream-merge", determine_complexity_label()], + assignees: get_default_reviewers() + } + +FUNCTION normalize_fork_workflow_triggers(): + workflow_files = list_files(".github/workflows/*.yml") + + FOR EACH wf IN workflow_files: + // Policy for PowerShell Windows fork: dispatch-only upstream workflows + ensure_trigger_enabled(wf, "workflow_dispatch") + disable_trigger(wf, "push") + disable_trigger(wf, "pull_request") + disable_trigger(wf, "schedule") + + RETURN "workflow triggers normalized for fork policy" +``` + +### Workflow Trigger Policy (Windows Fork) +- Upstream workflow files merged into this fork should default to manual invocation only. +- Keep `workflow_dispatch` active. +- Disable automatic triggers (`push`, `pull_request`, `schedule`) unless the Windows fork explicitly depends on them. +- During final merge review, verify `.github/workflows/*.yml` trigger blocks are policy-compliant. + +## Commit Message Template + +``` +Resolve merge conflicts for + +Major conflict resolutions: +- : Combined upstream with Windows using #ifdef +- : Excluded upstream with #ifndef WINDOWS due to +- : Accepted upstream completely + +Reasoning: +``` + +## Troubleshooting + +### If Unsure About a Conflict: +1. Check if the upstream change addresses a CVE or security issue (prioritize) +2. Look for similar code patterns elsewhere in the Windows codebase +3. Consult the OpenSSH-portable issue tracker for context +4. When in doubt, use conditional compilation to preserve both approaches + +### Testing Your Resolution: +- Build the project after each major conflict resolution +- Run ssh connection to local host to ensure basic functionality +- Check that removed functionality wasn't critical to Windows operation \ No newline at end of file diff --git a/.github/instructions/merge/merge-process-overview.instructions.md b/.github/instructions/merge/merge-process-overview.instructions.md new file mode 100644 index 000000000000..e2787a0edaa9 --- /dev/null +++ b/.github/instructions/merge/merge-process-overview.instructions.md @@ -0,0 +1,371 @@ +--- +applyTo: "**/*" +--- + +# OpenSSH-Portable: Merge From Upstream Instructions + +## Overview +This documentation provides comprehensive instructions for merging OpenBSD's OpenSSH-Portable changes into the PowerShell team's Windows-compatible fork. It is designed to be used by both human developers and AI agents to complete a full merge process that results in a ready-to-merge Pull Request. + +## Prerequisites +Ensure the following tools are installed and configured before proceeding: +- **Git** +- **PowerShell** +- **Visual Studio** with: + - Latest C/C++ development tools + - Latest Windows 10/11 SDK + +## Process Overview +The merge process uses a **two-phase approach** to preserve upstream commit history while keeping conflict resolution manageable: + +1. **Scratch branch** — Incremental `git merge` at batch boundaries. Build and run the full CI test suite after each batch. Every conflict resolution is recorded via `git rerere` and a resolution log. +2. **Real branch** — A single `git merge` of the final upstream target. Recorded resolutions are replayed automatically. This produces one merge commit with all upstream SHAs intact. + +The process consists of several interconnected phases: + +1. **[Setup Phase](#setup-phase)** - Repository configuration and preparation +2. **[Research Phase](#research-phase)** - Understanding changes and conflicts +3. **[Scratch Branch Phase](#scratch-branch-phase)** - Incremental merging with resolution recording +4. **[Real Branch Phase](#real-branch-phase)** - Single merge with resolution replay +5. **[Build Phase](#build-phase)** - Resolving compilation issues +6. **[Testing Phase](#testing-phase)** - Validating functionality +7. **[Submission Phase](#submission-phase)** - Creating the Pull Request + +## Setup Phase + +**📖 Detailed Instructions:** [Setup Instructions](../setup.instructions.md) + +**Quick Overview:** +1. Clone your fork of the openssh-portable repository +2. Configure upstream remotes (PowerShell team fork + original OpenSSH) +3. Fetch latest changes + +## Research Phase + +**📖 Detailed Instructions:** [Research Instructions](./research.instructions.md) + +**Key Resources:** +- **Upstream Release Notes:** [OpenSSH Release Notes](https://www.openssh.com/releasenotes.html) +- **Previous Merge PRs:** such as https://github.com/PowerShell/openssh-portable/pull/737 + +## Merge Phase + +### Initial Preparation +1. **Verify prerequisites and baseline** + Use the Test-MergePrerequisites MCP tool: + ```pwsh + # Run prerequisite check via MCP tool + # MCP Tool Name: mcp_openssh-server_Test_MergePrerequisites + # Parameters: TargetVersion (required), SkipBaselineBuild (optional) + + # Example invocation (replace with target like "V_10_0_P2"): + # The MCP tool will verify: + # - Git, PowerShell, Visual Studio installed + # - Repository remotes configured (origin, upstream, upstream-pwsh) + # - Target version exists in upstream + # - Working directory is clean + + # Proceed only if tool reports "ALL PREREQUISITES MET" + ``` + +2. **Configure git:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Config", Key="core.editor", Value="true" + + # Enable rerere for automatic resolution recording + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Config", Key="rerere.enabled", Value="true" + ``` + +3. **Create branches:** + ```pwsh + # Create the real merge branch (receives the final single merge) + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="CreateBranch", Branch="merge-v-" + + # Create the scratch branch from the same point (for incremental merges) + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="CreateBranch", Branch="scratch-merge-v-" + ``` + +### Scratch Branch Phase +4. **Identify merge range and group commits:** + Use the Get-CommitGroups MCP tool with `-FirstChunkOnly -GroupByCIPresence` + + **MCP Tool Name**: `mcp_openssh-server_Get_CommitGroups` + + **Parameters**: + - `GitHubTag` (string, optional): Start from last merged tag (e.g., "V_10_0_P2") + - `StartCommit` (string, optional): Start from specific commit SHA + - `EndCommit` (string, optional): End at specific commit SHA (default: HEAD - most recent upstream commit) + - `FirstChunkOnly` (boolean): Set to `true` + - `GroupByCIPresence` (boolean): Set to `true` + + **Example for first batch**: + - Find the last upstream tag in the fork + - Call tool with `GitHubTag=`, `EndCommit=`, `FirstChunkOnly=true`, `GroupByCIPresence=true` + - Omit `EndCommit` to merge all commits up to HEAD (most recent upstream commit) + - This gets commits ending with any commit that has CI runs (not just successful CI) + + **Example output:** + ```json + { + "ChunkNumber": 1, + "StartCommit": "609fe2c", + "EndCommit": "6fb728d", + "StartCommitFull": "609fe2cae2459d721ac11d23cd27b8a94397ef3c", + "EndCommitFull": "6fb728df50c1afd338cb0223a84ce24579577eff", + "CommitCount": 57, + "StartMessage": "upstream: rework the text for -3 to make it clearer what default", + "EndMessage": "Run all tests on Cygwin again." + } + ``` + + Display batch details for verification, then proceed with merging. + + **After completing steps below, get next batch**: + - Call tool with `StartCommit=`, `EndCommit=`, `FirstChunkOnly=true`, `GroupByCIPresence=true` + - Continue this process until the target end commit is reached (or HEAD if no end commit specified) + +5. **Execute batch merge on scratch branch:** + + Merge the batch's end commit to bring in all commits in the range at once: + + ```pwsh + # Merge all commits up to the batch endpoint + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Merge", CommitHash=$result.EndCommitFull + ``` + + This uses `--no-ff` to always create a merge commit checkpoint. + +7. **Resolve merge conflicts and record resolutions:** + **📖 Detailed Instructions** ([Merge Details](./merge-details.instructions.md)): + + - Resolve conflicts for all conflicted files + - **Record each resolution** using the Save-MergeResolution MCP tool: + ```pwsh + # MCP Tool: mcp_openssh-server_Save_MergeResolution + # FilePath="", Strategy="", Rationale="", + # BatchNumber=, UpstreamCommits="" + ``` + - `git rerere` also automatically records resolutions + - Follow established Windows compatibility patterns + - Reference previous merge PRs for similar conflicts + +8. **Complete the merge after resolution:** + ```pwsh + # Stage all resolved files using Invoke-Git MCP tool: + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Add", Path="." + + # Continue merge using Invoke-Git MCP tool: + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="MergeContinue" + ``` + +9. **Build after completing the batch:** + Use the Start-OpenSSHBuild MCP tool: + - **MCP Tool Name**: `mcp_openssh-server_Start_OpenSSHBuild` + - **Parameters**: `Configuration="Release"`, `Architecture="x64"` + + **ALWAYS check warnings after build (success or failure):** + - **Use Test-OpenSSHBuild MCP tool to parse errors and warnings**: + - **MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHBuild` + - **Parameters**: `Configuration="Release"`, `Architecture="x64"` + - **DO NOT** try to read log files directly with `Get-Content` or locate them manually + + If build failed: + - Fix issues based on parsed error output + - Rebuild and verify + + If build succeeded: + - Compare warnings against baseline established in Phase 1 + - If new warnings detected: + - Categorize warnings (deprecated APIs, type conversions, potential bugs, etc.) + - Report to user with warning details and categories + - Request user decision: fix warnings or proceed + - Wait for user approval before continuing + - If user approves proceeding, update baseline to include new warnings + + **CRITICAL: Before committing, restore paths.targets**: + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Checkout", Target=".\contrib\win32\openssh\paths.targets" + ``` + Commit any build fixes separately with descriptive messages (only actual code changes) + +10. **Run full CI validation after every batch (mandatory):** + Run the full OpenSSH CI suite regardless of upstream CI status for the batch endpoint. + - **MCP Tool Name**: `mcp_openssh-server_Invoke_OpenSSHTests` + - **Parameters**: `Configuration="Release"`, `Architecture="x64"`, `TestSuite="All"` + + If any suite fails: + - Capture failing suite details from tool output + - Re-run only the failing suite to iterate faster (`TestSuite="Unit"`, `TestSuite="Bash"`, or `TestSuite="E2E"`) + - For a single failing bash case, use `TestSuite="Bash"` and `BashTestFilePath=""` + - Fix issues and re-run full suite before proceeding to the next batch + +11. **Provide summary and get approval:** + - Summarize batch changes, conflicts resolved, build status, and full CI suite status (Unit/Bash/E2E) + - Wait for user approval before proceeding to next batch + - Document next steps (starting commit for next batch) + - After all batches complete on the scratch branch, proceed to the Real Branch Phase + +### Real Branch Phase +12. **Switch to the real merge branch:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Checkout", Target="merge-v-" + ``` + +13. **Perform a single merge** of the final upstream target: + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Merge", CommitHash="" + ``` + `git rerere` will automatically apply resolutions recorded during the scratch phase. + +14. **Replay remaining resolutions** from the log: + ```pwsh + # MCP Tool: mcp_openssh-server_Replay_MergeResolutions + # (reads from .git/merge-resolution-log.json) + ``` + Resolve any unmatched files manually using the log's strategy and rationale as guidance. + +15. **Complete the merge and apply build fixes:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="MergeContinue" + ``` + Apply build fixes (config.h.vs, .vcxproj changes, etc.) as separate commits after the merge commit. + +16. **Final build and validation** on the real branch. + +--- + +## Build Phase + +**📖 Detailed Instructions:** [Build Instructions](../build.instructions.md) + +7. **Initial build attempt:** + Use the Start-OpenSSHBuild MCP tool: + - **MCP Tool Name**: `mcp_openssh-server_Start_OpenSSHBuild` + - **Parameters**: `Configuration="Release"`, `Architecture="x64"` + +8. **Resolve compilation errors (iterative process):** + + **Common Areas to Check:** + - **config.h.vs updates:** New preprocessor definitions + - **Function signatures:** Windows equivalents for Unix functions + - **Build system changes:** Makefile vs Visual Studio projects + - **New dependencies:** Windows compatibility verification + +9. **Update Visual Studio projects:** + - Check Makefile for added/removed binaries + - Create/update .vcxproj files as needed + - Update Win32-OpenSSH.sln solution file + - Ensure Windows-applicable binaries only + +10. **Commit build fixes:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Commit" + # Message="Fix compilation errors for + # + # Changes: + # - Updated config.h.vs with + # - Added Windows equivalent for + # - Updated project files for " + ``` + +--- + +## Testing Phase + +**📖 Detailed Instructions:** [Testing Instructions](../testing.instructions.md) + +11. **Basic functionality test:** + ```pwsh + # Set up SSH service (see testing.instructions.md) + ssh.exe @localhost + ``` + +12. **Troubleshoot connection issues:** + - Enable verbose logging + - Check service configuration + - Use debugger if necessary + - Verify certificate/key handling + +13. **Commit any test fixes:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Commit" + # Message="Fix runtime issues for + # + # Issues resolved: + # - " + ``` + +--- + +## Submission Phase + +### Creating the Pull Request +14. **Push to fork:** + ```pwsh + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Push", Remote="origin", Branch="merge-v-" + ``` + +15. **Create Pull Request:** + - Target: `PowerShell/openssh-portable:` (typically the branch you started from, e.g., latestw_all) + - Title: `Merge upstream OpenSSH ` + - Include comprehensive description of changes and resolutions + +16. **Normalize upstream workflow triggers for Windows fork:** + - Ensure merged upstream workflow files under `.github/workflows/*.yml` are dispatch-only in this fork. + - Keep `workflow_dispatch` enabled and disable automatic triggers (`push`, `pull_request`, `schedule`) unless explicitly required for this fork. + - Preserve trigger blocks as commented context where practical so future re-syncs are straightforward. + +17. **Address CI/test failures:** + - Monitor automated tests + - Fix any Windows-specific test failures + - Ensure all checks pass + +18. **Request review:** + - Tag appropriate PowerShell team reviewers + - Provide context for complex conflict resolutions + +--- + +## Success Criteria + +**The merge is complete when:** +- [ ] All merge conflicts resolved with documented reasoning +- [ ] Solution builds successfully on Windows +- [ ] Basic SSH connection test passes +- [ ] All CI tests pass +- [ ] Upstream workflow triggers normalized to dispatch-only for this fork +- [ ] PR approved and ready for merge + +--- + +## AI Agent Resources + +AI agents should utilize these additional resources: + +- **[Reference Analysis](./research.instructions.md)** - Intelligence gathering protocols +- **[Merge Details](./merge-details.instructions.md)** - Comprehensive merge process, conflict resolution, and automation algorithms +- **[Testing Instructions](../testing.instructions.md)** - Detailed validation procedures + +**For AI Agents:** +1. **Start with this overview** - Follow the phases and track progress commit-by-commit +2. **Follow decision trees** - Refer to AI agent instructions for algorithmic guidance +3. **Document everything** - Maintain detailed commit messages and resolution rationale +4. **Use automated testing** - Leverage provided test scripts for validation +5. **Escalate when needed** - If complexity exceeds capabilities, document and request human intervention + +**Success Criteria Check:** +The merge process is successful when an AI agent can complete all phases independently and produce a Pull Request that meets all quality standards without human intervention. diff --git a/.github/instructions/merge/research.instructions.md b/.github/instructions/merge/research.instructions.md new file mode 100644 index 000000000000..3259ac577037 --- /dev/null +++ b/.github/instructions/merge/research.instructions.md @@ -0,0 +1,109 @@ +--- +applyTo: "**/*" +--- + +# References for AI Agents + +## AI Agent Instructions +This file provides reference materials and links that AI agents should review before and during the merge process. Each section contains specific guidance on what to look for and how to use the information. + +## Upstream Release Notes +**URL:** https://www.openssh.com/releasenotes.html + +**AI Agent Task:** +1. Navigate to the release notes page +2. Focus ONLY on the latest release section (at the top of the page) +3. Look for these specific types of changes that require Windows compatibility work: + - Signal handling modifications + - File handling changes + - Inter-process communication (IPC) updates + - New system calls or POSIX-specific functionality + - Changes to build system or dependencies + - Security fixes that might affect Windows implementations + +**Example Analysis:** +``` +If release notes mention "Added support for new signal handling in sshd", +the AI should flag this as requiring Windows event mechanism adaptation. +``` + +## Previous Merge Pull Requests + +**AI Agent Task:** Review these PRs in order of recency for conflict resolution patterns: + +1. **Most Recent:** https://github.com/PowerShell/openssh-portable/pull/737 +2. https://github.com/PowerShell/openssh-portable/pull/703 +3. https://github.com/PowerShell/openssh-portable/pull/684 +4. https://github.com/PowerShell/openssh-portable/pull/657 +5. https://github.com/PowerShell/openssh-portable/pull/626 +6. https://github.com/PowerShell/openssh-portable/pull/577 +7. https://github.com/PowerShell/openssh-portable/pull/504 +8. https://github.com/PowerShell/openssh-portable/pull/351 + +**What to Extract from Each PR:** +1. **Commit Messages:** Look for commits added AFTER the initial merge commit +2. **File Patterns:** Note which files commonly have conflicts +3. **Resolution Strategies:** Document how specific types of conflicts were resolved +4. **Build Fixes:** Note compilation issues and their solutions +5. **Test Failures:** Understand common CI/test failures and fixes + +**Key Contributors to Follow:** +- Regular PowerShell/OpenSSH-Portable contributors +- Their commit patterns and resolution strategies +- Comments and review feedback + +## Upstream Repository Analysis + +**Commands for AI Agent (use Invoke-Git MCP tool):** +```pwsh +# Get commit history for target version: +# MCP Tool: mcp_openssh-server_Invoke_Git +# Operation="Log", Range="..upstream/" + +# Analyze specific commits: +# MCP Tool: mcp_openssh-server_Invoke_Git +# Operation="Show", CommitHash="" + +# Compare branches: +# MCP Tool: mcp_openssh-server_Invoke_Git +# Operation="Diff", Range="HEAD..upstream/" +``` + +## Windows-Specific Knowledge Base + +### Common Conflict Areas +1. **Process Management:** fork() vs CreateProcess() +2. **Signal Handling:** Unix signals vs Windows events +3. **File Permissions:** POSIX permissions vs Windows ACLs +4. **Path Handling:** Unix paths vs Windows paths +5. **Build System:** Makefile vs Visual Studio projects + +### Resolution Pattern Library +```c +// Pattern 1: Platform-specific implementation +#ifdef WINDOWS + // Windows implementation +#else + // Unix implementation +#endif + +// Pattern 2: Exclude Unix-only features +#ifndef WINDOWS + // Unix-only code +#endif + +// Pattern 3: Windows compatibility layer +#ifdef WINDOWS + #include "win32compat.h" +#endif +``` + +## Decision Matrix for AI Agents + +| Conflict Type | Resolution Strategy | Example | +|---------------|-------------------|---------| +| Security Fix | Accept upstream completely | CVE patches | +| Build System | Update VS project files | New source files | +| System Calls | Add Windows equivalent | fork() → CreateProcess() | +| Configuration | Update config.h.vs | New preprocessor defines | +| Test Code | Platform-specific guards | Unix-only tests | diff --git a/.github/instructions/repository-overview.instructions.md b/.github/instructions/repository-overview.instructions.md new file mode 100644 index 000000000000..3fe4c9d6c2b8 --- /dev/null +++ b/.github/instructions/repository-overview.instructions.md @@ -0,0 +1,136 @@ +--- +applyTo: "**/*" +--- + +# Repository Structure and Windows Compatibility Layer + +## Overview + +This repository is a **downstream fork** of [openssh/openssh-portable](https://github.com/openssh/openssh-portable) maintained by the PowerShell team to provide Windows compatibility for OpenSSH. + +## Repository Organization + +### Upstream Code (Base Directory) +The root of the repository contains the upstream OpenSSH code: +- Core SSH implementation files (`.c`, `.h`) +- Unix/POSIX-focused codebase +- Maintained to stay close to upstream for easier merging + +### Windows Compatibility Layer + +#### Primary Windows Code Locations + +**1. `.\contrib\win32\openssh\`** +- Visual Studio project files (`.vcxproj`, `.sln`) +- Windows-specific build configuration +- Project organization for Windows builds + +**2. `.\contrib\win32\win32compat\`** +- Windows compatibility implementation layer +- Provides Windows equivalents for POSIX functions +- Contains platform abstraction code + +#### Compatibility Strategy + +The Windows port follows a **separation of concerns** approach to minimize divergence from upstream: + +1. **Preferred: Compatibility Layer** + - Windows-specific implementations prefixed with `w32_` + - Example: `w32_mkdir()`, `w32_stat()`, `w32_open()` + - Macro redefinition in headers to redirect POSIX calls + - Located in `contrib\win32\win32compat\` + +2. **When Necessary: Conditional Compilation** + - Use `#ifdef WINDOWS` blocks in upstream files + - Keep Windows-specific code minimal and well-documented + - Only when compatibility layer approach is insufficient + +**Example Pattern:** +```c +// In win32compat header (e.g., sys/stat.h) +int w32_mkdir(const char *pathname, unsigned short mode); +#undef mkdir // Clear any existing definition +#define mkdir w32_mkdir // Redirect to Windows implementation + +// In upstream code - no changes needed +mkdir(path, 0700); // Automatically uses w32_mkdir on Windows +``` + +## Special Case: SSH-Agent + +### Important: Separate Windows Implementation + +The **ssh-agent** is a special case that **does not follow** the standard compatibility layer pattern: + +- **Windows ssh-agent location**: `.\contrib\win32\win32compat\ssh-agent\` +- Built from **completely separate code** from the upstream ssh-agent +- Uses Windows-native APIs and service architecture + +### Implications for Upstream Merges + +When merging changes to `ssh-agent.c` or related agent files from upstream: + +1. **Simple changes** (bug fixes, small improvements): + - Manually port functionality to `contrib\win32\win32compat\ssh-agent\` + - Adapt logic to Windows implementation + +2. **Complex changes** (architectural changes, new features): + - Document as TODO in merge commit + - Flag for Windows team review + - May require significant redesign work + +3. **New files** (additional agent-related source files): + - **Not all new upstream files need to be ported** to the Windows ssh-agent + - Evaluate whether the functionality is relevant to the Windows implementation + - If not applicable, document the decision and skip porting + +4. **Do NOT**: + - Directly apply upstream ssh-agent patches to Windows version + - Assume one-to-one code correspondence + - Merge without understanding Windows implementation differences + +### Other Binaries + +All other OpenSSH binaries (ssh, sshd, scp, sftp, etc.) follow the standard compatibility layer approach and can be merged more directly from upstream with appropriate Windows compatibility adjustments. + +## Best Practices for Merging + +### 1. Minimize Direct Modifications +- Prefer extending compatibility layer over adding `#ifdef WINDOWS` blocks +- Keep upstream code as clean as possible + +### 2. Document Windows-Specific Changes +- Clear comments explaining why Windows needs different approach +- Reference related compatibility layer functions + +### 3. Test on Windows +- Always build and test on Windows after merging +- Use provided automation tools in `.github\tools\` +- Verify both functionality and build process + +### 4. Upstream Alignment +- Track which upstream commits have been merged +- Maintain clear merge history +- Document any deviations from upstream behavior + +## Key Files to Know + +### Build System +- `contrib\win32\openssh\Win32-OpenSSH.sln` - Main Visual Studio solution +- `contrib\win32\openssh\*.vcxproj` - Individual project files +- `contrib\win32\openssh\OpenSSHBuildHelper.psm1` - Build helper module + +### Compatibility Headers +- `contrib\win32\win32compat\inc\sys\*` - POSIX header replacements +- `contrib\win32\win32compat\inc\*.h` - Windows compatibility declarations +- `contrib\win32\win32compat\inc\crtheaders.h` - CRT header mappings + +### Compatibility Implementation +- `contrib\win32\win32compat\*.c` - Windows function implementations +- `contrib\win32\win32compat\ssh-agent\*` - Separate Windows ssh-agent + +## Getting Help + +- **Build issues**: See [build.instructions.md](./build.instructions.md) +- **Merge conflicts**: See [merge/merge-details.instructions.md](./merge/merge-details.instructions.md) +- **Testing**: See [testing.instructions.md](./testing.instructions.md) diff --git a/.github/instructions/setup.instructions.md b/.github/instructions/setup.instructions.md new file mode 100644 index 000000000000..00bb5b88746f --- /dev/null +++ b/.github/instructions/setup.instructions.md @@ -0,0 +1,85 @@ +--- +applyTo: "**/*" +--- + +# Repository Setup Instructions for AI Agents + +## Initial Repository Setup + +### Step 1: Clone Your Fork +```pwsh +# Replace 'your-username' with actual GitHub username +git clone https://github.com/your-username/openssh-portable.git +cd openssh-portable +``` + +### Step 2: Add Upstream Repositories +```pwsh +# Add PowerShell team's fork as upstream-pwsh +git remote add upstream-pwsh https://github.com/PowerShell/openssh-portable.git + +# Add original OpenSSH repository as upstream +git remote add upstream https://github.com/openssh/openssh-portable.git +``` + +### Step 3: Verify Remote Configuration +```pwsh +git remote -v +# Expected output: +# origin https://github.com/your-username/openssh-portable.git (fetch) +# origin https://github.com/your-username/openssh-portable.git (push) +# upstream https://github.com/openssh/openssh-portable.git (fetch) +# upstream https://github.com/openssh/openssh-portable.git (push) +# upstream-pwsh https://github.com/PowerShell/openssh-portable.git (fetch) +# upstream-pwsh https://github.com/PowerShell/openssh-portable.git (push) +``` + +### Step 4: Initial Fetch +Use the Invoke-Git MCP tool to fetch from all remotes: +- **MCP Tool**: `mcp_openssh-server_Invoke_Git` +- **Operation**: `Fetch`, **Remote**: `all` + +## Branch Strategy + +### Understanding the Branch Structure +- **upstream-pwsh/latestw_all**: Main Windows-compatible branch +- **upstream/master**: Latest upstream OpenSSH development +- **upstream/V_X_Y_PZ**: Tagged releases (merge targets) + +### Verification Commands +```pwsh +# List all branches +git branch -r + +# Check current branch +git branch +``` + +### Step 5: Clone VCPkg Repository +```pwsh +# In the same parent directory as openssh-portable +git clone https://github.com/Microsoft/vcpkg.git +``` + +### Step 6: Setup VCPkg Integration with MSBuild +```pwsh +cd vcpkg +.\bootstrap-vcpkg.bat +.\vcpkg.exe integrate install +``` + +## AI Agent Checklist + +Before proceeding to merge: +- [ ] Repository cloned successfully +- [ ] All three remotes configured (origin, upstream, upstream-pwsh) +- [ ] Can fetch from all remotes without errors +- [ ] Can see upstream target version/branch +- [ ] Working directory is clean (use Invoke-Git `Operation="Status"` — `ModifiedFiles` and `ConflictedFiles` should both be empty) + +## Troubleshooting + +### Common Issues +1. **Authentication errors**: Ensure GitHub credentials are configured +2. **Network issues**: Check proxy settings if behind corporate firewall +3. **Branch not found**: Verify branch/tag names are correct diff --git a/.github/instructions/testing.instructions.md b/.github/instructions/testing.instructions.md new file mode 100644 index 000000000000..5ad56413cc40 --- /dev/null +++ b/.github/instructions/testing.instructions.md @@ -0,0 +1,402 @@ +--- +applyTo: "**/*" +--- + +# Testing Instructions for AI Agents + +## Overview +This document provides comprehensive testing procedures for validating OpenSSH-Portable merges on Windows. Testing should be performed after successful compilation to ensure functionality is preserved. + +## Automated Testing with MCP Tools (Recommended) + +### Using Test-OpenSSHFunctionality Tool + +The repository includes an MCP tool that automates end-to-end functional testing of OpenSSH on Windows. + +Use the Test-OpenSSHFunctionality MCP tool: +- **MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHFunctionality` +- **Parameters**: + - `Configuration` (optional): "Debug" or "Release" (default: "Release") + - `Architecture` (optional): "x64", "x86", "ARM", "ARM64" (default: "x64") + - `SkipFirewall` (optional): Skip firewall configuration (default: false) + - `NoCleanup` (optional): Skip cleanup for debugging (default: false) + +**Examples:** +- Run with defaults: (no parameters needed) +- Test with specific configuration: `Configuration="Debug"`, `Architecture="x64"` +- Skip firewall configuration: `SkipFirewall=true` + +**What the tool does:** +1. Verifies Administrator privileges +2. Creates a temporary test user with random password +3. Installs and starts the SSH service +4. Configures Windows Firewall (unless -SkipFirewall is used) +5. Tests SSH connection with password authentication +6. Executes "echo hello world" command via SSH +7. Cleans up all resources (user, service, firewall rule) + +**Expected output on success:** +``` +=== OpenSSH Functionality Test === +[1/6] Checking Administrator privileges... +✓ Running with Administrator privileges +[2/6] Creating temporary test user... +✓ Created test user: openssh_test_1234 +[3/6] Installing SSH service... +✓ SSH service installed successfully +[4/6] Starting SSH service... +✓ SSH service started successfully +[5/6] Configuring Windows Firewall... +✓ Firewall rule created +[6/6] Testing SSH connection... +✓ SSH connection successful + Command output: hello world + +=== Cleanup === +✓ SSH service uninstalled +✓ Firewall rule removed +✓ Test user removed + +=== Test Summary === +Status: PASSED +``` + +**The tool returns a structured result object with:** +- `Success`: Boolean indicating overall test success +- `ServiceInstalled`: Whether service installation succeeded +- `ServiceStarted`: Whether service started successfully +- `ConnectionSuccessful`: Whether SSH connection test passed +- `CommandOutput`: Output from the test command +- `TestUser`: Name of the temporary test user created +- `Errors`: Array of any errors encountered +- `Message`: Summary message + +## Primary Testing Approach + +**Use the automated Test-OpenSSHFunctionality MCP tool for all testing.** + +The MCP tool performs comprehensive end-to-end testing including: +- Administrator privilege verification +- Temporary test user creation +- SSH service installation and startup +- Windows Firewall configuration +- SSH connection testing with password authentication +- Command execution verification +- Complete cleanup of all test resources + +**MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHFunctionality` + +**Parameters**: +- `Configuration` (optional): "Debug" or "Release" (default: "Release") +- `Architecture` (optional): "x64", "x86", "ARM", "ARM64" (default: "x64") +- `SkipFirewall` (optional): Skip firewall configuration (default: false) +- `NoCleanup` (optional): Skip cleanup for debugging (default: false) + +**When to use**: +- After successful build to validate functionality +- During merge process at CI checkpoints +- Before creating pull requests +- When debugging SSH connectivity issues + +## Full CI Test Suite + +For thorough validation (e.g., before submitting a PR or after a significant merge), run the complete CI test suite: unit tests, bash regression tests, and Pester E2E tests. + +Reference: https://github.com/PowerShell/Win32-OpenSSH/wiki/Run-OpenSSH-Pester-Tests + +### Using the Invoke-OpenSSHTests MCP Tool (Recommended) + +Use the Invoke-OpenSSHTests MCP tool: +- **MCP Tool Name**: `mcp_openssh-server_Invoke_OpenSSHTests` +- **Parameters**: + - `Configuration` (optional): "Debug" or "Release" (default: "Release") + - `Architecture` (optional): "x64", "x86", "ARM", "ARM64" (default: "x64") + - `TestSuite` (optional): "All", "Unit", "Bash", "E2E" — one or more values (default: "All") + - `BashTestFilePath` (optional): Absolute path to a single `.sh` test file for targeted bash testing (e.g., `C:\repos\openssh-portable\regress\banner.sh`) + - `BashShellPath` (optional): Path to `sh.exe` — auto-detected from common Cygwin locations if omitted + - `NoCleanup` (optional): Skip `Clear-OpenSSHTestEnvironment` after the run (default: false) + - `SkipSetup` (optional): Skip `Set-OpenSSHTestEnvironment` when environment is already configured (default: false) + +**The tool returns a structured result with:** +- `Success`: Overall pass/fail +- `UnitTestsPassed`, `BashTestsPassed`, `E2ETestsPassed`: Per-suite results (`$true`/`$false`/`$null` if not run) +- `UnitTestOutput`, `BashTestOutput`, `E2ETestOutput`: Captured output for each suite +- `Errors`: Array of failure messages +- `Warnings`: Known gotchas and environment notes +- `Message`: Summary + +**Examples:** +- Run full suite: (no parameters needed) +- Run only E2E tests: `TestSuite="E2E"` +- Run a single bash test: `TestSuite="Bash"`, `BashTestFilePath="C:\repos\openssh-portable\regress\banner.sh"` + +### Manually Running the Full CI Suite + +Binaries are expected at `C:\repos\openssh-portable\bin\{Architecture}\{Configuration}`. + +```pwsh +# 1. Import the test helper module +Import-Module C:\repos\openssh-portable\contrib\win32\openssh\OpenSSHTestHelper.psm1 -Force + +# 2. Configure the test environment (installs test accounts, sshd test service, etc.) +# This modifies known_hosts and ssh_config; run Clear-OpenSSHTestEnvironment to undo. +Set-OpenSSHTestEnvironment -OpenSSHBinPath "C:\repos\openssh-portable\bin\x64\Release" -Confirm:$false + +# 3. Run unit tests (unittest-*.exe binaries in the bin folder) +Invoke-OpenSSHUnitTest + +# 4. Run bash regression tests (requires Cygwin sh.exe) +Invoke-OpenSSHBashTests + +# 5. Run Pester E2E tests +Invoke-OpenSSHE2ETest + +# 6. Clean up test accounts, service, and ssh config changes +Clear-OpenSSHTestEnvironment +``` + +### Running a Single Bash Test + +Use `bash_tests_iterator.ps1` to run one bash test file in isolation: + +```pwsh +.\contrib\win32\openssh\bash_tests_iterator.ps1 ` + -OpenSSHBinPath "C:\repos\openssh-portable\bin\x64\Release" ` + -BashTestsPath "C:\repos\openssh-portable\regress" ` + -ShellPath "C:\cygwin64\bin\sh.exe" ` + -TestFilePath "C:\repos\openssh-portable\regress\banner.sh" +``` + +### Known CI Test Gotchas + +**`cfginclude.sh` — wrong PowerShell executable:** +The test calls `powershell.exe` directly. When running under `pwsh.exe`, the test will fail unless the file is edited to replace `powershell.exe` with `pwsh.exe`. +See: https://github.com/PowerShell/PowerShell/issues/18530#issuecomment-1325691850 + +**WSMan / Port Forwarding tests — disabled on some VMs:** +The WSMan and port-forwarding Pester tests may fail on VMs where these Windows features are disabled by default. Options: +- Enable the features: turn on "Windows Remote Management" and ensure port-forward firewall rules are allowed. +- Skip the affected test files (e.g., `PortForwarding.Tests.ps1`) when running `Invoke-OpenSSHE2ETest` for routine validation. + +**Pester version requirement:** +The E2E tests require **Pester version < 5**. The helper module will attempt to install Pester 3.4.6 via chocolatey if a compatible version is not found. + +**Cygwin required for bash tests:** +`Invoke-OpenSSHBashTests` auto-detects `sh.exe` at `%SystemDrive%\cygwin64\bin\sh.exe`, `%SystemDrive%\cygwin\bin\sh.exe`, or `%SystemDrive%\tools\cygwin\bin\sh.exe`. If none is found it installs Cygwin via chocolatey. Provide `-BashShellPath` to the MCP tool to override. + +## Validation Scenario Override: Entra-ID Debug Localhost + +Use this scenario when the prompt explicitly declares `Validation scenario=entra-id-debug-localhost`. + +In this scenario, do not create a temporary local user and random password. Instead, validate using an existing Entra-ID administrator account with key-based auth already configured. + +### Steps +1. Open terminal A in the build output directory and run sshd in foreground debug mode: +```pwsh +cd .\bin\x64\Release +.\sshd.exe -ddd +``` + +2. Open terminal B and attempt local key-based connection: +```pwsh +.\ssh.exe localhost +``` + +3. Confirm validation success by checking both sides: +- Client side: successful login on `ssh localhost` using existing key-based auth +- Server side (terminal A): no fatal errors during authentication/session setup + +### Notes +- This mode is intended for machines that already have admin key-based auth configured. +- Keep `sshd -ddd` running only for validation and stop it after the test. +- Use this scenario instead of `Test-OpenSSHFunctionality` when declared in the prompt. +- Use the rebuilt client and server from the same output directory (`.\bin\x64\Release`) to avoid version-mismatch handshake artifacts. +- Do not run extra port probes (for example `Test-NetConnection localhost -Port 22`) between starting `sshd -ddd` and the first `ssh` attempt; probes can consume the one foreground debug session and produce misleading connection-reset/refused behavior. + +## Manual Testing Procedures (For Troubleshooting Only) + +If the automated MCP tool fails and you need to troubleshoot specific issues manually, follow these procedures: + +### Prerequisites Check +```pwsh +# Verify Windows version compatibility +Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion + +# Check if running as Administrator - REQUIRED for service installation +if (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) +{ + Write-Error "Administrative privileges are REQUIRED for service installation and testing." + Write-Host "Please restart PowerShell or VS Code as Administrator and try again." -ForegroundColor Yellow + Write-Host "To elevate: Right-click PowerShell/VS Code -> 'Run as Administrator'" -ForegroundColor Yellow + exit 1 +} + +Write-Host "✓ Running with Administrator privileges" -ForegroundColor Green + +# Verify build artifacts exist +$buildPath = ".\contrib\win32\openssh\x64\Release" +if (-not (Test-Path "$buildPath\sshd.exe") -or -not (Test-Path "$buildPath\ssh.exe")) { + Write-Error "Build artifacts not found. Please build the project first." + exit 1 +} + +Write-Host "✓ Build artifacts verified" -ForegroundColor Green +``` + +### Test Environment Setup + +### Service Installation and Configuration + +#### Step 1: Install SSH Service +```pwsh +# Navigate to build directory +cd .\contrib\win32\openssh\x64\Release + +# Install SSH server service with PowerShell script +.\install-sshd.ps1 + +# Verify service installation +Get-Service sshd -ErrorAction SilentlyContinue | Select-Object Name, Status, StartType +``` + +#### Step 2: Configure SSH Service +```pwsh +# Start SSH service +Start-Service sshd + +# Verify service is running +Get-Service sshd | Select-Object Name, Status +``` + +#### Step 3: Configure Windows Firewall (if needed) +```pwsh +# Allow SSH through Windows Firewall +New-NetFirewallRule -DisplayName "SSH Server (sshd)" -Direction Inbound -Port 22 -Protocol TCP -Action Allow -ErrorAction SilentlyContinue +``` + +## Basic Functionality Tests + +### Test 1: SSH Client Connection +```pwsh +# Test local connection (most basic test) +$username = $env:USERNAME +$hostname = "localhost" + +Write-Host "Testing SSH connection: ssh $username@$hostname" + +# Basic connection test +.\ssh.exe $username@$hostname "echo 'SSH connection successful'" +``` + +**Expected Output:** +``` +SSH connection successful +``` + +## Error Diagnosis and Troubleshooting + +### Run SSH Server in Debug Mode +```pwsh +# Enable SSH daemon debug logging +Stop-Service sshd +.\sshd.exe -ddd + +# In another terminal, test connection with verbose client logging +.\ssh.exe -vvv $username@$hostname +``` + +### Common Issues and Solutions + +#### Issue 1: Service Won't Start +**Symptoms:** +- Service fails to start +- Event log shows service errors + +**Diagnosis:** +```pwsh +# Check event logs +Get-WinEvent -LogName System | Where-Object {$_.ProviderName -eq "Service Control Manager" -and $_.Id -eq 7034} | Select-Object -First 5 + +# Check sshd configuration +.\sshd.exe -T +``` + +**Common Solutions:** +- Verify configuration file syntax + +#### Issue 2: Connection Timeouts +**Symptoms:** +- SSH client hangs +- Connection timeout errors + +**Diagnosis:** +```pwsh +# Check network connectivity +Test-NetConnection -ComputerName localhost -Port 22 + +# Check Windows Firewall rules +Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*SSH*"} +``` + +## Success Criteria + +**Testing is successful when:** +- [ ] All expected executables are present after build (verified by Test-OpenSSHBuild MCP tool) +- [ ] SSH service installs and starts without errors +- [ ] SSH validation succeeds via either password authentication (standard) or `ssh localhost` key-based auth (entra-id-debug-localhost) +- [ ] Test command executes successfully via SSH connection +- [ ] All resources cleaned up properly after testing + + +## AI Agent Guidelines + +1. **Use automated testing tools** whenever possible - use the Test-OpenSSHFunctionality MCP tool over manual procedures +2. **Run tests incrementally** during the merge process, not just at the end +3. **Document any test failures** and their resolutions in commit messages +4. **Pay special attention to Windows-specific functionality** that might be affected by upstream changes +5. **Always verify cleanup** - ensure test users, services, and firewall rules are removed +6. **Report any new functionality** that needs additional testing procedures + +### Recommended Testing Workflow for AI Agents + +1. **After successful build**, run the automated functionality test: + - **MCP Tool Name**: `mcp_openssh-server_Test_OpenSSHFunctionality` + - **Parameters**: (use defaults) + + If the prompt declares `Validation scenario=entra-id-debug-localhost`, use the Entra-ID debug localhost flow instead: + - Run `.\sshd.exe -ddd` in one terminal from `.\bin\x64\Release` + - Run `.\ssh.exe localhost` in another terminal from `.\bin\x64\Release` + - Report outcome from both client connection behavior and server debug logs + +2. **If test passes**, the merge is validated for basic SSH functionality + +3. **If test fails**, use manual procedures and debug mode to diagnose issues + +4. **For full CI validation** (e.g., before creating a PR), run the complete test suite: + - **MCP Tool Name**: `mcp_openssh-server_Invoke_OpenSSHTests` + - **Parameters**: (use defaults to run all suites) + - If a specific suite fails, re-run it in isolation using `TestSuite="Unit"`, `TestSuite="Bash"`, or `TestSuite="E2E"` + - For a single failing bash test: `TestSuite="Bash"`, `BashTestFilePath=""` + +5. **Document results** in commit message or merge documentation + +## Manual Test Environment Cleanup + +If you ran manual tests instead of using the automated tool: + +```pwsh +# Clean up test environment +Stop-Service sshd -ErrorAction SilentlyContinue +cd .\contrib\win32\openssh\x64\Release +.\uninstall-sshd.ps1 + +# Remove firewall rule +Remove-NetFirewallRule -DisplayName "SSH Server (sshd)" -ErrorAction SilentlyContinue + +# Remove any test users manually created +Remove-LocalUser -Name "test_username" -ErrorAction SilentlyContinue + +Write-Host "Test environment cleaned up" +``` + +**Note:** The automated Test-OpenSSHFunctionality.ps1 tool handles all cleanup automatically, even on failure. diff --git a/.github/prompt/merge.prompt.md b/.github/prompt/merge.prompt.md new file mode 100644 index 000000000000..d5bd78140b6d --- /dev/null +++ b/.github/prompt/merge.prompt.md @@ -0,0 +1,35 @@ +# Merge Upstream Prompt + +Assist with merging the commits from upstream into this branch starting from the provided GitHub tag or commit. + +Provide the following when you invoke this prompt: +- Start ref (tag or commit) — REQUIRED (e.g., `upstream/V_9_8_P1` or a commit SHA) +- End ref (commit) — OPTIONAL (default: HEAD - most recent upstream commit) +- Upstream remote — optional (default: `upstream`) +- Windows fork remote — optional (default: `upstream-pwsh`) +- Target branch — optional (default: current branch) +- Validation scenario — optional (default: `standard`); set to `entra-id-debug-localhost` when the machine uses an Entra-ID admin account with existing key-based auth + +Operating guidance: +- Use and follow merge-upstream.agent.md. Treat it as the primary operating guide. +- Rely on the provided for repository overview, setup, build, merge strategy, and testing. Do not re-fetch or re-search them; assume they are already attached in context. +- Use the two-phase merge workflow: (1) incremental `git merge` on a scratch branch with resolution recording via `git rerere` and Save-MergeResolution, then (2) a single `git merge` on the real branch with resolution replay via `git rerere` and Replay-MergeResolutions. This preserves upstream commit history. +- Build using the MCP tools: `mcp_openssh-server_Start_OpenSSHBuild` (Release/x64 by default). If the build fails, analyze with `mcp_openssh-server_Test_OpenSSHBuild`. +- For validation, default to `mcp_openssh-server_Test_OpenSSHFunctionality`. If `Validation scenario=entra-id-debug-localhost` is declared, skip temporary local-user/password validation and instead run sshd in debug mode (`sshd -ddd`) and validate from a second terminal using `ssh localhost`. +- Apply Windows compatibility strategies as documented (prefer win32compat layer; guard with `#ifdef WINDOWS` when necessary; update VS projects for build system changes). +- Summarize a plan, request approval between batches, and clearly list conflict resolutions and rationale. + +Expected outputs per batch: +- Planned commit range and rationale for the batch boundary +- Conflict resolutions (what, why, how), especially Windows-specific handling +- Build result summary and, on failure, parsed errors with applied fixes +- Next-step proposal and explicit ask to proceed + +Quick start examples: +- "Merge from tag `upstream/V_9_8_P1` into my current branch." +- "Merge from tag `upstream/V_9_8_P1` to commit `a1b2c3d` into my current branch." +- "Merge starting at commit `3a1b2c3`, upstream remote `upstream`, target current branch." +- "Merge from tag `upstream/V_10_0_P2` to `upstream/V_10_3_P1`, validation scenario `entra-id-debug-localhost`." + +If the Start ref is not provided, ask for it before proceeding. +If the End ref is not provided, merging will continue to HEAD (most recent upstream commit). diff --git a/.github/setup_ci.sh b/.github/setup_ci.sh index f6c4a5c84fb5..e4c7b041aa50 100755 --- a/.github/setup_ci.sh +++ b/.github/setup_ci.sh @@ -12,7 +12,15 @@ case "$host" in echo Setting CYGWIN system environment variable. setx CYGWIN "binmode" echo Removing extended ACLs so umask works as expected. + set -x setfacl -b . regress + icacls regress /c /t /q /Inheritance:d + icacls regress /c /t /q /Grant ${LOGNAME}:F + icacls regress /c /t /q /Remove:g "Authenticated Users" \ + BUILTIN\\Administrators BUILTIN Everyone System Users + takeown /F regress + icacls regress + set +x PACKAGES="$PACKAGES,autoconf,automake,cygwin-devel,gcc-core" PACKAGES="$PACKAGES,make,openssl,libssl-devel,zlib-devel" ;; @@ -184,7 +192,7 @@ while [ ! -z "$PACKAGES" ] && [ "$tries" -gt "0" ]; do fi ;; setup) - if /cygdrive/c/setup.exe -q -P `echo "$PACKAGES" | tr ' ' ,`; then + if /cygdrive/d/cygwin/setup.exe -q -P `echo "$PACKAGES" | tr ' ' ,`; then PACKAGES="" fi ;; @@ -240,7 +248,7 @@ if [ ! -z "${INSTALL_BORINGSSL}" ]; then cd ${HOME}/boringssl && mkdir build && cd build && cmake -GNinja -DCMAKE_POSITION_INDEPENDENT_CODE=ON .. && ninja && mkdir -p /opt/boringssl/lib && - cp ${HOME}/boringssl/build/crypto/libcrypto.a /opt/boringssl/lib && + cp ${HOME}/boringssl/build/libcrypto.a /opt/boringssl/lib && cp -r ${HOME}/boringssl/include /opt/boringssl) fi diff --git a/.github/tools/Get-CommitGroups.ps1 b/.github/tools/Get-CommitGroups.ps1 new file mode 100644 index 000000000000..c2e2b18049d8 --- /dev/null +++ b/.github/tools/Get-CommitGroups.ps1 @@ -0,0 +1,418 @@ +<# +.SYNOPSIS + Groups upstream OpenSSH commits into batches based on CI success status or CI presence. + +.DESCRIPTION + This script fetches commits from the openssh/openssh-portable repository on GitHub + and groups them into batches (chunks) based on CI test results. By default, each chunk + ends with a commit that has all CI tests passing (success or skipped). Alternatively, + when using -GroupByCIPresence, each chunk ends with any commit that has CI runs, + regardless of success or failure. + + The script is designed to help with incremental merging of upstream commits by + identifying safe stopping points where all tests pass (or where CI exists). + + When the total number of commits exceeds 250 (GitHub API limit), the script + automatically adjusts to fetch the first 250 commits in chronological order. + +.PARAMETER GitHubTag + The GitHub tag to start from (e.g., "V_10_0_P2"). Cannot be used with -StartCommit. + The script will find commits after this tag up to HEAD. + +.PARAMETER StartCommit + The commit SHA to start from (e.g., "6fb728df50c1afd338cb0223a84ce24579577eff"). + Cannot be used with -GitHubTag. The script will find commits after this commit up to EndCommit (or HEAD if not specified). + This is typically used when continuing from a previously merged commit. + +.PARAMETER EndCommit + The commit SHA to end at (e.g., "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"). + If not specified, defaults to HEAD (most recent upstream commit). + This allows merging up to a specific commit rather than always merging to HEAD. + +.PARAMETER FirstChunkOnly + When specified, the script stops after finding the first chunk with a successful CI commit + (or first chunk with any CI when using -GroupByCIPresence). + This is useful for incremental processing where you want to merge one batch at a time. + +.PARAMETER GroupByCIPresence + When specified, groups commits by CI presence (any CI run exists) rather than CI success. + Each chunk ends with a commit that has any CI runs, regardless of pass/fail status. + Default behavior (without this flag) groups by CI success only. + +.OUTPUTS + Returns an array of chunk objects, each containing: + - ChunkNumber: Sequential number of the chunk + - StartIndex/EndIndex: Array indices for the chunk range + - StartCommit/EndCommit: Short SHA (7 chars) of first and last commits + - StartCommitFull/EndCommitFull: Full SHA of first and last commits + - CommitCount: Number of commits in the chunk + - StartMessage/EndMessage: Commit messages for first and last commits + +.EXAMPLE + .\Get-CommitGroups.ps1 -GitHubTag "V_10_0_P2" -FirstChunkOnly + + Finds the first batch of commits after the V_10_0_P2 tag that ends with passing CI. + +.EXAMPLE + .\Get-CommitGroups.ps1 -StartCommit "6fb728df50c1afd338cb0223a84ce24579577eff" -FirstChunkOnly + + Finds the first batch of commits after the specified commit that ends with passing CI. + Useful for continuing from where a previous merge left off. + +.EXAMPLE + .\Get-CommitGroups.ps1 -StartCommit "6fb728df50c1afd338cb0223a84ce24579577eff" + + Finds all batches of commits after the specified commit, grouping by CI success. + Each batch ends with a commit that has passing CI tests. + +.EXAMPLE + .\Get-CommitGroups.ps1 -GitHubTag "V_10_0_P2" -GroupByCIPresence -FirstChunkOnly + + Finds the first batch of commits after the V_10_0_P2 tag that ends with any commit + that has CI runs (regardless of success or failure). + +.EXAMPLE + .\Get-CommitGroups.ps1 -StartCommit "6fb728df50c1afd338cb0223a84ce24579577eff" -EndCommit "a1b2c3d4e5f6" -FirstChunkOnly + + Finds the first batch of commits between the specified start and end commits. + Useful for merging a specific range rather than all commits up to HEAD. + +.NOTES + - Requires internet access to query GitHub API + - Set GITHUB_TOKEN environment variable for authenticated API access (5,000 requests/hour) + - Without token: rate limited with 200ms delay between commits (60 requests/hour) + - Maximum 250 commits per API call (automatically handled) + - CI status is checked via GitHub check-runs API with pagination support + - Default mode: Commits with "success" or "skipped" CI conclusions are considered passing + - GroupByCIPresence mode: Any commit with CI runs (regardless of result) ends a chunk + +.LINK + https://github.com/openssh/openssh-portable +#> + +param( + [Parameter(Mandatory=$false)] + [string]$GitHubTag, + + [Parameter(Mandatory=$false)] + [string]$StartCommit, + + [Parameter(Mandatory=$false)] + [string]$EndCommit, + + [Parameter(Mandatory=$false)] + [switch]$FirstChunkOnly, + + [Parameter(Mandatory=$false)] + [switch]$GroupByCIPresence +) + +# Validate parameters +if (-not $GitHubTag -and -not $StartCommit) { + Write-Error "Either -GitHubTag or -StartCommit must be provided" + exit 1 +} + +if ($GitHubTag -and $StartCommit) { + Write-Error "Cannot specify both -GitHubTag and -StartCommit. Please provide only one." + exit 1 +} + +# Configuration +$repo = "openssh/openssh-portable" +$apiBase = "https://api.github.com/repos/$repo" + +# Check for GitHub token for authenticated API access +$script:githubToken = $env:GITHUB_TOKEN +if ($script:githubToken) { + Write-Host "Using authenticated GitHub API (higher rate limits)" -ForegroundColor Green +} else { + Write-Host "Using unauthenticated GitHub API (rate limited - consider setting GITHUB_TOKEN)" -ForegroundColor Yellow +} + +if ($GitHubTag) { + Write-Host "Fetching commits starting from tag: $GitHubTag" -ForegroundColor Cyan +} else { + Write-Host "Fetching commits starting from commit: $StartCommit" -ForegroundColor Cyan +} + +# Function to get GitHub API headers with optional authentication +function Get-GitHubHeaders { + $headers = @{ + "User-Agent" = "PowerShell" + "Accept" = "application/vnd.github+json" + } + + if ($script:githubToken) { + $headers["Authorization"] = "Bearer $script:githubToken" + } + + return $headers +} + +# Get the starting commit SHA +try { + if ($GitHubTag) { + $tagInfo = Invoke-RestMethod -Uri "$apiBase/git/refs/tags/$GitHubTag" -Headers (Get-GitHubHeaders) + $startCommitSha = $tagInfo.object.sha + + # If it's an annotated tag, we need to get the actual commit + if ($tagInfo.object.type -eq "tag") { + $tagObject = Invoke-RestMethod -Uri $tagInfo.object.url -Headers (Get-GitHubHeaders) + $startCommitSha = $tagObject.object.sha + } + + Write-Host "Tag $GitHubTag points to commit: $startCommitSha" -ForegroundColor Green + } else { + # Validate the commit exists + $commitInfo = Invoke-RestMethod -Uri "$apiBase/commits/$StartCommit" -Headers (Get-GitHubHeaders) + $startCommitSha = $commitInfo.sha + Write-Host "Starting from commit: $startCommitSha" -ForegroundColor Green + } +} catch { + Write-Error "Failed to retrieve starting commit information: $_" + exit 1 +} + +# Function to check CI status for a commit +function Get-CommitCIStatus { + param( + [string]$sha, + [bool]$checkPresenceOnly = $false + ) + + try { + $allCheckRuns = @() + $page = 1 + $perPage = 100 + + # Fetch all pages of check runs + do { + $checkRunsUrl = "$apiBase/commits/$sha/check-runs?per_page=$perPage&page=$page" + $response = Invoke-RestMethod -Uri $checkRunsUrl -Headers (Get-GitHubHeaders) + + $allCheckRuns += $response.check_runs + $page++ + + } while ($response.check_runs.Count -eq $perPage) + + # Check if there are any check runs + if ($allCheckRuns.Count -eq 0) { + return "no_ci" + } + + # If only checking for presence, return has_ci + if ($checkPresenceOnly) { + return "has_ci" + } + + # Check if all check runs are successful or skipped + $allSuccessful = $true + foreach ($checkRun in $allCheckRuns) { + # Accept "success" or "skipped" as valid conclusions + if ($checkRun.conclusion -ne "success" -and $checkRun.conclusion -ne "skipped") { + $allSuccessful = $false + break + } + } + + if ($allSuccessful) { + return "success" + } else { + return "failure" + } + } catch { + Write-Warning "Could not get CI status for commit $sha : $_" + return "unknown" + } +} + +# Function to get commit details +function Get-CommitDetails { + param([string]$sha) + + try { + $commitUrl = "$apiBase/commits/$sha" + $commit = Invoke-RestMethod -Uri $commitUrl -Headers (Get-GitHubHeaders) + return @{ + Sha = $commit.sha.Substring(0, 7) + FullSha = $commit.sha + Message = $commit.commit.message.Split("`n")[0] + Author = $commit.commit.author.name + Date = $commit.commit.author.date + } + } catch { + Write-Warning "Could not get commit details for $sha" + return $null + } +} + +# Fetch commits starting from the tag using compare API +Write-Host "`nFetching commits from the repository..." -ForegroundColor Cyan + +try { + # Get commits after the starting commit (excluding the start commit itself) + $allCommits = @() + $page = 1 + $perPage = 250 # Compare API returns max 250 commits per page + + $endRef = if ($EndCommit) { $EndCommit } else { "HEAD" } + Write-Host "Fetching commits from $startCommitSha...$endRef" -ForegroundColor Gray + + # The Compare API doesn't support pagination, so we need to use commits API instead + # to get commits in the correct range with proper pagination + $compareUrl = "$apiBase/compare/${startCommitSha}...$endRef" + $comparison = Invoke-RestMethod -Uri $compareUrl -Headers (Get-GitHubHeaders) + + # The Compare API returns commits - need to verify order + # According to GitHub API docs, commits are in chronological order (oldest first) + $allCommits = @($comparison.commits) + + # If we hit the 250 commit limit, we need to get the actual first 250 commits + # by iteratively narrowing the range until we get 250 or fewer commits + while ($comparison.total_commits -gt 250) { + Write-Host "Warning: Total commits ($($comparison.total_commits)) exceeds API limit (250)." -ForegroundColor Yellow + Write-Host "Fetching first 250 commits by narrowing the range..." -ForegroundColor Cyan + + # Get the oldest commit SHA from the current batch (first in chronological order) + # Since the batch is limited to 250, this is approximately the 250th commit from start + $oldestCommitSha = $allCommits[0].sha + + # Now compare from start to this oldest commit to narrow down the range + $limitedCompareUrl = "$apiBase/compare/${startCommitSha}...${oldestCommitSha}" + Write-Host "Comparing $startCommitSha...$oldestCommitSha" -ForegroundColor Gray + $comparison = Invoke-RestMethod -Uri $limitedCompareUrl -Headers (Get-GitHubHeaders) + + $allCommits = @($comparison.commits) + Write-Host "Narrowed to $($comparison.total_commits) total commits ($($allCommits.Count) returned)" -ForegroundColor Green + } + + $startRef = if ($GitHubTag) { "tag $GitHubTag" } else { "commit $StartCommit" } + Write-Host "Found $($allCommits.Count) commits from $startRef" -ForegroundColor Green +} catch { + Write-Error "Failed to fetch commits: $_" + exit 1 +} + +# Process commits and check CI status +$statusCheckMessage = if ($GroupByCIPresence) { "Checking CI presence for each commit..." } else { "Checking CI status for each commit..." } +Write-Host "`n$statusCheckMessage" -ForegroundColor Cyan + +$commitsWithStatus = @() +$chunks = @() +$commitCount = 0 +$chunkStart = 0 + +foreach ($commit in $allCommits) { + $commitCount++ + Write-Host "Processing commit $commitCount of $($allCommits.Count): $($commit.sha.Substring(0,7))" -ForegroundColor Gray + + $status = Get-CommitCIStatus -sha $commit.sha -checkPresenceOnly $GroupByCIPresence + $details = Get-CommitDetails -sha $commit.sha + + if ($details) { + $commitsWithStatus += [PSCustomObject]@{ + Index = $commitCount - 1 + Sha = $details.Sha + FullSha = $details.FullSha + Message = $details.Message + Author = $details.Author + Date = $details.Date + CIStatus = $status + } + + # Check if this commit completes a chunk (based on grouping mode) + $targetStatus = if ($GroupByCIPresence) { "has_ci" } else { "success" } + if ($status -eq $targetStatus) { + $chunkEnd = $commitsWithStatus.Count - 1 + + $chunks += [PSCustomObject]@{ + ChunkNumber = $chunks.Count + 1 + StartIndex = $chunkStart + EndIndex = $chunkEnd + StartCommit = $commitsWithStatus[$chunkStart].Sha + EndCommit = $commitsWithStatus[$chunkEnd].Sha + StartCommitFull = $commitsWithStatus[$chunkStart].FullSha + EndCommitFull = $commitsWithStatus[$chunkEnd].FullSha + CommitCount = $chunkEnd - $chunkStart + 1 + StartMessage = $commitsWithStatus[$chunkStart].Message + EndMessage = $commitsWithStatus[$chunkEnd].Message + } + + $chunkStart = $commitsWithStatus.Count + + # If FirstChunkOnly is specified, stop after finding the first chunk + if ($FirstChunkOnly) { + $chunkFoundMessage = if ($GroupByCIPresence) { "Found first chunk with CI, stopping..." } else { "Found first successful chunk, stopping..." } + Write-Host $chunkFoundMessage -ForegroundColor Green + break + } + } + } + + # Rate limiting - only needed for unauthenticated requests + if (-not $script:githubToken) { + Start-Sleep -Milliseconds 200 + } +} + +# Handle remaining commits that don't end with success (only if not FirstChunkOnly or no chunk found) +if (-not $FirstChunkOnly -and $chunkStart -lt $commitsWithStatus.Count) { + $chunkEnd = $commitsWithStatus.Count - 1 + $chunks += [PSCustomObject]@{ + ChunkNumber = $chunks.Count + 1 + StartIndex = $chunkStart + EndIndex = $chunkEnd + StartCommit = $commitsWithStatus[$chunkStart].Sha + EndCommit = $commitsWithStatus[$chunkEnd].Sha + StartCommitFull = $commitsWithStatus[$chunkStart].FullSha + EndCommitFull = $commitsWithStatus[$chunkEnd].FullSha + CommitCount = $chunkEnd - $chunkStart + 1 + StartMessage = $commitsWithStatus[$chunkStart].Message + EndMessage = $commitsWithStatus[$chunkEnd].Message + } +} + +Write-Host "`nGrouping complete." -ForegroundColor Cyan + +# Display results +$groupingMode = if ($GroupByCIPresence) { "CI Presence" } else { "CI Success" } +Write-Host "\n========================================" -ForegroundColor Cyan +Write-Host "COMMIT CHUNKS (Grouped by $groupingMode)" -ForegroundColor Cyan +Write-Host "========================================`n" -ForegroundColor Cyan + +foreach ($chunk in $chunks) { + Write-Host "Chunk $($chunk.ChunkNumber): $($chunk.CommitCount) commits" -ForegroundColor Yellow + Write-Host " Start: $($chunk.StartCommit) - $($chunk.StartMessage)" -ForegroundColor White + Write-Host " End: $($chunk.EndCommit) - $($chunk.EndMessage)" -ForegroundColor Green + Write-Host " Commit Pair: ($($chunk.StartCommitFull), $($chunk.EndCommitFull))" -ForegroundColor Magenta + Write-Host "" +} + +Write-Host "`nTotal Chunks: $($chunks.Count)" -ForegroundColor Cyan +Write-Host "Total Commits: $($commitsWithStatus.Count)" -ForegroundColor Cyan + +# Output detailed commit list +Write-Host "`n========================================" -ForegroundColor Cyan +Write-Host "DETAILED COMMIT LIST" -ForegroundColor Cyan +Write-Host "========================================`n" -ForegroundColor Cyan + +# Only show commits that are part of returned chunks +$maxIndex = if ($chunks.Count -gt 0) { $chunks[-1].EndIndex } else { -1 } +foreach ($commit in $commitsWithStatus) { + if ($commit.Index -le $maxIndex) { + $statusColor = switch ($commit.CIStatus) { + "success" { "Green" } + "has_ci" { "Green" } + "failure" { "Red" } + "no_ci" { "Yellow" } + "pending" { "Yellow" } + default { "Gray" } + } + + Write-Host "$($commit.Sha) | $($commit.CIStatus.PadRight(10)) | $($commit.Message.Substring(0, [Math]::Min(60, $commit.Message.Length)))" -ForegroundColor $statusColor + } +} + +# Return the chunks for potential further processing +return $chunks diff --git a/.github/tools/Get-ConflictContext.ps1 b/.github/tools/Get-ConflictContext.ps1 new file mode 100644 index 000000000000..46bab7be45b1 --- /dev/null +++ b/.github/tools/Get-ConflictContext.ps1 @@ -0,0 +1,490 @@ +<# +.SYNOPSIS + Retrieves three-way context for a conflicted file to aid complex conflict resolution. + +.DESCRIPTION + MCP-compatible tool that fetches three versions of a file involved in a merge or + cherry-pick conflict — the upstream file before the commit, the upstream file after + the commit, and our fork's version (via HEAD) — and extracts focused, line-numbered + excerpts centered on each changed hunk. + + For each hunk in the upstream diff, the tool locates the corresponding region in our + fork using two-tier content matching: + Tier 1: Sliding-window overlap score against unchanged context lines from the diff. + Tier 2: Fallback to searching for the function name from the @@ hunk header. + + This handles line-number divergence between upstream and our fork by finding the + region by content rather than by position. + + Use this tool ONLY when conflict complexity assessment returns HIGH_COMPLEXITY. + +.PARAMETER FilePath + Path to the conflicted file, relative to the repository root. + +.PARAMETER CommitHash + The upstream commit SHA that caused the conflict. During the scratch-branch merge + workflow, this is typically the batch endpoint commit passed to git merge. + +.PARAMETER ContextLines + Number of lines of context above and below each hunk match to include in excerpts. + Default: 40 + +.PARAMETER MaxTotalLines + Maximum total lines returned across all three versions combined (across all hunks). + Budget per version per hunk = max(10, floor(MaxTotalLines / 3 / hunkCount)). + The minimum floor of 10 lines per version per hunk is always enforced. + If the floor overrides the calculated budget, a warning is included in Message. + Default: 150 (approximately 50 lines per version) + +.OUTPUTS + Hashtable with: + Success [bool] Whether the operation completed without errors + Message [string] Human-readable summary (includes warnings about budget) + CommitMessage [string] The commit message of CommitHash + UpstreamDiff [string] Raw unified diff for the file from this commit + HunkCount [int] Number of hunks found in the upstream diff + IsBinary [bool] True if the file is binary (no excerpts returned) + Hunks [array] One entry per hunk: + HunkIndex [int] 1-based hunk number + HunkHeader [string] The @@ header line + FunctionName [string] Function name extracted from @@ header (may be empty) + UpstreamBefore [object] { Lines, StartLine, EndLine, Note } + UpstreamAfter [object] { Lines, StartLine, EndLine, Note } + OurFork [object] { Lines, StartLine, EndLine, Note } + + Each excerpt object: + Lines [string[]] The extracted lines (null if version unavailable) + StartLine [int] 1-based line number of first line in the excerpt + EndLine [int] 1-based line number of last line in the excerpt + Note [string] Explanation if unavailable or how region was located + +.EXAMPLE + # Get conflict context for a high-complexity conflict + # MCP Tool: mcp_openssh-server_Get_ConflictContext + # FilePath="auth.c", CommitHash="abc1234" + +.EXAMPLE + # Get context with increased budget for a file with many hunks + # MCP Tool: mcp_openssh-server_Get_ConflictContext + # FilePath="channels.c", CommitHash="abc1234", MaxTotalLines=300 +#> + +param( + [Parameter(Mandatory)] + [string]$FilePath, + + [Parameter(Mandatory)] + [string]$CommitHash, + + [int]$ContextLines = 40, + + [int]$MaxTotalLines = 150 +) + +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' + +# ── Git process helper (same pattern as Invoke-Git.ps1) ────────────────────── + +function Invoke-GitCommand { + param([string[]]$Arguments) + + $processInfo = [System.Diagnostics.ProcessStartInfo]::new() + $processInfo.FileName = 'git' + $processInfo.Arguments = ($Arguments | ForEach-Object { + if ($_ -match '\s') { "`"$_`"" } else { $_ } + }) -join ' ' + $processInfo.UseShellExecute = $false + $processInfo.CreateNoWindow = $true + $processInfo.RedirectStandardInput = $true + $processInfo.RedirectStandardOutput = $true + $processInfo.RedirectStandardError = $true + + $process = [System.Diagnostics.Process]::new() + $process.StartInfo = $processInfo + $process.Start() | Out-Null + $process.StandardInput.Close() + + $stdoutTask = $process.StandardOutput.ReadToEndAsync() + $stderrTask = $process.StandardError.ReadToEndAsync() + + $completed = $process.WaitForExit(30000) + + if (-not $completed) { + $process.Kill() + return @{ + ExitCode = -1 + Success = $false + Output = '' + Error = "git $($Arguments -join ' ') timed out after 30 seconds" + } + } + + return @{ + ExitCode = $process.ExitCode + Success = ($process.ExitCode -eq 0) + Output = $stdoutTask.GetAwaiter().GetResult() + Error = $stderrTask.GetAwaiter().GetResult().TrimEnd() + } +} + +# ── Helper: fetch a file at a git ref ──────────────────────────────────────── + +function Get-FileAtRef { + param([string]$Ref, [string]$File) + + $r = Invoke-GitCommand -Arguments @('show', "${Ref}:${File}") + if (-not $r.Success) { + return @{ Lines = $null; Note = "File not available at ref '${Ref}': $($r.Error.Trim())" } + } + $lines = $r.Output -split "`n" + # Remove trailing empty element produced by split on a newline-terminated string + if ($lines.Count -gt 0 -and $lines[-1] -eq '') { + $lines = $lines[0..($lines.Count - 2)] + } + return @{ Lines = $lines; Note = $null } +} + +# ── Helper: slice a line-numbered excerpt centred on a 1-based line ────────── + +function Get-Excerpt { + param( + [string[]]$Lines, + [int]$CenterLine, # 1-based + [int]$Budget # max lines to return + ) + + if (-not $Lines) { return $null } + $half = [Math]::Floor($Budget / 2) + $start = [Math]::Max(0, $CenterLine - 1 - $half) + $end = [Math]::Min($Lines.Count - 1, $CenterLine - 1 + $half) + + # Expand toward the opposite edge if we hit a boundary before using the full budget + if (($end - $start + 1) -lt $Budget) { + if ($start -eq 0) { + $end = [Math]::Min($Lines.Count - 1, $Budget - 1) + } else { + $start = [Math]::Max(0, $end - $Budget + 1) + } + } + + return @{ + Lines = $Lines[$start..$end] + StartLine = $start + 1 + EndLine = $end + 1 + Note = $null + } +} + +# ── Helper: sliding-window content-anchor match ─────────────────────────────── +# Returns the 1-based centre line in $FileLines that best overlaps $AnchorLines. + +function Find-AnchorMatch { + param( + [string[]]$FileLines, + [string[]]$AnchorLines, + [int]$ExpectedCenter # 1-based fallback if no match found + ) + + $anchorSet = @{} + foreach ($a in $AnchorLines) { + $t = $a.Trim() + if ($t) { $anchorSet[$t] = $true } + } + + $windowSize = [Math]::Max($AnchorLines.Count, 5) + $bestScore = -1 + $bestCenter = $ExpectedCenter + + for ($i = 0; $i -le ($FileLines.Count - $windowSize); $i++) { + $score = 0 + for ($j = $i; $j -lt ($i + $windowSize) -and $j -lt $FileLines.Count; $j++) { + $trimmed = $FileLines[$j].Trim() + if ($trimmed -and $anchorSet.ContainsKey($trimmed)) { $score++ } + } + if ($score -gt $bestScore) { + $bestScore = $score + $bestCenter = $i + [Math]::Floor($windowSize / 2) + 1 # convert to 1-based + } + } + + return @{ + Center = $bestCenter + Score = $bestScore + MaxPossible = $anchorSet.Count + } +} + +# ── Helper: find the first line in $FileLines containing $FunctionName ─────── + +function Find-FunctionMatch { + param( + [string[]]$FileLines, + [string]$FunctionName + ) + + $pattern = "\b$([regex]::Escape($FunctionName))\b" + for ($i = 0; $i -lt $FileLines.Count; $i++) { + if ($FileLines[$i] -match $pattern) { + return $i + 1 # 1-based + } + } + return -1 +} + +# ── Helper: parse all @@ hunks from unified diff text ──────────────────────── + +function Parse-DiffHunks { + param([string]$DiffText) + + $hunks = @() + $lines = $DiffText -split "`n" + $currentHunk = $null + $contextAccum = @() + $inHunk = $false + + foreach ($line in $lines) { + if ($line -match '^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(.*)$') { + + # Flush the previous hunk before starting a new one + if ($null -ne $currentHunk) { + $currentHunk['ContextLines'] = $contextAccum + $hunks += $currentHunk + } + + $upstreamStart = [int]$Matches[1] + $upstreamCount = if ($Matches[2]) { [int]$Matches[2] } else { 1 } + $afterStart = [int]$Matches[3] + $afterCount = if ($Matches[4]) { [int]$Matches[4] } else { 1 } + $funcTrailer = $Matches[5].Trim() + + # Extract function name from the optional trailer after @@ + $funcName = '' + if ($funcTrailer -match '(\w[\w_]*)\s*\(') { + $funcName = $Matches[1] + } elseif ($funcTrailer -match '(\w[\w_]+)') { + $funcName = $Matches[1] + } + + $currentHunk = @{ + Header = $line.Trim() + FunctionName = $funcName + UpstreamStart = $upstreamStart + UpstreamCount = $upstreamCount + AfterStart = $afterStart + AfterCount = $afterCount + } + $contextAccum = @() + $inHunk = $true + + } elseif ($inHunk) { + # Collect unchanged context lines (lines starting with a space) + if ($line -match '^ (.*)$') { + $contextAccum += $Matches[1] + } + } + } + + # Flush the last hunk + if ($null -ne $currentHunk) { + $currentHunk['ContextLines'] = $contextAccum + $hunks += $currentHunk + } + + return $hunks +} + +# ── Main ────────────────────────────────────────────────────────────────────── + +$warnings = @() + +# 1. Get the upstream diff for this file at this commit +$diffResult = Invoke-GitCommand -Arguments @('diff', "${CommitHash}^..${CommitHash}", '--', $FilePath) +if (-not $diffResult.Success -and $diffResult.ExitCode -ne 1) { + return @{ + Success = $false + Message = "Failed to get diff for '${FilePath}' at commit ${CommitHash}: $($diffResult.Error)" + CommitMessage = '' + UpstreamDiff = '' + HunkCount = 0 + IsBinary = $false + Hunks = @() + } +} + +$upstreamDiff = $diffResult.Output + +# 2. Binary file — return early with a note, no excerpts +if ($upstreamDiff -match 'Binary files .* differ') { + return @{ + Success = $true + Message = "Binary file — context not available for '${FilePath}'." + CommitMessage = '' + UpstreamDiff = $upstreamDiff + HunkCount = 0 + IsBinary = $true + Hunks = @() + } +} + +# 3. File not touched by this commit +if ([string]::IsNullOrWhiteSpace($upstreamDiff)) { + return @{ + Success = $true + Message = "File '${FilePath}' was not modified by commit ${CommitHash}." + CommitMessage = '' + UpstreamDiff = '' + HunkCount = 0 + IsBinary = $false + Hunks = @() + } +} + +# 4. Get the commit message +$commitMsgResult = Invoke-GitCommand -Arguments @('log', '-1', '--pretty=format:%s%n%n%b', $CommitHash) +$commitMessage = if ($commitMsgResult.Success) { $commitMsgResult.Output.Trim() } else { '' } + +# 5. Fetch the three file versions +# HEAD is our fork's version of the file during both merge and cherry-pick conflicts. +# CommitHash^ is the upstream state before the commit; CommitHash is after. +$upstreamBefore = Get-FileAtRef -Ref "${CommitHash}^" -File $FilePath +$upstreamAfter = Get-FileAtRef -Ref "${CommitHash}" -File $FilePath +$ourFork = Get-FileAtRef -Ref 'HEAD' -File $FilePath + +# 6. Parse hunks from the diff +$hunks = Parse-DiffHunks -DiffText $upstreamDiff +$hunkCount = $hunks.Count + +if ($hunkCount -eq 0) { + return @{ + Success = $true + Message = "No hunks found in diff for '${FilePath}' at commit ${CommitHash}." + CommitMessage = $commitMessage + UpstreamDiff = $upstreamDiff + HunkCount = 0 + IsBinary = $false + Hunks = @() + } +} + +# 7. Compute per-hunk line budget +# MaxTotalLines is split evenly across 3 versions and all hunks. +# Minimum floor of 10 lines per version per hunk is always enforced. +$MIN_LINES_PER_HUNK = 10 +$budgetPerHunk = [Math]::Floor($MaxTotalLines / 3 / $hunkCount) + +if ($budgetPerHunk -lt $MIN_LINES_PER_HUNK) { + $warnings += "MaxTotalLines=${MaxTotalLines} is too small for ${hunkCount} hunk(s) across 3 versions; " + + "minimum floor of ${MIN_LINES_PER_HUNK} lines applied — consider increasing MaxTotalLines." + $budgetPerHunk = $MIN_LINES_PER_HUNK +} + +# Never exceed the caller's ContextLines preference +$budgetPerHunk = [Math]::Min($budgetPerHunk, $ContextLines) + +# 8. Build per-hunk results +$ANCHOR_SCORE_THRESHOLD = 2 +$resultHunks = @() + +for ($h = 0; $h -lt $hunkCount; $h++) { + + $hunk = $hunks[$h] + $anchorLines = $hunk['ContextLines'] + + # ── upstream-before: line numbers are known from the diff header ────────── + $uBefore = @{ Lines = $null; StartLine = $null; EndLine = $null; Note = $upstreamBefore.Note } + if ($upstreamBefore.Lines) { + $center = $hunk['UpstreamStart'] + [Math]::Floor($hunk['UpstreamCount'] / 2) + $excerpt = Get-Excerpt -Lines $upstreamBefore.Lines -CenterLine $center -Budget $budgetPerHunk + if ($excerpt) { $uBefore = $excerpt } + } + + # ── upstream-after: line numbers are known from the diff header ─────────── + $uAfter = @{ Lines = $null; StartLine = $null; EndLine = $null; Note = $upstreamAfter.Note } + if ($upstreamAfter.Lines) { + $center = $hunk['AfterStart'] + [Math]::Floor($hunk['AfterCount'] / 2) + $excerpt = Get-Excerpt -Lines $upstreamAfter.Lines -CenterLine $center -Budget $budgetPerHunk + if ($excerpt) { $uAfter = $excerpt } + } + + # ── our fork: line numbers diverge — locate by content matching ────────── + $forkExcerpt = @{ Lines = $null; StartLine = $null; EndLine = $null; Note = $ourFork.Note } + + if ($ourFork.Lines) { + $forkCenter = $hunk['UpstreamStart'] # fallback: use upstream line number as estimate + $matchNote = $null + + if ($anchorLines.Count -ge 2) { + # Tier 1: sliding-window content match against unchanged context lines + $match = Find-AnchorMatch -FileLines $ourFork.Lines ` + -AnchorLines $anchorLines ` + -ExpectedCenter $forkCenter + + if ($match.Score -ge $ANCHOR_SCORE_THRESHOLD) { + $forkCenter = $match.Center + $matchNote = "Located via content-anchor match (score $($match.Score)/$($match.MaxPossible))." + } elseif ($hunk['FunctionName']) { + # Tier 2: anchor score too low — fall back to function name search + $fnLine = Find-FunctionMatch -FileLines $ourFork.Lines -FunctionName $hunk['FunctionName'] + if ($fnLine -gt 0) { + $forkCenter = $fnLine + $matchNote = "Located via function-name fallback ('$($hunk['FunctionName'])')." + } else { + $matchNote = "Could not locate region — anchor score too low and function " + + "'$($hunk['FunctionName'])' not found. Using upstream line number as estimate." + } + } else { + $matchNote = "Could not locate region — anchor score too low and no function name " + + "available. Using upstream line number as estimate." + } + + } elseif ($hunk['FunctionName']) { + # Too few anchor lines for sliding window — go straight to function-name search + $fnLine = Find-FunctionMatch -FileLines $ourFork.Lines -FunctionName $hunk['FunctionName'] + if ($fnLine -gt 0) { + $forkCenter = $fnLine + $matchNote = "Located via function-name fallback ('$($hunk['FunctionName'])') — " + + "insufficient anchor lines for content match." + } else { + $matchNote = "Insufficient anchor lines and function '$($hunk['FunctionName'])' not found. " + + "Using upstream line number as estimate." + } + } else { + $matchNote = "Insufficient anchor lines and no function name available. " + + "Using upstream line number as estimate." + } + + $excerpt = Get-Excerpt -Lines $ourFork.Lines -CenterLine $forkCenter -Budget $budgetPerHunk + if ($excerpt) { + $excerpt['Note'] = $matchNote + $forkExcerpt = $excerpt + } + } + + $resultHunks += @{ + HunkIndex = $h + 1 + HunkHeader = $hunk['Header'] + FunctionName = $hunk['FunctionName'] + UpstreamBefore = $uBefore + UpstreamAfter = $uAfter + OurFork = $forkExcerpt + } +} + +# 9. Return final result +$message = if ($warnings.Count -gt 0) { + "Context retrieved for ${hunkCount} hunk(s) in '${FilePath}' (commit ${CommitHash}). " + + "Warnings: $($warnings -join ' | ')" +} else { + "Context retrieved for ${hunkCount} hunk(s) in '${FilePath}' (commit ${CommitHash})." +} + +return @{ + Success = $true + Message = $message + CommitMessage = $commitMessage + UpstreamDiff = $upstreamDiff + HunkCount = $hunkCount + IsBinary = $false + Hunks = $resultHunks +} diff --git a/.github/tools/Invoke-Git.ps1 b/.github/tools/Invoke-Git.ps1 new file mode 100644 index 000000000000..3a30a1f53ade --- /dev/null +++ b/.github/tools/Invoke-Git.ps1 @@ -0,0 +1,449 @@ +<# +.SYNOPSIS + Executes a git operation and returns a structured result with exit code. + +.DESCRIPTION + MCP-compatible tool that runs git commands via System.Diagnostics.Process for + reliable exit code capture without interfering with the MCP server's stdio + transport. Async stream reads are started before WaitForExit to prevent deadlocks + when git output exceeds the stream buffer size. + + Returns a structured hashtable with Success, ExitCode, Output, Error, and + operation-specific fields so agents can make programmatic decisions without + text parsing. + +.PARAMETER Operation + The git operation to perform. One of: + CherryPick, CherryPickContinue, CherryPickAbort, + Merge, MergeContinue, MergeAbort, + Add, Checkout, CreateBranch, + Commit, Push, Fetch, + Config, Reset, Clean, + Status, Log, Diff, Show + +.PARAMETER CommitHash + A commit SHA or any git ref (branch name, tag, etc.). + Used by: CherryPick, Merge, Show. + +.PARAMETER Range + A git range expression (e.g. "abc123^..def456" or "HEAD..upstream/V_10_0_P2"). + Used by: Log (and Log with ShasOnly), Diff. + +.PARAMETER Message + Commit message text. + Used by: Commit. + +.PARAMETER Path + File path or directory to operate on. Defaults to '.'. + Used by: Add, Checkout (file restore), Diff, Show. + +.PARAMETER Remote + Remote name. Defaults to 'origin'. + Used by: Fetch, Push. + +.PARAMETER Branch + Branch name to create or push. + Used by: CreateBranch, Push. + +.PARAMETER StartPoint + Git ref (branch, tag, or commit) to base the new branch on. + Used by: CreateBranch. + +.PARAMETER Target + Branch, tag, commit ref, or file path to check out or reset to. + Used by: Checkout, Reset. + +.PARAMETER Key + Git config key (e.g. "core.editor"). + Used by: Config. + +.PARAMETER Value + Git config value to set. + Used by: Config. + +.PARAMETER Mode + Reset mode: 'soft', 'mixed' (default), or 'hard'. + Used by: Reset. + +.PARAMETER ShasOnly + When specified alongside Operation=Log, uses git rev-list --reverse instead of + git log --oneline. Returns commit SHAs in oldest-first order suitable for building + a cherry-pick loop. result.Commits will contain [{Hash: "", Message: ""}]. + +.OUTPUTS + Hashtable with: + Success [bool] Whether the command exited with code 0 + ExitCode [int] Raw process exit code + Output [string] Stdout from git + Error [string] Stderr from git + Message [string] Human-readable summary + Plus operation-specific fields: + CherryPick (on failure): ConflictedFiles [string[]] + Merge (on failure): ConflictedFiles [string[]] + Log / ShasOnly: Commits [{Hash, Message}] + Status: ConflictedFiles [string[]], ModifiedFiles [string[]] + Commit (on success): CommitHash [string] + +.EXAMPLE + # Cherry-pick a single commit + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="CherryPick", CommitHash="abc1234" + +.EXAMPLE + # Get ordered commit SHAs in a batch range for a cherry-pick loop + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Log", Range="abc123^..def456", ShasOnly=true + +.EXAMPLE + # Stage all changes after conflict resolution (Path defaults to '.') + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Add" + +.EXAMPLE + # Continue cherry-pick after resolving conflicts + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="CherryPickContinue" + +.EXAMPLE + # Abort an in-progress cherry-pick + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="CherryPickAbort" + +.EXAMPLE + # Restore paths.targets after a build modifies it + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Checkout", Target=".\contrib\win32\openssh\paths.targets" + +.EXAMPLE + # Create and check out a new merge branch + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="CreateBranch", Branch="merge-v10.0P2-20260306" + +.EXAMPLE + # Commit staged changes + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Commit", Message="Fix compilation errors for V_10_0_P2" + +.EXAMPLE + # Push a branch to origin + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Push", Remote="origin", Branch="merge-v10.0P2-20260306" + +.EXAMPLE + # Set a git config value + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Config", Key="core.editor", Value="true" + +.EXAMPLE + # Show differences between two refs for a specific file + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Diff", Range="upstream-pwsh/latestw_all..upstream/V_10_0_P2", Path="Makefile.in" + +.EXAMPLE + # Inspect a specific commit + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Show", CommitHash="abc1234" + +.EXAMPLE + # Check working directory status for conflicts and modifications + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Status" + +.EXAMPLE + # Hard-reset to HEAD (recovery) + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Reset", Target="HEAD", Mode="hard" + +.EXAMPLE + # Merge an upstream batch endpoint into the current branch + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Merge", CommitHash="6fb728df50c1afd338cb0223a84ce24579577eff" + +.EXAMPLE + # Continue a merge after resolving conflicts + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="MergeContinue" + +.EXAMPLE + # Abort an in-progress merge + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="MergeAbort" + +.EXAMPLE + # Enable rerere for merge resolution recording + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Config", Key="rerere.enabled", Value="true" + +.EXAMPLE + # Remove untracked files (recovery) + # MCP Tool: mcp_openssh-server_Invoke_Git + # Operation="Clean" +#> + +param( + [Parameter(Mandatory)] + [ValidateSet( + 'CherryPick', 'CherryPickContinue', 'CherryPickAbort', + 'Merge', 'MergeContinue', 'MergeAbort', + 'Add', 'Checkout', 'CreateBranch', + 'Commit', 'Push', 'Fetch', + 'Config', 'Reset', 'Clean', + 'Status', 'Log', 'Diff', 'Show' + )] + [string]$Operation, + + # CherryPick, Merge, Show — accepts any git ref: commit SHA, branch name, tag, etc. + [string]$CommitHash = '', + + # Log (plain or ShasOnly), Diff — git range expression e.g. "abc123^..def456" + [string]$Range = '', + + # Commit — commit message text + [string]$Message = '', + + # Add, Checkout (file restore), Diff, Show — file/directory path + [string]$Path = '.', + + # Fetch, Push — remote name + [string]$Remote = 'origin', + + # CreateBranch, Push — branch name + [string]$Branch = '', + + # CreateBranch — starting ref for the new branch + [string]$StartPoint = '', + + # Checkout, Reset — target ref or file path + [string]$Target = '', + + # Config — key (e.g. "core.editor") + [string]$Key = '', + + # Config — value to set + [string]$Value = '', + + # Reset — reset mode + [ValidateSet('soft', 'mixed', 'hard')] + [string]$Mode = 'mixed', + + # Log — use git rev-list --reverse (SHAs only, oldest first) instead of git log --oneline + [switch]$ShasOnly +) + +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' + +# --------------------------------------------------------------------------- +# Private helper — runs git via System.Diagnostics.Process. +# +# IMPORTANT: We use ProcessStartInfo rather than Start-Process because +# Start-Process with -RedirectStandardOutput/-RedirectStandardError conflicts +# with the MCP server's stdio transport, causing the process to hang. +# +# Async stream reads MUST be started BEFORE WaitForExit to prevent deadlocks: +# if git output exceeds the internal stream buffer, git blocks waiting for the +# buffer to drain while WaitForExit blocks waiting for git to exit. +# --------------------------------------------------------------------------- +function Invoke-GitCommand { + param([string[]]$Arguments) + + $processInfo = [System.Diagnostics.ProcessStartInfo]::new() + $processInfo.FileName = 'git' + $processInfo.Arguments = ($Arguments | ForEach-Object { + if ($_ -match '\s') { "`"$_`"" } else { $_ } + }) -join ' ' + $processInfo.UseShellExecute = $false + $processInfo.CreateNoWindow = $true + $processInfo.RedirectStandardInput = $true # Prevent git inheriting the MCP stdio pipe + $processInfo.RedirectStandardOutput = $true + $processInfo.RedirectStandardError = $true + + $process = [System.Diagnostics.Process]::new() + $process.StartInfo = $processInfo + $process.Start() | Out-Null + $process.StandardInput.Close() # Immediately close stdin so git never blocks on input + + # Begin async reads BEFORE blocking on WaitForExit + $stdoutTask = $process.StandardOutput.ReadToEndAsync() + $stderrTask = $process.StandardError.ReadToEndAsync() + + $completed = $process.WaitForExit(30000) # 30-second timeout + + if (-not $completed) { + $process.Kill() + return @{ + ExitCode = -1 + Success = $false + Output = '' + Error = "git $($Arguments -join ' ') timed out after 30 seconds" + } + } + + return @{ + ExitCode = $process.ExitCode + Success = ($process.ExitCode -eq 0) + Output = $stdoutTask.GetAwaiter().GetResult().TrimEnd() + Error = $stderrTask.GetAwaiter().GetResult().TrimEnd() + } +} + +# --------------------------------------------------------------------------- +# Operation dispatcher +# --------------------------------------------------------------------------- +$result = switch ($Operation) { + + 'CherryPick' { + if (-not $CommitHash) { throw 'CommitHash is required for CherryPick' } + $r = Invoke-GitCommand -Arguments @('cherry-pick', $CommitHash) + if (-not $r.Success) { + # Enrich failure result with list of conflicted files for agent reporting + $statusResult = Invoke-GitCommand -Arguments @('status', '--porcelain') + $r['ConflictedFiles'] = ($statusResult.Output -split "`n") | + Where-Object { $_ -match '^(UU|AA|DD|AU|UA|DU|UD)\s' } | + ForEach-Object { $_.Substring(3).Trim() } + } + $r + } + + 'CherryPickContinue' { + Invoke-GitCommand -Arguments @('cherry-pick', '--continue') + } + + 'CherryPickAbort' { + Invoke-GitCommand -Arguments @('cherry-pick', '--abort') + } + + 'Merge' { + if (-not $CommitHash) { throw 'CommitHash is required for Merge (target ref to merge)' } + $r = Invoke-GitCommand -Arguments @('merge', '--no-ff', $CommitHash) + if (-not $r.Success) { + $statusResult = Invoke-GitCommand -Arguments @('status', '--porcelain') + $r['ConflictedFiles'] = ($statusResult.Output -split "`n") | + Where-Object { $_ -match '^(UU|AA|DD|AU|UA|DU|UD)\s' } | + ForEach-Object { $_.Substring(3).Trim() } + } + $r + } + + 'MergeContinue' { + Invoke-GitCommand -Arguments @('merge', '--continue') + } + + 'MergeAbort' { + Invoke-GitCommand -Arguments @('merge', '--abort') + } + + 'Add' { + Invoke-GitCommand -Arguments @('add', $Path) + } + + 'Checkout' { + if (-not $Target) { throw 'Target is required for Checkout (branch name, tag, or file path)' } + Invoke-GitCommand -Arguments @('checkout', $Target) + } + + 'CreateBranch' { + if (-not $Branch) { throw 'Branch is required for CreateBranch' } + $args = @('checkout', '-b', $Branch) + if ($StartPoint) { $args += $StartPoint } + Invoke-GitCommand -Arguments $args + } + + 'Commit' { + if (-not $Message) { throw 'Message is required for Commit' } + $r = Invoke-GitCommand -Arguments @('commit', '-m', $Message) + if ($r.Success -and $r.Output -match '\[[\w/]+ ([0-9a-f]{7,})\]') { + $r['CommitHash'] = $Matches[1] + } + $r + } + + 'Push' { + $args = @('push', $Remote) + if ($Branch) { $args += $Branch } + Invoke-GitCommand -Arguments $args + } + + 'Fetch' { + $args = if ($Remote -eq 'all') { @('fetch', '--all') } else { @('fetch', $Remote) } + Invoke-GitCommand -Arguments $args + } + + 'Config' { + if (-not $Key) { throw 'Key is required for Config' } + $args = @('config', $Key) + if ($Value) { $args += $Value } + Invoke-GitCommand -Arguments $args + } + + 'Reset' { + if (-not $Target) { throw 'Target is required for Reset' } + Invoke-GitCommand -Arguments @('reset', "--$Mode", $Target) + } + + 'Clean' { + # -f (force) -d (include untracked directories) — standard recovery clean + Invoke-GitCommand -Arguments @('clean', '-fd') + } + + 'Status' { + $r = Invoke-GitCommand -Arguments @('status', '--porcelain') + $lines = if ($r.Output) { $r.Output -split "`n" } else { @() } + $r['ConflictedFiles'] = $lines | + Where-Object { $_ -match '^(UU|AA|DD|AU|UA|DU|UD)\s' } | + ForEach-Object { $_.Substring(3).Trim() } + $r['ModifiedFiles'] = $lines | + Where-Object { $_ -notmatch '^(UU|AA|DD|AU|UA|DU|UD)\s' -and $_ -match '^\S' } | + ForEach-Object { ($_ -replace '^\S+\s+', '').Trim() } + $r + } + + 'Log' { + if (-not $Range) { throw 'Range is required for Log (e.g. "abc123^..def456" or "HEAD..upstream/V_10_0_P2")' } + if ($ShasOnly) { + # Use rev-list --reverse to get SHAs in oldest-first (cherry-pick) order + $r = Invoke-GitCommand -Arguments @('rev-list', '--reverse', $Range) + $r['Commits'] = if ($r.Success -and $r.Output) { + ($r.Output -split "`n") | + Where-Object { $_ -match '^[0-9a-f]{7,}$' } | + ForEach-Object { @{ Hash = $_; Message = '' } } + } else { @() } + } else { + $logArgs = @('log', '--oneline', $Range) + if ($Path -and $Path -ne '.') { $logArgs += '--'; $logArgs += $Path } + $r = Invoke-GitCommand -Arguments $logArgs + $r['Commits'] = if ($r.Success -and $r.Output) { + ($r.Output -split "`n") | + Where-Object { $_ -match '^[0-9a-f]' } | + ForEach-Object { + if ($_ -match '^([0-9a-f]+)\s+(.+)$') { + @{ Hash = $Matches[1]; Message = $Matches[2] } + } + } + } else { @() } + } + $r + } + + 'Diff' { + $args = @('diff') + if ($Range) { $args += $Range } + if ($Path -and $Path -ne '.') { $args += '--'; $args += $Path } + Invoke-GitCommand -Arguments $args + } + + 'Show' { + $args = @('show') + if ($CommitHash) { $args += $CommitHash } + if ($Path -and $Path -ne '.') { $args += '--'; $args += $Path } + Invoke-GitCommand -Arguments $args + } +} + +$result['Message'] = if ($result.Success) { + "git $Operation completed successfully" +} else { + "git $Operation failed with exit code $($result.ExitCode): $($result.Error)" +} + +return $result diff --git a/.github/tools/Invoke-OpenSSHTests.ps1 b/.github/tools/Invoke-OpenSSHTests.ps1 new file mode 100644 index 000000000000..bcb3be929b30 --- /dev/null +++ b/.github/tools/Invoke-OpenSSHTests.ps1 @@ -0,0 +1,338 @@ +<# +.SYNOPSIS + Runs the OpenSSH full CI test suite (unit tests, bash tests, and E2E/Pester tests). + +.DESCRIPTION + This script automates the full OpenSSH CI test workflow on Windows using the + OpenSSHTestHelper module. It supports running all test suites together or + individual suites, with optional single-test targeting for bash tests. + + Test suites: + - Unit: Runs unittest-*.exe binaries found under the binary path + - Bash: Runs upstream bash regression tests via Cygwin sh.exe + - E2E: Runs Windows Pester-based end-to-end tests (requires Pester < 5) + + The workflow is: + 1. Import OpenSSHTestHelper module + 2. Set-OpenSSHTestEnvironment (installs test accounts, sshd test service, etc.) + 3. Run selected test suites + 4. Clear-OpenSSHTestEnvironment (unless -NoCleanup) + + Reference: https://github.com/PowerShell/Win32-OpenSSH/wiki/Run-OpenSSH-Pester-Tests + +.PARAMETER Configuration + Build configuration. Valid values: 'Debug', 'Release'. Default: 'Release'. + +.PARAMETER Architecture + Target architecture. Valid values: 'x64', 'x86', 'ARM', 'ARM64'. Default: 'x64'. + +.PARAMETER TestSuite + Which test suites to run. Valid values: 'All', 'Unit', 'Bash', 'E2E'. + Default: 'All'. Multiple values allowed. + +.PARAMETER BashTestFilePath + Run a single bash test file instead of the full bash suite. + Must be an absolute path to a .sh file under the regress folder. + Example: C:\repos\openssh-portable\regress\banner.sh + Only applies when TestSuite includes 'Bash'. + +.PARAMETER BashShellPath + Path to sh.exe (Cygwin or WSL). Auto-detected from common Cygwin locations + if not specified. Example: C:\cygwin64\bin\sh.exe + +.PARAMETER NoCleanup + Skip Clear-OpenSSHTestEnvironment at the end. Useful for debugging failures. + +.PARAMETER SkipSetup + Skip Set-OpenSSHTestEnvironment. Use when environment is already configured. + +.EXAMPLE + .\Invoke-OpenSSHTests.ps1 + Runs all test suites with Release x64 binaries. + +.EXAMPLE + .\Invoke-OpenSSHTests.ps1 -TestSuite Unit + Runs only unit tests. + +.EXAMPLE + .\Invoke-OpenSSHTests.ps1 -TestSuite E2E -Configuration Debug + Runs only Pester E2E tests using Debug binaries. + +.EXAMPLE + .\Invoke-OpenSSHTests.ps1 -TestSuite Bash -BashTestFilePath C:\repos\openssh-portable\regress\banner.sh + Runs a single bash test. + +.NOTES + Requires Administrator privileges. + Pester < 5 required for E2E tests (the helper will install via chocolatey if needed). + Cygwin (sh.exe) required for bash tests. + + Known gotchas: + - cfginclude.sh calls powershell.exe; if running under pwsh.exe, edit the test to use pwsh.exe. + See https://github.com/PowerShell/PowerShell/issues/18530#issuecomment-1325691850 + - WSMan and Port Forwarding tests may be disallowed on some VMs by default. + Enable the features or skip the affected tests. +#> + +[CmdletBinding()] +param( + [Parameter()] + [ValidateSet('Debug', 'Release')] + [string]$Configuration = 'Release', + + [Parameter()] + [ValidateSet('x64', 'x86', 'ARM', 'ARM64')] + [string]$Architecture = 'x64', + + [Parameter()] + [ValidateSet('All', 'Unit', 'Bash', 'E2E')] + [string[]]$TestSuite = @('All'), + + [Parameter()] + [string]$BashTestFilePath = '', + + [Parameter()] + [string]$BashShellPath = '', + + [Parameter()] + [switch]$NoCleanup, + + [Parameter()] + [switch]$SkipSetup +) + +# ────────────────────────────────────────────────────────────────────────────── +# Resolve paths +# ────────────────────────────────────────────────────────────────────────────── +$scriptRoot = Split-Path -Parent $PSCommandPath +$repoRoot = Split-Path -Parent (Split-Path -Parent $scriptRoot) +$binPath = Join-Path $repoRoot "bin\$Architecture\$Configuration" +$helperModule = Join-Path $repoRoot "contrib\win32\openssh\OpenSSHTestHelper.psm1" +$bashIterator = Join-Path $repoRoot "contrib\win32\openssh\bash_tests_iterator.ps1" +$regressPath = Join-Path $repoRoot "regress" + +# ────────────────────────────────────────────────────────────────────────────── +# Result object +# ────────────────────────────────────────────────────────────────────────────── +$result = [PSCustomObject]@{ + Success = $false + UnitTestsPassed = $null # $true/$false/$null (not run) + BashTestsPassed = $null + E2ETestsPassed = $null + UnitTestOutput = $null + BashTestOutput = $null + E2ETestOutput = $null + Errors = @() + Warnings = @() + Message = '' +} + +$moduleImported = $false +$setupCompleted = $false + +function Write-StepHeader([string]$msg) { + Write-Host "" + Write-Host "=== $msg ===" -ForegroundColor Cyan +} + +$runUnit = $TestSuite -contains 'All' -or $TestSuite -contains 'Unit' +$runBash = $TestSuite -contains 'All' -or $TestSuite -contains 'Bash' +$runE2E = $TestSuite -contains 'All' -or $TestSuite -contains 'E2E' + +try { + # ── Admin check ────────────────────────────────────────────────────────── + $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole( + [Security.Principal.WindowsBuiltInRole]"Administrator") + if (-not $isAdmin) { + $result.Errors += "Administrator privileges required." + $result.Message = "FAILED: Must be run as Administrator." + Write-Host "✗ Administrator privileges required." -ForegroundColor Red + return $result + } + + # ── Verify binaries ────────────────────────────────────────────────────── + if (-not (Test-Path (Join-Path $binPath "ssh.exe"))) { + $result.Errors += "Binaries not found at $binPath. Build the project first." + $result.Message = "FAILED: Build artifacts not found at $binPath." + Write-Host "✗ Binaries not found at $binPath" -ForegroundColor Red + return $result + } + Write-Host "✓ Binaries found at $binPath" -ForegroundColor Green + + # ── Import helper module ───────────────────────────────────────────────── + Write-StepHeader "Importing OpenSSHTestHelper" + if (-not (Test-Path $helperModule)) { + $result.Errors += "OpenSSHTestHelper.psm1 not found at $helperModule" + $result.Message = "FAILED: OpenSSHTestHelper module not found." + Write-Host "✗ Module not found: $helperModule" -ForegroundColor Red + return $result + } + Import-Module $helperModule -Force + $moduleImported = $true + Write-Host "✓ Module imported" -ForegroundColor Green + + # ── Set-OpenSSHTestEnvironment ─────────────────────────────────────────── + if (-not $SkipSetup) { + Write-StepHeader "Setting Up Test Environment" + Write-Host " OpenSSHBinPath: $binPath" + Set-OpenSSHTestEnvironment -OpenSSHBinPath $binPath -Confirm:$false + $setupCompleted = $true + Write-Host "✓ Test environment configured" -ForegroundColor Green + } else { + Write-Host "⚠ Skipping Set-OpenSSHTestEnvironment (-SkipSetup specified)" -ForegroundColor Yellow + $result.Warnings += "Setup skipped — environment must already be configured." + } + + # ── Unit Tests ─────────────────────────────────────────────────────────── + if ($runUnit) { + Write-StepHeader "Running Unit Tests" + try { + # Force unit test discovery to the selected build output path. + $unitOutput = Invoke-OpenSSHUnitTest -UnitTestDirectory $binPath *>&1 | Tee-Object -Variable unitCapture + $unitText = $unitCapture | Out-String + $result.UnitTestOutput = $unitText + + # Detect failure: unit test runner writes "failed" to output or exits non-zero + if ($unitText -match 'failed') { + $result.UnitTestsPassed = $false + $result.Errors += "Unit tests reported failures. See UnitTestOutput for details." + Write-Host "✗ Unit tests: FAILED" -ForegroundColor Red + } else { + $result.UnitTestsPassed = $true + Write-Host "✓ Unit tests: PASSED" -ForegroundColor Green + } + } catch { + $result.UnitTestsPassed = $false + $result.Errors += "Unit test exception: $_" + Write-Host "✗ Unit tests threw an exception: $_" -ForegroundColor Red + } + } + + # ── Bash Tests ─────────────────────────────────────────────────────────── + if ($runBash) { + Write-StepHeader "Running Bash Tests" + $result.Warnings += "cfginclude.sh gotcha: calls powershell.exe; if running under pwsh, edit the test to use pwsh.exe (see https://github.com/PowerShell/PowerShell/issues/18530#issuecomment-1325691850)." + + try { + if (-not [string]::IsNullOrEmpty($BashTestFilePath)) { + # Single bash test via iterator. + $resolvedShellPath = $BashShellPath + if ([string]::IsNullOrEmpty($resolvedShellPath) -or -not (Test-Path $resolvedShellPath)) { + throw "BashShellPath is required for single-test mode." + } + + Write-Host " Shell: $resolvedShellPath" + Write-Host " Running single test: $BashTestFilePath" + $bashOutput = & $bashIterator ` + -OpenSSHBinPath $binPath ` + -BashTestsPath $regressPath ` + -ShellPath $resolvedShellPath ` + -TestFilePath $BashTestFilePath ` + *>&1 | Tee-Object -Variable bashCapture + } else { + # Full bash suite via helper (helper handles Cygwin install/detection). + Write-Host " Running full bash test suite..." + $bashOutput = Invoke-OpenSSHBashTests *>&1 | Tee-Object -Variable bashCapture + } + + $bashText = $bashCapture | Out-String + $result.BashTestOutput = $bashText + + if ($bashText -match 'FAILED|not ok') { + $result.BashTestsPassed = $false + $result.Errors += "Bash tests reported failures. See BashTestOutput for details." + Write-Host "✗ Bash tests: FAILED" -ForegroundColor Red + } else { + $result.BashTestsPassed = $true + Write-Host "✓ Bash tests: PASSED" -ForegroundColor Green + } + } catch { + $result.BashTestsPassed = $false + $result.Errors += "Bash test exception: $_" + Write-Host "✗ Bash tests threw an exception: $_" -ForegroundColor Red + } + } + + # ── E2E / Pester Tests ─────────────────────────────────────────────────── + if ($runE2E) { + Write-StepHeader "Running E2E Pester Tests" + $result.Warnings += "WSMan and Port Forwarding tests may fail on some VMs where those features are disabled. Enable them in Windows Features or skip those test files." + Write-Host " ⚠ Note: WSMan/Port Forwarding may need to be enabled on this machine." -ForegroundColor Yellow + + try { + $e2eOutput = Invoke-OpenSSHE2ETest *>&1 | Tee-Object -Variable e2eCapture + $e2eText = $e2eCapture | Out-String + $result.E2ETestOutput = $e2eText + + if ($e2eText -match 'Failed\s*:\s*[1-9]|Tests failed') { + $result.E2ETestsPassed = $false + $result.Errors += "E2E tests reported failures. See E2ETestOutput for details." + Write-Host "✗ E2E Pester tests: FAILED" -ForegroundColor Red + } else { + $result.E2ETestsPassed = $true + Write-Host "✓ E2E Pester tests: PASSED" -ForegroundColor Green + } + } catch { + $result.E2ETestsPassed = $false + $result.Errors += "E2E test exception: $_" + Write-Host "✗ E2E tests threw an exception: $_" -ForegroundColor Red + } + } + + # ── Overall result ─────────────────────────────────────────────────────── + $anyFailed = ($result.UnitTestsPassed -eq $false) -or + ($result.BashTestsPassed -eq $false) -or + ($result.E2ETestsPassed -eq $false) + + $result.Success = -not $anyFailed + $result.Message = if ($result.Success) { "All selected test suites passed." } ` + else { "One or more test suites failed. See Errors for details." } + +} catch { + $result.Errors += "Unexpected error: $_" + $result.Message = "FAILED: Unexpected error — $_" + Write-Host "✗ Unexpected error: $_" -ForegroundColor Red +} finally { + # ── Cleanup ────────────────────────────────────────────────────────────── + if (-not $NoCleanup -and -not $SkipSetup -and $moduleImported -and $setupCompleted) { + Write-StepHeader "Cleaning Up Test Environment" + try { + Clear-OpenSSHTestEnvironment + Write-Host "✓ Test environment cleaned up" -ForegroundColor Green + } catch { + $result.Warnings += "Cleanup warning: $_" + Write-Host "⚠ Cleanup encountered an issue: $_" -ForegroundColor Yellow + } + } elseif (-not $NoCleanup -and -not $SkipSetup -and (-not $moduleImported -or -not $setupCompleted)) { + $result.Warnings += "Cleanup skipped because setup did not complete." + Write-Host "⚠ Cleanup skipped because setup did not complete." -ForegroundColor Yellow + } elseif ($NoCleanup) { + Write-Host "⚠ Skipping cleanup (-NoCleanup specified). Run Clear-OpenSSHTestEnvironment manually." -ForegroundColor Yellow + } +} + +# ── Summary ─────────────────────────────────────────────────────────────────── +Write-Host "" +Write-Host "=== Test Summary ===" -ForegroundColor Cyan +Write-Host "Overall: $(if ($result.Success) { '✓ PASSED' } else { '✗ FAILED' })" -ForegroundColor $(if ($result.Success) { 'Green' } else { 'Red' }) +if ($null -ne $result.UnitTestsPassed) { + Write-Host "Unit Tests: $(if ($result.UnitTestsPassed) { '✓ PASSED' } else { '✗ FAILED' })" -ForegroundColor $(if ($result.UnitTestsPassed) { 'Green' } else { 'Red' }) +} +if ($null -ne $result.BashTestsPassed) { + Write-Host "Bash Tests: $(if ($result.BashTestsPassed) { '✓ PASSED' } else { '✗ FAILED' })" -ForegroundColor $(if ($result.BashTestsPassed) { 'Green' } else { 'Red' }) +} +if ($null -ne $result.E2ETestsPassed) { + Write-Host "E2E Tests: $(if ($result.E2ETestsPassed) { '✓ PASSED' } else { '✗ FAILED' })" -ForegroundColor $(if ($result.E2ETestsPassed) { 'Green' } else { 'Red' }) +} +if ($result.Warnings.Count -gt 0) { + Write-Host "" + Write-Host "Warnings:" -ForegroundColor Yellow + $result.Warnings | ForEach-Object { Write-Host " ⚠ $_" -ForegroundColor Yellow } +} +if ($result.Errors.Count -gt 0) { + Write-Host "" + Write-Host "Errors:" -ForegroundColor Red + $result.Errors | ForEach-Object { Write-Host " ✗ $_" -ForegroundColor Red } +} + +return $result diff --git a/.github/tools/Replay-MergeResolutions.ps1 b/.github/tools/Replay-MergeResolutions.ps1 new file mode 100644 index 000000000000..7006c44de9a9 --- /dev/null +++ b/.github/tools/Replay-MergeResolutions.ps1 @@ -0,0 +1,201 @@ +<# +.SYNOPSIS + Replays saved conflict resolutions from the merge resolution log onto + currently conflicted files. + +.DESCRIPTION + MCP-compatible tool for the real-branch phase of the scratch-branch merge + workflow. Reads .git/merge-resolution-log.json (populated during the scratch + phase by Save-MergeResolution.ps1) and attempts to apply saved resolutions + to files that are currently in a conflicted state (UU/AA/etc. in git status). + + For each conflicted file that has a matching entry in the log, the tool writes + the saved resolved content and stages the file with git add. + + Files not found in the log are reported as unmatched so the agent can resolve + them manually. + +.PARAMETER DryRun + When specified, reports what would be applied without modifying any files. + +.OUTPUTS + Hashtable with: + Success [bool] Whether the operation completed without errors + Message [string] Human-readable summary + ResolvedFiles [string[]] Files successfully resolved from the log + UnmatchedFiles [string[]] Conflicted files with no log entry + FailedFiles [string[]] Files where replay was attempted but failed + LogPath [string] Absolute path to the resolution log + +.EXAMPLE + # Replay all saved resolutions onto current merge conflicts + # MCP Tool: mcp_openssh-server_Replay_MergeResolutions + +.EXAMPLE + # Preview what would be replayed without modifying files + # MCP Tool: mcp_openssh-server_Replay_MergeResolutions + # DryRun=true +#> + +param( + [switch]$DryRun +) + +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' + +# ── Git process helper (same pattern as Invoke-Git.ps1) ────────────────────── + +function Invoke-GitCommand { + param([string[]]$Arguments) + + $processInfo = [System.Diagnostics.ProcessStartInfo]::new() + $processInfo.FileName = 'git' + $processInfo.Arguments = ($Arguments | ForEach-Object { + if ($_ -match '\s') { "`"$_`"" } else { $_ } + }) -join ' ' + $processInfo.UseShellExecute = $false + $processInfo.CreateNoWindow = $true + $processInfo.RedirectStandardInput = $true + $processInfo.RedirectStandardOutput = $true + $processInfo.RedirectStandardError = $true + + $process = [System.Diagnostics.Process]::new() + $process.StartInfo = $processInfo + $process.Start() | Out-Null + $process.StandardInput.Close() + + $stdoutTask = $process.StandardOutput.ReadToEndAsync() + $stderrTask = $process.StandardError.ReadToEndAsync() + + $completed = $process.WaitForExit(30000) + + if (-not $completed) { + $process.Kill() + return @{ + ExitCode = -1 + Success = $false + Output = '' + Error = "git $($Arguments -join ' ') timed out after 30 seconds" + } + } + + return @{ + ExitCode = $process.ExitCode + Success = ($process.ExitCode -eq 0) + Output = $stdoutTask.GetAwaiter().GetResult().TrimEnd() + Error = $stderrTask.GetAwaiter().GetResult().TrimEnd() + } +} + +# ── Locate and read the resolution log ─────────────────────────────────────── + +$gitDir = Join-Path (Get-Location) '.git' +$logPath = Join-Path $gitDir 'merge-resolution-log.json' + +if (-not (Test-Path $logPath)) { + return @{ + Success = $false + Message = 'No resolution log found at .git/merge-resolution-log.json. Run the scratch-branch phase first.' + ResolvedFiles = @() + UnmatchedFiles = @() + FailedFiles = @() + LogPath = $logPath + } +} + +$log = Get-Content -Raw $logPath | ConvertFrom-Json + +if (-not $log.resolutions -or $log.resolutions.Count -eq 0) { + return @{ + Success = $true + Message = 'Resolution log is empty — no saved resolutions to replay.' + ResolvedFiles = @() + UnmatchedFiles = @() + FailedFiles = @() + LogPath = $logPath + } +} + +# ── Build a lookup of saved resolutions keyed by file path ─────────────────── +# If multiple entries exist for the same file (across batches), use the latest one. + +$resolutionMap = @{} +foreach ($entry in $log.resolutions) { + $resolutionMap[$entry.file] = $entry +} + +# ── Get currently conflicted files from git status ─────────────────────────── + +$statusResult = Invoke-GitCommand -Arguments @('status', '--porcelain') +$conflictedFiles = @() +if ($statusResult.Output) { + $conflictedFiles = ($statusResult.Output -split "`n") | + Where-Object { $_ -match '^(UU|AA|DD|AU|UA|DU|UD)\s' } | + ForEach-Object { $_.Substring(3).Trim() } +} + +if ($conflictedFiles.Count -eq 0) { + return @{ + Success = $true + Message = 'No conflicted files found — nothing to replay.' + ResolvedFiles = @() + UnmatchedFiles = @() + FailedFiles = @() + LogPath = $logPath + } +} + +# ── Replay resolutions ────────────────────────────────────────────────────── + +$resolvedFiles = [System.Collections.Generic.List[string]]::new() +$unmatchedFiles = [System.Collections.Generic.List[string]]::new() +$failedFiles = [System.Collections.Generic.List[string]]::new() + +foreach ($file in $conflictedFiles) { + if (-not $resolutionMap.ContainsKey($file)) { + $unmatchedFiles.Add($file) + continue + } + + $entry = $resolutionMap[$file] + + if ($DryRun) { + $resolvedFiles.Add($file) + continue + } + + try { + # Decode the saved resolved content and write it to the file + $contentBytes = [System.Convert]::FromBase64String($entry.resolved_content_base64) + $fullFilePath = Join-Path (Get-Location) $file + [System.IO.File]::WriteAllBytes($fullFilePath, $contentBytes) + + # Stage the resolved file + $addResult = Invoke-GitCommand -Arguments @('add', $file) + if (-not $addResult.Success) { + $failedFiles.Add($file) + continue + } + + $resolvedFiles.Add($file) + } catch { + $failedFiles.Add($file) + } +} + +# ── Return result ──────────────────────────────────────────────────────────── + +$dryRunNote = if ($DryRun) { ' (DRY RUN — no files modified)' } else { '' } +$message = "Replay complete${dryRunNote}: $($resolvedFiles.Count) resolved, " + + "$($unmatchedFiles.Count) unmatched, $($failedFiles.Count) failed " + + "(out of $($conflictedFiles.Count) conflicted files)." + +return @{ + Success = ($failedFiles.Count -eq 0) + Message = $message + ResolvedFiles = $resolvedFiles.ToArray() + UnmatchedFiles = $unmatchedFiles.ToArray() + FailedFiles = $failedFiles.ToArray() + LogPath = $logPath +} diff --git a/.github/tools/Save-MergeResolution.ps1 b/.github/tools/Save-MergeResolution.ps1 new file mode 100644 index 000000000000..049d0e739172 --- /dev/null +++ b/.github/tools/Save-MergeResolution.ps1 @@ -0,0 +1,160 @@ +<# +.SYNOPSIS + Records a conflict resolution entry to the merge resolution log. + +.DESCRIPTION + MCP-compatible tool that saves details about how a conflicted file was resolved + during the scratch-branch phase of the merge workflow. The resolution — including + the resolved file content, strategy, and rationale — is appended to a JSON log + at .git/merge-resolution-log.json. + + This log is consumed by Replay-MergeResolutions.ps1 during the real-branch + single-merge phase to automatically re-apply known resolutions. + +.PARAMETER FilePath + Path to the resolved file, relative to the repository root. + +.PARAMETER Strategy + The resolution strategy used. One of: + accept_upstream — Took the upstream change completely + ifdef_windows — Wrapped with #ifdef WINDOWS / #else / #endif + ifndef_windows — Excluded with #ifndef WINDOWS + combine — Combined upstream and Windows changes + manual — Custom resolution not fitting other categories + +.PARAMETER Rationale + Free-text explanation of why this resolution strategy was chosen. + +.PARAMETER BatchNumber + The batch number (from Get-CommitGroups) that this resolution belongs to. + +.PARAMETER UpstreamCommits + Comma-separated list of upstream commit SHAs that touched this file in this batch. + +.PARAMETER MergeTarget + The final upstream ref being merged (e.g. "upstream/V_10_1_P1"). Only needed on + the first invocation to initialise the log header. Ignored if log already exists. + +.OUTPUTS + Hashtable with: + Success [bool] Whether the entry was saved + Message [string] Human-readable summary + LogPath [string] Absolute path to the resolution log file + +.EXAMPLE + # Record a resolution after resolving auth.c + # MCP Tool: mcp_openssh-server_Save_MergeResolution + # FilePath="auth.c", Strategy="ifdef_windows", Rationale="Wrapped PAM code", + # BatchNumber=1, UpstreamCommits="abc1234,def5678" + +.EXAMPLE + # Record the first resolution (initialises log with MergeTarget) + # MCP Tool: mcp_openssh-server_Save_MergeResolution + # FilePath="channels.c", Strategy="accept_upstream", Rationale="Security fix", + # BatchNumber=1, UpstreamCommits="abc1234", MergeTarget="upstream/V_10_1_P1" +#> + +param( + [Parameter(Mandatory)] + [string]$FilePath, + + [Parameter(Mandatory)] + [ValidateSet('accept_upstream', 'ifdef_windows', 'ifndef_windows', 'combine', 'manual')] + [string]$Strategy, + + [Parameter(Mandatory)] + [string]$Rationale, + + [Parameter(Mandatory)] + [int]$BatchNumber, + + [string]$UpstreamCommits = '', + + [string]$MergeTarget = '' +) + +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' + +# ── Locate the log file inside .git ────────────────────────────────────────── + +$gitDir = Join-Path (Get-Location) '.git' +if (-not (Test-Path $gitDir)) { + return @{ + Success = $false + Message = 'Not inside a git repository — .git directory not found.' + LogPath = '' + } +} + +$logPath = Join-Path $gitDir 'merge-resolution-log.json' + +# ── Read or initialise the log ─────────────────────────────────────────────── + +if (Test-Path $logPath) { + $log = Get-Content -Raw $logPath | ConvertFrom-Json +} else { + $log = [PSCustomObject]@{ + merge_target = if ($MergeTarget) { $MergeTarget } else { 'unknown' } + created_at = (Get-Date -Format 'o') + resolutions = @() + } +} + +# ── Read the resolved file and compute hash ────────────────────────────────── + +$fullFilePath = Join-Path (Get-Location) $FilePath +if (-not (Test-Path $fullFilePath)) { + return @{ + Success = $false + Message = "Resolved file not found: ${FilePath}" + LogPath = $logPath + } +} + +$fileBytes = [System.IO.File]::ReadAllBytes($fullFilePath) +$sha256 = [System.Security.Cryptography.SHA256]::Create() +$hashBytes = $sha256.ComputeHash($fileBytes) +$hashString = ($hashBytes | ForEach-Object { $_.ToString('x2') }) -join '' +$contentB64 = [System.Convert]::ToBase64String($fileBytes) + +# ── Parse upstream commits ─────────────────────────────────────────────────── + +$commitList = if ($UpstreamCommits) { + ($UpstreamCommits -split ',') | ForEach-Object { $_.Trim() } | Where-Object { $_ } +} else { + @() +} + +# ── Build the entry ────────────────────────────────────────────────────────── + +$entry = [PSCustomObject]@{ + file = $FilePath + batch_number = $BatchNumber + upstream_commits = $commitList + strategy = $Strategy + rationale = $Rationale + resolved_content_sha256 = $hashString + resolved_content_base64 = $contentB64 + recorded_at = (Get-Date -Format 'o') +} + +# ── Append and save ────────────────────────────────────────────────────────── + +# ConvertFrom-Json returns a fixed-size array; convert to a list so we can add +$existingResolutions = [System.Collections.Generic.List[object]]::new() +if ($log.resolutions) { + foreach ($r in $log.resolutions) { + $existingResolutions.Add($r) + } +} +$existingResolutions.Add($entry) +$log.resolutions = $existingResolutions.ToArray() + +$log | ConvertTo-Json -Depth 10 | Set-Content -Path $logPath -Encoding utf8 + +return @{ + Success = $true + Message = "Resolution recorded for '${FilePath}' (batch ${BatchNumber}, strategy: ${Strategy}). Log has $($log.resolutions.Count) entries." + LogPath = $logPath +} diff --git a/.github/tools/Start-OpenSSHBuild.ps1 b/.github/tools/Start-OpenSSHBuild.ps1 new file mode 100644 index 000000000000..b6b0c6e2c3d0 --- /dev/null +++ b/.github/tools/Start-OpenSSHBuild.ps1 @@ -0,0 +1,214 @@ +<# +.SYNOPSIS + MCP tool to build OpenSSH on Windows using Visual Studio. + +.DESCRIPTION + This script wraps the Start-OpenSSHBuild function from OpenSSHBuildHelper.psm1 + to provide a standardized MCP interface for building OpenSSH. It supports + incremental and clean builds, multiple architectures, and various build configurations. + + The tool invokes MSBuild on the Win32-OpenSSH.sln solution and captures + all build output to a log file. + +.PARAMETER Configuration + Build configuration type. Valid values: 'Debug', 'Release' + Default: 'Release' + +.PARAMETER Architecture + Target architecture for the build. Valid values: 'x64', 'x86', 'ARM', 'ARM64' + Default: 'x64' + +.PARAMETER Clean + When specified, performs a clean build by deleting existing build artifacts first. + Default: false (incremental build) + +.PARAMETER NoOpenSSL + Build without OpenSSL support. + Default: false + +.PARAMETER OneCore + Build for Windows OneCore API subset. + Default: false + +.OUTPUTS + Returns a hashtable with: + - Success: Boolean indicating build success + - ExitCode: MSBuild exit code + - LogFile: Path to build log file + - BuildPath: Path to build output directory + - Message: Status message + +.EXAMPLE + .\Start-OpenSSHBuild.ps1 -Configuration Release -Architecture x64 + + Performs an incremental release build for x64 architecture. + +.EXAMPLE + .\Start-OpenSSHBuild.ps1 -Configuration Debug -Architecture x64 -Clean + + Performs a clean debug build for x64 architecture. + +.EXAMPLE + .\Start-OpenSSHBuild.ps1 -Architecture ARM64 -OneCore + + Performs an incremental OneCore release build for ARM64. + +.NOTES + - Requires Visual Studio 2019 or later with C++ tools + - Requires Windows SDK 10.0.17763.0 or later + - Build artifacts output to: contrib\win32\openssh\{Architecture}\{Configuration}\ + - Build log written to: OpenSSH{Configuration}{Architecture}.log +#> + +param( + [Parameter(Mandatory=$false)] + [ValidateSet('Debug', 'Release')] + [string]$Configuration = 'Release', + + [Parameter(Mandatory=$false)] + [ValidateSet('x64', 'x86', 'ARM', 'ARM64')] + [string]$Architecture = 'x64', + + [Parameter(Mandatory=$false)] + [switch]$Clean, + + [Parameter(Mandatory=$false)] + [switch]$NoOpenSSL, + + [Parameter(Mandatory=$false)] + [switch]$OneCore +) + +# Determine repository root (go up from .github\tools to repo root) +$scriptRoot = $PSScriptRoot +$repoRoot = Split-Path -Parent (Split-Path -Parent $scriptRoot) + +# Navigate to repository root +Push-Location $repoRoot + +try { + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "OpenSSH Build Tool (MCP)" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "Configuration: $Configuration" -ForegroundColor White + Write-Host "Architecture: $Architecture" -ForegroundColor White + Write-Host "Clean Build: $Clean" -ForegroundColor White + Write-Host "No OpenSSL: $NoOpenSSL" -ForegroundColor White + Write-Host "OneCore: $OneCore" -ForegroundColor White + Write-Host "========================================`n" -ForegroundColor Cyan + + # Import OpenSSH build helper module + $buildHelperPath = Join-Path $repoRoot "contrib\win32\openssh\OpenSSHBuildHelper.psm1" + if (-not (Test-Path $buildHelperPath)) { + throw "OpenSSHBuildHelper.psm1 not found at: $buildHelperPath" + } + + Import-Module $buildHelperPath -Force -ErrorAction Stop + Write-Host "✓ Loaded OpenSSHBuildHelper module" -ForegroundColor Green + + # Define build output path + $buildPath = Join-Path $repoRoot "contrib\win32\openssh\$Architecture\$Configuration" + + # Perform clean if requested + if ($Clean -and (Test-Path $buildPath)) { + Write-Host "`nCleaning previous build artifacts..." -ForegroundColor Yellow + Remove-Item $buildPath -Recurse -Force -ErrorAction Stop + Write-Host "✓ Cleaned: $buildPath" -ForegroundColor Green + } + + # Build log file path (align with other tools under contrib\win32\openssh) + $logFile = Join-Path $repoRoot "contrib\win32\openssh\OpenSSH$Configuration$Architecture.log" + Write-Host "`nBuild log: $logFile" -ForegroundColor Gray + + # Prepare parameters for Start-OpenSSHBuild + $buildParams = @{ + Configuration = $Configuration + NativeHostArch = $Architecture + } + + if ($NoOpenSSL) { + $buildParams['NoOpenSSL'] = $true + } + + if ($OneCore) { + $buildParams['OneCore'] = $true + } + + # Execute build + Write-Host "`nStarting build..." -ForegroundColor Cyan + Write-Host "Command: Start-OpenSSHBuild -Configuration $Configuration -NativeHostArch $Architecture$(if($NoOpenSSL){' -NoOpenSSL'})$(if($OneCore){' -OneCore'})" -ForegroundColor Gray + + $buildResult = Start-OpenSSHBuild @buildParams + + # Determine build success primarily via log markers, not exit code + $successByLog = $null + $buildLogTime = $null + if (Test-Path $logFile) { + $buildLogTime = (Get-Item $logFile -ErrorAction SilentlyContinue).LastWriteTime + $logLines = Get-Content $logFile -ErrorAction SilentlyContinue + if ($logLines) { + $lastMarker = $null + foreach ($line in $logLines) { + if ($line -match '(?i)Build\s+(FAILED|Failed)') { $lastMarker = 'FAILED' } + elseif ($line -match '(?i)Build\s+(SUCCEEDED|Succeeded)') { $lastMarker = 'SUCCEEDED' } + } + if ($lastMarker) { $successByLog = ($lastMarker -eq 'SUCCEEDED') } + } + } + + $derivedSuccess = if ($successByLog -ne $null) { $successByLog } else { $buildResult -eq 0 } + + if ($derivedSuccess) { + Write-Host "`n========================================" -ForegroundColor Green + Write-Host "BUILD SUCCEEDED" -ForegroundColor Green + Write-Host "========================================" -ForegroundColor Green + Write-Host "Build artifacts: $buildPath" -ForegroundColor White + + $result = @{ + Success = $true + ExitCode = $buildResult + LogFile = $logFile + BuildPath = $buildPath + BuildLogTimestamp = $buildLogTime + Message = "Build completed successfully" + } + } else { + Write-Host "`n========================================" -ForegroundColor Red + Write-Host "BUILD FAILED" -ForegroundColor Red + Write-Host "========================================" -ForegroundColor Red + Write-Host "Exit code: $buildResult" -ForegroundColor Red + Write-Host "Check log file: $logFile" -ForegroundColor Yellow + + $result = @{ + Success = $false + ExitCode = $buildResult + LogFile = $logFile + BuildPath = $buildPath + BuildLogTimestamp = $buildLogTime + Message = "Build failed (determined from log markers or exit code). Check log file for details." + } + } + + # Output result as JSON for MCP consumption + return $result + +} catch { + Write-Host "`n========================================" -ForegroundColor Red + Write-Host "ERROR" -ForegroundColor Red + Write-Host "========================================" -ForegroundColor Red + Write-Host $_.Exception.Message -ForegroundColor Red + Write-Host $_.ScriptStackTrace -ForegroundColor Gray + + $result = @{ + Success = $false + ExitCode = -1 + LogFile = $logFile + BuildPath = $buildPath + Message = "Build tool error: $($_.Exception.Message)" + } + + return $result + +} finally { + Pop-Location +} diff --git a/.github/tools/Test-MergePrerequisites.ps1 b/.github/tools/Test-MergePrerequisites.ps1 new file mode 100644 index 000000000000..3cd75bd87657 --- /dev/null +++ b/.github/tools/Test-MergePrerequisites.ps1 @@ -0,0 +1,288 @@ +<# +.SYNOPSIS + MCP tool that verifies all prerequisites for starting an OpenSSH upstream merge. + +.DESCRIPTION + This script performs comprehensive pre-merge setup verification for the OpenSSH + upstream merge workflow. It checks: + - Required tools (Git, PowerShell, Visual Studio) + - Repository configuration (remotes, branch state) + - Target version identification + + This tool should be run before starting Phase 1 of the merge workflow to ensure + all prerequisites are met. It prevents wasted effort by catching configuration + issues early. + + To verify baseline build capability, use the Test-OpenSSHBuild MCP tool: + mcp_openssh-server_Test_OpenSSHBuild + +.PARAMETER TargetVersion + The upstream version/tag to merge (e.g., "V_10_0_P2", "V_9_9_P1") + This can be a tag name or branch name from the upstream repository. + +.OUTPUTS + Returns a hashtable with: + - Success: Boolean indicating all prerequisites passed + - GitInstalled: Boolean - Git is available + - PowerShellVersion: String - PowerShell version + - VSInstalled: Boolean - Visual Studio is available + - RemotesConfigured: Boolean - All required remotes configured + - TargetExists: Boolean - Target version/tag exists in upstream + - WorkingDirClean: Boolean - No uncommitted changes + - Issues: Array - List of any issues found + - Message: String - Summary message + +.EXAMPLE + .\Test-MergePrerequisites.ps1 -TargetVersion "V_10_0_P2" + + Verifies all prerequisites for merging upstream V_10_0_P2. + For baseline build verification, use Test-OpenSSHBuild MCP tool separately. + +.NOTES + - This is a Phase 1 Pre-Merge Setup verification tool + - Should be run before creating the merge branch + - For baseline build verification, use: mcp_openssh-server_Test_OpenSSHBuild + - Part of the OpenSSH upstream merge workflow automation +#> + +param( + [Parameter(Mandatory=$true)] + [string]$TargetVersion +) + +$scriptRoot = $PSScriptRoot +if ([string]::IsNullOrEmpty($scriptRoot)) { + $scriptRoot = Split-Path -Parent $MyInvocation.MyCommand.Path +} +$repoRoot = (Get-Item $scriptRoot).Parent.Parent.FullName + +$result = @{ + Success = $false + GitInstalled = $false + PowerShellVersion = $PSVersionTable.PSVersion.ToString() + VSInstalled = $false + RemotesConfigured = $false + TargetExists = $false + WorkingDirClean = $false + Issues = @() + Message = "" +} + +try { + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "OpenSSH Merge Prerequisites Check" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "Target Version: $TargetVersion" -ForegroundColor White + Write-Host "Repository Root: $repoRoot" -ForegroundColor Gray + Write-Host "========================================`n" -ForegroundColor Cyan + + # Change to repository root + Push-Location $repoRoot + Write-Host "Working Directory: $(Get-Location)" -ForegroundColor Gray + Write-Host "" + + # Step 1: Verify Git + Write-Host "[1/6] Checking Git installation..." -ForegroundColor Cyan + try { + $gitPath = Get-Command git -ErrorAction SilentlyContinue + if ($gitPath) { + $result.GitInstalled = $true + Write-Host " ✓ Git found: $($gitPath.Source)" -ForegroundColor Green + } else { + $result.Issues += "Git is not installed or not in PATH" + Write-Host " ✗ Git not found" -ForegroundColor Red + } + } catch { + $result.Issues += "Git is not installed or not in PATH" + Write-Host " ✗ Git not found" -ForegroundColor Red + } + + # Step 2: Verify PowerShell version + Write-Host "`n[2/6] Checking PowerShell version..." -ForegroundColor Cyan + $psVersion = $PSVersionTable.PSVersion + if ($psVersion.Major -ge 5) { + Write-Host " ✓ PowerShell $($psVersion.ToString()) (>= 5.0)" -ForegroundColor Green + } else { + $result.Issues += "PowerShell version $($psVersion.ToString()) is too old (need >= 5.0)" + Write-Host " ✗ PowerShell $($psVersion.ToString()) is too old (need >= 5.0)" -ForegroundColor Red + } + + # Step 3: Verify Visual Studio + Write-Host "`n[3/6] Checking Visual Studio installation..." -ForegroundColor Cyan + $msBuildPaths = @( + "${env:ProgramFiles}\Microsoft Visual Studio\2022\*\MSBuild\Current\Bin\MSBuild.exe", + "${env:ProgramFiles}\Microsoft Visual Studio\2019\*\MSBuild\Current\Bin\MSBuild.exe", + "${env:ProgramFiles(x86)}\Microsoft Visual Studio\2022\*\MSBuild\Current\Bin\MSBuild.exe", + "${env:ProgramFiles(x86)}\Microsoft Visual Studio\2019\*\MSBuild\Current\Bin\MSBuild.exe" + ) + + $msBuildFound = $false + foreach ($path in $msBuildPaths) { + $resolved = Resolve-Path $path -ErrorAction SilentlyContinue + if ($resolved) { + $msBuildFound = $true + $result.VSInstalled = $true + Write-Host " ✓ Visual Studio found: $($resolved.Path)" -ForegroundColor Green + break + } + } + + if (-not $msBuildFound) { + $result.Issues += "Visual Studio 2019 or later not found" + Write-Host " ✗ Visual Studio 2019 or later not found" -ForegroundColor Red + } + + # Step 4: Verify repository remotes + Write-Host "`n[4/6] Checking repository remotes..." -ForegroundColor Cyan + if ($result.GitInstalled) { + try { + $gitConfigPath = Join-Path $repoRoot ".git\config" + if (Test-Path $gitConfigPath) { + $gitConfig = Get-Content $gitConfigPath -Raw + $expectedRemotes = @('origin', 'upstream', 'upstream-pwsh') + $missingRemotes = @() + + foreach ($remote in $expectedRemotes) { + if ($gitConfig -match "\[remote `"$remote`"\]") { + Write-Host " ✓ $remote configured" -ForegroundColor Green + } else { + $missingRemotes += $remote + Write-Host " ✗ $remote not configured" -ForegroundColor Red + } + } + + if ($missingRemotes.Count -eq 0) { + $result.RemotesConfigured = $true + } else { + $result.Issues += "Missing remotes: $($missingRemotes -join ', ')" + } + } else { + $result.Issues += "Not a git repository" + Write-Host " ✗ Not a git repository" -ForegroundColor Red + } + } catch { + $result.Issues += "Error checking remotes: $($_.Exception.Message)" + Write-Host " ✗ Error checking remotes" -ForegroundColor Red + } + } else { + Write-Host " ⊘ Skipped (Git not available)" -ForegroundColor Yellow + } + + # Step 5: Verify target version exists + Write-Host "`n[5/6] Checking target version exists..." -ForegroundColor Cyan + if ($result.GitInstalled -and $result.RemotesConfigured) { + try { + # Check if tag/branch ref exists in .git directory + $tagPath = Join-Path $repoRoot ".git\refs\tags\$TargetVersion" + $upstreamBranchPath = Join-Path $repoRoot ".git\refs\remotes\upstream\$TargetVersion" + + if (Test-Path $tagPath) { + $result.TargetExists = $true + Write-Host " ✓ Target tag exists locally: $TargetVersion" -ForegroundColor Green + } elseif (Test-Path $upstreamBranchPath) { + $result.TargetExists = $true + Write-Host " ✓ Target branch exists: upstream/$TargetVersion" -ForegroundColor Green + } else { + $result.Issues += "Target version/tag '$TargetVersion' not found locally. Run 'git fetch upstream --tags' to update." + Write-Host " ✗ Target '$TargetVersion' not found locally" -ForegroundColor Red + Write-Host " Hint: Run 'git fetch upstream --tags' to fetch latest tags" -ForegroundColor Yellow + } + } catch { + $result.Issues += "Error checking target version: $($_.Exception.Message)" + Write-Host " ✗ Error checking target version" -ForegroundColor Red + } + } else { + Write-Host " ⊘ Skipped (prerequisites not met)" -ForegroundColor Yellow + } + + # Step 6: Verify working directory is clean + Write-Host "`n[6/6] Checking working directory status..." -ForegroundColor Cyan + if ($result.GitInstalled) { + try { + # Use Start-Job to run git status --porcelain + $job = Start-Job -ScriptBlock { + param($repoPath) + Set-Location $repoPath + git status --porcelain + } -ArgumentList $repoRoot + + $jobResult = Wait-Job $job -Timeout 10 + if ($jobResult) { + $statusOutput = Receive-Job $job + Remove-Job $job -Force + + if ([string]::IsNullOrWhiteSpace($statusOutput)) { + $result.WorkingDirClean = $true + Write-Host " ✓ Working directory is clean" -ForegroundColor Green + } else { + $result.Issues += "Working directory has uncommitted changes" + Write-Host " ✗ Working directory has uncommitted changes:" -ForegroundColor Red + $statusOutput | ForEach-Object { Write-Host " $_" -ForegroundColor Yellow } + Write-Host " Hint: Commit or stash changes before starting merge" -ForegroundColor Yellow + } + } else { + Remove-Job $job -Force + $result.Issues += "Git status check timed out" + Write-Host " ✗ Git status check timed out" -ForegroundColor Red + } + } catch { + $result.Issues += "Error checking working directory: $($_.Exception.Message)" + Write-Host " ✗ Error checking working directory status" -ForegroundColor Red + } + } else { + Write-Host " ⊘ Skipped (Git not available)" -ForegroundColor Yellow + } + + # Final evaluation + Write-Host "`n========================================" -ForegroundColor Cyan + Write-Host "PREREQUISITE CHECK SUMMARY" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + + $criticalChecks = @( + $result.GitInstalled, + $result.VSInstalled, + $result.RemotesConfigured, + $result.TargetExists, + $result.WorkingDirClean + ) + + $result.Success = ($criticalChecks | Where-Object { $_ -eq $false }).Count -eq 0 + + if ($result.Success) { + Write-Host "✓ ALL PREREQUISITES MET" -ForegroundColor Green + Write-Host "`nYou are ready to begin the merge process:" -ForegroundColor White + $result.Message = "All prerequisites met. Ready to start merge." + } else { + Write-Host "✗ PREREQUISITES NOT MET" -ForegroundColor Red + Write-Host "`nIssues found:" -ForegroundColor Yellow + foreach ($issue in $result.Issues) { + Write-Host " • $issue" -ForegroundColor Red + } + $result.Message = "$($result.Issues.Count) issue(s) found. Fix issues before starting merge." + } + + Write-Host "" + + # Return result + return $result + +} catch { + Write-Host "`n========================================" -ForegroundColor Red + Write-Host "ERROR" -ForegroundColor Red + Write-Host "========================================" -ForegroundColor Red + Write-Host $_.Exception.Message -ForegroundColor Red + Write-Host $_.ScriptStackTrace -ForegroundColor Gray + + $result.Success = $false + $result.Issues += "Tool error: $($_.Exception.Message)" + $result.Message = "Prerequisite check failed with error: $($_.Exception.Message)" + + # Return result + return $result +} finally { + try { + Pop-Location + } catch { + # Ignore Pop-Location errors in MCP context + } +} diff --git a/.github/tools/Test-OpenSSHBuild.ps1 b/.github/tools/Test-OpenSSHBuild.ps1 new file mode 100644 index 000000000000..db50930c7d2b --- /dev/null +++ b/.github/tools/Test-OpenSSHBuild.ps1 @@ -0,0 +1,320 @@ +<# +.SYNOPSIS + MCP tool to test OpenSSH build artifacts and parse build errors. + +.DESCRIPTION + This script tests that all expected OpenSSH executables were built successfully + and parses the build log file for any compilation or linker errors using regex patterns. + + Expected artifacts (14 executables): + - ssh.exe, sshd.exe, sshd-auth.exe, sshd-session.exe + - ssh-agent.exe, ssh-add.exe, ssh-keygen.exe, ssh-keyscan.exe + - scp.exe, sftp.exe, sftp-server.exe + - ssh-pkcs11-helper.exe, ssh-shellhost.exe, ssh-sk-helper.exe + +.PARAMETER Configuration + Build configuration type that was used. Valid values: 'Debug', 'Release' + Default: 'Release' + +.PARAMETER Architecture + Target architecture that was built. Valid values: 'x64', 'x86', 'ARM', 'ARM64' + Default: 'x64' + +.PARAMETER LogFile + Optional path to the build log file. If not specified, uses default pattern: + OpenSSH{Configuration}{Architecture}.log in repository root. + +.OUTPUTS + Returns a hashtable with: + - Success: Boolean indicating if all artifacts present and no errors + - ArtifactsFound: Array of executables that exist + - ArtifactsMissing: Array of expected executables that are missing + - TotalArtifacts: Count of artifacts found + - ExpectedArtifacts: Count of artifacts expected (14) + - Errors: Array of parsed error objects with file, line, code, message + - Warnings: Array of parsed warning objects + - LogFile: Path to log file analyzed + - Message: Summary message + +.EXAMPLE + .\Test-OpenSSHBuild.ps1 -Configuration Release -Architecture x64 + + Tests release build artifacts for x64 architecture. + +.EXAMPLE + .\Test-OpenSSHBuild.ps1 -Configuration Debug -Architecture x86 -LogFile "C:\build\custom.log" + + Tests debug build artifacts for x86 using a custom log file location. + +.NOTES + - Expected build artifact location: bin\{Architecture}\{Configuration}\ + - Error parsing regex (file/line form): ^(?.+?)\((?\d+)[,)].*?\s(?fatal error|error)\s+(?(?:C|LNK|MSB)\d+)\s*:\s*(?.+)$ + - Error parsing regex (generic/no line): ^(?:.*?:\s*)?(?fatal error|error)\s+(?(?:C|LNK|MSB)\d+)\s*:\s*(?.+)$ + - Warning parsing regex (file/line form): ^(?.+?)\((?\d+)[,)].*?\swarning\s+(?(?:C|LNK|MSB)\d+)\s*:\s*(?.+)$ + - Warning parsing regex (generic/no line): ^(?:.*?:\s*)?warning\s+(?(?:C|LNK|MSB)\d+)\s*:\s*(?.+)$ +#> + +param( + [Parameter(Mandatory=$false)] + [ValidateSet('Debug', 'Release')] + [string]$Configuration = 'Release', + + [Parameter(Mandatory=$false)] + [ValidateSet('x64', 'x86', 'ARM', 'ARM64')] + [string]$Architecture = 'x64', + + [Parameter(Mandatory=$false)] + [string]$LogFile +) + +# Determine repository root (go up from .github\tools to repo root) +$scriptRoot = $PSScriptRoot +$repoRoot = Split-Path -Parent (Split-Path -Parent $scriptRoot) + +# Define expected artifacts (14 executables) +$expectedArtifacts = @( + "ssh.exe", + "sshd.exe", + "sshd-auth.exe", + "sshd-session.exe", + "ssh-agent.exe", + "ssh-add.exe", + "ssh-keygen.exe", + "ssh-keyscan.exe", + "scp.exe", + "sftp.exe", + "sftp-server.exe", + "ssh-pkcs11-helper.exe", + "ssh-shellhost.exe", + "ssh-sk-helper.exe" +) + +try { + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "OpenSSH Build Test Tool (MCP)" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "Configuration: $Configuration" -ForegroundColor White + Write-Host "Architecture: $Architecture" -ForegroundColor White + Write-Host "========================================`n" -ForegroundColor Cyan + + # Define build output path + $buildPath = Join-Path $repoRoot "bin\$Architecture\$Configuration" + + if (-not (Test-Path $buildPath)) { + Write-Host "Build path does not exist: $buildPath" -ForegroundColor Red + + $result = @{ + Success = $false + ArtifactsFound = @() + ArtifactsMissing = $expectedArtifacts + TotalArtifacts = 0 + ExpectedArtifacts = $expectedArtifacts.Count + Errors = @() + Warnings = @() + LogFile = $LogFile + Message = "Build path does not exist: $buildPath" + } + + return $result + } + + Write-Host "Build path: $buildPath" -ForegroundColor Gray + + # Check for artifacts + Write-Host "`nChecking for expected artifacts..." -ForegroundColor Cyan + + $artifactsFound = @() + $artifactsMissing = @() + + foreach ($artifact in $expectedArtifacts) { + $artifactPath = Join-Path $buildPath $artifact + if (Test-Path $artifactPath) { + $artifactsFound += $artifact + Write-Host " ✓ $artifact" -ForegroundColor Green + } else { + $artifactsMissing += $artifact + Write-Host " ✗ $artifact (MISSING)" -ForegroundColor Red + } + } + + Write-Host "`nArtifacts: $($artifactsFound.Count) of $($expectedArtifacts.Count) found" -ForegroundColor $(if ($artifactsMissing.Count -eq 0) { "Green" } else { "Yellow" }) + + # Parse build log if available + $errors = @() + $warnings = @() + + if (-not $LogFile) { + $LogFile = Join-Path $repoRoot "contrib\win32\openssh\OpenSSH$Configuration$Architecture.log" + } + + if (Test-Path $LogFile) { + Write-Host "`nParsing build log: $LogFile" -ForegroundColor Cyan + + $logContent = Get-Content $LogFile -ErrorAction SilentlyContinue + $logTime = (Get-Item $LogFile -ErrorAction SilentlyContinue).LastWriteTime + + if ($logContent) { + # Find the first build status marker and, if failed, only scan lines after it + $buildStatusIndex = $null + $buildFailed = $false + for ($i = 0; $i -lt $logContent.Count; $i++) { + $line = $logContent[$i] + if ($line -match 'Build\s+(FAILED|Failed)') { + $buildStatusIndex = $i + $buildFailed = $true + break + } elseif ($line -match 'Build\s+(SUCCEEDED|Succeeded)') { + $buildStatusIndex = $i + break + } + } + + $linesToScan = $logContent + if ($buildFailed -and $buildStatusIndex -ne $null -and $buildStatusIndex + 1 -lt $logContent.Count) { + $linesToScan = $logContent[($buildStatusIndex + 1)..($logContent.Count - 1)] + } + + # Broadened regex patterns to support linker/MSBuild messages without line numbers + $errorWithFileRegex = '^(?.+?)\((?\d+)[,)].*?\s(?fatal error|error)\s+(?(?:C|LNK|MSB)\d+)\s*:\s*(?.+)$' + $genericErrorRegex = '^(?:.*?:\s*)?(?fatal error|error)\s+(?(?:C|LNK|MSB)\d+)\s*:\s*(?.+)$' + $warningWithFileRegex = '^(?.+?)\((?\d+)[,)].*?\swarning\s+(?(?:C|LNK|MSB)\d+)\s*:\s*(?.+)$' + $genericWarningRegex = '^(?:.*?:\s*)?warning\s+(?(?:C|LNK|MSB)\d+)\s*:\s*(?.+)$' + + foreach ($line in $linesToScan) { + # Errors with file/line + if ($line -match $errorWithFileRegex) { + $errors += [PSCustomObject]@{ + File = $matches['file'] + Line = [int]$matches['line'] + Code = $matches['code'] + Message = $matches['message'] + RawLine = $line + } + continue + } + # Generic errors (e.g., LINK/MSBuild without line numbers) + if ($line -match $genericErrorRegex) { + $errors += [PSCustomObject]@{ + File = '' + Line = $null + Code = $matches['code'] + Message = $matches['message'] + RawLine = $line + } + continue + } + # Warnings with file/line + if ($line -match $warningWithFileRegex) { + $warnings += [PSCustomObject]@{ + File = $matches['file'] + Line = [int]$matches['line'] + Code = $matches['code'] + Message = $matches['message'] + RawLine = $line + } + continue + } + # Generic warnings + if ($line -match $genericWarningRegex) { + $warnings += [PSCustomObject]@{ + File = '' + Line = $null + Code = $matches['code'] + Message = $matches['message'] + RawLine = $line + } + } + } + + if ($errors.Count -gt 0) { + Write-Host "`nFound $($errors.Count) error(s) in build log:" -ForegroundColor Red + foreach ($e in $errors) { + if ([string]::IsNullOrEmpty($e.File)) { + Write-Host " error $($e.Code): $($e.Message)" -ForegroundColor Red + } else { + $lineSuffix = if ($e.Line -ne $null) { "(" + $e.Line + ")" } else { "" } + Write-Host (" {0}{1}: error {2}: {3}" -f $e.File, $lineSuffix, $e.Code, $e.Message) -ForegroundColor Red + } + } + } else { + Write-Host "`n✓ No errors found in build log" -ForegroundColor Green + } + + if ($warnings.Count -gt 0) { + Write-Host "`nFound $($warnings.Count) warning(s) in build log:" -ForegroundColor Yellow + foreach ($warning in $warnings | Select-Object -First 10) { + if ([string]::IsNullOrEmpty($warning.File)) { + Write-Host " warning $($warning.Code): $($warning.Message)" -ForegroundColor Yellow + } else { + $lineSuffix = if ($warning.Line -ne $null) { "(" + $warning.Line + ")" } else { "" } + Write-Host (" {0}{1}: warning {2}: {3}" -f $warning.File, $lineSuffix, $warning.Code, $warning.Message) -ForegroundColor Yellow + } + } + if ($warnings.Count -gt 10) { + Write-Host " ... and $($warnings.Count - 10) more warnings" -ForegroundColor Gray + } + } + } else { + Write-Host "Log file is empty or could not be read" -ForegroundColor Yellow + } + + # Timestamp freshness checks removed; rely on build log parsing instead + } else { + Write-Host "`nBuild log not found: $LogFile" -ForegroundColor Yellow + } + + # Determine overall success + $success = ($artifactsMissing.Count -eq 0) -and ($errors.Count -eq 0) + + # Build summary message + if ($success) { + $message = "All $($expectedArtifacts.Count) artifacts built successfully with no errors" + } elseif ($artifactsMissing.Count -gt 0 -and $errors.Count -gt 0) { + $message = "$($artifactsMissing.Count) artifacts missing and $($errors.Count) error(s) found" + } elseif ($artifactsMissing.Count -gt 0) { + $message = "$($artifactsMissing.Count) artifacts missing" + } else { + $message = "$($errors.Count) error(s) found in build log" + } + + Write-Host "`n========================================" -ForegroundColor $(if ($success) { "Green" } else { "Red" }) + Write-Host $(if ($success) { "TEST PASSED" } else { "TEST FAILED" }) -ForegroundColor $(if ($success) { "Green" } else { "Red" }) + Write-Host "========================================" -ForegroundColor $(if ($success) { "Green" } else { "Red" }) + Write-Host $message -ForegroundColor White + + $result = @{ + Success = $success + ArtifactsFound = $artifactsFound + ArtifactsMissing = $artifactsMissing + TotalArtifacts = $artifactsFound.Count + ExpectedArtifacts = $expectedArtifacts.Count + Errors = $errors + Warnings = $warnings + LogFile = $LogFile + # BuildLogTimestamp and stale artifact checks removed + Message = $message + } + + return $result + +} catch { + Write-Host "`n========================================" -ForegroundColor Red + Write-Host "ERROR" -ForegroundColor Red + Write-Host "========================================" -ForegroundColor Red + Write-Host $_.Exception.Message -ForegroundColor Red + Write-Host $_.ScriptStackTrace -ForegroundColor Gray + + $result = @{ + Success = $false + ArtifactsFound = @() + ArtifactsMissing = $expectedArtifacts + TotalArtifacts = 0 + ExpectedArtifacts = $expectedArtifacts.Count + Errors = @() + Warnings = @() + LogFile = $LogFile + Message = "Test tool error: $($_.Exception.Message)" + } + + return $result +} diff --git a/.github/tools/Test-OpenSSHFunctionality.ps1 b/.github/tools/Test-OpenSSHFunctionality.ps1 new file mode 100644 index 000000000000..7a1186dc98a2 --- /dev/null +++ b/.github/tools/Test-OpenSSHFunctionality.ps1 @@ -0,0 +1,451 @@ +<# +.SYNOPSIS + Tests OpenSSH functionality by installing the SSH service, creating a test user, + and attempting a password-authenticated SSH connection. + +.DESCRIPTION + This script performs end-to-end functional testing of OpenSSH on Windows by: + 1. Verifying Administrator privileges + 2. Creating a temporary local user with a random password + 3. Installing the SSH service using install-sshd.ps1 + 4. Starting the SSH service + 5. Configuring Windows Firewall (optional) + 6. Testing SSH connection with password authentication + 7. Cleaning up all resources (user, service, firewall rule) + + The test is successful if an SSH connection can execute "echo hello world" successfully. + +.PARAMETER Configuration + Build configuration type. Valid values: 'Debug', 'Release' + Default: 'Release' + +.PARAMETER Architecture + Target architecture. Valid values: 'x64', 'x86', 'ARM', 'ARM64' + Default: 'x64' + +.PARAMETER SkipFirewall + Skip Windows Firewall configuration. Use this if firewall rules already exist + or if testing on a system without firewall enabled. + +.PARAMETER NoCleanup + Skip cleanup of created resources (test user, firewall rule, temp files). + Useful when debugging failures. + +.EXAMPLE + .\Test-OpenSSHFunctionality.ps1 + Tests using default Release x64 build with firewall configuration + +.EXAMPLE + .\Test-OpenSSHFunctionality.ps1 -Configuration Debug -Architecture x64 + Tests using Debug x64 build + +.EXAMPLE + .\Test-OpenSSHFunctionality.ps1 -SkipFirewall + Tests without modifying firewall rules + +.NOTES + Requires Administrator privileges. + Creates temporary user with prefix "openssh_test_" which is removed after testing. +#> + +[CmdletBinding()] +param( + [Parameter()] + [ValidateSet('Debug', 'Release')] + [string]$Configuration = 'Release', + + [Parameter()] + [ValidateSet('x64', 'x86', 'ARM', 'ARM64')] + [string]$Architecture = 'x64', + + [Parameter()] + [switch]$SkipFirewall, + + [Parameter()] + [switch]$NoCleanup +) + +# Helper function to generate a random password +function New-RandomPassword { + [CmdletBinding()] + param( + [Parameter()] + [int]$Length = 20 + ) + + # Character sets for password complexity + $lowercase = 'abcdefghijklmnopqrstuvwxyz' + $uppercase = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' + $numbers = '0123456789' + $special = '!@#$%^&*()_+-=[]{}|;:,.<>?' + + # Ensure at least one character from each set + $password = @( + $lowercase[(Get-Random -Maximum $lowercase.Length)] + $uppercase[(Get-Random -Maximum $uppercase.Length)] + $numbers[(Get-Random -Maximum $numbers.Length)] + $special[(Get-Random -Maximum $special.Length)] + ) + + # Fill the rest with random characters from all sets + $allChars = $lowercase + $uppercase + $numbers + $special + for ($i = $password.Count; $i -lt $Length; $i++) { + $password += $allChars[(Get-Random -Maximum $allChars.Length)] + } + + # Shuffle the password + $shuffled = $password | Sort-Object {Get-Random} + + return -join $shuffled +} + +# Initialize result object +$result = [PSCustomObject]@{ + Success = $false + ServiceInstalled = $false + ServiceStarted = $false + ConnectionSuccessful = $false + CommandOutput = $null + TestUser = $null + Errors = @() + Message = "" +} + +# Variables for cleanup tracking +$testUser = $null +$serviceWasInstalled = $false +$firewallRuleCreated = $false + +try { + Write-Host "=== OpenSSH Functionality Test ===" -ForegroundColor Cyan + Write-Host "Configuration: $Configuration" -ForegroundColor Gray + Write-Host "Architecture: $Architecture" -ForegroundColor Gray + Write-Host "" + + # Step 1: Verify Administrator privileges + Write-Host "[1/6] Checking Administrator privileges..." -ForegroundColor Yellow + $isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator") + + if (-not $isAdmin) { + $result.Errors += "Administrator privileges required" + $result.Message = "FAILED: This script must be run as Administrator for service installation and user management." + Write-Host "✗ Administrator privileges required" -ForegroundColor Red + Write-Host " Please restart PowerShell or VS Code as Administrator" -ForegroundColor Yellow + return $result + } + Write-Host "✓ Running with Administrator privileges" -ForegroundColor Green + + # Step 2: Locate build artifacts and scripts + $scriptRoot = Split-Path -Parent $PSCommandPath + $repoRoot = Split-Path -Parent (Split-Path -Parent $scriptRoot) + $buildPath = Join-Path $repoRoot "bin\$Architecture\$Configuration" + $askPassExe = Join-Path $repoRoot "regress\pesterTests\utilities\askpass_util\askpass_util.exe" + + # Verify build artifacts exist + $sshdExe = Join-Path $buildPath "sshd.exe" + $sshExe = Join-Path $buildPath "ssh.exe" + $installScript = Join-Path $buildPath "install-sshd.ps1" + + if (-not (Test-Path $sshdExe) -or -not (Test-Path $sshExe)) { + $result.Errors += "Build artifacts not found at $buildPath" + $result.Message = "FAILED: Build artifacts not found. Please build the project first." + Write-Host "✗ Build artifacts not found at $buildPath" -ForegroundColor Red + return $result + } + + if (-not (Test-Path $installScript)) { + $result.Errors += "install-sshd.ps1 not found at $buildPath" + $result.Message = "FAILED: install-sshd.ps1 script not found." + Write-Host "✗ install-sshd.ps1 not found at $buildPath" -ForegroundColor Red + return $result + } + + # Step 3: Create temporary test user + Write-Host "`n[2/6] Creating temporary test user..." -ForegroundColor Yellow + $testUsername = "openssh_test_" + (Get-Random -Minimum 1000 -Maximum 9999) + $testPassword = New-RandomPassword -Length 24 + $securePassword = ConvertTo-SecureString $testPassword -AsPlainText -Force + + try { + Import-Module Microsoft.PowerShell.LocalAccounts -UseWindowsPowerShell + New-LocalUser -Name $testUsername -Password $securePassword -Description "Temporary user for OpenSSH testing" -ErrorAction Stop | Out-Null + $testUser = $testUsername + $result.TestUser = $testUsername + $env:ASKPASS_PASSWORD = $testPassword + $env:SSH_ASKPASS_REQUIRE = "force" + if (-not (Test-Path $askPassExe)) { + throw "SSH_ASKPASS helper not found at '$askPassExe'" + } + $env:SSH_ASKPASS = $askPassExe + Write-Host "✓ Created test user: $testUsername" -ForegroundColor Green + } + catch { + $result.Errors += "Failed to create test user: $_" + $result.Message = "FAILED: Could not create temporary test user." + Write-Host "✗ Failed to create test user: $_" -ForegroundColor Red + return $result + } + + # Step 4: Install SSH service + Write-Host "`n[3/6] Installing SSH service..." -ForegroundColor Yellow + Push-Location $buildPath + try { + # Check if service already exists + $existingService = Get-Service sshd -ErrorAction SilentlyContinue + if ($existingService) { + Write-Host " SSH service already exists, uninstalling first..." -ForegroundColor Gray + $uninstallScript = Join-Path $buildPath "uninstall-sshd.ps1" + if (Test-Path $uninstallScript) { + & $uninstallScript 2>&1 | Out-Null + Start-Sleep -Seconds 2 + } + } + + # Install the service + & $installScript 2>&1 | Out-Null + $serviceWasInstalled = $true + + # Verify installation + $service = Get-Service sshd -ErrorAction SilentlyContinue + if ($service) { + $result.ServiceInstalled = $true + Write-Host "✓ SSH service installed successfully" -ForegroundColor Green + } + else { + throw "Service installation completed but service not found" + } + } + catch { + $result.Errors += "Failed to install SSH service: $_" + $result.Message = "FAILED: SSH service installation failed." + Write-Host "✗ Failed to install SSH service: $_" -ForegroundColor Red + return $result + } + finally { + Pop-Location + } + + # Step 5: Start SSH service + Write-Host "`n[4/6] Starting SSH service..." -ForegroundColor Yellow + try { + Start-Service sshd -ErrorAction Stop + Start-Sleep -Seconds 2 + + $service = Get-Service sshd + if ($service.Status -eq 'Running') { + $result.ServiceStarted = $true + Write-Host "✓ SSH service started successfully" -ForegroundColor Green + } + else { + throw "Service status is $($service.Status), expected Running" + } + } + catch { + $result.Errors += "Failed to start SSH service: $_" + $result.Message = "FAILED: Could not start SSH service." + Write-Host "✗ Failed to start SSH service: $_" -ForegroundColor Red + return $result + } + + # Step 6: Configure Windows Firewall (if not skipped) + if (-not $SkipFirewall) { + Write-Host "`n[5/6] Configuring Windows Firewall..." -ForegroundColor Yellow + try { + # Check if rule already exists + $existingRule = Get-NetFirewallRule -DisplayName "SSH Server (sshd) - Test" -ErrorAction SilentlyContinue + if ($existingRule) { + Remove-NetFirewallRule -DisplayName "SSH Server (sshd) - Test" -ErrorAction SilentlyContinue + } + + New-NetFirewallRule -DisplayName "SSH Server (sshd) - Test" -Direction Inbound -Port 22 -Protocol TCP -Action Allow -ErrorAction Stop | Out-Null + $firewallRuleCreated = $true + Write-Host "✓ Firewall rule created" -ForegroundColor Green + } + catch { + # Non-critical error, continue with test + Write-Host "⚠ Firewall configuration failed (non-critical): $_" -ForegroundColor Yellow + } + } + else { + Write-Host "`n[5/6] Skipping firewall configuration (as requested)" -ForegroundColor Gray + } + + # Step 7: Test SSH connection + Write-Host "`n[6/6] Testing SSH connection..." -ForegroundColor Yellow + + # Prepare connection test + $sshClientPath = Join-Path $buildPath "ssh.exe" + $hostname = "localhost" + $testCommand = "echo hello world" + + # Create temporary files for password input and output capture + $tempPasswordFile = [System.IO.Path]::GetTempFileName() + $tempOutputFile = [System.IO.Path]::GetTempFileName() + $tempErrorFile = [System.IO.Path]::GetTempFileName() + + try { + # Write password to temp file (for potential use, though we'll use environment variable) + Set-Content -Path $tempPasswordFile -Value $testPassword -NoNewline + + # Build SSH command with password authentication forced + # Note: Windows SSH doesn't support stdin password directly, so we rely on interactive prompt handling + # For automated testing, we'll use SSH with key-based auth disabled and capture output + + $processInfo = New-Object System.Diagnostics.ProcessStartInfo + $processInfo.FileName = $sshClientPath + $processInfo.Arguments = "-o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL -o PubkeyAuthentication=no -o PasswordAuthentication=yes $testUsername@$hostname `"$testCommand`"" + $processInfo.RedirectStandardInput = $true + $processInfo.RedirectStandardOutput = $true + $processInfo.RedirectStandardError = $true + $processInfo.UseShellExecute = $false + $processInfo.CreateNoWindow = $true + + $process = New-Object System.Diagnostics.Process + $process.StartInfo = $processInfo + + Write-Host " Attempting SSH connection to $testUsername@$hostname..." -ForegroundColor Gray + + $process.Start() | Out-Null + + # Begin async reads BEFORE blocking on WaitForExit — prevents deadlock when + # SSH output exceeds the internal stream buffer size (same issue as MCP stdio). + $stdoutTask = $process.StandardOutput.ReadToEndAsync() + $stderrTask = $process.StandardError.ReadToEndAsync() + + $completed = $process.WaitForExit(30000) # 30-second timeout + + if (-not $completed) { + $process.Kill() + throw "SSH connection timed out after 30 seconds" + } + + $stdout = $stdoutTask.GetAwaiter().GetResult() + $stderr = $stderrTask.GetAwaiter().GetResult() + $exitCode = $process.ExitCode + + # Check result + if ($exitCode -eq 0 -and $stdout -match "hello world") { + $result.ConnectionSuccessful = $true + $result.CommandOutput = $stdout.Trim() + $result.Success = $true + $result.Message = "SUCCESS: SSH connection test passed. Command executed successfully." + Write-Host "✓ SSH connection successful" -ForegroundColor Green + Write-Host " Command output: $($stdout.Trim())" -ForegroundColor Gray + } + else { + $result.Errors += "SSH connection failed with exit code $exitCode" + if ($stderr) { + $result.Errors += "SSH error: $stderr" + } + $result.Message = "FAILED: SSH connection test failed." + Write-Host "✗ SSH connection failed (exit code: $exitCode)" -ForegroundColor Red + if ($stderr) { + Write-Host " Error: $stderr" -ForegroundColor Red + } + } + } + catch { + $result.Errors += "SSH connection test error: $_" + $result.Message = "FAILED: SSH connection test encountered an error." + Write-Host "✗ SSH connection test error: $_" -ForegroundColor Red + } + finally { + # Clean up temp files + if (Test-Path $tempPasswordFile) { Remove-Item $tempPasswordFile -Force -ErrorAction SilentlyContinue } + if (Test-Path $tempOutputFile) { Remove-Item $tempOutputFile -Force -ErrorAction SilentlyContinue } + if (Test-Path $tempErrorFile) { Remove-Item $tempErrorFile -Force -ErrorAction SilentlyContinue } + } +} +finally { + # Cleanup: Always attempt to clean up resources + Write-Host "`n=== Cleanup ===" -ForegroundColor Cyan + + if ($NoCleanup) { + Write-Host "⚠ NoCleanup specified - leaving resources in place for investigation." -ForegroundColor Yellow + if ($testUser) { + Write-Host " Test user: $testUser" -ForegroundColor Yellow + } + if ($serviceWasInstalled) { + Write-Host " SSH service may still be installed/running (sshd)." -ForegroundColor Yellow + } + if ($firewallRuleCreated) { + Write-Host " Firewall rule: SSH Server (sshd) - Test" -ForegroundColor Yellow + } + Write-Host ""; + } else { + # Stop and uninstall SSH service + if ($serviceWasInstalled) { + Write-Host "Stopping SSH service..." -ForegroundColor Gray + try { + Stop-Service sshd -Force -ErrorAction SilentlyContinue + Start-Sleep -Seconds 1 + } + catch { + Write-Host "⚠ Warning: Failed to stop service: $_" -ForegroundColor Yellow + } + + Write-Host "Uninstalling SSH service..." -ForegroundColor Gray + $uninstallScript = Join-Path $buildPath "uninstall-sshd.ps1" + if (Test-Path $uninstallScript) { + Push-Location $buildPath + try { + & $uninstallScript 2>&1 | Out-Null + Write-Host "✓ SSH service uninstalled" -ForegroundColor Green + } + catch { + Write-Host "⚠ Warning: Failed to uninstall service: $_" -ForegroundColor Yellow + } + finally { + Pop-Location + } + } + } + + # Remove firewall rule + if ($firewallRuleCreated) { + Write-Host "Removing firewall rule..." -ForegroundColor Gray + try { + Remove-NetFirewallRule -DisplayName "SSH Server (sshd) - Test" -ErrorAction SilentlyContinue + Write-Host "✓ Firewall rule removed" -ForegroundColor Green + } + catch { + Write-Host "⚠ Warning: Failed to remove firewall rule: $_" -ForegroundColor Yellow + } + } + + # Remove test user + if ($testUser) { + Write-Host "Removing test user..." -ForegroundColor Gray + try { + Remove-LocalUser -Name $testUser -ErrorAction Stop + Write-Host "✓ Test user removed" -ForegroundColor Green + } + catch { + Write-Host "⚠ Warning: Failed to remove test user: $_" -ForegroundColor Yellow + Write-Host " You may need to manually remove user: $testUser" -ForegroundColor Yellow + } + } + + Write-Host "" + } +} + +# Output summary +Write-Host "=== Test Summary ===" -ForegroundColor Cyan +Write-Host "Status: $(if ($result.Success) { 'PASSED' } else { 'FAILED' })" -ForegroundColor $(if ($result.Success) { 'Green' } else { 'Red' }) +Write-Host "Service Installed: $($result.ServiceInstalled)" -ForegroundColor Gray +Write-Host "Service Started: $($result.ServiceStarted)" -ForegroundColor Gray +Write-Host "Connection Successful: $($result.ConnectionSuccessful)" -ForegroundColor Gray +if ($result.CommandOutput) { + Write-Host "Command Output: $($result.CommandOutput)" -ForegroundColor Gray +} +if ($result.Errors.Count -gt 0) { + Write-Host "Errors:" -ForegroundColor Red + foreach ($e in $result.Errors) { + Write-Host " - $e" -ForegroundColor Red + } +} +Write-Host "" + +# Return result object +return $result diff --git a/.skipped-commit-ids b/.skipped-commit-ids index 7988e25006f4..319beea0dee6 100644 --- a/.skipped-commit-ids +++ b/.skipped-commit-ids @@ -39,6 +39,7 @@ fb39324748824cb0387e9d67c41d1bef945c54ea Makefile change 112aacedd3b61cc5c34b1fa6d9fb759214179172 Makefile change a959fc45ea3431b36f52eda04faefc58bcde00db groupaccess.c changes 6d07e4606997e36b860621a14dd41975f2902f8f Makefile.inc +c7246a6b519ac390ca550719f91acfdaef1fa0f0 Makefile relink change Old upstream tree: diff --git a/INSTALL b/INSTALL index 3ad1659f36f6..56e351af60e1 100644 --- a/INSTALL +++ b/INSTALL @@ -245,7 +245,7 @@ manually using the following commands: ssh-keygen -t [type] -f /etc/ssh/ssh_host_key -N "" -for each of the types you wish to generate (rsa, dsa or ecdsa) or +for each of the types you wish to generate (rsa, ed25519 or ecdsa) or ssh-keygen -A diff --git a/Makefile.in b/Makefile.in index 4617cebcd5e4..672bf4493cf8 100644 --- a/Makefile.in +++ b/Makefile.in @@ -105,7 +105,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ log.o match.o moduli.o nchan.o packet.o \ readpass.o ttymodes.o xmalloc.o addr.o addrmatch.o \ atomicio.o dispatch.o mac.o misc.o utf8.o \ - monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \ + monitor_fdpass.o rijndael.o ssh-ecdsa.o ssh-ecdsa-sk.o \ ssh-ed25519-sk.o ssh-rsa.o dh.o \ msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \ ssh-pkcs11.o smult_curve25519_ref.o \ @@ -140,7 +140,7 @@ SSHD_SESSION_OBJS=sshd-session.o auth-rhosts.o auth-passwd.o \ auth2-gss.o gss-serv.o gss-serv-krb5.o \ loginrec.o auth-pam.o auth-shadow.o auth-sia.o \ sftp-server.o sftp-common.o \ - uidswap.o platform-listen.o $(SKOBJS) + uidswap.o platform-listen.o misc-agent.o $(SKOBJS) SSHD_AUTH_OBJS=sshd-auth.o \ auth2-methods.o \ @@ -155,7 +155,7 @@ SSHD_AUTH_OBJS=sshd-auth.o \ sandbox-null.o sandbox-rlimit.o sandbox-darwin.o \ sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-solaris.o \ sftp-server.o sftp-common.o \ - uidswap.o $(SKOBJS) + uidswap.o misc-agent.o $(SKOBJS) SFTP_CLIENT_OBJS=sftp-common.o sftp-client.o sftp-glob.o @@ -163,7 +163,7 @@ SCP_OBJS= scp.o progressmeter.o $(SFTP_CLIENT_OBJS) SSHADD_OBJS= ssh-add.o $(SKOBJS) -SSHAGENT_OBJS= ssh-agent.o ssh-pkcs11-client.o $(SKOBJS) +SSHAGENT_OBJS= ssh-agent.o ssh-pkcs11-client.o misc-agent.o $(SKOBJS) SSHKEYGEN_OBJS= ssh-keygen.o sshsig.o $(SKOBJS) @@ -194,7 +194,6 @@ PATHSUBS = \ -e 's|/etc/shosts.equiv|$(sysconfdir)/shosts.equiv|g' \ -e 's|/etc/ssh/ssh_host_key|$(sysconfdir)/ssh_host_key|g' \ -e 's|/etc/ssh/ssh_host_ecdsa_key|$(sysconfdir)/ssh_host_ecdsa_key|g' \ - -e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \ -e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \ -e 's|/etc/ssh/ssh_host_ed25519_key|$(sysconfdir)/ssh_host_ed25519_key|g' \ -e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \ @@ -494,7 +493,6 @@ host-key: ssh-keygen$(EXEEXT) fi host-key-force: ssh-keygen$(EXEEXT) ssh$(EXEEXT) - ./ssh-keygen -t dsa -f $(DESTDIR)$(sysconfdir)/ssh_host_dsa_key -N "" ./ssh-keygen -t rsa -f $(DESTDIR)$(sysconfdir)/ssh_host_rsa_key -N "" ./ssh-keygen -t ed25519 -f $(DESTDIR)$(sysconfdir)/ssh_host_ed25519_key -N "" if ./ssh -Q key | grep ecdsa >/dev/null ; then \ @@ -557,7 +555,7 @@ regress-prep: ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile REGRESSLIBS=libssh.a $(LIBCOMPAT) -TESTLIBS=$(LIBS) $(CHANNELLIBS) +TESTLIBS=$(LIBS) $(CHANNELLIBS) @TESTLIBS@ regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c $(REGRESSLIBS) $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/modpipe.c \ @@ -782,6 +780,13 @@ unit: regress-unit-binaries OBJ="$(BUILDDIR)/regress" \ $@ && echo $@ tests passed +unit-bench: regress-unit-binaries + cd $(srcdir)/regress || exit $$?; \ + $(MAKE) \ + .CURDIR="$(abs_top_srcdir)/regress" \ + .OBJDIR="$(BUILDDIR)/regress" \ + OBJ="$(BUILDDIR)/regress" $@ + TEST_SSH_SSHD="$(BUILDDIR)/sshd" interop-tests t-exec file-tests extra-tests: regress-prep regress-binaries $(TARGETS) diff --git a/PROTOCOL b/PROTOCOL index 26387793febc..f99173c527b7 100644 --- a/PROTOCOL +++ b/PROTOCOL @@ -34,14 +34,13 @@ The method is documented in: https://www.openssh.com/txt/draft-miller-secsh-compression-delayed-00.txt 1.3. transport: New public key algorithms "ssh-rsa-cert-v01@openssh.com", - "ssh-dsa-cert-v01@openssh.com", "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ecdsa-sha2-nistp384-cert-v01@openssh.com" and "ecdsa-sha2-nistp521-cert-v01@openssh.com" OpenSSH introduces new public key algorithms to support certificate authentication for users and host keys. These methods are documented -in the file PROTOCOL.certkeys +in at https://datatracker.ietf.org/doc/draft-miller-ssh-cert/ 1.4. transport: Elliptic Curve cryptography @@ -765,15 +764,15 @@ authorized_keys files, are formatted as a single line of text consisting of the public key algorithm name followed by a base64-encoded key blob. The public key blob (before base64 encoding) is the same format used for the encoding of public keys sent on the wire: as described in RFC4253 -section 6.6 for RSA and DSA keys, RFC5656 section 3.1 for ECDSA keys -and the "New public key formats" section of PROTOCOL.certkeys for the -OpenSSH certificate formats. +section 6.6 for RSA keys, RFC5656 section 3.1 for ECDSA keys and +https://datatracker.ietf.org/doc/draft-miller-ssh-cert/ +for the OpenSSH certificate formats. 5.2 Private key format OpenSSH private keys, as generated by ssh-keygen(1) use the format described in PROTOCOL.key by default. As a legacy option, PEM format -(RFC7468) private keys are also supported for RSA, DSA and ECDSA keys +(RFC7468) private keys are also supported for RSA and ECDSA keys and were the default format before OpenSSH 7.8. 5.3 KRL format @@ -792,4 +791,4 @@ master instance and later clients. OpenSSH extends the usual agent protocol. These changes are documented in the PROTOCOL.agent file. -$OpenBSD: PROTOCOL,v 1.55 2024/01/08 05:05:15 djm Exp $ +$OpenBSD: PROTOCOL,v 1.57 2025/05/06 05:40:56 djm Exp $ diff --git a/PROTOCOL.certkeys b/PROTOCOL.certkeys deleted file mode 100644 index 0a212c635c5d..000000000000 --- a/PROTOCOL.certkeys +++ /dev/null @@ -1,326 +0,0 @@ -This document describes a simple public-key certificate authentication -system for use by SSH. - -Background ----------- - -The SSH protocol currently supports a simple public key authentication -mechanism. Unlike other public key implementations, SSH eschews the use -of X.509 certificates and uses raw keys. This approach has some benefits -relating to simplicity of configuration and minimisation of attack -surface, but it does not support the important use-cases of centrally -managed, passwordless authentication and centrally certified host keys. - -These protocol extensions build on the simple public key authentication -system already in SSH to allow certificate-based authentication. The -certificates used are not traditional X.509 certificates, with numerous -options and complex encoding rules, but something rather more minimal: a -key, some identity information and usage options that have been signed -with some other trusted key. - -A sshd server may be configured to allow authentication via certified -keys, by extending the existing ~/.ssh/authorized_keys mechanism to -allow specification of certification authority keys in addition to -raw user keys. The ssh client will support automatic verification of -acceptance of certified host keys, by adding a similar ability to -specify CA keys in ~/.ssh/known_hosts. - -All certificate types include certification information along with the -public key that is used to sign challenges. In OpenSSH, ssh-keygen -performs the CA signing operation. - -Certified keys are represented using new key types: - - ssh-rsa-cert-v01@openssh.com - ssh-dss-cert-v01@openssh.com - ecdsa-sha2-nistp256-cert-v01@openssh.com - ecdsa-sha2-nistp384-cert-v01@openssh.com - ecdsa-sha2-nistp521-cert-v01@openssh.com - ssh-ed25519-cert-v01@openssh.com - -Two additional types exist for RSA certificates to force use of -SHA-2 signatures (SHA-256 and SHA-512 respectively): - - rsa-sha2-256-cert-v01@openssh.com - rsa-sha2-512-cert-v01@openssh.com - -These RSA/SHA-2 types should not appear in keys at rest or transmitted -on the wire, but do appear in a SSH_MSG_KEXINIT's host-key algorithms -field or in the "public key algorithm name" field of a "publickey" -SSH_USERAUTH_REQUEST to indicate that the signature will use the -specified algorithm. - -Protocol extensions -------------------- - -The SSH wire protocol includes several extensibility mechanisms. -These modifications shall take advantage of namespaced public key -algorithm names to add support for certificate authentication without -breaking the protocol - implementations that do not support the -extensions will simply ignore them. - -Authentication using the new key formats described below proceeds -using the existing SSH "publickey" authentication method described -in RFC4252 section 7. - -New public key formats ----------------------- - -The certificate key types take a similar high-level format (note: data -types and encoding are as per RFC4251 section 5). The serialised wire -encoding of these certificates is also used for storing them on disk. - -#define SSH_CERT_TYPE_USER 1 -#define SSH_CERT_TYPE_HOST 2 - -RSA certificate - - string "ssh-rsa-cert-v01@openssh.com" - string nonce - mpint e - mpint n - uint64 serial - uint32 type - string key id - string valid principals - uint64 valid after - uint64 valid before - string critical options - string extensions - string reserved - string signature key - string signature - -DSA certificate - - string "ssh-dss-cert-v01@openssh.com" - string nonce - mpint p - mpint q - mpint g - mpint y - uint64 serial - uint32 type - string key id - string valid principals - uint64 valid after - uint64 valid before - string critical options - string extensions - string reserved - string signature key - string signature - -ECDSA certificate - - string "ecdsa-sha2-nistp256-cert-v01@openssh.com" | - "ecdsa-sha2-nistp384-cert-v01@openssh.com" | - "ecdsa-sha2-nistp521-cert-v01@openssh.com" - string nonce - string curve - string public_key - uint64 serial - uint32 type - string key id - string valid principals - uint64 valid after - uint64 valid before - string critical options - string extensions - string reserved - string signature key - string signature - -ED25519 certificate - - string "ssh-ed25519-cert-v01@openssh.com" - string nonce - string pk - uint64 serial - uint32 type - string key id - string valid principals - uint64 valid after - uint64 valid before - string critical options - string extensions - string reserved - string signature key - string signature - -The nonce field is a CA-provided random bitstring of arbitrary length -(but typically 16 or 32 bytes) included to make attacks that depend on -inducing collisions in the signature hash infeasible. - -e and n are the RSA exponent and public modulus respectively. - -p, q, g, y are the DSA parameters as described in FIPS-186-2. - -curve and public key are respectively the ECDSA "[identifier]" and "Q" -defined in section 3.1 of RFC5656. - -pk is the encoded Ed25519 public key as defined by RFC8032. - -serial is an optional certificate serial number set by the CA to -provide an abbreviated way to refer to certificates from that CA. -If a CA does not wish to number its certificates, it must set this -field to zero. - -type specifies whether this certificate is for identification of a user -or a host using a SSH_CERT_TYPE_... value. - -key id is a free-form text field that is filled in by the CA at the time -of signing; the intention is that the contents of this field are used to -identify the identity principal in log messages. - -"valid principals" is a string containing zero or more principals as -strings packed inside it. These principals list the names for which this -certificate is valid; hostnames for SSH_CERT_TYPE_HOST certificates and -usernames for SSH_CERT_TYPE_USER certificates. As a special case, a -zero-length "valid principals" field means the certificate is valid for -any principal of the specified type. - -"valid after" and "valid before" specify a validity period for the -certificate. Each represents a time in seconds since 1970-01-01 -00:00:00. A certificate is considered valid if: - - valid after <= current time < valid before - -critical options is a set of zero or more key options encoded as -below. All such options are "critical" in the sense that an implementation -must refuse to authorise a key that has an unrecognised option. - -extensions is a set of zero or more optional extensions. These extensions -are not critical, and an implementation that encounters one that it does -not recognise may safely ignore it. - -Generally, critical options are used to control features that restrict -access where extensions are used to enable features that grant access. -This ensures that certificates containing unknown restrictions do not -inadvertently grant access while allowing new protocol features to be -enabled via extensions without breaking certificates' backwards -compatibility. - -The reserved field is currently unused and is ignored in this version of -the protocol. - -The signature key field contains the CA key used to sign the -certificate. The valid key types for CA keys are ssh-rsa, -ssh-dss, ssh-ed25519 and the ECDSA types ecdsa-sha2-nistp256, -ecdsa-sha2-nistp384, ecdsa-sha2-nistp521. "Chained" certificates, where -the signature key type is a certificate type itself are NOT supported. -Note that it is possible for a RSA certificate key to be signed by a -Ed25519 or ECDSA CA key and vice-versa. - -signature is computed over all preceding fields from the initial string -up to, and including the signature key. Signatures are computed and -encoded according to the rules defined for the CA's public key algorithm -(RFC4253 section 6.6 for ssh-rsa and ssh-dss, RFC5656 for the ECDSA -types, and RFC8032 for Ed25519). - -Critical options ----------------- - -The critical options section of the certificate specifies zero or more -options on the certificate's validity. The format of this field -is a sequence of zero or more tuples: - - string name - string data - -Options must be lexically ordered by "name" if they appear in the -sequence. Each named option may only appear once in a certificate. - -The name field identifies the option. The data field contains -option-specific information encoded as zero or more values inside -the string. I.e. an empty data field would be encoded as a zero- -length string (00 00 00 00), and data field that holds a single -string value "a" would be encoded as (00 00 00 05 00 00 00 01 65). - -All options are "critical"; if an implementation does not recognise -a option, then the validating party should refuse to accept the -certificate. - -Custom options should append the originating author or organisation's -domain name to the option name, e.g. "my-option@example.com". - -No critical options are defined for host certificates at present. The -supported user certificate options and the contents and structure of -their data fields are: - -Name Format Description ------------------------------------------------------------------------------ -force-command string Specifies a command that is executed - (replacing any the user specified on the - ssh command-line) whenever this key is - used for authentication. - -source-address string Comma-separated list of source addresses - from which this certificate is accepted - for authentication. Addresses are - specified in CIDR format (nn.nn.nn.nn/nn - or hhhh::hhhh/nn). - If this option is not present, then - certificates may be presented from any - source address. - -verify-required empty Flag indicating that signatures made - with this certificate must assert FIDO - user verification (e.g. PIN or - biometric). This option only makes sense - for the U2F/FIDO security key types that - support this feature in their signature - formats. - -Extensions ----------- - -The extensions section of the certificate specifies zero or more -non-critical certificate extensions. The encoding and ordering of -extensions in this field is identical to that of the critical options, -as is the requirement that each name appear only once. - -If an implementation does not recognise an extension, then it should -ignore it. - -Custom options should append the originating author or organisation's -domain name to the option name, e.g. "my-option@example.com". - -No extensions are defined for host certificates at present. The -supported user certificate extensions and the contents and structure of -their data fields are: - -Name Format Description ------------------------------------------------------------------------------ -no-touch-required empty Flag indicating that signatures made - with this certificate need not assert - FIDO user presence. This option only - makes sense for the U2F/FIDO security - key types that support this feature in - their signature formats. - -permit-X11-forwarding empty Flag indicating that X11 forwarding - should be permitted. X11 forwarding will - be refused if this option is absent. - -permit-agent-forwarding empty Flag indicating that agent forwarding - should be allowed. Agent forwarding - must not be permitted unless this - option is present. - -permit-port-forwarding empty Flag indicating that port-forwarding - should be allowed. If this option is - not present, then no port forwarding will - be allowed. - -permit-pty empty Flag indicating that PTY allocation - should be permitted. In the absence of - this option PTY allocation will be - disabled. - -permit-user-rc empty Flag indicating that execution of - ~/.ssh/rc should be permitted. Execution - of this script will not be permitted if - this option is not present. - -$OpenBSD: PROTOCOL.certkeys,v 1.20 2024/12/06 16:02:12 djm Exp $ diff --git a/TODO b/TODO index b76529c960a0..e9e2d96e6e1d 100644 --- a/TODO +++ b/TODO @@ -7,7 +7,7 @@ Documentation: - Install FAQ? -- General FAQ on S/Key, TIS, RSA, RSA2, DSA, etc and suggestions on when it +- General FAQ on S/Key, TIS, RSA, RSA2, etc and suggestions on when it would be best to use them. - Create a Documentation/ directory? diff --git a/authfd.c b/authfd.c index e04ad0cf2d02..66797880af84 100644 --- a/authfd.c +++ b/authfd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: authfd.c,v 1.134 2023/12/18 14:46:56 djm Exp $ */ +/* $OpenBSD: authfd.c,v 1.135 2025/05/06 05:40:56 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -601,8 +601,6 @@ ssh_add_identity_constrained(int sock, struct sshkey *key, #ifdef WITH_OPENSSL case KEY_RSA: case KEY_RSA_CERT: - case KEY_DSA: - case KEY_DSA_CERT: case KEY_ECDSA: case KEY_ECDSA_CERT: case KEY_ECDSA_SK: diff --git a/authfile.c b/authfile.c index 151fc21334c8..698f702980a6 100644 --- a/authfile.c +++ b/authfile.c @@ -1,4 +1,4 @@ -/* $OpenBSD: authfile.c,v 1.145 2024/09/22 12:56:21 jsg Exp $ */ +/* $OpenBSD: authfile.c,v 1.146 2025/05/06 05:40:56 djm Exp $ */ /* * Copyright (c) 2000, 2013 Markus Friedl. All rights reserved. * @@ -342,7 +342,6 @@ sshkey_load_private_cert(int type, const char *filename, const char *passphrase, switch (type) { #ifdef WITH_OPENSSL case KEY_RSA: - case KEY_DSA: case KEY_ECDSA: #endif /* WITH_OPENSSL */ case KEY_ED25519: diff --git a/configure.ac b/configure.ac index ee77a0484b19..221d5f5618bf 100644 --- a/configure.ac +++ b/configure.ac @@ -1449,6 +1449,11 @@ AC_CHECK_FUNC([getspnam], , AC_SEARCH_LIBS([basename], [gen], [AC_DEFINE([HAVE_BASENAME], [1], [Define if you have the basename function.])]) +dnl sqrt() only used in unit tests. +AC_CHECK_FUNC([sqrt], , + [AC_CHECK_LIB([m], [sqrt], [TESTLIBS="$TESTLIBS -lm"])]) +AC_SUBST([TESTLIBS]) + dnl zlib defaults to enabled zlib=yes AC_ARG_WITH([zlib], @@ -1999,6 +2004,7 @@ AC_CHECK_FUNCS([ \ fnmatch \ freeaddrinfo \ freezero \ + fstatat \ fstatfs \ fstatvfs \ futimes \ @@ -2094,6 +2100,7 @@ AC_CHECK_FUNCS([ \ timegm \ timingsafe_bcmp \ truncate \ + unlinkat \ unsetenv \ updwtmpx \ utimensat \ @@ -2275,6 +2282,11 @@ AC_CHECK_DECLS([offsetof], , , [ #include ]) +AC_CHECK_DECLS([INFINITY], , + AC_CHECK_DECLS(__builtin_inff), + [#include ] +) + # extra bits for select(2) AC_CHECK_DECLS([howmany, NFDBITS], [], [], [[ #include @@ -3066,7 +3078,6 @@ if test "x$openssl" = "xyes" ; then AC_CHECK_FUNCS([ \ BN_is_prime_ex \ DES_crypt \ - DSA_generate_parameters_ex \ EVP_DigestSign \ EVP_DigestVerify \ EVP_DigestFinal_ex \ diff --git a/contrib/cygwin/ssh-user-config b/contrib/cygwin/ssh-user-config index 3858722f646d..35802d06ecba 100644 --- a/contrib/cygwin/ssh-user-config +++ b/contrib/cygwin/ssh-user-config @@ -246,9 +246,8 @@ done check_user_homedir check_user_dot_ssh_dir create_identity id_rsa rsa "SSH2 RSA" -create_identity id_dsa dsa "SSH2 DSA" +create_identity id_ed25519 ed25519 "SSH2 Ed25519" create_identity id_ecdsa ecdsa "SSH2 ECDSA" -create_identity identity rsa1 "(deprecated) SSH1 RSA" fix_authorized_keys_perms echo diff --git a/contrib/redhat/openssh.spec b/contrib/redhat/openssh.spec index 74116b485135..b60695f09f95 100644 --- a/contrib/redhat/openssh.spec +++ b/contrib/redhat/openssh.spec @@ -281,20 +281,6 @@ if [ "$1" != 0 -a -r /var/run/sshd.pid ] ; then touch /var/run/sshd.restart fi -%triggerun server -- openssh-server < 2.5.0p1 -# Count the number of HostKey and HostDsaKey statements we have. -gawk 'BEGIN {IGNORECASE=1} - /^hostkey/ || /^hostdsakey/ {sawhostkey = sawhostkey + 1} - END {exit sawhostkey}' /etc/ssh/sshd_config -# And if we only found one, we know the client was relying on the old default -# behavior, which loaded the the SSH2 DSA host key when HostDsaKey wasn't -# specified. Now that HostKey is used for both SSH1 and SSH2 keys, specifying -# one nullifies the default, which would have loaded both. -if [ $? -eq 1 ] ; then - echo HostKey /etc/ssh/ssh_host_rsa_key >> /etc/ssh/sshd_config - echo HostKey /etc/ssh/ssh_host_dsa_key >> /etc/ssh/sshd_config -fi - %triggerpostun server -- ssh-server if [ "$1" != 0 ] ; then /sbin/chkconfig --add sshd diff --git a/contrib/redhat/sshd.init b/contrib/redhat/sshd.init index 8ee5fcd3bb4f..b82545956ac8 100755 --- a/contrib/redhat/sshd.init +++ b/contrib/redhat/sshd.init @@ -41,7 +41,7 @@ start() /usr/bin/ssh-keygen -A if [ -x /sbin/restorecon ]; then /sbin/restorecon /etc/ssh/ssh_host_rsa_key.pub - /sbin/restorecon /etc/ssh/ssh_host_dsa_key.pub + /sbin/restorecon /etc/ssh/ssh_host_ed25519_key.pub /sbin/restorecon /etc/ssh/ssh_host_ecdsa_key.pub fi diff --git a/contrib/win32/openssh/libssh.vcxproj b/contrib/win32/openssh/libssh.vcxproj index c6cfe93058f3..dacb2ad311d7 100644 --- a/contrib/win32/openssh/libssh.vcxproj +++ b/contrib/win32/openssh/libssh.vcxproj @@ -422,9 +422,6 @@ - - true - true diff --git a/contrib/win32/openssh/sshd-auth.vcxproj b/contrib/win32/openssh/sshd-auth.vcxproj index fd3a28e06214..24d5426e513d 100644 --- a/contrib/win32/openssh/sshd-auth.vcxproj +++ b/contrib/win32/openssh/sshd-auth.vcxproj @@ -461,6 +461,7 @@ + diff --git a/contrib/win32/openssh/sshd-session.vcxproj b/contrib/win32/openssh/sshd-session.vcxproj index 45895f0e1bf2..48cd1f6eab02 100644 --- a/contrib/win32/openssh/sshd-session.vcxproj +++ b/contrib/win32/openssh/sshd-session.vcxproj @@ -462,6 +462,7 @@ + diff --git a/defines.h b/defines.h index d2baeb9407bd..a1bd6fad345e 100644 --- a/defines.h +++ b/defines.h @@ -515,6 +515,13 @@ struct winsize { } while (0) #endif +#ifndef timespeccmp +#define timespeccmp(tsp, usp, cmp) \ + (((tsp)->tv_sec == (usp)->tv_sec) ? \ + ((tsp)->tv_nsec cmp (usp)->tv_nsec) : \ + ((tsp)->tv_sec cmp (usp)->tv_sec)) +#endif + #ifndef TIMEVAL_TO_TIMESPEC #define TIMEVAL_TO_TIMESPEC(tv, ts) { \ (ts)->tv_sec = (tv)->tv_sec; \ @@ -986,4 +993,11 @@ struct winsize { /* The ML-KEM768 implementation also uses C89 features */ # define USE_MLKEM768X25519 1 #endif + +#if defined(HAVE_DECL_INFINITY) && HAVE_DECL_INFINITY == 0 +# if defined(HAVE_DECL___BUILTIN_INFF) && HAVE_DECL___BUILTIN_INFF == 1 +# define INFINITY __builtin_inff() +# endif +#endif + #endif /* _DEFINES_H */ diff --git a/dns.c b/dns.c index 939241440777..c01c7bebee18 100644 --- a/dns.c +++ b/dns.c @@ -1,4 +1,4 @@ -/* $OpenBSD: dns.c,v 1.44 2023/03/10 04:06:21 dtucker Exp $ */ +/* $OpenBSD: dns.c,v 1.45 2025/05/06 05:40:56 djm Exp $ */ /* * Copyright (c) 2003 Wesley Griffin. All rights reserved. @@ -88,9 +88,6 @@ dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type, case KEY_RSA: *algorithm = SSHFP_KEY_RSA; break; - case KEY_DSA: - *algorithm = SSHFP_KEY_DSA; - break; case KEY_ECDSA: *algorithm = SSHFP_KEY_ECDSA; break; diff --git a/hostfile.c b/hostfile.c index c5669c703735..4cec57da50c6 100644 --- a/hostfile.c +++ b/hostfile.c @@ -1,4 +1,4 @@ -/* $OpenBSD: hostfile.c,v 1.95 2023/02/21 06:48:18 dtucker Exp $ */ +/* $OpenBSD: hostfile.c,v 1.99 2025/05/06 05:40:56 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -150,8 +150,8 @@ host_hash(const char *host, const char *name_from_hostfile, u_int src_len) } /* - * Parses an RSA (number of bits, e, n) or DSA key from a string. Moves the - * pointer over the key. Skips any whitespace at the beginning and at end. + * Parses an RSA key from a string. Moves the pointer over the key. + * Skips any whitespace at the beginning and at end. */ int @@ -434,7 +434,7 @@ lookup_marker_in_hostkeys(struct hostkeys *hostkeys, int want_marker) } static int -write_host_entry(FILE *f, const char *host, const char *ip, +format_host_entry(struct sshbuf *entry, const char *host, const char *ip, const struct sshkey *key, int store_hash) { int r, success = 0; @@ -449,22 +449,50 @@ write_host_entry(FILE *f, const char *host, const char *ip, free(lhost); return 0; } - fprintf(f, "%s ", hashed_host); - } else if (ip != NULL) - fprintf(f, "%s,%s ", lhost, ip); - else { - fprintf(f, "%s ", lhost); + if ((r = sshbuf_putf(entry, "%s ", hashed_host)) != 0) + fatal_fr(r, "sshbuf_putf"); + } else if (ip != NULL) { + if ((r = sshbuf_putf(entry, "%s,%s ", lhost, ip)) != 0) + fatal_fr(r, "sshbuf_putf"); + } else { + if ((r = sshbuf_putf(entry, "%s ", lhost)) != 0) + fatal_fr(r, "sshbuf_putf"); } free(hashed_host); free(lhost); - if ((r = sshkey_write(key, f)) == 0) + if ((r = sshkey_format_text(key, entry)) == 0) success = 1; else error_fr(r, "sshkey_write"); - fputc('\n', f); + if ((r = sshbuf_putf(entry, "\n")) != 0) + fatal_fr(r, "sshbuf_putf"); + /* If hashing is enabled, the IP address needs to go on its own line */ if (success && store_hash && ip != NULL) - success = write_host_entry(f, ip, NULL, key, 1); + success = format_host_entry(entry, ip, NULL, key, 1); + return success; +} + +static int +write_host_entry(FILE *f, const char *host, const char *ip, + const struct sshkey *key, int store_hash) +{ + int r, success = 0; + struct sshbuf *entry = NULL; + + if ((entry = sshbuf_new()) == NULL) + fatal_f("allocation failed"); + if ((r = format_host_entry(entry, host, ip, key, store_hash)) != 1) { + debug_f("failed to format host entry"); + goto out; + } + if ((r = fwrite(sshbuf_ptr(entry), sshbuf_len(entry), 1, f)) != 1) { + error_f("fwrite: %s", strerror(errno)); + goto out; + } + success = 1; + out: + sshbuf_free(entry); return success; } @@ -520,9 +548,9 @@ add_host_to_hostfile(const char *filename, const char *host, if (key == NULL) return 1; /* XXX ? */ hostfile_create_user_ssh_dir(filename, 0); - f = fopen(filename, "a+"); - if (!f) + if ((f = fopen(filename, "a+")) == NULL) return 0; + setvbuf(f, NULL, _IONBF, 0); /* Make sure we have a terminating newline. */ if (fseek(f, -1L, SEEK_END) == 0 && fgetc(f) != '\n') addnl = 1; @@ -810,6 +838,12 @@ hostkeys_foreach_file(const char *path, FILE *f, hostkeys_foreach_fn *callback, /* Find the end of the host name portion. */ for (cp2 = cp; *cp2 && *cp2 != ' ' && *cp2 != '\t'; cp2++) ; + if (*cp2 == '\0') { + verbose_f("truncated line at %s:%lu", path, linenum); + if ((options & HKF_WANT_MATCH) == 0) + goto bad; + continue; + } lineinfo.hosts = cp; *cp2++ = '\0'; diff --git a/misc-agent.c b/misc-agent.c new file mode 100644 index 000000000000..1280d27fe8e8 --- /dev/null +++ b/misc-agent.c @@ -0,0 +1,344 @@ +/* + * Copyright (c) 2025 Damien Miller + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include "includes.h" + + +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#ifdef HAVE_TIME_H +# include +#endif +#include + +#include "digest.h" +#include "log.h" +#include "misc.h" +#include "pathnames.h" +#include "ssh.h" +#include "xmalloc.h" + +/* stuff shared by agent listeners (ssh-agent and sshd agent forwarding) */ + +#define SOCKET_HOSTNAME_HASHLEN 10 /* length of hostname hash in socket path */ + +/* used for presenting random strings in unix_listener_tmp and hostname_hash */ +static const char presentation_chars[] = + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; + +/* returns a text-encoded hash of the hostname of specified length (max 64) */ +static char * +hostname_hash(size_t len) +{ + char hostname[NI_MAXHOST], p[65]; + u_char hash[64]; + int r; + size_t l, i; + + l = ssh_digest_bytes(SSH_DIGEST_SHA512); + if (len > 64) { + error_f("bad length %zu > max %zd", len, l - 1); + return NULL; + } + if (gethostname(hostname, sizeof(hostname)) == -1) { + error_f("gethostname: %s", strerror(errno)); + return NULL; + } + if ((r = ssh_digest_memory(SSH_DIGEST_SHA512, + hostname, strlen(hostname), hash, sizeof(hash))) != 0) { + error_fr(r, "ssh_digest_memory"); + return NULL; + } + memset(p, '\0', sizeof(p)); + for (i = 0; i < l; i++) + p[i] = presentation_chars[ + hash[i] % (sizeof(presentation_chars) - 1)]; + /* debug3_f("hostname \"%s\" => hash \"%s\"", hostname, p); */ + p[len] = '\0'; + return xstrdup(p); +} + +char * +agent_hostname_hash(void) +{ + return hostname_hash(SOCKET_HOSTNAME_HASHLEN); +} + +/* + * Creates a unix listener at a mkstemp(3)-style path, e.g. "/dir/sock.XXXXXX" + * Supplied path is modified to the actual one used. + */ +static int +unix_listener_tmp(char *path, int backlog) +{ + struct sockaddr_un sunaddr; + int good, sock = -1; + size_t i, xstart; + mode_t prev_mask; + + /* Find first 'X' template character back from end of string */ + xstart = strlen(path); + while (xstart > 0 && path[xstart - 1] == 'X') + xstart--; + + memset(&sunaddr, 0, sizeof(sunaddr)); + sunaddr.sun_family = AF_UNIX; + prev_mask = umask(0177); + for (good = 0; !good;) { + sock = -1; + /* Randomise path suffix */ + for (i = xstart; path[i] != '\0'; i++) { + path[i] = presentation_chars[ + arc4random_uniform(sizeof(presentation_chars)-1)]; + } + debug_f("trying path \"%s\"", path); + + if (strlcpy(sunaddr.sun_path, path, + sizeof(sunaddr.sun_path)) >= sizeof(sunaddr.sun_path)) { + error_f("path \"%s\" too long for Unix domain socket", + path); + break; + } + + if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1) { + error_f("socket: %.100s", strerror(errno)); + break; + } + if (bind(sock, (struct sockaddr *)&sunaddr, + sizeof(sunaddr)) == -1) { + if (errno == EADDRINUSE) { + error_f("bind \"%s\": %.100s", + path, strerror(errno)); + close(sock); + sock = -1; + continue; + } + error_f("bind \"%s\": %.100s", path, strerror(errno)); + break; + } + if (listen(sock, backlog) == -1) { + error_f("listen \"%s\": %s", path, strerror(errno)); + break; + } + good = 1; + } + umask(prev_mask); + if (good) { + debug3_f("listening on unix socket \"%s\" as fd=%d", + path, sock); + } else if (sock != -1) { + close(sock); + sock = -1; + } + return sock; +} + +/* + * Create a subdirectory under the supplied home directory if it + * doesn't already exist + */ +static int +ensure_mkdir(const char *homedir, const char *subdir) +{ + char *path; + + xasprintf(&path, "%s/%s", homedir, subdir); + if (mkdir(path, 0700) == 0) + debug("created directory %s", path); + else if (errno != EEXIST) { + error_f("mkdir %s: %s", path, strerror(errno)); + return -1; + } + free(path); + return 0; +} + +static int +agent_prepare_sockdir(const char *homedir) +{ + if (homedir == NULL || *homedir == '\0' || + ensure_mkdir(homedir, _PATH_SSH_USER_DIR) != 0 || + ensure_mkdir(homedir, _PATH_SSH_AGENT_SOCKET_DIR) != 0) + return -1; + return 0; +} + + +/* Get a path template for an agent socket in the user's homedir */ +static char * +agent_socket_template(const char *homedir, const char *tag) +{ + char *hostnamehash, *ret; + + if ((hostnamehash = hostname_hash(SOCKET_HOSTNAME_HASHLEN)) == NULL) + return NULL; + xasprintf(&ret, "%s/%s/s.%s.%s.XXXXXXXXXX", + homedir, _PATH_SSH_AGENT_SOCKET_DIR, hostnamehash, tag); + free(hostnamehash); + return ret; +} + +int +agent_listener(const char *homedir, const char *tag, int *sockp, char **pathp) +{ + int sock; + char *path; + + *sockp = -1; + *pathp = NULL; + + if (agent_prepare_sockdir(homedir) != 0) + return -1; /* error already logged */ + if ((path = agent_socket_template(homedir, tag)) == NULL) + return -1; /* error already logged */ + if ((sock = unix_listener_tmp(path, SSH_LISTEN_BACKLOG)) == -1) { + free(path); + return -1; /* error already logged */ + } + /* success */ + *sockp = sock; + *pathp = path; + return 0; +} + +#ifndef WINDOWS +static int +socket_is_stale(const char *path) +{ + int fd, r; + struct sockaddr_un sun; + socklen_t l = sizeof(r); + + /* attempt non-blocking connect on socket */ + memset(&sun, '\0', sizeof(sun)); + sun.sun_family = AF_UNIX; + if (strlcpy(sun.sun_path, path, + sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) { + debug_f("path for \"%s\" too long for sockaddr_un", path); + return 0; + } + if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) == -1) { + error_f("socket: %s", strerror(errno)); + return 0; + } + set_nonblock(fd); + /* a socket without a listener should yield an error immediately */ + if (connect(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) { + debug_f("connect \"%s\": %s", path, strerror(errno)); + close(fd); + return 1; + } + if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &r, &l) == -1) { + debug_f("getsockopt: %s", strerror(errno)); + close(fd); + return 0; + } + if (r != 0) { + debug_f("socket error on %s: %s", path, strerror(errno)); + close(fd); + return 1; + } + close(fd); + debug_f("socket %s seems still active", path); + return 0; +} + +void +agent_cleanup_stale(const char *homedir, int ignore_hosthash) +{ + DIR *d = NULL; + struct dirent *dp; + struct stat sb; + char *prefix = NULL, *dirpath = NULL, *path; + struct timespec now, sub, *mtimp = NULL; + + /* Only consider sockets last modified > 1 hour ago */ + if (clock_gettime(CLOCK_REALTIME, &now) != 0) { + error_f("clock_gettime: %s", strerror(errno)); + return; + } + sub.tv_sec = 60 * 60; + sub.tv_nsec = 0; + timespecsub(&now, &sub, &now); + + /* Only consider sockets from the same hostname */ + if (!ignore_hosthash) { + if ((path = agent_hostname_hash()) == NULL) { + error_f("couldn't get hostname hash"); + return; + } + xasprintf(&prefix, "s.%s.", path); + free(path); + } + + xasprintf(&dirpath, "%s/%s", homedir, _PATH_SSH_AGENT_SOCKET_DIR); + if ((d = opendir(dirpath)) == NULL) { + if (errno != ENOENT) + error_f("opendir \"%s\": %s", dirpath, strerror(errno)); + goto out; + } + while ((dp = readdir(d)) != NULL) { + if (dp->d_type != DT_SOCK && dp->d_type != DT_UNKNOWN) + continue; + if (fstatat(dirfd(d), dp->d_name, + &sb, AT_SYMLINK_NOFOLLOW) != 0 && errno != ENOENT) { + error_f("stat \"%s/%s\": %s", + dirpath, dp->d_name, strerror(errno)); + continue; + } + if (!S_ISSOCK(sb.st_mode)) + continue; +#ifdef HAVE_STRUCT_STAT_ST_MTIM + mtimp = &sb.st_mtim; +#else + sub.tv_sec = sb.st_mtime; + sub.tv_nsec = 0; + mtimp = ⊂ +#endif + if (timespeccmp(mtimp, &now, >)) { + debug3_f("Ignoring recent socket \"%s/%s\"", + dirpath, dp->d_name); + continue; + } + if (!ignore_hosthash && + strncmp(dp->d_name, prefix, strlen(prefix)) != 0) { + debug3_f("Ignoring socket \"%s/%s\" " + "from different host", dirpath, dp->d_name); + continue; + } + xasprintf(&path, "%s/%s", dirpath, dp->d_name); + if (socket_is_stale(path)) { + debug_f("cleanup stale socket %s", path); + unlinkat(dirfd(d), dp->d_name, 0); + } + free(path); + } + out: + if (d != NULL) + closedir(d); + free(dirpath); + free(prefix); +} +#endif /* !WINDOWS */ diff --git a/misc.c b/misc.c index f8c8a7beac29..0e18c4763265 100644 --- a/misc.c +++ b/misc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: misc.c,v 1.198 2024/10/24 03:14:37 djm Exp $ */ +/* $OpenBSD: misc.c,v 1.199 2025/05/05 02:48:06 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2005-2020 Damien Miller. All rights reserved. @@ -3277,3 +3277,18 @@ signal_is_crash(int sig) } return 0; } + +char * +get_homedir(void) +{ + char *cp; + struct passwd *pw; + + if ((cp = getenv("HOME")) != NULL && *cp != '\0') + return xstrdup(cp); + + if ((pw = getpwuid(getuid())) != NULL && *pw->pw_dir != '\0') + return xstrdup(pw->pw_dir); + + return NULL; +} diff --git a/misc.h b/misc.h index ace2a2ffb72a..9138e650f55b 100644 --- a/misc.h +++ b/misc.h @@ -1,4 +1,4 @@ -/* $OpenBSD: misc.h,v 1.110 2024/09/25 01:24:04 djm Exp $ */ +/* $OpenBSD: misc.h,v 1.111 2025/05/05 02:48:06 djm Exp $ */ /* * Author: Tatu Ylonen @@ -108,6 +108,7 @@ int parse_pattern_interval(const char *, char **, int *); int path_absolute(const char *); int stdfd_devnull(int, int, int); int lib_contains_symbol(const char *, const char *); +char *get_homedir(void); void sock_set_v6only(int); @@ -234,6 +235,11 @@ int ptimeout_get_ms(struct timespec *pt); struct timespec *ptimeout_get_tsp(struct timespec *pt); int ptimeout_isset(struct timespec *pt); +/* misc-agent.c */ +char *agent_hostname_hash(void); +int agent_listener(const char *, const char *, int *, char **); +void agent_cleanup_stale(const char *, int); + /* readpass.c */ #define RP_ECHO 0x0001 diff --git a/monitor_wrap.c b/monitor_wrap.c index c237f0c4016e..91ab3046a870 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor_wrap.c,v 1.138 2024/10/22 06:13:00 dtucker Exp $ */ +/* $OpenBSD: monitor_wrap.c,v 1.139 2025/05/05 02:40:30 djm Exp $ */ /* * Copyright 2002 Niels Provos * Copyright 2002 Markus Friedl @@ -139,17 +139,17 @@ mm_reap(void) } if (WIFEXITED(status)) { if (WEXITSTATUS(status) != 0) { - debug_f("preauth child exited with status %d", + debug_f("child exited with status %d", WEXITSTATUS(status)); cleanup_exit(255); } } else if (WIFSIGNALED(status)) { - error_f("preauth child terminated by signal %d", + error_f("child terminated by signal %d", WTERMSIG(status)); cleanup_exit(signal_is_crash(WTERMSIG(status)) ? EXIT_CHILD_CRASH : 255); } else { - error_f("preauth child terminated abnormally (status=0x%x)", + error_f("child terminated abnormally (status=0x%x)", status); cleanup_exit(EXIT_CHILD_CRASH); } diff --git a/openbsd-compat/bsd-misc.c b/openbsd-compat/bsd-misc.c index 226a5915bd1d..b26b4ba4670e 100644 --- a/openbsd-compat/bsd-misc.c +++ b/openbsd-compat/bsd-misc.c @@ -220,6 +220,46 @@ fchmodat(int fd, const char *path, mode_t mode, int flag) } #endif +#ifndef HAVE_FSTATAT +/* + * A limited implementation of fstatat that just has what OpenSSH uses: + * cwd-relative and absolute paths, with or without following symlinks. + */ +int +fstatat(int dirfd, const char *path, struct stat *sb, int flag) +{ + if (dirfd != AT_FDCWD && path && path[0] != '/') { + errno = ENOSYS; + return -1; + } + if (flag == 0) + return stat(path, sb); + else if (flag == AT_SYMLINK_NOFOLLOW) + return lstat(path, sb); + errno = ENOSYS; + return -1; +} +#endif + +#ifndef HAVE_UNLINKAT +/* + * A limited implementation of unlinkat that just has what OpenSSH uses: + * cwd-relative and absolute paths. + */ +int +unlinkat(int dirfd, const char *path, int flag) +{ + if (dirfd != AT_FDCWD && path && path[0] != '/') { + errno = ENOSYS; + return -1; + } + if (flag == 0) + return unlink(path); + errno = ENOSYS; + return -1; +} +#endif + #ifndef HAVE_TRUNCATE int truncate(const char *path, off_t length) { diff --git a/openbsd-compat/bsd-misc.h b/openbsd-compat/bsd-misc.h index 61ead1b7fad0..edb0fcc8ca2b 100644 --- a/openbsd-compat/bsd-misc.h +++ b/openbsd-compat/bsd-misc.h @@ -77,6 +77,14 @@ int fchmodat(int, const char *, mode_t, int); int fchownat(int, const char *, uid_t, gid_t, int); #endif +#ifdef HAVE_FSTATAT +int fstatat(int, const char *, struct stat *, int); +#endif + +#ifdef HAVE_UNLINKAT +int unlinkat(int, const char *, int); +#endif + #ifndef HAVE_TRUNCATE int truncate (const char *, off_t); #endif /* HAVE_TRUNCATE */ diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h index 6b8fff412951..936f4068d843 100644 --- a/openbsd-compat/openssl-compat.h +++ b/openbsd-compat/openssl-compat.h @@ -24,7 +24,6 @@ #include #include #include -#include #ifdef OPENSSL_HAS_ECC #include #endif @@ -45,9 +44,6 @@ void ssh_libcrypto_init(void); #ifndef OPENSSL_RSA_MAX_MODULUS_BITS # define OPENSSL_RSA_MAX_MODULUS_BITS 16384 #endif -#ifndef OPENSSL_DSA_MAX_MODULUS_BITS -# define OPENSSL_DSA_MAX_MODULUS_BITS 10000 -#endif #ifdef LIBRESSL_VERSION_NUMBER # if LIBRESSL_VERSION_NUMBER < 0x3010000fL diff --git a/pathnames.h b/pathnames.h index 3b5b5aa9befb..c578f64c3501 100644 --- a/pathnames.h +++ b/pathnames.h @@ -1,4 +1,4 @@ -/* $OpenBSD: pathnames.h,v 1.32 2024/05/17 00:30:24 djm Exp $ */ +/* $OpenBSD: pathnames.h,v 1.35 2025/05/06 05:40:56 djm Exp $ */ /* * Author: Tatu Ylonen @@ -36,7 +36,6 @@ */ #define _PATH_SERVER_CONFIG_FILE SSHDIR "/sshd_config" #define _PATH_HOST_CONFIG_FILE SSHDIR "/ssh_config" -#define _PATH_HOST_DSA_KEY_FILE SSHDIR "/ssh_host_dsa_key" #define _PATH_HOST_ECDSA_KEY_FILE SSHDIR "/ssh_host_ecdsa_key" #define _PATH_HOST_ED25519_KEY_FILE SSHDIR "/ssh_host_ed25519_key" #define _PATH_HOST_XMSS_KEY_FILE SSHDIR "/ssh_host_xmss_key" @@ -75,6 +74,13 @@ */ #define _PATH_SSH_USER_DIR ".ssh" + +/* + * The directory in which ssh-agent sockets and agent sockets forwarded by + * sshd reside. This directory should not be world-readable. + */ +#define _PATH_SSH_AGENT_SOCKET_DIR _PATH_SSH_USER_DIR "/agent" + /* * Per-user file containing host keys of known hosts. This file need not be * readable by anyone except the user him/herself, though this does not @@ -88,7 +94,6 @@ * Name of the default file containing client-side authentication key. This * file should only be readable by the user him/herself. */ -#define _PATH_SSH_CLIENT_ID_DSA _PATH_SSH_USER_DIR "/id_dsa" #define _PATH_SSH_CLIENT_ID_ECDSA _PATH_SSH_USER_DIR "/id_ecdsa" #define _PATH_SSH_CLIENT_ID_RSA _PATH_SSH_USER_DIR "/id_rsa" #define _PATH_SSH_CLIENT_ID_ED25519 _PATH_SSH_USER_DIR "/id_ed25519" diff --git a/readconf.c b/readconf.c index 3605a50e4e5b..42c9a25b4ae8 100644 --- a/readconf.c +++ b/readconf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: readconf.c,v 1.398 2025/03/18 04:53:14 djm Exp $ */ +/* $OpenBSD: readconf.c,v 1.399 2025/05/06 05:40:56 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -2891,9 +2891,6 @@ fill_default_options(Options * options) add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_ED25519_SK, 0); add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_XMSS, 0); -#ifdef WITH_DSA - add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_DSA, 0); -#endif } if (options->escape_char == -1) options->escape_char = '~'; diff --git a/regress/Makefile b/regress/Makefile index 7e7f95b58a2c..d97ea34a2050 100644 --- a/regress/Makefile +++ b/regress/Makefile @@ -2,7 +2,7 @@ tests: prep file-tests t-exec unit -REGRESS_TARGETS= t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 +REGRESS_TARGETS= t1 t2 t3 t4 t5 t7 t9 t10 t11 t12 # File based tests file-tests: $(REGRESS_TARGETS) @@ -130,9 +130,9 @@ CLEANFILES= *.core actual agent-key.* authorized_keys_${USERNAME} \ ed25519-agent.pub ed25519 ed25519.pub empty.in \ expect failed-regress.log failed-ssh.log failed-sshd.log \ hkr.* host.ecdsa-sha2-nistp256 host.ecdsa-sha2-nistp384 \ - host.ecdsa-sha2-nistp521 host.ssh-dss host.ssh-ed25519 \ + host.ecdsa-sha2-nistp521 host.ssh-ed25519 \ host.ssh-rsa host_ca_key* host_krl_* host_revoked_* key.* \ - key.dsa-* key.ecdsa-* key.ed25519-512 \ + key.ecdsa-* key.ed25519-512 \ key.ed25519-512.pub key.rsa-* keys-command-args kh.* askpass \ known_hosts known_hosts-cert known_hosts.* krl-* ls.copy \ modpipe netcat no_identity_config \ @@ -191,36 +191,18 @@ t5: ${TEST_SSH_SSHKEYGEN} -Bf ${.CURDIR}/rsa_openssh.pub |\ awk '{print $$2}' | diff - ${.CURDIR}/t5.ok ; \ fi -t6: - set -xe ; if ${TEST_SSH_SSH} -Q key | grep -q "^ssh-dss" ; then \ - ${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/dsa_ssh2.prv > $(OBJ)/t6.out1 ; \ - ${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/dsa_ssh2.pub > $(OBJ)/t6.out2 ; \ - chmod 600 $(OBJ)/t6.out1 ; \ - ${TEST_SSH_SSHKEYGEN} -yf $(OBJ)/t6.out1 | diff - $(OBJ)/t6.out2 ; \ - fi $(OBJ)/t7.out: - set -xe ; if ${TEST_SSH_SSH} -Q key | grep -q "^ssh-dss" ; then \ + set -xe ; if ${TEST_SSH_SSH} -Q key | grep -q "^ssh-rsa" ; then \ ${TEST_SSH_SSHKEYGEN} -q -t rsa -N '' -f $@ ; \ fi t7: $(OBJ)/t7.out - set -xe ; if ${TEST_SSH_SSH} -Q key | grep -q "^ssh-dss" ; then \ + set -xe ; if ${TEST_SSH_SSH} -Q key | grep -q "^ssh-rsa" ; then \ ${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t7.out > /dev/null ; \ ${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t7.out > /dev/null ; \ fi -$(OBJ)/t8.out: - set -xe ; if ssh -Q key | grep -q "^ssh-dss" ; then \ - ${TEST_SSH_SSHKEYGEN} -q -t dsa -N '' -f $@ ; \ - fi - -t8: $(OBJ)/t8.out - set -xe ; if ssh -Q key | grep -q "^ssh-dss" ; then \ - ${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t8.out > /dev/null ; \ - ${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t8.out > /dev/null ; \ - fi - $(OBJ)/t9.out: ! ${TEST_SSH_SSH} -Q key-plain | grep ecdsa >/dev/null || \ ${TEST_SSH_SSHKEYGEN} -q -t ecdsa -N '' -f $@ @@ -240,7 +222,7 @@ t10: $(OBJ)/t10.out ${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t10.out > /dev/null t11: - set -xe ; if ${TEST_SSH_SSH} -Q key | grep -q "^ssh-dss" ; then \ + set -xe ; if ${TEST_SSH_SSH} -Q key | grep -q "^ssh-rsa" ; then \ ${TEST_SSH_SSHKEYGEN} -E sha256 -lf ${.CURDIR}/rsa_openssh.pub |\ awk '{print $$2}' | diff - ${.CURDIR}/t11.ok ; \ fi @@ -292,26 +274,33 @@ t-extra: ${EXTRA_TESTS:=.sh} interop: ${INTEROP_TARGETS} # Unit tests, built by top-level Makefile -unit: +unit unit-bench: set -e ; if test -z "${SKIP_UNIT}" ; then \ V="" ; \ test "x${USE_VALGRIND}" = "x" || \ V=${.CURDIR}/valgrind-unit.sh ; \ - $$V ${.OBJDIR}/unittests/sshbuf/test_sshbuf ; \ + ARGS=""; \ + test "x$@" = "xunit-bench" && ARGS="-b"; \ + test "x${UNITTEST_FAST}" = "x" || ARGS="$$ARGS -f"; \ + test "x${UNITTEST_SLOW}" = "x" || ARGS="$$ARGS -F"; \ + test "x${UNITTEST_VERBOSE}" = "x" || ARGS="$$ARGS -v"; \ + test "x${UNITTEST_BENCH_DETAIL}" = "x" || ARGS="$$ARGS -B"; \ + test "x${UNITTEST_BENCH_ONLY}" = "x" || ARGS="$$ARGS -O ${UNITTEST_BENCH_ONLY}"; \ + $$V ${.OBJDIR}/unittests/sshbuf/test_sshbuf $${ARGS}; \ $$V ${.OBJDIR}/unittests/sshkey/test_sshkey \ - -d ${.CURDIR}/unittests/sshkey/testdata ; \ + -d ${.CURDIR}/unittests/sshkey/testdata $${ARGS}; \ $$V ${.OBJDIR}/unittests/sshsig/test_sshsig \ - -d ${.CURDIR}/unittests/sshsig/testdata ; \ + -d ${.CURDIR}/unittests/sshsig/testdata $${ARGS}; \ $$V ${.OBJDIR}/unittests/authopt/test_authopt \ - -d ${.CURDIR}/unittests/authopt/testdata ; \ - $$V ${.OBJDIR}/unittests/bitmap/test_bitmap ; \ - $$V ${.OBJDIR}/unittests/conversion/test_conversion ; \ - $$V ${.OBJDIR}/unittests/kex/test_kex ; \ + -d ${.CURDIR}/unittests/authopt/testdata $${ARGS}; \ + $$V ${.OBJDIR}/unittests/bitmap/test_bitmap $${ARGS}; \ + $$V ${.OBJDIR}/unittests/conversion/test_conversion $${ARGS}; \ + $$V ${.OBJDIR}/unittests/kex/test_kex $${ARGS}; \ $$V ${.OBJDIR}/unittests/hostkeys/test_hostkeys \ - -d ${.CURDIR}/unittests/hostkeys/testdata ; \ - $$V ${.OBJDIR}/unittests/match/test_match ; \ - $$V ${.OBJDIR}/unittests/misc/test_misc ; \ + -d ${.CURDIR}/unittests/hostkeys/testdata $${ARGS}; \ + $$V ${.OBJDIR}/unittests/match/test_match $${ARGS}; \ + $$V ${.OBJDIR}/unittests/misc/test_misc $${ARGS}; \ if test "x${TEST_SSH_UTF8}" = "xyes" ; then \ - $$V ${.OBJDIR}/unittests/utf8/test_utf8 ; \ + $$V ${.OBJDIR}/unittests/utf8/test_utf8 $${ARGS}; \ fi \ fi diff --git a/regress/agent.sh b/regress/agent.sh index 2c98b700d77a..31676e75b062 100644 --- a/regress/agent.sh +++ b/regress/agent.sh @@ -1,4 +1,4 @@ -# $OpenBSD: agent.sh,v 1.22 2024/10/24 03:28:34 djm Exp $ +# $OpenBSD: agent.sh,v 1.23 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. tid="simple agent test" @@ -92,10 +92,6 @@ fi for t in ${SSH_KEYTYPES}; do trace "connect via agent using $t key" - if [ "$t" = "ssh-dss" ]; then - echo "PubkeyAcceptedAlgorithms +ssh-dss" >> $OBJ/ssh_proxy - echo "PubkeyAcceptedAlgorithms +ssh-dss" >> $OBJ/sshd_proxy - fi ${SSH} -F $OBJ/ssh_proxy -i $OBJ/$t-agent.pub -oIdentitiesOnly=yes \ somehost exit 52 r=$? @@ -149,7 +145,6 @@ fi (printf 'cert-authority,principals="estragon" '; cat $OBJ/user_ca_key.pub) \ > $OBJ/authorized_keys_$USER for t in ${SSH_KEYTYPES}; do - if [ "$t" != "ssh-dss" ]; then trace "connect via agent using $t key" ${SSH} -F $OBJ/ssh_proxy -i $OBJ/$t-agent.pub \ -oCertificateFile=$OBJ/$t-agent-cert.pub \ @@ -158,7 +153,6 @@ for t in ${SSH_KEYTYPES}; do if [ $r -ne 52 ]; then fail "ssh connect with failed (exit code $r)" fi - fi done ## Deletion tests. diff --git a/regress/cert-hostkey.sh b/regress/cert-hostkey.sh index f66d493c181c..b45dc88b51b7 100644 --- a/regress/cert-hostkey.sh +++ b/regress/cert-hostkey.sh @@ -1,4 +1,4 @@ -# $OpenBSD: cert-hostkey.sh,v 1.27 2021/09/30 05:26:26 dtucker Exp $ +# $OpenBSD: cert-hostkey.sh,v 1.28 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. tid="certified host keys" @@ -73,7 +73,7 @@ touch $OBJ/host_revoked_plain touch $OBJ/host_revoked_cert cat $OBJ/host_ca_key.pub $OBJ/host_ca_key2.pub > $OBJ/host_revoked_ca -PLAIN_TYPES=`echo "$SSH_KEYTYPES" | sed 's/^ssh-dss/ssh-dsa/g;s/^ssh-//'` +PLAIN_TYPES=`echo "$SSH_KEYTYPES" | sed 's/^ssh-//'` if echo "$PLAIN_TYPES" | grep '^rsa$' >/dev/null 2>&1 ; then PLAIN_TYPES="$PLAIN_TYPES rsa-sha2-256 rsa-sha2-512" diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh index 4dac8c307baa..aa64b2ee62a2 100644 --- a/regress/cert-userkey.sh +++ b/regress/cert-userkey.sh @@ -1,4 +1,4 @@ -# $OpenBSD: cert-userkey.sh,v 1.29 2024/12/06 16:25:58 djm Exp $ +# $OpenBSD: cert-userkey.sh,v 1.30 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. tid="certified user keys" @@ -16,7 +16,7 @@ fi grep -v AuthorizedKeysFile $OBJ/sshd_proxy > $OBJ/sshd_proxy_bak echo "AuthorizedKeysFile $OBJ/authorized_keys_%u_*" >> $OBJ/sshd_proxy_bak -PLAIN_TYPES=`$SSH -Q key-plain | maybe_filter_sk | sed 's/^ssh-dss/ssh-dsa/;s/^ssh-//'` +PLAIN_TYPES=`$SSH -Q key-plain | maybe_filter_sk | sed 's/^ssh-//'` EXTRA_TYPES="" rsa="" @@ -31,7 +31,7 @@ kname() { sk-ecdsa-*) n="sk-ecdsa" ;; sk-ssh-ed25519*) n="sk-ssh-ed25519" ;; # subshell because some seds will add a newline - *) n=$(echo $1 | sed 's/^dsa/ssh-dss/;s/^rsa/ssh-rsa/;s/^ed/ssh-ed/') ;; + *) n=$(echo $1 | sed 's/^rsa/ssh-rsa/;s/^ed/ssh-ed/') ;; esac if [ -z "$rsa" ]; then echo "$n*,ssh-ed25519*" diff --git a/regress/dsa_ssh2.prv b/regress/dsa_ssh2.prv deleted file mode 100644 index c93b4037194c..000000000000 --- a/regress/dsa_ssh2.prv +++ /dev/null @@ -1,14 +0,0 @@ ----- BEGIN SSH2 ENCRYPTED PRIVATE KEY ---- -Subject: ssh-keygen test -Comment: "1024-bit dsa, Tue Jan 08 2002 22:00:23 +0100" -P2/56wAAAgIAAAAmZGwtbW9kcHtzaWdue2RzYS1uaXN0LXNoYTF9LGRoe3BsYWlufX0AAA -AEbm9uZQAAAcQAAAHAAAAAAAAABACwUfm3AxZTut3icBmwCcD48nY64HzuELlQ+vEqjIcR -Lo49es/DQTeLNQ+kdKRCfouosGNv0WqxRtF0tUsWdXxS37oHGa4QPugBdHRd7YlZGZv8kg -x7FsoepY7v7E683/97dv2zxL3AGagTEzWr7fl0yPexAaZoDvtQrrjX44BLmwAABACWQkvv -MxnD8eFkS1konFfMJ1CkuRfTN34CBZ6dY7VTSGemy4QwtFdMKmoufD0eKgy3p5WOeWCYKt -F4FhjHKZk/aaxFjjIbtkrnlvXg64QI11dSZyBN6/ViQkHPSkUDF+A6AAEhrNbQbAFSvao1 -kTvNtPCtL0AkUIduEMzGQfLCTAAAAKDeC043YVo9Zo0zAEeIA4uZh4LBCQAAA/9aj7Y5ik -ehygJ4qTDSlVypsPuV+n59tMS0e2pfrSG87yf5r94AKBmJeho5OO6wYaXCxsVB7AFbSUD6 -75AK8mHF4v1/+7SWKk5f8xlMCMSPZ9K0+j/W1d/q2qkhnnDZolOHDomLA+U00i5ya/jnTV -zyDPWLFpWK8u3xGBPAYX324gAAAKDHFvooRnaXdZbeWGTTqmgHB1GU9A== ----- END SSH2 ENCRYPTED PRIVATE KEY ---- diff --git a/regress/dsa_ssh2.pub b/regress/dsa_ssh2.pub deleted file mode 100644 index 215d73baef31..000000000000 --- a/regress/dsa_ssh2.pub +++ /dev/null @@ -1,13 +0,0 @@ ----- BEGIN SSH2 PUBLIC KEY ---- -Subject: ssh-keygen test -Comment: "1024-bit dsa, Tue Jan 08 2002 22:00:23 +0100" -AAAAB3NzaC1kc3MAAACBALBR+bcDFlO63eJwGbAJwPjydjrgfO4QuVD68SqMhxEujj16z8 -NBN4s1D6R0pEJ+i6iwY2/RarFG0XS1SxZ1fFLfugcZrhA+6AF0dF3tiVkZm/ySDHsWyh6l -ju/sTrzf/3t2/bPEvcAZqBMTNavt+XTI97EBpmgO+1CuuNfjgEubAAAAFQDeC043YVo9Zo -0zAEeIA4uZh4LBCQAAAIEAlkJL7zMZw/HhZEtZKJxXzCdQpLkX0zd+AgWenWO1U0hnpsuE -MLRXTCpqLnw9HioMt6eVjnlgmCrReBYYxymZP2msRY4yG7ZK55b14OuECNdXUmcgTev1Yk -JBz0pFAxfgOgABIazW0GwBUr2qNZE7zbTwrS9AJFCHbhDMxkHywkwAAACAWo+2OYpHocoC -eKkw0pVcqbD7lfp+fbTEtHtqX60hvO8n+a/eACgZiXoaOTjusGGlwsbFQewBW0lA+u+QCv -JhxeL9f/u0lipOX/MZTAjEj2fStPo/1tXf6tqpIZ5w2aJThw6JiwPlNNIucmv4501c8gz1 -ixaVivLt8RgTwGF99uI= ----- END SSH2 PUBLIC KEY ---- diff --git a/regress/hostbased.sh b/regress/hostbased.sh index eb9cf2727d33..5de176b18bf7 100644 --- a/regress/hostbased.sh +++ b/regress/hostbased.sh @@ -1,4 +1,4 @@ -# $OpenBSD: hostbased.sh,v 1.4 2022/12/07 11:45:43 dtucker Exp $ +# $OpenBSD: hostbased.sh,v 1.5 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. # This test requires external setup and thus is skipped unless @@ -43,7 +43,6 @@ for key in `${SUDO} ${SSHD} -T | awk '$1=="hostkey"{print $2}'`; do 521*ECDSA*) algos="$algos ecdsa-sha2-nistp521" ;; *RSA*) algos="$algos ssh-rsa rsa-sha2-256 rsa-sha2-512" ;; *ED25519*) algos="$algos ssh-ed25519" ;; - *DSA*) algos="$algos ssh-dss" ;; *) verbose "unknown host key type $key" ;; esac done diff --git a/regress/keytype.sh b/regress/keytype.sh index f1c045183bd3..11ef7d0cb270 100644 --- a/regress/keytype.sh +++ b/regress/keytype.sh @@ -1,4 +1,4 @@ -# $OpenBSD: keytype.sh,v 1.11 2021/02/25 03:27:34 djm Exp $ +# $OpenBSD: keytype.sh,v 1.12 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. tid="login with different key types" @@ -10,7 +10,6 @@ cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak ktypes="" for i in ${SSH_KEYTYPES}; do case "$i" in - ssh-dss) ktypes="$ktypes dsa-1024" ;; ssh-rsa) ktypes="$ktypes rsa-2048 rsa-3072" ;; ssh-ed25519) ktypes="$ktypes ed25519-512" ;; ecdsa-sha2-nistp256) ktypes="$ktypes ecdsa-256" ;; @@ -36,7 +35,6 @@ done kname_to_ktype() { case $1 in - dsa-1024) echo ssh-dss;; ecdsa-256) echo ecdsa-sha2-nistp256;; ecdsa-384) echo ecdsa-sha2-nistp384;; ecdsa-521) echo ecdsa-sha2-nistp521;; diff --git a/regress/knownhosts-command.sh b/regress/knownhosts-command.sh index 1eeeca521543..6db87a754b91 100644 --- a/regress/knownhosts-command.sh +++ b/regress/knownhosts-command.sh @@ -1,4 +1,4 @@ -# $OpenBSD: knownhosts-command.sh,v 1.3 2021/08/30 01:15:45 djm Exp $ +# $OpenBSD: knownhosts-command.sh,v 1.4 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. tid="known hosts command " @@ -48,7 +48,6 @@ echo "expected_username: $expected_username" for keytype in ${SSH_HOSTKEY_TYPES} ; do algs=$keytype - test "x$keytype" = "xssh-dss" && continue test "x$keytype" = "xssh-rsa" && algs=ssh-rsa,rsa-sha2-256,rsa-sha2-512 verbose "keytype $keytype" cat > $OBJ/knownhosts_command << _EOF diff --git a/regress/krl.sh b/regress/krl.sh index a42684ec5592..93efadeb6665 100644 --- a/regress/krl.sh +++ b/regress/krl.sh @@ -1,4 +1,4 @@ -# $OpenBSD: krl.sh,v 1.12 2023/01/16 04:11:29 djm Exp $ +# $OpenBSD: krl.sh,v 1.13 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. tid="key revocation lists" @@ -11,7 +11,6 @@ for t in $SSH_KEYTYPES; do case "$t" in ecdsa*) ktype2=ecdsa ;; ssh-rsa) ktype3=rsa ;; - ssh-dss) ktype4=dsa ;; sk-ssh-ed25519@openssh.com) ktype5=ed25519-sk ;; sk-ecdsa-sha2-nistp256@openssh.com) ktype6=ecdsa-sk ;; esac diff --git a/regress/limit-keytype.sh b/regress/limit-keytype.sh index e333de9a7883..01c4874481fb 100644 --- a/regress/limit-keytype.sh +++ b/regress/limit-keytype.sh @@ -1,4 +1,4 @@ -# $OpenBSD: limit-keytype.sh,v 1.10 2021/02/25 03:27:34 djm Exp $ +# $OpenBSD: limit-keytype.sh,v 1.11 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. tid="restrict pubkey type" @@ -17,7 +17,6 @@ for t in $SSH_KEYTYPES ; do case "$t" in ssh-rsa) ktype2=rsa ;; ecdsa*) ktype3=ecdsa ;; # unused - ssh-dss) ktype4=dsa ;; sk-ssh-ed25519@openssh.com) ktype5=ed25519-sk ;; sk-ecdsa-sha2-nistp256@openssh.com) ktype6=ecdsa-sk ;; esac @@ -75,7 +74,6 @@ keytype() { case "$1" in ecdsa) printf "ecdsa-sha2-*" ;; ed25519) printf "ssh-ed25519" ;; - dsa) printf "ssh-dss" ;; rsa) printf "rsa-sha2-256,rsa-sha2-512,ssh-rsa" ;; sk-ecdsa) printf "sk-ecdsa-*" ;; sk-ssh-ed25519) printf "sk-ssh-ed25519-*" ;; @@ -123,7 +121,7 @@ if [ "$ktype1" != "$ktype2" ]; then fi ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed" -# Allow only DSA in main config, Ed25519 for user. +# Allow only Ed25519 in main config, Ed25519 for user. verbose "match w/ matching" if [ "$os" == "windows" ]; then # If User is domainuser then it will be in "domain/user" so convert it to "domain\user" diff --git a/regress/misc/fuzz-harness/fixed-keys.h b/regress/misc/fuzz-harness/fixed-keys.h index c6e7c6cc1828..7dae9ac0034d 100644 --- a/regress/misc/fuzz-harness/fixed-keys.h +++ b/regress/misc/fuzz-harness/fixed-keys.h @@ -34,41 +34,6 @@ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDf56l/5UYqgY9oBlet/pLRzK6ZCd12QYGdUVfQDl6HftG0u6DSpjm2HGwFRsYZWv2ZN3ZBfAu6MHBiDmXUw/8WaD7nfXZmDH2keZL6opQttqvSGU2Cm00Rv5o1R3ej2qDdpepebv5meMBXTl5/+bE1E3Zm+4STDtxGmlMlxsEj68XeVe4JedfaSUMj3kaXYBbdYdG1qeosdle4GSONEEMpzsxSr8Y/WGYuIB33l29Tt9mNGUgSw/zjMYQjUVvQv+SY8dw62JV8d+3wK2YL2/r73gms6I8EE1JxX53KuAAY+x0p2v/W8ilCYI2Ijyzc8KIPwntmIFpibQjx+rkb+qdT" #define CERT_RSA \ "ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg89JX6OBMYDSxER8fnU5y8xxeMCHR/hI0uVqdEhNyCpcAAAADAQABAAABAQDf56l/5UYqgY9oBlet/pLRzK6ZCd12QYGdUVfQDl6HftG0u6DSpjm2HGwFRsYZWv2ZN3ZBfAu6MHBiDmXUw/8WaD7nfXZmDH2keZL6opQttqvSGU2Cm00Rv5o1R3ej2qDdpepebv5meMBXTl5/+bE1E3Zm+4STDtxGmlMlxsEj68XeVe4JedfaSUMj3kaXYBbdYdG1qeosdle4GSONEEMpzsxSr8Y/WGYuIB33l29Tt9mNGUgSw/zjMYQjUVvQv+SY8dw62JV8d+3wK2YL2/r73gms6I8EE1JxX53KuAAY+x0p2v/W8ilCYI2Ijyzc8KIPwntmIFpibQjx+rkb+qdTAAAAAAAAA+0AAAABAAAAB3VseXNzZXMAAAAXAAAAB3VseXNzZXMAAAAIb2R5c3NldXMAAAAAAAAAAP//////////AAAAAAAAAIIAAAAVcGVybWl0LVgxMS1mb3J3YXJkaW5nAAAAAAAAABdwZXJtaXQtYWdlbnQtZm9yd2FyZGluZwAAAAAAAAAWcGVybWl0LXBvcnQtZm9yd2FyZGluZwAAAAAAAAAKcGVybWl0LXB0eQAAAAAAAAAOcGVybWl0LXVzZXItcmMAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgM9BeYRUxUuZ4VHJp8oxVaA8OS/z+5EFPCZwQNq1nMwMAAABTAAAAC3NzaC1lZDI1NTE5AAAAQGCDA6PWw4x9bHQl0w7NqifHepumqD3dmyMx+hZGuPRon+TsyCjfytu7hWmV7l9XUF0fPQNFQ7FGat5e+7YUNgE= id_rsa.pub" -#define PRIV_DSA \ -"-----BEGIN OPENSSH PRIVATE KEY-----\n"\ -"b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABsgAAAAdzc2gtZH\n"\ -"NzAAAAgQCsGTfjpQ465EOkfQXJM9BOvfRQE0fqlykAls+ncz+T7hrbeScRu8xpwzsznJNm\n"\ -"xlW8o6cUDiHmBJ5OHgamUC9N7YJeU/6fnOAZifgN8mqK6k8pKHuje8ANOiYgHLl0yiASQA\n"\ -"3//qMyzZ+W/hemoLSmLAbEqlfWVeyYx+wta1Vm+QAAABUAvWyehvUvdHvQxavYgS5p0t5Q\n"\ -"d7UAAACBAIRA9Yy+f4Kzqpv/qICPO3zk42UuP7WAhSW2nCbQdLlCiSTxcjKgcvXNRckwJP\n"\ -"44JjSHOtJy/AMtJrPIbLYG6KuWTdBlEHFiG6DafvLG+qPMSL2bPjXTOhuOMbCHIZ+5WBkW\n"\ -"THeG/Nv11iI01Of9V6tXkig23K370flkRkXFi9MdAAAAgCt6YUcQkNwG7B/e5M1FZsLP9O\n"\ -"kVB3BwLAOjmWdHpyhu3HpwSJa3XLEvhXN0i6IVI2KgPo/2GtYA6rHt14L+6u1pmhh8sAvQ\n"\ -"ksp3qZB+xh/NP+hBqf0sbHX0yYbzKOvI5SCc/kKK6yagcBZOsubM/KC8TxyVgmD5c6WzYs\n"\ -"h5TEpvAAAB2PHjRbbx40W2AAAAB3NzaC1kc3MAAACBAKwZN+OlDjrkQ6R9Bckz0E699FAT\n"\ -"R+qXKQCWz6dzP5PuGtt5JxG7zGnDOzOck2bGVbyjpxQOIeYEnk4eBqZQL03tgl5T/p+c4B\n"\ -"mJ+A3yaorqTykoe6N7wA06JiAcuXTKIBJADf/+ozLNn5b+F6agtKYsBsSqV9ZV7JjH7C1r\n"\ -"VWb5AAAAFQC9bJ6G9S90e9DFq9iBLmnS3lB3tQAAAIEAhED1jL5/grOqm/+ogI87fOTjZS\n"\ -"4/tYCFJbacJtB0uUKJJPFyMqBy9c1FyTAk/jgmNIc60nL8Ay0ms8hstgboq5ZN0GUQcWIb\n"\ -"oNp+8sb6o8xIvZs+NdM6G44xsIchn7lYGRZMd4b82/XWIjTU5/1Xq1eSKDbcrfvR+WRGRc\n"\ -"WL0x0AAACAK3phRxCQ3AbsH97kzUVmws/06RUHcHAsA6OZZ0enKG7cenBIlrdcsS+Fc3SL\n"\ -"ohUjYqA+j/Ya1gDqse3Xgv7q7WmaGHywC9CSynepkH7GH80/6EGp/SxsdfTJhvMo68jlIJ\n"\ -"z+QorrJqBwFk6y5sz8oLxPHJWCYPlzpbNiyHlMSm8AAAAUUA+OGldMi76ClO/sstpdbBUE\n"\ -"lq8AAAAAAQI=\n"\ -"-----END OPENSSH PRIVATE KEY-----\n" -#define PUB_DSA \ -"ssh-dss AAAAB3NzaC1kc3MAAACBAKwZN+OlDjrkQ6R9Bckz0E699FATR+qXKQCWz6dzP5PuGtt5JxG7zGnDOzOck2bGVbyjpxQOIeYEnk4eBqZQL03tgl5T/p+c4BmJ+A3yaorqTykoe6N7wA06JiAcuXTKIBJADf/+ozLNn5b+F6agtKYsBsSqV9ZV7JjH7C1rVWb5AAAAFQC9bJ6G9S90e9DFq9iBLmnS3lB3tQAAAIEAhED1jL5/grOqm/+ogI87fOTjZS4/tYCFJbacJtB0uUKJJPFyMqBy9c1FyTAk/jgmNIc60nL8Ay0ms8hstgboq5ZN0GUQcWIboNp+8sb6o8xIvZs+NdM6G44xsIchn7lYGRZMd4b82/XWIjTU5/1Xq1eSKDbcrfvR+WRGRcWL0x0AAACAK3phRxCQ3AbsH97kzUVmws/06RUHcHAsA6OZZ0enKG7cenBIlrdcsS+Fc3SLohUjYqA+j/Ya1gDqse3Xgv7q7WmaGHywC9CSynepkH7GH80/6EGp/SxsdfTJhvMo68jlIJz+QorrJqBwFk6y5sz8oLxPHJWCYPlzpbNiyHlMSm8=" -#define CERT_DSA \ -"ssh-dss-cert-v01@openssh.com AAAAHHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20AAAAguF716Yub+vVKNlONKLsfxGYWkRe/PyjfYdGRTsFaDvAAAACBAKwZN+OlDjrkQ6R9Bckz0E699FATR+qXKQCWz6dzP5PuGtt5JxG7zGnDOzOck2bGVbyjpxQOIeYEnk4eBqZQL03tgl5T/p+c4BmJ+A3yaorqTykoe6N7wA06JiAcuXTKIBJADf/+ozLNn5b+F6agtKYsBsSqV9ZV7JjH7C1rVWb5AAAAFQC9bJ6G9S90e9DFq9iBLmnS3lB3tQAAAIEAhED1jL5/grOqm/+ogI87fOTjZS4/tYCFJbacJtB0uUKJJPFyMqBy9c1FyTAk/jgmNIc60nL8Ay0ms8hstgboq5ZN0GUQcWIboNp+8sb6o8xIvZs+NdM6G44xsIchn7lYGRZMd4b82/XWIjTU5/1Xq1eSKDbcrfvR+WRGRcWL0x0AAACAK3phRxCQ3AbsH97kzUVmws/06RUHcHAsA6OZZ0enKG7cenBIlrdcsS+Fc3SLohUjYqA+j/Ya1gDqse3Xgv7q7WmaGHywC9CSynepkH7GH80/6EGp/SxsdfTJhvMo68jlIJz+QorrJqBwFk6y5sz8oLxPHJWCYPlzpbNiyHlMSm8AAAAAAAAD6AAAAAEAAAAHdWx5c3NlcwAAABcAAAAHdWx5c3NlcwAAAAhvZHlzc2V1cwAAAAAAAAAA//////////8AAAAAAAAAggAAABVwZXJtaXQtWDExLWZvcndhcmRpbmcAAAAAAAAAF3Blcm1pdC1hZ2VudC1mb3J3YXJkaW5nAAAAAAAAABZwZXJtaXQtcG9ydC1mb3J3YXJkaW5nAAAAAAAAAApwZXJtaXQtcHR5AAAAAAAAAA5wZXJtaXQtdXNlci1yYwAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACAz0F5hFTFS5nhUcmnyjFVoDw5L/P7kQU8JnBA2rWczAwAAAFMAAAALc3NoLWVkMjU1MTkAAABAjMQEZcbdUYJBjIC4GxByFDOb8tv71vDZdx7irHwaqIjx5rzpJUuOV1r8ZO4kY+Yaiun1yrWj2QYkfJrHBvD1DA== id_dsa.pub" -#define PRIV_ECDSA \ -"-----BEGIN OPENSSH PRIVATE KEY-----\n"\ -"b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS\n"\ -"1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQTDJ0VlMv+0rguNzaJ1DF2KueHaxRSQ\n"\ -"6LpIxGbulrg1a8RPbnMXwag5GcDiDllD2lDUJUuBEWyjXA0rZoZX35ELAAAAoE/Bbr5PwW\n"\ -"6+AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMMnRWUy/7SuC43N\n"\ -"onUMXYq54drFFJDoukjEZu6WuDVrxE9ucxfBqDkZwOIOWUPaUNQlS4ERbKNcDStmhlffkQ\n"\ -"sAAAAhAIhE6hCID5oOm1TDktc++KFKyScjLifcZ6Cgv5xSSyLOAAAAAAECAwQFBgc=\n"\ -"-----END OPENSSH PRIVATE KEY-----\n" #define PUB_ECDSA \ "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMMnRWUy/7SuC43NonUMXYq54drFFJDoukjEZu6WuDVrxE9ucxfBqDkZwOIOWUPaUNQlS4ERbKNcDStmhlffkQs=" #define CERT_ECDSA \ diff --git a/regress/misc/fuzz-harness/testdata/create-agent-corpus.sh b/regress/misc/fuzz-harness/testdata/create-agent-corpus.sh index 1043b9ff47d7..842b8c48d9dd 100755 --- a/regress/misc/fuzz-harness/testdata/create-agent-corpus.sh +++ b/regress/misc/fuzz-harness/testdata/create-agent-corpus.sh @@ -14,7 +14,7 @@ sleep 1 AGENT_PID=$! trap "kill $AGENT_PID" EXIT -PRIV="id_dsa id_ecdsa id_ecdsa_sk id_ed25519 id_ed25519_sk id_rsa" +PRIV="id_ecdsa id_ecdsa_sk id_ed25519 id_ed25519_sk id_rsa" # add keys ssh-add $PRIV diff --git a/regress/misc/ssh-verify-attestation/Makefile b/regress/misc/ssh-verify-attestation/Makefile index 2a797aecae46..06fb8aac4e98 100644 --- a/regress/misc/ssh-verify-attestation/Makefile +++ b/regress/misc/ssh-verify-attestation/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.1 2024/12/04 16:42:49 djm Exp $ +# $OpenBSD: Makefile,v 1.2 2025/05/06 06:05:48 djm Exp $ .include .include @@ -13,7 +13,7 @@ SRCS=ssh-verify-attestation.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c -SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c +SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c SRCS+=addr.c addrmatch.c bitmap.c SRCS+=ed25519.c hash.c diff --git a/regress/ssh-com-client.sh b/regress/ssh-com-client.sh index e4f80cf0aadf..97b36b564f4a 100644 --- a/regress/ssh-com-client.sh +++ b/regress/ssh-com-client.sh @@ -1,4 +1,4 @@ -# $OpenBSD: ssh-com-client.sh,v 1.7 2013/05/17 04:29:14 dtucker Exp $ +# $OpenBSD: ssh-com-client.sh,v 1.8 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. tid="connect with ssh.com client" @@ -28,7 +28,7 @@ VERSIONS=" # setup authorized keys SRC=`dirname ${SCRIPT}` -cp ${SRC}/dsa_ssh2.prv ${OBJ}/id.com +cp ${SRC}/rsa_ssh2.prv ${OBJ}/id.com chmod 600 ${OBJ}/id.com ${SSHKEYGEN} -i -f ${OBJ}/id.com > $OBJ/id.openssh chmod 600 ${OBJ}/id.openssh @@ -36,8 +36,8 @@ ${SSHKEYGEN} -y -f ${OBJ}/id.openssh > $OBJ/authorized_keys_$USER ${SSHKEYGEN} -e -f ${OBJ}/id.openssh > $OBJ/id.com.pub echo IdKey ${OBJ}/id.com > ${OBJ}/id.list -# we need a DSA host key -t=dsa +# we need a RSA host key +t=rsa rm -f ${OBJ}/$t ${OBJ}/$t.pub ${SSHKEYGEN} -q -N '' -t $t -f ${OBJ}/$t $SUDO cp $OBJ/$t $OBJ/host.$t @@ -47,7 +47,6 @@ echo HostKey $OBJ/host.$t >> $OBJ/sshd_config mkdir -p ${OBJ}/${USER}/hostkeys HK=${OBJ}/${USER}/hostkeys/key_${PORT}_127.0.0.1 ${SSHKEYGEN} -e -f ${OBJ}/rsa.pub > ${HK}.ssh-rsa.pub -${SSHKEYGEN} -e -f ${OBJ}/dsa.pub > ${HK}.ssh-dss.pub cat > ${OBJ}/ssh2_config << EOF *: @@ -74,7 +73,7 @@ for v in ${VERSIONS}; do continue fi verbose "ssh2 ${v}" - key=ssh-dss + key=ssh-rsa skipcat=0 case $v in 2.1.*|2.3.0) @@ -124,7 +123,6 @@ for v in ${VERSIONS}; do done rm -rf ${OBJ}/${USER} -for i in ssh2_config random_seed dsa.pub dsa host.dsa \ - id.list id.com id.com.pub id.openssh; do +for i in ssh2_config random_seed id.list id.com id.com.pub id.openssh; do rm -f ${OBJ}/$i done diff --git a/regress/ssh-com.sh b/regress/ssh-com.sh index b1a2505d1135..bb833380eb57 100644 --- a/regress/ssh-com.sh +++ b/regress/ssh-com.sh @@ -1,4 +1,4 @@ -# $OpenBSD: ssh-com.sh,v 1.10 2017/05/08 01:52:49 djm Exp $ +# $OpenBSD: ssh-com.sh,v 1.11 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. tid="connect to ssh.com server" @@ -41,8 +41,8 @@ cat << EOF > $OBJ/sshd2_config PubKeyAuthentication yes #AllowedAuthentications publickey AuthorizationFile authorization - HostKeyFile ${SRC}/dsa_ssh2.prv - PublicHostKeyFile ${SRC}/dsa_ssh2.pub + HostKeyFile ${SRC}/rsa_ssh2.prv + PublicHostKeyFile ${SRC}/rsa_ssh2.pub RandomSeedFile ${OBJ}/random_seed MaxConnections 0 PermitRootLogin yes @@ -55,23 +55,21 @@ EOF sed "s/HostKeyAlias.*/HostKeyAlias ssh2-localhost-with-alias/" \ < $OBJ/ssh_config > $OBJ/ssh_config_com -# we need a DSA key for -rm -f ${OBJ}/dsa ${OBJ}/dsa.pub -${SSHKEYGEN} -q -N '' -t dsa -f ${OBJ}/dsa +# we need a RSA key for +rm -f ${OBJ}/rsa ${OBJ}/rsa.pub +${SSHKEYGEN} -q -N '' -t rsa -f ${OBJ}/rsa # setup userdir, try rsa first mkdir -p ${OBJ}/${USER} cp /dev/null ${OBJ}/${USER}/authorization -for t in rsa dsa; do - ${SSHKEYGEN} -e -f ${OBJ}/$t.pub > ${OBJ}/${USER}/$t.com - echo Key $t.com >> ${OBJ}/${USER}/authorization - echo IdentityFile ${OBJ}/$t >> ${OBJ}/ssh_config_com -done +${SSHKEYGEN} -e -f ${OBJ}/rsa.pub > ${OBJ}/${USER}/rsa.com +echo Key rsa.com >> ${OBJ}/${USER}/authorization +echo IdentityFile ${OBJ}/rsa >> ${OBJ}/ssh_config_com -# convert and append DSA hostkey +# convert and append RSA hostkey ( printf 'ssh2-localhost-with-alias,127.0.0.1,::1 ' - ${SSHKEYGEN} -if ${SRC}/dsa_ssh2.pub + ${SSHKEYGEN} -if ${SRC}/rsa_ssh2.pub ) >> $OBJ/known_hosts # go for it @@ -114,6 +112,6 @@ done rm -rf ${OBJ}/${USER} for i in sshd_config_proxy ssh_config_proxy random_seed \ - sshd2_config dsa.pub dsa ssh_config_com; do + sshd2_config rsa.pub rsa ssh_config_com; do rm -f ${OBJ}/$i done diff --git a/regress/ssh2putty.sh b/regress/ssh2putty.sh index 9b08310391ca..bd291313f6c3 100755 --- a/regress/ssh2putty.sh +++ b/regress/ssh2putty.sh @@ -1,5 +1,5 @@ #!/bin/sh -# $OpenBSD: ssh2putty.sh,v 1.9 2021/07/25 12:13:03 dtucker Exp $ +# $OpenBSD: ssh2putty.sh,v 1.10 2025/05/06 06:05:48 djm Exp $ if test "x$1" = "x" -o "x$2" = "x" -o "x$3" = "x" ; then echo "Usage: ssh2putty hostname port ssh-private-key" @@ -12,7 +12,6 @@ KEYFILE=$3 OPENSSL_BIN="${OPENSSL_BIN:-openssl}" -# XXX - support DSA keys too if grep "BEGIN RSA PRIVATE KEY" $KEYFILE >/dev/null 2>&1 ; then : else diff --git a/regress/sshcfgparse.sh b/regress/sshcfgparse.sh index bf6971ebe18b..7d418090f2aa 100644 --- a/regress/sshcfgparse.sh +++ b/regress/sshcfgparse.sh @@ -1,15 +1,8 @@ -# $OpenBSD: sshcfgparse.sh,v 1.9 2021/06/08 07:05:27 dtucker Exp $ +# $OpenBSD: sshcfgparse.sh,v 1.10 2025/05/06 06:05:48 djm Exp $ # Placed in the Public Domain. tid="ssh config parse" -dsa=0 -for t in $SSH_KEYTYPES; do - case "$t" in - ssh-dss) dsa=1 ;; - esac -done - expect_result_present() { _str="$1" ; shift for _expect in "$@" ; do @@ -99,7 +92,6 @@ if [ "$os" == "windows" ]; then f=${f/$'\r'/} # remove CR (carriage return) fi expect_result_present "$f" "ssh-ed25519" "ssh-ed25519-cert-v01.*" -expect_result_absent "$f" "ssh-dss" # Explicit override f=`${SSH} -GF none -opubkeyacceptedalgorithms=ssh-ed25519 host | \ awk '/^pubkeyacceptedalgorithms /{print $2}'` @@ -107,7 +99,7 @@ if [ "$os" == "windows" ]; then f=${f/$'\r'/} # remove CR (carriage return) fi expect_result_present "$f" "ssh-ed25519" -expect_result_absent "$f" "ssh-ed25519-cert-v01.*" "ssh-dss" +expect_result_absent "$f" "ssh-ed25519-cert-v01.*" # Removal from default set f=`${SSH} -GF none -opubkeyacceptedalgorithms=-ssh-ed25519-cert* host | \ awk '/^pubkeyacceptedalgorithms /{print $2}'` @@ -115,32 +107,17 @@ if [ "$os" == "windows" ]; then f=${f/$'\r'/} # remove CR (carriage return) fi expect_result_present "$f" "ssh-ed25519" -expect_result_absent "$f" "ssh-ed25519-cert-v01.*" "ssh-dss" +expect_result_absent "$f" "ssh-ed25519-cert-v01.*" f=`${SSH} -GF none -opubkeyacceptedalgorithms=-ssh-ed25519 host | \ awk '/^pubkeyacceptedalgorithms /{print $2}'` if [ "$os" == "windows" ]; then f=${f/$'\r'/} # remove CR (carriage return) fi expect_result_present "$f" "ssh-ed25519-cert-v01.*" -expect_result_absent "$f" "ssh-ed25519" "ssh-dss" +expect_result_absent "$f" "ssh-ed25519" # Append to default set. # This is not tested when built !WITH_OPENSSL -if [ "$dsa" = "1" ]; then - f=`${SSH} -GF none -opubkeyacceptedalgorithms=+ssh-dss-cert* host | \ - awk '/^pubkeyacceptedalgorithms /{print $2}'` - if [ "$os" == "windows" ]; then - f=${f/$'\r'/} # remove CR (carriage return) - fi - expect_result_present "$f" "ssh-ed25519" "ssh-dss-cert-v01.*" - expect_result_absent "$f" "ssh-dss" - f=`${SSH} -GF none -opubkeyacceptedalgorithms=+ssh-dss host | \ - awk '/^pubkeyacceptedalgorithms /{print $2}'` - if [ "$os" == "windows" ]; then - f=${f/$'\r'/} # remove CR (carriage return) - fi - expect_result_present "$f" "ssh-ed25519" "ssh-ed25519-cert-v01.*" "ssh-dss" - expect_result_absent "$f" "ssh-dss-cert-v01.*" -fi +# XXX need a test for this verbose "agentforwarding" f=`${SSH} -GF none host | awk '/^forwardagent /{print$2}'` diff --git a/regress/unittests/Makefile.inc b/regress/unittests/Makefile.inc index 98e280486ab1..5fcf7a950a39 100644 --- a/regress/unittests/Makefile.inc +++ b/regress/unittests/Makefile.inc @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile.inc,v 1.16 2024/01/11 01:45:58 djm Exp $ +# $OpenBSD: Makefile.inc,v 1.18 2025/05/06 06:05:48 djm Exp $ .include .include @@ -7,6 +7,9 @@ UNITTEST_FAST?= no # Skip slow tests (e.g. less intensive fuzzing). UNITTEST_SLOW?= no # Include slower tests (e.g. more intensive fuzzing). UNITTEST_VERBOSE?= no # Verbose test output (inc. per-test names). +UNITTEST_BENCHMARK?= no # Run unit tests in benchmarking mode. +UNITTEST_BENCH_DETAIL?=no # Detailed benchmark statistics. +UNITTEST_BENCH_ONLY?= # Run only these benchmarks MALLOC_OPTIONS?= CFGJRSUX TEST_ENV?= MALLOC_OPTIONS=${MALLOC_OPTIONS} @@ -15,10 +18,6 @@ TEST_ENV?= MALLOC_OPTIONS=${MALLOC_OPTIONS} OPENSSL?= yes DSAKEY?= yes -.if (${DSAKEY:L} == "yes") -CFLAGS+= -DWITH_DSA -.endif - .if (${OPENSSL:L} == "yes") CFLAGS+= -DWITH_OPENSSL .endif @@ -69,8 +68,8 @@ DPADD+=${.CURDIR}/../test_helper/libtest_helper.a .PATH: ${.CURDIR}/${SSHREL} -LDADD+= -lutil -DPADD+= ${LIBUTIL} +LDADD+= -lutil -lm +DPADD+= ${LIBUTIL} ${LIBM} .if (${OPENSSL:L} == "yes") LDADD+= -lcrypto @@ -82,11 +81,21 @@ DPADD+= ${LIBFIDO2} ${LIBCBOR} ${LIBUSBHID} UNITTEST_ARGS?= -.if (${UNITTEST_VERBOSE:L} != "no") +.if (${UNITTEST_VERBOSE:L:R} != "no") UNITTEST_ARGS+= -v .endif -.if (${UNITTEST_FAST:L} != "no") +.if (${UNITTEST_FAST:L:R} != "no") UNITTEST_ARGS+= -f -.elif (${UNITTEST_SLOW:L} != "no") +.elif (${UNITTEST_SLOW:L:R} != "no") UNITTEST_ARGS+= -F .endif + +.if (${UNITTEST_BENCHMARK:L:R} != "no") +UNITTEST_ARGS+= -b +.endif +.if (${UNITTEST_BENCH_DETAIL:L:R} != "no") +UNITTEST_ARGS+= -B +.endif +.if (${UNITTEST_BENCH_ONLY:L} != "") +UNITTEST_ARGS+= -O "${UNITTEST_BENCH_ONLY}" +.endif diff --git a/regress/unittests/authopt/Makefile b/regress/unittests/authopt/Makefile index 3045ec708165..d5ea2c796be1 100644 --- a/regress/unittests/authopt/Makefile +++ b/regress/unittests/authopt/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.7 2023/01/15 23:35:10 djm Exp $ +# $OpenBSD: Makefile,v 1.9 2025/05/06 06:05:48 djm Exp $ PROG=test_authopt SRCS=tests.c @@ -8,7 +8,7 @@ SRCS+=auth-options.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c -SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c +SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c SRCS+=addr.c addrmatch.c bitmap.c SRCS+=ed25519.c hash.c @@ -22,6 +22,6 @@ SRCS+=utf8.c REGRESS_TARGETS=run-regress-${PROG} run-regress-${PROG}: ${PROG} - env ${TEST_ENV} ./${PROG} -d ${.CURDIR}/testdata + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} -d ${.CURDIR}/testdata .include diff --git a/regress/unittests/authopt/tests.c b/regress/unittests/authopt/tests.c index d9e190305e76..5285f0db5746 100644 --- a/regress/unittests/authopt/tests.c +++ b/regress/unittests/authopt/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.3 2021/12/14 21:25:27 deraadt Exp $ */ +/* $OpenBSD: tests.c,v 1.4 2025/04/15 04:00:42 djm Exp $ */ /* * Regress test for keys options functions. @@ -576,3 +576,9 @@ tests(void) test_cert_parse(); test_merge(); } + +void +benchmarks(void) +{ + printf("no benchmarks\n"); +} diff --git a/regress/unittests/bitmap/Makefile b/regress/unittests/bitmap/Makefile index fe30acc77394..c38cc7918cc1 100644 --- a/regress/unittests/bitmap/Makefile +++ b/regress/unittests/bitmap/Makefile @@ -1,14 +1,15 @@ -# $OpenBSD: Makefile,v 1.4 2017/12/21 00:41:22 djm Exp $ +# $OpenBSD: Makefile,v 1.5 2025/04/15 04:00:42 djm Exp $ PROG=test_bitmap SRCS=tests.c # From usr.sbin/ssh -SRCS+=bitmap.c atomicio.c +SRCS+=bitmap.c atomicio.c misc.c xmalloc.c fatal.c log.c cleanup.c match.c +SRCS+=sshbuf.c sshbuf-getput-basic.c sshbuf-misc.c ssherr.c addr.c addrmatch.c REGRESS_TARGETS=run-regress-${PROG} run-regress-${PROG}: ${PROG} - env ${TEST_ENV} ./${PROG} + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} .include diff --git a/regress/unittests/bitmap/tests.c b/regress/unittests/bitmap/tests.c index 576b863f4066..b8eae2313215 100644 --- a/regress/unittests/bitmap/tests.c +++ b/regress/unittests/bitmap/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.2 2021/12/14 21:25:27 deraadt Exp $ */ +/* $OpenBSD: tests.c,v 1.3 2025/04/15 04:00:42 djm Exp $ */ /* * Regress test for bitmap.h bitmap API * @@ -23,7 +23,7 @@ #include "bitmap.h" -#define NTESTS 131 +#define DEFAULT_NTESTS 131 void tests(void) @@ -32,10 +32,15 @@ tests(void) struct bitmap *b; BIGNUM *bn; size_t len; - int i, j, k, n; + int i, j, k, n, ntests = DEFAULT_NTESTS; u_char bbuf[1024], bnbuf[1024]; int r; + if (test_is_fast()) + ntests /= 4; + else if (test_is_slow()) + ntests *= 2; + TEST_START("bitmap_new"); b = bitmap_new(); ASSERT_PTR_NE(b, NULL); @@ -44,9 +49,9 @@ tests(void) TEST_DONE(); TEST_START("bitmap_set_bit / bitmap_test_bit"); - for (i = -1; i < NTESTS; i++) { - for (j = -1; j < NTESTS; j++) { - for (k = -1; k < NTESTS; k++) { + for (i = -1; i < ntests; i++) { + for (j = -1; j < ntests; j++) { + for (k = -1; k < ntests; k++) { bitmap_zero(b); BN_clear(bn); @@ -67,7 +72,7 @@ tests(void) /* Check perfect match between bitmap and bn */ test_subtest_info("match %d/%d/%d", i, j, k); - for (n = 0; n < NTESTS; n++) { + for (n = 0; n < ntests; n++) { ASSERT_INT_EQ(BN_is_bit_set(bn, n), bitmap_test_bit(b, n)); } @@ -99,7 +104,7 @@ tests(void) bitmap_zero(b); ASSERT_INT_EQ(bitmap_from_string(b, bnbuf, len), 0); - for (n = 0; n < NTESTS; n++) { + for (n = 0; n < ntests; n++) { ASSERT_INT_EQ(BN_is_bit_set(bn, n), bitmap_test_bit(b, n)); } @@ -107,7 +112,7 @@ tests(void) /* Test clearing bits */ test_subtest_info("clear %d/%d/%d", i, j, k); - for (n = 0; n < NTESTS; n++) { + for (n = 0; n < ntests; n++) { ASSERT_INT_EQ(bitmap_set_bit(b, n), 0); ASSERT_INT_EQ(BN_set_bit(bn, n), 1); } @@ -123,7 +128,7 @@ tests(void) bitmap_clear_bit(b, k); BN_clear_bit(bn, k); } - for (n = 0; n < NTESTS; n++) { + for (n = 0; n < ntests; n++) { ASSERT_INT_EQ(BN_is_bit_set(bn, n), bitmap_test_bit(b, n)); } @@ -135,4 +140,9 @@ tests(void) TEST_DONE(); #endif } +void +benchmarks(void) +{ + printf("no benchmarks\n"); +} diff --git a/regress/unittests/conversion/Makefile b/regress/unittests/conversion/Makefile index 5793c4934845..f9f5859ac5e8 100644 --- a/regress/unittests/conversion/Makefile +++ b/regress/unittests/conversion/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.4 2021/01/09 12:24:30 dtucker Exp $ +# $OpenBSD: Makefile,v 1.5 2025/04/15 04:00:42 djm Exp $ PROG=test_conversion SRCS=tests.c @@ -11,6 +11,6 @@ SRCS+=match.c addr.c addrmatch.c REGRESS_TARGETS=run-regress-${PROG} run-regress-${PROG}: ${PROG} - env ${TEST_ENV} ./${PROG} + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} .include diff --git a/regress/unittests/conversion/tests.c b/regress/unittests/conversion/tests.c index 5b526f7afa07..d65e6326fd4e 100644 --- a/regress/unittests/conversion/tests.c +++ b/regress/unittests/conversion/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.4 2021/12/14 21:25:27 deraadt Exp $ */ +/* $OpenBSD: tests.c,v 1.5 2025/04/15 04:00:42 djm Exp $ */ /* * Regress test for conversions * @@ -50,3 +50,9 @@ tests(void) ASSERT_INT_EQ(convtime("1000000000000000000000w"), -1); TEST_DONE(); } + +void +benchmarks(void) +{ + printf("no benchmarks\n"); +} diff --git a/regress/unittests/hostkeys/Makefile b/regress/unittests/hostkeys/Makefile index 04d93359acaa..142ffa632aad 100644 --- a/regress/unittests/hostkeys/Makefile +++ b/regress/unittests/hostkeys/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.10 2023/01/15 23:35:10 djm Exp $ +# $OpenBSD: Makefile,v 1.12 2025/05/06 06:05:48 djm Exp $ PROG=test_hostkeys SRCS=tests.c test_iterate.c @@ -6,7 +6,7 @@ SRCS=tests.c test_iterate.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c -SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c +SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c SRCS+=addr.c addrmatch.c bitmap.c hostfile.c SRCS+=ed25519.c hash.c @@ -20,6 +20,6 @@ SRCS+=utf8.c REGRESS_TARGETS=run-regress-${PROG} run-regress-${PROG}: ${PROG} - env ${TEST_ENV} ./${PROG} -d ${.CURDIR}/testdata + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} -d ${.CURDIR}/testdata .include diff --git a/regress/unittests/hostkeys/mktestdata.sh b/regress/unittests/hostkeys/mktestdata.sh index 5a46de990dca..5fec5829853a 100644 --- a/regress/unittests/hostkeys/mktestdata.sh +++ b/regress/unittests/hostkeys/mktestdata.sh @@ -1,11 +1,11 @@ #!/bin/sh -# $OpenBSD: mktestdata.sh,v 1.2 2017/04/30 23:33:48 djm Exp $ +# $OpenBSD: mktestdata.sh,v 1.3 2025/05/06 06:05:48 djm Exp $ set -ex cd testdata -rm -f rsa* dsa* ecdsa* ed25519* +rm -f rsa* ecdsa* ed25519* rm -f known_hosts* gen_all() { @@ -14,11 +14,10 @@ gen_all() { test "x$_n" = "x1" && _ecdsa_bits=384 test "x$_n" = "x2" && _ecdsa_bits=521 ssh-keygen -qt rsa -b 1024 -C "RSA #$_n" -N "" -f rsa_$_n - ssh-keygen -qt dsa -b 1024 -C "DSA #$_n" -N "" -f dsa_$_n ssh-keygen -qt ecdsa -b $_ecdsa_bits -C "ECDSA #$_n" -N "" -f ecdsa_$_n ssh-keygen -qt ed25519 -C "ED25519 #$_n" -N "" -f ed25519_$_n # Don't need private keys - rm -f rsa_$_n dsa_$_n ecdsa_$_n ed25519_$_n + rm -f rsa_$_n ecdsa_$_n ed25519_$_n } hentries() { @@ -65,18 +64,18 @@ rm -f known_hosts_hash_frag.old echo "# Revoked and CA keys" printf "@revoked sisyphus.example.com " ; cat ed25519_4.pub printf "@cert-authority prometheus.example.com " ; cat ecdsa_4.pub - printf "@cert-authority *.example.com " ; cat dsa_4.pub + printf "@cert-authority *.example.com " ; cat rsa_4.pub printf "\n" echo "# Some invalid lines" # Invalid marker - printf "@what sisyphus.example.com " ; cat dsa_1.pub + printf "@what sisyphus.example.com " ; cat rsa_1.pub # Key missing echo "sisyphus.example.com " # Key blob missing echo "prometheus.example.com ssh-ed25519 " # Key blob truncated - echo "sisyphus.example.com ssh-dsa AAAATgAAAAdz" + echo "sisyphus.example.com ssh-rsa AAAATgAAAAdz" # Invalid type echo "sisyphus.example.com ssh-XXX AAAATgAAAAdzc2gtWFhYAAAAP0ZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRg==" # Type mismatch with blob diff --git a/regress/unittests/hostkeys/test_iterate.c b/regress/unittests/hostkeys/test_iterate.c index 7efb8e1b9cc6..0139376f4a78 100644 --- a/regress/unittests/hostkeys/test_iterate.c +++ b/regress/unittests/hostkeys/test_iterate.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_iterate.c,v 1.9 2024/01/11 01:45:58 djm Exp $ */ +/* $OpenBSD: test_iterate.c,v 1.10 2025/05/06 06:05:48 djm Exp $ */ /* * Regress test for hostfile.h hostkeys_foreach() * @@ -94,15 +94,8 @@ check(struct hostkey_foreach_line *l, void *_ctx) expected->no_parse_keytype == KEY_ECDSA) skip = 1; #endif /* OPENSSL_HAS_ECC */ -#ifndef WITH_DSA - if (expected->l.keytype == KEY_DSA || - expected->no_parse_keytype == KEY_DSA) - skip = 1; -#endif #ifndef WITH_OPENSSL - if (expected->l.keytype == KEY_DSA || - expected->no_parse_keytype == KEY_DSA || - expected->l.keytype == KEY_RSA || + if (expected->l.keytype == KEY_RSA || expected->no_parse_keytype == KEY_RSA || expected->l.keytype == KEY_ECDSA || expected->no_parse_keytype == KEY_ECDSA) @@ -160,14 +153,9 @@ prepare_expected(struct expected *expected, size_t n) if (expected[i].l.keytype == KEY_ECDSA) continue; #endif /* OPENSSL_HAS_ECC */ -#ifndef WITH_DSA - if (expected[i].l.keytype == KEY_DSA) - continue; -#endif #ifndef WITH_OPENSSL switch (expected[i].l.keytype) { case KEY_RSA: - case KEY_DSA: case KEY_ECDSA: continue; } @@ -204,23 +192,9 @@ struct expected expected_full[] = { NULL, /* comment */ 0, /* note */ } }, - { "dsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { - NULL, - 2, - HKF_STATUS_OK, - 0, - NULL, - MRK_NONE, - "sisyphus.example.com", - NULL, - KEY_DSA, - NULL, /* filled at runtime */ - "DSA #1", - 0, - } }, { "ecdsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, - 3, + 2, HKF_STATUS_OK, 0, NULL, @@ -234,7 +208,7 @@ struct expected expected_full[] = { } }, { "ed25519_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, - 4, + 3, HKF_STATUS_OK, 0, NULL, @@ -248,7 +222,7 @@ struct expected expected_full[] = { } }, { "rsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, - 5, + 4, HKF_STATUS_OK, 0, NULL, @@ -262,7 +236,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 6, + 5, HKF_STATUS_COMMENT, 0, "", @@ -276,7 +250,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 7, + 6, HKF_STATUS_COMMENT, 0, "# Plain host keys, hostnames + addresses", @@ -288,23 +262,9 @@ struct expected expected_full[] = { NULL, 0, } }, - { "dsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, { - NULL, - 8, - HKF_STATUS_OK, - 0, - NULL, - MRK_NONE, - "prometheus.example.com,192.0.2.1,2001:db8::1", - NULL, - KEY_DSA, - NULL, /* filled at runtime */ - "DSA #2", - 0, - } }, { "ecdsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, - 9, + 7, HKF_STATUS_OK, 0, NULL, @@ -318,7 +278,7 @@ struct expected expected_full[] = { } }, { "ed25519_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, - 10, + 8, HKF_STATUS_OK, 0, NULL, @@ -332,7 +292,7 @@ struct expected expected_full[] = { } }, { "rsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, - 11, + 9, HKF_STATUS_OK, 0, NULL, @@ -346,7 +306,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 12, + 10, HKF_STATUS_COMMENT, 0, "", @@ -360,7 +320,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 13, + 11, HKF_STATUS_COMMENT, 0, "# Some hosts with wildcard names / IPs", @@ -372,23 +332,9 @@ struct expected expected_full[] = { NULL, 0, } }, - { "dsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, { - NULL, - 14, - HKF_STATUS_OK, - 0, - NULL, - MRK_NONE, - "*.example.com,192.0.2.*,2001:*", - NULL, - KEY_DSA, - NULL, /* filled at runtime */ - "DSA #3", - 0, - } }, { "ecdsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, - 15, + 12, HKF_STATUS_OK, 0, NULL, @@ -402,7 +348,7 @@ struct expected expected_full[] = { } }, { "ed25519_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, - 16, + 13, HKF_STATUS_OK, 0, NULL, @@ -416,7 +362,7 @@ struct expected expected_full[] = { } }, { "rsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, { NULL, - 17, + 14, HKF_STATUS_OK, 0, NULL, @@ -430,7 +376,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 18, + 15, HKF_STATUS_COMMENT, 0, "", @@ -444,7 +390,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 19, + 16, HKF_STATUS_COMMENT, 0, "# Hashed hostname and address entries", @@ -456,23 +402,9 @@ struct expected expected_full[] = { NULL, 0, } }, - { "dsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, { - NULL, - 20, - HKF_STATUS_OK, - 0, - NULL, - MRK_NONE, - NULL, - NULL, - KEY_DSA, - NULL, /* filled at runtime */ - "DSA #5", - 0, - } }, { "ecdsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, { NULL, - 21, + 17, HKF_STATUS_OK, 0, NULL, @@ -486,7 +418,7 @@ struct expected expected_full[] = { } }, { "ed25519_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, { NULL, - 22, + 18, HKF_STATUS_OK, 0, NULL, @@ -500,7 +432,7 @@ struct expected expected_full[] = { } }, { "rsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, { NULL, - 23, + 19, HKF_STATUS_OK, 0, NULL, @@ -514,7 +446,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 24, + 20, HKF_STATUS_COMMENT, 0, "", @@ -531,51 +463,9 @@ struct expected expected_full[] = { * hostname and addresses in the pre-hashed known_hosts are split * to separate lines. */ - { "dsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, { - NULL, - 25, - HKF_STATUS_OK, - 0, - NULL, - MRK_NONE, - NULL, - NULL, - KEY_DSA, - NULL, /* filled at runtime */ - "DSA #6", - 0, - } }, - { "dsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, { - NULL, - 26, - HKF_STATUS_OK, - 0, - NULL, - MRK_NONE, - NULL, - NULL, - KEY_DSA, - NULL, /* filled at runtime */ - "DSA #6", - 0, - } }, - { "dsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, { - NULL, - 27, - HKF_STATUS_OK, - 0, - NULL, - MRK_NONE, - NULL, - NULL, - KEY_DSA, - NULL, /* filled at runtime */ - "DSA #6", - 0, - } }, { "ecdsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, { NULL, - 28, + 21, HKF_STATUS_OK, 0, NULL, @@ -589,7 +479,7 @@ struct expected expected_full[] = { } }, { "ecdsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, { NULL, - 29, + 22, HKF_STATUS_OK, 0, NULL, @@ -603,7 +493,7 @@ struct expected expected_full[] = { } }, { "ecdsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, { NULL, - 30, + 23, HKF_STATUS_OK, 0, NULL, @@ -617,7 +507,7 @@ struct expected expected_full[] = { } }, { "ed25519_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, { NULL, - 31, + 24, HKF_STATUS_OK, 0, NULL, @@ -631,7 +521,7 @@ struct expected expected_full[] = { } }, { "ed25519_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, { NULL, - 32, + 25, HKF_STATUS_OK, 0, NULL, @@ -645,7 +535,7 @@ struct expected expected_full[] = { } }, { "ed25519_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, { NULL, - 33, + 26, HKF_STATUS_OK, 0, NULL, @@ -659,7 +549,7 @@ struct expected expected_full[] = { } }, { "rsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, { NULL, - 34, + 27, HKF_STATUS_OK, 0, NULL, @@ -673,7 +563,7 @@ struct expected expected_full[] = { } }, { "rsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, { NULL, - 35, + 28, HKF_STATUS_OK, 0, NULL, @@ -687,7 +577,7 @@ struct expected expected_full[] = { } }, { "rsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, { NULL, - 36, + 29, HKF_STATUS_OK, 0, NULL, @@ -701,7 +591,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 37, + 30, HKF_STATUS_COMMENT, 0, "", @@ -715,7 +605,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 38, + 31, HKF_STATUS_COMMENT, 0, "", @@ -729,7 +619,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 39, + 32, HKF_STATUS_COMMENT, 0, "# Revoked and CA keys", @@ -743,7 +633,7 @@ struct expected expected_full[] = { } }, { "ed25519_4.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, - 40, + 33, HKF_STATUS_OK, 0, NULL, @@ -757,7 +647,7 @@ struct expected expected_full[] = { } }, { "ecdsa_4.pub" , -1, -1, HKF_MATCH_HOST, 0, 0, 0, -1, { NULL, - 41, + 34, HKF_STATUS_OK, 0, NULL, @@ -769,23 +659,9 @@ struct expected expected_full[] = { "ECDSA #4", 0, } }, - { "dsa_4.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, 0, 0, -1, { - NULL, - 42, - HKF_STATUS_OK, - 0, - NULL, - MRK_CA, - "*.example.com", - NULL, - KEY_DSA, - NULL, /* filled at runtime */ - "DSA #4", - 0, - } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 43, + 35, HKF_STATUS_COMMENT, 0, "", @@ -799,7 +675,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 44, + 36, HKF_STATUS_COMMENT, 0, "# Some invalid lines", @@ -813,7 +689,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, 0, 0, 0, -1, { NULL, - 45, + 37, HKF_STATUS_INVALID, 0, NULL, @@ -827,7 +703,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, - 46, + 38, HKF_STATUS_INVALID, 0, NULL, @@ -841,7 +717,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, HKF_MATCH_HOST, 0, 0, 0, -1, { NULL, - 47, + 39, HKF_STATUS_INVALID, 0, NULL, @@ -853,9 +729,9 @@ struct expected expected_full[] = { NULL, 0, } }, - { NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { + { NULL, HKF_STATUS_OK, KEY_ED25519, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, - 48, + 40, HKF_STATUS_INVALID, /* Would be ok if key not parsed */ 0, NULL, @@ -869,7 +745,7 @@ struct expected expected_full[] = { } }, { NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, { NULL, - 49, + 41, HKF_STATUS_INVALID, 0, NULL, @@ -883,7 +759,7 @@ struct expected expected_full[] = { } }, { NULL, HKF_STATUS_OK, KEY_RSA, HKF_MATCH_HOST, 0, 0, 0, -1, { NULL, - 50, + 42, HKF_STATUS_INVALID, /* Would be ok if key not parsed */ 0, NULL, diff --git a/regress/unittests/hostkeys/testdata/dsa_1.pub b/regress/unittests/hostkeys/testdata/dsa_1.pub deleted file mode 100644 index 56e1e3714625..000000000000 --- a/regress/unittests/hostkeys/testdata/dsa_1.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-dss AAAAB3NzaC1kc3MAAACBAOqffHxEW4c+Z9q/r3l4sYK8F7qrBsU8XF9upGsW62T9InROFFq9IO0x3pQ6mDA0Wtw0sqcDmkPCHPyP4Ok/fU3/drLaZusHoVYu8pBBrWsIDrKgkeX9TEodBsSrYdl4Sqtqq9EZv9+DttV6LStZrgYyUTOKwOF95wGantpLynX5AAAAFQDdt+zjRNlETDsgmxcSYFgREirJrQAAAIBQlrPaiPhR24FhnMLcHH4016vL7AqDDID6Qw7PhbXGa4/XlxWMIigjBKrIPKvnZ6p712LSnCKtcbfdx0MtmJlNa01CYqPaRhgRaf+uGdvTkTUcdaq8R5lLJL+JMNwUhcC8ijm3NqEjXjffuebGe1EzIeiITbA7Nndcd+GytwRDegAAAIEAkRYPjSVcUxfUHhHdpP6V8CuY1+CYSs9EPJ7iiWTDuXWVIBTU32oJLAnrmAcOwtIzEfPvm+rff5FI/Yhon2pB3VTXhPPEBjYzE5qANanAT4e6tzAVc5f3DUhHaDknwRYfDz86GFvuLtDjeE/UZ9t6OofYoEsCBpYozLAprBvNIQY= DSA #1 diff --git a/regress/unittests/hostkeys/testdata/dsa_2.pub b/regress/unittests/hostkeys/testdata/dsa_2.pub deleted file mode 100644 index 394e0bf00255..000000000000 --- a/regress/unittests/hostkeys/testdata/dsa_2.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-dss AAAAB3NzaC1kc3MAAACBAI38Hy/61/O5Bp6yUG8J5XQCeNjRS0xvjlCdzKLyXCueMa+L+X2L/u9PWUsy5SVbTjGgpB8sF6UkCNsV+va7S8zCCHas2MZ7GPlxP6GZBkRPTIFR0N/Pu7wfBzDQz0t0iL4VmxBfTBQv/SxkGWZg+yHihIQP9fwdSAwD/7aVh6ItAAAAFQDSyihIUlINlswM0PJ8wXSti3yIMwAAAIB+oqzaB6ozqs8YxpN5oQOBa/9HEBQEsp8RSIlQmVubXRNgktp42n+Ii1waU9UUk8DX5ahhIeR6B7ojWkqmDAji4SKpoHf4kmr6HvYo85ZSTSx0W4YK/gJHSpDJwhlT52tAfb1JCbWSObjl09B4STv7KedCHcR5oXQvvrV+XoKOSAAAAIAue/EXrs2INw1RfaKNHC0oqOMxmRitv0BFMuNVPo1VDj39CE5kA7AHjwvS1TNeaHtK5Hhgeb6vsmLmNPTOc8xCob0ilyQbt9O0GbONeF2Ge7D2UJyULA/hxql+tCYFIC6yUrmo35fF9XiNisXLoaflk9fjp7ROWWVwnki/jstaQw== DSA #2 diff --git a/regress/unittests/hostkeys/testdata/dsa_3.pub b/regress/unittests/hostkeys/testdata/dsa_3.pub deleted file mode 100644 index e506ea42253a..000000000000 --- a/regress/unittests/hostkeys/testdata/dsa_3.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-dss AAAAB3NzaC1kc3MAAACBAI6lz2Ip9bzE7TGuDD4SjO9S4Ac90gq0h6ai1O06eI8t/Ot2uJ5Jk2QyVr2jvIZHDl/5bwBx7+5oyjlwRoUrAPPD814wf5tU2tSnmdu1Wbf0cBswif5q0r4tevzmopp/AtgH11QHo3u0/pfyJd10qBDLV2FaYSKMmZvyPfZJ0s9pAAAAFQD5Eqjl6Rx2qVePodD9OwAPT0bU6wAAAIAfnDm6csZF0sFaJR3NIJvaYgSGr8s7cqlsk2gLltB/1wOOO2yX+NeEC+B0H93hlMfaUsPa08bwgmYxnavSMqEBpmtPceefJiEd68zwYqXd38f88wyWZ9Z5iwaI/6OVZPHzCbDxOa4ewVTevRNYUKP1xUTZNT8/gSMfZLYPk4T2AQAAAIAUKroozRMyV+3V/rxt0gFnNxRXBKk+9cl3vgsQ7ktkI9cYg7V1T2K0XF21AVMK9gODszy6PBJjV6ruXBV6TRiqIbQauivp3bHHKYsG6wiJNqwdbVwIjfvv8nn1qFoZQLXG3sdONr9NwN8KzrX89OV0BlR2dVM5qqp+YxOXymP9yg== DSA #3 diff --git a/regress/unittests/hostkeys/testdata/dsa_4.pub b/regress/unittests/hostkeys/testdata/dsa_4.pub deleted file mode 100644 index 8552c3819287..000000000000 --- a/regress/unittests/hostkeys/testdata/dsa_4.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-dss AAAAB3NzaC1kc3MAAACBAKvjnFHm0VvMr5h2Zu3nURsxQKGoxm+DCzYDxRYcilK07Cm5c4XTrFbA2X86+9sGs++W7QRMcTJUYIg0a+UtIMtAjwORd6ZPXM2K5dBW+gh1oHyvKi767tWX7I2c+1ZPJDY95mUUfZQUEfdy9eGDSBmw/pSsveQ1ur6XNUh/MtP/AAAAFQDHnXk/9jBJAdce1pHtLWnbdPSGdQAAAIEAm2OLy8tZBfiEO3c3X1yyB/GTcDwrQCqRMDkhnsmrliec3dWkOfNTzu+MrdvF8ymTWLEqPpbMheYtvNyZ3TF0HO5W7aVBpdGZbOdOAIfB+6skqGbI8A5Up1d7dak/bSsqL2r5NjwbDOdq+1hBzzvbl/qjh+sQarV2zHrpKoQaV28AAACANtkBVedBbqIAdphCrN/LbUi9WlyuF9UZz+tlpVLYrj8GJVwnplV2tvOmUw6yP5/pzCimTsao8dpL5PWxm7fKxLWVxA+lEsA4WeC885CiZn8xhdaJOCN+NyJ2bqkz+4VPI7oDGBm0aFwUqJn+M1PiSgvI50XdF2dBsFRTRNY0wzA= DSA #4 diff --git a/regress/unittests/hostkeys/testdata/dsa_5.pub b/regress/unittests/hostkeys/testdata/dsa_5.pub deleted file mode 100644 index 149e1efd166b..000000000000 --- a/regress/unittests/hostkeys/testdata/dsa_5.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-dss AAAAB3NzaC1kc3MAAACBALrFy7w5ihlaOG+qR+6fj+vm5EQaO3qwxgACLcgH+VfShuOG4mkx8qFJmf+OZ3fh5iKngjNZfKtfcqI7zHWdk6378TQfQC52/kbZukjNXOLCpyNkogahcjA00onIoTK1RUDuMW28edAHwPFbpttXDTaqis+8JPMY8hZwsZGENCzTAAAAFQD6+It5vozwGgaN9ROYPMlByhi6jwAAAIBz2mcAC694vNzz9b6614gkX9d9E99PzJYfU1MPkXDziKg7MrjBw7Opd5y1jL09S3iL6lSTlHkKwVKvQ3pOwWRwXXRrKVus4I0STveoApm526jmp6mY0YEtqR98vMJ0v97h1ydt8FikKlihefCsnXVicb8887PXs2Y8C6GuFT3tfQAAAIBbmHtV5tPcrMRDkULhaQ/Whap2VKvT2DUhIHA7lx6oy/KpkltOpxDZOIGUHKqffGbiR7Jh01/y090AY5L2eCf0S2Ytx93+eADwVVpJbFJo6zSwfeey2Gm6L2oA+rCz9zTdmtZoekpD3/RAOQjnJIAPwbs7mXwabZTw4xRtiYIRrw== DSA #5 diff --git a/regress/unittests/hostkeys/testdata/dsa_6.pub b/regress/unittests/hostkeys/testdata/dsa_6.pub deleted file mode 100644 index edbb97643d26..000000000000 --- a/regress/unittests/hostkeys/testdata/dsa_6.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-dss AAAAB3NzaC1kc3MAAACBAIutigAse65TCW6hHDOEGXenE9L4L0talHbs65hj3UUNtWflKdQeXLofqXgW8AwaDKmnuRPrxRoxVNXj84n45wtBEdt4ztmdAZteAbXSnHqpcxME3jDxh3EtxzGPXLs+RUmKPVguraSgo7W2oN7KFx6VM+AcAtxANSTlvDid3s47AAAAFQCd9Q3kkHSLWe77sW0eRaayI45ovwAAAIAw6srGF6xvFasI44Y3r9JJ2K+3ezozl3ldL3p2+p2HG3iWafC4SdV8pB6ZIxKlYAywiiFb3LzH/JweGFq1jtoFDRM3MlYORBevydU4zPz7b5QLDVB0sY4evYtWmg2BFJvoWRfhLnlZVW7h5N8v4fNIwdVmVsw4Ljes7iF2HRGhHgAAAIBDFT3fww2Oby1xUA6G9pDAcVikrQFqp1sJRylNTUyeyQ37SNAGzYxwHJFgQr8gZLdRQ1UW+idYpqVbVNcYFMOiw/zSqK2OfVwPZ9U+TTKdc992ChSup6vJEKM/ZVIyDWDbJr7igQ4ahy7jo9mFvm8ljN926EnspQzCvs0Dxk6tHA== DSA #6 diff --git a/regress/unittests/hostkeys/testdata/known_hosts b/regress/unittests/hostkeys/testdata/known_hosts index 4446f45dffe8..5298e3eebb3d 100644 --- a/regress/unittests/hostkeys/testdata/known_hosts +++ b/regress/unittests/hostkeys/testdata/known_hosts @@ -1,30 +1,23 @@ # Plain host keys, plain host names -sisyphus.example.com ssh-dss AAAAB3NzaC1kc3MAAACBAOqffHxEW4c+Z9q/r3l4sYK8F7qrBsU8XF9upGsW62T9InROFFq9IO0x3pQ6mDA0Wtw0sqcDmkPCHPyP4Ok/fU3/drLaZusHoVYu8pBBrWsIDrKgkeX9TEodBsSrYdl4Sqtqq9EZv9+DttV6LStZrgYyUTOKwOF95wGantpLynX5AAAAFQDdt+zjRNlETDsgmxcSYFgREirJrQAAAIBQlrPaiPhR24FhnMLcHH4016vL7AqDDID6Qw7PhbXGa4/XlxWMIigjBKrIPKvnZ6p712LSnCKtcbfdx0MtmJlNa01CYqPaRhgRaf+uGdvTkTUcdaq8R5lLJL+JMNwUhcC8ijm3NqEjXjffuebGe1EzIeiITbA7Nndcd+GytwRDegAAAIEAkRYPjSVcUxfUHhHdpP6V8CuY1+CYSs9EPJ7iiWTDuXWVIBTU32oJLAnrmAcOwtIzEfPvm+rff5FI/Yhon2pB3VTXhPPEBjYzE5qANanAT4e6tzAVc5f3DUhHaDknwRYfDz86GFvuLtDjeE/UZ9t6OofYoEsCBpYozLAprBvNIQY= DSA #1 sisyphus.example.com ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBF6yQEtD9yBw9gmDRf477WBBzvWhAa0ioBI3nbA4emKykj0RbuQd5C4XdQAEOZGzE7v//FcCjwB2wi+JH5eKkxCtN6CjohDASZ1huoIV2UVyYIicZJEEOg1IWjjphvaxtw== ECDSA #1 sisyphus.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK9ks7jkua5YWIwByRnnnc6UPJQWI75O0e/UJdPYU1JI ED25519 #1 sisyphus.example.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDg4hB4vAZHJ0PVRiJajOv/GlytFWNpv5/9xgB9+5BIbvp8LOrFZ5D9K0Gsmwpd4G4rfaAz8j896DhMArg0vtkilIPPGt/6VzWMERgvaIQPJ/IE99X3+fjcAG56oAWwy29JX10lQMzBPU6XJIaN/zqpkb6qUBiAHBdLpxrFBBU0/w== RSA #1 # Plain host keys, hostnames + addresses -prometheus.example.com,192.0.2.1,2001:db8::1 ssh-dss AAAAB3NzaC1kc3MAAACBAI38Hy/61/O5Bp6yUG8J5XQCeNjRS0xvjlCdzKLyXCueMa+L+X2L/u9PWUsy5SVbTjGgpB8sF6UkCNsV+va7S8zCCHas2MZ7GPlxP6GZBkRPTIFR0N/Pu7wfBzDQz0t0iL4VmxBfTBQv/SxkGWZg+yHihIQP9fwdSAwD/7aVh6ItAAAAFQDSyihIUlINlswM0PJ8wXSti3yIMwAAAIB+oqzaB6ozqs8YxpN5oQOBa/9HEBQEsp8RSIlQmVubXRNgktp42n+Ii1waU9UUk8DX5ahhIeR6B7ojWkqmDAji4SKpoHf4kmr6HvYo85ZSTSx0W4YK/gJHSpDJwhlT52tAfb1JCbWSObjl09B4STv7KedCHcR5oXQvvrV+XoKOSAAAAIAue/EXrs2INw1RfaKNHC0oqOMxmRitv0BFMuNVPo1VDj39CE5kA7AHjwvS1TNeaHtK5Hhgeb6vsmLmNPTOc8xCob0ilyQbt9O0GbONeF2Ge7D2UJyULA/hxql+tCYFIC6yUrmo35fF9XiNisXLoaflk9fjp7ROWWVwnki/jstaQw== DSA #2 prometheus.example.com,192.0.2.1,2001:db8::1 ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAB8qVcXwgBM92NCmReQlPrZAoui4Bz/mW0VUBFOpHXXW1n+15b/Y7Pc6UBd/ITTZmaBciXY+PWaSBGdwc5GdqGdLgFyJ/QAGrFMPNpVutm/82gNQzlxpNwjbMcKyiZEXzSgnjS6DzMQ0WuSMdzIBXq8OW/Kafxg4ZkU6YqALUXxlQMZuQ== ECDSA #2 prometheus.example.com,192.0.2.1,2001:db8::1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBp6PVW0z2o9C4Ukv/JOgmK7QMFe1pD1s3ADFF7IQob ED25519 #2 prometheus.example.com,192.0.2.1,2001:db8::1 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDmbUhNabB5AmBDX6GNHZ3lbn7pRxqfpW+f53QqNGlK0sLV+0gkMIrOfUp1kdE2ZLE6tfzdicatj/RlH6/wuo4yyYb+Pyx3G0vxdmAIiA4aANq38XweDucBC0TZkRWVHK+Gs5V/uV0z7N0axJvkkJujMLvST3CRiiWwlficBc6yVQ== RSA #2 # Some hosts with wildcard names / IPs -*.example.com,192.0.2.*,2001:* ssh-dss AAAAB3NzaC1kc3MAAACBAI6lz2Ip9bzE7TGuDD4SjO9S4Ac90gq0h6ai1O06eI8t/Ot2uJ5Jk2QyVr2jvIZHDl/5bwBx7+5oyjlwRoUrAPPD814wf5tU2tSnmdu1Wbf0cBswif5q0r4tevzmopp/AtgH11QHo3u0/pfyJd10qBDLV2FaYSKMmZvyPfZJ0s9pAAAAFQD5Eqjl6Rx2qVePodD9OwAPT0bU6wAAAIAfnDm6csZF0sFaJR3NIJvaYgSGr8s7cqlsk2gLltB/1wOOO2yX+NeEC+B0H93hlMfaUsPa08bwgmYxnavSMqEBpmtPceefJiEd68zwYqXd38f88wyWZ9Z5iwaI/6OVZPHzCbDxOa4ewVTevRNYUKP1xUTZNT8/gSMfZLYPk4T2AQAAAIAUKroozRMyV+3V/rxt0gFnNxRXBKk+9cl3vgsQ7ktkI9cYg7V1T2K0XF21AVMK9gODszy6PBJjV6ruXBV6TRiqIbQauivp3bHHKYsG6wiJNqwdbVwIjfvv8nn1qFoZQLXG3sdONr9NwN8KzrX89OV0BlR2dVM5qqp+YxOXymP9yg== DSA #3 *.example.com,192.0.2.*,2001:* ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIb3BhJZk+vUQPg5TQc1koIzuGqloCq7wjr9LjlhG24IBeiFHLsdWw74HDlH4DrOmlxToVYk2lTdnjARleRByjk= ECDSA #3 *.example.com,192.0.2.*,2001:* ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlYfExtYZAPqYvYdrlpGlSWhh/XNHcH3v3c2JzsVNbB ED25519 #3 *.example.com,192.0.2.*,2001:* ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDX8F93W3SH4ZSus4XUQ2cw9dqcuyUETTlKEeGv3zlknV3YCoe2Mp04naDhiuwj8sOsytrZSESzLY1ZEyzrjxE6ZFVv8NKgck/AbRjcwlRFOcx9oKUxOrXRa0IoXlTq0kyjKCJfaHBKnGitZThknCPTbVmpATkm5xx6J0WEDozfoQ== RSA #3 # Hashed hostname and address entries -|1|z3xOIdT5ue3Vuf3MzT67kaioqjw=|GZhhe5uwDOBQrC9N4cCjpbLpSn4= ssh-dss AAAAB3NzaC1kc3MAAACBALrFy7w5ihlaOG+qR+6fj+vm5EQaO3qwxgACLcgH+VfShuOG4mkx8qFJmf+OZ3fh5iKngjNZfKtfcqI7zHWdk6378TQfQC52/kbZukjNXOLCpyNkogahcjA00onIoTK1RUDuMW28edAHwPFbpttXDTaqis+8JPMY8hZwsZGENCzTAAAAFQD6+It5vozwGgaN9ROYPMlByhi6jwAAAIBz2mcAC694vNzz9b6614gkX9d9E99PzJYfU1MPkXDziKg7MrjBw7Opd5y1jL09S3iL6lSTlHkKwVKvQ3pOwWRwXXRrKVus4I0STveoApm526jmp6mY0YEtqR98vMJ0v97h1ydt8FikKlihefCsnXVicb8887PXs2Y8C6GuFT3tfQAAAIBbmHtV5tPcrMRDkULhaQ/Whap2VKvT2DUhIHA7lx6oy/KpkltOpxDZOIGUHKqffGbiR7Jh01/y090AY5L2eCf0S2Ytx93+eADwVVpJbFJo6zSwfeey2Gm6L2oA+rCz9zTdmtZoekpD3/RAOQjnJIAPwbs7mXwabZTw4xRtiYIRrw== DSA #5 |1|B7t/AYabn8zgwU47Cb4A/Nqt3eI=|arQPZyRphkzisr7w6wwikvhaOyE= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIudcagzq4QPtP1jkpje34+0POLB0jwT64hqrbCqhTH2T800KDZ0h2vwlJYa3OP3Oqru9AB5pnuHsKw7mAhUGY= ECDSA #5 |1|JR81WxEocTP5d7goIRkl8fHBbno=|l6sj6FOsoXxgEZMzn/BnOfPKN68= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINf63qSV8rD57N+digID8t28WVhd3Yf2K2UhaoG8TsWQ ED25519 #5 |1|W7x4zY6KtTZJgsopyOusJqvVPag=|QauLt7hKezBZFZi2i4Xopho7Nsk= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC/C15Q4sfnk7BZff1er8bscay+5s51oD4eWArlHWMK/ZfYeeTAccTy+7B7Jv+MS4nKCpflrvJI2RQz4kS8vF0ATdBbi4jeWefStlHNg0HLhnCY7NAfDIlRdaN9lm3Pqm2vmr+CkqwcJaSpycDg8nPN9yNAuD6pv7NDuUnECezojQ== RSA #5 -|1|mxnU8luzqWLvfVi5qBm5xVIyCRM=|9Epopft7LBd80Bf6RmWPIpwa8yU= ssh-dss AAAAB3NzaC1kc3MAAACBAIutigAse65TCW6hHDOEGXenE9L4L0talHbs65hj3UUNtWflKdQeXLofqXgW8AwaDKmnuRPrxRoxVNXj84n45wtBEdt4ztmdAZteAbXSnHqpcxME3jDxh3EtxzGPXLs+RUmKPVguraSgo7W2oN7KFx6VM+AcAtxANSTlvDid3s47AAAAFQCd9Q3kkHSLWe77sW0eRaayI45ovwAAAIAw6srGF6xvFasI44Y3r9JJ2K+3ezozl3ldL3p2+p2HG3iWafC4SdV8pB6ZIxKlYAywiiFb3LzH/JweGFq1jtoFDRM3MlYORBevydU4zPz7b5QLDVB0sY4evYtWmg2BFJvoWRfhLnlZVW7h5N8v4fNIwdVmVsw4Ljes7iF2HRGhHgAAAIBDFT3fww2Oby1xUA6G9pDAcVikrQFqp1sJRylNTUyeyQ37SNAGzYxwHJFgQr8gZLdRQ1UW+idYpqVbVNcYFMOiw/zSqK2OfVwPZ9U+TTKdc992ChSup6vJEKM/ZVIyDWDbJr7igQ4ahy7jo9mFvm8ljN926EnspQzCvs0Dxk6tHA== DSA #6 -|1|klvLmvh2vCpkNMDEjVvrE8SJWTg=|e/dqEEBLnbgqmwEesl4cDRu/7TM= ssh-dss AAAAB3NzaC1kc3MAAACBAIutigAse65TCW6hHDOEGXenE9L4L0talHbs65hj3UUNtWflKdQeXLofqXgW8AwaDKmnuRPrxRoxVNXj84n45wtBEdt4ztmdAZteAbXSnHqpcxME3jDxh3EtxzGPXLs+RUmKPVguraSgo7W2oN7KFx6VM+AcAtxANSTlvDid3s47AAAAFQCd9Q3kkHSLWe77sW0eRaayI45ovwAAAIAw6srGF6xvFasI44Y3r9JJ2K+3ezozl3ldL3p2+p2HG3iWafC4SdV8pB6ZIxKlYAywiiFb3LzH/JweGFq1jtoFDRM3MlYORBevydU4zPz7b5QLDVB0sY4evYtWmg2BFJvoWRfhLnlZVW7h5N8v4fNIwdVmVsw4Ljes7iF2HRGhHgAAAIBDFT3fww2Oby1xUA6G9pDAcVikrQFqp1sJRylNTUyeyQ37SNAGzYxwHJFgQr8gZLdRQ1UW+idYpqVbVNcYFMOiw/zSqK2OfVwPZ9U+TTKdc992ChSup6vJEKM/ZVIyDWDbJr7igQ4ahy7jo9mFvm8ljN926EnspQzCvs0Dxk6tHA== DSA #6 -|1|wsk3ddB3UjuxEsoeNCeZjZ6NvZs=|O3O/q2Z/u7DrxoTiIq6kzCevQT0= ssh-dss AAAAB3NzaC1kc3MAAACBAIutigAse65TCW6hHDOEGXenE9L4L0talHbs65hj3UUNtWflKdQeXLofqXgW8AwaDKmnuRPrxRoxVNXj84n45wtBEdt4ztmdAZteAbXSnHqpcxME3jDxh3EtxzGPXLs+RUmKPVguraSgo7W2oN7KFx6VM+AcAtxANSTlvDid3s47AAAAFQCd9Q3kkHSLWe77sW0eRaayI45ovwAAAIAw6srGF6xvFasI44Y3r9JJ2K+3ezozl3ldL3p2+p2HG3iWafC4SdV8pB6ZIxKlYAywiiFb3LzH/JweGFq1jtoFDRM3MlYORBevydU4zPz7b5QLDVB0sY4evYtWmg2BFJvoWRfhLnlZVW7h5N8v4fNIwdVmVsw4Ljes7iF2HRGhHgAAAIBDFT3fww2Oby1xUA6G9pDAcVikrQFqp1sJRylNTUyeyQ37SNAGzYxwHJFgQr8gZLdRQ1UW+idYpqVbVNcYFMOiw/zSqK2OfVwPZ9U+TTKdc992ChSup6vJEKM/ZVIyDWDbJr7igQ4ahy7jo9mFvm8ljN926EnspQzCvs0Dxk6tHA== DSA #6 |1|B8epmkLSni+vGZDijr/EwxeR2k4=|7ct8yzNOVJhKm3ZD2w0XIT7df8E= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK1wRLyKtvK3Mmhd0XPkKwW4ev1KBVf8J4aG8lESq1TsaqqfOXYGyxMq5pN8fCGiD5UPOqyTYz/ZNzClRhJRHao= ECDSA #6 |1|JojD885UhYhbCu571rgyM/5PpYU=|BJaU2aE1FebQZy3B5tzTDRWFRG0= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK1wRLyKtvK3Mmhd0XPkKwW4ev1KBVf8J4aG8lESq1TsaqqfOXYGyxMq5pN8fCGiD5UPOqyTYz/ZNzClRhJRHao= ECDSA #6 |1|5t7UDHDybVrDZVQPCpwdnr6nk4k=|EqJ73W/veIL3H2x+YWHcJxI5ETA= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK1wRLyKtvK3Mmhd0XPkKwW4ev1KBVf8J4aG8lESq1TsaqqfOXYGyxMq5pN8fCGiD5UPOqyTYz/ZNzClRhJRHao= ECDSA #6 @@ -39,12 +32,11 @@ prometheus.example.com,192.0.2.1,2001:db8::1 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAA # Revoked and CA keys @revoked sisyphus.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDFP8L9REfN/iYy1KIRtFqSCn3V2+vOCpoZYENFGLdOF ED25519 #4 @cert-authority prometheus.example.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHZd0OXHIWwK3xnjAdMZ1tojxWycdu38pORO/UX5cqsKMgGCKQVBWWO3TFk1ePkGIE9VMWT1hCGqWRRwYlH+dSE= ECDSA #4 -@cert-authority *.example.com ssh-dss AAAAB3NzaC1kc3MAAACBAKvjnFHm0VvMr5h2Zu3nURsxQKGoxm+DCzYDxRYcilK07Cm5c4XTrFbA2X86+9sGs++W7QRMcTJUYIg0a+UtIMtAjwORd6ZPXM2K5dBW+gh1oHyvKi767tWX7I2c+1ZPJDY95mUUfZQUEfdy9eGDSBmw/pSsveQ1ur6XNUh/MtP/AAAAFQDHnXk/9jBJAdce1pHtLWnbdPSGdQAAAIEAm2OLy8tZBfiEO3c3X1yyB/GTcDwrQCqRMDkhnsmrliec3dWkOfNTzu+MrdvF8ymTWLEqPpbMheYtvNyZ3TF0HO5W7aVBpdGZbOdOAIfB+6skqGbI8A5Up1d7dak/bSsqL2r5NjwbDOdq+1hBzzvbl/qjh+sQarV2zHrpKoQaV28AAACANtkBVedBbqIAdphCrN/LbUi9WlyuF9UZz+tlpVLYrj8GJVwnplV2tvOmUw6yP5/pzCimTsao8dpL5PWxm7fKxLWVxA+lEsA4WeC885CiZn8xhdaJOCN+NyJ2bqkz+4VPI7oDGBm0aFwUqJn+M1PiSgvI50XdF2dBsFRTRNY0wzA= DSA #4 # Some invalid lines -@what sisyphus.example.com ssh-dss AAAAB3NzaC1kc3MAAACBAOqffHxEW4c+Z9q/r3l4sYK8F7qrBsU8XF9upGsW62T9InROFFq9IO0x3pQ6mDA0Wtw0sqcDmkPCHPyP4Ok/fU3/drLaZusHoVYu8pBBrWsIDrKgkeX9TEodBsSrYdl4Sqtqq9EZv9+DttV6LStZrgYyUTOKwOF95wGantpLynX5AAAAFQDdt+zjRNlETDsgmxcSYFgREirJrQAAAIBQlrPaiPhR24FhnMLcHH4016vL7AqDDID6Qw7PhbXGa4/XlxWMIigjBKrIPKvnZ6p712LSnCKtcbfdx0MtmJlNa01CYqPaRhgRaf+uGdvTkTUcdaq8R5lLJL+JMNwUhcC8ijm3NqEjXjffuebGe1EzIeiITbA7Nndcd+GytwRDegAAAIEAkRYPjSVcUxfUHhHdpP6V8CuY1+CYSs9EPJ7iiWTDuXWVIBTU32oJLAnrmAcOwtIzEfPvm+rff5FI/Yhon2pB3VTXhPPEBjYzE5qANanAT4e6tzAVc5f3DUhHaDknwRYfDz86GFvuLtDjeE/UZ9t6OofYoEsCBpYozLAprBvNIQY= DSA #1 +@what ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDg4hB4vAZHJ0PVRiJajOv/GlytFWNpv5/9xgB9+5BIbvp8LOrFZ5D9K0Gsmwpd4G4rfaAz8j896DhMArg0vtkilIPPGt/6VzWMERgvaIQPJ/IE99X3+fjcAG56oAWwy29JX10lQMzBPU6XJIaN/zqpkb6qUBiAHBdLpxrFBBU0/w== RSA #1 sisyphus.example.com prometheus.example.com ssh-ed25519 -sisyphus.example.com ssh-dsa AAAATgAAAAdz +sisyphus.example.com ssh-ed25519 AAAATgAAAAdz sisyphus.example.com ssh-XXX AAAATgAAAAdzc2gtWFhYAAAAP0ZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRg== prometheus.example.com ssh-rsa AAAATgAAAAdzc2gtWFhYAAAAP0ZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRg== diff --git a/regress/unittests/hostkeys/tests.c b/regress/unittests/hostkeys/tests.c index 92c7646ad164..c6e17fad09cb 100644 --- a/regress/unittests/hostkeys/tests.c +++ b/regress/unittests/hostkeys/tests.c @@ -1,10 +1,16 @@ -/* $OpenBSD: tests.c,v 1.1 2015/02/16 22:18:34 djm Exp $ */ +/* $OpenBSD: tests.c,v 1.2 2025/04/15 04:00:42 djm Exp $ */ /* * Regress test for known_hosts-related API. * * Placed in the public domain */ +#include "includes.h" + +#include + +#include "../test_helper/test_helper.h" + void tests(void); void test_iterate(void); /* test_iterate.c */ @@ -14,3 +20,8 @@ tests(void) test_iterate(); } +void +benchmarks(void) +{ + printf("no benchmarks\n"); +} diff --git a/regress/unittests/kex/Makefile b/regress/unittests/kex/Makefile index ca4f0ee38639..645fb0609733 100644 --- a/regress/unittests/kex/Makefile +++ b/regress/unittests/kex/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.16 2024/09/09 03:13:39 djm Exp $ +# $OpenBSD: Makefile,v 1.18 2025/05/06 06:05:48 djm Exp $ PROG=test_kex SRCS=tests.c test_kex.c test_proposal.c @@ -6,7 +6,7 @@ SRCS=tests.c test_kex.c test_proposal.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c -SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c +SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c SRCS+=addr.c addrmatch.c bitmap.c packet.c dispatch.c canohost.c ssh_api.c SRCS+=compat.c ed25519.c hash.c @@ -35,7 +35,7 @@ SRCS+=digest-openssl.c REGRESS_TARGETS=run-regress-${PROG} run-regress-${PROG}: ${PROG} - env ${TEST_ENV} ./${PROG} + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} .include diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c index caf8f57f75d6..54b826239ae8 100644 --- a/regress/unittests/kex/test_kex.c +++ b/regress/unittests/kex/test_kex.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_kex.c,v 1.9 2024/09/09 03:13:39 djm Exp $ */ +/* $OpenBSD: test_kex.c,v 1.11 2025/05/06 06:05:48 djm Exp $ */ /* * Regress test KEX * @@ -8,6 +8,7 @@ #include "includes.h" #include +#include #include #ifdef HAVE_STDINT_H #include @@ -76,7 +77,8 @@ run_kex(struct ssh *client, struct ssh *server) } static void -do_kex_with_key(char *kex, int keytype, int bits) +do_kex_with_key(char *kex, char *cipher, char *mac, + struct sshkey *key, int keytype, int bits) { struct ssh *client = NULL, *server = NULL, *server2 = NULL; struct sshkey *private, *public; @@ -85,9 +87,14 @@ do_kex_with_key(char *kex, int keytype, int bits) char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT }; char *keyname = NULL; - TEST_START("sshkey_generate"); - ASSERT_INT_EQ(sshkey_generate(keytype, bits, &private), 0); - TEST_DONE(); + if (key != NULL) { + private = key; + keytype = key->type; + } else { + TEST_START("sshkey_generate"); + ASSERT_INT_EQ(sshkey_generate(keytype, bits, &private), 0); + TEST_DONE(); + } TEST_START("sshkey_from_private"); ASSERT_INT_EQ(sshkey_from_private(private, &public), 0); @@ -97,6 +104,14 @@ do_kex_with_key(char *kex, int keytype, int bits) memcpy(kex_params.proposal, myproposal, sizeof(myproposal)); if (kex != NULL) kex_params.proposal[PROPOSAL_KEX_ALGS] = kex; + if (cipher != NULL) { + kex_params.proposal[PROPOSAL_ENC_ALGS_CTOS] = cipher; + kex_params.proposal[PROPOSAL_ENC_ALGS_STOC] = cipher; + } + if (mac != NULL) { + kex_params.proposal[PROPOSAL_MAC_ALGS_CTOS] = mac; + kex_params.proposal[PROPOSAL_MAC_ALGS_STOC] = mac; + } keyname = strdup(sshkey_ssh_name(private)); ASSERT_PTR_NE(keyname, NULL); kex_params.proposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = keyname; @@ -167,7 +182,8 @@ do_kex_with_key(char *kex, int keytype, int bits) TEST_DONE(); TEST_START("cleanup"); - sshkey_free(private); + if (key == NULL) + sshkey_free(private); sshkey_free(public); ssh_free(client); ssh_free(server); @@ -179,19 +195,34 @@ do_kex_with_key(char *kex, int keytype, int bits) static void do_kex(char *kex) { -#if 0 - log_init("test_kex", SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 1); -#endif + struct sshkey *key = NULL; + char name[256]; + + if (test_is_benchmark()) { + snprintf(name, sizeof(name), "generate %s", kex); + TEST_START(name); + ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 0, &key), 0); + TEST_DONE(); + snprintf(name, sizeof(name), "KEX %s", kex); + BENCH_START(name); + /* + * NB. use a cipher/MAC here that requires minimal bits from + * the KEX to avoid DH-GEX taking forever. + */ + do_kex_with_key(kex, "aes128-ctr", "hmac-sha2-256", key, + KEY_ED25519, 256); + BENCH_FINISH("kex"); + sshkey_free(key); + return; + } + #ifdef WITH_OPENSSL - do_kex_with_key(kex, KEY_RSA, 2048); -#ifdef WITH_DSA - do_kex_with_key(kex, KEY_DSA, 1024); -#endif -#ifdef OPENSSL_HAS_ECC - do_kex_with_key(kex, KEY_ECDSA, 256); -#endif /* OPENSSL_HAS_ECC */ + do_kex_with_key(kex, NULL, NULL, NULL, KEY_RSA, 2048); +# ifdef OPENSSL_HAS_ECC + do_kex_with_key(kex, NULL, NULL, NULL, KEY_ECDSA, 256); +# endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ - do_kex_with_key(kex, KEY_ED25519, 256); + do_kex_with_key(kex, NULL, NULL, NULL, KEY_ED25519, 256); } void diff --git a/regress/unittests/kex/tests.c b/regress/unittests/kex/tests.c index d3044f033767..a3ef19ef410a 100644 --- a/regress/unittests/kex/tests.c +++ b/regress/unittests/kex/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.3 2023/03/06 12:15:47 dtucker Exp $ */ +/* $OpenBSD: tests.c,v 1.4 2025/04/15 04:00:42 djm Exp $ */ /* * Placed in the public domain */ @@ -16,3 +16,10 @@ tests(void) kex_proposal_tests(); kex_proposal_populate_tests(); } + +void +benchmarks(void) +{ + printf("\n"); + kex_tests(); +} diff --git a/regress/unittests/match/Makefile b/regress/unittests/match/Makefile index 939163d30ef5..7b17e5689344 100644 --- a/regress/unittests/match/Makefile +++ b/regress/unittests/match/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.5 2021/01/09 12:24:31 dtucker Exp $ +# $OpenBSD: Makefile,v 1.6 2025/04/15 04:00:42 djm Exp $ PROG=test_match SRCS=tests.c @@ -11,6 +11,6 @@ SRCS+=cleanup.c atomicio.c addr.c REGRESS_TARGETS=run-regress-${PROG} run-regress-${PROG}: ${PROG} - env ${TEST_ENV} ./${PROG} + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} .include diff --git a/regress/unittests/match/tests.c b/regress/unittests/match/tests.c index f00d1f9348fc..2ca6c769ae3f 100644 --- a/regress/unittests/match/tests.c +++ b/regress/unittests/match/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.8 2021/12/14 21:25:27 deraadt Exp $ */ +/* $OpenBSD: tests.c,v 1.9 2025/04/15 04:00:42 djm Exp $ */ /* * Regress test for matching functions * @@ -129,3 +129,9 @@ tests(void) * int addr_match_cidr_list(const char *, const char *); */ } + +void +benchmarks(void) +{ + printf("no benchmarks\n"); +} diff --git a/regress/unittests/misc/Makefile b/regress/unittests/misc/Makefile index d2be393ad703..7282be13a667 100644 --- a/regress/unittests/misc/Makefile +++ b/regress/unittests/misc/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.9 2023/01/06 02:59:50 djm Exp $ +# $OpenBSD: Makefile,v 1.10 2025/04/15 04:00:42 djm Exp $ PROG=test_misc SRCS=tests.c @@ -28,6 +28,6 @@ SRCS+= atomicio.c cleanup.c fatal.c REGRESS_TARGETS=run-regress-${PROG} run-regress-${PROG}: ${PROG} - env ${TEST_ENV} ./${PROG} + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} .include diff --git a/regress/unittests/misc/tests.c b/regress/unittests/misc/tests.c index 32699541413e..7611a0d3b645 100644 --- a/regress/unittests/misc/tests.c +++ b/regress/unittests/misc/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.10 2023/01/06 02:59:50 djm Exp $ */ +/* $OpenBSD: tests.c,v 1.11 2025/04/15 04:00:42 djm Exp $ */ /* * Regress test for misc helper functions. * @@ -39,3 +39,9 @@ tests(void) test_hpdelim(); test_ptimeout(); } + +void +benchmarks(void) +{ + printf("no benchmarks\n"); +} diff --git a/regress/unittests/sshbuf/tests.c b/regress/unittests/sshbuf/tests.c index 29916a10bc5b..95a34a8c8e97 100644 --- a/regress/unittests/sshbuf/tests.c +++ b/regress/unittests/sshbuf/tests.c @@ -1,10 +1,14 @@ -/* $OpenBSD: tests.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */ +/* $OpenBSD: tests.c,v 1.2 2025/04/15 04:00:42 djm Exp $ */ /* * Regress test for sshbuf.h buffer API * * Placed in the public domain */ +#include "includes.h" + +#include + #include "../test_helper/test_helper.h" void sshbuf_tests(void); @@ -28,3 +32,9 @@ tests(void) sshbuf_getput_fuzz_tests(); sshbuf_fixed(); } + +void +benchmarks(void) +{ + printf("no benchmarks\n"); +} diff --git a/regress/unittests/sshkey/Makefile b/regress/unittests/sshkey/Makefile index cd0f44d13d24..b237ff55c8d3 100644 --- a/regress/unittests/sshkey/Makefile +++ b/regress/unittests/sshkey/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.12 2023/01/15 23:35:10 djm Exp $ +# $OpenBSD: Makefile,v 1.13 2025/05/06 06:05:48 djm Exp $ PROG=test_sshkey SRCS=tests.c test_sshkey.c test_file.c test_fuzz.c common.c @@ -6,7 +6,7 @@ SRCS=tests.c test_sshkey.c test_file.c test_fuzz.c common.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c -SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c +SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c SRCS+=addr.c addrmatch.c bitmap.c SRCS+=ed25519.c hash.c diff --git a/regress/unittests/sshkey/common.c b/regress/unittests/sshkey/common.c index f325c2ac2025..a579eccb29d5 100644 --- a/regress/unittests/sshkey/common.c +++ b/regress/unittests/sshkey/common.c @@ -1,4 +1,4 @@ -/* $OpenBSD: common.c,v 1.6 2024/08/15 00:52:23 djm Exp $ */ +/* $OpenBSD: common.c,v 1.7 2025/05/06 06:05:48 djm Exp $ */ /* * Helpers for key API tests * @@ -21,7 +21,6 @@ #ifdef WITH_OPENSSL #include #include -#include #include #ifdef OPENSSL_HAS_NISTP256 # include @@ -126,38 +125,4 @@ rsa_q(struct sshkey *k) RSA_get0_factors(EVP_PKEY_get0_RSA(k->pkey), NULL, &q); return q; } - -const BIGNUM * -dsa_g(struct sshkey *k) -{ - const BIGNUM *g = NULL; - - ASSERT_PTR_NE(k, NULL); - ASSERT_PTR_NE(k->dsa, NULL); - DSA_get0_pqg(k->dsa, NULL, NULL, &g); - return g; -} - -const BIGNUM * -dsa_pub_key(struct sshkey *k) -{ - const BIGNUM *pub_key = NULL; - - ASSERT_PTR_NE(k, NULL); - ASSERT_PTR_NE(k->dsa, NULL); - DSA_get0_key(k->dsa, &pub_key, NULL); - return pub_key; -} - -const BIGNUM * -dsa_priv_key(struct sshkey *k) -{ - const BIGNUM *priv_key = NULL; - - ASSERT_PTR_NE(k, NULL); - ASSERT_PTR_NE(k->dsa, NULL); - DSA_get0_key(k->dsa, NULL, &priv_key); - return priv_key; -} #endif /* WITH_OPENSSL */ - diff --git a/regress/unittests/sshkey/common.h b/regress/unittests/sshkey/common.h index 7a514fdc8fe6..6127116da3d4 100644 --- a/regress/unittests/sshkey/common.h +++ b/regress/unittests/sshkey/common.h @@ -1,4 +1,4 @@ -/* $OpenBSD: common.h,v 1.2 2018/09/13 09:03:20 djm Exp $ */ +/* $OpenBSD: common.h,v 1.3 2025/05/06 06:05:48 djm Exp $ */ /* * Helpers for key API tests * @@ -19,7 +19,4 @@ const BIGNUM *rsa_n(struct sshkey *k); const BIGNUM *rsa_e(struct sshkey *k); const BIGNUM *rsa_p(struct sshkey *k); const BIGNUM *rsa_q(struct sshkey *k); -const BIGNUM *dsa_g(struct sshkey *k); -const BIGNUM *dsa_pub_key(struct sshkey *k); -const BIGNUM *dsa_priv_key(struct sshkey *k); diff --git a/regress/unittests/sshkey/mktestdata.sh b/regress/unittests/sshkey/mktestdata.sh index fcd78e990e8b..97e5d79fd734 100755 --- a/regress/unittests/sshkey/mktestdata.sh +++ b/regress/unittests/sshkey/mktestdata.sh @@ -1,5 +1,5 @@ #!/bin/sh -# $OpenBSD: mktestdata.sh,v 1.11 2020/06/19 03:48:49 djm Exp $ +# $OpenBSD: mktestdata.sh,v 1.12 2025/05/06 06:05:48 djm Exp $ PW=mekmitasdigoat @@ -24,27 +24,6 @@ rsa_params() { done } -dsa_params() { - _in="$1" - _outbase="$2" - set -e - openssl dsa -noout -text -in $_in | \ - awk '/^priv:$/,/^pub:/' | \ - grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.priv - openssl dsa -noout -text -in $_in | \ - awk '/^pub:/,/^P:/' | #\ - grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.pub - openssl dsa -noout -text -in $_in | \ - awk '/^G:/,0' | \ - grep -v '^[a-zA-Z]' | tr -d ' \n:' > ${_outbase}.g - for x in priv pub g ; do - echo "" >> ${_outbase}.$x - echo ============ ${_outbase}.$x - cat ${_outbase}.$x - echo ============ - done -} - ecdsa_params() { _in="$1" _outbase="$2" @@ -79,15 +58,14 @@ else exit 1 fi -rm -f rsa_1 dsa_1 ecdsa_1 ed25519_1 -rm -f rsa_2 dsa_2 ecdsa_2 ed25519_2 -rm -f rsa_n dsa_n ecdsa_n # new-format keys -rm -f rsa_1_pw dsa_1_pw ecdsa_1_pw ed25519_1_pw -rm -f rsa_n_pw dsa_n_pw ecdsa_n_pw +rm -f rsa_1 ecdsa_1 ed25519_1 +rm -f rsa_2 ecdsa_2 ed25519_2 +rm -f rsa_n ecdsa_n # new-format keys +rm -f rsa_1_pw ecdsa_1_pw ed25519_1_pw +rm -f rsa_n_pw ecdsa_n_pw rm -f pw *.pub *.bn.* *.param.* *.fp *.fp.bb ssh-keygen -t rsa -b 1024 -C "RSA test key #1" -N "" -f rsa_1 -m PEM -ssh-keygen -t dsa -b 1024 -C "DSA test key #1" -N "" -f dsa_1 -m PEM ssh-keygen -t ecdsa -b 256 -C "ECDSA test key #1" -N "" -f ecdsa_1 -m PEM ssh-keygen -t ed25519 -C "ED25519 test key #1" -N "" -f ed25519_1 ssh-keygen -w "$SK_DUMMY" -t ecdsa-sk -C "ECDSA-SK test key #1" \ @@ -97,7 +75,6 @@ ssh-keygen -w "$SK_DUMMY" -t ed25519-sk -C "ED25519-SK test key #1" \ ssh-keygen -t rsa -b 2048 -C "RSA test key #2" -N "" -f rsa_2 -m PEM -ssh-keygen -t dsa -b 1024 -C "DSA test key #2" -N "" -f dsa_2 -m PEM ssh-keygen -t ecdsa -b 521 -C "ECDSA test key #2" -N "" -f ecdsa_2 -m PEM ssh-keygen -t ed25519 -C "ED25519 test key #2" -N "" -f ed25519_2 ssh-keygen -w "$SK_DUMMY" -t ecdsa-sk -C "ECDSA-SK test key #2" \ @@ -106,37 +83,29 @@ ssh-keygen -w "$SK_DUMMY" -t ed25519-sk -C "ED25519-SK test key #2" \ -N "" -f ed25519_sk2 cp rsa_1 rsa_n -cp dsa_1 dsa_n cp ecdsa_1 ecdsa_n ssh-keygen -pf rsa_n -N "" -ssh-keygen -pf dsa_n -N "" ssh-keygen -pf ecdsa_n -N "" cp rsa_1 rsa_1_pw -cp dsa_1 dsa_1_pw cp ecdsa_1 ecdsa_1_pw cp ed25519_1 ed25519_1_pw cp ecdsa_sk1 ecdsa_sk1_pw cp ed25519_sk1 ed25519_sk1_pw cp rsa_1 rsa_n_pw -cp dsa_1 dsa_n_pw cp ecdsa_1 ecdsa_n_pw ssh-keygen -pf rsa_1_pw -m PEM -N "$PW" -ssh-keygen -pf dsa_1_pw -m PEM -N "$PW" ssh-keygen -pf ecdsa_1_pw -m PEM -N "$PW" ssh-keygen -pf ed25519_1_pw -N "$PW" ssh-keygen -pf ecdsa_sk1_pw -m PEM -N "$PW" ssh-keygen -pf ed25519_sk1_pw -N "$PW" ssh-keygen -pf rsa_n_pw -N "$PW" -ssh-keygen -pf dsa_n_pw -N "$PW" ssh-keygen -pf ecdsa_n_pw -N "$PW" rsa_params rsa_1 rsa_1.param rsa_params rsa_2 rsa_2.param -dsa_params dsa_1 dsa_1.param -dsa_params dsa_1 dsa_1.param ecdsa_params ecdsa_1 ecdsa_1.param ecdsa_params ecdsa_2 ecdsa_2.param # XXX ed25519, *sk params @@ -144,9 +113,6 @@ ecdsa_params ecdsa_2 ecdsa_2.param ssh-keygen -s rsa_2 -I hugo -n user1,user2 \ -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \ -V 19990101:20110101 -z 1 rsa_1.pub -ssh-keygen -s rsa_2 -I hugo -n user1,user2 \ - -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \ - -V 19990101:20110101 -z 2 dsa_1.pub ssh-keygen -s rsa_2 -I hugo -n user1,user2 \ -Oforce-command=/bin/ls -Ono-port-forwarding -Osource-address=10.0.0.0/8 \ -V 19990101:20110101 -z 3 ecdsa_1.pub @@ -175,8 +141,6 @@ ssh-keygen -s rsa_2 -I hugo -n user1,user2 -t rsa-sha2-512 \ ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \ -V 19990101:20110101 -z 5 rsa_1.pub -ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \ - -V 19990101:20110101 -z 6 dsa_1.pub ssh-keygen -s ecdsa_1 -I julius -n host1,host2 -h \ -V 19990101:20110101 -z 7 ecdsa_1.pub ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \ @@ -187,33 +151,28 @@ ssh-keygen -s ed25519_1 -I julius -n host1,host2 -h \ -V 19990101:20110101 -z 8 ed25519_sk1.pub ssh-keygen -lf rsa_1 | awk '{print $2}' > rsa_1.fp -ssh-keygen -lf dsa_1 | awk '{print $2}' > dsa_1.fp ssh-keygen -lf ecdsa_1 | awk '{print $2}' > ecdsa_1.fp ssh-keygen -lf ed25519_1 | awk '{print $2}' > ed25519_1.fp ssh-keygen -lf ecdsa_sk1 | awk '{print $2}' > ecdsa_sk1.fp ssh-keygen -lf ed25519_sk1 | awk '{print $2}' > ed25519_sk1.fp ssh-keygen -lf rsa_2 | awk '{print $2}' > rsa_2.fp -ssh-keygen -lf dsa_2 | awk '{print $2}' > dsa_2.fp ssh-keygen -lf ecdsa_2 | awk '{print $2}' > ecdsa_2.fp ssh-keygen -lf ed25519_2 | awk '{print $2}' > ed25519_2.fp ssh-keygen -lf ecdsa_sk2 | awk '{print $2}' > ecdsa_sk2.fp ssh-keygen -lf ed25519_sk2 | awk '{print $2}' > ed25519_sk2.fp ssh-keygen -lf rsa_1-cert.pub | awk '{print $2}' > rsa_1-cert.fp -ssh-keygen -lf dsa_1-cert.pub | awk '{print $2}' > dsa_1-cert.fp ssh-keygen -lf ecdsa_1-cert.pub | awk '{print $2}' > ecdsa_1-cert.fp ssh-keygen -lf ed25519_1-cert.pub | awk '{print $2}' > ed25519_1-cert.fp ssh-keygen -lf ecdsa_sk1-cert.pub | awk '{print $2}' > ecdsa_sk1-cert.fp ssh-keygen -lf ed25519_sk1-cert.pub | awk '{print $2}' > ed25519_sk1-cert.fp ssh-keygen -Bf rsa_1 | awk '{print $2}' > rsa_1.fp.bb -ssh-keygen -Bf dsa_1 | awk '{print $2}' > dsa_1.fp.bb ssh-keygen -Bf ecdsa_1 | awk '{print $2}' > ecdsa_1.fp.bb ssh-keygen -Bf ed25519_1 | awk '{print $2}' > ed25519_1.fp.bb ssh-keygen -Bf ecdsa_sk1 | awk '{print $2}' > ecdsa_sk1.fp.bb ssh-keygen -Bf ed25519_sk1 | awk '{print $2}' > ed25519_sk1.fp.bb ssh-keygen -Bf rsa_2 | awk '{print $2}' > rsa_2.fp.bb -ssh-keygen -Bf dsa_2 | awk '{print $2}' > dsa_2.fp.bb ssh-keygen -Bf ecdsa_2 | awk '{print $2}' > ecdsa_2.fp.bb ssh-keygen -Bf ed25519_2 | awk '{print $2}' > ed25519_2.fp.bb ssh-keygen -Bf ecdsa_sk2 | awk '{print $2}' > ecdsa_sk2.fp.bb diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c index 25f73de79619..b0ea45bdf2a8 100644 --- a/regress/unittests/sshkey/test_file.c +++ b/regress/unittests/sshkey/test_file.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_file.c,v 1.12 2024/08/15 00:52:23 djm Exp $ */ +/* $OpenBSD: test_file.c,v 1.13 2025/05/06 06:05:48 djm Exp $ */ /* * Regress test for sshkey.h key management API * @@ -21,7 +21,6 @@ #ifdef WITH_OPENSSL #include #include -#include #include #ifdef OPENSSL_HAS_NISTP256 # include @@ -167,101 +166,6 @@ sshkey_file_tests(void) sshkey_free(k1); -#ifdef WITH_DSA - TEST_START("parse DSA from private"); - buf = load_file("dsa_1"); - ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); - sshbuf_free(buf); - ASSERT_PTR_NE(k1, NULL); - a = load_bignum("dsa_1.param.g"); - b = load_bignum("dsa_1.param.priv"); - c = load_bignum("dsa_1.param.pub"); - ASSERT_BIGNUM_EQ(dsa_g(k1), a); - ASSERT_BIGNUM_EQ(dsa_priv_key(k1), b); - ASSERT_BIGNUM_EQ(dsa_pub_key(k1), c); - BN_free(a); - BN_free(b); - BN_free(c); - TEST_DONE(); - -#ifndef WINDOWS /* TODO: test fails (atleast) on Windows as Licrypto is unable to parse legacy private key file with passphrase*/ - TEST_START("parse DSA from private w/ passphrase"); - buf = load_file("dsa_1_pw"); - ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, - (const char *)sshbuf_ptr(pw), &k2, NULL), 0); - sshbuf_free(buf); - ASSERT_PTR_NE(k2, NULL); - ASSERT_INT_EQ(sshkey_equal(k1, k2), 1); - sshkey_free(k2); - TEST_DONE(); -#endif - - TEST_START("parse DSA from new-format"); - buf = load_file("dsa_n"); - ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k2, NULL), 0); - sshbuf_free(buf); - ASSERT_PTR_NE(k2, NULL); - ASSERT_INT_EQ(sshkey_equal(k1, k2), 1); - sshkey_free(k2); - TEST_DONE(); - - TEST_START("parse DSA from new-format w/ passphrase"); - buf = load_file("dsa_n_pw"); - ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, - (const char *)sshbuf_ptr(pw), &k2, NULL), 0); - sshbuf_free(buf); - ASSERT_PTR_NE(k2, NULL); - ASSERT_INT_EQ(sshkey_equal(k1, k2), 1); - sshkey_free(k2); - TEST_DONE(); - - TEST_START("load DSA from public"); - ASSERT_INT_EQ(sshkey_load_public(test_data_file("dsa_1.pub"), &k2, - NULL), 0); - ASSERT_PTR_NE(k2, NULL); - ASSERT_INT_EQ(sshkey_equal(k1, k2), 1); - sshkey_free(k2); - TEST_DONE(); - - TEST_START("load DSA cert"); - ASSERT_INT_EQ(sshkey_load_cert(test_data_file("dsa_1"), &k2), 0); - ASSERT_PTR_NE(k2, NULL); - ASSERT_INT_EQ(k2->type, KEY_DSA_CERT); - ASSERT_INT_EQ(sshkey_equal(k1, k2), 0); - ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1); - TEST_DONE(); - - TEST_START("DSA key hex fingerprint"); - buf = load_text_file("dsa_1.fp"); - cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA256, SSH_FP_BASE64); - ASSERT_PTR_NE(cp, NULL); - ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf)); - sshbuf_free(buf); - free(cp); - TEST_DONE(); - - TEST_START("DSA cert hex fingerprint"); - buf = load_text_file("dsa_1-cert.fp"); - cp = sshkey_fingerprint(k2, SSH_DIGEST_SHA256, SSH_FP_BASE64); - ASSERT_PTR_NE(cp, NULL); - ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf)); - sshbuf_free(buf); - free(cp); - sshkey_free(k2); - TEST_DONE(); - - TEST_START("DSA key bubblebabble fingerprint"); - buf = load_text_file("dsa_1.fp.bb"); - cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA1, SSH_FP_BUBBLEBABBLE); - ASSERT_PTR_NE(cp, NULL); - ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf)); - sshbuf_free(buf); - free(cp); - TEST_DONE(); - - sshkey_free(k1); -#endif - #ifdef OPENSSL_HAS_ECC TEST_START("parse ECDSA from private"); buf = load_file("ecdsa_1"); diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c index 0aff7c9bf4e4..12d0e12eacef 100644 --- a/regress/unittests/sshkey/test_fuzz.c +++ b/regress/unittests/sshkey/test_fuzz.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_fuzz.c,v 1.14 2024/01/11 01:45:58 djm Exp $ */ +/* $OpenBSD: test_fuzz.c,v 1.15 2025/05/06 06:05:48 djm Exp $ */ /* * Fuzz tests for key parsing * @@ -21,7 +21,6 @@ #ifdef WITH_OPENSSL #include #include -#include #include #ifdef OPENSSL_HAS_NISTP256 # include @@ -160,52 +159,6 @@ sshkey_fuzz_tests(void) fuzz_cleanup(fuzz); TEST_DONE(); -#ifdef WITH_DSA - TEST_START("fuzz DSA private"); - buf = load_file("dsa_1"); - fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf), - sshbuf_len(buf)); - ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); - sshkey_free(k1); - sshbuf_free(buf); - ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL); - TEST_ONERROR(onerror, fuzz); - for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) { - r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz)); - ASSERT_INT_EQ(r, 0); - if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0) - sshkey_free(k1); - sshbuf_reset(fuzzed); - if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS) - break; - } - sshbuf_free(fuzzed); - fuzz_cleanup(fuzz); - TEST_DONE(); - - TEST_START("fuzz DSA new-format private"); - buf = load_file("dsa_n"); - fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf), - sshbuf_len(buf)); - ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); - sshkey_free(k1); - sshbuf_free(buf); - ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL); - TEST_ONERROR(onerror, fuzz); - for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) { - r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz)); - ASSERT_INT_EQ(r, 0); - if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0) - sshkey_free(k1); - sshbuf_reset(fuzzed); - if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS) - break; - } - sshbuf_free(fuzzed); - fuzz_cleanup(fuzz); - TEST_DONE(); -#endif - #ifdef OPENSSL_HAS_ECC TEST_START("fuzz ECDSA private"); buf = load_file("ecdsa_1"); @@ -290,22 +243,6 @@ sshkey_fuzz_tests(void) sshkey_free(k1); TEST_DONE(); -#ifdef WITH_DSA - TEST_START("fuzz DSA public"); - buf = load_file("dsa_1"); - ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); - sshbuf_free(buf); - public_fuzz(k1); - sshkey_free(k1); - TEST_DONE(); - - TEST_START("fuzz DSA cert"); - ASSERT_INT_EQ(sshkey_load_cert(test_data_file("dsa_1"), &k1), 0); - public_fuzz(k1); - sshkey_free(k1); - TEST_DONE(); -#endif - #ifdef OPENSSL_HAS_ECC TEST_START("fuzz ECDSA public"); buf = load_file("ecdsa_1"); @@ -362,16 +299,6 @@ sshkey_fuzz_tests(void) sshkey_free(k1); TEST_DONE(); -#ifdef WITH_DSA - TEST_START("fuzz DSA sig"); - buf = load_file("dsa_1"); - ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0); - sshbuf_free(buf); - sig_fuzz(k1, NULL); - sshkey_free(k1); - TEST_DONE(); -#endif - #ifdef OPENSSL_HAS_ECC TEST_START("fuzz ECDSA sig"); buf = load_file("ecdsa_1"); diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c index 5bf4b65cc055..832ef9b202cc 100644 --- a/regress/unittests/sshkey/test_sshkey.c +++ b/regress/unittests/sshkey/test_sshkey.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_sshkey.c,v 1.25 2024/08/15 00:52:23 djm Exp $ */ +/* $OpenBSD: test_sshkey.c,v 1.29 2025/05/06 06:05:48 djm Exp $ */ /* * Regress test for sshkey.h key management API * @@ -18,7 +18,6 @@ #ifdef WITH_OPENSSL #include #include -#include #if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) # include #endif @@ -36,6 +35,7 @@ #include "ssh2.h" void sshkey_tests(void); +void sshkey_benchmarks(void); static void put_opt(struct sshbuf *b, const char *name, const char *value) @@ -133,6 +133,55 @@ signature_test(struct sshkey *k, struct sshkey *bad, const char *sig_alg, free(sig); } +static void +signature_bench(const char *name, int ktype, int bits, const char *sig_alg, + const u_char *d, size_t l) +{ + struct sshkey *k; + size_t len; + u_char *sig; + char testname[256]; + + snprintf(testname, sizeof(testname), "sign %s", name); + TEST_START(testname); + ASSERT_INT_EQ(sshkey_generate(ktype, bits, &k), 0); + ASSERT_PTR_NE(k, NULL); + + BENCH_START(testname); + ASSERT_INT_EQ(sshkey_sign(k, &sig, &len, d, l, sig_alg, + NULL, NULL, 0), 0); + free(sig); + BENCH_FINISH("sign"); + + sshkey_free(k); + TEST_DONE(); +} + +static void +verify_bench(const char *name, int ktype, int bits, const char *sig_alg, + const u_char *d, size_t l) +{ + struct sshkey *k; + size_t len; + u_char *sig; + char testname[256]; + + snprintf(testname, sizeof(testname), "verify %s", name); + TEST_START(testname); + ASSERT_INT_EQ(sshkey_generate(ktype, bits, &k), 0); + ASSERT_PTR_NE(k, NULL); + + ASSERT_INT_EQ(sshkey_sign(k, &sig, &len, d, l, sig_alg, + NULL, NULL, 0), 0); + BENCH_START(testname); + ASSERT_INT_EQ(sshkey_verify(k, sig, len, d, l, NULL, 0, NULL), 0); + BENCH_FINISH("verify"); + + free(sig); + sshkey_free(k); + TEST_DONE(); +} + static void banana(u_char *s, size_t l) { @@ -165,6 +214,19 @@ signature_tests(struct sshkey *k, struct sshkey *bad, const char *sig_alg) } } +static void +signature_benchmark(const char *name, int ktype, int bits, + const char *sig_alg, int bench_verify) +{ + u_char buf[256]; + + banana(buf, sizeof(buf)); + if (bench_verify) + verify_bench(name, ktype, bits, sig_alg, buf, sizeof(buf)); + else + signature_bench(name, ktype, bits, sig_alg, buf, sizeof(buf)); +} + static struct sshkey * get_private(const char *n) { @@ -208,14 +270,6 @@ sshkey_tests(void) sshkey_free(k1); TEST_DONE(); -#ifdef WITH_DSA - TEST_START("new/free KEY_DSA"); - k1 = sshkey_new(KEY_DSA); - ASSERT_PTR_NE(k1, NULL); - ASSERT_PTR_NE(k1->dsa, NULL); - sshkey_free(k1); - TEST_DONE(); -#endif #ifdef OPENSSL_HAS_ECC TEST_START("new/free KEY_ECDSA"); @@ -247,14 +301,6 @@ sshkey_tests(void) ASSERT_PTR_EQ(k1, NULL); TEST_DONE(); -#ifdef WITH_DSA - TEST_START("generate KEY_DSA wrong bits"); - ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 2048, &k1), - SSH_ERR_KEY_LENGTH); - ASSERT_PTR_EQ(k1, NULL); - sshkey_free(k1); - TEST_DONE(); -#endif #ifdef OPENSSL_HAS_ECC TEST_START("generate KEY_ECDSA wrong bits"); @@ -277,15 +323,6 @@ sshkey_tests(void) ASSERT_INT_EQ(BN_num_bits(rsa_n(kr)), 1024); TEST_DONE(); -#ifdef WITH_DSA - TEST_START("generate KEY_DSA"); - ASSERT_INT_EQ(sshkey_generate(KEY_DSA, 1024, &kd), 0); - ASSERT_PTR_NE(kd, NULL); - ASSERT_PTR_NE(kd->dsa, NULL); - ASSERT_PTR_NE(dsa_g(kd), NULL); - ASSERT_PTR_NE(dsa_priv_key(kd), NULL); - TEST_DONE(); -#endif #ifdef OPENSSL_HAS_ECC TEST_START("generate KEY_ECDSA"); @@ -325,22 +362,6 @@ sshkey_tests(void) sshkey_free(k1); TEST_DONE(); -#ifdef WITH_DSA - TEST_START("demote KEY_DSA"); - ASSERT_INT_EQ(sshkey_from_private(kd, &k1), 0); - ASSERT_PTR_NE(k1, NULL); - ASSERT_PTR_NE(kd, k1); - ASSERT_INT_EQ(k1->type, KEY_DSA); - ASSERT_PTR_NE(k1->dsa, NULL); - ASSERT_PTR_NE(dsa_g(k1), NULL); - ASSERT_PTR_EQ(dsa_priv_key(k1), NULL); - TEST_DONE(); - - TEST_START("equal KEY_DSA/demoted KEY_DSA"); - ASSERT_INT_EQ(sshkey_equal(kd, k1), 1); - sshkey_free(k1); - TEST_DONE(); -#endif #ifdef OPENSSL_HAS_ECC TEST_START("demote KEY_ECDSA"); @@ -488,16 +509,6 @@ sshkey_tests(void) sshkey_free(k2); TEST_DONE(); -#ifdef WITH_DSA - TEST_START("sign and verify DSA"); - k1 = get_private("dsa_1"); - ASSERT_INT_EQ(sshkey_load_public(test_data_file("dsa_2.pub"), &k2, - NULL), 0); - signature_tests(k1, k2, NULL); - sshkey_free(k1); - sshkey_free(k2); - TEST_DONE(); -#endif #ifdef OPENSSL_HAS_ECC TEST_START("sign and verify ECDSA"); @@ -537,3 +548,86 @@ sshkey_tests(void) TEST_DONE(); #endif /* WITH_OPENSSL */ } + +void +sshkey_benchmarks(void) +{ + struct sshkey *k = NULL; + +#ifdef WITH_OPENSSL + BENCH_START("generate RSA-1024"); + TEST_START("generate KEY_RSA"); + ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1024, &k), 0); + ASSERT_PTR_NE(k, NULL); + sshkey_free(k); + TEST_DONE(); + BENCH_FINISH("keys"); + + BENCH_START("generate RSA-2048"); + TEST_START("generate KEY_RSA"); + ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 2048, &k), 0); + ASSERT_PTR_NE(k, NULL); + sshkey_free(k); + TEST_DONE(); + BENCH_FINISH("keys"); + + + BENCH_START("generate ECDSA-256"); + TEST_START("generate KEY_ECDSA"); + ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &k), 0); + ASSERT_PTR_NE(k, NULL); + sshkey_free(k); + TEST_DONE(); + BENCH_FINISH("keys"); + + BENCH_START("generate ECDSA-384"); + TEST_START("generate KEY_ECDSA"); + ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 384, &k), 0); + ASSERT_PTR_NE(k, NULL); + sshkey_free(k); + TEST_DONE(); + BENCH_FINISH("keys"); + + BENCH_START("generate ECDSA-521"); + TEST_START("generate KEY_ECDSA"); + ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 521, &k), 0); + ASSERT_PTR_NE(k, NULL); + sshkey_free(k); + TEST_DONE(); + BENCH_FINISH("keys"); +#endif /* WITH_OPENSSL */ + + BENCH_START("generate ED25519"); + TEST_START("generate KEY_ED25519"); + ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &k), 0); + ASSERT_PTR_NE(k, NULL); + sshkey_free(k); + TEST_DONE(); + BENCH_FINISH("keys"); + +#ifdef WITH_OPENSSL + /* sign */ + signature_benchmark("RSA-1024/SHA1", KEY_RSA, 1024, "ssh-rsa", 0); + signature_benchmark("RSA-1024/SHA256", KEY_RSA, 1024, "rsa-sha2-256", 0); + signature_benchmark("RSA-1024/SHA512", KEY_RSA, 1024, "rsa-sha2-512", 0); + signature_benchmark("RSA-2048/SHA1", KEY_RSA, 2048, "ssh-rsa", 0); + signature_benchmark("RSA-2048/SHA256", KEY_RSA, 2048, "rsa-sha2-256", 0); + signature_benchmark("RSA-2048/SHA512", KEY_RSA, 2048, "rsa-sha2-512", 0); + signature_benchmark("ECDSA-256", KEY_ECDSA, 256, NULL, 0); + signature_benchmark("ECDSA-384", KEY_ECDSA, 384, NULL, 0); + signature_benchmark("ECDSA-521", KEY_ECDSA, 521, NULL, 0); + signature_benchmark("ED25519", KEY_ED25519, 0, NULL, 0); + + /* verify */ + signature_benchmark("RSA-1024/SHA1", KEY_RSA, 1024, "ssh-rsa", 1); + signature_benchmark("RSA-1024/SHA256", KEY_RSA, 1024, "rsa-sha2-256", 1); + signature_benchmark("RSA-1024/SHA512", KEY_RSA, 1024, "rsa-sha2-512", 1); + signature_benchmark("RSA-2048/SHA1", KEY_RSA, 2048, "ssh-rsa", 1); + signature_benchmark("RSA-2048/SHA256", KEY_RSA, 2048, "rsa-sha2-256", 1); + signature_benchmark("RSA-2048/SHA512", KEY_RSA, 2048, "rsa-sha2-512", 1); + signature_benchmark("ECDSA-256", KEY_ECDSA, 256, NULL, 1); + signature_benchmark("ECDSA-384", KEY_ECDSA, 384, NULL, 1); + signature_benchmark("ECDSA-521", KEY_ECDSA, 521, NULL, 1); +#endif /* WITH_OPENSSL */ + signature_benchmark("ED25519", KEY_ED25519, 0, NULL, 1); +} diff --git a/regress/unittests/sshkey/testdata/dsa_1 b/regress/unittests/sshkey/testdata/dsa_1 deleted file mode 100644 index d3f24824f8d5..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_1 +++ /dev/null @@ -1,12 +0,0 @@ ------BEGIN DSA PRIVATE KEY----- -MIIBvAIBAAKBgQD6kutNFRsHTwEAv6d39Lhsqy1apdHBZ9c2HfyRr7WmypyGIy2m -Ka43vzXI8CNwmRSYs+A6d0vJC7Pl+f9QzJ/04NWOA+MiwfurwrR3CRe61QRYb8Py -mcHOxueHs95IcjrbIPNn86cjnPP5qvv/guUzCjuww4zBdJOXpligrGt2XwIVAKMD -/50qQy7j8JaMk+1+Xtg1pK01AoGBAO7l9QVVbSSoy5lq6cOtvpf8UlwOa6+zBwbl -o4gmFd1RwX1yWkA8kQ7RrhCSg8Hc6mIGnKRgKRli/3LgbSfZ0obFJehkRtEWtN4P -h8fVUeS74iQbIwFQeKlYHIlNTRoGtAbdi3nHdV+BBkEQc1V3rjqYqhjOoz/yNsgz -LND26HrdAoGBAOdXpyfmobEBaOqZAuvgj1P0uhjG2P31Ufurv22FWPBU3A9qrkxb -OXwE0LwvjCvrsQV/lrYhJz/tiys40VeahulWZE5SAHMXGIf95LiLSgaXMjko7joo -t+LK84ltLymwZ4QMnYjnZSSclf1UuyQMcUtb34+I0u9Ycnyhp2mSFsQtAhRYIbQ5 -KfXsZuBPuWe5FJz3ldaEgw== ------END DSA PRIVATE KEY----- diff --git a/regress/unittests/sshkey/testdata/dsa_1-cert.fp b/regress/unittests/sshkey/testdata/dsa_1-cert.fp deleted file mode 100644 index 75ff0e9cd9f7..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_1-cert.fp +++ /dev/null @@ -1 +0,0 @@ -SHA256:kOLgXSoAT8O5T6r36n5NJUYigbux1d7gdH/rmWiJm6s diff --git a/regress/unittests/sshkey/testdata/dsa_1-cert.pub b/regress/unittests/sshkey/testdata/dsa_1-cert.pub deleted file mode 100644 index e768db1e7bad..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_1-cert.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-dss-cert-v01@openssh.com AAAAHHNzaC1kc3MtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgdTlbNU9Hn9Qng3FHxwH971bxCIoq1ern/QWFFDWXgmYAAACBAPqS600VGwdPAQC/p3f0uGyrLVql0cFn1zYd/JGvtabKnIYjLaYprje/NcjwI3CZFJiz4Dp3S8kLs+X5/1DMn/Tg1Y4D4yLB+6vCtHcJF7rVBFhvw/KZwc7G54ez3khyOtsg82fzpyOc8/mq+/+C5TMKO7DDjMF0k5emWKCsa3ZfAAAAFQCjA/+dKkMu4/CWjJPtfl7YNaStNQAAAIEA7uX1BVVtJKjLmWrpw62+l/xSXA5rr7MHBuWjiCYV3VHBfXJaQDyRDtGuEJKDwdzqYgacpGApGWL/cuBtJ9nShsUl6GRG0Ra03g+Hx9VR5LviJBsjAVB4qVgciU1NGga0Bt2Lecd1X4EGQRBzVXeuOpiqGM6jP/I2yDMs0Pboet0AAACBAOdXpyfmobEBaOqZAuvgj1P0uhjG2P31Ufurv22FWPBU3A9qrkxbOXwE0LwvjCvrsQV/lrYhJz/tiys40VeahulWZE5SAHMXGIf95LiLSgaXMjko7joot+LK84ltLymwZ4QMnYjnZSSclf1UuyQMcUtb34+I0u9Ycnyhp2mSFsQtAAAAAAAAAAYAAAACAAAABmp1bGl1cwAAABIAAAAFaG9zdDEAAAAFaG9zdDIAAAAANowB8AAAAABNHmBwAAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACBThupGO0X+FLQhbz8CoKPwc7V3JNsQuGtlsgN+F7SMGQAAAFMAAAALc3NoLWVkMjU1MTkAAABAh/z1LIdNL1b66tQ8t9DY9BTB3BQKpTKmc7ezyFKLwl96yaIniZwD9Ticdbe/8i/Li3uCFE3EAt8NAIv9zff8Bg== DSA test key #1 diff --git a/regress/unittests/sshkey/testdata/dsa_1.fp b/regress/unittests/sshkey/testdata/dsa_1.fp deleted file mode 100644 index 75ff0e9cd9f7..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_1.fp +++ /dev/null @@ -1 +0,0 @@ -SHA256:kOLgXSoAT8O5T6r36n5NJUYigbux1d7gdH/rmWiJm6s diff --git a/regress/unittests/sshkey/testdata/dsa_1.fp.bb b/regress/unittests/sshkey/testdata/dsa_1.fp.bb deleted file mode 100644 index ba37776ee30a..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_1.fp.bb +++ /dev/null @@ -1 +0,0 @@ -xetag-todiz-mifah-torec-mynyv-cyvit-gopon-pygag-rupic-cenav-bexax diff --git a/regress/unittests/sshkey/testdata/dsa_1.param.g b/regress/unittests/sshkey/testdata/dsa_1.param.g deleted file mode 100644 index e51c3f9fd1b4..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_1.param.g +++ /dev/null @@ -1 +0,0 @@ -00eee5f505556d24a8cb996ae9c3adbe97fc525c0e6bafb30706e5a3882615dd51c17d725a403c910ed1ae109283c1dcea62069ca460291962ff72e06d27d9d286c525e86446d116b4de0f87c7d551e4bbe2241b23015078a9581c894d4d1a06b406dd8b79c7755f81064110735577ae3a98aa18cea33ff236c8332cd0f6e87add diff --git a/regress/unittests/sshkey/testdata/dsa_1.param.priv b/regress/unittests/sshkey/testdata/dsa_1.param.priv deleted file mode 100644 index 4f743314c76e..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_1.param.priv +++ /dev/null @@ -1 +0,0 @@ -5821b43929f5ec66e04fb967b9149cf795d68483 diff --git a/regress/unittests/sshkey/testdata/dsa_1.param.pub b/regress/unittests/sshkey/testdata/dsa_1.param.pub deleted file mode 100644 index ba0313beec48..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_1.param.pub +++ /dev/null @@ -1 +0,0 @@ -00e757a727e6a1b10168ea9902ebe08f53f4ba18c6d8fdf551fbabbf6d8558f054dc0f6aae4c5b397c04d0bc2f8c2bebb1057f96b621273fed8b2b38d1579a86e956644e520073171887fde4b88b4a0697323928ee3a28b7e2caf3896d2f29b067840c9d88e765249c95fd54bb240c714b5bdf8f88d2ef58727ca1a7699216c42d diff --git a/regress/unittests/sshkey/testdata/dsa_1.pub b/regress/unittests/sshkey/testdata/dsa_1.pub deleted file mode 100644 index 41cae2f69f52..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_1.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-dss AAAAB3NzaC1kc3MAAACBAPqS600VGwdPAQC/p3f0uGyrLVql0cFn1zYd/JGvtabKnIYjLaYprje/NcjwI3CZFJiz4Dp3S8kLs+X5/1DMn/Tg1Y4D4yLB+6vCtHcJF7rVBFhvw/KZwc7G54ez3khyOtsg82fzpyOc8/mq+/+C5TMKO7DDjMF0k5emWKCsa3ZfAAAAFQCjA/+dKkMu4/CWjJPtfl7YNaStNQAAAIEA7uX1BVVtJKjLmWrpw62+l/xSXA5rr7MHBuWjiCYV3VHBfXJaQDyRDtGuEJKDwdzqYgacpGApGWL/cuBtJ9nShsUl6GRG0Ra03g+Hx9VR5LviJBsjAVB4qVgciU1NGga0Bt2Lecd1X4EGQRBzVXeuOpiqGM6jP/I2yDMs0Pboet0AAACBAOdXpyfmobEBaOqZAuvgj1P0uhjG2P31Ufurv22FWPBU3A9qrkxbOXwE0LwvjCvrsQV/lrYhJz/tiys40VeahulWZE5SAHMXGIf95LiLSgaXMjko7joot+LK84ltLymwZ4QMnYjnZSSclf1UuyQMcUtb34+I0u9Ycnyhp2mSFsQt DSA test key #1 diff --git a/regress/unittests/sshkey/testdata/dsa_1_pw b/regress/unittests/sshkey/testdata/dsa_1_pw deleted file mode 100644 index 24c73039fe1a..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_1_pw +++ /dev/null @@ -1,15 +0,0 @@ ------BEGIN DSA PRIVATE KEY----- -Proc-Type: 4,ENCRYPTED -DEK-Info: AES-128-CBC,BC8386C373B22EB7F00ADC821D5D8BE9 - -+HDV2DQ09sxrIAeXTz9r3YFuPRa2hk1+NGcr3ETkXbC6KiZ14wpTnGTloKwaQjIW -eXTa9mpCOWAoohgvsVb+hOuOlP7AfeHu1IXV4EAS+GDpkiV5UxlCXXwqlD75Buu4 -wwDd/p4SWzILH3WGjDk5JIXoxWNY13LHwC7Q6gtGJx4AicUG7YBRTXMIBDa/Kh77 -6o2rFETKmp4VHBvHbakmiETfptdM8bbWxKWeY2vakThyESgeofsLoTOQCIwlEfJC -s2D/KYL65C8VbHYgIoSLTQnooO45DDyxIuhCqP+H23mhv9vB1Od3nc2atgHj/XFs -dcOPFkF/msDRYqxY3V0AS6+jpKwFodZ7g/hyGcyPxOkzlJVuKoKuH6P5PyQ69Gx0 -iqri0xEPyABr7kGlXNrjjctojX+B4WwSnjg/2euXXWFXCRalIdA7ErATTiQbGOx7 -Vd6Gn8PZbSy1MkqEDrZRip0pfAFJYI/8GXPC75BpnRsrVlfhtrngbW+kBP35LzaN -l2K+RQ3gSB3iFoqNb1Kuu6T5MZlyVl5H2dVlJSeb1euQ2OycXdDoFTyJ4AiyWS7w -Vlh8zeJnso5QRDjMwx99pZilbbuFGSLsahiGEveFc6o= ------END DSA PRIVATE KEY----- diff --git a/regress/unittests/sshkey/testdata/dsa_2 b/regress/unittests/sshkey/testdata/dsa_2 deleted file mode 100644 index 3cc9631afa0f..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_2 +++ /dev/null @@ -1,12 +0,0 @@ ------BEGIN DSA PRIVATE KEY----- -MIIBvQIBAAKBgQCbyPXNdHeLsjpobPVCMkfagBkt15Zsltqf/PGNP1y1cuz7rsTX -ZekQwUkSTNm5coqXe+ZOw2O4tjobJDd60I1/VPgaB0NYlQR9Hn87M284WD4f6VY+ -aunHmP134a8ybG5G4NqVNF3ihvxAR2pVITqb7kE46r2uYZNcNlHI8voRCwIVAMcP -bwqFNsQbH5pJyZW30wj4KVZ3AoGBAIK98BVeKQVf8qDFqx9ovMuNgVSxpd+N0Yta -5ZEy1OI2ziu5RhjueIM2K7Gq2Mnp38ob1AM53BUxqlcBJaHEDa6rj6yvuMgW9oCJ -dImBM8sIFxfBbXNbpJiMaDwa6WyT84OkpDE6uuAepTMnWOUWkUVkAiyokHDUGXkG -GyoQblbXAoGBAIsf7TaZ804sUWwRV0wI8DYx+hxD5QdrfYPYMtL2fHn3lICimGt0 -FTtUZ25jKg0E0DMBPdET6ZEHB3ZZkR8hFoUzZhdnyJMu3UjVtgaV88Ue3PrXxchk -0W2jHPaAgQU3JIWzo8HFIFqvC/HEL+EyW3rBTY2uXM3XGI+YcWSA4ZrZAhUAsY2f -bDFNzgZ4DaZ9wLRzTgOswPU= ------END DSA PRIVATE KEY----- diff --git a/regress/unittests/sshkey/testdata/dsa_2.fp b/regress/unittests/sshkey/testdata/dsa_2.fp deleted file mode 100644 index 51fbeb4d8ce1..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_2.fp +++ /dev/null @@ -1 +0,0 @@ -SHA256:ecwhWcXgpdBxZ2e+OjpRRY7dqXHHCD62BGtoVQQBwCk diff --git a/regress/unittests/sshkey/testdata/dsa_2.fp.bb b/regress/unittests/sshkey/testdata/dsa_2.fp.bb deleted file mode 100644 index 4d908ee30977..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_2.fp.bb +++ /dev/null @@ -1 +0,0 @@ -xeser-megad-pocan-rozit-belup-tapoh-fapif-kyvit-vonav-cehab-naxax diff --git a/regress/unittests/sshkey/testdata/dsa_2.pub b/regress/unittests/sshkey/testdata/dsa_2.pub deleted file mode 100644 index 77bb555d595f..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_2.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-dss AAAAB3NzaC1kc3MAAACBAJvI9c10d4uyOmhs9UIyR9qAGS3XlmyW2p/88Y0/XLVy7PuuxNdl6RDBSRJM2blyipd75k7DY7i2OhskN3rQjX9U+BoHQ1iVBH0efzszbzhYPh/pVj5q6ceY/XfhrzJsbkbg2pU0XeKG/EBHalUhOpvuQTjqva5hk1w2Ucjy+hELAAAAFQDHD28KhTbEGx+aScmVt9MI+ClWdwAAAIEAgr3wFV4pBV/yoMWrH2i8y42BVLGl343Ri1rlkTLU4jbOK7lGGO54gzYrsarYyenfyhvUAzncFTGqVwElocQNrquPrK+4yBb2gIl0iYEzywgXF8Ftc1ukmIxoPBrpbJPzg6SkMTq64B6lMydY5RaRRWQCLKiQcNQZeQYbKhBuVtcAAACBAIsf7TaZ804sUWwRV0wI8DYx+hxD5QdrfYPYMtL2fHn3lICimGt0FTtUZ25jKg0E0DMBPdET6ZEHB3ZZkR8hFoUzZhdnyJMu3UjVtgaV88Ue3PrXxchk0W2jHPaAgQU3JIWzo8HFIFqvC/HEL+EyW3rBTY2uXM3XGI+YcWSA4ZrZ DSA test key #2 diff --git a/regress/unittests/sshkey/testdata/dsa_n b/regress/unittests/sshkey/testdata/dsa_n deleted file mode 100644 index 657624e0e72f..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_n +++ /dev/null @@ -1,21 +0,0 @@ ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABswAAAAdzc2gtZH -NzAAAAgQD6kutNFRsHTwEAv6d39Lhsqy1apdHBZ9c2HfyRr7WmypyGIy2mKa43vzXI8CNw -mRSYs+A6d0vJC7Pl+f9QzJ/04NWOA+MiwfurwrR3CRe61QRYb8PymcHOxueHs95IcjrbIP -Nn86cjnPP5qvv/guUzCjuww4zBdJOXpligrGt2XwAAABUAowP/nSpDLuPwloyT7X5e2DWk -rTUAAACBAO7l9QVVbSSoy5lq6cOtvpf8UlwOa6+zBwblo4gmFd1RwX1yWkA8kQ7RrhCSg8 -Hc6mIGnKRgKRli/3LgbSfZ0obFJehkRtEWtN4Ph8fVUeS74iQbIwFQeKlYHIlNTRoGtAbd -i3nHdV+BBkEQc1V3rjqYqhjOoz/yNsgzLND26HrdAAAAgQDnV6cn5qGxAWjqmQLr4I9T9L -oYxtj99VH7q79thVjwVNwPaq5MWzl8BNC8L4wr67EFf5a2ISc/7YsrONFXmobpVmROUgBz -FxiH/eS4i0oGlzI5KO46KLfiyvOJbS8psGeEDJ2I52UknJX9VLskDHFLW9+PiNLvWHJ8oa -dpkhbELQAAAdhWTOFbVkzhWwAAAAdzc2gtZHNzAAAAgQD6kutNFRsHTwEAv6d39Lhsqy1a -pdHBZ9c2HfyRr7WmypyGIy2mKa43vzXI8CNwmRSYs+A6d0vJC7Pl+f9QzJ/04NWOA+Miwf -urwrR3CRe61QRYb8PymcHOxueHs95IcjrbIPNn86cjnPP5qvv/guUzCjuww4zBdJOXplig -rGt2XwAAABUAowP/nSpDLuPwloyT7X5e2DWkrTUAAACBAO7l9QVVbSSoy5lq6cOtvpf8Ul -wOa6+zBwblo4gmFd1RwX1yWkA8kQ7RrhCSg8Hc6mIGnKRgKRli/3LgbSfZ0obFJehkRtEW -tN4Ph8fVUeS74iQbIwFQeKlYHIlNTRoGtAbdi3nHdV+BBkEQc1V3rjqYqhjOoz/yNsgzLN -D26HrdAAAAgQDnV6cn5qGxAWjqmQLr4I9T9LoYxtj99VH7q79thVjwVNwPaq5MWzl8BNC8 -L4wr67EFf5a2ISc/7YsrONFXmobpVmROUgBzFxiH/eS4i0oGlzI5KO46KLfiyvOJbS8psG -eEDJ2I52UknJX9VLskDHFLW9+PiNLvWHJ8oadpkhbELQAAABRYIbQ5KfXsZuBPuWe5FJz3 -ldaEgwAAAAAB ------END OPENSSH PRIVATE KEY----- diff --git a/regress/unittests/sshkey/testdata/dsa_n_pw b/regress/unittests/sshkey/testdata/dsa_n_pw deleted file mode 100644 index 24ac299a482d..000000000000 --- a/regress/unittests/sshkey/testdata/dsa_n_pw +++ /dev/null @@ -1,21 +0,0 @@ ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABCVs+LsMJ -wnB5zM9U9pTXrGAAAAEAAAAAEAAAGzAAAAB3NzaC1kc3MAAACBAPqS600VGwdPAQC/p3f0 -uGyrLVql0cFn1zYd/JGvtabKnIYjLaYprje/NcjwI3CZFJiz4Dp3S8kLs+X5/1DMn/Tg1Y -4D4yLB+6vCtHcJF7rVBFhvw/KZwc7G54ez3khyOtsg82fzpyOc8/mq+/+C5TMKO7DDjMF0 -k5emWKCsa3ZfAAAAFQCjA/+dKkMu4/CWjJPtfl7YNaStNQAAAIEA7uX1BVVtJKjLmWrpw6 -2+l/xSXA5rr7MHBuWjiCYV3VHBfXJaQDyRDtGuEJKDwdzqYgacpGApGWL/cuBtJ9nShsUl -6GRG0Ra03g+Hx9VR5LviJBsjAVB4qVgciU1NGga0Bt2Lecd1X4EGQRBzVXeuOpiqGM6jP/ -I2yDMs0Pboet0AAACBAOdXpyfmobEBaOqZAuvgj1P0uhjG2P31Ufurv22FWPBU3A9qrkxb -OXwE0LwvjCvrsQV/lrYhJz/tiys40VeahulWZE5SAHMXGIf95LiLSgaXMjko7joot+LK84 -ltLymwZ4QMnYjnZSSclf1UuyQMcUtb34+I0u9Ycnyhp2mSFsQtAAAB4HiOcRW4w+sIqBL0 -TPVbf0glN1hUi0rcE63Pqxmvxb8LkldC4IxAUagPrjhNAEW2AY42+CvPrtGB1z7gDADAIW -xZX6wKwIcXP0Qh+xHE12F4u6mwfasssnAp4t1Ki8uCjMjnimgb3KdWpp0kiUV0oR062TXV -PAdfrWjaq4fw0KOqbHIAG/v36AqzuqjSTfDbqvLZM3y0gp2Q1RxaQVJA5ZIKKyqRyFX7sr -BaEIyCgeE3hM0EB7BycY1oIcS/eNxrACBWVJCENl5N7LtEYXNX7TANFniztfXzwaqGTT6A -fCfbW4gz1UKldLUBzbIrPwMWlirAstbHvOf/2Iay2pNAs/SHhI0aF2jsGfvv5/D6N+r9dG -B2SgDKBg7pywMH1DTvg6YT3P4GjCx0GUHqRCFLvD1rDdk4KSjvaRMpVq1PJ0/Wv6UGtsMS -TR0PaEHDRNZqAX4YxqujnWrGKuRJhuz0eUvp7fZvbWHtiAMKV7368kkeUmkOHanb+TS+zs -KINX8ev8zJZ6WVr8Vl+IQavpv0i2bXwS6QqbEuifpv/+uBb7pqRiU4u8en0eMdX1bZoTPM -R6xHCnGD/Jpb3zS91Ya57T6CiXZ12KCaL6nWGnCkZVpzkfJ2HjFklWSWBQ6uyaosDQ== ------END OPENSSH PRIVATE KEY----- diff --git a/regress/unittests/sshkey/tests.c b/regress/unittests/sshkey/tests.c index 78aa9223d42b..5511e7b8900d 100644 --- a/regress/unittests/sshkey/tests.c +++ b/regress/unittests/sshkey/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */ +/* $OpenBSD: tests.c,v 1.2 2025/04/15 04:00:42 djm Exp $ */ /* * Regress test for sshbuf.h buffer API * @@ -12,6 +12,7 @@ void sshkey_tests(void); void sshkey_file_tests(void); void sshkey_fuzz_tests(void); +void sshkey_benchmarks(void); void tests(void) @@ -20,3 +21,10 @@ tests(void) sshkey_file_tests(); sshkey_fuzz_tests(); } + +void +benchmarks(void) +{ + printf("\n"); + sshkey_benchmarks(); +} diff --git a/regress/unittests/sshsig/Makefile b/regress/unittests/sshsig/Makefile index bc3c6c739d48..f8b6560eba18 100644 --- a/regress/unittests/sshsig/Makefile +++ b/regress/unittests/sshsig/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.3 2023/01/15 23:35:10 djm Exp $ +# $OpenBSD: Makefile,v 1.4 2025/05/06 06:05:48 djm Exp $ PROG=test_sshsig SRCS=tests.c @@ -6,7 +6,7 @@ SRCS=tests.c # From usr.bin/ssh SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c -SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c +SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c SRCS+=addr.c addrmatch.c bitmap.c sshsig.c SRCS+=ed25519.c hash.c diff --git a/regress/unittests/sshsig/mktestdata.sh b/regress/unittests/sshsig/mktestdata.sh index d2300f9c6ee1..b7c60cc27767 100755 --- a/regress/unittests/sshsig/mktestdata.sh +++ b/regress/unittests/sshsig/mktestdata.sh @@ -1,5 +1,5 @@ #!/bin/sh -# $OpenBSD: mktestdata.sh,v 1.1 2020/06/19 04:32:09 djm Exp $ +# $OpenBSD: mktestdata.sh,v 1.2 2025/05/06 06:05:48 djm Exp $ NAMESPACE=unittest @@ -17,14 +17,13 @@ else fi rm -f signed-data namespace -rm -f rsa dsa ecdsa ed25519 ecdsa_sk ed25519_sk -rm -f rsa.sig dsa.sig ecdsa.sig ed25519.sig ecdsa_sk.sig ed25519_sk.sig +rm -f rsa ecdsa ed25519 ecdsa_sk ed25519_sk +rm -f rsa.sig ecdsa.sig ed25519.sig ecdsa_sk.sig ed25519_sk.sig printf "This is a test, this is only a test" > signed-data printf "$NAMESPACE" > namespace ssh-keygen -t rsa -C "RSA test" -N "" -f rsa -m PEM -ssh-keygen -t dsa -C "DSA test" -N "" -f dsa -m PEM ssh-keygen -t ecdsa -C "ECDSA test" -N "" -f ecdsa -m PEM ssh-keygen -t ed25519 -C "ED25519 test key" -N "" -f ed25519 ssh-keygen -w "$SK_DUMMY" -t ecdsa-sk -C "ECDSA-SK test key" \ @@ -33,7 +32,6 @@ ssh-keygen -w "$SK_DUMMY" -t ed25519-sk -C "ED25519-SK test key" \ -N "" -f ed25519_sk ssh-keygen -Y sign -f rsa -n $NAMESPACE - < signed-data > rsa.sig -ssh-keygen -Y sign -f dsa -n $NAMESPACE - < signed-data > dsa.sig ssh-keygen -Y sign -f ecdsa -n $NAMESPACE - < signed-data > ecdsa.sig ssh-keygen -Y sign -f ed25519 -n $NAMESPACE - < signed-data > ed25519.sig ssh-keygen -w "$SK_DUMMY" \ diff --git a/regress/unittests/sshsig/testdata/dsa b/regress/unittests/sshsig/testdata/dsa deleted file mode 100644 index 7c0063efcdf5..000000000000 --- a/regress/unittests/sshsig/testdata/dsa +++ /dev/null @@ -1,12 +0,0 @@ ------BEGIN DSA PRIVATE KEY----- -MIIBuwIBAAKBgQCXpndQdz2mQVnk+lYOF3nxDT+h6SiJmUvBFhnFWBv8tG4pTOkb -EwGufLEzGpzjTj+3bjVau7LFt37AFrqs4Num272BWNsYNIjOlGPgq7Xjv32FN00x -JYh1DoRs1cGGnvohlsWEamGGhTHD1a9ipctPEBV+NrxtZMrl+pO/ZZg8vQIVAKJB -P3iNYSpSuW74+q4WxLCuK8O3AoGAQldE+BIuxlvoG1IFiWesx0CU+H2KO0SEZc9A -SX/qjOabh0Fb78ofTlEf9gWHFfat8SvSJQIOPMVlb76Lio8AAMT8Eaa/qQKKYmQL -dNq4MLhhjxx5KLGt6J2JyFPExCv+qnHYHD59ngtLwKyqGjpSC8LPLktdXn8W/Aad -Ly1K7+MCgYBsMHBczhSeUh8w7i20CVg4OlNTmfJRVU2tO6OpMxZ/quitRm3hLKSN -u4xRkvHJwi4LhQtv1SXvLI5gs5P3gCG8tsIAiyCqLinHha63iBdJpqhnV/x/j7dB -yJr3xJbnmLdWLkkCtNk1Ir1/CuEz+ufAyLGdKWksEAu1UUlb501BkwIVAILIa3Rg -0h7J9lQpHJphvF3K0M1T ------END DSA PRIVATE KEY----- diff --git a/regress/unittests/sshsig/testdata/dsa.pub b/regress/unittests/sshsig/testdata/dsa.pub deleted file mode 100644 index e77aa7ef41a0..000000000000 --- a/regress/unittests/sshsig/testdata/dsa.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-dss AAAAB3NzaC1kc3MAAACBAJemd1B3PaZBWeT6Vg4XefENP6HpKImZS8EWGcVYG/y0bilM6RsTAa58sTManONOP7duNVq7ssW3fsAWuqzg26bbvYFY2xg0iM6UY+CrteO/fYU3TTEliHUOhGzVwYae+iGWxYRqYYaFMcPVr2Kly08QFX42vG1kyuX6k79lmDy9AAAAFQCiQT94jWEqUrlu+PquFsSwrivDtwAAAIBCV0T4Ei7GW+gbUgWJZ6zHQJT4fYo7RIRlz0BJf+qM5puHQVvvyh9OUR/2BYcV9q3xK9IlAg48xWVvvouKjwAAxPwRpr+pAopiZAt02rgwuGGPHHkosa3onYnIU8TEK/6qcdgcPn2eC0vArKoaOlILws8uS11efxb8Bp0vLUrv4wAAAIBsMHBczhSeUh8w7i20CVg4OlNTmfJRVU2tO6OpMxZ/quitRm3hLKSNu4xRkvHJwi4LhQtv1SXvLI5gs5P3gCG8tsIAiyCqLinHha63iBdJpqhnV/x/j7dByJr3xJbnmLdWLkkCtNk1Ir1/CuEz+ufAyLGdKWksEAu1UUlb501Bkw== DSA test diff --git a/regress/unittests/sshsig/testdata/dsa.sig b/regress/unittests/sshsig/testdata/dsa.sig deleted file mode 100644 index 0b14ad6b8a7b..000000000000 --- a/regress/unittests/sshsig/testdata/dsa.sig +++ /dev/null @@ -1,13 +0,0 @@ ------BEGIN SSH SIGNATURE----- -U1NIU0lHAAAAAQAAAbEAAAAHc3NoLWRzcwAAAIEAl6Z3UHc9pkFZ5PpWDhd58Q0/oekoiZ -lLwRYZxVgb/LRuKUzpGxMBrnyxMxqc404/t241Wruyxbd+wBa6rODbptu9gVjbGDSIzpRj -4Ku14799hTdNMSWIdQ6EbNXBhp76IZbFhGphhoUxw9WvYqXLTxAVfja8bWTK5fqTv2WYPL -0AAAAVAKJBP3iNYSpSuW74+q4WxLCuK8O3AAAAgEJXRPgSLsZb6BtSBYlnrMdAlPh9ijtE -hGXPQEl/6ozmm4dBW+/KH05RH/YFhxX2rfEr0iUCDjzFZW++i4qPAADE/BGmv6kCimJkC3 -TauDC4YY8ceSixreidichTxMQr/qpx2Bw+fZ4LS8Csqho6UgvCzy5LXV5/FvwGnS8tSu/j -AAAAgGwwcFzOFJ5SHzDuLbQJWDg6U1OZ8lFVTa07o6kzFn+q6K1GbeEspI27jFGS8cnCLg -uFC2/VJe8sjmCzk/eAIby2wgCLIKouKceFrreIF0mmqGdX/H+Pt0HImvfElueYt1YuSQK0 -2TUivX8K4TP658DIsZ0paSwQC7VRSVvnTUGTAAAACHVuaXR0ZXN0AAAAAAAAAAZzaGE1MT -IAAAA3AAAAB3NzaC1kc3MAAAAodi5lr0pqBpO76OY4N1CtfR85BCgZ95qfVjP/e9lToj0q -lwjSJJXUjw== ------END SSH SIGNATURE----- diff --git a/regress/unittests/sshsig/tests.c b/regress/unittests/sshsig/tests.c index 80966bdd2c27..ef1a46edcbb2 100644 --- a/regress/unittests/sshsig/tests.c +++ b/regress/unittests/sshsig/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.4 2024/01/11 01:45:59 djm Exp $ */ +/* $OpenBSD: tests.c,v 1.6 2025/05/06 06:05:48 djm Exp $ */ /* * Regress test for sshbuf.h buffer API * @@ -103,11 +103,6 @@ tests(void) check_sig("rsa.pub", "rsa.sig", msg, namespace); TEST_DONE(); -#ifdef WITH_DSA - TEST_START("check DSA signature"); - check_sig("dsa.pub", "dsa.sig", msg, namespace); - TEST_DONE(); -#endif #ifdef OPENSSL_HAS_ECC TEST_START("check ECDSA signature"); @@ -142,3 +137,9 @@ tests(void) sshbuf_free(msg); free(namespace); } + +void +benchmarks(void) +{ + printf("no benchmarks\n"); +} diff --git a/regress/unittests/test_helper/test_helper.c b/regress/unittests/test_helper/test_helper.c index 8e10a7d45c1b..78d4af97d3b8 100644 --- a/regress/unittests/test_helper/test_helper.c +++ b/regress/unittests/test_helper/test_helper.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_helper.c,v 1.13 2021/12/14 21:25:27 deraadt Exp $ */ +/* $OpenBSD: test_helper.c,v 1.14 2025/04/15 04:00:42 djm Exp $ */ /* * Copyright (c) 2011 Damien Miller * @@ -21,18 +21,22 @@ #include #include - -#include +#include + +#include #include -#include +#include +#include +#include +#include #ifdef HAVE_STDINT_H # include #endif +#include #include #include -#include +#include #include -#include #ifdef WITH_OPENSSL #include @@ -43,12 +47,25 @@ # include #endif -#define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) - #include "entropy.h" #include "test_helper.h" #include "atomicio.h" +#include "match.h" +#include "misc.h" +#include "xmalloc.h" + +#define BENCH_FAST_DEADLINE 1 +#define BENCH_NORMAL_DEADLINE 10 +#define BENCH_SLOW_DEADLINE 60 +#define BENCH_SAMPLES_ALLOC 8192 +#define BENCH_COLUMN_WIDTH 40 +#define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) + +#ifndef CLOCK_REALTIME +# define CLOCK_REALTIME 0 +#endif + #define TEST_CHECK_INT(r, pred) do { \ switch (pred) { \ case TEST_EQ: \ @@ -123,6 +140,15 @@ static const char *data_dir = NULL; static char subtest_info[512]; static int fast = 0; static int slow = 0; +static int benchmark_detail_statistics = 0; + +static int benchmark = 0; +static const char *bench_name = NULL; +static char *benchmark_pattern = NULL; +static struct timespec bench_start_time, bench_finish_time; +static struct timespec *bench_samples; +static int bench_skip, bench_nruns, bench_nalloc; +double bench_accum_secs; int main(int argc, char **argv) @@ -169,8 +195,17 @@ main(int argc, char **argv) } } - while ((ch = getopt(argc, argv, "Ffvqd:")) != -1) { + while ((ch = getopt(argc, argv, "O:bBFfvqd:")) != -1) { switch (ch) { + case 'b': + benchmark = 1; + break; + case 'B': + benchmark = benchmark_detail_statistics = 1; + break; + case 'O': + benchmark_pattern = xstrdup(optarg); + break; case 'F': slow = 1; break; @@ -190,7 +225,8 @@ main(int argc, char **argv) break; default: fprintf(stderr, "Unrecognised command line option\n"); - fprintf(stderr, "Usage: %s [-v]\n", __progname); + fprintf(stderr, "Usage: %s [-vqfFbB] [-d data_dir] " + "[-O pattern]\n", __progname); exit(1); } } @@ -200,7 +236,10 @@ main(int argc, char **argv) if (verbose_mode) printf("\n"); - tests(); + if (benchmark) + benchmarks(); + else + tests(); #ifdef WINDOWS if (isModuliFileCopied) { @@ -208,7 +247,7 @@ main(int argc, char **argv) } #endif - if (!quiet_mode) + if (!quiet_mode && !benchmark) printf(" %u tests ok\n", test_number); return 0; } @@ -302,7 +341,7 @@ test_done(void) active_test_name = NULL; if (verbose_mode) printf("OK\n"); - else if (!quiet_mode) { + else if (!quiet_mode && !benchmark) { printf("."); fflush(stdout); } @@ -318,6 +357,12 @@ test_subtest_info(const char *fmt, ...) va_end(ap); } +int +test_is_benchmark(void) +{ + return benchmark; +} + void ssl_err_check(const char *file, int line) { @@ -621,3 +666,131 @@ assert_ptr(const char *file, int line, const char *a1, const char *a2, test_die(); } +static double +tstod(const struct timespec *ts) +{ + return (double)ts->tv_sec + ((double)ts->tv_nsec / 1000000000.0); +} + +void +bench_start(const char *file, int line, const char *name) +{ + char *cp; + + if (bench_name != NULL) { + fprintf(stderr, "\n%s:%d internal error: BENCH_START() called " + "while previous benchmark \"%s\" incomplete", + file, line, bench_name); + abort(); + } + cp = xstrdup(name); + lowercase(cp); + bench_skip = benchmark_pattern != NULL && + match_pattern_list(cp, benchmark_pattern, 1) != 1; + free(cp); + + bench_name = name; + bench_nruns = 0; + if (bench_skip) + return; + free(bench_samples); + bench_nalloc = BENCH_SAMPLES_ALLOC; + bench_samples = xcalloc(sizeof(*bench_samples), bench_nalloc); + bench_accum_secs = 0; +} + +int +bench_done(void) +{ + return bench_skip || bench_accum_secs >= (fast ? BENCH_FAST_DEADLINE : + (slow ? BENCH_SLOW_DEADLINE : BENCH_NORMAL_DEADLINE)); +} + +void +bench_case_start(const char *file, int line) +{ + clock_gettime(CLOCK_REALTIME, &bench_start_time); +} + +void +bench_case_finish(const char *file, int line) +{ + struct timespec ts; + + clock_gettime(CLOCK_REALTIME, &bench_finish_time); + timespecsub(&bench_finish_time, &bench_start_time, &ts); + if (bench_nruns >= bench_nalloc) { + if (bench_nalloc >= INT_MAX / 2) { + fprintf(stderr, "\n%s:%d benchmark %s too many samples", + __FILE__, __LINE__, bench_name); + abort(); + } + bench_samples = xrecallocarray(bench_samples, bench_nalloc, + bench_nalloc * 2, sizeof(*bench_samples)); + bench_nalloc *= 2; + } + bench_samples[bench_nruns++] = ts; + bench_accum_secs += tstod(&ts); +} + +static int +tscmp(const void *aa, const void *bb) +{ + const struct timespec *a = (const struct timespec *)aa; + const struct timespec *b = (const struct timespec *)bb; + + if (timespeccmp(a, b, ==)) + return 0; + return timespeccmp(a, b, <) ? -1 : 1; +} + +void +bench_finish(const char *file, int line, const char *unit) +{ + double std_dev = 0, mean_spr, mean_rps, med_spr, med_rps; + int i; + + if (bench_skip) + goto done; + + if (bench_nruns < 1) { + fprintf(stderr, "\n%s:%d benchmark %s never ran", file, line, + bench_name); + abort(); + } + /* median */ + qsort(bench_samples, bench_nruns, sizeof(*bench_samples), tscmp); + i = bench_nruns / 2; + med_spr = tstod(&bench_samples[i]); + if (bench_nruns > 1 && bench_nruns & 1) + med_spr = (med_spr + tstod(&bench_samples[i - 1])) / 2.0; + med_rps = (med_spr == 0.0) ? INFINITY : 1.0/med_spr; + /* mean */ + mean_spr = bench_accum_secs / (double)bench_nruns; + mean_rps = (mean_spr == 0.0) ? INFINITY : 1.0/mean_spr; + /* std. dev */ + std_dev = 0; + for (i = 0; i < bench_nruns; i++) { + std_dev = tstod(&bench_samples[i]) - mean_spr; + std_dev *= std_dev; + } + std_dev /= (double)bench_nruns; + std_dev = sqrt(std_dev); + if (benchmark_detail_statistics) { + printf("%s: %d runs in %0.3fs, %0.03f/%0.03f ms/%s " + "(mean/median), std.dev %0.03f ms, " + "%0.2f/%0.2f %s/s (mean/median)\n", + bench_name, bench_nruns, bench_accum_secs, + mean_spr * 1000, med_spr * 1000, unit, std_dev * 1000, + mean_rps, med_rps, unit); + } else { + printf("%-*s %0.2f %s/s\n", BENCH_COLUMN_WIDTH, + bench_name, med_rps, unit); + } + done: + bench_name = NULL; + bench_nruns = 0; + free(bench_samples); + bench_samples = NULL; + bench_skip = 0; +} diff --git a/regress/unittests/test_helper/test_helper.h b/regress/unittests/test_helper/test_helper.h index 66302201cec3..23338af38882 100644 --- a/regress/unittests/test_helper/test_helper.h +++ b/regress/unittests/test_helper/test_helper.h @@ -1,4 +1,4 @@ -/* $OpenBSD: test_helper.h,v 1.9 2018/10/17 23:28:05 djm Exp $ */ +/* $OpenBSD: test_helper.h,v 1.10 2025/04/15 04:00:42 djm Exp $ */ /* * Copyright (c) 2011 Damien Miller * @@ -39,6 +39,7 @@ typedef void (test_onerror_func_t)(void *); /* Supplied by test suite */ void tests(void); +void benchmarks(void); const char *test_data_file(const char *name); void test_start(const char *n); @@ -49,6 +50,7 @@ int test_is_verbose(void); int test_is_quiet(void); int test_is_fast(void); int test_is_slow(void); +int test_is_benchmark(void); void test_subtest_info(const char *fmt, ...) __attribute__((format(printf, 1, 2))); void ssl_err_check(const char *file, int line); @@ -285,6 +287,26 @@ void assert_u64(const char *file, int line, #define ASSERT_U64_GE(a1, a2) \ assert_u64(__FILE__, __LINE__, #a1, #a2, a1, a2, TEST_GE) +/* Benchmarking support */ +#define BENCH_START(name) \ + do { \ + bench_start(__FILE__, __LINE__, name); \ + while (!bench_done()) { \ + bench_case_start(__FILE__, __LINE__); \ + do { +#define BENCH_FINISH(unit) \ + } while (0); \ + bench_case_finish(__FILE__, __LINE__); \ + } \ + bench_finish(__FILE__, __LINE__, unit); \ + } while (0) + +void bench_start(const char *file, int line, const char *name); +void bench_case_start(const char *file, int line); +void bench_case_finish(const char *file, int line); +void bench_finish(const char *file, int line, const char *unit); +int bench_done(void); + /* Fuzzing support */ struct fuzz; diff --git a/regress/unittests/utf8/Makefile b/regress/unittests/utf8/Makefile index f8eec0484f8f..e89536500822 100644 --- a/regress/unittests/utf8/Makefile +++ b/regress/unittests/utf8/Makefile @@ -1,14 +1,15 @@ -# $OpenBSD: Makefile,v 1.5 2017/12/21 00:41:22 djm Exp $ +# $OpenBSD: Makefile,v 1.6 2025/04/15 04:00:42 djm Exp $ PROG=test_utf8 SRCS=tests.c # From usr.bin/ssh -SRCS+=utf8.c atomicio.c +SRCS+=utf8.c atomicio.c misc.c xmalloc.c match.c ssherr.c cleanup.c fatal.c +SRCS+=sshbuf.c sshbuf-getput-basic.c sshbuf-misc.c addr.c addrmatch.c log.c REGRESS_TARGETS=run-regress-${PROG} run-regress-${PROG}: ${PROG} - env ${TEST_ENV} ./${PROG} + env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} .include diff --git a/regress/unittests/utf8/tests.c b/regress/unittests/utf8/tests.c index 8cf524ddb210..3fb63415e1ad 100644 --- a/regress/unittests/utf8/tests.c +++ b/regress/unittests/utf8/tests.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tests.c,v 1.4 2017/02/19 00:11:29 djm Exp $ */ +/* $OpenBSD: tests.c,v 1.5 2025/04/15 04:00:42 djm Exp $ */ /* * Regress test for the utf8.h *mprintf() API * @@ -102,3 +102,9 @@ tests(void) one(0, "double_fit", "a\343\201\201", 7, 5, -1, "a\\343"); one(0, "double_spc", "a\343\201\201", 13, 13, 13, "a\\343\\201\\201"); } + +void +benchmarks(void) +{ + printf("no benchmarks\n"); +} diff --git a/regress/unittests/win32compat/tests.c b/regress/unittests/win32compat/tests.c index ae27730dc757..756d6b8b394c 100644 --- a/regress/unittests/win32compat/tests.c +++ b/regress/unittests/win32compat/tests.c @@ -27,6 +27,12 @@ tests() miscellaneous_tests(); } +void +benchmarks(void) +{ + tests(); +} + char * dup_str(char *inStr) { diff --git a/scp.1 b/scp.1 index aa2e2d8b53f8..ff739e8b8304 100644 --- a/scp.1 +++ b/scp.1 @@ -8,9 +8,9 @@ .\" .\" Created: Sun May 7 00:14:37 1995 ylo .\" -.\" $OpenBSD: scp.1,v 1.113 2024/12/06 15:12:56 djm Exp $ +.\" $OpenBSD: scp.1,v 1.114 2025/04/14 05:41:42 jmc Exp $ .\" -.Dd $Mdocdate: December 6 2024 $ +.Dd $Mdocdate: April 14 2025 $ .Dt SCP 1 .Os .Sh NAME @@ -76,15 +76,16 @@ The options are as follows: .Bl -tag -width Ds .It Fl 3 Copies between two remote hosts are transferred through the local host. -Without this option the data is copied directly between the two remote -hosts. -Note that, when using the legacy SCP protocol (via the +This mode is the default, +but see also the +.Fl R +option for copying data directly between two remote hosts. +Note that when using the legacy SCP protocol (via the .Fl O flag), this option selects batch mode for the second host as .Nm cannot ask for passwords or passphrases for both hosts. -This mode is the default. .It Fl 4 Forces .Nm @@ -278,7 +279,9 @@ Quiet mode: disables the progress meter as well as warning and diagnostic messages from .Xr ssh 1 . .It Fl R -Copies between two remote hosts are performed by connecting to the origin +Copies between two remote hosts are transferred through the local host +by default. +This option instead copies between two remote hosts by connecting to the origin host and executing .Nm there. diff --git a/session.c b/session.c index 0308f5bd7d8c..5949e8c89d07 100644 --- a/session.c +++ b/session.c @@ -1,4 +1,4 @@ -/* $OpenBSD: session.c,v 1.341 2025/04/09 07:00:03 djm Exp $ */ +/* $OpenBSD: session.c,v 1.342 2025/05/05 02:48:06 djm Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved @@ -178,7 +178,6 @@ static char *auth_info_file = NULL; /* Name and directory of socket for authentication agent forwarding. */ static char *auth_sock_name = NULL; -static char *auth_sock_dir = NULL; /* removes the agent forwarding socket */ @@ -188,7 +187,6 @@ auth_sock_cleanup_proc(struct passwd *pw) if (auth_sock_name != NULL) { temporarily_use_uid(pw); unlink(auth_sock_name); - rmdir(auth_sock_dir); auth_sock_name = NULL; restore_uid(); } @@ -208,32 +206,15 @@ auth_input_request_forwarding(struct ssh *ssh, struct passwd * pw) /* Temporarily drop privileged uid for mkdir/bind. */ temporarily_use_uid(pw); - /* Allocate a buffer for the socket name, and format the name. */ - auth_sock_dir = xstrdup("/tmp/ssh-XXXXXXXXXX"); - - /* Create private directory for socket */ - if (mkdtemp(auth_sock_dir) == NULL) { + if (agent_listener(pw->pw_dir, "sshd", &sock, &auth_sock_name) != 0) { + /* a more detailed error is already logged */ ssh_packet_send_debug(ssh, "Agent forwarding disabled: " - "mkdtemp() failed: %.100s", strerror(errno)); + "couldn't create listener socket"); restore_uid(); - free(auth_sock_dir); - auth_sock_dir = NULL; goto authsock_err; } - - xasprintf(&auth_sock_name, "%s/agent.%ld", - auth_sock_dir, (long) getpid()); - - /* Start a Unix listener on auth_sock_name. */ - sock = unix_listener(auth_sock_name, SSH_LISTEN_BACKLOG, 0); - - /* Restore the privileged uid. */ restore_uid(); - /* Check for socket/bind/listen failure. */ - if (sock < 0) - goto authsock_err; - /* Allocate a channel for the authentication agent socket. */ nc = channel_new(ssh, "auth-listener", SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1, @@ -244,16 +225,9 @@ auth_input_request_forwarding(struct ssh *ssh, struct passwd * pw) authsock_err: free(auth_sock_name); - if (auth_sock_dir != NULL) { - temporarily_use_uid(pw); - rmdir(auth_sock_dir); - restore_uid(); - free(auth_sock_dir); - } if (sock != -1) close(sock); auth_sock_name = NULL; - auth_sock_dir = NULL; return 0; } diff --git a/ssh-add.c b/ssh-add.c index b90ae87b8455..2a98868faf29 100644 --- a/ssh-add.c +++ b/ssh-add.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-add.c,v 1.173 2024/09/06 02:30:44 djm Exp $ */ +/* $OpenBSD: ssh-add.c,v 1.174 2025/05/06 05:40:56 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -85,9 +85,6 @@ static char *default_files[] = { _PATH_SSH_CLIENT_ID_ED25519, _PATH_SSH_CLIENT_ID_ED25519_SK, _PATH_SSH_CLIENT_ID_XMSS, -#ifdef WITH_DSA - _PATH_SSH_CLIENT_ID_DSA, -#endif NULL }; diff --git a/ssh-agent.1 b/ssh-agent.1 index 533ad6d3a6d2..9f56e3efdc08 100644 --- a/ssh-agent.1 +++ b/ssh-agent.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-agent.1,v 1.82 2025/02/09 18:24:08 schwarze Exp $ +.\" $OpenBSD: ssh-agent.1,v 1.84 2025/05/05 05:47:28 jmc Exp $ .\" .\" Author: Tatu Ylonen .\" Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -34,7 +34,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: February 9 2025 $ +.Dd $Mdocdate: May 5 2025 $ .Dt SSH-AGENT 1 .Os .Sh NAME @@ -43,13 +43,14 @@ .Sh SYNOPSIS .Nm ssh-agent .Op Fl c | s -.Op Fl \&Dd +.Op Fl \&DdTU .Op Fl a Ar bind_address .Op Fl E Ar fingerprint_hash .Op Fl O Ar option .Op Fl P Ar allowed_providers .Op Fl t Ar life .Nm ssh-agent +.Op Fl TU .Op Fl a Ar bind_address .Op Fl E Ar fingerprint_hash .Op Fl O Ar option @@ -59,6 +60,8 @@ .Nm ssh-agent .Op Fl c | s .Fl k +.Nm ssh-agent +.Fl u .Sh DESCRIPTION .Nm is a program to hold private keys used for public key authentication. @@ -74,8 +77,8 @@ Bind the agent to the .Ux Ns -domain socket .Ar bind_address . -The default is -.Pa $TMPDIR/ssh-XXXXXXXXXX/agent.\*(Ltppid\*(Gt . +The default is to create a socket at a random path matching +.Pa $HOME/.ssh/agent/s.* . .It Fl c Generate C-shell commands on standard output. This is the default if @@ -173,6 +176,11 @@ Generate Bourne shell commands on standard output. This is the default if .Ev SHELL does not look like it's a csh style of shell. +.It Fl T +Bind the agent socket in a randomised subdirectory of the form +.Pa $TMPDIR/ssh-XXXXXXXXXX/agent.\*(Ltppid\*(Gt , +instead of the default behaviour of using a randomised name matching +.Pa $HOME/.ssh/agent/s.* . .It Fl t Ar life Set a default value for the maximum lifetime of identities added to the agent. The lifetime may be specified in seconds or in a time format specified in @@ -181,6 +189,20 @@ A lifetime specified for an identity with .Xr ssh-add 1 overrides this value. Without this option the default maximum lifetime is forever. +.It Fl U +Instructs +.Nm +not to clean up stale agent sockets under +.Pa $HOME/.ssh/agent/ . +.It Fl u +Instructs +.Nm +to only clean up stale agent sockets under +.Pa $HOME/.ssh/agent/ +and then exit immediately. +If this option is given twice, +.Nm +will delete stale agent sockets regardless of the host name that created them. .It Ar command Op Ar arg ... If a command (and optional arguments) is given, this is executed as a subprocess of the agent. diff --git a/ssh-agent.c b/ssh-agent.c index c27c5a956f2c..8a88ef3fd1c0 100644 --- a/ssh-agent.c +++ b/ssh-agent.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-agent.c,v 1.310 2025/02/18 08:02:48 djm Exp $ */ +/* $OpenBSD: ssh-agent.c,v 1.312 2025/05/05 02:48:06 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -2208,20 +2208,23 @@ static void usage(void) { fprintf(stderr, - "usage: ssh-agent [-c | -s] [-Dd] [-a bind_address] [-E fingerprint_hash]\n" + "usage: ssh-agent [-c | -s] [-DdTU] [-a bind_address] [-E fingerprint_hash]\n" " [-O option] [-P allowed_providers] [-t life]\n" - " ssh-agent [-a bind_address] [-E fingerprint_hash] [-O option]\n" + " ssh-agent [-TU] [-a bind_address] [-E fingerprint_hash] [-O option]\n" " [-P allowed_providers] [-t life] command [arg ...]\n" - " ssh-agent [-c | -s] -k\n"); + " ssh-agent [-c | -s] -k\n" + " ssh-agent -u\n"); exit(1); } int main(int ac, char **av) { - int c_flag = 0, d_flag = 0, D_flag = 0, k_flag = 0, s_flag = 0; + int c_flag = 0, d_flag = 0, D_flag = 0, k_flag = 0; + int s_flag = 0, T_flag = 0, u_flag = 0, U_flag = 0; int sock = -1, ch, result, saved_errno; - char *shell, *format, *fdstr, *pidstr, *agentsocket = NULL; + char *homedir = NULL, *shell, *format, *pidstr, *agentsocket = NULL; + char *fdstr; const char *errstr = NULL; const char *ccp; #ifdef HAVE_SETRLIMIT @@ -2256,7 +2259,7 @@ main(int ac, char **av) __progname = ssh_get_progname(av[0]); seed_rng(); - while ((ch = getopt(ac, av, "cDdksE:a:O:P:t:")) != -1) { + while ((ch = getopt(ac, av, "cDdksTuUE:a:O:P:t:")) != -1) { switch (ch) { case 'E': fingerprint_hash = ssh_digest_alg_by_name(optarg); @@ -2313,6 +2316,15 @@ main(int ac, char **av) usage(); } break; + case 'T': + T_flag++; + break; + case 'u': + u_flag++; + break; + case 'U': + U_flag++; + break; default: usage(); } @@ -2320,9 +2332,14 @@ main(int ac, char **av) ac -= optind; av += optind; - if (ac > 0 && (c_flag || k_flag || s_flag || d_flag || D_flag)) + if (ac > 0 && + (c_flag || k_flag || s_flag || d_flag || D_flag || u_flag)) usage(); + log_init(__progname, + d_flag ? SYSLOG_LEVEL_DEBUG3 : SYSLOG_LEVEL_INFO, + SYSLOG_FACILITY_AUTH, 1); + if (allowed_providers == NULL) allowed_providers = xstrdup(DEFAULT_ALLOWED_PROVIDERS); if (websafe_allowlist == NULL) @@ -2358,6 +2375,14 @@ main(int ac, char **av) printf("echo Agent pid %ld killed;\n", (long)pid); exit(0); } + if (u_flag) { + if ((homedir = get_homedir()) == NULL) + fatal("Couldn't determine home directory"); + agent_cleanup_stale(homedir, u_flag > 1); + printf("Deleted stale agent sockets in ~/%s\n", + _PATH_SSH_AGENT_SOCKET_DIR); + exit(0); + } /* * Minimum file descriptors: @@ -2391,22 +2416,52 @@ main(int ac, char **av) sock = 3; } - /* Otherwise, create private directory for agent socket */ - if (sock == -1) { - if (agentsocket == NULL) { + if (sock == -1 && agentsocket == NULL && !T_flag) { + /* Default case: ~/.ssh/agent/[socket] */ + if ((homedir = get_homedir()) == NULL) + fatal("Couldn't determine home directory"); + if (!U_flag) + agent_cleanup_stale(homedir, 0); + if (agent_listener(homedir, "agent", &sock, &agentsocket) != 0) + fatal_f("Couldn't prepare agent socket"); + if (strlcpy(socket_name, agentsocket, + sizeof(socket_name)) >= sizeof(socket_name)) { + fatal_f("Socket path \"%s\" too long", + agentsocket); + } + free(homedir); + free(agentsocket); + agentsocket = NULL; + } else if (sock == -1) { + if (T_flag) { + /* + * Create private directory for agent socket + * in $TMPDIR. + */ mktemp_proto(socket_dir, sizeof(socket_dir)); if (mkdtemp(socket_dir) == NULL) { perror("mkdtemp: private socket dir"); exit(1); } - snprintf(socket_name, sizeof socket_name, - "%s/agent.%ld", socket_dir, - (long)parent_pid); + snprintf(socket_name, sizeof(socket_name), + "%s/agent.%ld", socket_dir, (long)parent_pid); } else { /* Try to use specified agent socket */ socket_dir[0] = '\0'; - strlcpy(socket_name, agentsocket, sizeof socket_name); + if (strlcpy(socket_name, agentsocket, + sizeof(socket_name)) >= sizeof(socket_name)) { + fatal_f("Socket path \"%s\" too long", + agentsocket); + } + } + /* Listen on socket */ + prev_mask = umask(0177); + if ((sock = unix_listener(socket_name, + SSH_LISTEN_BACKLOG, 0)) < 0) { + *socket_name = '\0'; /* Don't unlink existing file */ + cleanup_exit(1); } + umask(prev_mask); } closefrom(sock == -1 ? STDERR_FILENO + 1 : sock + 1); @@ -2526,7 +2581,7 @@ main(int ac, char **av) } if (signalled_keydrop) { logit("signal %d received; removing all keys", - signalled_keydrop); + (int)signalled_keydrop); remove_all_identities(); signalled_keydrop = 0; } diff --git a/ssh-dss.c b/ssh-dss.c deleted file mode 100644 index aea661377f5c..000000000000 --- a/ssh-dss.c +++ /dev/null @@ -1,457 +0,0 @@ -/* $OpenBSD: ssh-dss.c,v 1.50 2024/01/11 01:45:36 djm Exp $ */ -/* - * Copyright (c) 2000 Markus Friedl. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. - * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -#include "includes.h" - -#if defined(WITH_OPENSSL) && defined(WITH_DSA) - -#include - -#include -#include -#include - -#include -#include - -#include "sshbuf.h" -#include "ssherr.h" -#include "digest.h" -#define SSHKEY_INTERNAL -#include "sshkey.h" - -#include "openbsd-compat/openssl-compat.h" - -#define INTBLOB_LEN 20 -#define SIGBLOB_LEN (2*INTBLOB_LEN) - -static u_int -ssh_dss_size(const struct sshkey *key) -{ - const BIGNUM *dsa_p; - - if (key->dsa == NULL) - return 0; - DSA_get0_pqg(key->dsa, &dsa_p, NULL, NULL); - return BN_num_bits(dsa_p); -} - -static int -ssh_dss_alloc(struct sshkey *k) -{ - if ((k->dsa = DSA_new()) == NULL) - return SSH_ERR_ALLOC_FAIL; - return 0; -} - -static void -ssh_dss_cleanup(struct sshkey *k) -{ - DSA_free(k->dsa); - k->dsa = NULL; -} - -static int -ssh_dss_equal(const struct sshkey *a, const struct sshkey *b) -{ - const BIGNUM *dsa_p_a, *dsa_q_a, *dsa_g_a, *dsa_pub_key_a; - const BIGNUM *dsa_p_b, *dsa_q_b, *dsa_g_b, *dsa_pub_key_b; - - if (a->dsa == NULL || b->dsa == NULL) - return 0; - DSA_get0_pqg(a->dsa, &dsa_p_a, &dsa_q_a, &dsa_g_a); - DSA_get0_pqg(b->dsa, &dsa_p_b, &dsa_q_b, &dsa_g_b); - DSA_get0_key(a->dsa, &dsa_pub_key_a, NULL); - DSA_get0_key(b->dsa, &dsa_pub_key_b, NULL); - if (dsa_p_a == NULL || dsa_p_b == NULL || - dsa_q_a == NULL || dsa_q_b == NULL || - dsa_g_a == NULL || dsa_g_b == NULL || - dsa_pub_key_a == NULL || dsa_pub_key_b == NULL) - return 0; - if (BN_cmp(dsa_p_a, dsa_p_b) != 0) - return 0; - if (BN_cmp(dsa_q_a, dsa_q_b) != 0) - return 0; - if (BN_cmp(dsa_g_a, dsa_g_b) != 0) - return 0; - if (BN_cmp(dsa_pub_key_a, dsa_pub_key_b) != 0) - return 0; - return 1; -} - -static int -ssh_dss_serialize_public(const struct sshkey *key, struct sshbuf *b, - enum sshkey_serialize_rep opts) -{ - int r; - const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; - - if (key->dsa == NULL) - return SSH_ERR_INVALID_ARGUMENT; - DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g); - DSA_get0_key(key->dsa, &dsa_pub_key, NULL); - if (dsa_p == NULL || dsa_q == NULL || - dsa_g == NULL || dsa_pub_key == NULL) - return SSH_ERR_INTERNAL_ERROR; - if ((r = sshbuf_put_bignum2(b, dsa_p)) != 0 || - (r = sshbuf_put_bignum2(b, dsa_q)) != 0 || - (r = sshbuf_put_bignum2(b, dsa_g)) != 0 || - (r = sshbuf_put_bignum2(b, dsa_pub_key)) != 0) - return r; - - return 0; -} - -static int -ssh_dss_serialize_private(const struct sshkey *key, struct sshbuf *b, - enum sshkey_serialize_rep opts) -{ - int r; - const BIGNUM *dsa_priv_key; - - DSA_get0_key(key->dsa, NULL, &dsa_priv_key); - if (!sshkey_is_cert(key)) { - if ((r = ssh_dss_serialize_public(key, b, opts)) != 0) - return r; - } - if ((r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0) - return r; - - return 0; -} - -static int -ssh_dss_generate(struct sshkey *k, int bits) -{ - DSA *private; - - if (bits != 1024) - return SSH_ERR_KEY_LENGTH; - if ((private = DSA_new()) == NULL) - return SSH_ERR_ALLOC_FAIL; - if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL, - NULL, NULL) || !DSA_generate_key(private)) { - DSA_free(private); - return SSH_ERR_LIBCRYPTO_ERROR; - } - k->dsa = private; - return 0; -} - -static int -ssh_dss_copy_public(const struct sshkey *from, struct sshkey *to) -{ - const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key; - BIGNUM *dsa_p_dup = NULL, *dsa_q_dup = NULL, *dsa_g_dup = NULL; - BIGNUM *dsa_pub_key_dup = NULL; - int r = SSH_ERR_INTERNAL_ERROR; - - DSA_get0_pqg(from->dsa, &dsa_p, &dsa_q, &dsa_g); - DSA_get0_key(from->dsa, &dsa_pub_key, NULL); - if ((dsa_p_dup = BN_dup(dsa_p)) == NULL || - (dsa_q_dup = BN_dup(dsa_q)) == NULL || - (dsa_g_dup = BN_dup(dsa_g)) == NULL || - (dsa_pub_key_dup = BN_dup(dsa_pub_key)) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } - if (!DSA_set0_pqg(to->dsa, dsa_p_dup, dsa_q_dup, dsa_g_dup)) { - r = SSH_ERR_LIBCRYPTO_ERROR; - goto out; - } - dsa_p_dup = dsa_q_dup = dsa_g_dup = NULL; /* transferred */ - if (!DSA_set0_key(to->dsa, dsa_pub_key_dup, NULL)) { - r = SSH_ERR_LIBCRYPTO_ERROR; - goto out; - } - dsa_pub_key_dup = NULL; /* transferred */ - /* success */ - r = 0; - out: - BN_clear_free(dsa_p_dup); - BN_clear_free(dsa_q_dup); - BN_clear_free(dsa_g_dup); - BN_clear_free(dsa_pub_key_dup); - return r; -} - -static int -ssh_dss_deserialize_public(const char *ktype, struct sshbuf *b, - struct sshkey *key) -{ - int ret = SSH_ERR_INTERNAL_ERROR; - BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL, *dsa_pub_key = NULL; - - if (sshbuf_get_bignum2(b, &dsa_p) != 0 || - sshbuf_get_bignum2(b, &dsa_q) != 0 || - sshbuf_get_bignum2(b, &dsa_g) != 0 || - sshbuf_get_bignum2(b, &dsa_pub_key) != 0) { - ret = SSH_ERR_INVALID_FORMAT; - goto out; - } - if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g)) { - ret = SSH_ERR_LIBCRYPTO_ERROR; - goto out; - } - dsa_p = dsa_q = dsa_g = NULL; /* transferred */ - if (!DSA_set0_key(key->dsa, dsa_pub_key, NULL)) { - ret = SSH_ERR_LIBCRYPTO_ERROR; - goto out; - } - dsa_pub_key = NULL; /* transferred */ -#ifdef DEBUG_PK - DSA_print_fp(stderr, key->dsa, 8); -#endif - /* success */ - ret = 0; - out: - BN_clear_free(dsa_p); - BN_clear_free(dsa_q); - BN_clear_free(dsa_g); - BN_clear_free(dsa_pub_key); - return ret; -} - -static int -ssh_dss_deserialize_private(const char *ktype, struct sshbuf *b, - struct sshkey *key) -{ - int r; - BIGNUM *dsa_priv_key = NULL; - - if (!sshkey_is_cert(key)) { - if ((r = ssh_dss_deserialize_public(ktype, b, key)) != 0) - return r; - } - - if ((r = sshbuf_get_bignum2(b, &dsa_priv_key)) != 0) - return r; - if (!DSA_set0_key(key->dsa, NULL, dsa_priv_key)) { - BN_clear_free(dsa_priv_key); - return SSH_ERR_LIBCRYPTO_ERROR; - } - return 0; -} - -static int -ssh_dss_sign(struct sshkey *key, - u_char **sigp, size_t *lenp, - const u_char *data, size_t datalen, - const char *alg, const char *sk_provider, const char *sk_pin, u_int compat) -{ - DSA_SIG *sig = NULL; - const BIGNUM *sig_r, *sig_s; - u_char digest[SSH_DIGEST_MAX_LENGTH], sigblob[SIGBLOB_LEN]; - size_t rlen, slen, len, dlen = ssh_digest_bytes(SSH_DIGEST_SHA1); - struct sshbuf *b = NULL; - int ret = SSH_ERR_INVALID_ARGUMENT; - - if (lenp != NULL) - *lenp = 0; - if (sigp != NULL) - *sigp = NULL; - - if (key == NULL || key->dsa == NULL || - sshkey_type_plain(key->type) != KEY_DSA) - return SSH_ERR_INVALID_ARGUMENT; - if (dlen == 0) - return SSH_ERR_INTERNAL_ERROR; - - if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, datalen, - digest, sizeof(digest))) != 0) - goto out; - - if ((sig = DSA_do_sign(digest, dlen, key->dsa)) == NULL) { - ret = SSH_ERR_LIBCRYPTO_ERROR; - goto out; - } - - DSA_SIG_get0(sig, &sig_r, &sig_s); - rlen = BN_num_bytes(sig_r); - slen = BN_num_bytes(sig_s); - if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) { - ret = SSH_ERR_INTERNAL_ERROR; - goto out; - } - explicit_bzero(sigblob, SIGBLOB_LEN); - BN_bn2bin(sig_r, sigblob + SIGBLOB_LEN - INTBLOB_LEN - rlen); - BN_bn2bin(sig_s, sigblob + SIGBLOB_LEN - slen); - - if ((b = sshbuf_new()) == NULL) { - ret = SSH_ERR_ALLOC_FAIL; - goto out; - } - if ((ret = sshbuf_put_cstring(b, "ssh-dss")) != 0 || - (ret = sshbuf_put_string(b, sigblob, SIGBLOB_LEN)) != 0) - goto out; - - len = sshbuf_len(b); - if (sigp != NULL) { - if ((*sigp = malloc(len)) == NULL) { - ret = SSH_ERR_ALLOC_FAIL; - goto out; - } - memcpy(*sigp, sshbuf_ptr(b), len); - } - if (lenp != NULL) - *lenp = len; - ret = 0; - out: - explicit_bzero(digest, sizeof(digest)); - DSA_SIG_free(sig); - sshbuf_free(b); - return ret; -} - -static int -ssh_dss_verify(const struct sshkey *key, - const u_char *sig, size_t siglen, - const u_char *data, size_t dlen, const char *alg, u_int compat, - struct sshkey_sig_details **detailsp) -{ - DSA_SIG *dsig = NULL; - BIGNUM *sig_r = NULL, *sig_s = NULL; - u_char digest[SSH_DIGEST_MAX_LENGTH], *sigblob = NULL; - size_t len, hlen = ssh_digest_bytes(SSH_DIGEST_SHA1); - int ret = SSH_ERR_INTERNAL_ERROR; - struct sshbuf *b = NULL; - char *ktype = NULL; - - if (key == NULL || key->dsa == NULL || - sshkey_type_plain(key->type) != KEY_DSA || - sig == NULL || siglen == 0) - return SSH_ERR_INVALID_ARGUMENT; - if (hlen == 0) - return SSH_ERR_INTERNAL_ERROR; - - /* fetch signature */ - if ((b = sshbuf_from(sig, siglen)) == NULL) - return SSH_ERR_ALLOC_FAIL; - if (sshbuf_get_cstring(b, &ktype, NULL) != 0 || - sshbuf_get_string(b, &sigblob, &len) != 0) { - ret = SSH_ERR_INVALID_FORMAT; - goto out; - } - if (strcmp("ssh-dss", ktype) != 0) { - ret = SSH_ERR_KEY_TYPE_MISMATCH; - goto out; - } - if (sshbuf_len(b) != 0) { - ret = SSH_ERR_UNEXPECTED_TRAILING_DATA; - goto out; - } - - if (len != SIGBLOB_LEN) { - ret = SSH_ERR_INVALID_FORMAT; - goto out; - } - - /* parse signature */ - if ((dsig = DSA_SIG_new()) == NULL || - (sig_r = BN_new()) == NULL || - (sig_s = BN_new()) == NULL) { - ret = SSH_ERR_ALLOC_FAIL; - goto out; - } - if ((BN_bin2bn(sigblob, INTBLOB_LEN, sig_r) == NULL) || - (BN_bin2bn(sigblob + INTBLOB_LEN, INTBLOB_LEN, sig_s) == NULL)) { - ret = SSH_ERR_LIBCRYPTO_ERROR; - goto out; - } - if (!DSA_SIG_set0(dsig, sig_r, sig_s)) { - ret = SSH_ERR_LIBCRYPTO_ERROR; - goto out; - } - sig_r = sig_s = NULL; /* transferred */ - - /* sha1 the data */ - if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, dlen, - digest, sizeof(digest))) != 0) - goto out; - - switch (DSA_do_verify(digest, hlen, dsig, key->dsa)) { - case 1: - ret = 0; - break; - case 0: - ret = SSH_ERR_SIGNATURE_INVALID; - goto out; - default: - ret = SSH_ERR_LIBCRYPTO_ERROR; - goto out; - } - - out: - explicit_bzero(digest, sizeof(digest)); - DSA_SIG_free(dsig); - BN_clear_free(sig_r); - BN_clear_free(sig_s); - sshbuf_free(b); - free(ktype); - if (sigblob != NULL) - freezero(sigblob, len); - return ret; -} - -static const struct sshkey_impl_funcs sshkey_dss_funcs = { - /* .size = */ ssh_dss_size, - /* .alloc = */ ssh_dss_alloc, - /* .cleanup = */ ssh_dss_cleanup, - /* .equal = */ ssh_dss_equal, - /* .ssh_serialize_public = */ ssh_dss_serialize_public, - /* .ssh_deserialize_public = */ ssh_dss_deserialize_public, - /* .ssh_serialize_private = */ ssh_dss_serialize_private, - /* .ssh_deserialize_private = */ ssh_dss_deserialize_private, - /* .generate = */ ssh_dss_generate, - /* .copy_public = */ ssh_dss_copy_public, - /* .sign = */ ssh_dss_sign, - /* .verify = */ ssh_dss_verify, -}; - -const struct sshkey_impl sshkey_dss_impl = { - /* .name = */ "ssh-dss", - /* .shortname = */ "DSA", - /* .sigalg = */ NULL, - /* .type = */ KEY_DSA, - /* .nid = */ 0, - /* .cert = */ 0, - /* .sigonly = */ 0, - /* .keybits = */ 0, - /* .funcs = */ &sshkey_dss_funcs, -}; - -const struct sshkey_impl sshkey_dsa_cert_impl = { - /* .name = */ "ssh-dss-cert-v01@openssh.com", - /* .shortname = */ "DSA-CERT", - /* .sigalg = */ NULL, - /* .type = */ KEY_DSA_CERT, - /* .nid = */ 0, - /* .cert = */ 1, - /* .sigonly = */ 0, - /* .keybits = */ 0, - /* .funcs = */ &sshkey_dss_funcs, -}; - -#endif /* WITH_OPENSSL && WITH_DSA */ diff --git a/ssh-keygen.c b/ssh-keygen.c index 533dfe142d0d..a6c9e1a2da8b 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keygen.c,v 1.477 2024/12/04 14:24:20 djm Exp $ */ +/* $OpenBSD: ssh-keygen.c,v 1.478 2025/05/06 05:40:56 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1994 Tatu Ylonen , Espoo, Finland @@ -74,18 +74,14 @@ #endif /* WINDOWS */ /* - * Default number of bits in the RSA, DSA and ECDSA keys. These value can be + * Default number of bits in the RSA and ECDSA keys. These value can be * overridden on the command line. * - * These values, with the exception of DSA, provide security equivalent to at - * least 128 bits of security according to NIST Special Publication 800-57: - * Recommendation for Key Management Part 1 rev 4 section 5.6.1. - * For DSA it (and FIPS-186-4 section 4.2) specifies that the only size for - * which a 160bit hash is acceptable is 1kbit, and since ssh-dss specifies only - * SHA1 we limit the DSA key size 1k bits. + * These values provide security equivalent to at least 128 bits of security + * according to NIST Special Publication 800-57: Recommendation for Key + * Management Part 1 rev 4 section 5.6.1. */ #define DEFAULT_BITS 3072 -#define DEFAULT_BITS_DSA 1024 #ifdef WINDOWS #define DEFAULT_BITS_ECDSA 384 #else @@ -193,9 +189,6 @@ type_bits_valid(int type, const char *name, u_int32_t *bitsp) int nid; switch(type) { - case KEY_DSA: - *bitsp = DEFAULT_BITS_DSA; - break; case KEY_ECDSA: if (name != NULL && (nid = sshkey_ecdsa_nid_from_name(name)) > 0) @@ -211,10 +204,6 @@ type_bits_valid(int type, const char *name, u_int32_t *bitsp) } #ifdef WITH_OPENSSL switch (type) { - case KEY_DSA: - if (*bitsp != 1024) - fatal("Invalid DSA key length: must be 1024 bits"); - break; case KEY_RSA: if (*bitsp < SSH_RSA_MINIMUM_MODULUS_SIZE) fatal("Invalid RSA key length: minimum is %d bits", @@ -274,12 +263,6 @@ ask_filename(struct passwd *pw, const char *prompt) #endif /* WINDOWS */ else { switch (sshkey_type_from_shortname(key_type_name)) { -#ifdef WITH_DSA - case KEY_DSA_CERT: - case KEY_DSA: - name = _PATH_SSH_CLIENT_ID_DSA; - break; -#endif #ifdef OPENSSL_HAS_ECC case KEY_ECDSA_CERT: case KEY_ECDSA: @@ -394,12 +377,6 @@ do_convert_to_pkcs8(struct sshkey *k) EVP_PKEY_get0_RSA(k->pkey))) fatal("PEM_write_RSA_PUBKEY failed"); break; -#ifdef WITH_DSA - case KEY_DSA: - if (!PEM_write_DSA_PUBKEY(stdout, k->dsa)) - fatal("PEM_write_DSA_PUBKEY failed"); - break; -#endif #ifdef OPENSSL_HAS_ECC case KEY_ECDSA: if (!PEM_write_EC_PUBKEY(stdout, @@ -422,12 +399,6 @@ do_convert_to_pem(struct sshkey *k) EVP_PKEY_get0_RSA(k->pkey))) fatal("PEM_write_RSAPublicKey failed"); break; -#ifdef WITH_DSA - case KEY_DSA: - if (!PEM_write_DSA_PUBKEY(stdout, k->dsa)) - fatal("PEM_write_DSA_PUBKEY failed"); - break; -#endif #ifdef OPENSSL_HAS_ECC case KEY_ECDSA: if (!PEM_write_EC_PUBKEY(stdout, @@ -503,10 +474,6 @@ do_convert_private_ssh2(struct sshbuf *b) u_int magic, i1, i2, i3, i4; size_t slen; u_long e; -#ifdef WITH_DSA - BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL; - BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL; -#endif BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL; BIGNUM *rsa_p = NULL, *rsa_q = NULL, *rsa_iqmp = NULL; BIGNUM *rsa_dmp1 = NULL, *rsa_dmq1 = NULL; @@ -538,10 +505,6 @@ do_convert_private_ssh2(struct sshbuf *b) if (strstr(type, "rsa")) { ktype = KEY_RSA; -#ifdef WITH_DSA - } else if (strstr(type, "dsa")) { - ktype = KEY_DSA; -#endif } else { free(type); return NULL; @@ -551,27 +514,6 @@ do_convert_private_ssh2(struct sshbuf *b) free(type); switch (key->type) { -#ifdef WITH_DSA - case KEY_DSA: - if ((dsa_p = BN_new()) == NULL || - (dsa_q = BN_new()) == NULL || - (dsa_g = BN_new()) == NULL || - (dsa_pub_key = BN_new()) == NULL || - (dsa_priv_key = BN_new()) == NULL) - fatal_f("BN_new"); - buffer_get_bignum_bits(b, dsa_p); - buffer_get_bignum_bits(b, dsa_g); - buffer_get_bignum_bits(b, dsa_q); - buffer_get_bignum_bits(b, dsa_pub_key); - buffer_get_bignum_bits(b, dsa_priv_key); - if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g)) - fatal_f("DSA_set0_pqg failed"); - dsa_p = dsa_q = dsa_g = NULL; /* transferred */ - if (!DSA_set0_key(key->dsa, dsa_pub_key, dsa_priv_key)) - fatal_f("DSA_set0_key failed"); - dsa_pub_key = dsa_priv_key = NULL; /* transferred */ - break; -#endif case KEY_RSA: if ((r = sshbuf_get_u8(b, &e1)) != 0 || (e1 < 30 && (r = sshbuf_get_u8(b, &e2)) != 0) || @@ -746,14 +688,6 @@ do_convert_from_pkcs8(struct sshkey **k, int *private) (*k)->pkey = pubkey; pubkey = NULL; break; -#ifdef WITH_DSA - case EVP_PKEY_DSA: - if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) - fatal("sshkey_new failed"); - (*k)->type = KEY_DSA; - (*k)->dsa = EVP_PKEY_get1_DSA(pubkey); - break; -#endif #ifdef OPENSSL_HAS_ECC case EVP_PKEY_EC: if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) @@ -829,12 +763,6 @@ do_convert_from(struct passwd *pw) fprintf(stdout, "\n"); } else { switch (k->type) { -#ifdef WITH_DSA - case KEY_DSA: - ok = PEM_write_DSAPrivateKey(stdout, k->dsa, NULL, - NULL, 0, NULL, NULL); - break; -#endif #ifdef OPENSSL_HAS_ECC case KEY_ECDSA: ok = PEM_write_ECPrivateKey(stdout, @@ -3381,7 +3309,7 @@ usage(void) fprintf(stderr, "usage: ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile]\n" " [-m format] [-N new_passphrase] [-O option]\n" - " [-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]\n" + " [-t ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]\n" " [-w provider] [-Z cipher]\n" " ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase]\n" " [-P old_passphrase] [-Z cipher]\n" @@ -3857,11 +3785,6 @@ main(int argc, char **argv) n += do_print_resource_record(pw, _PATH_HOST_RSA_KEY_FILE, rr_hostname, print_generic, opts, nopts); -#ifdef WITH_DSA - n += do_print_resource_record(pw, - _PATH_HOST_DSA_KEY_FILE, rr_hostname, - print_generic, opts, nopts); -#endif n += do_print_resource_record(pw, _PATH_HOST_ECDSA_KEY_FILE, rr_hostname, print_generic, opts, nopts); diff --git a/ssh-keyscan.c b/ssh-keyscan.c index 3436c0b5c7c6..7b1e0ca86500 100644 --- a/ssh-keyscan.c +++ b/ssh-keyscan.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keyscan.c,v 1.165 2024/12/06 15:17:15 djm Exp $ */ +/* $OpenBSD: ssh-keyscan.c,v 1.166 2025/05/06 05:40:56 djm Exp $ */ /* * Copyright 1995, 1996 by David Mazieres . * @@ -62,15 +62,14 @@ int IPv4or6 = AF_UNSPEC; int ssh_port = SSH_DEFAULT_PORT; -#define KT_DSA (1) -#define KT_RSA (1<<1) -#define KT_ECDSA (1<<2) -#define KT_ED25519 (1<<3) -#define KT_XMSS (1<<4) -#define KT_ECDSA_SK (1<<5) -#define KT_ED25519_SK (1<<6) +#define KT_RSA (1) +#define KT_ECDSA (1<<1) +#define KT_ED25519 (1<<2) +#define KT_XMSS (1<<3) +#define KT_ECDSA_SK (1<<4) +#define KT_ED25519_SK (1<<5) -#define KT_MIN KT_DSA +#define KT_MIN KT_RSA #define KT_MAX KT_ED25519_SK int get_cert = 0; @@ -240,10 +239,6 @@ keygrab_ssh2(con *c) int r; switch (c->c_keytype) { - case KT_DSA: - myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ? - "ssh-dss-cert-v01@openssh.com" : "ssh-dss"; - break; case KT_RSA: myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ? "rsa-sha2-512-cert-v01@openssh.com," @@ -743,11 +738,6 @@ main(int argc, char **argv) int type = sshkey_type_from_shortname(tname); switch (type) { -#ifdef WITH_DSA - case KEY_DSA: - get_keytypes |= KT_DSA; - break; -#endif case KEY_ECDSA: get_keytypes |= KT_ECDSA; break; diff --git a/ssh-keysign.c b/ssh-keysign.c index 955f7b0abad9..4d65dd1d33a0 100644 --- a/ssh-keysign.c +++ b/ssh-keysign.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keysign.c,v 1.75 2025/02/15 01:48:30 djm Exp $ */ +/* $OpenBSD: ssh-keysign.c,v 1.76 2025/05/06 05:40:56 djm Exp $ */ /* * Copyright (c) 2002 Markus Friedl. All rights reserved. * @@ -200,9 +200,6 @@ main(int argc, char **argv) i = 0; /* XXX This really needs to read sshd_config for the paths */ -#ifdef WITH_DSA - key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY); -#endif key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY); key_fd[i++] = open(_PATH_HOST_ED25519_KEY_FILE, O_RDONLY); key_fd[i++] = open(_PATH_HOST_XMSS_KEY_FILE, O_RDONLY); diff --git a/ssh.c b/ssh.c index ea94d25106cf..c90280eaced1 100644 --- a/ssh.c +++ b/ssh.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh.c,v 1.612 2025/04/09 01:24:40 djm Exp $ */ +/* $OpenBSD: ssh.c,v 1.613 2025/05/06 05:40:56 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -1769,15 +1769,9 @@ main(int ac, char **av) L_CERT(_PATH_HOST_ECDSA_KEY_FILE, 0); L_CERT(_PATH_HOST_ED25519_KEY_FILE, 1); L_CERT(_PATH_HOST_RSA_KEY_FILE, 2); -#ifdef WITH_DSA - L_CERT(_PATH_HOST_DSA_KEY_FILE, 3); -#endif L_PUBKEY(_PATH_HOST_ECDSA_KEY_FILE, 4); L_PUBKEY(_PATH_HOST_ED25519_KEY_FILE, 5); L_PUBKEY(_PATH_HOST_RSA_KEY_FILE, 6); -#ifdef WITH_DSA - L_PUBKEY(_PATH_HOST_DSA_KEY_FILE, 7); -#endif L_CERT(_PATH_HOST_XMSS_KEY_FILE, 8); L_PUBKEY(_PATH_HOST_XMSS_KEY_FILE, 9); if (loaded == 0) diff --git a/ssh_config b/ssh_config index cc5663562e95..238a0c5e371b 100644 --- a/ssh_config +++ b/ssh_config @@ -1,4 +1,4 @@ -# $OpenBSD: ssh_config,v 1.36 2023/08/02 23:04:38 djm Exp $ +# $OpenBSD: ssh_config,v 1.37 2025/05/06 05:40:56 djm Exp $ # This is the ssh client system-wide configuration file. See # ssh_config(5) for more information. This file provides defaults for @@ -30,7 +30,6 @@ # ConnectTimeout 0 # StrictHostKeyChecking ask # IdentityFile ~/.ssh/id_rsa -# IdentityFile ~/.ssh/id_dsa # IdentityFile ~/.ssh/id_ecdsa # IdentityFile ~/.ssh/id_ed25519 # Port 22 diff --git a/sshconnect.c b/sshconnect.c index dc28a5e4a9af..b43b3cb677a3 100644 --- a/sshconnect.c +++ b/sshconnect.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect.c,v 1.369 2024/12/06 16:21:48 djm Exp $ */ +/* $OpenBSD: sshconnect.c,v 1.370 2025/05/06 05:40:56 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -1663,9 +1663,6 @@ show_other_keys(struct hostkeys *hostkeys, struct sshkey *key) { int type[] = { KEY_RSA, -#ifdef WITH_DSA - KEY_DSA, -#endif KEY_ECDSA, KEY_ED25519, KEY_XMSS, diff --git a/sshd-auth.c b/sshd-auth.c index ad22dc338ee3..f1d89d9032ad 100644 --- a/sshd-auth.c +++ b/sshd-auth.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshd-auth.c,v 1.3 2025/01/16 06:37:10 dtucker Exp $ */ +/* $OpenBSD: sshd-auth.c,v 1.4 2025/05/06 05:40:56 djm Exp $ */ /* * SSH2 implementation: * Privilege Separation: @@ -250,7 +250,6 @@ list_hostkey_types(void) append_hostkey_type(b, "rsa-sha2-512"); append_hostkey_type(b, "rsa-sha2-256"); /* FALLTHROUGH */ - case KEY_DSA: case KEY_ECDSA: case KEY_ED25519: case KEY_ECDSA_SK: @@ -271,7 +270,6 @@ list_hostkey_types(void) append_hostkey_type(b, "rsa-sha2-256-cert-v01@openssh.com"); /* FALLTHROUGH */ - case KEY_DSA_CERT: case KEY_ECDSA_CERT: case KEY_ED25519_CERT: case KEY_ECDSA_SK_CERT: @@ -297,7 +295,6 @@ get_hostkey_public_by_type(int type, int nid, struct ssh *ssh) for (i = 0; i < options.num_host_key_files; i++) { switch (type) { case KEY_RSA_CERT: - case KEY_DSA_CERT: case KEY_ECDSA_CERT: case KEY_ED25519_CERT: case KEY_ECDSA_SK_CERT: diff --git a/sshd-session.c b/sshd-session.c index 623c20eba2df..2bf58f634957 100644 --- a/sshd-session.c +++ b/sshd-session.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshd-session.c,v 1.12 2025/03/12 22:43:44 djm Exp $ */ +/* $OpenBSD: sshd-session.c,v 1.13 2025/05/06 05:40:56 djm Exp $ */ /* * SSH2 implementation: * Privilege Separation: @@ -934,7 +934,6 @@ get_hostkey_by_type(int type, int nid, int need_private, struct ssh *ssh) for (i = 0; i < options.num_host_key_files; i++) { switch (type) { case KEY_RSA_CERT: - case KEY_DSA_CERT: case KEY_ECDSA_CERT: case KEY_ED25519_CERT: case KEY_ECDSA_SK_CERT: diff --git a/sshd.c b/sshd.c index 3e6c34276543..1dc96171f32d 100644 --- a/sshd.c +++ b/sshd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshd.c,v 1.617 2025/04/07 08:12:22 dtucker Exp $ */ +/* $OpenBSD: sshd.c,v 1.618 2025/05/06 05:40:56 djm Exp $ */ /* * Copyright (c) 2000, 2001, 2002 Markus Friedl. All rights reserved. * Copyright (c) 2002 Niels Provos. All rights reserved. @@ -1712,7 +1712,6 @@ main(int ac, char **av) switch (keytype) { case KEY_RSA: - case KEY_DSA: case KEY_ECDSA: case KEY_ED25519: case KEY_ECDSA_SK: diff --git a/sshkey.c b/sshkey.c index a33fc0724873..7382c082fc1d 100644 --- a/sshkey.c +++ b/sshkey.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshkey.c,v 1.148 2024/12/03 15:53:51 tb Exp $ */ +/* $OpenBSD: sshkey.c,v 1.149 2025/05/06 05:40:56 djm Exp $ */ /* * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. * Copyright (c) 2008 Alexander von Gernler. All rights reserved. @@ -131,10 +131,6 @@ extern const struct sshkey_impl sshkey_rsa_sha256_impl; extern const struct sshkey_impl sshkey_rsa_sha256_cert_impl; extern const struct sshkey_impl sshkey_rsa_sha512_impl; extern const struct sshkey_impl sshkey_rsa_sha512_cert_impl; -# ifdef WITH_DSA -extern const struct sshkey_impl sshkey_dss_impl; -extern const struct sshkey_impl sshkey_dsa_cert_impl; -# endif #endif /* WITH_OPENSSL */ #ifdef WITH_XMSS extern const struct sshkey_impl sshkey_xmss_impl; @@ -164,10 +160,6 @@ const struct sshkey_impl * const keyimpls[] = { &sshkey_ecdsa_sk_webauthn_impl, # endif /* ENABLE_SK */ # endif /* OPENSSL_HAS_ECC */ -# ifdef WITH_DSA - &sshkey_dss_impl, - &sshkey_dsa_cert_impl, -# endif &sshkey_rsa_impl, &sshkey_rsa_cert_impl, &sshkey_rsa_sha256_impl, @@ -463,8 +455,6 @@ sshkey_type_plain(int type) switch (type) { case KEY_RSA_CERT: return KEY_RSA; - case KEY_DSA_CERT: - return KEY_DSA; case KEY_ECDSA_CERT: return KEY_ECDSA; case KEY_ECDSA_SK_CERT: @@ -487,8 +477,6 @@ sshkey_type_certified(int type) switch (type) { case KEY_RSA: return KEY_RSA_CERT; - case KEY_DSA: - return KEY_DSA_CERT; case KEY_ECDSA: return KEY_ECDSA_CERT; case KEY_ECDSA_SK: @@ -3396,20 +3384,6 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, goto out; switch (key->type) { -#ifdef WITH_DSA - case KEY_DSA: - if (format == SSHKEY_PRIVATE_PEM) { - success = PEM_write_bio_DSAPrivateKey(bio, key->dsa, - cipher, passphrase, len, NULL, NULL); - } else { - if ((pkey = EVP_PKEY_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } - success = EVP_PKEY_set1_DSA(pkey, key->dsa); - } - break; -#endif #ifdef OPENSSL_HAS_ECC case KEY_ECDSA: if (format == SSHKEY_PRIVATE_PEM) { @@ -3477,7 +3451,6 @@ sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob, { switch (key->type) { #ifdef WITH_OPENSSL - case KEY_DSA: case KEY_ECDSA: case KEY_RSA: break; /* see below */ @@ -3652,19 +3625,6 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, prv->pkey = pk; if ((r = sshkey_check_rsa_length(prv, 0)) != 0) goto out; -#ifdef WITH_DSA - } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA && - (type == KEY_UNSPEC || type == KEY_DSA)) { - if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } - prv->dsa = EVP_PKEY_get1_DSA(pk); - prv->type = KEY_DSA; -#ifdef DEBUG_PK - DSA_print_fp(stderr, prv->dsa, 8); -#endif -#endif #ifdef OPENSSL_HAS_ECC } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC && (type == KEY_UNSPEC || type == KEY_ECDSA)) { diff --git a/sshkey.h b/sshkey.h index 19bbbac7dc0f..5fa410b9431d 100644 --- a/sshkey.h +++ b/sshkey.h @@ -1,4 +1,4 @@ -/* $OpenBSD: sshkey.h,v 1.66 2025/04/02 04:28:03 tb Exp $ */ +/* $OpenBSD: sshkey.h,v 1.67 2025/05/06 05:40:56 djm Exp $ */ /* * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. @@ -30,9 +30,6 @@ #ifdef WITH_OPENSSL #include -#ifdef WITH_DSA -#include -#endif #include # ifdef OPENSSL_HAS_ECC # include @@ -46,7 +43,6 @@ #else /* WITH_OPENSSL */ # define BIGNUM void # define RSA void -# define DSA void # define EC_KEY void # define EC_GROUP void # define EC_POINT void @@ -62,11 +58,9 @@ struct sshbuf; /* Key types */ enum sshkey_types { KEY_RSA, - KEY_DSA, KEY_ECDSA, KEY_ED25519, KEY_RSA_CERT, - KEY_DSA_CERT, KEY_ECDSA_CERT, KEY_ED25519_CERT, KEY_XMSS, @@ -129,8 +123,6 @@ struct sshkey_cert { struct sshkey { int type; int flags; - /* KEY_DSA */ - DSA *dsa; /* KEY_ECDSA and KEY_ECDSA_SK */ int ecdsa_nid; /* NID of curve */ /* libcrypto-backed keys */ @@ -353,7 +345,6 @@ int check_rsa_length(const RSA *rsa); /* XXX remove */ #if !defined(WITH_OPENSSL) # undef RSA -# undef DSA # undef EC_KEY # undef EC_GROUP # undef EC_POINT