diff --git a/src/hostkey.c b/src/hostkey.c index 5da0eabd..1bbf4da9 100644 --- a/src/hostkey.c +++ b/src/hostkey.c @@ -354,13 +354,81 @@ static const struct hostkey_method hostkey_method_ssh_rsa_sha2_512 = { hostkey_method_ssh_rsa_dtor, }; #endif /* LIBSSH2_RSA_SHA2 */ + +#if LIBSSH2_RSA_SHA1 || LIBSSH2_RSA_SHA2 +/* + * Initialize the server hostkey cert. + * + * OpenSSH certificate format (PROTOCOL.certkeys): + * string "ssh-rsa-cert-v01@openssh.com" + * string nonce + * mpint e + * mpint n + * + * + * The rsa-sha2-{256,512}-cert-v01 types appear only in KEXINIT and the + * signature, so all three cert variants share this blob layout and init. + * The existing per-variant sig_verify operates on the abstract (the inner + * RSA key ctx) and is reused verbatim. + */ +static int hostkey_method_ssh_rsa_init_cert(LIBSSH2_SESSION *session, + const unsigned char *hostkey_data, + size_t hostkey_data_len, + void **abstract) +{ + ssh2_rsa_ctx *rsa; + unsigned char *e, *n, *nonce; + size_t e_len, n_len, nonce_len; + struct string_buf buf; + + if(*abstract) { + hostkey_method_ssh_rsa_dtor(session, abstract); + *abstract = NULL; + } + + /* 4 + 28 + 4 + 16 + 4 + 4 */ + if(hostkey_data_len < 60) { + ssh2_deb((session, LIBSSH2_TRACE_ERROR, "host key length too short")); + return -1; + } + + buf.data = SSH2_UNCONST(hostkey_data); + buf.dataptr = buf.data; + buf.len = hostkey_data_len; + + if(ssh2_match_string(&buf, "ssh-rsa-cert-v01@openssh.com")) + return -1; + + /* nonce - must be min of 16 bytes */ + if(ssh2_get_string(&buf, &nonce, &nonce_len) || nonce_len < 16) + return -1; + + if(ssh2_get_string(&buf, &e, &e_len) || + ssh2_get_string(&buf, &n, &n_len)) + return -1; + + /* + * we cannot check for eob here because certs + * have more meta data we do not read + */ + + if(ssh2_rsa_new(&rsa, session, e, e_len, n, n_len, + NULL, 0, NULL, 0, NULL, 0, NULL, 0, NULL, 0, NULL, 0)) + return -1; + + *abstract = rsa; + + return 0; +} +#endif /* LIBSSH2_RSA_SHA1 || LIBSSH2_RSA_SHA2 */ + #if LIBSSH2_RSA_SHA1 static const struct hostkey_method hostkey_method_ssh_rsa_cert = { "ssh-rsa-cert-v01@openssh.com", SSH2_SHA1_DIG_LEN, - NULL, + hostkey_method_ssh_rsa_init_cert, hostkey_method_ssh_rsa_initPEM, - NULL, + hostkey_method_ssh_rsa_sig_verify, hostkey_method_ssh_rsa_signv, NULL, /* encrypt */ hostkey_method_ssh_rsa_dtor, @@ -370,9 +438,9 @@ static const struct hostkey_method hostkey_method_ssh_rsa_cert = { static const struct hostkey_method hostkey_method_ssh_rsa_sha2_256_cert = { "rsa-sha2-256-cert-v01@openssh.com", SSH2_SHA256_DIG_LEN, - NULL, + hostkey_method_ssh_rsa_init_cert, hostkey_method_ssh_rsa_initPEM, - NULL, + hostkey_method_ssh_rsa_sha2_256_sig_verify, hostkey_method_ssh_rsa_sha2_256_signv, NULL, /* encrypt */ hostkey_method_ssh_rsa_dtor, @@ -381,9 +449,9 @@ static const struct hostkey_method hostkey_method_ssh_rsa_sha2_256_cert = { static const struct hostkey_method hostkey_method_ssh_rsa_sha2_512_cert = { "rsa-sha2-512-cert-v01@openssh.com", SSH2_SHA512_DIG_LEN, - NULL, + hostkey_method_ssh_rsa_init_cert, hostkey_method_ssh_rsa_initPEM, - NULL, + hostkey_method_ssh_rsa_sha2_512_sig_verify, hostkey_method_ssh_rsa_sha2_512_signv, NULL, /* encrypt */ hostkey_method_ssh_rsa_dtor, @@ -805,12 +873,110 @@ static const struct hostkey_method hostkey_method_ecdsa_ssh_nistp521 = { hostkey_method_ssh_ecdsa_dtor, }; +/* + * Initialize the server hostkey cert. + * + * OpenSSH certificate format (PROTOCOL.certkeys): + * string "ecdsa-sha2-nistpXXX-cert-v01@openssh.com" + * string nonce + * string curve (same as the plain key) + * string public_key (EC point, same as the plain key) + * + * + * The cert type string is the same as the negotiated method by definition, + * so we skip it and the nonce, then reuse the plain curve-name + EC point + * parsing. The existing sig_verify operates on the abstract (the inner + * key ctx) and is reused verbatim. + */ +static int hostkey_method_ssh_ecdsa_init_cert( + LIBSSH2_SESSION *session, + const unsigned char *hostkey_data, + size_t hostkey_data_len, + void **abstract) +{ + ssh2_ecdsa_ctx *ec_ctx = NULL; + char *domain, *type_str; + unsigned char *public_key, *nonce; + size_t key_len, domain_len, type_len, nonce_len; + ssh2_curve_type curve; + struct string_buf buf; + + if(abstract && *abstract) { + hostkey_method_ssh_ecdsa_dtor(session, abstract); + *abstract = NULL; + } + + /* Minimum size for a nistp256 certificate with a 16-byte nonce. */ + if(hostkey_data_len < 145) { + ssh2_deb((session, LIBSSH2_TRACE_ERROR, "host key length too short")); + return -1; + } + + buf.data = SSH2_UNCONST(hostkey_data); + buf.dataptr = buf.data; + buf.len = hostkey_data_len; + + if(ssh2_get_chars(&buf, &type_str, &type_len)) + return -1; + + /* cert type string must match the negotiated hostkey method */ + if(type_len != strlen(session->hostkey->name) || + strncmp(type_str, session->hostkey->name, type_len)) + return -1; + + if(SSH2_IS_LITERAL(type_str, type_len, + "ecdsa-sha2-nistp256-cert-v01@openssh.com")) + curve = SSH2_EC_CURVE_NISTP256; + else if(SSH2_IS_LITERAL(type_str, type_len, + "ecdsa-sha2-nistp384-cert-v01@openssh.com")) + curve = SSH2_EC_CURVE_NISTP384; + else if(SSH2_IS_LITERAL(type_str, type_len, + "ecdsa-sha2-nistp521-cert-v01@openssh.com")) + curve = SSH2_EC_CURVE_NISTP521; + else + return -1; + + /* nonce - must be min of 16 bytes */ + if(ssh2_get_string(&buf, &nonce, &nonce_len) || nonce_len < 16) + return -1; + + /* inner public key: curve name */ + if(ssh2_get_chars(&buf, &domain, &domain_len)) + return -1; + + if((curve == SSH2_EC_CURVE_NISTP256 && + !SSH2_IS_LITERAL(domain, domain_len, "nistp256")) || + (curve == SSH2_EC_CURVE_NISTP384 && + !SSH2_IS_LITERAL(domain, domain_len, "nistp384")) || + (curve == SSH2_EC_CURVE_NISTP521 && + !SSH2_IS_LITERAL(domain, domain_len, "nistp521"))) + return -1; + + /* inner public key: EC point */ + if(ssh2_get_string(&buf, &public_key, &key_len)) + return -1; + + /* + * we cannot check for eob here because certs + * have more meta data we do not read + */ + + if(ssh2_ecdsa_curve_name_with_octal_new(&ec_ctx, session, public_key, + key_len, curve)) + return -1; + + if(abstract) + *abstract = ec_ctx; + + return 0; +} + static const struct hostkey_method hostkey_method_ecdsa_ssh_nistp256_cert = { "ecdsa-sha2-nistp256-cert-v01@openssh.com", SSH2_SHA256_DIG_LEN, - NULL, + hostkey_method_ssh_ecdsa_init_cert, hostkey_method_ssh_ecdsa_initPEM, - NULL, + hostkey_method_ssh_ecdsa_sig_verify, hostkey_method_ssh_ecdsa_signv, NULL, /* encrypt */ hostkey_method_ssh_ecdsa_dtor, @@ -819,9 +985,9 @@ static const struct hostkey_method hostkey_method_ecdsa_ssh_nistp256_cert = { static const struct hostkey_method hostkey_method_ecdsa_ssh_nistp384_cert = { "ecdsa-sha2-nistp384-cert-v01@openssh.com", SSH2_SHA384_DIG_LEN, - NULL, + hostkey_method_ssh_ecdsa_init_cert, hostkey_method_ssh_ecdsa_initPEM, - NULL, + hostkey_method_ssh_ecdsa_sig_verify, hostkey_method_ssh_ecdsa_signv, NULL, /* encrypt */ hostkey_method_ssh_ecdsa_dtor, @@ -830,9 +996,9 @@ static const struct hostkey_method hostkey_method_ecdsa_ssh_nistp384_cert = { static const struct hostkey_method hostkey_method_ecdsa_ssh_nistp521_cert = { "ecdsa-sha2-nistp521-cert-v01@openssh.com", SSH2_SHA512_DIG_LEN, - NULL, + hostkey_method_ssh_ecdsa_init_cert, hostkey_method_ssh_ecdsa_initPEM, - NULL, + hostkey_method_ssh_ecdsa_sig_verify, hostkey_method_ssh_ecdsa_signv, NULL, /* encrypt */ hostkey_method_ssh_ecdsa_dtor, diff --git a/tests/Makefile.inc b/tests/Makefile.inc index 0d8c014c..836a15e7 100644 --- a/tests/Makefile.inc +++ b/tests/Makefile.inc @@ -73,8 +73,12 @@ EXTRA_DIST = \ .checksrc \ CMakeLists.txt \ keys-generate.sh \ + keys/ca_host_ecdsa \ + keys/ca_host_ecdsa.pub \ keys/ca_host_ed25519 \ keys/ca_host_ed25519.pub \ + keys/ca_host_rsa \ + keys/ca_host_rsa.pub \ keys/ca_user_ecdsa \ keys/ca_user_ecdsa.pub \ keys/ca_user_ed25519 \ @@ -133,11 +137,13 @@ EXTRA_DIST = \ openssh_server/authorized_keys \ openssh_server/ca_user_keys.pub \ openssh_server/ssh_host_ecdsa_key \ + openssh_server/ssh_host_ecdsa_key-cert.pub \ openssh_server/ssh_host_ecdsa_key.pub \ openssh_server/ssh_host_ed25519_key \ openssh_server/ssh_host_ed25519_key-cert.pub \ openssh_server/ssh_host_ed25519_key.pub \ openssh_server/ssh_host_rsa_key \ + openssh_server/ssh_host_rsa_key-cert.pub \ openssh_server/ssh_host_rsa_key.pub \ openssh_server/sshd_config \ test_read_algos.test \ diff --git a/tests/keys-generate.sh b/tests/keys-generate.sh index 492ab0e7..8f117358 100755 --- a/tests/keys-generate.sh +++ b/tests/keys-generate.sh @@ -24,6 +24,8 @@ rm -f keys/ca_* rm -f keys/id_* # host CAs +ssh-keygen -t rsa -b 2048 -N '' -m RFC4716 -C 'ca_host_rsa' -f 'keys/ca_host_rsa' +ssh-keygen -t ecdsa -b 256 -N '' -m RFC4716 -C 'ca_host_ecdsa' -f 'keys/ca_host_ecdsa' ssh-keygen -t ed25519 -N '' -m RFC4716 -C 'ca_host_ed25519' -f 'keys/ca_host_ed25519' # user CAs @@ -36,6 +38,8 @@ id='identity' pr="${1:-libssh2}" # host certificates +ssh-keygen -h -I 'host_rsa' -n "${pr}" -s 'keys/ca_host_rsa' 'openssh_server/ssh_host_rsa_key.pub' +ssh-keygen -h -I 'host_ecdsa' -n "${pr}" -s 'keys/ca_host_ecdsa' 'openssh_server/ssh_host_ecdsa_key.pub' ssh-keygen -h -I 'host_ed25519' -n "${pr}" -s 'keys/ca_host_ed25519' 'openssh_server/ssh_host_ed25519_key.pub' # inspect PKCS8 private keys with command: diff --git a/tests/keys/ca_host_ecdsa b/tests/keys/ca_host_ecdsa new file mode 100644 index 00000000..6a358107 --- /dev/null +++ b/tests/keys/ca_host_ecdsa @@ -0,0 +1,9 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS +1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQQlZVqXG/s2cxstuRu2VD1UY9jkl44i +Cex0v1/uHAkZUKxVnrtkB+R9emZKOYRub8SD1dzucgg7+H134IacQsjpAAAAqF8h1hBfId +YQAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVlWpcb+zZzGy25 +G7ZUPVRj2OSXjiIJ7HS/X+4cCRlQrFWeu2QH5H16Zko5hG5vxIPV3O5yCDv4fXfghpxCyO +kAAAAgGCFyUNcWR6/7aB+j/Yiq21Lb8NH5k/T/gjKx0LzfO1cAAAANY2FfaG9zdF9lY2Rz +YQECAw== +-----END OPENSSH PRIVATE KEY----- diff --git a/tests/keys/ca_host_ecdsa.pub b/tests/keys/ca_host_ecdsa.pub new file mode 100644 index 00000000..9c93b4d6 --- /dev/null +++ b/tests/keys/ca_host_ecdsa.pub @@ -0,0 +1 @@ +ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVlWpcb+zZzGy25G7ZUPVRj2OSXjiIJ7HS/X+4cCRlQrFWeu2QH5H16Zko5hG5vxIPV3O5yCDv4fXfghpxCyOk= ca_host_ecdsa diff --git a/tests/keys/ca_host_rsa b/tests/keys/ca_host_rsa new file mode 100644 index 00000000..1367bceb --- /dev/null +++ b/tests/keys/ca_host_rsa @@ -0,0 +1,27 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn +NhAAAAAwEAAQAAAQEA0PjSC7sc64NaOaHHj8gYIcTIAKavjCo+9eEATejbkTxCK7QuKyTr +k8T4+wZsaqHaGCci5SB+4YsVHbe0LmDkizCh8Kf1uergo/MFXVn4hS72cotv9eJ/+Eqy1i +J3BciSIDqtiS5MxGd8dg+L789jXmraKT5UKvNjjbzZ8MU/m34EGlqgDV51ylDQI79i+AQC +3YfwT/KbiALa1anDqzmu3A/qVtqx2ymbta5131IxMZtNgCwpx645MiIs/nl4CRTEkV/S4s +pwTLx2njWSdEbA6MrPqyDVGRwZOutqvns7uYIDhzeT4aPs+FJNdR5zpqR6keO3/0wyTeDJ +FehzJtWD6QAAA8iMaN+sjGjfrAAAAAdzc2gtcnNhAAABAQDQ+NILuxzrg1o5ocePyBghxM +gApq+MKj714QBN6NuRPEIrtC4rJOuTxPj7BmxqodoYJyLlIH7hixUdt7QuYOSLMKHwp/W5 +6uCj8wVdWfiFLvZyi2/14n/4SrLWIncFyJIgOq2JLkzEZ3x2D4vvz2NeatopPlQq82ONvN +nwxT+bfgQaWqANXnXKUNAjv2L4BALdh/BP8puIAtrVqcOrOa7cD+pW2rHbKZu1rnXfUjEx +m02ALCnHrjkyIiz+eXgJFMSRX9LiynBMvHaeNZJ0RsDoys+rINUZHBk662q+ezu5ggOHN5 +Pho+z4Uk11HnOmpHqR47f/TDJN4MkV6HMm1YPpAAAAAwEAAQAAAQAENwaWj7w8OFqnJ68U +pHivIq7Vi4cmLLp3H2YQDDq0hdqAUuqs+lpJkVsjxgwFBRV28AAlTrfccP+YqTpIRrJJZ+ +5WQi8DxFvqVqYkrUJE3m8AXbVhCGPkJE6R4OFVc6eV4JUcO5u3CO7S20qraDuU/ZL/qrcM +JDtdciITuAjJyDIwjmB8PZymLlAiw7Ch8xK2RJ5p1/kre2n5XmIzgKsHHFeByTAVt4OmCj +HcfI2JA6FhWkdRYIxwLjTGr7ziGQD+PDTohopE8wy3VxLlPUThQ9+8IskWV0VNKQofpxbE +5NyHd6vTTnQmrA7AOgVT2QVEG+vLyZ9xBaUXsF6Re+ExAAAAgQCQ8XoeS7J9zKLvPPwjA7 +AxxqRC4EfxE+/1Bd4vsnkspxgzy2nvvjFyHf3ogDzVJitNmEi54mhwkxvvq64xJrEHwUCf +xJwXrH6PD7wcHBTcMyTrsBp0rJOGzrCHqOY7UKLh/6lQ+kfLE7aGhqCJYmjo91HFh68lVq +G9zJzNj1iVygAAAIEA9TXbRdZonoGjDAZ6jKQ7ocjWr3uGBoMBhcnXZ8yhq+cFIte2oISG +tjM+tf59fFzw+3DHznU57nr8FmMvyYI2Ly3p3302kD/mEKDDN1Q9NbA8bGuuwYHo2ib0Hq +sqsLjXc2UcEbZh3rg077qJ8bzBcMSuCkTIs4MfyPebZEnMjLkAAACBANoqwrDt5+TtzyLT +THVfDEzG30MECgEd+L8xLZXequNPzJDoMLSE4PGN/Wjvr+G5QQMGL7g6AXwUZPcJMIpRuw +EdzLumLLdPXz0TWORS9p0/0V8O1Pi4LMFa1Fu/zdvijOYa2srF8RaHiVMee4OoaMo0yKn7 +/OcTjhGawwvwPfixAAAAC2NhX2hvc3RfcnNhAQIDBAUGBw== +-----END OPENSSH PRIVATE KEY----- diff --git a/tests/keys/ca_host_rsa.pub b/tests/keys/ca_host_rsa.pub new file mode 100644 index 00000000..29ede602 --- /dev/null +++ b/tests/keys/ca_host_rsa.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQ+NILuxzrg1o5ocePyBghxMgApq+MKj714QBN6NuRPEIrtC4rJOuTxPj7BmxqodoYJyLlIH7hixUdt7QuYOSLMKHwp/W56uCj8wVdWfiFLvZyi2/14n/4SrLWIncFyJIgOq2JLkzEZ3x2D4vvz2NeatopPlQq82ONvNnwxT+bfgQaWqANXnXKUNAjv2L4BALdh/BP8puIAtrVqcOrOa7cD+pW2rHbKZu1rnXfUjExm02ALCnHrjkyIiz+eXgJFMSRX9LiynBMvHaeNZJ0RsDoys+rINUZHBk662q+ezu5ggOHN5Pho+z4Uk11HnOmpHqR47f/TDJN4MkV6HMm1YPp ca_host_rsa diff --git a/tests/openssh_server/Dockerfile b/tests/openssh_server/Dockerfile index 81cbe064..9d767c2e 100644 --- a/tests/openssh_server/Dockerfile +++ b/tests/openssh_server/Dockerfile @@ -27,6 +27,12 @@ COPY ssh_host_ed25519_key /tmp/etc/ssh/ssh_host_ed25519_key RUN install -m 0600 /tmp/etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key # Host certificates +COPY ssh_host_rsa_key-cert.pub /tmp/etc/ssh/ssh_host_rsa_key-cert.pub +RUN install -m 0644 /tmp/etc/ssh/ssh_host_rsa_key-cert.pub /etc/ssh/ssh_host_rsa_key-cert.pub + +COPY ssh_host_ecdsa_key-cert.pub /tmp/etc/ssh/ssh_host_ecdsa_key-cert.pub +RUN install -m 0644 /tmp/etc/ssh/ssh_host_ecdsa_key-cert.pub /etc/ssh/ssh_host_ecdsa_key-cert.pub + COPY ssh_host_ed25519_key-cert.pub /tmp/etc/ssh/ssh_host_ed25519_key-cert.pub RUN install -m 0644 /tmp/etc/ssh/ssh_host_ed25519_key-cert.pub /etc/ssh/ssh_host_ed25519_key-cert.pub @@ -43,6 +49,8 @@ RUN sed -i 's/KbdInteractiveAuthentication no/KbdInteractiveAuthentication yes/' COPY sshd_config /tmp/etc/ssh/sshd_config RUN cat /tmp/etc/ssh/sshd_config >> /etc/ssh/sshd_config RUN echo 'TrustedUserCAKeys /etc/ssh/ca_user_keys.pub' >> /etc/ssh/sshd_config +RUN echo 'HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub' >> /etc/ssh/sshd_config +RUN echo 'HostCertificate /etc/ssh/ssh_host_ecdsa_key-cert.pub' >> /etc/ssh/sshd_config RUN echo 'HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub' >> /etc/ssh/sshd_config # SSH login fix. Otherwise user is kicked off after login diff --git a/tests/openssh_server/ssh_host_ecdsa_key-cert.pub b/tests/openssh_server/ssh_host_ecdsa_key-cert.pub new file mode 100644 index 00000000..a36d4dd3 --- /dev/null +++ b/tests/openssh_server/ssh_host_ecdsa_key-cert.pub @@ -0,0 +1 @@ +ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgB4UbNhvuwfCifhqOeI/bp/GT3s8xYofpyeavA+75l5sAAAAIbmlzdHAyNTYAAABBBC+/syyeKJD9dC2ZH9Q7iJGReR4YM3rUCMsSynkyXojdfSClGCMY7JvWlt30ESjYvxoTfSRGx6WvaqYK/vPoYQ4AAAAAAAAAAAAAAAIAAAAKaG9zdF9lY2RzYQAAAAsAAAAHbGlic3NoMgAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVlWpcb+zZzGy25G7ZUPVRj2OSXjiIJ7HS/X+4cCRlQrFWeu2QH5H16Zko5hG5vxIPV3O5yCDv4fXfghpxCyOkAAABjAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAABIAAAAIES/HuhK5z/HP553OzMXDIK8JU/yrgg5JdaClqA1jgT+AAAAIFnDIf0BdY03VNTQ5tjfQLeafUGDsCDYk/itn0kq28AP openssh_server/ssh_host_ecdsa_key.pub diff --git a/tests/openssh_server/ssh_host_rsa_key-cert.pub b/tests/openssh_server/ssh_host_rsa_key-cert.pub new file mode 100644 index 00000000..59484cda --- /dev/null +++ b/tests/openssh_server/ssh_host_rsa_key-cert.pub @@ -0,0 +1 @@ +ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg1nngOml/H/JyE9+3lvLywhhEF7vCLrIG3CUsiN5TymQAAAABIwAAAQEArrr/JuJmaZligyfS8vcNur+mWR2ddDQtVdhHzdKUUoR6/Om6cvxpe61H1YZO1xCpLUBXmkki4HoNtYOpPB2W4V+8U4BDeVBD5crypEOE1+7BAm99fnEDxYIOZq2/jTP0yQmzCpWYS3COyFmkOL7sfX1wQMeW5zQT2WKcxC6FSWbhDqrBeNEGi687hJJoJ7YXgY/IdiYW5NcOuqRSWljjGS3dAJsHHWk4nJbhjEDXbPaeduMAwQU9i6ELfP3r+q6wdu0P4jWaoo3De1aYxnToV/ldXykpipON4NPamsb6Ph2qlJQKypq7J4iQgkIIbCU1A31+4ExvcIVoxLQw/aTSbwAAAAAAAAAAAAAAAgAAAAhob3N0X3JzYQAAAAsAAAAHbGlic3NoMgAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQDQ+NILuxzrg1o5ocePyBghxMgApq+MKj714QBN6NuRPEIrtC4rJOuTxPj7BmxqodoYJyLlIH7hixUdt7QuYOSLMKHwp/W56uCj8wVdWfiFLvZyi2/14n/4SrLWIncFyJIgOq2JLkzEZ3x2D4vvz2NeatopPlQq82ONvNnwxT+bfgQaWqANXnXKUNAjv2L4BALdh/BP8puIAtrVqcOrOa7cD+pW2rHbKZu1rnXfUjExm02ALCnHrjkyIiz+eXgJFMSRX9LiynBMvHaeNZJ0RsDoys+rINUZHBk662q+ezu5ggOHN5Pho+z4Uk11HnOmpHqR47f/TDJN4MkV6HMm1YPpAAABFAAAAAxyc2Etc2hhMi01MTIAAAEAzr6ES6jTlPwp5+PsggQQAqK3M4tllOIB4sSYDrXovSWQva8M+ngNrWwKnDtq69wqilKQ2Hx6uH4CyymqDzfkQPbwUTxw3b7QhlFHpdKe/RsVSkQGbdftssYoB/2M2ErmNJCzNweX39hyiS67DY435H0ccJ1u4qADG7qOQjtlnuAqwZtxrv88xaM/CaKnb+gtrfm6KdJ4S38S2M4OxRMfv22QZjihyHKhf+zK1pZN9vJmqhdR0TP5QJC19N8zpIxMlp2h32s/6zSCwFLJes+DnPmQmbQe6tbIoRcjEeSPcSMfA4C8pBEk3KuXsMjqoH4s3xwUDz336+rJdde4RpC/zA== openssh_server/ssh_host_rsa_key.pub diff --git a/tests/openssh_server/sshd_config b/tests/openssh_server/sshd_config index f16b5f3e..e4e0ab41 100644 --- a/tests/openssh_server/sshd_config +++ b/tests/openssh_server/sshd_config @@ -3,7 +3,7 @@ # SPDX-License-Identifier: BSD-3-Clause CASignatureAlgorithms +ssh-rsa -HostKeyAlgorithms +ssh-rsa +HostKeyAlgorithms +ssh-rsa,ssh-rsa-cert-v01@openssh.com # modern name in OpenSSH 8.5+: PubkeyAcceptedAlgorithms PubkeyAcceptedKeyTypes +ssh-rsa,ssh-rsa-cert-v01@openssh.com MACs +hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha2-512,hmac-md5,hmac-md5-96,umac-64@openssh.com,umac-128@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com diff --git a/tests/session_fixture.c b/tests/session_fixture.c index bcda4f1a..0591608e 100644 --- a/tests/session_fixture.c +++ b/tests/session_fixture.c @@ -99,6 +99,16 @@ static char const *skip_mac[] = { /* List of HOSTKEY algorithms for which tests are skipped */ static char const *skip_hostkey[] = { +#if !LIBSSH2_ECDSA + "ecdsa-sha2-nistp256-cert-v01@openssh.com", +#endif +#if !LIBSSH2_RSA_SHA2 + "rsa-sha2-256-cert-v01@openssh.com", + "rsa-sha2-512-cert-v01@openssh.com", +#endif +#if !LIBSSH2_RSA_SHA1 + "ssh-rsa-cert-v01@openssh.com", +#endif #if !LIBSSH2_ED25519 "ssh-ed25519-cert-v01@openssh.com", #endif diff --git a/tests/test_read_algos.txt b/tests/test_read_algos.txt index 38514c31..f3420d5e 100644 --- a/tests/test_read_algos.txt +++ b/tests/test_read_algos.txt @@ -17,4 +17,8 @@ hmac-sha2-256 hmac-sha2-256-etm@openssh.com hmac-sha2-512 hmac-sha2-512-etm@openssh.com +ecdsa-sha2-nistp256-cert-v01@openssh.com +rsa-sha2-256-cert-v01@openssh.com +rsa-sha2-512-cert-v01@openssh.com ssh-ed25519-cert-v01@openssh.com +ssh-rsa-cert-v01@openssh.com