1 # $OpenBSD: rekey.sh,v 1.14 2013/11/21 03:18:51 djm Exp $
2 # Placed in the Public Domain.
6 LOG=${TEST_SSH_LOGFILE}
10 # Test rekeying based on data volume only.
11 # Arguments will be passed to ssh.
15 ${SSH} <${DATA} -oCompression=no $@ -v -F $OBJ/ssh_proxy somehost \
18 fail "ssh failed ($@)"
20 cmp ${DATA} ${COPY} || fail "corrupted copy ($@)"
21 n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
23 trace "$n rekeying(s)"
25 fail "no rekeying occured ($@)"
29 increase_datafile_size 300
32 for i in `${SSH} -Q kex`; do
33 opts="$opts KexAlgorithms=$i"
35 for i in `${SSH} -Q cipher`; do
36 opts="$opts Ciphers=$i"
38 for i in `${SSH} -Q mac`; do
43 verbose "client rekey $opt"
44 ssh_data_rekeying -oRekeyLimit=256k -o$opt
47 # AEAD ciphers are magical so test with all KexAlgorithms
48 if ${SSH} -Q cipher-auth | grep '^.*$' >/dev/null 2>&1 ; then
49 for c in `${SSH} -Q cipher-auth`; do
50 for kex in `${SSH} -Q kex`; do
51 verbose "client rekey $c $kex"
52 ssh_data_rekeying -oRekeyLimit=256k -oCiphers=$c -oKexAlgorithms=$kex
57 for s in 16 1k 128k 256k; do
58 verbose "client rekeylimit ${s}"
59 ssh_data_rekeying -oCompression=no -oRekeyLimit=$s
63 verbose "client rekeylimit default ${s}"
65 ${SSH} < ${DATA} -oCompression=no -oRekeyLimit="default $s" -F \
66 $OBJ/ssh_proxy somehost "cat >${COPY};sleep $s;sleep 3"
70 cmp ${DATA} ${COPY} || fail "corrupted copy"
71 n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
73 trace "$n rekeying(s)"
75 fail "no rekeying occured"
80 verbose "client rekeylimit default ${s} no data"
82 ${SSH} -oCompression=no -oRekeyLimit="default $s" -F \
83 $OBJ/ssh_proxy somehost "sleep $s;sleep 3"
87 n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
89 trace "$n rekeying(s)"
91 fail "no rekeying occured"
95 echo "rekeylimit default 5" >>$OBJ/sshd_proxy
97 verbose "server rekeylimit default ${s} no data"
99 ${SSH} -oCompression=no -F $OBJ/ssh_proxy somehost "sleep $s;sleep 3"
100 if [ $? -ne 0 ]; then
103 n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
105 trace "$n rekeying(s)"
106 if [ $n -lt 1 ]; then
107 fail "no rekeying occured"
111 verbose "rekeylimit parsing"
112 for size in 16 1k 1K 1m 1M 1g 1G; do
113 for time in 1 1m 1M 1h 1H 1d 1D 1w 1W; do
117 1m|1M) bytes=1048576 ;;
118 1g|1G) bytes=1073741824 ;;
123 1h|1H) seconds=3600 ;;
124 1d|1D) seconds=86400 ;;
125 1w|1W) seconds=604800 ;;
128 b=`$SUDO ${SSHD} -T -o "rekeylimit $size $time" -f $OBJ/sshd_proxy | \
129 awk '/rekeylimit/{print $2}'`
130 s=`$SUDO ${SSHD} -T -o "rekeylimit $size $time" -f $OBJ/sshd_proxy | \
131 awk '/rekeylimit/{print $3}'`
133 if [ "$bytes" != "$b" ]; then
134 fatal "rekeylimit size: expected $bytes bytes got $b"
136 if [ "$seconds" != "$s" ]; then
137 fatal "rekeylimit time: expected $time seconds got $s"
142 rm -f ${COPY} ${DATA}