Import openssh_8.0p1.orig.tar.gz

28 files changed, 314 insertions, 289 deletions

diff --git a/regress/Makefile b/regress/Makefile
index 647b4a049..925edf71a 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.97 2018/06/07 04:46:34 djm Exp $
+#       $OpenBSD: Makefile,v 1.100 2019/01/20 23:24:19 djm Exp $
 
 REGRESS_TARGETS=        unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t-exec
 tests:          prep $(REGRESS_TARGETS)
@@ -11,7 +11,6 @@ prep:
 
 clean:
         for F in $(CLEANFILES); do rm -f $(OBJ)$$F; done
-        test -z "${SUDO}" || ${SUDO} rm -f ${SUDO_CLEAN}
         rm -rf $(OBJ).putty
 
 distclean:      clean
@@ -92,7 +91,8 @@ LTESTS= 	connect \
 INTEROP_TESTS=  putty-transfer putty-ciphers putty-kex conch-ciphers
 #INTEROP_TESTS+=ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
 
-#LTESTS=        cipher-speed
+EXTRA_TESTS=    agent-pkcs11
+#EXTRA_TESTS+=  cipher-speed
 
 USERNAME=               ${LOGNAME}
 CLEANFILES=     *.core actual agent-key.* authorized_keys_${USERNAME} \
@@ -122,8 +122,6 @@ CLEANFILES=	*.core actual agent-key.* authorized_keys_${USERNAME} \
                 t8.out t8.out.pub t9.out t9.out.pub testdata \
                 user_*key* user_ca* user_key*
 
-SUDO_CLEAN+=    /var/run/testdata_${USERNAME} /var/run/keycommand_${USERNAME}
-
 # Enable all malloc(3) randomisations and checks
 TEST_ENV=      "MALLOC_OPTIONS=CFGJRSUX"
 
@@ -217,6 +215,13 @@ t-exec-interop:	${INTEROP_TESTS:=.sh}
                 (env SUDO="${SUDO}" TEST_ENV=${TEST_ENV} ${TEST_SHELL} ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
         done
 
+t-extra:        ${EXTRA_TESTS:=.sh}
+        @if [ "x$?" = "x" ]; then exit 0; fi; \
+        for TEST in ""$?; do \
+                echo "run test $${TEST}" ... 1>&2; \
+                (env SUDO="${SUDO}" TEST_ENV=${TEST_ENV} ${TEST_SHELL} ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
+        done
+
 # Not run by default
 interop: ${INTEROP_TARGETS}
 
diff --git a/regress/agent-pkcs11.sh b/regress/agent-pkcs11.sh
index db3018b88..5205d9067 100644
--- a/regress/agent-pkcs11.sh
+++ b/regress/agent-pkcs11.sh
@@ -1,16 +1,53 @@
-#       $OpenBSD: agent-pkcs11.sh,v 1.3 2017/04/30 23:34:55 djm Exp $
+#       $OpenBSD: agent-pkcs11.sh,v 1.6 2019/01/21 09:13:41 djm Exp $
 #       Placed in the Public Domain.
 
 tid="pkcs11 agent test"
 
-TEST_SSH_PIN=""
-TEST_SSH_PKCS11=/usr/local/lib/soft-pkcs11.so.0.0
+try_token_libs() {
+        for _lib in "$@" ; do
+                if test -f "$_lib" ; then
+                        verbose "Using token library $_lib"
+                        TEST_SSH_PKCS11="$_lib"
+                        return
+                fi
+        done
+        echo "skipped: Unable to find PKCS#11 token library"
+        exit 0
+}
+
+try_token_libs \
+        /usr/local/lib/softhsm/libsofthsm2.so \
+        /usr/lib64/pkcs11/libsofthsm2.so \
+        /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so
+
+TEST_SSH_PIN=1234
+TEST_SSH_SOPIN=12345678
+if [ "x$TEST_SSH_SSHPKCS11HELPER" != "x" ]; then
+        SSH_PKCS11_HELPER="${TEST_SSH_SSHPKCS11HELPER}"
+        export SSH_PKCS11_HELPER
+fi
 
 test -f "$TEST_SSH_PKCS11" || fatal "$TEST_SSH_PKCS11 does not exist"
 
-# setup environment for soft-pkcs11 token
-SOFTPKCS11RC=$OBJ/pkcs11.info
-export SOFTPKCS11RC
+# setup environment for softhsm2 token
+DIR=$OBJ/SOFTHSM
+rm -rf $DIR
+TOKEN=$DIR/tokendir
+mkdir -p $TOKEN
+SOFTHSM2_CONF=$DIR/softhsm2.conf
+export SOFTHSM2_CONF
+cat > $SOFTHSM2_CONF << EOF
+# SoftHSM v2 configuration file
+directories.tokendir = ${TOKEN}
+objectstore.backend = file
+# ERROR, WARNING, INFO, DEBUG
+log.level = DEBUG
+# If CKF_REMOVABLE_DEVICE flag should be set
+slots.removable = false
+EOF
+out=$(softhsm2-util --init-token --free --label token-slot-0 --pin "$TEST_SSH_PIN" --so-pin "$TEST_SSH_SOPIN")
+slot=$(echo -- $out | sed 's/.* //')
+
 # prevent ssh-agent from calling ssh-askpass
 SSH_ASKPASS=/usr/bin/true
 export SSH_ASKPASS
@@ -22,22 +59,27 @@ notty() {
             if (fork) { wait; exit($? >> 8); } else { exec(@ARGV) }' "$@"
 }
 
+trace "generating keys"
+RSA=${DIR}/RSA
+EC=${DIR}/EC
+openssl genpkey -algorithm rsa > $RSA
+openssl pkcs8 -nocrypt -in $RSA |\
+    softhsm2-util --slot "$slot" --label 01 --id 01 --pin "$TEST_SSH_PIN" --import /dev/stdin
+openssl genpkey \
+    -genparam \
+    -algorithm ec \
+    -pkeyopt ec_paramgen_curve:prime256v1 |\
+    openssl genpkey \
+    -paramfile /dev/stdin > $EC
+openssl pkcs8 -nocrypt -in $EC |\
+    softhsm2-util --slot "$slot" --label 02 --id 02 --pin "$TEST_SSH_PIN" --import /dev/stdin
+
 trace "start agent"
 eval `${SSHAGENT} -s` > /dev/null
 r=$?
 if [ $r -ne 0 ]; then
         fail "could not start ssh-agent: exit code $r"
 else
-        trace "generating key/cert"
-        rm -f $OBJ/pkcs11.key $OBJ/pkcs11.crt
-        openssl genrsa -out $OBJ/pkcs11.key 2048 > /dev/null 2>&1
-        chmod 600 $OBJ/pkcs11.key 
-        openssl req -key $OBJ/pkcs11.key -new -x509 \
-            -out $OBJ/pkcs11.crt -text -subj '/CN=pkcs11 test' > /dev/null
-        printf "a\ta\t$OBJ/pkcs11.crt\t$OBJ/pkcs11.key" > $SOFTPKCS11RC
-        # add to authorized keys
-        ${SSHKEYGEN} -y -f $OBJ/pkcs11.key > $OBJ/authorized_keys_$USER
-
         trace "add pkcs11 key to agent"
         echo ${TEST_SSH_PIN} | notty ${SSHADD} -s ${TEST_SSH_PKCS11} > /dev/null 2>&1
         r=$?
@@ -52,12 +94,23 @@ else
                 fail "ssh-add -l failed: exit code $r"
         fi
 
-        trace "pkcs11 connect via agent"
-        ${SSH} -F $OBJ/ssh_proxy somehost exit 5
-        r=$?
-        if [ $r -ne 5 ]; then
-                fail "ssh connect failed (exit code $r)"
-        fi
+        for k in $RSA $EC; do
+                trace "testing $k"
+                chmod 600 $k
+                ssh-keygen -y -f $k > $k.pub
+                pub=$(cat $k.pub)
+                ${SSHADD} -L | grep -q "$pub" || fail "key $k missing in ssh-add -L"
+                ${SSHADD} -T $k.pub || fail "ssh-add -T with $k failed"
+
+                # add to authorized keys
+                cat $k.pub > $OBJ/authorized_keys_$USER
+                trace "pkcs11 connect via agent ($k)"
+                ${SSH} -F $OBJ/ssh_proxy somehost exit 5
+                r=$?
+                if [ $r -ne 5 ]; then
+                        fail "ssh connect failed (exit code $r)"
+                fi
+        done
 
         trace "remove pkcs11 keys"
         echo ${TEST_SSH_PIN} | notty ${SSHADD} -e ${TEST_SSH_PKCS11} > /dev/null 2>&1
diff --git a/regress/agent-timeout.sh b/regress/agent-timeout.sh
index 9598c2032..80012f80c 100644
--- a/regress/agent-timeout.sh
+++ b/regress/agent-timeout.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: agent-timeout.sh,v 1.3 2015/03/03 22:35:19 markus Exp $
+#       $OpenBSD: agent-timeout.sh,v 1.4 2019/01/28 00:08:26 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="agent timeout test"
@@ -12,16 +12,18 @@ if [ $r -ne 0 ]; then
         fail "could not start ssh-agent: exit code $r"
 else
         trace "add keys with timeout"
+        keys=0
         for t in ${SSH_KEYTYPES}; do
                 ${SSHADD} -t ${SSHAGENT_TIMEOUT} $OBJ/$t > /dev/null 2>&1
                 if [ $? -ne 0 ]; then
                         fail "ssh-add did succeed exit code 0"
                 fi
+                keys=$((${keys} + 1))
         done
         n=`${SSHADD} -l 2> /dev/null | wc -l`
         trace "agent has $n keys"
-        if [ $n -ne 2 ]; then
-                fail "ssh-add -l did not return 2 keys: $n"
+        if [ $n -ne $keys ]; then
+                fail "ssh-add -l did not return $keys keys: $n"
         fi
         trace "sleeping 2*${SSHAGENT_TIMEOUT} seconds"
         sleep ${SSHAGENT_TIMEOUT}
diff --git a/regress/agent.sh b/regress/agent.sh
index 7111056c9..788b02064 100644
--- a/regress/agent.sh
+++ b/regress/agent.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: agent.sh,v 1.13 2017/12/19 00:49:30 djm Exp $
+#       $OpenBSD: agent.sh,v 1.14 2019/01/28 00:12:36 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="simple agent test"
@@ -27,6 +27,9 @@ ${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key \
 trace "overwrite authorized keys"
 printf '' > $OBJ/authorized_keys_$USER
 
+echo "PubkeyAcceptedKeyTypes +ssh-dss" >> $OBJ/ssh_proxy
+echo "PubkeyAcceptedKeyTypes +ssh-dss" >> $OBJ/sshd_proxy
+
 for t in ${SSH_KEYTYPES}; do
         # generate user key for agent
         rm -f $OBJ/$t-agent $OBJ/$t-agent.pub*
@@ -96,6 +99,7 @@ fi
 (printf 'cert-authority,principals="estragon" '; cat $OBJ/user_ca_key.pub) \
         > $OBJ/authorized_keys_$USER
 for t in ${SSH_KEYTYPES}; do
+    if [ "$t" != "ssh-dss" ]; then
         trace "connect via agent using $t key"
         ${SSH} -F $OBJ/ssh_proxy -i $OBJ/$t-agent.pub \
                 -oCertificateFile=$OBJ/$t-agent-cert.pub \
@@ -104,6 +108,7 @@ for t in ${SSH_KEYTYPES}; do
         if [ $r -ne 52 ]; then
                 fail "ssh connect with failed (exit code $r)"
         fi
+    fi
 done
 
 trace "delete all agent keys"
diff --git a/regress/cert-hostkey.sh b/regress/cert-hostkey.sh
index d2ecd318b..3ce777967 100644
--- a/regress/cert-hostkey.sh
+++ b/regress/cert-hostkey.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cert-hostkey.sh,v 1.16 2018/07/03 11:43:49 djm Exp $
+#       $OpenBSD: cert-hostkey.sh,v 1.17 2018/10/31 11:09:27 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="certified host keys"
@@ -127,7 +127,7 @@ attempt_connect() {
 }
 
 # Basic connect and revocation tests.
-for privsep in yes no ; do
+for privsep in yes sandbox ; do
         for ktype in $PLAIN_TYPES ; do
                 verbose "$tid: host ${ktype} cert connect privsep $privsep"
                 (
@@ -165,7 +165,7 @@ for ktype in $PLAIN_TYPES ; do
         kh_revoke cert_host_key_${ktype}.pub >> $OBJ/known_hosts-cert.orig
 done
 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
-for privsep in yes no ; do
+for privsep in yes sandbox ; do
         for ktype in $PLAIN_TYPES ; do
                 verbose "$tid: host ${ktype} revoked cert privsep $privsep"
                 (
diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh
index 30c2c156d..6849e9922 100644
--- a/regress/cert-userkey.sh
+++ b/regress/cert-userkey.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cert-userkey.sh,v 1.19 2018/03/12 00:54:04 djm Exp $
+#       $OpenBSD: cert-userkey.sh,v 1.20 2018/10/31 11:09:27 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="certified user keys"
@@ -47,7 +47,7 @@ done
 # Test explicitly-specified principals
 for ktype in $EXTRA_TYPES $PLAIN_TYPES ; do
         t=$(kname $ktype)
-        for privsep in yes no ; do
+        for privsep in yes sandbox ; do
                 _prefix="${ktype} privsep $privsep"
 
                 # Setup for AuthorizedPrincipalsFile
diff --git a/regress/keys-command.sh b/regress/keys-command.sh
index 4029e2c78..d166fc589 100644
--- a/regress/keys-command.sh
+++ b/regress/keys-command.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: keys-command.sh,v 1.4 2016/09/26 21:34:38 bluhm Exp $
+#       $OpenBSD: keys-command.sh,v 1.5 2018/11/22 08:48:32 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="authorized keys from command"
@@ -19,7 +19,8 @@ expected_key_fp=`$SSHKEYGEN -lf $OBJ/rsa.pub | awk '{ print $2 }'`
 
 # Establish a AuthorizedKeysCommand in /var/run where it will have
 # acceptable directory permissions.
-KEY_COMMAND="/var/run/keycommand_${LOGNAME}"
+KEY_COMMAND="/var/run/keycommand_${LOGNAME}.$$"
+trap "${SUDO} rm -f ${KEY_COMMAND}" 0
 cat << _EOF | $SUDO sh -c "rm -f '$KEY_COMMAND' ; cat > '$KEY_COMMAND'"
 #!/bin/sh
 echo args: "\$@" >> $OBJ/keys-command-args
@@ -78,5 +79,3 @@ if [ -x $KEY_COMMAND ]; then
 else
         echo "SKIPPED: $KEY_COMMAND not executable (/var/run mounted noexec?)"
 fi
-
-$SUDO rm -f $KEY_COMMAND
diff --git a/regress/keyscan.sh b/regress/keyscan.sh
index 3bde1219a..8940d24b6 100644
--- a/regress/keyscan.sh
+++ b/regress/keyscan.sh
@@ -1,14 +1,20 @@
-#       $OpenBSD: keyscan.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
+#       $OpenBSD: keyscan.sh,v 1.9 2019/01/28 03:50:39 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="keyscan"
 
-# remove DSA hostkey
-rm -f ${OBJ}/host.dsa
+KEYTYPES=`${SSH} -Q key-plain`
+for i in $KEYTYPES; do
+        if [ -z "$algs" ]; then
+                algs="$i"
+        else
+                algs="$algs,$i"
+        fi
+done
+echo "HostKeyAlgorithms $algs" >> $OBJ/sshd_config
 
 start_sshd
 
-KEYTYPES=`${SSH} -Q key-plain`
 for t in $KEYTYPES; do
         trace "keyscan type $t"
         ${SSHKEYSCAN} -t $t -p $PORT 127.0.0.1 127.0.0.1 127.0.0.1 \
diff --git a/regress/misc/kexfuzz/Makefile b/regress/misc/kexfuzz/Makefile
index a7bb6b70d..20802cb87 100644
--- a/regress/misc/kexfuzz/Makefile
+++ b/regress/misc/kexfuzz/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.3 2017/12/21 05:46:35 djm Exp $
+#       $OpenBSD: Makefile,v 1.4 2019/01/21 12:50:12 djm Exp $
 
 .include <bsd.own.mk>
 .include <bsd.obj.mk>
@@ -18,12 +18,21 @@ SRCS+=atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c ssh-dss.c
 SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c
 SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c
 SRCS+=addrmatch.c bitmap.c packet.c dispatch.c canohost.c ssh_api.c
-SRCS+=kex.c kexc25519.c kexc25519c.c kexc25519s.c kexdh.c kexdhc.c kexdhs.c
-SRCS+=kexecdh.c kexecdhc.c kexecdhs.c kexgex.c kexgexc.c kexgexs.c
-SRCS+=dh.c compat.c
-SRCS+=ed25519.c hash.c ge25519.c fe25519.c sc25519.c verify.c
+SRCS+=compat.c ed25519.c hash.c ge25519.c fe25519.c sc25519.c verify.c
 SRCS+=cipher-chachapoly.c chacha.c poly1305.c
-SRCS+=smult_curve25519_ref.c
+
+SRCS+=  kex.c
+SRCS+=  dh.c
+SRCS+=  kexdh.c
+SRCS+=  kexecdh.c
+SRCS+=  kexgex.c
+SRCS+=  kexgexc.c
+SRCS+=  kexgexs.c
+SRCS+=  kexc25519.c
+SRCS+=  smult_curve25519_ref.c
+SRCS+=  kexgen.c
+SRCS+=  kexsntrup4591761x25519.c
+SRCS+=  sntrup4591761.c
 
 SRCS+=digest-openssl.c
 #SRCS+=digest-libc.c
diff --git a/regress/misc/kexfuzz/kexfuzz.c b/regress/misc/kexfuzz/kexfuzz.c
index 3e2c48160..7051e87b1 100644
--- a/regress/misc/kexfuzz/kexfuzz.c
+++ b/regress/misc/kexfuzz/kexfuzz.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: kexfuzz.c,v 1.4 2017/04/30 23:34:55 djm Exp $ */
+/*      $OpenBSD: kexfuzz.c,v 1.5 2019/01/21 12:50:12 djm Exp $ */
 /*
  * Fuzz harness for KEX code
  *
@@ -29,8 +29,6 @@
 #include "authfile.h"
 #include "log.h"
 
-struct ssh *active_state = NULL; /* XXX - needed for linking */
-
 void kex_tests(void);
 static int do_debug = 0;
 
@@ -275,18 +273,18 @@ do_kex_with_key(const char *kex, struct sshkey *prvkey, int *c2s, int *s2c,
         ASSERT_PTR_NE(server2->kex, NULL);
         /* XXX we need to set the callbacks */
 #ifdef WITH_OPENSSL
-        server2->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-        server2->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
-        server2->kex->kex[KEX_DH_GRP14_SHA256] = kexdh_server;
-        server2->kex->kex[KEX_DH_GRP16_SHA512] = kexdh_server;
-        server2->kex->kex[KEX_DH_GRP18_SHA512] = kexdh_server;
+        server2->kex->kex[KEX_DH_GRP1_SHA1] = kex_gen_server;
+        server2->kex->kex[KEX_DH_GRP14_SHA1] = kex_gen_server;
+        server2->kex->kex[KEX_DH_GRP14_SHA256] = kex_gen_server;
+        server2->kex->kex[KEX_DH_GRP16_SHA512] = kex_gen_server;
+        server2->kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server;
         server2->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
         server2->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
 # ifdef OPENSSL_HAS_ECC
-        server2->kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
+        server2->kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
 # endif
 #endif
-        server2->kex->kex[KEX_C25519_SHA256] = kexc25519_server;
+        server2->kex->kex[KEX_C25519_SHA256] = kex_gen_server;
         server2->kex->load_host_public_key = server->kex->load_host_public_key;
         server2->kex->load_host_private_key = server->kex->load_host_private_key;
         server2->kex->sign = server->kex->sign;
diff --git a/regress/multiplex.sh b/regress/multiplex.sh
index a6fad8eb8..de357c4d5 100644
--- a/regress/multiplex.sh
+++ b/regress/multiplex.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: multiplex.sh,v 1.28 2017/04/30 23:34:55 djm Exp $
+#       $OpenBSD: multiplex.sh,v 1.29 2019/01/01 22:20:16 djm Exp $
 #       Placed in the Public Domain.
 
 make_tmpdir
@@ -142,7 +142,8 @@ ${SSH} -F $OBJ/ssh_config -p$P otherhost true \
 verbose "test $tid: cmd forward local (UNIX)"
 ${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -L $OBJ/unix-1.fwd:localhost:$PORT otherhost \
      || fail "request local forward failed"
-echo "" | $NC -U $OBJ/unix-1.fwd | grep "Protocol mismatch" >/dev/null 2>&1 \
+echo "" | $NC -U $OBJ/unix-1.fwd | \
+    grep "Invalid SSH identification string" >/dev/null 2>&1 \
      || fail "connect to local forward path failed"
 ${SSH} -F $OBJ/ssh_config -S $CTL -Ocancel -L $OBJ/unix-1.fwd:localhost:$PORT otherhost \
      || fail "cancel local forward failed"
@@ -153,7 +154,8 @@ rm -f $OBJ/unix-1.fwd
 verbose "test $tid: cmd forward remote (UNIX)"
 ${SSH} -F $OBJ/ssh_config -S $CTL -Oforward -R $OBJ/unix-1.fwd:localhost:$PORT otherhost \
      || fail "request remote forward failed"
-echo "" | $NC -U $OBJ/unix-1.fwd | grep "Protocol mismatch" >/dev/null 2>&1 \
+echo "" | $NC -U $OBJ/unix-1.fwd | \
+    grep "Invalid SSH identification string" >/dev/null 2>&1 \
      || fail "connect to remote forwarded path failed"
 ${SSH} -F $OBJ/ssh_config -S $CTL -Ocancel -R $OBJ/unix-1.fwd:localhost:$PORT otherhost \
      || fail "cancel remote forward failed"
diff --git a/regress/multipubkey.sh b/regress/multipubkey.sh
index e9d15306f..4d443ec45 100644
--- a/regress/multipubkey.sh
+++ b/regress/multipubkey.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: multipubkey.sh,v 1.1 2014/12/22 08:06:03 djm Exp $
+#       $OpenBSD: multipubkey.sh,v 1.2 2018/10/31 11:09:27 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="multiple pubkey"
@@ -31,7 +31,7 @@ grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy
 opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes"
 opts="$opts -i $OBJ/cert_user_key1 -i $OBJ/user_key1 -i $OBJ/user_key2"
 
-for privsep in no yes; do
+for privsep in yes sandbox ; do
         (
                 grep -v "Protocol"  $OBJ/sshd_proxy.orig
                 echo "Protocol 2"
diff --git a/regress/principals-command.sh b/regress/principals-command.sh
index bcc68e80b..197c00021 100644
--- a/regress/principals-command.sh
+++ b/regress/principals-command.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: principals-command.sh,v 1.4 2017/04/30 23:34:55 djm Exp $
+#       $OpenBSD: principals-command.sh,v 1.6 2018/11/22 08:48:32 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="authorized principals command"
@@ -30,7 +30,8 @@ CA_FP=`${SSHKEYGEN} -lf $OBJ/user_ca_key.pub | awk '{ print $2 }'`
 
 # Establish a AuthorizedPrincipalsCommand in /var/run where it will have
 # acceptable directory permissions.
-PRINCIPALS_COMMAND="/var/run/principals_command_${LOGNAME}"
+PRINCIPALS_COMMAND="/var/run/principals_command_${LOGNAME}.$$"
+trap "$SUDO rm -f ${PRINCIPALS_COMMAND}" 0
 cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_COMMAND'"
 #!/bin/sh
 test "x\$1" != "x${LOGNAME}" && exit 1
@@ -57,7 +58,7 @@ fi
 
 if [ -x $PRINCIPALS_COMMAND ]; then
         # Test explicitly-specified principals
-        for privsep in yes no ; do
+        for privsep in yes sandbox ; do
                 _prefix="privsep $privsep"
 
                 # Setup for AuthorizedPrincipalsCommand
diff --git a/regress/sftp-chroot.sh b/regress/sftp-chroot.sh
index ba5bd1efb..5acc4d2de 100644
--- a/regress/sftp-chroot.sh
+++ b/regress/sftp-chroot.sh
@@ -1,11 +1,12 @@
-#       $OpenBSD: sftp-chroot.sh,v 1.6 2018/02/09 03:42:57 dtucker Exp $
+#       $OpenBSD: sftp-chroot.sh,v 1.7 2018/11/22 08:48:32 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="sftp in chroot"
 
 CHROOT=/var/run
-FILENAME=testdata_${USER}
+FILENAME=testdata_${USER}.$$
 PRIVDATA=${CHROOT}/${FILENAME}
+trap "${SUDO} rm -f ${PRIVDATA}" 0
 
 if [ -z "$SUDO" -a ! -w /var/run ]; then
         echo "need SUDO to create file in /var/run, test won't work without"
@@ -28,5 +29,3 @@ ${SFTP} -S "$SSH" -F $OBJ/ssh_config host:/${FILENAME} $COPY \
     >>$TEST_REGRESS_LOGFILE 2>&1 || \
         fatal "Fetch ${FILENAME} failed"
 cmp $PRIVDATA $COPY || fail "$PRIVDATA $COPY differ"
-
-$SUDO rm $PRIVDATA
diff --git a/regress/sftp-cmds.sh b/regress/sftp-cmds.sh
index aad7fcac2..1289c4089 100644
--- a/regress/sftp-cmds.sh
+++ b/regress/sftp-cmds.sh
@@ -77,7 +77,6 @@ echo "get \"$DATA\" $COPY" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "get failed"
 cmp $DATA ${COPY} || fail "corrupted copy after get"
 
-if [ "$os" != "cygwin" ]; then
 rm -f ${QUOTECOPY}
 cp $DATA ${QUOTECOPY}
 verbose "$tid: get filename with quotes"
@@ -85,7 +84,6 @@ echo "get \"$QUOTECOPY_ARG\" ${COPY}" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1
         || fail "get failed"
 cmp ${COPY} ${QUOTECOPY} || fail "corrupted copy after get with quotes"
 rm -f ${QUOTECOPY} ${COPY}
-fi
 
 rm -f "$SPACECOPY" ${COPY}
 cp $DATA "$SPACECOPY"
@@ -136,13 +134,11 @@ echo "put $DATA $COPY" | \
         ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
 cmp $DATA ${COPY} || fail "corrupted copy after put"
 
-if [ "$os" != "cygwin" ]; then
 rm -f ${QUOTECOPY}
 verbose "$tid: put filename with quotes"
 echo "put $DATA \"$QUOTECOPY_ARG\"" | \
         ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
 cmp $DATA ${QUOTECOPY} || fail "corrupted copy after put with quotes"
-fi
 
 rm -f "$SPACECOPY"
 verbose "$tid: put filename with spaces"
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 40d46e3cd..b8e2009de 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: test-exec.sh,v 1.64 2018/08/10 01:35:49 dtucker Exp $
+#       $OpenBSD: test-exec.sh,v 1.65 2019/01/27 06:30:53 dtucker Exp $
 #       Placed in the Public Domain.
 
 #SUDO=sudo
@@ -12,10 +12,6 @@ OSF1*)
         BIN_SH=xpg4
         export BIN_SH
         ;;
-CYGWIN_NT-5.0)
-        os=cygwin
-        TEST_SSH_IPV6=no
-        ;;
 CYGWIN*)
         os=cygwin
         ;;
@@ -469,11 +465,11 @@ fi
 
 rm -f $OBJ/known_hosts $OBJ/authorized_keys_$USER
 
-SSH_KEYTYPES="rsa ed25519"
+SSH_KEYTYPES=`$SSH -Q key-plain`
 
-trace "generate keys"
 for t in ${SSH_KEYTYPES}; do
         # generate user key
+        trace "generating key type $t"
         if [ ! -f $OBJ/$t ] || [ ${SSHKEYGEN_BIN} -nt $OBJ/$t ]; then
                 rm -f $OBJ/$t
                 ${SSHKEYGEN} -q -N '' -t $t  -f $OBJ/$t ||\
diff --git a/regress/unittests/Makefile.inc b/regress/unittests/Makefile.inc
index b509f4452..428ef6836 100644
--- a/regress/unittests/Makefile.inc
+++ b/regress/unittests/Makefile.inc
@@ -1,8 +1,25 @@
-#       $OpenBSD: Makefile.inc,v 1.12 2017/12/21 00:41:22 djm Exp $
+#       $OpenBSD: Makefile.inc,v 1.13 2018/10/17 23:28:05 djm Exp $
+
+REGRESS_FAIL_EARLY?=    yes
 
 .include <bsd.own.mk>
 .include <bsd.obj.mk>
 
+# User-settable options
+UNITTEST_FAST?= no      # Skip slow tests (e.g. less intensive fuzzing).
+UNITTEST_SLOW?= no      # Include slower tests (e.g. more intensive fuzzing).
+UNITTEST_VERBOSE?= no   # Verbose test output (inc. per-test names).
+
+MALLOC_OPTIONS?=        CFGJRSUX
+TEST_ENV?=              MALLOC_OPTIONS=${MALLOC_OPTIONS}
+
+# XXX detect from ssh binary?
+OPENSSL?=       yes
+
+.if (${OPENSSL:L} == "yes")
+CFLAGS+=        -DWITH_OPENSSL
+.endif
+
 # enable warnings
 WARNINGS=Yes
 
@@ -49,5 +66,21 @@ DPADD+=${.CURDIR}/../test_helper/libtest_helper.a
 
 .PATH: ${.CURDIR}/${SSHREL}
 
+LDADD+= -lutil
+DPADD+= ${LIBUTIL}
+
+.if (${OPENSSL:L} == "yes")
 LDADD+= -lcrypto
 DPADD+= ${LIBCRYPTO}
+.endif
+
+UNITTEST_ARGS?=
+
+.if (${UNITTEST_VERBOSE:L} != "no")
+UNITTEST_ARGS+= -v
+.endif
+.if (${UNITTEST_FAST:L} != "no")
+UNITTEST_ARGS+= -f
+.elif (${UNITTEST_SLOW:L} != "no")
+UNITTEST_ARGS+= -F
+.endif
diff --git a/regress/unittests/kex/Makefile b/regress/unittests/kex/Makefile
index 5c61307a3..7b4c644e5 100644
--- a/regress/unittests/kex/Makefile
+++ b/regress/unittests/kex/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.5 2017/12/21 00:41:22 djm Exp $
+#       $OpenBSD: Makefile,v 1.6 2019/01/21 12:35:20 djm Exp $
 
 PROG=test_kex
 SRCS=tests.c test_kex.c
@@ -9,12 +9,21 @@ SRCS+=atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c ssh-dss.c
 SRCS+=ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c
 SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c
 SRCS+=addrmatch.c bitmap.c packet.c dispatch.c canohost.c ssh_api.c
-SRCS+=kex.c kexc25519.c kexc25519c.c kexc25519s.c kexdh.c kexdhc.c kexdhs.c
-SRCS+=kexecdh.c kexecdhc.c kexecdhs.c kexgex.c kexgexc.c kexgexs.c
-SRCS+=dh.c compat.c
-SRCS+=ed25519.c hash.c ge25519.c fe25519.c sc25519.c verify.c
+SRCS+=compat.c ed25519.c hash.c ge25519.c fe25519.c sc25519.c verify.c
 SRCS+=cipher-chachapoly.c chacha.c poly1305.c
-SRCS+=smult_curve25519_ref.c
+
+SRCS+=  kex.c
+SRCS+=  dh.c
+SRCS+=  kexdh.c
+SRCS+=  kexecdh.c
+SRCS+=  kexgex.c
+SRCS+=  kexgexc.c
+SRCS+=  kexgexs.c
+SRCS+=  kexc25519.c
+SRCS+=  smult_curve25519_ref.c
+SRCS+=  kexgen.c
+SRCS+=  kexsntrup4591761x25519.c
+SRCS+=  sntrup4591761.c
 
 SRCS+=digest-openssl.c
 #SRCS+=digest-libc.c
diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c
index 6e5999bb9..a860efc02 100644
--- a/regress/unittests/kex/test_kex.c
+++ b/regress/unittests/kex/test_kex.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_kex.c,v 1.2 2015/07/10 06:23:25 markus Exp $ */
+/*      $OpenBSD: test_kex.c,v 1.4 2019/01/21 12:35:20 djm Exp $ */
 /*
  * Regress test KEX
  *
@@ -24,8 +24,6 @@
 #include "packet.h"
 #include "myproposal.h"
 
-struct ssh *active_state = NULL; /* XXX - needed for linking */
-
 void kex_tests(void);
 static int do_debug = 0;
 
@@ -139,20 +137,19 @@ do_kex_with_key(char *kex, int keytype, int bits)
         ASSERT_INT_EQ(ssh_init(&server2, 1, NULL), 0);
         ASSERT_PTR_NE(server2, NULL);
         ASSERT_INT_EQ(ssh_add_hostkey(server2, private), 0);
-        kex_free(server2->kex); /* XXX or should ssh_packet_set_state()? */
         ASSERT_INT_EQ(ssh_packet_set_state(server2, state), 0);
         ASSERT_INT_EQ(sshbuf_len(state), 0);
         sshbuf_free(state);
         ASSERT_PTR_NE(server2->kex, NULL);
         /* XXX we need to set the callbacks */
-        server2->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-        server2->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
+        server2->kex->kex[KEX_DH_GRP1_SHA1] = kex_gen_server;
+        server2->kex->kex[KEX_DH_GRP14_SHA1] = kex_gen_server;
         server2->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
         server2->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
 #ifdef OPENSSL_HAS_ECC
-        server2->kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
+        server2->kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
 #endif
-        server2->kex->kex[KEX_C25519_SHA256] = kexc25519_server;
+        server2->kex->kex[KEX_C25519_SHA256] = kex_gen_server;
         server2->kex->load_host_public_key = server->kex->load_host_public_key;
         server2->kex->load_host_private_key = server->kex->load_host_private_key;
         server2->kex->sign = server->kex->sign;
diff --git a/regress/unittests/sshbuf/Makefile b/regress/unittests/sshbuf/Makefile
index 81d4f27a6..0e8e9fd10 100644
--- a/regress/unittests/sshbuf/Makefile
+++ b/regress/unittests/sshbuf/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.6 2017/12/21 00:41:22 djm Exp $
+#       $OpenBSD: Makefile,v 1.7 2018/10/17 23:28:05 djm Exp $
 
 .include <bsd.regress.mk>
 
@@ -17,6 +17,5 @@ SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c
 SRCS+=atomicio.c
 
 run-regress-${PROG}: ${PROG}
-        env ${TEST_ENV} ./${PROG}
- 
+        env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS}
 
diff --git a/regress/unittests/sshbuf/test_sshbuf_fuzz.c b/regress/unittests/sshbuf/test_sshbuf_fuzz.c
index c52376b53..e236c82f9 100644
--- a/regress/unittests/sshbuf/test_sshbuf_fuzz.c
+++ b/regress/unittests/sshbuf/test_sshbuf_fuzz.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_sshbuf_fuzz.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*      $OpenBSD: test_sshbuf_fuzz.c,v 1.2 2018/10/17 23:28:05 djm Exp $ */
 /*
  * Regress test for sshbuf.h buffer API
  *
@@ -30,10 +30,15 @@ sshbuf_fuzz_tests(void)
 {
         struct sshbuf *p1;
         u_char *dp;
-        size_t sz, sz2, i;
+        size_t sz, sz2, i, ntests = NUM_FUZZ_TESTS;
         u_int32_t r;
         int ret;
 
+        if (test_is_fast())
+                ntests >>= 2;
+        if (test_is_slow())
+                ntests <<= 2;
+
         /* NB. uses sshbuf internals */
         TEST_START("fuzz alloc/dealloc");
         p1 = sshbuf_new();
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c
index a68e1329e..5d39e63e1 100644
--- a/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_sshbuf_getput_crypto.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*      $OpenBSD: test_sshbuf_getput_crypto.c,v 1.2 2019/01/21 12:29:35 djm Exp $ */
 /*
  * Regress test for sshbuf.h buffer API
  *
@@ -33,7 +33,6 @@ sshbuf_getput_crypto_tests(void)
 {
         struct sshbuf *p1;
         BIGNUM *bn, *bn2;
-        /* This one has num_bits != num_bytes * 8 to test bignum1 encoding */
         const char *hexbn1 = "0102030405060708090a0b0c0d0e0f10";
         /* This one has MSB set to test bignum2 encoding negative-avoidance */
         const char *hexbn2 = "f0e0d0c0b0a0908070605040302010007fff11";
@@ -77,54 +76,6 @@ sshbuf_getput_crypto_tests(void)
                 ASSERT_INT_GT(BN_hex2bn(&bnn, b), 0); \
         } while (0)
 
-        TEST_START("sshbuf_put_bignum1");
-        MKBN(hexbn1, bn);
-        p1 = sshbuf_new();
-        ASSERT_PTR_NE(p1, NULL);
-        ASSERT_INT_EQ(sshbuf_put_bignum1(p1, bn), 0);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn1) + 2);
-        ASSERT_U16_EQ(PEEK_U16(sshbuf_ptr(p1)), (u_int16_t)BN_num_bits(bn));
-        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 2, expbn1, sizeof(expbn1));
-        BN_free(bn);
-        sshbuf_free(p1);
-        TEST_DONE();
-
-        TEST_START("sshbuf_put_bignum1 limited");
-        MKBN(hexbn1, bn);
-        p1 = sshbuf_new();
-        ASSERT_PTR_NE(p1, NULL);
-        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn1) + 1), 0);
-        r = sshbuf_put_bignum1(p1, bn);
-        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
-        BN_free(bn);
-        sshbuf_free(p1);
-        TEST_DONE();
-
-        TEST_START("sshbuf_put_bignum1 bn2");
-        MKBN(hexbn2, bn);
-        p1 = sshbuf_new();
-        ASSERT_PTR_NE(p1, NULL);
-        ASSERT_INT_EQ(sshbuf_put_bignum1(p1, bn), 0);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 2);
-        ASSERT_U16_EQ(PEEK_U16(sshbuf_ptr(p1)), (u_int16_t)BN_num_bits(bn));
-        ASSERT_MEM_EQ(sshbuf_ptr(p1) + 2, expbn2, sizeof(expbn2));
-        BN_free(bn);
-        sshbuf_free(p1);
-        TEST_DONE();
-
-        TEST_START("sshbuf_put_bignum1 bn2 limited");
-        MKBN(hexbn2, bn);
-        p1 = sshbuf_new();
-        ASSERT_PTR_NE(p1, NULL);
-        ASSERT_INT_EQ(sshbuf_set_max_size(p1, sizeof(expbn1) + 1), 0);
-        r = sshbuf_put_bignum1(p1, bn);
-        ASSERT_INT_EQ(r, SSH_ERR_NO_BUFFER_SPACE);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 0);
-        BN_free(bn);
-        sshbuf_free(p1);
-        TEST_DONE();
-
         TEST_START("sshbuf_put_bignum2");
         MKBN(hexbn1, bn);
         p1 = sshbuf_new();
@@ -174,88 +125,6 @@ sshbuf_getput_crypto_tests(void)
         sshbuf_free(p1);
         TEST_DONE();
 
-        TEST_START("sshbuf_get_bignum1");
-        MKBN(hexbn1, bn);
-        p1 = sshbuf_new();
-        ASSERT_PTR_NE(p1, NULL);
-        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
-        ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1)), 0);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1));
-        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
-        bn2 = BN_new();
-        ASSERT_INT_EQ(sshbuf_get_bignum1(p1, bn2), 0);
-        ASSERT_BIGNUM_EQ(bn, bn2);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
-        BN_free(bn);
-        BN_free(bn2);
-        sshbuf_free(p1);
-        TEST_DONE();
-
-        TEST_START("sshbuf_get_bignum1 truncated");
-        MKBN(hexbn1, bn);
-        p1 = sshbuf_new();
-        ASSERT_PTR_NE(p1, NULL);
-        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
-        ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1) - 1), 0);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1) - 1);
-        bn2 = BN_new();
-        r = sshbuf_get_bignum1(p1, bn2);
-        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn1) - 1);
-        BN_free(bn);
-        BN_free(bn2);
-        sshbuf_free(p1);
-        TEST_DONE();
-
-        TEST_START("sshbuf_get_bignum1 giant");
-        MKBN(hexbn1, bn);
-        p1 = sshbuf_new();
-        ASSERT_PTR_NE(p1, NULL);
-        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xffff), 0);
-        ASSERT_INT_EQ(sshbuf_reserve(p1, (0xffff + 7) / 8, NULL), 0);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + ((0xffff + 7) / 8));
-        bn2 = BN_new();
-        r = sshbuf_get_bignum1(p1, bn2);
-        ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_TOO_LARGE);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + ((0xffff + 7) / 8));
-        BN_free(bn);
-        BN_free(bn2);
-        sshbuf_free(p1);
-        TEST_DONE();
-
-        TEST_START("sshbuf_get_bignum1 bn2");
-        MKBN(hexbn2, bn);
-        p1 = sshbuf_new();
-        ASSERT_PTR_NE(p1, NULL);
-        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
-        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2));
-        ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
-        bn2 = BN_new();
-        ASSERT_INT_EQ(sshbuf_get_bignum1(p1, bn2), 0);
-        ASSERT_BIGNUM_EQ(bn, bn2);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
-        BN_free(bn);
-        BN_free(bn2);
-        sshbuf_free(p1);
-        TEST_DONE();
-
-        TEST_START("sshbuf_get_bignum1 bn2 truncated");
-        MKBN(hexbn2, bn);
-        p1 = sshbuf_new();
-        ASSERT_PTR_NE(p1, NULL);
-        ASSERT_INT_EQ(sshbuf_put_u16(p1, BN_num_bits(bn)), 0);
-        ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2) - 1), 0);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2) - 1);
-        bn2 = BN_new();
-        r = sshbuf_get_bignum1(p1, bn2);
-        ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
-        ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2 + sizeof(expbn2) - 1);
-        BN_free(bn);
-        BN_free(bn2);
-        sshbuf_free(p1);
-        TEST_DONE();
-
         TEST_START("sshbuf_get_bignum2");
         MKBN(hexbn1, bn);
         p1 = sshbuf_new();
@@ -264,8 +133,8 @@ sshbuf_getput_crypto_tests(void)
         ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1)), 0);
         ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4 + sizeof(expbn1));
         ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
-        bn2 = BN_new();
-        ASSERT_INT_EQ(sshbuf_get_bignum2(p1, bn2), 0);
+        bn2 = NULL;
+        ASSERT_INT_EQ(sshbuf_get_bignum2(p1, &bn2), 0);
         ASSERT_BIGNUM_EQ(bn, bn2);
         ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
         BN_free(bn);
@@ -279,8 +148,8 @@ sshbuf_getput_crypto_tests(void)
         ASSERT_PTR_NE(p1, NULL);
         ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn)), 0);
         ASSERT_INT_EQ(sshbuf_put(p1, expbn1, sizeof(expbn1) - 1), 0);
-        bn2 = BN_new();
-        r = sshbuf_get_bignum2(p1, bn2);
+        bn2 = NULL;
+        r = sshbuf_get_bignum2(p1, &bn2);
         ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
         ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn1) + 3);
         BN_free(bn);
@@ -294,8 +163,8 @@ sshbuf_getput_crypto_tests(void)
         ASSERT_PTR_NE(p1, NULL);
         ASSERT_INT_EQ(sshbuf_put_u32(p1, 65536), 0);
         ASSERT_INT_EQ(sshbuf_reserve(p1, 65536, NULL), 0);
-        bn2 = BN_new();
-        r = sshbuf_get_bignum2(p1, bn2);
+        bn2 = NULL;
+        r = sshbuf_get_bignum2(p1, &bn2);
         ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_TOO_LARGE);
         ASSERT_SIZE_T_EQ(sshbuf_len(p1), 65536 + 4);
         BN_free(bn);
@@ -312,8 +181,8 @@ sshbuf_getput_crypto_tests(void)
         ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0);
         ASSERT_SIZE_T_EQ(sshbuf_len(p1), 4 + 1 + sizeof(expbn2));
         ASSERT_INT_EQ(sshbuf_put_u16(p1, 0xd00f), 0);
-        bn2 = BN_new();
-        ASSERT_INT_EQ(sshbuf_get_bignum2(p1, bn2), 0);
+        bn2 = NULL;
+        ASSERT_INT_EQ(sshbuf_get_bignum2(p1, &bn2), 0);
         ASSERT_BIGNUM_EQ(bn, bn2);
         ASSERT_SIZE_T_EQ(sshbuf_len(p1), 2);
         BN_free(bn);
@@ -328,8 +197,8 @@ sshbuf_getput_crypto_tests(void)
         ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn) + 1), 0);
         ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x00), 0);
         ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2) - 1), 0);
-        bn2 = BN_new();
-        r = sshbuf_get_bignum2(p1, bn2);
+        bn2 = NULL;
+        r = sshbuf_get_bignum2(p1, &bn2);
         ASSERT_INT_EQ(r, SSH_ERR_MESSAGE_INCOMPLETE);
         ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 1 + 4 - 1);
         BN_free(bn);
@@ -343,8 +212,8 @@ sshbuf_getput_crypto_tests(void)
         ASSERT_PTR_NE(p1, NULL);
         ASSERT_INT_EQ(sshbuf_put_u32(p1, BN_num_bytes(bn)), 0);
         ASSERT_INT_EQ(sshbuf_put(p1, expbn2, sizeof(expbn2)), 0);
-        bn2 = BN_new();
-        r = sshbuf_get_bignum2(p1, bn2);
+        bn2 = NULL;
+        r = sshbuf_get_bignum2(p1, &bn2);
         ASSERT_INT_EQ(r, SSH_ERR_BIGNUM_IS_NEGATIVE);
         ASSERT_SIZE_T_EQ(sshbuf_len(p1), sizeof(expbn2) + 4);
         BN_free(bn);
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c
index c6b5c29d1..ca06bfb00 100644
--- a/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_sshbuf_getput_fuzz.c,v 1.2 2014/05/02 02:54:00 djm Exp $ */
+/*      $OpenBSD: test_sshbuf_getput_fuzz.c,v 1.4 2019/01/21 12:29:35 djm Exp $ */
 /*
  * Regress test for sshbuf.h buffer API
  *
@@ -54,11 +54,8 @@ attempt_parse_blob(u_char *blob, size_t len)
                 bzero(s, l);
                 free(s);
         }
-        bn = BN_new();
-        sshbuf_get_bignum1(p1, bn);
-        BN_clear_free(bn);
-        bn = BN_new();
-        sshbuf_get_bignum2(p1, bn);
+        bn = NULL;
+        sshbuf_get_bignum2(p1, &bn);
         BN_clear_free(bn);
 #if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256)
         eck = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
@@ -92,10 +89,6 @@ sshbuf_getput_fuzz_tests(void)
                 /* string */
                 0x00, 0x00, 0x00, 0x09,
                 'O', ' ', 'G', 'o', 'r', 'g', 'o', 'n', '!',
-                /* bignum1 */
-                0x79,
-                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
-                0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
                 /* bignum2 */
                 0x00, 0x00, 0x00, 0x14,
                 0x00,
@@ -115,11 +108,15 @@ sshbuf_getput_fuzz_tests(void)
                 0x55, 0x0f, 0x69, 0xd8, 0x0e, 0xc2, 0x3c, 0xd4,
         };
         struct fuzz *fuzz;
+        u_int fuzzers = FUZZ_1_BIT_FLIP | FUZZ_2_BIT_FLIP |
+            FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END;
+
+        if (test_is_fast())
+                fuzzers &= ~(FUZZ_2_BYTE_FLIP|FUZZ_2_BIT_FLIP);
 
         TEST_START("fuzz blob parsing");
-        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | FUZZ_2_BIT_FLIP |
-            FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP |
-            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END, blob, sizeof(blob));
+        fuzz = fuzz_begin(fuzzers, blob, sizeof(blob));
         TEST_ONERROR(onerror, fuzz);
         for(; !fuzz_done(fuzz); fuzz_next(fuzz))
                 attempt_parse_blob(blob, sizeof(blob));
diff --git a/regress/unittests/sshkey/Makefile b/regress/unittests/sshkey/Makefile
index 1c940bec6..aa731df1c 100644
--- a/regress/unittests/sshkey/Makefile
+++ b/regress/unittests/sshkey/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.5 2017/12/21 00:41:22 djm Exp $
+#       $OpenBSD: Makefile,v 1.6 2018/10/17 23:28:05 djm Exp $
 
 PROG=test_sshkey
 SRCS=tests.c test_sshkey.c test_file.c test_fuzz.c common.c
@@ -18,7 +18,7 @@ SRCS+=digest-openssl.c
 REGRESS_TARGETS=run-regress-${PROG}
 
 run-regress-${PROG}: ${PROG}
-        env ${TEST_ENV} ./${PROG} -d ${.CURDIR}/testdata
+        env ${TEST_ENV} ./${PROG} ${UNITTEST_ARGS} -d ${.CURDIR}/testdata
 
 .include <bsd.regress.mk>
 
diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c
index d3b0c92b4..5953de595 100644
--- a/regress/unittests/sshkey/test_fuzz.c
+++ b/regress/unittests/sshkey/test_fuzz.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_fuzz.c,v 1.8 2017/12/21 00:41:22 djm Exp $ */
+/*      $OpenBSD: test_fuzz.c,v 1.9 2018/10/17 23:28:05 djm Exp $ */
 /*
  * Fuzz tests for key parsing
  *
@@ -51,14 +51,16 @@ public_fuzz(struct sshkey *k)
         struct sshkey *k1;
         struct sshbuf *buf;
         struct fuzz *fuzz;
+        u_int fuzzers = FUZZ_1_BIT_FLIP | FUZZ_1_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END;
 
+        if (test_is_fast())
+                fuzzers &= ~FUZZ_1_BIT_FLIP;
+        if (test_is_slow())
+                fuzzers |= FUZZ_2_BIT_FLIP | FUZZ_2_BYTE_FLIP;
         ASSERT_PTR_NE(buf = sshbuf_new(), NULL);
         ASSERT_INT_EQ(sshkey_putb(k, buf), 0);
-        /* XXX need a way to run the tests in "slow, but complete" mode */
-        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | /* XXX too slow FUZZ_2_BIT_FLIP | */
-            FUZZ_1_BYTE_FLIP | /* XXX too slow FUZZ_2_BYTE_FLIP | */
-            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END,
-            sshbuf_mutable_ptr(buf), sshbuf_len(buf));
+        fuzz = fuzz_begin(fuzzers, sshbuf_mutable_ptr(buf), sshbuf_len(buf));
         ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(buf), sshbuf_len(buf),
             &k1), 0);
         sshkey_free(k1);
@@ -77,12 +79,17 @@ sig_fuzz(struct sshkey *k, const char *sig_alg)
         struct fuzz *fuzz;
         u_char *sig, c[] = "some junk to be signed";
         size_t l;
+        u_int fuzzers = FUZZ_1_BIT_FLIP | FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP |
+            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END;
+
+        if (test_is_fast())
+                fuzzers &= ~FUZZ_2_BYTE_FLIP;
+        if (test_is_slow())
+                fuzzers |= FUZZ_2_BIT_FLIP;
 
         ASSERT_INT_EQ(sshkey_sign(k, &sig, &l, c, sizeof(c), sig_alg, 0), 0);
         ASSERT_SIZE_T_GT(l, 0);
-        fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | /* too slow FUZZ_2_BIT_FLIP | */
-            FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP |
-            FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END, sig, l);
+        fuzz = fuzz_begin(fuzzers, sig, l);
         ASSERT_INT_EQ(sshkey_verify(k, sig, l, c, sizeof(c), NULL, 0), 0);
         free(sig);
         TEST_ONERROR(onerror, fuzz);
@@ -96,13 +103,15 @@ sig_fuzz(struct sshkey *k, const char *sig_alg)
         fuzz_cleanup(fuzz);
 }
 
+#define NUM_FAST_BASE64_TESTS   1024
+
 void
 sshkey_fuzz_tests(void)
 {
         struct sshkey *k1;
         struct sshbuf *buf, *fuzzed;
         struct fuzz *fuzz;
-        int r;
+        int r, i;
 
 
         TEST_START("fuzz RSA private");
@@ -114,12 +123,14 @@ sshkey_fuzz_tests(void)
         sshbuf_free(buf);
         ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
         TEST_ONERROR(onerror, fuzz);
-        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+        for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) {
                 r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
                 ASSERT_INT_EQ(r, 0);
                 if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
                         sshkey_free(k1);
                 sshbuf_reset(fuzzed);
+                if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS)
+                        break;
         }
         sshbuf_free(fuzzed);
         fuzz_cleanup(fuzz);
@@ -134,12 +145,14 @@ sshkey_fuzz_tests(void)
         sshbuf_free(buf);
         ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
         TEST_ONERROR(onerror, fuzz);
-        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+        for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) {
                 r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
                 ASSERT_INT_EQ(r, 0);
                 if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
                         sshkey_free(k1);
                 sshbuf_reset(fuzzed);
+                if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS)
+                        break;
         }
         sshbuf_free(fuzzed);
         fuzz_cleanup(fuzz);
@@ -154,12 +167,14 @@ sshkey_fuzz_tests(void)
         sshbuf_free(buf);
         ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
         TEST_ONERROR(onerror, fuzz);
-        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+        for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) {
                 r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
                 ASSERT_INT_EQ(r, 0);
                 if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
                         sshkey_free(k1);
                 sshbuf_reset(fuzzed);
+                if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS)
+                        break;
         }
         sshbuf_free(fuzzed);
         fuzz_cleanup(fuzz);
@@ -174,12 +189,14 @@ sshkey_fuzz_tests(void)
         sshbuf_free(buf);
         ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
         TEST_ONERROR(onerror, fuzz);
-        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+        for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) {
                 r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
                 ASSERT_INT_EQ(r, 0);
                 if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
                         sshkey_free(k1);
                 sshbuf_reset(fuzzed);
+                if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS)
+                        break;
         }
         sshbuf_free(fuzzed);
         fuzz_cleanup(fuzz);
@@ -195,12 +212,14 @@ sshkey_fuzz_tests(void)
         sshbuf_free(buf);
         ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
         TEST_ONERROR(onerror, fuzz);
-        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+        for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) {
                 r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
                 ASSERT_INT_EQ(r, 0);
                 if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
                         sshkey_free(k1);
                 sshbuf_reset(fuzzed);
+                if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS)
+                        break;
         }
         sshbuf_free(fuzzed);
         fuzz_cleanup(fuzz);
@@ -215,12 +234,14 @@ sshkey_fuzz_tests(void)
         sshbuf_free(buf);
         ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
         TEST_ONERROR(onerror, fuzz);
-        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+        for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) {
                 r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
                 ASSERT_INT_EQ(r, 0);
                 if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
                         sshkey_free(k1);
                 sshbuf_reset(fuzzed);
+                if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS)
+                        break;
         }
         sshbuf_free(fuzzed);
         fuzz_cleanup(fuzz);
@@ -236,12 +257,14 @@ sshkey_fuzz_tests(void)
         sshbuf_free(buf);
         ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
         TEST_ONERROR(onerror, fuzz);
-        for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
+        for(i = 0; !fuzz_done(fuzz); i++, fuzz_next(fuzz)) {
                 r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
                 ASSERT_INT_EQ(r, 0);
                 if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
                         sshkey_free(k1);
                 sshbuf_reset(fuzzed);
+                if (test_is_fast() && i >= NUM_FAST_BASE64_TESTS)
+                        break;
         }
         sshbuf_free(fuzzed);
         fuzz_cleanup(fuzz);
diff --git a/regress/unittests/sshkey/tests.c b/regress/unittests/sshkey/tests.c
index 13f265cdb..78aa9223d 100644
--- a/regress/unittests/sshkey/tests.c
+++ b/regress/unittests/sshkey/tests.c
@@ -7,8 +7,6 @@
 
 #include "includes.h"
 
-#include <openssl/evp.h>
-
 #include "../test_helper/test_helper.h"
 
 void sshkey_tests(void);
@@ -18,9 +16,6 @@ void sshkey_fuzz_tests(void);
 void
 tests(void)
 {
-        OpenSSL_add_all_algorithms();
-        ERR_load_CRYPTO_strings();
-
         sshkey_tests();
         sshkey_file_tests();
         sshkey_fuzz_tests();
diff --git a/regress/unittests/test_helper/test_helper.c b/regress/unittests/test_helper/test_helper.c
index 4cc70852c..e7a47b265 100644
--- a/regress/unittests/test_helper/test_helper.c
+++ b/regress/unittests/test_helper/test_helper.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_helper.c,v 1.8 2018/02/08 08:46:20 djm Exp $     */
+/*      $OpenBSD: test_helper.c,v 1.11 2018/11/23 02:53:57 dtucker Exp $        */
 /*
  * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
  *
@@ -35,11 +35,13 @@
 #include <signal.h>
 
 #include <openssl/bn.h>
+#include <openssl/err.h>
 
 #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
 # include <vis.h>
 #endif
 
+#include "entropy.h"
 #include "test_helper.h"
 #include "atomicio.h"
 
@@ -115,12 +117,17 @@ static test_onerror_func_t *test_onerror = NULL;
 static void *onerror_ctx = NULL;
 static const char *data_dir = NULL;
 static char subtest_info[512];
+static int fast = 0;
+static int slow = 0;
 
 int
 main(int argc, char **argv)
 {
         int ch;
 
+        seed_rng();
+        ERR_load_CRYPTO_strings();
+
         /* Handle systems without __progname */
         if (__progname == NULL) {
                 __progname = strrchr(argv[0], '/');
@@ -134,8 +141,14 @@ main(int argc, char **argv)
                 }
         }
 
-        while ((ch = getopt(argc, argv, "vqd:")) != -1) {
+        while ((ch = getopt(argc, argv, "Ffvqd:")) != -1) {
                 switch (ch) {
+                case 'F':
+                        slow = 1;
+                        break;
+                case 'f':
+                        fast = 1;
+                        break;
                 case 'd':
                         data_dir = optarg;
                         break;
@@ -167,17 +180,29 @@ main(int argc, char **argv)
 }
 
 int
-test_is_verbose()
+test_is_verbose(void)
 {
         return verbose_mode;
 }
 
 int
-test_is_quiet()
+test_is_quiet(void)
 {
         return quiet_mode;
 }
 
+int
+test_is_fast(void)
+{
+        return fast;
+}
+
+int
+test_is_slow(void)
+{
+        return slow;
+}
+
 const char *
 test_data_file(const char *name)
 {
diff --git a/regress/unittests/test_helper/test_helper.h b/regress/unittests/test_helper/test_helper.h
index 6da0066e9..1f893c8dd 100644
--- a/regress/unittests/test_helper/test_helper.h
+++ b/regress/unittests/test_helper/test_helper.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_helper.h,v 1.8 2018/02/08 08:46:20 djm Exp $     */
+/*      $OpenBSD: test_helper.h,v 1.9 2018/10/17 23:28:05 djm Exp $     */
 /*
  * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
  *
@@ -45,6 +45,8 @@ void set_onerror_func(test_onerror_func_t *f, void *ctx);
 void test_done(void);
 int test_is_verbose(void);
 int test_is_quiet(void);
+int test_is_fast(void);
+int test_is_slow(void);
 void test_subtest_info(const char *fmt, ...)
     __attribute__((format(printf, 1, 2)));
 void ssl_err_check(const char *file, int line);