* New upstream release (http://www.openssh.org/txt/release-5.9).

  - Introduce sandboxing of the pre-auth privsep child using an optional
    sshd_config(5) "UsePrivilegeSeparation=sandbox" mode that enables
    mandatory restrictions on the syscalls the privsep child can perform.
  - Add new SHA256-based HMAC transport integrity modes from
    http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt.
  - The pre-authentication sshd(8) privilege separation slave process now
    logs via a socket shared with the master process, avoiding the need to
    maintain /dev/log inside the chroot (closes: #75043, #429243,
    #599240).
  - ssh(1) now warns when a server refuses X11 forwarding (closes:
    #504757).
  - sshd_config(5)'s AuthorizedKeysFile now accepts multiple paths,
    separated by whitespace (closes: #76312).  The authorized_keys2
    fallback is deprecated but documented (closes: #560156).
  - ssh(1) and sshd(8): set IPv6 traffic class from IPQoS, as well as IPv4
    ToS/DSCP (closes: #498297).
  - ssh-add(1) now accepts keys piped from standard input.  E.g. "ssh-add
    - < /path/to/key" (closes: #229124).
  - Clean up lost-passphrase text in ssh-keygen(1) (closes: #444691).
  - Say "required" rather than "recommended" in unprotected-private-key
    warning (LP: #663455).

9 files changed, 83 insertions, 51 deletions

diff --git a/regress/README.regress b/regress/README.regress
index da9bb6a99..82e4cc751 100644
--- a/regress/README.regress
+++ b/regress/README.regress
@@ -93,10 +93,6 @@ Failed tests can be difficult to diagnose. Suggestions:
 
 Known Issues.
 
-- If your build requires ssh-rand-helper regress tests will fail
-  unless ssh-rand-helper is in pre-installed (the path to
-  ssh-rand-helper is hard coded).
-
 - Similarly, if you do not have "scp" in your system's $PATH then the
   multiplex scp tests will fail (since the system's shell startup scripts
   will determine where the shell started by sshd will look for scp).
@@ -105,4 +101,4 @@ Known Issues.
   test to fail.  The old behaviour can be restored by setting (and
   exporting) _POSIX2_VERSION=199209 before running the tests.
 
-$Id: README.regress,v 1.11 2010/08/16 21:04:29 djm Exp $
+$Id: README.regress,v 1.12 2011/05/05 03:48:42 djm Exp $
diff --git a/regress/cert-hostkey.sh b/regress/cert-hostkey.sh
index 3b147b9f7..6216abd87 100644
--- a/regress/cert-hostkey.sh
+++ b/regress/cert-hostkey.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cert-hostkey.sh,v 1.5 2010/08/31 12:24:09 djm Exp $
+#       $OpenBSD: cert-hostkey.sh,v 1.6 2011/05/20 02:43:36 djm Exp $
 #       Placed in the Public Domain.
 
 tid="certified host keys"
diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh
index fcca3708b..6700db274 100644
--- a/regress/cert-userkey.sh
+++ b/regress/cert-userkey.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cert-userkey.sh,v 1.7 2010/08/31 12:24:09 djm Exp $
+#       $OpenBSD: cert-userkey.sh,v 1.8 2011/05/17 07:13:31 djm Exp $
 #       Placed in the Public Domain.
 
 tid="certified user keys"
@@ -27,7 +27,7 @@ for ktype in rsa dsa $ecdsa ; do
             -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype} ||
                 fail "couldn't sign cert_user_key_${ktype}"
         # v00 ecdsa certs do not exist
-        test "{ktype}" = "ecdsa" && continue
+        test "${ktype}" = "ecdsa" && continue
         cp $OBJ/cert_user_key_${ktype} $OBJ/cert_user_key_${ktype}_v00
         cp $OBJ/cert_user_key_${ktype}.pub $OBJ/cert_user_key_${ktype}_v00.pub
         ${SSHKEYGEN} -q -t v00 -s $OBJ/user_ca_key -I \
diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh
index 96badd51b..0603fab64 100644
--- a/regress/cfgmatch.sh
+++ b/regress/cfgmatch.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cfgmatch.sh,v 1.4 2006/12/13 08:36:36 dtucker Exp $
+#       $OpenBSD: cfgmatch.sh,v 1.6 2011/06/03 05:35:10 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="sshd_config match"
@@ -7,6 +7,28 @@ pidfile=$OBJ/remote_pid
 fwdport=3301
 fwd="-L $fwdport:127.0.0.1:$PORT"
 
+echo "ExitOnForwardFailure=yes" >> $OBJ/ssh_config
+echo "ExitOnForwardFailure=yes" >> $OBJ/ssh_proxy
+
+start_client()
+{
+        rm -f $pidfile
+        ${SSH} -q -$p $fwd "$@" somehost \
+            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' \
+            >>$TEST_SSH_LOGFILE 2>&1 &
+        client_pid=$!
+        # Wait for remote end
+        n=0
+        while test ! -f $pidfile ; do
+                sleep 1
+                n=`expr $n + 1`
+                if test $n -gt 60; then
+                        kill $client_pid
+                        fatal "timeout waiting for background ssh"
+                fi
+        done    
+}
+
 stop_client()
 {
         pid=`cat $pidfile`
@@ -14,11 +36,15 @@ stop_client()
                 kill $pid
                 sleep 1
         fi
+        wait
 }
 
 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
-
+grep -v AuthorizedKeysFile $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
+echo "AuthorizedKeysFile /dev/null" >>$OBJ/sshd_proxy
 echo "PermitOpen 127.0.0.1:1" >>$OBJ/sshd_config
+echo "Match user $USER" >>$OBJ/sshd_proxy
+echo "AuthorizedKeysFile /dev/null $OBJ/authorized_keys_%u" >>$OBJ/sshd_proxy
 echo "Match Address 127.0.0.1" >>$OBJ/sshd_config
 echo "PermitOpen 127.0.0.1:$PORT" >>$OBJ/sshd_config
 
@@ -32,12 +58,8 @@ start_sshd
 
 # Test Match + PermitOpen in sshd_config.  This should be permitted
 for p in 1 2; do
-        rm -f $pidfile
         trace "match permitopen localhost proto $p"
-        ${SSH} -$p $fwd -F $OBJ/ssh_config -f somehost \
-            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
-            fail "match permitopen proto $p sshd failed"
-        sleep 1;
+        start_client -F $OBJ/ssh_config
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
             fail "match permitopen permit proto $p"
         stop_client
@@ -45,12 +67,8 @@ done
 
 # Same but from different source.  This should not be permitted
 for p in 1 2; do
-        rm -f $pidfile
         trace "match permitopen proxy proto $p"
-        ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
-            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
-            fail "match permitopen proxy proto $p sshd failed"
-        sleep 1;
+        start_client -F $OBJ/ssh_proxy
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
             fail "match permitopen deny proto $p"
         stop_client
@@ -62,12 +80,8 @@ cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
 echon 'permitopen="127.0.0.1:'$PORT'" ' >>$OBJ/authorized_keys_$USER
 cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
 for p in 1 2; do
-        rm -f $pidfile
         trace "match permitopen proxy w/key opts proto $p"
-        ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
-            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
-            fail "match permitopen w/key opt proto $p sshd failed"
-        sleep 1;
+        start_client -F $OBJ/ssh_proxy
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
             fail "match permitopen deny w/key opt proto $p"
         stop_client
@@ -76,12 +90,8 @@ done
 # Test both sshd_config and key options permitting the same dst/port pair.
 # Should be permitted.
 for p in 1 2; do
-        rm -f $pidfile
         trace "match permitopen localhost proto $p"
-        ${SSH} -$p $fwd -F $OBJ/ssh_config -f somehost \
-            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
-            fail "match permitopen proto $p sshd failed"
-        sleep 1;
+        start_client -F $OBJ/ssh_config
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
             fail "match permitopen permit proto $p"
         stop_client
@@ -94,12 +104,8 @@ echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
 
 # Test that a Match overrides a PermitOpen in the global section
 for p in 1 2; do
-        rm -f $pidfile
         trace "match permitopen proxy w/key opts proto $p"
-        ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
-            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
-            fail "match override permitopen proto $p sshd failed"
-        sleep 1;
+        start_client -F $OBJ/ssh_proxy
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
             fail "match override permitopen proto $p"
         stop_client
@@ -113,12 +119,8 @@ echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
 # Test that a rule that doesn't match doesn't override, plus test a
 # PermitOpen entry that's not at the start of the list
 for p in 1 2; do
-        rm -f $pidfile
         trace "nomatch permitopen proxy w/key opts proto $p"
-        ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
-            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
-            fail "nomatch override permitopen proto $p sshd failed"
-        sleep 1;
+        start_client -F $OBJ/ssh_proxy
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
             fail "nomatch override permitopen proto $p"
         stop_client
diff --git a/regress/cipher-speed.sh b/regress/cipher-speed.sh
index 85de6d585..257afd179 100644
--- a/regress/cipher-speed.sh
+++ b/regress/cipher-speed.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cipher-speed.sh,v 1.3 2007/06/07 19:41:46 pvalchev Exp $
+#       $OpenBSD: cipher-speed.sh,v 1.4 2011/08/02 01:23:41 djm Exp $
 #       Placed in the Public Domain.
 
 tid="cipher speed"
@@ -12,9 +12,13 @@ tries="1 2"
 DATA=/bin/ls
 DATA=/bsd
 
-macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
 ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc 
-        arcfour128 arcfour256 arcfour aes192-cbc aes256-cbc aes128-ctr"
+        arcfour128 arcfour256 arcfour 
+        aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se
+        aes128-ctr aes192-ctr aes256-ctr"
+macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
+config_defined HAVE_EVP_SHA256 &&
+    macs="$macs hmac-sha2-256 hmac-sha2-256-96 hmac-sha2-512 hmac-sha2-512-96"
 
 for c in $ciphers; do for m in $macs; do
         trace "proto 2 cipher $c mac $m"
diff --git a/regress/connect-privsep.sh b/regress/connect-privsep.sh
index d23cadba5..11fb9aef9 100644
--- a/regress/connect-privsep.sh
+++ b/regress/connect-privsep.sh
@@ -1,8 +1,9 @@
-#       $OpenBSD: connect-privsep.sh,v 1.1 2002/03/21 21:45:07 markus Exp $
+#       $OpenBSD: connect-privsep.sh,v 1.2 2011/06/30 22:44:43 markus Exp $
 #       Placed in the Public Domain.
 
 tid="proxy connect with privsep"
 
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
 echo 'UsePrivilegeSeparation yes' >> $OBJ/sshd_proxy
 
 for p in 1 2; do
@@ -11,3 +12,14 @@ for p in 1 2; do
                 fail "ssh privsep+proxyconnect protocol $p failed"
         fi
 done
+
+cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
+echo 'UsePrivilegeSeparation sandbox' >> $OBJ/sshd_proxy
+
+for p in 1 2; do
+        ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
+        if [ $? -ne 0 ]; then
+                # XXX replace this with fail once sandbox has stabilised
+                warn "ssh privsep/sandbox+proxyconnect protocol $p failed"
+        fi
+done
diff --git a/regress/dynamic-forward.sh b/regress/dynamic-forward.sh
index 4674a7baf..d1ab8059b 100644
--- a/regress/dynamic-forward.sh
+++ b/regress/dynamic-forward.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: dynamic-forward.sh,v 1.4 2004/06/22 22:55:56 dtucker Exp $
+#       $OpenBSD: dynamic-forward.sh,v 1.9 2011/06/03 00:29:52 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="dynamic forwarding"
@@ -20,9 +20,23 @@ trace "will use ProxyCommand $proxycmd"
 start_sshd
 
 for p in 1 2; do
+        n=0
+        error="1"
         trace "start dynamic forwarding, fork to background"
-        ${SSH} -$p -F $OBJ/ssh_config -f -D $FWDPORT -q somehost \
-                exec sh -c \'"echo \$\$ > $OBJ/remote_pid; exec sleep 444"\'
+        while [ "$error" -ne 0 -a "$n" -lt 3 ]; do
+                n=`expr $n + 1`
+                ${SSH} -$p -F $OBJ/ssh_config -f -D $FWDPORT -q \
+                    -oExitOnForwardFailure=yes somehost exec sh -c \
+                        \'"echo \$\$ > $OBJ/remote_pid; exec sleep 444"\'
+                error=$?
+                if [ "$error" -ne 0 ]; then
+                        trace "forward failed proto $p attempt $n err $error"
+                        sleep $n
+                fi
+        done
+        if [ "$error" -ne 0 ]; then
+                fatal "failed to start dynamic forwarding proto $p"
+        fi
 
         for s in 4 5; do
             for h in 127.0.0.1 localhost; do
@@ -44,7 +58,4 @@ for p in 1 2; do
         else
                 fail "no pid file: $OBJ/remote_pid"
         fi
-
-        # Must allow time for connection tear-down
-        sleep 2
 done
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 5c56aefff..092cfed5b 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -204,6 +204,11 @@ verbose ()
         fi
 }
 
+warn ()
+{
+        echo "WARNING: $@" >>$TEST_SSH_LOGFILE
+        echo "WARNING: $@"
+}
 
 fail ()
 {
diff --git a/regress/try-ciphers.sh b/regress/try-ciphers.sh
index ef776d2ee..0918d2245 100644
--- a/regress/try-ciphers.sh
+++ b/regress/try-ciphers.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: try-ciphers.sh,v 1.11 2007/06/07 19:41:46 pvalchev Exp $
+#       $OpenBSD: try-ciphers.sh,v 1.12 2011/08/02 01:23:41 djm Exp $
 #       Placed in the Public Domain.
 
 tid="try ciphers"
@@ -8,6 +8,8 @@ ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc
         aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se
         aes128-ctr aes192-ctr aes256-ctr"
 macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
+config_defined HAVE_EVP_SHA256 &&
+    macs="$macs hmac-sha2-256 hmac-sha2-256-96 hmac-sha2-512 hmac-sha2-512-96"
 
 for c in $ciphers; do
         for m in $macs; do