10 files changed, 132 insertions, 10 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index 1f74d7567..a3594adbc 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-b139635512b1af75e82252c0c71ac66e08b78774
-b139635512b1af75e82252c0c71ac66e08b78774
+9c88f6248e9da14cb7916527862f2eac7f55b12a
+9c88f6248e9da14cb7916527862f2eac7f55b12a
 a8ed8d256b2e2c05b0c15565a7938028c5192277
 a8ed8d256b2e2c05b0c15565a7938028c5192277
 openssh_7.3p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 34e51a7c6..2ba15c11f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,6 +8,7 @@ openssh (1:7.3p1-4) UNRELEASED; urgency=medium
     dgit-compatible.
   * Build all upstream regression test binaries using the new
     "regress-binaries" target.
+  * Fix and enable PuTTY interoperability tests under autopkgtest.
 
  -- Colin Watson <cjwatson@debian.org>  Fri, 11 Nov 2016 02:50:39 +0000
 
diff --git a/debian/patches/fix-putty-interop-tests.patch b/debian/patches/fix-putty-interop-tests.patch
new file mode 100644
index 000000000..c33c24acc
--- /dev/null
+++ b/debian/patches/fix-putty-interop-tests.patch
@@ -0,0 +1,113 @@
+From 9c88f6248e9da14cb7916527862f2eac7f55b12a Mon Sep 17 00:00:00 2001
+From: Colin Watson <cjwatson@debian.org>
+Date: Sat, 19 Nov 2016 16:02:49 +0000
+Subject: Fix PuTTY interop tests
+
+A while back I got a patch into PuTTY (although it hasn't yet made it
+into an upstream release) to add passphrase-file options to puttygen.
+Use these to make the PuTTY interop tests non-interactive.
+
+Fix up a few details of the saved session.
+
+When plink is given a saved session name, it expects that *instead* of
+the host name (or IP address), not in addition to it.  Drop "127.0.0.1"
+from the various plink test command lines.
+
+(It is possible that the last two of these represent compatibility
+breaks of some kind; but if they are, then that ship sailed sufficiently
+long ago - at least seven years, possibly more - that it's no longer
+worth worrying about it.  It's more useful to test interoperability with
+current versions.)
+
+Origin: https://bugzilla.mindrot.org/attachment.cgi?id=2891
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2639
+Last-Update: 2016-11-19
+
+Patch-Name: fix-putty-interop-tests.patch
+---
+ regress/putty-ciphers.sh  |  2 +-
+ regress/putty-kex.sh      |  3 +--
+ regress/putty-transfer.sh |  4 ++--
+ regress/test-exec.sh      | 10 ++++++++--
+ 4 files changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/regress/putty-ciphers.sh b/regress/putty-ciphers.sh
+index 724a98c..3775b1d 100644
+--- a/regress/putty-ciphers.sh
++++ b/regress/putty-ciphers.sh
+@@ -16,7 +16,7 @@ for c in aes blowfish 3des arcfour aes128-ctr aes192-ctr aes256-ctr ; do
+ 
+        rm -f ${COPY}
+        env HOME=$PWD ${PLINK} -load cipher_$c -batch -i putty.rsa2 \
+-           127.0.0.1 cat ${DATA} > ${COPY}
++           cat ${DATA} > ${COPY}
+        if [ $? -ne 0 ]; then
+                fail "ssh cat $DATA failed"
+        fi
+diff --git a/regress/putty-kex.sh b/regress/putty-kex.sh
+index 1844d65..6ae2290 100644
+--- a/regress/putty-kex.sh
++++ b/regress/putty-kex.sh
+@@ -14,8 +14,7 @@ for k in dh-gex-sha1 dh-group1-sha1 dh-group14-sha1 ; do
+            ${OBJ}/.putty/sessions/kex_$k
+        echo "KEX=$k" >> ${OBJ}/.putty/sessions/kex_$k
+ 
+-       env HOME=$PWD ${PLINK} -load kex_$k -batch -i putty.rsa2 \
+-           127.0.0.1 true
++       env HOME=$PWD ${PLINK} -load kex_$k -batch -i putty.rsa2 true
+        if [ $? -ne 0 ]; then
+                fail "KEX $k failed"
+        fi
+diff --git a/regress/putty-transfer.sh b/regress/putty-transfer.sh
+index aec0e04..cb1da94 100644
+--- a/regress/putty-transfer.sh
++++ b/regress/putty-transfer.sh
+@@ -17,7 +17,7 @@ for p in 2; do
+                    ${OBJ}/.putty/sessions/compression_$c
+                echo "Compression=$c" >> ${OBJ}/.putty/sessions/kex_$k
+                env HOME=$PWD ${PLINK} -load compression_$c -batch \
+-                   -i putty.rsa$p 127.0.0.1 cat ${DATA} > ${COPY}
++                   -i putty.rsa$p cat ${DATA} > ${COPY}
+                if [ $? -ne 0 ]; then
+                        fail "ssh cat $DATA failed"
+                fi
+@@ -28,7 +28,7 @@ for p in 2; do
+                        rm -f ${COPY}
+                        dd if=$DATA obs=${s} 2> /dev/null | \
+                                env HOME=$PWD ${PLINK} -load compression_$c \
+-                                   -batch -i putty.rsa$p 127.0.0.1 \
++                                   -batch -i putty.rsa$p \
+                                    "cat > ${COPY}"
+                        if [ $? -ne 0 ]; then
+                                fail "ssh cat $DATA failed"
+diff --git a/regress/test-exec.sh b/regress/test-exec.sh
+index 1b6526d..74b365c 100644
+--- a/regress/test-exec.sh
++++ b/regress/test-exec.sh
+@@ -513,7 +513,11 @@ if test "$REGRESS_INTEROP_PUTTY" = "yes" ; then
+ 
+        # Add a PuTTY key to authorized_keys
+        rm -f ${OBJ}/putty.rsa2
+-       puttygen -t rsa -o ${OBJ}/putty.rsa2 < /dev/null > /dev/null
++       if ! puttygen -t rsa -o ${OBJ}/putty.rsa2 \
++           --new-passphrase /dev/null < /dev/null > /dev/null; then
++               echo "Your installed version of PuTTY is too old to support --new-passphrase; trying without (may require manual interaction) ..." >&2
++               puttygen -t rsa -o ${OBJ}/putty.rsa2 < /dev/null > /dev/null
++       fi
+        puttygen -O public-openssh ${OBJ}/putty.rsa2 \
+            >> $OBJ/authorized_keys_$USER
+ 
+@@ -526,10 +530,12 @@ if test "$REGRESS_INTEROP_PUTTY" = "yes" ; then
+        # Setup proxied session
+        mkdir -p ${OBJ}/.putty/sessions
+        rm -f ${OBJ}/.putty/sessions/localhost_proxy
+-       echo "Hostname=127.0.0.1" >> ${OBJ}/.putty/sessions/localhost_proxy
++       echo "Protocol=ssh" >> ${OBJ}/.putty/sessions/localhost_proxy
++       echo "HostName=127.0.0.1" >> ${OBJ}/.putty/sessions/localhost_proxy
+        echo "PortNumber=$PORT" >> ${OBJ}/.putty/sessions/localhost_proxy
+        echo "ProxyMethod=5" >> ${OBJ}/.putty/sessions/localhost_proxy
+        echo "ProxyTelnetCommand=sh ${SRC}/sshd-log-wrapper.sh ${TEST_SSHD_LOGFILE} ${SSHD} -i -f $OBJ/sshd_proxy" >> ${OBJ}/.putty/sessions/localhost_proxy
++       echo "ProxyLocalhost=1" >> ${OBJ}/.putty/sessions/localhost_proxy
+ 
+        REGRESS_INTEROP_PUTTY=yes
+ fi
diff --git a/debian/patches/series b/debian/patches/series
index a968a036d..8dfd83f16 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -26,3 +26,4 @@ sigstop.patch
 systemd-readiness.patch
 debian-config.patch
 unregister-kexinit.patch
+fix-putty-interop-tests.patch
diff --git a/debian/tests/control b/debian/tests/control
index ab5122f46..5a54be563 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -1,3 +1,3 @@
 Tests: regress
 Restrictions: needs-root allow-stderr
-Depends: @builddeps@, openssh-client, openssh-server, openssh-sftp-server, sudo, python-twisted-conch (>= 1:15.5.0-1)
+Depends: @builddeps@, openssh-client, openssh-server, openssh-sftp-server, sudo, putty-tools (>= 0.67-2), python-twisted-conch (>= 1:15.5.0-1)
diff --git a/debian/tests/regress b/debian/tests/regress
index 4cd90175b..253541ad5 100644
--- a/debian/tests/regress
+++ b/debian/tests/regress
@@ -30,6 +30,8 @@ make -C regress \
         SUDO=sudo \
         TEST_SHELL=sh \
         TEST_SSH_SFTPSERVER=/usr/lib/openssh/sftp-server \
+        TEST_SSH_PLINK=plink \
+        TEST_SSH_PUTTYGEN=puttygen \
         TEST_SSH_CONCH=conch \
         TEST_SSH_IPV6=yes \
         TEST_SSH_ECC=yes \
diff --git a/regress/putty-ciphers.sh b/regress/putty-ciphers.sh
index 724a98cc1..3775b1d80 100644
--- a/regress/putty-ciphers.sh
+++ b/regress/putty-ciphers.sh
@@ -16,7 +16,7 @@ for c in aes blowfish 3des arcfour aes128-ctr aes192-ctr aes256-ctr ; do
 
         rm -f ${COPY}
         env HOME=$PWD ${PLINK} -load cipher_$c -batch -i putty.rsa2 \
-            127.0.0.1 cat ${DATA} > ${COPY}
+            cat ${DATA} > ${COPY}
         if [ $? -ne 0 ]; then
                 fail "ssh cat $DATA failed"
         fi
diff --git a/regress/putty-kex.sh b/regress/putty-kex.sh
index 1844d6599..6ae229005 100644
--- a/regress/putty-kex.sh
+++ b/regress/putty-kex.sh
@@ -14,8 +14,7 @@ for k in dh-gex-sha1 dh-group1-sha1 dh-group14-sha1 ; do
             ${OBJ}/.putty/sessions/kex_$k
         echo "KEX=$k" >> ${OBJ}/.putty/sessions/kex_$k
 
-        env HOME=$PWD ${PLINK} -load kex_$k -batch -i putty.rsa2 \
-            127.0.0.1 true
+        env HOME=$PWD ${PLINK} -load kex_$k -batch -i putty.rsa2 true
         if [ $? -ne 0 ]; then
                 fail "KEX $k failed"
         fi
diff --git a/regress/putty-transfer.sh b/regress/putty-transfer.sh
index aec0e04ee..cb1da94fa 100644
--- a/regress/putty-transfer.sh
+++ b/regress/putty-transfer.sh
@@ -17,7 +17,7 @@ for p in 2; do
                     ${OBJ}/.putty/sessions/compression_$c
                 echo "Compression=$c" >> ${OBJ}/.putty/sessions/kex_$k
                 env HOME=$PWD ${PLINK} -load compression_$c -batch \
-                    -i putty.rsa$p 127.0.0.1 cat ${DATA} > ${COPY}
+                    -i putty.rsa$p cat ${DATA} > ${COPY}
                 if [ $? -ne 0 ]; then
                         fail "ssh cat $DATA failed"
                 fi
@@ -28,7 +28,7 @@ for p in 2; do
                         rm -f ${COPY}
                         dd if=$DATA obs=${s} 2> /dev/null | \
                                 env HOME=$PWD ${PLINK} -load compression_$c \
-                                    -batch -i putty.rsa$p 127.0.0.1 \
+                                    -batch -i putty.rsa$p \
                                     "cat > ${COPY}"
                         if [ $? -ne 0 ]; then
                                 fail "ssh cat $DATA failed"
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 1b6526d0b..74b365cac 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -513,7 +513,11 @@ if test "$REGRESS_INTEROP_PUTTY" = "yes" ; then
 
         # Add a PuTTY key to authorized_keys
         rm -f ${OBJ}/putty.rsa2
-        puttygen -t rsa -o ${OBJ}/putty.rsa2 < /dev/null > /dev/null
+        if ! puttygen -t rsa -o ${OBJ}/putty.rsa2 \
+            --new-passphrase /dev/null < /dev/null > /dev/null; then
+                echo "Your installed version of PuTTY is too old to support --new-passphrase; trying without (may require manual interaction) ..." >&2
+                puttygen -t rsa -o ${OBJ}/putty.rsa2 < /dev/null > /dev/null
+        fi
         puttygen -O public-openssh ${OBJ}/putty.rsa2 \
             >> $OBJ/authorized_keys_$USER
 
@@ -526,10 +530,12 @@ if test "$REGRESS_INTEROP_PUTTY" = "yes" ; then
         # Setup proxied session
         mkdir -p ${OBJ}/.putty/sessions
         rm -f ${OBJ}/.putty/sessions/localhost_proxy
-        echo "Hostname=127.0.0.1" >> ${OBJ}/.putty/sessions/localhost_proxy
+        echo "Protocol=ssh" >> ${OBJ}/.putty/sessions/localhost_proxy
+        echo "HostName=127.0.0.1" >> ${OBJ}/.putty/sessions/localhost_proxy
         echo "PortNumber=$PORT" >> ${OBJ}/.putty/sessions/localhost_proxy
         echo "ProxyMethod=5" >> ${OBJ}/.putty/sessions/localhost_proxy
         echo "ProxyTelnetCommand=sh ${SRC}/sshd-log-wrapper.sh ${TEST_SSHD_LOGFILE} ${SSHD} -i -f $OBJ/sshd_proxy" >> ${OBJ}/.putty/sessions/localhost_proxy
+        echo "ProxyLocalhost=1" >> ${OBJ}/.putty/sessions/localhost_proxy
 
         REGRESS_INTEROP_PUTTY=yes
 fi