9 files changed, 68 insertions, 51 deletions

diff --git a/regress/addrmatch.sh b/regress/addrmatch.sh
index 23ddd65ce..1584bd405 100644
--- a/regress/addrmatch.sh
+++ b/regress/addrmatch.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: addrmatch.sh,v 1.3 2010/02/09 04:57:36 djm Exp $
+#       $OpenBSD: addrmatch.sh,v 1.4 2012/05/13 01:42:32 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="address match"
@@ -7,39 +7,50 @@ mv $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 
 run_trial()
 {
-        user="$1"; addr="$2"; host="$3"; expected="$4"; descr="$5"
+        user="$1"; addr="$2"; host="$3"; laddr="$4"; lport="$5"
+        expected="$6"; descr="$7"
 
         verbose "test $descr for $user $addr $host"
         result=`${SSHD} -f $OBJ/sshd_proxy -T \
-            -C user=${user},addr=${addr},host=${host} | \
-            awk '/^passwordauthentication/ {print $2}'`
+            -C user=${user},addr=${addr},host=${host},laddr=${laddr},lport=${lport} | \
+            awk '/^forcecommand/ {print $2}'`
         if [ "$result" != "$expected" ]; then
-                fail "failed for $user $addr $host: expected $expected, got $result"
+                fail "failed '$descr' expected $expected got $result"
         fi
 }
 
 cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
 cat >>$OBJ/sshd_proxy <<EOD
-PasswordAuthentication no
+ForceCommand nomatch
 Match Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com
-        PasswordAuthentication yes
+        ForceCommand match1
 Match Address 1.1.1.1,::1,!::3,2000::/16
-        PasswordAuthentication yes
+        ForceCommand match2
+Match LocalAddress 127.0.0.1,::1
+        ForceCommand match3
+Match LocalPort 5678
+        ForceCommand match4
 EOD
 
-run_trial user 192.168.0.1 somehost yes         "permit, first entry"
-run_trial user 192.168.30.1 somehost no         "deny, negative match"
-run_trial user 19.0.0.1 somehost no             "deny, no match"
-run_trial user 10.255.255.254 somehost yes      "permit, list middle"
-run_trial user 192.168.30.1 192.168.0.1 no      "deny, faked IP in hostname"
-run_trial user 1.1.1.1 somehost.example.com yes "permit, bare IP4 address"
-test "$TEST_SSH_IPV6" = "no" && exit
-run_trial user ::1 somehost.example.com  yes    "permit, bare IP6 address"
-run_trial user ::2 somehost.exaple.com no       "deny IPv6"
-run_trial user ::3 somehost no                  "deny IP6 negated"
-run_trial user ::4 somehost no                  "deny, IP6 no match"
-run_trial user 2000::1 somehost yes             "permit, IP6 network"
-run_trial user 2001::1 somehost no              "deny, IP6 network"
+run_trial user 192.168.0.1 somehost 1.2.3.4 1234 match1 "first entry"
+run_trial user 192.168.30.1 somehost 1.2.3.4 1234 nomatch "negative match"
+run_trial user 19.0.0.1 somehost 1.2.3.4 1234 nomatch "no match"
+run_trial user 10.255.255.254 somehost 1.2.3.4 1234 match1 "list middle"
+run_trial user 192.168.30.1 192.168.0.1 1.2.3.4 1234 nomatch "faked IP in hostname"
+run_trial user 1.1.1.1 somehost.example.com 1.2.3.4 1234 match2 "bare IP4 address"
+run_trial user 19.0.0.1 somehost 127.0.0.1 1234 match3 "localaddress"
+run_trial user 19.0.0.1 somehost 1.2.3.4 5678 match4 "localport"
+
+if test "$TEST_SSH_IPV6" != "no"; then
+run_trial user ::1 somehost.example.com ::2 1234 match2 "bare IP6 address"
+run_trial user ::2 somehost.exaple.com ::2 1234 nomatch "deny IPv6"
+run_trial user ::3 somehost ::2 1234 nomatch "IP6 negated"
+run_trial user ::4 somehost ::2 1234 nomatch "IP6 no match"
+run_trial user 2000::1 somehost ::2 1234 match2 "IP6 network"
+run_trial user 2001::1 somehost ::2 1234 nomatch "IP6 network"
+run_trial user ::5 somehost ::1 1234 match3 "IP6 localaddress"
+run_trial user ::5 somehost ::2 5678 match4 "IP6 localport"
+fi
 
 cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
 rm $OBJ/sshd_proxy_bak
diff --git a/regress/cipher-speed.sh b/regress/cipher-speed.sh
index 257afd179..5800f4b09 100644
--- a/regress/cipher-speed.sh
+++ b/regress/cipher-speed.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cipher-speed.sh,v 1.4 2011/08/02 01:23:41 djm Exp $
+#       $OpenBSD: cipher-speed.sh,v 1.5 2012/06/28 05:07:45 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="cipher speed"
@@ -18,7 +18,7 @@ ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc
         aes128-ctr aes192-ctr aes256-ctr"
 macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
 config_defined HAVE_EVP_SHA256 &&
-    macs="$macs hmac-sha2-256 hmac-sha2-256-96 hmac-sha2-512 hmac-sha2-512-96"
+    macs="$macs hmac-sha2-256 hmac-sha2-512"
 
 for c in $ciphers; do for m in $macs; do
         trace "proto 2 cipher $c mac $m"
diff --git a/regress/connect-privsep.sh b/regress/connect-privsep.sh
index 11fb9aef9..94cc64acf 100644
--- a/regress/connect-privsep.sh
+++ b/regress/connect-privsep.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: connect-privsep.sh,v 1.2 2011/06/30 22:44:43 markus Exp $
+#       $OpenBSD: connect-privsep.sh,v 1.4 2012/07/02 14:37:06 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="proxy connect with privsep"
@@ -23,3 +23,14 @@ for p in 1 2; do
                 warn "ssh privsep/sandbox+proxyconnect protocol $p failed"
         fi
 done
+
+# Because sandbox is sensitive to changes in libc, especially malloc, retest
+# with every malloc.conf option (and none).
+for m in '' A F G H J P R S X Z '<' '>'; do
+    for p in 1 2; do
+        env MALLOC_OPTIONS="$m" ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
+        if [ $? -ne 0 ]; then
+                fail "ssh privsep/sandbox+proxyconnect protocol $p mopt '$m' failed"
+        fi
+    done
+done
diff --git a/regress/forwarding.sh b/regress/forwarding.sh
index 6dec991a6..f9c367beb 100644
--- a/regress/forwarding.sh
+++ b/regress/forwarding.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: forwarding.sh,v 1.7 2010/01/11 02:53:44 dtucker Exp $
+#       $OpenBSD: forwarding.sh,v 1.8 2012/06/01 00:47:35 djm Exp $
 #       Placed in the Public Domain.
 
 tid="local and remote forwarding"
@@ -75,7 +75,7 @@ for p in 1 2; do
         else
                 # this one should fail
                 ${SSH} -$p -F $OBJ/ssh_config -p ${base}01 true \
-                     2>${TEST_SSH_LOGFILE} && \
+                     2>>$TEST_SSH_LOGFILE && \
                         fail "local forwarding not cleared"
         fi
         sleep 10
@@ -88,7 +88,7 @@ for p in 1 2; do
         else
                 # this one should fail
                 ${SSH} -$p -F $OBJ/ssh_config -p ${base}01 true \
-                     2>${TEST_SSH_LOGFILE} && \
+                     2>>$TEST_SSH_LOGFILE && \
                         fail "remote forwarding not cleared"
         fi
         sleep 10
diff --git a/regress/multiplex.sh b/regress/multiplex.sh
index b94cdf02f..93e15088f 100644
--- a/regress/multiplex.sh
+++ b/regress/multiplex.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: multiplex.sh,v 1.12 2009/05/05 07:51:36 dtucker Exp $
+#       $OpenBSD: multiplex.sh,v 1.13 2012/06/01 00:47:36 djm Exp $
 #       Placed in the Public Domain.
 
 CTL=/tmp/openssh.regress.ctl-sock.$$
@@ -12,7 +12,6 @@ fi
 
 DATA=/bin/ls${EXEEXT}
 COPY=$OBJ/ls.copy
-LOG=$TEST_SSH_LOGFILE
 
 start_sshd
 
@@ -48,13 +47,13 @@ cmp ${DATA} ${COPY}		|| fail "ssh -S ctl: corrupted copy of ${DATA}"
 rm -f ${COPY}
 trace "sftp transfer over multiplexed connection and check result"
 echo "get ${DATA} ${COPY}" | \
-        ${SFTP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost >$LOG 2>&1
+        ${SFTP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost >>$TEST_SSH_LOGFILE 2>&1
 test -f ${COPY}                 || fail "sftp: failed copy ${DATA}" 
 cmp ${DATA} ${COPY}             || fail "sftp: corrupted copy of ${DATA}"
 
 rm -f ${COPY}
 trace "scp transfer over multiplexed connection and check result"
-${SCP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost:${DATA} ${COPY} >$LOG 2>&1
+${SCP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost:${DATA} ${COPY} >>$TEST_SSH_LOGFILE 2>&1
 test -f ${COPY}                 || fail "scp: failed copy ${DATA}" 
 cmp ${DATA} ${COPY}             || fail "scp: corrupted copy of ${DATA}"
 
diff --git a/regress/reexec.sh b/regress/reexec.sh
index 6edfc318e..9464eb699 100644
--- a/regress/reexec.sh
+++ b/regress/reexec.sh
@@ -46,6 +46,9 @@ rm -f $PIDFILE
 
 cp $OBJ/sshd_config.orig $OBJ/sshd_config
 
+# cygwin can't fork a deleted binary
+if [ "$os" != "cygwin" ]; then
+
 verbose "test reexec fallback"
 
 start_sshd_copy
@@ -69,4 +72,4 @@ copy_tests
 $SUDO kill `$SUDO cat $PIDFILE`
 rm -f $PIDFILE
 
-
+fi
diff --git a/regress/sftp-cmds.sh b/regress/sftp-cmds.sh
index 1c67b6476..2e0300e16 100644
--- a/regress/sftp-cmds.sh
+++ b/regress/sftp-cmds.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: sftp-cmds.sh,v 1.11 2010/12/04 00:21:19 djm Exp $
+#       $OpenBSD: sftp-cmds.sh,v 1.12 2012/06/01 00:52:52 djm Exp $
 #       Placed in the Public Domain.
 
 # XXX - TODO: 
@@ -17,20 +17,6 @@ do
         fi
 done
 
-if have_prog uname
-then
-        case `uname` in
-        CYGWIN*)
-                os=cygwin
-                ;;
-        *)
-                os=`uname`
-                ;;
-        esac
-else
-        os="unknown"
-fi
-
 # Path with embedded quote
 QUOTECOPY=${COPY}".\"blah\""
 QUOTECOPY_ARG=${COPY}'.\"blah\"'
@@ -40,7 +26,7 @@ SPACECOPY_ARG="${COPY}\ this\ has\ spaces.txt"
 # File with glob metacharacters
 GLOBMETACOPY="${COPY} [metachar].txt"
 
-rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 ${BATCH}.*
+rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2
 mkdir ${COPY}.dd
 
 verbose "$tid: lls"
@@ -242,7 +228,7 @@ verbose "$tid: lchdir"
 echo "lchdir ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "lchdir failed"
 
-rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 ${BATCH}.*
+rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2
 rm -rf ${QUOTECOPY} "$SPACECOPY" "$GLOBMETACOPY"
 
 
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 092cfed5b..bdc2c1a49 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -12,6 +12,13 @@ OSF1*)
         BIN_SH=xpg4
         export BIN_SH
         ;;
+CYGWIN_NT-5.0)
+        os=cygwin
+        TEST_SSH_IPV6=no
+        ;;
+CYGWIN*)
+        os=cygwin
+        ;;
 esac
 
 if [ ! -z "$TEST_SSH_PORT" ]; then
diff --git a/regress/try-ciphers.sh b/regress/try-ciphers.sh
index 0918d2245..925863504 100644
--- a/regress/try-ciphers.sh
+++ b/regress/try-ciphers.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: try-ciphers.sh,v 1.12 2011/08/02 01:23:41 djm Exp $
+#       $OpenBSD: try-ciphers.sh,v 1.13 2012/06/28 05:07:45 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="try ciphers"
@@ -9,7 +9,7 @@ ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc
         aes128-ctr aes192-ctr aes256-ctr"
 macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
 config_defined HAVE_EVP_SHA256 &&
-    macs="$macs hmac-sha2-256 hmac-sha2-256-96 hmac-sha2-512 hmac-sha2-512-96"
+    macs="$macs hmac-sha2-256 hmac-sha2-512"
 
 for c in $ciphers; do
         for m in $macs; do