From 9e3ed9ebb1a7e47c155c28399ddf09b306ea05df Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Fri, 4 Sep 2015 04:23:10 +0000
Subject: upstream commit

trim junk from end of file; bz#2455 from Jakub Jelen

Upstream-Regress-ID: a4e64e8931e40d23874b047074444eff919cdfe6
---
 regress/hostkey-rotate.sh | 20 +-------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

(limited to 'regress')

diff --git a/regress/hostkey-rotate.sh b/regress/hostkey-rotate.sh
index 3aa8c40c0..d69de3255 100644
--- a/regress/hostkey-rotate.sh
+++ b/regress/hostkey-rotate.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: hostkey-rotate.sh,v 1.4 2015/07/10 06:23:25 markus Exp $
+#	$OpenBSD: hostkey-rotate.sh,v 1.5 2015/09/04 04:23:10 djm Exp $
 #	Placed in the Public Domain.
 
 tid="hostkey rotate"
@@ -108,21 +108,3 @@ verbose "check rotate primary hostkey"
 dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa
 expect_nkeys 1 "learn hostkeys"
 check_key_present ssh-rsa || fail "didn't learn changed key"
-
-#	$OpenBSD: hostkey-rotate.sh,v 1.4 2015/07/10 06:23:25 markus Exp $
-#	Placed in the Public Domain.
-
-tid="hostkey rotate"
-
-# Prepare hostkeys file with one key
-
-# Connect to sshd
-
-# Check that other keys learned
-
-# Change one hostkey (non primary)
-
-# Connect to sshd
-
-# Check that the key was replaced
-
-- 
cgit v1.2.3


From 9c06c814aff925e11a5cc592c06929c258a014f6 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Fri, 11 Sep 2015 03:44:21 +0000
Subject: upstream commit

try all supported key types here; bz#2455 reported by
 Jakub Jelen

Upstream-Regress-ID: 188cb7d9031cdbac3a0fa58b428b8fa2b2482bba
---
 regress/keyscan.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'regress')

diff --git a/regress/keyscan.sh b/regress/keyscan.sh
index 886f3295a..f97364b76 100644
--- a/regress/keyscan.sh
+++ b/regress/keyscan.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: keyscan.sh,v 1.4 2015/03/03 22:35:19 markus Exp $
+#	$OpenBSD: keyscan.sh,v 1.5 2015/09/11 03:44:21 djm Exp $
 #	Placed in the Public Domain.
 
 tid="keyscan"
@@ -8,7 +8,7 @@ rm -f ${OBJ}/host.dsa
 
 start_sshd
 
-KEYTYPES="rsa dsa"
+KEYTYPES=`${SSH} -Q key-plain`
 if ssh_version 1; then
 	KEYTYPES="${KEYTYPES} rsa1"
 fi
-- 
cgit v1.2.3


From 0097248f90a00865082e8c146b905a6555cc146f Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Fri, 11 Sep 2015 04:55:01 +0000
Subject: upstream commit

skip if running as root; many systems (inc OpenBSD) allow
 root to ptrace arbitrary processes

Upstream-Regress-ID: be2b925df89360dff36f972951fa0fa793769038
---
 regress/agent-ptrace.sh | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'regress')

diff --git a/regress/agent-ptrace.sh b/regress/agent-ptrace.sh
index 1912ca8f9..bb676d631 100644
--- a/regress/agent-ptrace.sh
+++ b/regress/agent-ptrace.sh
@@ -12,6 +12,11 @@ if have_prog uname ; then
 	esac
 fi
 
+if [ "x$USER" = "xroot" ]; then
+	echo "Skipped: running as root"
+	exit 0
+fi
+
 if have_prog gdb ; then
 	: ok
 else
-- 
cgit v1.2.3


From e14ac43b75e68f1ffbd3e1a5e44143c8ae578dcd Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Thu, 24 Sep 2015 06:16:53 +0000
Subject: upstream commit

regress test for CertificateFile; patch from Meghana Bhat
 via bz#2436

Upstream-Regress-ID: e7a6e980cbe0f8081ba2e83de40d06c17be8bd25
---
 regress/Makefile         |   5 +-
 regress/cert-file.sh     | 136 +++++++++++++++++++++++++++++++++++++++++++++++
 regress/limit-keytype.sh |  19 ++++---
 3 files changed, 148 insertions(+), 12 deletions(-)
 create mode 100644 regress/cert-file.sh

(limited to 'regress')

diff --git a/regress/Makefile b/regress/Makefile
index cba83f4d6..451909c1a 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.81 2015/05/21 06:44:25 djm Exp $
+#	$OpenBSD: Makefile,v 1.82 2015/09/24 06:16:53 djm Exp $
 
 REGRESS_TARGETS=	unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t-exec
 tests:		prep $(REGRESS_TARGETS)
@@ -74,7 +74,8 @@ LTESTS= 	connect \
 		hostkey-agent \
 		keygen-knownhosts \
 		hostkey-rotate \
-		principals-command
+		principals-command \
+		cert-file
 
 
 #		dhgex \
diff --git a/regress/cert-file.sh b/regress/cert-file.sh
new file mode 100644
index 000000000..f172cfd11
--- /dev/null
+++ b/regress/cert-file.sh
@@ -0,0 +1,136 @@
+#	$OpenBSD: cert-file.sh,v 1.1 2015/09/24 06:16:53 djm Exp $
+#	Placed in the Public Domain.
+
+tid="ssh with certificates"
+
+rm -f $OBJ/user_ca_key* $OBJ/user_key*
+rm -f $OBJ/cert_user_key*
+
+# Create a CA key
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key1 ||\
+	fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t ed25519  -f $OBJ/user_ca_key2 ||\
+	fatal "ssh-keygen failed"
+
+# Make some keys and certificates.
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key1 || \
+	fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key2 || \
+	fatal "ssh-keygen failed"
+# Move the certificate to a different address to better control
+# when it is offered.
+${SSHKEYGEN} -q -s $OBJ/user_ca_key1 -I "regress user key for $USER" \
+	-z $$ -n ${USER} $OBJ/user_key1 ||
+		fail "couldn't sign user_key1 with user_ca_key1"
+mv $OBJ/user_key1-cert.pub $OBJ/cert_user_key1_1.pub
+${SSHKEYGEN} -q -s $OBJ/user_ca_key2 -I "regress user key for $USER" \
+	-z $$ -n ${USER} $OBJ/user_key1 ||
+		fail "couldn't sign user_key1 with user_ca_key2"
+mv $OBJ/user_key1-cert.pub $OBJ/cert_user_key1_2.pub
+
+trace 'try with identity files'
+opts="-F $OBJ/ssh_proxy -oIdentitiesOnly=yes"
+opts2="$opts -i $OBJ/user_key1 -i $OBJ/user_key2"
+echo "cert-authority $(cat $OBJ/user_ca_key1.pub)" > $OBJ/authorized_keys_$USER
+
+for p in ${SSH_PROTOCOLS}; do
+	# Just keys should fail
+	${SSH} $opts2 somehost exit 5$p
+	r=$?
+	if [ $r -eq 5$p ]; then
+		fail "ssh succeeded with no certs in protocol $p"
+	fi
+
+	# Keys with untrusted cert should fail.
+	opts3="$opts2 -z $OBJ/cert_user_key1_2.pub"
+	${SSH} $opts3 somehost exit 5$p
+	r=$?
+	if [ $r -eq 5$p ]; then
+		fail "ssh succeeded with bad cert in protocol $p"
+	fi
+
+	# Good cert with bad key should fail.
+	opts3="$opts -i $OBJ/user_key2 -z $OBJ/cert_user_key1_1.pub"
+	${SSH} $opts3 somehost exit 5$p
+	r=$?
+	if [ $r -eq 5$p ]; then
+		fail "ssh succeeded with no matching key in protocol $p"
+	fi
+
+	# Keys with one trusted cert, should succeed.
+	opts3="$opts2 -z $OBJ/cert_user_key1_1.pub"
+	${SSH} $opts3 somehost exit 5$p
+	r=$?
+	if [ $r -ne 5$p ]; then
+		fail "ssh failed with trusted cert and key in protocol $p"
+	fi
+
+	# Multiple certs and keys, with one trusted cert, should succeed.
+	opts3="$opts2 -z $OBJ/cert_user_key1_2.pub -z $OBJ/cert_user_key1_1.pub"
+	${SSH} $opts3 somehost exit 5$p
+	r=$?
+	if [ $r -ne 5$p ]; then
+		fail "ssh failed with multiple certs in protocol $p"
+	fi
+
+	#Keys with trusted certificate specified in config options, should succeed.
+	opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
+	${SSH} $opts3 somehost exit 5$p
+	r=$?
+	if [ $r -ne 5$p ]; then
+		fail "ssh failed with trusted cert in config in protocol $p"
+	fi
+done
+
+#next, using an agent in combination with the keys
+SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1
+if [ $? -ne 2 ]; then
+	fatal "ssh-add -l did not fail with exit code 2"
+fi
+
+trace "start agent"
+eval `${SSHAGENT} -s` > /dev/null
+r=$?
+if [ $r -ne 0 ]; then
+	fatal "could not start ssh-agent: exit code $r"
+fi
+
+# add private keys to agent
+${SSHADD} -k $OBJ/user_key2 > /dev/null 2>&1
+if [ $? -ne 0 ]; then
+	fatal "ssh-add did not succeed with exit code 0"
+fi
+${SSHADD} -k $OBJ/user_key1 > /dev/null 2>&1
+if [ $? -ne 0 ]; then
+	fatal "ssh-add did not succeed with exit code 0"
+fi
+
+# try ssh with the agent and certificates
+# note: ssh agent only uses certificates in protocol 2
+opts="-F $OBJ/ssh_proxy"
+# with no certificates, shoud fail
+${SSH} -2 $opts somehost exit 52
+if [ $? -eq 52 ]; then
+	fail "ssh connect with agent in protocol 2 succeeded with no cert"
+fi
+
+#with an untrusted certificate, should fail
+opts="$opts -z $OBJ/cert_user_key1_2.pub"
+${SSH} -2 $opts somehost exit 52
+if [ $? -eq 52 ]; then
+	fail "ssh connect with agent in protocol 2 succeeded with bad cert"
+fi
+
+#with an additional trusted certificate, should succeed
+opts="$opts -z $OBJ/cert_user_key1_1.pub"
+${SSH} -2 $opts somehost exit 52
+if [ $? -ne 52 ]; then
+	fail "ssh connect with agent in protocol 2 failed with good cert"
+fi
+
+trace "kill agent"
+${SSHAGENT} -k > /dev/null
+
+#cleanup
+rm -f $OBJ/user_ca_key* $OBJ/user_key*
+rm -f $OBJ/cert_user_key*
diff --git a/regress/limit-keytype.sh b/regress/limit-keytype.sh
index 2de037bd1..aaf2d2d44 100644
--- a/regress/limit-keytype.sh
+++ b/regress/limit-keytype.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: limit-keytype.sh,v 1.1 2015/01/13 07:49:49 djm Exp $
+#	$OpenBSD: limit-keytype.sh,v 1.2 2015/09/24 06:16:53 djm Exp $
 #	Placed in the Public Domain.
 
 tid="restrict pubkey type"
@@ -26,12 +26,11 @@ ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
 # Copy the private key alongside the cert to allow better control of when
 # it is offered.
 mv $OBJ/user_key3-cert.pub $OBJ/cert_user_key3.pub
-cp -p $OBJ/user_key3 $OBJ/cert_user_key3
 
 grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy
 
 opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes"
-fullopts="$opts -i $OBJ/cert_user_key3 -i $OBJ/user_key1 -i $OBJ/user_key2"
+certopts="$opts -i $OBJ/user_key3 -oCertificateFile=$OBJ/cert_user_key3.pub"
 
 echo mekmitasdigoat > $OBJ/authorized_principals_$USER
 cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER
@@ -53,28 +52,28 @@ prepare_config() {
 prepare_config
 
 # Check we can log in with all key types.
-${SSH} $opts -i $OBJ/cert_user_key3 proxy true || fatal "cert failed"
+${SSH} $certopts proxy true || fatal "cert failed"
 ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
 ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
 
 # Allow plain Ed25519 and RSA. The certificate should fail.
-verbose "privsep=$privsep allow rsa,ed25519"
+verbose "allow rsa,ed25519"
 prepare_config "PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519"
-${SSH} $opts -i $OBJ/cert_user_key3 proxy true && fatal "cert succeeded"
+${SSH} $certopt proxy true && fatal "cert succeeded"
 ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
 ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
 
 # Allow Ed25519 only.
-verbose "privsep=$privsep allow ed25519"
+verbose "allow ed25519"
 prepare_config "PubkeyAcceptedKeyTypes ssh-ed25519"
-${SSH} $opts -i $OBJ/cert_user_key3 proxy true && fatal "cert succeeded"
+${SSH} $certopts proxy true && fatal "cert succeeded"
 ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
 ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded"
 
 # Allow all certs. Plain keys should fail.
-verbose "privsep=$privsep allow cert only"
+verbose "allow cert only"
 prepare_config "PubkeyAcceptedKeyTypes ssh-*-cert-v01@openssh.com"
-${SSH} $opts -i $OBJ/cert_user_key3 proxy true || fatal "cert failed"
+${SSH} $certopts proxy true || fatal "cert failed"
 ${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded"
 ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded"
 
-- 
cgit v1.2.3


From 21ae8ee3b630b0925f973db647a1b9aa5fcdd4c5 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Thu, 24 Sep 2015 07:15:39 +0000
Subject: upstream commit

fix command-line option to match what was actually
 committed

Upstream-Regress-ID: 3e8c24a2044e8afd37e7ce17b69002ca817ac699
---
 regress/cert-file.sh | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

(limited to 'regress')

diff --git a/regress/cert-file.sh b/regress/cert-file.sh
index f172cfd11..bad923ad0 100644
--- a/regress/cert-file.sh
+++ b/regress/cert-file.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: cert-file.sh,v 1.1 2015/09/24 06:16:53 djm Exp $
+#	$OpenBSD: cert-file.sh,v 1.2 2015/09/24 07:15:39 djm Exp $
 #	Placed in the Public Domain.
 
 tid="ssh with certificates"
@@ -42,7 +42,7 @@ for p in ${SSH_PROTOCOLS}; do
 	fi
 
 	# Keys with untrusted cert should fail.
-	opts3="$opts2 -z $OBJ/cert_user_key1_2.pub"
+	opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
 	${SSH} $opts3 somehost exit 5$p
 	r=$?
 	if [ $r -eq 5$p ]; then
@@ -50,7 +50,8 @@ for p in ${SSH_PROTOCOLS}; do
 	fi
 
 	# Good cert with bad key should fail.
-	opts3="$opts -i $OBJ/user_key2 -z $OBJ/cert_user_key1_1.pub"
+	opts3="$opts -i $OBJ/user_key2"
+	opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
 	${SSH} $opts3 somehost exit 5$p
 	r=$?
 	if [ $r -eq 5$p ]; then
@@ -58,7 +59,7 @@ for p in ${SSH_PROTOCOLS}; do
 	fi
 
 	# Keys with one trusted cert, should succeed.
-	opts3="$opts2 -z $OBJ/cert_user_key1_1.pub"
+	opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
 	${SSH} $opts3 somehost exit 5$p
 	r=$?
 	if [ $r -ne 5$p ]; then
@@ -66,7 +67,8 @@ for p in ${SSH_PROTOCOLS}; do
 	fi
 
 	# Multiple certs and keys, with one trusted cert, should succeed.
-	opts3="$opts2 -z $OBJ/cert_user_key1_2.pub -z $OBJ/cert_user_key1_1.pub"
+	opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
+	opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
 	${SSH} $opts3 somehost exit 5$p
 	r=$?
 	if [ $r -ne 5$p ]; then
@@ -115,14 +117,14 @@ if [ $? -eq 52 ]; then
 fi
 
 #with an untrusted certificate, should fail
-opts="$opts -z $OBJ/cert_user_key1_2.pub"
+opts="$opts -oCertificateFile=$OBJ/cert_user_key1_2.pub"
 ${SSH} -2 $opts somehost exit 52
 if [ $? -eq 52 ]; then
 	fail "ssh connect with agent in protocol 2 succeeded with bad cert"
 fi
 
 #with an additional trusted certificate, should succeed
-opts="$opts -z $OBJ/cert_user_key1_1.pub"
+opts="$opts -oCertificateFile=$OBJ/cert_user_key1_1.pub"
 ${SSH} -2 $opts somehost exit 52
 if [ $? -ne 52 ]; then
 	fail "ssh connect with agent in protocol 2 failed with good cert"
-- 
cgit v1.2.3


From fdd020e86439afa7f537e2429d29d4b744c94331 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Tue, 6 Oct 2015 01:20:59 +0000
Subject: upstream commit

adapt to recent sshkey_parse_private_fileblob() API
 change

Upstream-Regress-ID: 5c0d818da511e33e0abf6a92a31bd7163b7ad988
---
 regress/unittests/sshkey/test_file.c   | 42 ++++++++-----------
 regress/unittests/sshkey/test_fuzz.c   | 74 ++++++++++++----------------------
 regress/unittests/sshkey/test_sshkey.c |  4 +-
 3 files changed, 44 insertions(+), 76 deletions(-)

(limited to 'regress')

diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c
index c8a236937..906491f2b 100644
--- a/regress/unittests/sshkey/test_file.c
+++ b/regress/unittests/sshkey/test_file.c
@@ -1,4 +1,4 @@
-/* 	$OpenBSD: test_file.c,v 1.4 2015/07/07 14:53:30 markus Exp $ */
+/* 	$OpenBSD: test_file.c,v 1.5 2015/10/06 01:20:59 djm Exp $ */
 /*
  * Regress test for sshkey.h key management API
  *
@@ -54,8 +54,7 @@ sshkey_file_tests(void)
 #ifdef WITH_SSH1
 	TEST_START("parse RSA1 from private");
 	buf = load_file("rsa1_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "rsa1_1",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k1, NULL);
 	a = load_bignum("rsa1_1.param.n");
@@ -66,7 +65,7 @@ sshkey_file_tests(void)
 	TEST_START("parse RSA1 from private w/ passphrase");
 	buf = load_file("rsa1_1_pw");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    (const char *)sshbuf_ptr(pw), "rsa1_1_pw", &k2, NULL), 0);
+	    (const char *)sshbuf_ptr(pw), &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
@@ -104,8 +103,7 @@ sshkey_file_tests(void)
 
 	TEST_START("parse RSA from private");
 	buf = load_file("rsa_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "rsa_1",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k1, NULL);
 	a = load_bignum("rsa_1.param.n");
@@ -122,7 +120,7 @@ sshkey_file_tests(void)
 	TEST_START("parse RSA from private w/ passphrase");
 	buf = load_file("rsa_1_pw");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    (const char *)sshbuf_ptr(pw), "rsa_1_pw", &k2, NULL), 0);
+	    (const char *)sshbuf_ptr(pw), &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
@@ -131,8 +129,7 @@ sshkey_file_tests(void)
 
 	TEST_START("parse RSA from new-format");
 	buf = load_file("rsa_n");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    "", "rsa_n", &k2, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
@@ -142,7 +139,7 @@ sshkey_file_tests(void)
 	TEST_START("parse RSA from new-format w/ passphrase");
 	buf = load_file("rsa_n_pw");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    (const char *)sshbuf_ptr(pw), "rsa_n_pw", &k2, NULL), 0);
+	    (const char *)sshbuf_ptr(pw), &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
@@ -197,8 +194,7 @@ sshkey_file_tests(void)
 
 	TEST_START("parse DSA from private");
 	buf = load_file("dsa_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "dsa_1",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k1, NULL);
 	a = load_bignum("dsa_1.param.g");
@@ -215,7 +211,7 @@ sshkey_file_tests(void)
 	TEST_START("parse DSA from private w/ passphrase");
 	buf = load_file("dsa_1_pw");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    (const char *)sshbuf_ptr(pw), "dsa_1_pw", &k2, NULL), 0);
+	    (const char *)sshbuf_ptr(pw), &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
@@ -224,8 +220,7 @@ sshkey_file_tests(void)
 
 	TEST_START("parse DSA from new-format");
 	buf = load_file("dsa_n");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    "", "dsa_n", &k2, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
@@ -235,7 +230,7 @@ sshkey_file_tests(void)
 	TEST_START("parse DSA from new-format w/ passphrase");
 	buf = load_file("dsa_n_pw");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    (const char *)sshbuf_ptr(pw), "dsa_n_pw", &k2, NULL), 0);
+	    (const char *)sshbuf_ptr(pw), &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
@@ -291,8 +286,7 @@ sshkey_file_tests(void)
 #ifdef OPENSSL_HAS_ECC
 	TEST_START("parse ECDSA from private");
 	buf = load_file("ecdsa_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "ecdsa_1",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k1, NULL);
 	buf = load_text_file("ecdsa_1.param.curve");
@@ -315,7 +309,7 @@ sshkey_file_tests(void)
 	TEST_START("parse ECDSA from private w/ passphrase");
 	buf = load_file("ecdsa_1_pw");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    (const char *)sshbuf_ptr(pw), "ecdsa_1_pw", &k2, NULL), 0);
+	    (const char *)sshbuf_ptr(pw), &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
@@ -324,8 +318,7 @@ sshkey_file_tests(void)
 
 	TEST_START("parse ECDSA from new-format");
 	buf = load_file("ecdsa_n");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    "", "ecdsa_n", &k2, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
@@ -335,7 +328,7 @@ sshkey_file_tests(void)
 	TEST_START("parse ECDSA from new-format w/ passphrase");
 	buf = load_file("ecdsa_n_pw");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    (const char *)sshbuf_ptr(pw), "ecdsa_n_pw", &k2, NULL), 0);
+	    (const char *)sshbuf_ptr(pw), &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
@@ -391,8 +384,7 @@ sshkey_file_tests(void)
 
 	TEST_START("parse Ed25519 from private");
 	buf = load_file("ed25519_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "ed25519_1",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k1, NULL);
 	ASSERT_INT_EQ(k1->type, KEY_ED25519);
@@ -402,7 +394,7 @@ sshkey_file_tests(void)
 	TEST_START("parse Ed25519 from private w/ passphrase");
 	buf = load_file("ed25519_1_pw");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf,
-	    (const char *)sshbuf_ptr(pw), "ed25519_1_pw", &k2, NULL), 0);
+	    (const char *)sshbuf_ptr(pw), &k2, NULL), 0);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(k2, NULL);
 	ASSERT_INT_EQ(sshkey_equal(k1, k2), 1);
diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c
index 1f08a2e43..cb7924de1 100644
--- a/regress/unittests/sshkey/test_fuzz.c
+++ b/regress/unittests/sshkey/test_fuzz.c
@@ -1,4 +1,4 @@
-/* 	$OpenBSD: test_fuzz.c,v 1.4 2015/03/04 23:22:35 djm Exp $ */
+/* 	$OpenBSD: test_fuzz.c,v 1.5 2015/10/06 01:20:59 djm Exp $ */
 /*
  * Fuzz tests for key parsing
  *
@@ -110,8 +110,7 @@ sshkey_fuzz_tests(void)
 	fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | FUZZ_1_BYTE_FLIP |
 	    FUZZ_TRUNCATE_START | FUZZ_TRUNCATE_END,
 	    sshbuf_mutable_ptr(buf), sshbuf_len(buf));
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshkey_free(k1);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
@@ -119,8 +118,7 @@ sshkey_fuzz_tests(void)
 	for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
 		r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
 		ASSERT_INT_EQ(r, 0);
-		if (sshkey_parse_private_fileblob(fuzzed, "", "key",
-		    &k1, NULL) == 0)
+		if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
 			sshkey_free(k1);
 		sshbuf_reset(fuzzed);
 	}
@@ -154,8 +152,7 @@ sshkey_fuzz_tests(void)
 	buf = load_file("rsa_1");
 	fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
 	    sshbuf_len(buf));
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshkey_free(k1);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
@@ -163,8 +160,7 @@ sshkey_fuzz_tests(void)
 	for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
 		r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
 		ASSERT_INT_EQ(r, 0);
-		if (sshkey_parse_private_fileblob(fuzzed, "", "key",
-		    &k1, NULL) == 0)
+		if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
 			sshkey_free(k1);
 		sshbuf_reset(fuzzed);
 	}
@@ -176,8 +172,7 @@ sshkey_fuzz_tests(void)
 	buf = load_file("rsa_n");
 	fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
 	    sshbuf_len(buf));
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshkey_free(k1);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
@@ -185,8 +180,7 @@ sshkey_fuzz_tests(void)
 	for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
 		r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
 		ASSERT_INT_EQ(r, 0);
-		if (sshkey_parse_private_fileblob(fuzzed, "", "key",
-		    &k1, NULL) == 0)
+		if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
 			sshkey_free(k1);
 		sshbuf_reset(fuzzed);
 	}
@@ -198,8 +192,7 @@ sshkey_fuzz_tests(void)
 	buf = load_file("dsa_1");
 	fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
 	    sshbuf_len(buf));
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshkey_free(k1);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
@@ -207,8 +200,7 @@ sshkey_fuzz_tests(void)
 	for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
 		r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
 		ASSERT_INT_EQ(r, 0);
-		if (sshkey_parse_private_fileblob(fuzzed, "", "key",
-		    &k1, NULL) == 0)
+		if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
 			sshkey_free(k1);
 		sshbuf_reset(fuzzed);
 	}
@@ -220,8 +212,7 @@ sshkey_fuzz_tests(void)
 	buf = load_file("dsa_n");
 	fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
 	    sshbuf_len(buf));
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshkey_free(k1);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
@@ -229,8 +220,7 @@ sshkey_fuzz_tests(void)
 	for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
 		r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
 		ASSERT_INT_EQ(r, 0);
-		if (sshkey_parse_private_fileblob(fuzzed, "", "key",
-		    &k1, NULL) == 0)
+		if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
 			sshkey_free(k1);
 		sshbuf_reset(fuzzed);
 	}
@@ -243,8 +233,7 @@ sshkey_fuzz_tests(void)
 	buf = load_file("ecdsa_1");
 	fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
 	    sshbuf_len(buf));
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshkey_free(k1);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
@@ -252,8 +241,7 @@ sshkey_fuzz_tests(void)
 	for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
 		r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
 		ASSERT_INT_EQ(r, 0);
-		if (sshkey_parse_private_fileblob(fuzzed, "", "key",
-		    &k1, NULL) == 0)
+		if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
 			sshkey_free(k1);
 		sshbuf_reset(fuzzed);
 	}
@@ -265,8 +253,7 @@ sshkey_fuzz_tests(void)
 	buf = load_file("ecdsa_n");
 	fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
 	    sshbuf_len(buf));
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshkey_free(k1);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
@@ -274,8 +261,7 @@ sshkey_fuzz_tests(void)
 	for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
 		r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
 		ASSERT_INT_EQ(r, 0);
-		if (sshkey_parse_private_fileblob(fuzzed, "", "key",
-		    &k1, NULL) == 0)
+		if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
 			sshkey_free(k1);
 		sshbuf_reset(fuzzed);
 	}
@@ -288,8 +274,7 @@ sshkey_fuzz_tests(void)
 	buf = load_file("ed25519_1");
 	fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
 	    sshbuf_len(buf));
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshkey_free(k1);
 	sshbuf_free(buf);
 	ASSERT_PTR_NE(fuzzed = sshbuf_new(), NULL);
@@ -297,8 +282,7 @@ sshkey_fuzz_tests(void)
 	for(; !fuzz_done(fuzz); fuzz_next(fuzz)) {
 		r = sshbuf_put(fuzzed, fuzz_ptr(fuzz), fuzz_len(fuzz));
 		ASSERT_INT_EQ(r, 0);
-		if (sshkey_parse_private_fileblob(fuzzed, "", "key",
-		    &k1, NULL) == 0)
+		if (sshkey_parse_private_fileblob(fuzzed, "", &k1, NULL) == 0)
 			sshkey_free(k1);
 		sshbuf_reset(fuzzed);
 	}
@@ -308,8 +292,7 @@ sshkey_fuzz_tests(void)
 
 	TEST_START("fuzz RSA public");
 	buf = load_file("rsa_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	public_fuzz(k1);
 	sshkey_free(k1);
@@ -323,8 +306,7 @@ sshkey_fuzz_tests(void)
 
 	TEST_START("fuzz DSA public");
 	buf = load_file("dsa_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	public_fuzz(k1);
 	sshkey_free(k1);
@@ -339,8 +321,7 @@ sshkey_fuzz_tests(void)
 #ifdef OPENSSL_HAS_ECC
 	TEST_START("fuzz ECDSA public");
 	buf = load_file("ecdsa_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	public_fuzz(k1);
 	sshkey_free(k1);
@@ -355,8 +336,7 @@ sshkey_fuzz_tests(void)
 
 	TEST_START("fuzz Ed25519 public");
 	buf = load_file("ed25519_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	public_fuzz(k1);
 	sshkey_free(k1);
@@ -370,8 +350,7 @@ sshkey_fuzz_tests(void)
 
 	TEST_START("fuzz RSA sig");
 	buf = load_file("rsa_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	sig_fuzz(k1);
 	sshkey_free(k1);
@@ -379,8 +358,7 @@ sshkey_fuzz_tests(void)
 
 	TEST_START("fuzz DSA sig");
 	buf = load_file("dsa_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	sig_fuzz(k1);
 	sshkey_free(k1);
@@ -389,8 +367,7 @@ sshkey_fuzz_tests(void)
 #ifdef OPENSSL_HAS_ECC
 	TEST_START("fuzz ECDSA sig");
 	buf = load_file("ecdsa_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	sig_fuzz(k1);
 	sshkey_free(k1);
@@ -399,8 +376,7 @@ sshkey_fuzz_tests(void)
 
 	TEST_START("fuzz Ed25519 sig");
 	buf = load_file("ed25519_1");
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", "key",
-	    &k1, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
 	sig_fuzz(k1);
 	sshkey_free(k1);
diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
index 9b3ce7ee4..442e67344 100644
--- a/regress/unittests/sshkey/test_sshkey.c
+++ b/regress/unittests/sshkey/test_sshkey.c
@@ -1,4 +1,4 @@
-/* 	$OpenBSD: test_sshkey.c,v 1.7 2015/08/05 05:27:33 djm Exp $ */
+/* 	$OpenBSD: test_sshkey.c,v 1.8 2015/10/06 01:20:59 djm Exp $ */
 /*
  * Regress test for sshkey.h key management API
  *
@@ -166,7 +166,7 @@ get_private(const char *n)
 	struct sshkey *ret;
 
 	b = load_file(n);
-	ASSERT_INT_EQ(sshkey_parse_private_fileblob(b, "", n, &ret, NULL), 0);
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(b, "", &ret, NULL), 0);
 	sshbuf_free(b);
 	return ret;
 }
-- 
cgit v1.2.3


From 86c10dbbef6a5800d2431a66cf7f41a954bb62b5 Mon Sep 17 00:00:00 2001
From: "dtucker@openbsd.org" <dtucker@openbsd.org>
Date: Fri, 23 Oct 2015 02:22:01 +0000
Subject: upstream commit

Update expected group sizes to match recent code changes.

Upstream-Regress-ID: 0004f0ea93428969fe75bcfff0d521c553977794
---
 regress/dhgex.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'regress')

diff --git a/regress/dhgex.sh b/regress/dhgex.sh
index 57fca4a32..e7c573397 100644
--- a/regress/dhgex.sh
+++ b/regress/dhgex.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: dhgex.sh,v 1.2 2014/04/21 22:15:37 djm Exp $
+#	$OpenBSD: dhgex.sh,v 1.3 2015/10/23 02:22:01 dtucker Exp $
 #	Placed in the Public Domain.
 
 tid="dhgex"
@@ -20,7 +20,9 @@ ssh_test_dhgex()
 	echo "Ciphers=$cipher" >> $OBJ/sshd_proxy
 	rm -f ${LOG}
 	opts="-oKexAlgorithms=$kex -oCiphers=$cipher"
-	groupsz="1024<$bits<8192"
+	min=2048
+	max=8192
+	groupsz="$min<$bits<$max"
 	verbose "$tid bits $bits $kex $cipher"
 	${SSH} ${opts} $@ -vvv -F ${OBJ}/ssh_proxy somehost true
 	if [ $? -ne 0 ]; then
-- 
cgit v1.2.3


From abd9dbc3c0d8c8c7561347cfa22166156e78c077 Mon Sep 17 00:00:00 2001
From: "dtucker@openbsd.org" <dtucker@openbsd.org>
Date: Mon, 26 Oct 2015 02:50:58 +0000
Subject: upstream commit

Fix typo certopt->certopts in shell variable.  This would
 cause the test to hang at a host key prompt if you have an A or CNAME for
 "proxy" in your local domain.

Upstream-Regress-ID: 6ea03bcd39443a83c89e2c5606392ceb9585836a
---
 regress/limit-keytype.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'regress')

diff --git a/regress/limit-keytype.sh b/regress/limit-keytype.sh
index aaf2d2d44..71781b26e 100644
--- a/regress/limit-keytype.sh
+++ b/regress/limit-keytype.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: limit-keytype.sh,v 1.2 2015/09/24 06:16:53 djm Exp $
+#	$OpenBSD: limit-keytype.sh,v 1.3 2015/10/26 02:50:58 dtucker Exp $
 #	Placed in the Public Domain.
 
 tid="restrict pubkey type"
@@ -59,7 +59,7 @@ ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
 # Allow plain Ed25519 and RSA. The certificate should fail.
 verbose "allow rsa,ed25519"
 prepare_config "PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519"
-${SSH} $certopt proxy true && fatal "cert succeeded"
+${SSH} $certopts proxy true && fatal "cert succeeded"
 ${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
 ${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
 
-- 
cgit v1.2.3


From b67e2e76fcf1ae7c802eb27ca927e16c91a513ff Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Thu, 29 Oct 2015 08:05:17 +0000
Subject: upstream commit

regress test for "PubkeyAcceptedKeyTypes +..." inside a
 Match block

Upstream-Regress-ID: 246c37ed64a2e5704d4c158ccdca1ff700e10647
---
 regress/limit-keytype.sh | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

(limited to 'regress')

diff --git a/regress/limit-keytype.sh b/regress/limit-keytype.sh
index 71781b26e..c0cf2fed6 100644
--- a/regress/limit-keytype.sh
+++ b/regress/limit-keytype.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: limit-keytype.sh,v 1.3 2015/10/26 02:50:58 dtucker Exp $
+#	$OpenBSD: limit-keytype.sh,v 1.4 2015/10/29 08:05:17 djm Exp $
 #	Placed in the Public Domain.
 
 tid="restrict pubkey type"
@@ -20,6 +20,8 @@ ${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key2 || \
 	fatal "ssh-keygen failed"
 ${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_key3 || \
 	fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t dsa -f $OBJ/user_key4 || \
+	fatal "ssh-keygen failed"
 ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
 	-z $$ -n ${USER},mekmitasdigoat $OBJ/user_key3 ||
 		fatal "couldn't sign user_key1"
@@ -77,3 +79,19 @@ ${SSH} $certopts proxy true || fatal "cert failed"
 ${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded"
 ${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded"
 
+# Allow RSA in main config, Ed25519 for non-existent user.
+verbose "match w/ no match"
+prepare_config "PubkeyAcceptedKeyTypes ssh-rsa" \
+	"Match user x$USER" "PubkeyAcceptedKeyTypes +ssh-ed25519"
+${SSH} $certopts proxy true && fatal "cert succeeded"
+${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded"
+${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
+
+# Allow only DSA in main config, Ed25519 for user.
+verbose "match w/ matching"
+prepare_config "PubkeyAcceptedKeyTypes ssh-dss" \
+	"Match user $USER" "PubkeyAcceptedKeyTypes +ssh-ed25519"
+${SSH} $certopts proxy true || fatal "cert failed"
+${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
+${SSH} $opts -i $OBJ/user_key4 proxy true && fatal "key4 succeeded"
+
-- 
cgit v1.2.3


From da98c11d03d819a15429d8fff9688acd7505439f Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Mon, 7 Dec 2015 02:20:46 +0000
Subject: upstream commit

basic unit tests for rsa-sha2-* signature types

Upstream-Regress-ID: 7dc4b9db809d578ff104d591b4d86560c3598d3c
---
 regress/unittests/sshkey/test_fuzz.c   | 30 +++++++++++++++++------
 regress/unittests/sshkey/test_sshkey.c | 44 ++++++++++++++++++++++++----------
 2 files changed, 55 insertions(+), 19 deletions(-)

(limited to 'regress')

diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c
index cb7924de1..1f414e0ac 100644
--- a/regress/unittests/sshkey/test_fuzz.c
+++ b/regress/unittests/sshkey/test_fuzz.c
@@ -1,4 +1,4 @@
-/* 	$OpenBSD: test_fuzz.c,v 1.5 2015/10/06 01:20:59 djm Exp $ */
+/* 	$OpenBSD: test_fuzz.c,v 1.6 2015/12/07 02:20:46 djm Exp $ */
 /*
  * Fuzz tests for key parsing
  *
@@ -72,13 +72,13 @@ public_fuzz(struct sshkey *k)
 }
 
 static void
-sig_fuzz(struct sshkey *k)
+sig_fuzz(struct sshkey *k, const char *sig_alg)
 {
 	struct fuzz *fuzz;
 	u_char *sig, c[] = "some junk to be signed";
 	size_t l;
 
-	ASSERT_INT_EQ(sshkey_sign(k, &sig, &l, c, sizeof(c), 0), 0);
+	ASSERT_INT_EQ(sshkey_sign(k, &sig, &l, c, sizeof(c), sig_alg, 0), 0);
 	ASSERT_SIZE_T_GT(l, 0);
 	fuzz = fuzz_begin(FUZZ_1_BIT_FLIP | /* too slow FUZZ_2_BIT_FLIP | */
 	    FUZZ_1_BYTE_FLIP | FUZZ_2_BYTE_FLIP |
@@ -352,7 +352,23 @@ sshkey_fuzz_tests(void)
 	buf = load_file("rsa_1");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
-	sig_fuzz(k1);
+	sig_fuzz(k1, "ssh-rsa");
+	sshkey_free(k1);
+	TEST_DONE();
+
+	TEST_START("fuzz RSA SHA256 sig");
+	buf = load_file("rsa_1");
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
+	sshbuf_free(buf);
+	sig_fuzz(k1, "rsa-sha2-256");
+	sshkey_free(k1);
+	TEST_DONE();
+
+	TEST_START("fuzz RSA SHA512 sig");
+	buf = load_file("rsa_1");
+	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
+	sshbuf_free(buf);
+	sig_fuzz(k1, "rsa-sha2-512");
 	sshkey_free(k1);
 	TEST_DONE();
 
@@ -360,7 +376,7 @@ sshkey_fuzz_tests(void)
 	buf = load_file("dsa_1");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
-	sig_fuzz(k1);
+	sig_fuzz(k1, NULL);
 	sshkey_free(k1);
 	TEST_DONE();
 
@@ -369,7 +385,7 @@ sshkey_fuzz_tests(void)
 	buf = load_file("ecdsa_1");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
-	sig_fuzz(k1);
+	sig_fuzz(k1, NULL);
 	sshkey_free(k1);
 	TEST_DONE();
 #endif
@@ -378,7 +394,7 @@ sshkey_fuzz_tests(void)
 	buf = load_file("ed25519_1");
 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
 	sshbuf_free(buf);
-	sig_fuzz(k1);
+	sig_fuzz(k1, NULL);
 	sshkey_free(k1);
 	TEST_DONE();
 
diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
index 442e67344..1f160d1a7 100644
--- a/regress/unittests/sshkey/test_sshkey.c
+++ b/regress/unittests/sshkey/test_sshkey.c
@@ -1,4 +1,4 @@
-/* 	$OpenBSD: test_sshkey.c,v 1.8 2015/10/06 01:20:59 djm Exp $ */
+/* 	$OpenBSD: test_sshkey.c,v 1.9 2015/12/07 02:20:46 djm Exp $ */
 /*
  * Regress test for sshkey.h key management API
  *
@@ -52,7 +52,8 @@ put_opt(struct sshbuf *b, const char *name, const char *value)
 
 static void
 build_cert(struct sshbuf *b, const struct sshkey *k, const char *type,
-    const struct sshkey *sign_key, const struct sshkey *ca_key)
+    const struct sshkey *sign_key, const struct sshkey *ca_key,
+    const char *sig_alg)
 {
 	struct sshbuf *ca_buf, *pk, *principals, *critopts, *exts;
 	u_char *sigblob;
@@ -99,7 +100,7 @@ build_cert(struct sshbuf *b, const struct sshkey *k, const char *type,
 	ASSERT_INT_EQ(sshbuf_put_string(b, NULL, 0), 0); /* reserved */
 	ASSERT_INT_EQ(sshbuf_put_stringb(b, ca_buf), 0); /* signature key */
 	ASSERT_INT_EQ(sshkey_sign(sign_key, &sigblob, &siglen,
-	    sshbuf_ptr(b), sshbuf_len(b), 0), 0);
+	    sshbuf_ptr(b), sshbuf_len(b), sig_alg, 0), 0);
 	ASSERT_INT_EQ(sshbuf_put_string(b, sigblob, siglen), 0); /* signature */
 
 	free(sigblob);
@@ -111,12 +112,13 @@ build_cert(struct sshbuf *b, const struct sshkey *k, const char *type,
 }
 
 static void
-signature_test(struct sshkey *k, struct sshkey *bad, const u_char *d, size_t l)
+signature_test(struct sshkey *k, struct sshkey *bad, const char *sig_alg,
+    const u_char *d, size_t l)
 {
 	size_t len;
 	u_char *sig;
 
-	ASSERT_INT_EQ(sshkey_sign(k, &sig, &len, d, l, 0), 0);
+	ASSERT_INT_EQ(sshkey_sign(k, &sig, &len, d, l, sig_alg, 0), 0);
 	ASSERT_SIZE_T_GT(len, 8);
 	ASSERT_PTR_NE(sig, NULL);
 	ASSERT_INT_EQ(sshkey_verify(k, sig, len, d, l, 0), 0);
@@ -143,7 +145,7 @@ banana(u_char *s, size_t l)
 }
 
 static void
-signature_tests(struct sshkey *k, struct sshkey *bad)
+signature_tests(struct sshkey *k, struct sshkey *bad, const char *sig_alg)
 {
 	u_char i, buf[2049];
 	size_t lens[] = {
@@ -155,7 +157,7 @@ signature_tests(struct sshkey *k, struct sshkey *bad)
 		test_subtest_info("%s key, banana length %zu",
 		    sshkey_type(k), lens[i]);
 		banana(buf, lens[i]);
-		signature_test(k, bad, buf, lens[i]);
+		signature_test(k, bad, sig_alg, buf, lens[i]);
 	}
 }
 
@@ -469,7 +471,25 @@ sshkey_tests(void)
 	k1 = get_private("rsa_1");
 	ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_2.pub"), &k2,
 	    NULL), 0);
-	signature_tests(k1, k2);
+	signature_tests(k1, k2, "ssh-rsa");
+	sshkey_free(k1);
+	sshkey_free(k2);
+	TEST_DONE();
+
+	TEST_START("sign and verify RSA-SHA256");
+	k1 = get_private("rsa_1");
+	ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_2.pub"), &k2,
+	    NULL), 0);
+	signature_tests(k1, k2, "rsa-sha2-256");
+	sshkey_free(k1);
+	sshkey_free(k2);
+	TEST_DONE();
+
+	TEST_START("sign and verify RSA-SHA512");
+	k1 = get_private("rsa_1");
+	ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_2.pub"), &k2,
+	    NULL), 0);
+	signature_tests(k1, k2, "rsa-sha2-512");
 	sshkey_free(k1);
 	sshkey_free(k2);
 	TEST_DONE();
@@ -478,7 +498,7 @@ sshkey_tests(void)
 	k1 = get_private("dsa_1");
 	ASSERT_INT_EQ(sshkey_load_public(test_data_file("dsa_2.pub"), &k2,
 	    NULL), 0);
-	signature_tests(k1, k2);
+	signature_tests(k1, k2, NULL);
 	sshkey_free(k1);
 	sshkey_free(k2);
 	TEST_DONE();
@@ -488,7 +508,7 @@ sshkey_tests(void)
 	k1 = get_private("ecdsa_1");
 	ASSERT_INT_EQ(sshkey_load_public(test_data_file("ecdsa_2.pub"), &k2,
 	    NULL), 0);
-	signature_tests(k1, k2);
+	signature_tests(k1, k2, NULL);
 	sshkey_free(k1);
 	sshkey_free(k2);
 	TEST_DONE();
@@ -498,7 +518,7 @@ sshkey_tests(void)
 	k1 = get_private("ed25519_1");
 	ASSERT_INT_EQ(sshkey_load_public(test_data_file("ed25519_2.pub"), &k2,
 	    NULL), 0);
-	signature_tests(k1, k2);
+	signature_tests(k1, k2, NULL);
 	sshkey_free(k1);
 	sshkey_free(k2);
 	TEST_DONE();
@@ -508,7 +528,7 @@ sshkey_tests(void)
 	ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2,
 	    NULL), 0);
 	k3 = get_private("rsa_1");
-	build_cert(b, k2, "ssh-rsa-cert-v01@openssh.com", k3, k1);
+	build_cert(b, k2, "ssh-rsa-cert-v01@openssh.com", k3, k1, NULL);
 	ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(b), sshbuf_len(b), &k4),
 	    SSH_ERR_KEY_CERT_INVALID_SIGN_KEY);
 	ASSERT_PTR_EQ(k4, NULL);
-- 
cgit v1.2.3


From 537f88ec7bcf40bd444ac5584c707c5588c55c43 Mon Sep 17 00:00:00 2001
From: "dtucker@openbsd.org" <dtucker@openbsd.org>
Date: Fri, 29 Jan 2016 05:18:15 +0000
Subject: upstream commit

Add regression test for RekeyLimit parsing of >32bit values
 (4G and 8G).

Upstream-Regress-ID: 548390350c62747b6234f522a99c319eee401328
---
 regress/rekey.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'regress')

diff --git a/regress/rekey.sh b/regress/rekey.sh
index 0d4444d03..ae145bc8b 100644
--- a/regress/rekey.sh
+++ b/regress/rekey.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: rekey.sh,v 1.16 2015/02/14 12:43:16 markus Exp $
+#	$OpenBSD: rekey.sh,v 1.17 2016/01/29 05:18:15 dtucker Exp $
 #	Placed in the Public Domain.
 
 tid="rekey"
@@ -137,13 +137,15 @@ for s in 5 10; do
 done
 
 verbose "rekeylimit parsing"
-for size in 16 1k 1K 1m 1M 1g 1G; do
+for size in 16 1k 1K 1m 1M 1g 1G 4G 8G; do
     for time in 1 1m 1M 1h 1H 1d 1D 1w 1W; do
 	case $size in
 		16)	bytes=16 ;;
 		1k|1K)	bytes=1024 ;;
 		1m|1M)	bytes=1048576 ;;
 		1g|1G)	bytes=1073741824 ;;
+		4g|4G)	bytes=4294967296 ;;
+		8g|8G)	bytes=8589934592 ;;
 	esac
 	case $time in
 		1)	seconds=1 ;;
-- 
cgit v1.2.3


From 624fd395b559820705171f460dd33d67743d13d6 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Wed, 17 Feb 2016 02:24:17 +0000
Subject: upstream commit

include bad $SSH_CONNECTION in failure output

Upstream-Regress-ID: b22d72edfde78c403aaec2b9c9753ef633cc0529
---
 regress/proxy-connect.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'regress')

diff --git a/regress/proxy-connect.sh b/regress/proxy-connect.sh
index f816962b5..b7a43fabe 100644
--- a/regress/proxy-connect.sh
+++ b/regress/proxy-connect.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: proxy-connect.sh,v 1.8 2015/03/03 22:35:19 markus Exp $
+#	$OpenBSD: proxy-connect.sh,v 1.9 2016/02/17 02:24:17 djm Exp $
 #	Placed in the Public Domain.
 
 tid="proxy connect"
@@ -18,7 +18,8 @@ for ps in no yes; do
 		fail "ssh proxyconnect protocol $p privsep=$ps comp=$c failed"
 	fi
 	if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
-		fail "bad SSH_CONNECTION protocol $p privsep=$ps comp=$c"
+		fail "bad SSH_CONNECTION protocol $p privsep=$ps comp=$c: " \
+		    "$SSH_CONNECTION"
 	fi
     done
   done
-- 
cgit v1.2.3


From 1acc058d0a7913838c830ed998a1a1fb5b7864bf Mon Sep 17 00:00:00 2001
From: Damien Miller <djm@mindrot.org>
Date: Tue, 23 Feb 2016 16:12:13 +1100
Subject: Disable tests where fs perms are incorrect

Some tests have strict requirements on the filesystem permissions
for certain files and directories. This adds a regress/check-perm
tool that copies the relevant logic from sshd to exactly test
the paths in question. This lets us skip tests when the local
filesystem doesn't conform to our expectations rather than
continuing and failing the test run.

ok dtucker@
---
 Makefile.in                   |   5 ++
 regress/check-perm.c          | 205 ++++++++++++++++++++++++++++++++++++++++++
 regress/keys-command.sh       |   6 ++
 regress/principals-command.sh |   7 ++
 regress/setuid-allowed.c      |   2 +-
 regress/sftp-chroot.sh        |   5 ++
 6 files changed, 229 insertions(+), 1 deletion(-)
 create mode 100644 regress/check-perm.c

(limited to 'regress')

diff --git a/Makefile.in b/Makefile.in
index a8984c8fb..d401787db 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -434,6 +434,10 @@ regress/netcat$(EXEEXT): $(srcdir)/regress/netcat.c
 	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $? \
 	$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
 
+regress/check-perm$(EXEEXT): $(srcdir)/regress/check-perm.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $? \
+	$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
 UNITTESTS_TEST_HELPER_OBJS=\
 	regress/unittests/test_helper/test_helper.o \
 	regress/unittests/test_helper/fuzz.o
@@ -505,6 +509,7 @@ REGRESS_BINARIES=\
 	regress/modpipe$(EXEEXT) \
 	regress/setuid-allowed$(EXEEXT) \
 	regress/netcat$(EXEEXT) \
+	regress/check-perm$(EXEEXT) \
 	regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \
 	regress/unittests/sshkey/test_sshkey$(EXEEXT) \
 	regress/unittests/bitmap/test_bitmap$(EXEEXT) \
diff --git a/regress/check-perm.c b/regress/check-perm.c
new file mode 100644
index 000000000..dac307d24
--- /dev/null
+++ b/regress/check-perm.c
@@ -0,0 +1,205 @@
+/*
+ * Placed in the public domain
+ */
+
+/* $OpenBSD: modpipe.c,v 1.6 2013/11/21 03:16:47 djm Exp $ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <pwd.h>
+#ifdef HAVE_LIBGEN_H
+#include <libgen.h>
+#endif
+
+static void
+fatal(const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+	vfprintf(stderr, fmt, args);
+	fputc('\n', stderr);
+	va_end(args);
+	exit(1);
+}
+/* Based on session.c. NB. keep tests in sync */
+static void
+safely_chroot(const char *path, uid_t uid)
+{
+	const char *cp;
+	char component[PATH_MAX];
+	struct stat st;
+
+	if (*path != '/')
+		fatal("chroot path does not begin at root");
+	if (strlen(path) >= sizeof(component))
+		fatal("chroot path too long");
+
+	/*
+	 * Descend the path, checking that each component is a
+	 * root-owned directory with strict permissions.
+	 */
+	for (cp = path; cp != NULL;) {
+		if ((cp = strchr(cp, '/')) == NULL)
+			strlcpy(component, path, sizeof(component));
+		else {
+			cp++;
+			memcpy(component, path, cp - path);
+			component[cp - path] = '\0';
+		}
+
+		/* debug3("%s: checking '%s'", __func__, component); */
+
+		if (stat(component, &st) != 0)
+			fatal("%s: stat(\"%s\"): %s", __func__,
+			    component, strerror(errno));
+		if (st.st_uid != 0 || (st.st_mode & 022) != 0)
+			fatal("bad ownership or modes for chroot "
+			    "directory %s\"%s\"",
+			    cp == NULL ? "" : "component ", component);
+		if (!S_ISDIR(st.st_mode))
+			fatal("chroot path %s\"%s\" is not a directory",
+			    cp == NULL ? "" : "component ", component);
+
+	}
+
+	if (chdir(path) == -1)
+		fatal("Unable to chdir to chroot path \"%s\": "
+		    "%s", path, strerror(errno));
+}
+
+/* from platform.c */
+int
+platform_sys_dir_uid(uid_t uid)
+{
+	if (uid == 0)
+		return 1;
+#ifdef PLATFORM_SYS_DIR_UID
+	if (uid == PLATFORM_SYS_DIR_UID)
+		return 1;
+#endif
+	return 0;
+}
+
+/* from auth.c */
+int
+auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
+    uid_t uid, char *err, size_t errlen)
+{
+	char buf[PATH_MAX], homedir[PATH_MAX];
+	char *cp;
+	int comparehome = 0;
+	struct stat st;
+
+	if (realpath(name, buf) == NULL) {
+		snprintf(err, errlen, "realpath %s failed: %s", name,
+		    strerror(errno));
+		return -1;
+	}
+	if (pw_dir != NULL && realpath(pw_dir, homedir) != NULL)
+		comparehome = 1;
+
+	if (!S_ISREG(stp->st_mode)) {
+		snprintf(err, errlen, "%s is not a regular file", buf);
+		return -1;
+	}
+	if ((!platform_sys_dir_uid(stp->st_uid) && stp->st_uid != uid) ||
+	    (stp->st_mode & 022) != 0) {
+		snprintf(err, errlen, "bad ownership or modes for file %s",
+		    buf);
+		return -1;
+	}
+
+	/* for each component of the canonical path, walking upwards */
+	for (;;) {
+		if ((cp = dirname(buf)) == NULL) {
+			snprintf(err, errlen, "dirname() failed");
+			return -1;
+		}
+		strlcpy(buf, cp, sizeof(buf));
+
+		if (stat(buf, &st) < 0 ||
+		    (!platform_sys_dir_uid(st.st_uid) && st.st_uid != uid) ||
+		    (st.st_mode & 022) != 0) {
+			snprintf(err, errlen,
+			    "bad ownership or modes for directory %s", buf);
+			return -1;
+		}
+
+		/* If are past the homedir then we can stop */
+		if (comparehome && strcmp(homedir, buf) == 0)
+			break;
+
+		/*
+		 * dirname should always complete with a "/" path,
+		 * but we can be paranoid and check for "." too
+		 */
+		if ((strcmp("/", buf) == 0) || (strcmp(".", buf) == 0))
+			break;
+	}
+	return 0;
+}
+
+static void
+usage(void)
+{
+	fprintf(stderr, "check-perm -m [chroot | keys-command] [path]\n");
+	exit(1);
+}
+
+int
+main(int argc, char **argv)
+{
+	const char *path = ".";
+	char errmsg[256];
+	int ch, mode = -1;
+	extern char *optarg;
+	extern int optind;
+	struct stat st;
+
+	while ((ch = getopt(argc, argv, "hm:")) != -1) {
+		switch (ch) {
+		case 'm':
+			if (strcasecmp(optarg, "chroot") == 0)
+				mode = 1;
+			else if (strcasecmp(optarg, "keys-command") == 0)
+				mode = 2;
+			else {
+				fprintf(stderr, "Invalid -m option\n"),
+				usage();
+			}
+			break;
+		default:
+			usage();
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if (argc > 1)
+		usage();
+	else if (argc == 1)
+		path = argv[0];
+
+	if (mode == 1)
+		safely_chroot(path, getuid());
+	else if (mode == 2) {
+		if (stat(path, &st) < 0)
+			fatal("Could not stat %s: %s", path, strerror(errno));
+		if (auth_secure_path(path, &st, NULL, 0,
+		    errmsg, sizeof(errmsg)) != 0)
+			fatal("Unsafe %s: %s", path, errmsg);
+	} else {
+		fprintf(stderr, "Invalid mode\n");
+		usage();
+	}
+	return 0;
+}
diff --git a/regress/keys-command.sh b/regress/keys-command.sh
index 700273b66..af68cf15c 100644
--- a/regress/keys-command.sh
+++ b/regress/keys-command.sh
@@ -36,6 +36,12 @@ exec cat "$OBJ/authorized_keys_${LOGNAME}"
 _EOF
 $SUDO chmod 0755 "$KEY_COMMAND"
 
+if ! $OBJ/check-perm -m keys-command $KEY_COMMAND ; then
+	echo "skipping: $KEY_COMMAND is unsuitable as AuthorizedKeysCommand"
+	$SUDO rm -f $KEY_COMMAND
+	exit 0
+fi
+
 if [ -x $KEY_COMMAND ]; then
 	cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
 
diff --git a/regress/principals-command.sh b/regress/principals-command.sh
index b90a8cf2c..c0be7e747 100644
--- a/regress/principals-command.sh
+++ b/regress/principals-command.sh
@@ -24,6 +24,13 @@ _EOF
 test $? -eq 0 || fatal "couldn't prepare principals command"
 $SUDO chmod 0755 "$PRINCIPALS_CMD"
 
+if ! $OBJ/check-perm -m keys-command $PRINCIPALS_CMD ; then
+	echo "skipping: $PRINCIPALS_CMD is unsuitable as " \
+	    "AuthorizedPrincipalsCommand"
+	$SUDO rm -f $PRINCIPALS_CMD
+	exit 0
+fi
+
 # Create a CA key and a user certificate.
 ${SSHKEYGEN} -q -N '' -t ed25519  -f $OBJ/user_ca_key || \
 	fatal "ssh-keygen of user_ca_key failed"
diff --git a/regress/setuid-allowed.c b/regress/setuid-allowed.c
index 676d2661c..7a0527fd0 100644
--- a/regress/setuid-allowed.c
+++ b/regress/setuid-allowed.c
@@ -26,7 +26,7 @@
 #include <string.h>
 #include <errno.h>
 
-void
+static void
 usage(void)
 {
 	fprintf(stderr, "check-setuid [path]\n");
diff --git a/regress/sftp-chroot.sh b/regress/sftp-chroot.sh
index 23f7456e8..9c26eb680 100644
--- a/regress/sftp-chroot.sh
+++ b/regress/sftp-chroot.sh
@@ -12,6 +12,11 @@ if [ -z "$SUDO" ]; then
   exit 0
 fi
 
+if ! $OBJ/check-perm -m chroot "$CHROOT" ; then
+  echo "skipped: $CHROOT is unsuitable as ChrootDirectory"
+  exit 0
+fi
+
 $SUDO sh -c "echo mekmitastdigoat > $PRIVDATA" || \
 	fatal "create $PRIVDATA failed"
 
-- 
cgit v1.2.3