diff options
| author | dtucker@openbsd.org <dtucker@openbsd.org> | 2024-08-21 08:59:08 +0200 |
|---|---|---|
| committer | Darren Tucker <dtucker@dtucker.net> | 2024-08-21 09:08:06 +0200 |
| commit | 25c52f37a82c4da48ec537de37d7c168982b8d6d (patch) | |
| tree | abd0fc300672efe7436fc755497aaec258442077 /regress/rekey.sh | |
| parent | upstream: Send only as much data as needed to trigger rekeying. Speeds (diff) | |
| download | openssh-25c52f37a82c4da48ec537de37d7c168982b8d6d.tar.xz openssh-25c52f37a82c4da48ec537de37d7c168982b8d6d.zip | |
upstream: Use curve25519-sha256 kex where possible.
Except where we're explicitly testing a different kex, use
curve25519-sha256 since it's faster than the default and supported even
when configured without OpenSSL. Add a check to ensure that the kex we
intended to test is the one we actually tested. Speeds test up by ~5%.
OpenBSD-Regress-ID: 3b27fcc2ae953cb08fd82a0d3155c498b226d6e0
Diffstat (limited to '')
| -rw-r--r-- | regress/rekey.sh | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/regress/rekey.sh b/regress/rekey.sh index 061e65475..79e52f2a9 100644 --- a/regress/rekey.sh +++ b/regress/rekey.sh @@ -1,4 +1,4 @@ -# $OpenBSD: rekey.sh,v 1.26 2024/08/20 12:36:59 dtucker Exp $ +# $OpenBSD: rekey.sh,v 1.27 2024/08/21 06:59:08 dtucker Exp $ # Placed in the Public Domain. tid="rekey" @@ -11,6 +11,7 @@ cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak echo "Compression no" >> $OBJ/ssh_proxy echo "RekeyLimit 256k" >> $OBJ/ssh_proxy +echo "KexAlgorithms curve25519-sha256" >> ssh_proxy # Test rekeying based on data volume only. # Arguments: rekeylimit, kex method, optional remaining opts are passed to ssh. @@ -31,7 +32,7 @@ ssh_data_rekeying() rm -f ${COPY} ${COPY2} ${LOG} # Create data file just big enough to reach rekey threshold. dd if=${DATA} of=${COPY} bs=$_bytes count=1 2>/dev/null - ${SSH} <${COPY} $_opts -v \ + ${SSH} <${COPY} $_opts -vv \ -oRekeyLimit=$_bytes -F $OBJ/ssh_proxy somehost "cat >${COPY2}" if [ $? -ne 0 ]; then fail "ssh failed ($@)" @@ -39,6 +40,16 @@ ssh_data_rekeying() cmp ${COPY} ${COPY2} || fail "corrupted copy ($@)" n=`grep 'NEWKEYS sent' ${LOG} | wc -l` n=`expr $n - 1` + case "$_kexopt" in + KexAlgorithms*) + _want=`echo $_kexopt | cut -f2 -d=` + _got=`awk 'BEGIN{FS="[ \r]+"} /kex: algorithm: /{print $4}' \ + ${LOG} | sort -u` + if [ "$_want" != "$_got" ]; then + fail "expected kex $_want, got $_got" + fi + ;; + esac trace "$n rekeying(s)" if [ $n -lt 1 ]; then fail "no rekeying occurred ($@)" |