[openssh-commits] [openssh] branch master updated: upstream: Use aes128-ctr for MAC tests since default has implicit MAC.

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

dtucker pushed a commit to branch master
in repository openssh.

The following commit(s) were added to refs/heads/master by this push:
     new 7e75e3f5 upstream: Use aes128-ctr for MAC tests since default has implicit MAC.
7e75e3f5 is described below

commit 7e75e3f57c41b9a6e6401e7674d7c2ff5c33975b
Author: dtucker at openbsd.org <dtucker at openbsd.org>
AuthorDate: Thu Aug 22 10:21:02 2024 +0000

    upstream: Use aes128-ctr for MAC tests since default has implicit MAC.
    
    Also verify that the Cipher or MAC we intended to use is actually the one
    selected during the test.
    
    OpenBSD-Regress-ID: ff43fed30552afe23d1364526fe8cf88cbfafe1d
---
 regress/rekey.sh | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/regress/rekey.sh b/regress/rekey.sh
index 53f74baa..1f68a101 100644
--- a/regress/rekey.sh
+++ b/regress/rekey.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: rekey.sh,v 1.28 2024/08/21 10:33:27 dtucker Exp $
+#	$OpenBSD: rekey.sh,v 1.29 2024/08/22 10:21:02 dtucker Exp $
 #	Placed in the Public Domain.
 
 tid="rekey"
@@ -28,6 +28,11 @@ ssh_data_rekeying()
 		echo "$_kexopt" >> $OBJ/sshd_proxy
 		_opts="$_opts -o$_kexopt"
 	fi
+	case "$_kexopt" in
+	MACs=*)
+		# default chacha20-poly1305 cipher has implicit MAC
+		_opts="$_opts -oCiphers=aes128-ctr" ;;
+	esac
 	trace  bytes $_bytes kex $_kexopt opts $_opts
 	rm -f ${COPY} ${COPY2} ${LOG}
 	# Create data file just big enough to reach rekey threshold.
@@ -40,16 +45,22 @@ ssh_data_rekeying()
 	cmp ${COPY} ${COPY2}		|| fail "corrupted copy ($@)"
 	n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
 	n=`expr $n - 1`
+	_want=`echo $_kexopt | cut -f2 -d=`
+	_got=""
 	case "$_kexopt" in
-	KexAlgorithms*)
-		_want=`echo $_kexopt | cut -f2 -d=`
+	KexAlgorithms=*)
 		_got=`awk '/kex: algorithm: /{print $4}' ${LOG} | \
-		    tr -d '\r' | sort -u`
-		if [ "$_want" != "$_got" ]; then
-			fail "expected kex $_want, got $_got"
-		fi
-		 ;;
+		    tr -d '\r' | sort -u` ;;
+	Ciphers=*)
+		_got=`awk '/kex: client->server cipher:/{print $5}' ${LOG} | \
+		    tr -d '\r' | sort -u` ;;
+	MACs=*)
+		_got=`awk '/kex: client->server cipher:/{print $7}' ${LOG} | \
+		    tr -d '\r' | sort -u` ;;
 	esac
+	if [ "$_want" != "$_got" ]; then
+		fail "unexpected algorithm, want $_want, got $_got"
+	fi
 	trace "$n rekeying(s)"
 	if [ $n -lt 1 ]; then
 		fail "no rekeying occurred ($@)"

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.