[openssh-commits] [openssh] 03/04: upstream: verify that RekeyLimit in a Match block is effective

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit dd4556dc758ef0fe4c74325bf5fa045a7f44d72e
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Tue Jul 21 06:18:09 2026 +0000

    upstream: verify that RekeyLimit in a Match block is effective
    
    OpenBSD-Regress-ID: 23084bcf86071a7fe0c121552ec6e0b208cc7e28
---
 regress/rekey.sh | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/regress/rekey.sh b/regress/rekey.sh
index 88430309d..ed53a7464 100644
--- a/regress/rekey.sh
+++ b/regress/rekey.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: rekey.sh,v 1.30 2024/08/28 12:08:26 djm Exp $
+#	$OpenBSD: rekey.sh,v 1.31 2026/07/21 06:18:09 djm Exp $
 #	Placed in the Public Domain.
 
 tid="rekey"
@@ -73,7 +73,7 @@ increase_datafile_size 300
 opts=""
 
 # Filter out duplicate curve algo
-kexs=`${SSH} -Q kex | grep -v curve25519-sha256 at libssh.org`
+kexs=`${SSH} -Q kex | grep -v curve25519-sha256 at libssh.org | grep -v sntrup761x25519-sha512 at openssh.com`
 ciphers=`${SSH} -Q cipher`
 macs=`${SSH} -Q mac`
 
@@ -157,6 +157,26 @@ for s in 16 1k 128k 256k; do
 	fi
 done
 
+for s in 16 1k 128k 256k; do
+	verbose "server match rekeylimit ${s}"
+	cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+	echo "match user *" >>$OBJ/sshd_proxy
+	echo "rekeylimit ${s}" >>$OBJ/sshd_proxy
+	rm -f ${COPY} ${COPY2} ${LOG}
+	dd if=${DATA} of=${COPY} bs=$s count=1 2>/dev/null
+	${SSH} -F $OBJ/ssh_proxy somehost "cat ${COPY}" >${COPY2}
+	if [ $? -ne 0 ]; then
+		fail "ssh failed"
+	fi
+	cmp ${COPY} ${COPY2}		|| fail "corrupted copy"
+	n=`grep 'NEWKEYS sent' ${LOG} | wc -l`
+	n=`expr $n - 1`
+	trace "$n rekeying(s)"
+	if [ $n -lt 1 ]; then
+		fail "no rekeying occurred"
+	fi
+done
+
 for s in 5 10; do
 	verbose "server rekeylimit default ${s} no data"
 	cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.