Call for testing: OpenSSH-5.4

[Asif Iqbal]

On Mon, Mar 1, 2010 at 4:49 PM, Asif Iqbal <vadud3 at gmail.com> wrote:
> failing on opensolaris snv_133
>
> SunOS scrub 5.11 snv_133 i86pc i386 i86pc
>
> gcc version 3.4.3 (csl-sol210-3_4-20050802)
>
>
> gunzip openssh-SNAP-20100302.tar.gz
> tar tvf openssh-SNAP-20100302.tar
> tar xvf openssh-SNAP-20100302.tar
> cd openssh
> ./configure
> make tests
> [...]
> run test cert-hostkey.sh ...
> certified host keys: sign host rsa cert
> certified host keys: sign host dsa cert
> certified host keys: host rsa cert connect privsep yes
> certified host keys: host dsa cert connect privsep yes
> certified host keys: host rsa cert connect privsep no
> certified host keys: host dsa cert connect privsep no
> certified host keys: test host cert connect user-certificate expect failure
> certified host keys: test host cert connect empty principals expect success
> certified host keys: test host cert connect wrong principals expect failure
> certified host keys: test host cert connect cert not yet valid expect failure
> certified host keys: test host cert connect cert expired expect failure
> certified host keys: test host cert connect cert valid interval expect success
> certified host keys: test host cert connect cert has constraints expect failure
> certified host keys: host rsa cert downgrade to raw key
> certified host keys: host dsa cert downgrade to raw key
> ok certified host keys
> run test cert-userkey.sh ...
> certified user keys: sign user rsa cert
> certified user keys: sign user dsa cert
> certified user keys: user rsa cert connect privsep yes
> Permission denied (publickey,password,keyboard-interactive).
> ssh cert connect failed
> certified user keys: user dsa cert connect privsep yes
> Permission denied (publickey,password,keyboard-interactive).
> ssh cert connect failed
> certified user keys: user rsa cert connect privsep no
> Permission denied (publickey,password,keyboard-interactive).
> ssh cert connect failed
> certified user keys: user dsa cert connect privsep no
> Permission denied (publickey,password,keyboard-interactive).
> ssh cert connect failed
> certified user keys: ensure CA key does not authenticate user
> ssh cert connect with CA key succeeded unexpectedly
> certified user keys: test user cert connect host-certificate expect failure
> certified user keys: test user cert connect empty principals expect success
> ssh cert connect empty principals failed unexpectedly
> certified user keys: test user cert connect wrong principals expect failure
> certified user keys: test user cert connect cert not yet valid expect failure
> certified user keys: test user cert connect cert expired expect failure
> certified user keys: test user cert connect cert valid interval expect success
> ssh cert connect cert valid interval failed unexpectedly
> certified user keys: test user cert connect wrong source-address expect failure
> certified user keys: test user cert connect force-command expect failure
> failed certified user keys
> *** Error code 1
> The following command caused the error:
> if [ "xconnect.sh proxy-connect.sh connect-privsep.sh proto-version.sh
> proto-mismatch.sh exit-status.sh envpass.sh transfer.sh banner.sh
> rekey.sh stderr-data.sh stderr-after-eof.sh broken-pipe.sh
> try-ciphers.sh yes-head.sh login-timeout.sh agent.sh
> agent-getpeereid.sh agent-timeout.sh agent-ptrace.sh keyscan.sh
> keygen-change.sh keygen-convert.sh key-options.sh scp.sh sftp.sh
> sftp-cmds.sh sftp-badcmds.sh sftp-batch.sh sftp-glob.sh reconfigure.sh
> dynamic-forward.sh forwarding.sh multiplex.sh reexec.sh brokenkeys.sh
> cfgmatch.sh addrmatch.sh localcommand.sh forcecommand.sh portnum.sh
> cert-hostkey.sh cert-userkey.sh" = "x" ]; then exit 0; fi; \
> for TEST in ""connect.sh proxy-connect.sh connect-privsep.sh
> proto-version.sh proto-mismatch.sh exit-status.sh envpass.sh
> transfer.sh banner.sh rekey.sh stderr-data.sh stderr-after-eof.sh
> broken-pipe.sh try-ciphers.sh yes-head.sh login-timeout.sh agent.sh
> agent-getpeereid.sh agent-timeout.sh agent-ptrace.sh keyscan.sh
> keygen-change.sh keygen-convert.sh key-options.sh scp.sh sftp.sh
> sftp-cmds.sh sftp-badcmds.sh sftp-batch.sh sftp-glob.sh reconfigure.sh
> dynamic-forward.sh forwarding.sh multiplex.sh reexec.sh brokenkeys.sh
> cfgmatch.sh addrmatch.sh localcommand.sh forcecommand.sh portnum.sh
> cert-hostkey.sh cert-userkey.sh; do \
>        echo "run test ${TEST}" ... 1>&2; \
>        (env SUDO= TEST_ENV="MALLOC_OPTIONS=AFGJPRX" sh
> /export/home/iqbala/Download/openssh/regress/test-exec.sh
> /export/home/iqbala/Download/openssh/regress
> /export/home/iqbala/Download/openssh/regress/${TEST}) || exit $?; \
> done
> make: Fatal error: Command failed for target `t-exec'
> Current working directory /export/home/iqbala/Download/openssh/regress
> *** Error code 1
> make: Fatal error: Command failed for target `tests'


fails with sunstudio cc: Sun C 5.10 SunOS_i386 2009/06/03
on opensolaris snv_133

run test cert-userkey.sh ...
certified user keys: sign user rsa cert
certified user keys: sign user dsa cert
certified user keys: user rsa cert connect privsep yes
Permission denied (publickey,password,keyboard-interactive).
ssh cert connect failed
certified user keys: user dsa cert connect privsep yes
Permission denied (publickey,password,keyboard-interactive).
ssh cert connect failed
certified user keys: user rsa cert connect privsep no
Permission denied (publickey,password,keyboard-interactive).
ssh cert connect failed
certified user keys: user dsa cert connect privsep no
Permission denied (publickey,password,keyboard-interactive).
ssh cert connect failed
certified user keys: ensure CA key does not authenticate user
ssh cert connect with CA key succeeded unexpectedly
certified user keys: test user cert connect host-certificate expect failure
certified user keys: test user cert connect empty principals expect success
ssh cert connect empty principals failed unexpectedly
certified user keys: test user cert connect wrong principals expect failure
certified user keys: test user cert connect cert not yet valid expect failure
certified user keys: test user cert connect cert expired expect failure
certified user keys: test user cert connect cert valid interval expect success
ssh cert connect cert valid interval failed unexpectedly
certified user keys: test user cert connect wrong source-address expect failure
certified user keys: test user cert connect force-command expect failure
failed certified user keys
*** Error code 1
The following command caused the error:
if [ "xconnect.sh proxy-connect.sh connect-privsep.sh proto-version.sh
proto-mismatch.sh exit-status.sh envpass.sh transfer.sh banner.sh
rekey.sh stderr-data.sh stderr-after-eof.sh broken-pipe.sh
try-ciphers.sh yes-head.sh login-timeout.sh agent.sh
agent-getpeereid.sh agent-timeout.sh agent-ptrace.sh keyscan.sh
keygen-change.sh keygen-convert.sh key-options.sh scp.sh sftp.sh
sftp-cmds.sh sftp-badcmds.sh sftp-batch.sh sftp-glob.sh reconfigure.sh
dynamic-forward.sh forwarding.sh multiplex.sh reexec.sh brokenkeys.sh
cfgmatch.sh addrmatch.sh localcommand.sh forcecommand.sh portnum.sh
cert-hostkey.sh cert-userkey.sh" = "x" ]; then exit 0; fi; \
for TEST in ""connect.sh proxy-connect.sh connect-privsep.sh
proto-version.sh proto-mismatch.sh exit-status.sh envpass.sh
transfer.sh banner.sh rekey.sh stderr-data.sh stderr-after-eof.sh
broken-pipe.sh try-ciphers.sh yes-head.sh login-timeout.sh agent.sh
agent-getpeereid.sh agent-timeout.sh agent-ptrace.sh keyscan.sh
keygen-change.sh keygen-convert.sh key-options.sh scp.sh sftp.sh
sftp-cmds.sh sftp-badcmds.sh sftp-batch.sh sftp-glob.sh reconfigure.sh
dynamic-forward.sh forwarding.sh multiplex.sh reexec.sh brokenkeys.sh
cfgmatch.sh addrmatch.sh localcommand.sh forcecommand.sh portnum.sh
cert-hostkey.sh cert-userkey.sh; do \
	echo "run test ${TEST}" ... 1>&2; \
	(env SUDO= TEST_ENV="MALLOC_OPTIONS=AFGJPRX" sh
/export/home/iqbala/Download/openssh/regress/test-exec.sh
/export/home/iqbala/Download/openssh/regress
/export/home/iqbala/Download/openssh/regress/${TEST}) || exit $?; \
done
make: Fatal error: Command failed for target `t-exec'
Current working directory /export/home/iqbala/Download/openssh/regress
*** Error code 1
make: Fatal error: Command failed for target `tests'

>
>
> On Sat, Feb 27, 2010 at 2:25 AM, Damien Miller <djm at mindrot.org> wrote:
>> Hi,
>>
>> OpenSSH 5.4 is almost ready for release, so we would appreciate testing
>> on as many platforms and systems as possible. This is a big release,
>> with a number of major new features and many bug fixes.
>>
>> Snapshot releases for portable OpenSSH are available from
>> http://www.mindrot.org/openssh_snap/
>>
>> The OpenBSD version is available in CVS HEAD:
>> http://www.openbsd.org/anoncvs.html
>>
>> Portable OpenSSH is also available via anonymous CVS using the
>> instructions at http://www.openssh.com/portable.html#cvs
>>
>> Running the regression tests supplied with Portable OpenSSH does not
>> require installation and is a simply:
>>
>> $ ./configure && make tests
>>
>> Live testing on suitable non-production systems is also
>> appreciated. Please send reports of success or failure to
>> openssh-unix-dev at mindrot.org.
>>
>> Below is a summary of changes. More detail may be found in the ChangeLog
>> in the portable OpenSSH tarballs.
>>
>> Thanks to the many people who contributed to this release.
>>
>> -------------------------------
>>
>> Changes since OpenSSH 5.3
>> =========================
>>
>> Features:
>>
>>  * After a transition period of about 10 years, this release disables
>>   SSH protocol 1 by default. Clients and servers that need to use the
>>   legacy protocol must explicitly enable it in ssh_config / sshd_config
>>   or on the command-line.
>>
>>  * Deprecate the libsectok/OpenSC-based smartcard code and add
>>   support for PKCS#11 tokens. PKCS#11 support is automatically enabled
>>   on all platforms that support dlopen(3) and was inspired by patches
>>   written by Alon Bar-Lev. Details in the ssh(1) and ssh-add(1)
>>   manpages
>>
>>  * Add support for certificate authentication of users and hosts using a
>>   new, minimal OpenSSH certificate format (not X.509). Certificates
>>   contain a public key, identity information and some validity
>>   constraints and are signed with a standard SSH public key using
>>   ssh-keygen(1). CA keys may be marked as trusted in authorized_keys
>>   (for user authentication) or known_hosts (for host authentication).
>>
>>   Documentation for certificate support may be found in ssh-keygen(1),
>>   sshd(8) and ssh(1) and a description of the protocol changes in
>>   PROTOCOL.certkeys.
>>
>>  * Added a 'netcat mode' to ssh(1): "ssh -W host:port ..." This connects
>>   stdio on the client to a single port forward on the server. This
>>   allows, for example, using ssh as a ProxyCommand to route connections
>>   via intermediate servers. bz#1618
>>
>>  * Rewrite the ssh(1) multiplexing support to support non-blocking
>>   operation of the mux master, improve the resilience of the master to
>>   malformed messages sent to it by the slave and add support for
>>   requesting port- forwardings via the multiplex protocol. The new
>>   stdio-to-local forward mode ("ssh -W host:port ...") is also
>>   supported. The revised multiplexing protocol is documented in the
>>   file PROTOCOL.mux in the source distribution.
>>
>>  * Add a 'read-only' mode to sftp-server(8) that disables open in write
>>   mode and all other fs-modifying protocol methods. bz#430
>>
>>  * Allow setting an explicit umask on the sftp-server(8) commandline to
>>   override whatever default the user has. bz#1229
>>
>>  * Many improvements to the sftp(1) client, many of which were
>>   implemented by Carlos Silva through the Google Summer of Code
>>   program:
>>   - Support the "-h" (human-readable units) flag for ls
>>   - Implement tab-completion of commands, local and remote filenames
>>   - Support most of scp(1)'s commandline arguments in sftp(1), as a
>>     first step towards making sftp(1) a drop-in replacement for scp(1).
>>     Note that the rarely-used "-P sftp_server_path" option has been
>>     moved to "-D sftp_server_path" to make way for "-P port" to match
>>     scp(1).
>>   - Add recursive transfer support for get/put and on the commandline
>>
>>  * New RSA keys will be generated with a public exponent of RSA_F4 ==
>>   (2**16)+1 == 65537 instead of the previous value 35.
>>
>>  * Passphrase-protected SSH protocol 2 private keys are now protected
>>   with AES-128 instead of 3DES. This applied to freshly-generated keys
>>   as well as keys that are reencrypted (e.g. by changing their
>>   passphrase).
>>
>> Bugfixes:
>>
>>  * When using ChrootDirectory, make sure we test for the existence of
>>   the user's shell inside the chroot and not outside (bz#1679)
>>  * Cache user and group name lookups in sftp-server using
>>   user_from_[ug]id(3) to improve performance on hosts where these
>>   operations are slow (e.g. NIS or LDAP). bz#1495
>>  * Fix problem that prevented passphrase reading from being interrupted
>>   in some circumstances; bz#1590
>>  * Ignore and log any Protocol 1 keys where the claimed size is not
>>   equal to the actual size.
>>  * Make HostBased authentication work with a ProxyCommand. bz#1569
>>  * Avoid run-time failures when specifying hostkeys via a relative
>>   path by prepending the current working directory in these cases.
>>   bz#1290
>>  * Do not prompt for a passphrase if we fail to open a keyfile, and log
>>   the reason why the open failed to debug. bz#1693
>>  * Document that the PubkeyAuthentication directive is allowed in a
>>   sshd_config(5) Match block. bz#1577
>>  * When converting keys, truncate key comments at 72 chars as per
>>   RFC4716. bz#1630
>>  * Do not allow logins if /etc/nologin exists but is not readable by the
>>   user logging in.
>>  * Output a debug log if sshd(8) can't open an existing authorized_keys.
>>   bz#1694
>>  * Quell tc[gs]etattr warnings when forcing a tty (ssh -tt), since we
>>   usually don't actually have a tty to read/set; bz#1686
>>  * Prevent sftp from crashing when given a "-" without a command.
>>   Also, allow whitespace to follow a "-". bz#1691
>>  * After sshd receives a SIGHUP, ignore subsequent HUPs while sshd
>>   re-execs itself. Prevents two HUPs in quick succession from resulting
>>   in sshd dying. bz#1692
>>  * Clarify in sshd_config(5) that StrictModes does not apply to
>>   ChrootDirectory. Permissions and ownership are always checked when
>>   chrooting. bz#1532
>>  * Set close-on-exec on various descriptors so they don't get leaked to
>>   child processes. bz#1643
>>  * Fix very rare race condition in x11/agent channel allocation: don't
>>   read after the end of the select read/write fdset and make sure a
>>   reused FD is not touched before the pre-handlers are called.
>>  * Fix incorrect exit status when multiplexing and channel ID 0 is
>>   recycled. bz#1570
>>  * Fail with an error when an attempt is made to connect to a server
>>   with ForceCommand=internal-sftp with a shell session (i.e. not a
>>   subsystem session). Avoids stuck client when attempting to ssh to
>>   such a service. bz#1606:
>>  * Warn but do not fail if stat()ing the subsystem binary fails. This
>>   helps with chrootdirectory+forcecommand=sftp-server and restricted
>>   shells. bz #1599
>>  * Change "Connecting to host..." message to "Connected to host."
>>   and delay it until after the sftp protocol connection has been
>>   established. Avoids confusing sequence of messages when the
>>   underlying ssh connection experiences problems. bz#1588
>>  * Use the HostKeyAlias rather than the hostname specified on the
>>   commandline when prompting for passwords. bz#1039
>>  * Correct off-by-one in percent_expand(): we would fatal() when trying
>>   to expand EXPAND_MAX_KEYS, allowing only EXPAND_MAX_KEYS-1 to
>>   actually work. Note that nothing in OpenSSH actually uses close to
>>   this limit at present. bz#1607
>>  * Fix passing of empty options from scp(1) and sftp(1) to the
>>   underlying ssh(1). Also add support for the stop option "--".
>>  * Fix an incorrect magic number and typo in PROTOCOL; bz#1688
>>  * Don't escape backslashes when displaying the SSH2 banner. bz#1533
>>  * Don't unnecessarily dup() the in and out fds for sftp-server. bz#1566
>>  * Force use of the correct hash function for random-art signature
>>   display as it was inheriting the wrong one when bubblebabble
>>   signatures were activated. bz#1611
>>  * Do not fall back to adding keys without contraints (ssh-add -c /
>>   -t ...) when the agent refuses the constrained add request. bz#1612
>>  * Fix a race condition in ssh-agent that could result in a wedged or
>>   spinning agent. bz#1633
>>  * Flush stdio before exec() to ensure that everying (motd
>>   in particular) has made it out before the streams go away. bz#1596
>>  * Set FD_CLOEXEC on in/out sockets in sshd(8). bz#1706
>>
>> Portable OpenSSH Bugfixes:
>>
>>  * Use system's kerberos principal name on AIX if it's available.
>>   bz#1583
>>  * Disable OOM-killing of the listening sshd on Linux. bz#1740
>>  * Use pkg-config for opensc config if it's available. bz#1160
>>  * Unbreak Redhat spec to allow building without askpass. bz#1677
>>  * If PidFile is set in sshd_config, use it in SMF init file. bz#1628
>>  * Print error and usage() when ssh-rand-helper is passed command-
>>   line arguments as none are supported. bz#1568
>>  * Add missing setsockopt() to set IPV6_V6ONLY for local forwarding
>>   with GatwayPorts=yes. bz#1648
>>  * Make GNOME 2 askpass dialog desktop-modal. bz#1645
>>  * If SELinux is enabled set the security context to "sftpd_t" before
>>   running the internal sftp server. bz#1637
>>  * Correctly check libselinux for necessary SELinux functions; bz#1713
>> _______________________________________________
>> openssh-unix-dev mailing list
>> openssh-unix-dev at mindrot.org
>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>>
>
>
>
> --
> Asif Iqbal
> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
> A: Because it messes up the order in which people normally read text.
> Q: Why is top-posting such a bad thing?
>



-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?