sshserver.pl 40 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162
  1. #!/usr/bin/env perl
  2. #***************************************************************************
  3. # _ _ ____ _
  4. # Project ___| | | | _ \| |
  5. # / __| | | | |_) | |
  6. # | (__| |_| | _ <| |___
  7. # \___|\___/|_| \_\_____|
  8. #
  9. # Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
  10. #
  11. # This software is licensed as described in the file COPYING, which
  12. # you should have received as part of this distribution. The terms
  13. # are also available at https://curl.se/docs/copyright.html.
  14. #
  15. # You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16. # copies of the Software, and permit persons to whom the Software is
  17. # furnished to do so, under the terms of the COPYING file.
  18. #
  19. # This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20. # KIND, either express or implied.
  21. #
  22. #***************************************************************************
  23. # Starts sshd for use in the SCP and SFTP curl test harness tests.
  24. # Also creates the ssh configuration files needed for these tests.
  25. use strict;
  26. use warnings;
  27. use Cwd;
  28. use Cwd 'abs_path';
  29. use Digest::MD5;
  30. use Digest::MD5 'md5_hex';
  31. use MIME::Base64;
  32. #***************************************************************************
  33. # Variables and subs imported from sshhelp module
  34. #
  35. use sshhelp qw(
  36. $sshdexe
  37. $sshexe
  38. $sftpsrvexe
  39. $sftpexe
  40. $sshkeygenexe
  41. $sshdconfig
  42. $sshconfig
  43. $sftpconfig
  44. $knownhosts
  45. $sshdlog
  46. $sshlog
  47. $sftplog
  48. $sftpcmds
  49. $hstprvkeyf
  50. $hstpubkeyf
  51. $hstpubmd5f
  52. $cliprvkeyf
  53. $clipubkeyf
  54. display_sshdconfig
  55. display_sshconfig
  56. display_sftpconfig
  57. display_sshdlog
  58. display_sshlog
  59. display_sftplog
  60. dump_array
  61. find_sshd
  62. find_ssh
  63. find_sftpsrv
  64. find_sftp
  65. find_sshkeygen
  66. logmsg
  67. sshversioninfo
  68. );
  69. #***************************************************************************
  70. # Subs imported from serverhelp module
  71. #
  72. use serverhelp qw(
  73. server_pidfilename
  74. server_logfilename
  75. );
  76. use pathhelp;
  77. #***************************************************************************
  78. my $verbose = 0; # set to 1 for debugging
  79. my $debugprotocol = 0; # set to 1 for protocol debugging
  80. my $port = 8999; # our default SCP/SFTP server port
  81. my $listenaddr = '127.0.0.1'; # default address on which to listen
  82. my $ipvnum = 4; # default IP version of listener address
  83. my $idnum = 1; # default ssh daemon instance number
  84. my $proto = 'ssh'; # protocol the ssh daemon speaks
  85. my $path = getcwd(); # current working directory
  86. my $logdir = $path .'/log'; # directory for log files
  87. my $username = $ENV{USER}; # default user
  88. my $pidfile; # ssh daemon pid file
  89. my $identity = 'curl_client_key'; # default identity file
  90. my $error;
  91. my @cfgarr;
  92. #***************************************************************************
  93. # Parse command line options
  94. #
  95. while(@ARGV) {
  96. if($ARGV[0] eq '--verbose') {
  97. $verbose = 1;
  98. }
  99. elsif($ARGV[0] eq '--debugprotocol') {
  100. $verbose = 1;
  101. $debugprotocol = 1;
  102. }
  103. elsif($ARGV[0] eq '--user') {
  104. if($ARGV[1]) {
  105. $username = $ARGV[1];
  106. shift @ARGV;
  107. }
  108. }
  109. elsif($ARGV[0] eq '--id') {
  110. if($ARGV[1]) {
  111. if($ARGV[1] =~ /^(\d+)$/) {
  112. $idnum = $1 if($1 > 0);
  113. shift @ARGV;
  114. }
  115. }
  116. }
  117. elsif($ARGV[0] eq '--ipv4') {
  118. $ipvnum = 4;
  119. $listenaddr = '127.0.0.1' if($listenaddr eq '::1');
  120. }
  121. elsif($ARGV[0] eq '--ipv6') {
  122. $ipvnum = 6;
  123. $listenaddr = '::1' if($listenaddr eq '127.0.0.1');
  124. }
  125. elsif($ARGV[0] eq '--addr') {
  126. if($ARGV[1]) {
  127. my $tmpstr = $ARGV[1];
  128. if($tmpstr =~ /^(\d\d?\d?)\.(\d\d?\d?)\.(\d\d?\d?)\.(\d\d?\d?)$/) {
  129. $listenaddr = "$1.$2.$3.$4" if($ipvnum == 4);
  130. shift @ARGV;
  131. }
  132. elsif($ipvnum == 6) {
  133. $listenaddr = $tmpstr;
  134. $listenaddr =~ s/^\[(.*)\]$/$1/;
  135. shift @ARGV;
  136. }
  137. }
  138. }
  139. elsif($ARGV[0] eq '--pidfile') {
  140. if($ARGV[1]) {
  141. $pidfile = "$path/". $ARGV[1];
  142. shift @ARGV;
  143. }
  144. }
  145. elsif($ARGV[0] eq '--sshport') {
  146. if($ARGV[1]) {
  147. if($ARGV[1] =~ /^(\d+)$/) {
  148. $port = $1;
  149. shift @ARGV;
  150. }
  151. }
  152. }
  153. else {
  154. print STDERR "\nWarning: sshserver.pl unknown parameter: $ARGV[0]\n";
  155. }
  156. shift @ARGV;
  157. }
  158. #***************************************************************************
  159. # Default ssh daemon pid file name
  160. #
  161. if(!$pidfile) {
  162. $pidfile = "$path/". server_pidfilename($proto, $ipvnum, $idnum);
  163. }
  164. #***************************************************************************
  165. # ssh and sftp server log file names
  166. #
  167. $sshdlog = server_logfilename($logdir, 'ssh', $ipvnum, $idnum);
  168. $sftplog = server_logfilename($logdir, 'sftp', $ipvnum, $idnum);
  169. #***************************************************************************
  170. # Logging level for ssh server and client
  171. #
  172. my $loglevel = $debugprotocol?'DEBUG3':'DEBUG2';
  173. #***************************************************************************
  174. # Validate username
  175. #
  176. if(!$username) {
  177. $error = 'Will not run ssh server without a user name';
  178. }
  179. elsif($username eq 'root') {
  180. $error = 'Will not run ssh server as root to mitigate security risks';
  181. }
  182. if($error) {
  183. logmsg $error;
  184. exit 1;
  185. }
  186. #***************************************************************************
  187. # Find out ssh daemon canonical file name
  188. #
  189. my $sshd = find_sshd();
  190. if(!$sshd) {
  191. logmsg "cannot find $sshdexe";
  192. exit 1;
  193. }
  194. #***************************************************************************
  195. # Find out ssh daemon version info
  196. #
  197. my ($sshdid, $sshdvernum, $sshdverstr, $sshderror) = sshversioninfo($sshd);
  198. if(!$sshdid) {
  199. # Not an OpenSSH or SunSSH ssh daemon
  200. logmsg $sshderror if($verbose);
  201. logmsg 'SCP and SFTP tests require OpenSSH 2.9.9 or later';
  202. exit 1;
  203. }
  204. logmsg "ssh server found $sshd is $sshdverstr" if($verbose);
  205. #***************************************************************************
  206. # ssh daemon command line options we might use and version support
  207. #
  208. # -e: log stderr : OpenSSH 2.9.0 and later
  209. # -f: sshd config file : OpenSSH 1.2.1 and later
  210. # -D: no daemon forking : OpenSSH 2.5.0 and later
  211. # -o: command-line option : OpenSSH 3.1.0 and later
  212. # -t: test config file : OpenSSH 2.9.9 and later
  213. # -?: sshd version info : OpenSSH 1.2.1 and later
  214. #
  215. # -e: log stderr : SunSSH 1.0.0 and later
  216. # -f: sshd config file : SunSSH 1.0.0 and later
  217. # -D: no daemon forking : SunSSH 1.0.0 and later
  218. # -o: command-line option : SunSSH 1.0.0 and later
  219. # -t: test config file : SunSSH 1.0.0 and later
  220. # -?: sshd version info : SunSSH 1.0.0 and later
  221. #***************************************************************************
  222. # Verify minimum ssh daemon version
  223. #
  224. if((($sshdid =~ /OpenSSH/) && ($sshdvernum < 299)) ||
  225. (($sshdid =~ /SunSSH/) && ($sshdvernum < 100))) {
  226. logmsg 'SCP and SFTP tests require OpenSSH 2.9.9 or later';
  227. exit 1;
  228. }
  229. #***************************************************************************
  230. # Find out sftp server plugin canonical file name
  231. #
  232. my $sftpsrv = find_sftpsrv();
  233. if(!$sftpsrv) {
  234. logmsg "cannot find $sftpsrvexe";
  235. exit 1;
  236. }
  237. logmsg "sftp server plugin found $sftpsrv" if($verbose);
  238. #***************************************************************************
  239. # Find out sftp client canonical file name
  240. #
  241. my $sftp = find_sftp();
  242. if(!$sftp) {
  243. logmsg "cannot find $sftpexe";
  244. exit 1;
  245. }
  246. logmsg "sftp client found $sftp" if($verbose);
  247. #***************************************************************************
  248. # Find out ssh keygen canonical file name
  249. #
  250. my $sshkeygen = find_sshkeygen();
  251. if(!$sshkeygen) {
  252. logmsg "cannot find $sshkeygenexe";
  253. exit 1;
  254. }
  255. logmsg "ssh keygen found $sshkeygen" if($verbose);
  256. #***************************************************************************
  257. # Find out ssh client canonical file name
  258. #
  259. my $ssh = find_ssh();
  260. if(!$ssh) {
  261. logmsg "cannot find $sshexe";
  262. exit 1;
  263. }
  264. #***************************************************************************
  265. # Find out ssh client version info
  266. #
  267. my ($sshid, $sshvernum, $sshverstr, $ssherror) = sshversioninfo($ssh);
  268. if(!$sshid) {
  269. # Not an OpenSSH or SunSSH ssh client
  270. logmsg $ssherror if($verbose);
  271. logmsg 'SCP and SFTP tests require OpenSSH 2.9.9 or later';
  272. exit 1;
  273. }
  274. logmsg "ssh client found $ssh is $sshverstr" if($verbose);
  275. #***************************************************************************
  276. # ssh client command line options we might use and version support
  277. #
  278. # -D: dynamic app port forwarding : OpenSSH 2.9.9 and later
  279. # -F: ssh config file : OpenSSH 2.9.9 and later
  280. # -N: no shell/command : OpenSSH 2.1.0 and later
  281. # -p: connection port : OpenSSH 1.2.1 and later
  282. # -v: verbose messages : OpenSSH 1.2.1 and later
  283. # -vv: increase verbosity : OpenSSH 2.3.0 and later
  284. # -V: ssh version info : OpenSSH 1.2.1 and later
  285. #
  286. # -D: dynamic app port forwarding : SunSSH 1.0.0 and later
  287. # -F: ssh config file : SunSSH 1.0.0 and later
  288. # -N: no shell/command : SunSSH 1.0.0 and later
  289. # -p: connection port : SunSSH 1.0.0 and later
  290. # -v: verbose messages : SunSSH 1.0.0 and later
  291. # -vv: increase verbosity : SunSSH 1.0.0 and later
  292. # -V: ssh version info : SunSSH 1.0.0 and later
  293. #***************************************************************************
  294. # Verify minimum ssh client version
  295. #
  296. if((($sshid =~ /OpenSSH/) && ($sshvernum < 299)) ||
  297. (($sshid =~ /SunSSH/) && ($sshvernum < 100))) {
  298. logmsg 'SCP and SFTP tests require OpenSSH 2.9.9 or later';
  299. exit 1;
  300. }
  301. #***************************************************************************
  302. # ssh keygen command line options we actually use and version support
  303. #
  304. # -C: identity comment : OpenSSH 1.2.1 and later
  305. # -f: key filename : OpenSSH 1.2.1 and later
  306. # -N: new passphrase : OpenSSH 1.2.1 and later
  307. # -q: quiet keygen : OpenSSH 1.2.1 and later
  308. # -t: key type : OpenSSH 2.5.0 and later
  309. #
  310. # -C: identity comment : SunSSH 1.0.0 and later
  311. # -f: key filename : SunSSH 1.0.0 and later
  312. # -N: new passphrase : SunSSH 1.0.0 and later
  313. # -q: quiet keygen : SunSSH 1.0.0 and later
  314. # -t: key type : SunSSH 1.0.0 and later
  315. #***************************************************************************
  316. # Generate host and client key files for curl's tests
  317. #
  318. if((! -e $hstprvkeyf) || (! -s $hstprvkeyf) ||
  319. (! -e $hstpubkeyf) || (! -s $hstpubkeyf) ||
  320. (! -e $hstpubmd5f) || (! -s $hstpubmd5f) ||
  321. (! -e $cliprvkeyf) || (! -s $cliprvkeyf) ||
  322. (! -e $clipubkeyf) || (! -s $clipubkeyf)) {
  323. # Make sure all files are gone so ssh-keygen doesn't complain
  324. unlink($hstprvkeyf, $hstpubkeyf, $hstpubmd5f, $cliprvkeyf, $clipubkeyf);
  325. logmsg 'generating host keys...' if($verbose);
  326. if(system "\"$sshkeygen\" -q -t rsa -f $hstprvkeyf -C 'curl test server' -N ''") {
  327. logmsg 'Could not generate host key';
  328. exit 1;
  329. }
  330. logmsg 'generating client keys...' if($verbose);
  331. if(system "\"$sshkeygen\" -q -t rsa -f $cliprvkeyf -C 'curl test client' -N ''") {
  332. logmsg 'Could not generate client key';
  333. exit 1;
  334. }
  335. # Make sure that permissions are restricted so openssh doesn't complain
  336. system "chmod 600 $hstprvkeyf";
  337. system "chmod 600 $cliprvkeyf";
  338. # Save md5 hash of public host key
  339. open(RSAKEYFILE, "<$hstpubkeyf");
  340. my @rsahostkey = do { local $/ = ' '; <RSAKEYFILE> };
  341. close(RSAKEYFILE);
  342. if(!$rsahostkey[1]) {
  343. logmsg 'Failed parsing base64 encoded RSA host key';
  344. exit 1;
  345. }
  346. open(PUBMD5FILE, ">$hstpubmd5f");
  347. print PUBMD5FILE md5_hex(decode_base64($rsahostkey[1]));
  348. close(PUBMD5FILE);
  349. if((! -e $hstpubmd5f) || (! -s $hstpubmd5f)) {
  350. logmsg 'Failed writing md5 hash of RSA host key';
  351. exit 1;
  352. }
  353. }
  354. #***************************************************************************
  355. # Convert paths for curl's tests running on Windows with Cygwin/Msys OpenSSH
  356. #
  357. my $clipubkeyf_config = abs_path("$path/$clipubkeyf");
  358. my $hstprvkeyf_config = abs_path("$path/$hstprvkeyf");
  359. my $pidfile_config = $pidfile;
  360. my $sftpsrv_config = $sftpsrv;
  361. if (pathhelp::os_is_win()) {
  362. # Ensure to use MinGW/Cygwin paths
  363. $clipubkeyf_config = pathhelp::build_sys_abs_path($clipubkeyf_config);
  364. $hstprvkeyf_config = pathhelp::build_sys_abs_path($hstprvkeyf_config);
  365. $pidfile_config = pathhelp::build_sys_abs_path($pidfile_config);
  366. $sftpsrv_config = "internal-sftp";
  367. }
  368. if ($sshdid =~ /OpenSSH-Windows/) {
  369. # Ensure to use native Windows paths with OpenSSH for Windows
  370. $clipubkeyf_config = pathhelp::sys_native_abs_path($clipubkeyf);
  371. $hstprvkeyf_config = pathhelp::sys_native_abs_path($hstprvkeyf);
  372. $pidfile_config = pathhelp::sys_native_abs_path($pidfile);
  373. $sftpsrv_config = pathhelp::sys_native_abs_path($sftpsrv);
  374. $sshdconfig = pathhelp::sys_native_abs_path($sshdconfig);
  375. $sshconfig = pathhelp::sys_native_abs_path($sshconfig);
  376. $sftpconfig = pathhelp::sys_native_abs_path($sftpconfig);
  377. }
  378. #***************************************************************************
  379. # ssh daemon configuration file options we might use and version support
  380. #
  381. # AFSTokenPassing : OpenSSH 1.2.1 and later [1]
  382. # AcceptEnv : OpenSSH 3.9.0 and later
  383. # AddressFamily : OpenSSH 4.0.0 and later
  384. # AllowGroups : OpenSSH 1.2.1 and later
  385. # AllowTcpForwarding : OpenSSH 2.3.0 and later
  386. # AllowUsers : OpenSSH 1.2.1 and later
  387. # AuthorizedKeysFile : OpenSSH 2.9.9 and later
  388. # AuthorizedKeysFile2 : OpenSSH 2.9.9 and later
  389. # Banner : OpenSSH 2.5.0 and later
  390. # ChallengeResponseAuthentication : OpenSSH 2.5.0 and later
  391. # Ciphers : OpenSSH 2.1.0 and later [3]
  392. # ClientAliveCountMax : OpenSSH 2.9.0 and later
  393. # ClientAliveInterval : OpenSSH 2.9.0 and later
  394. # Compression : OpenSSH 3.3.0 and later
  395. # DenyGroups : OpenSSH 1.2.1 and later
  396. # DenyUsers : OpenSSH 1.2.1 and later
  397. # ForceCommand : OpenSSH 4.4.0 and later [3]
  398. # GatewayPorts : OpenSSH 2.1.0 and later
  399. # GSSAPIAuthentication : OpenSSH 3.7.0 and later [1]
  400. # GSSAPICleanupCredentials : OpenSSH 3.8.0 and later [1]
  401. # GSSAPIKeyExchange : SunSSH 1.0.0 and later [1]
  402. # GSSAPIStoreDelegatedCredentials : SunSSH 1.0.0 and later [1]
  403. # GSSCleanupCreds : SunSSH 1.0.0 and later [1]
  404. # GSSUseSessionCredCache : SunSSH 1.0.0 and later [1]
  405. # HostbasedAuthentication : OpenSSH 2.9.0 and later
  406. # HostbasedUsesNameFromPacketOnly : OpenSSH 2.9.0 and later
  407. # HostKey : OpenSSH 1.2.1 and later
  408. # IgnoreRhosts : OpenSSH 1.2.1 and later
  409. # IgnoreUserKnownHosts : OpenSSH 1.2.1 and later
  410. # KbdInteractiveAuthentication : OpenSSH 2.3.0 and later
  411. # KeepAlive : OpenSSH 1.2.1 and later
  412. # KerberosAuthentication : OpenSSH 1.2.1 and later [1]
  413. # KerberosGetAFSToken : OpenSSH 3.8.0 and later [1]
  414. # KerberosOrLocalPasswd : OpenSSH 1.2.1 and later [1]
  415. # KerberosTgtPassing : OpenSSH 1.2.1 and later [1]
  416. # KerberosTicketCleanup : OpenSSH 1.2.1 and later [1]
  417. # KeyRegenerationInterval : OpenSSH 1.2.1 and later
  418. # ListenAddress : OpenSSH 1.2.1 and later
  419. # LoginGraceTime : OpenSSH 1.2.1 and later
  420. # LogLevel : OpenSSH 1.2.1 and later
  421. # LookupClientHostnames : SunSSH 1.0.0 and later
  422. # MACs : OpenSSH 2.5.0 and later [3]
  423. # Match : OpenSSH 4.4.0 and later [3]
  424. # MaxAuthTries : OpenSSH 3.9.0 and later
  425. # MaxStartups : OpenSSH 2.2.0 and later
  426. # PAMAuthenticationViaKbdInt : OpenSSH 2.9.0 and later [2]
  427. # PasswordAuthentication : OpenSSH 1.2.1 and later
  428. # PermitEmptyPasswords : OpenSSH 1.2.1 and later
  429. # PermitOpen : OpenSSH 4.4.0 and later [3]
  430. # PermitRootLogin : OpenSSH 1.2.1 and later
  431. # PermitTunnel : OpenSSH 4.3.0 and later
  432. # PermitUserEnvironment : OpenSSH 3.5.0 and later
  433. # PidFile : OpenSSH 2.1.0 and later
  434. # Port : OpenSSH 1.2.1 and later
  435. # PrintLastLog : OpenSSH 2.9.0 and later
  436. # PrintMotd : OpenSSH 1.2.1 and later
  437. # Protocol : OpenSSH 2.1.0 and later
  438. # PubkeyAuthentication : OpenSSH 2.5.0 and later
  439. # RhostsAuthentication : OpenSSH 1.2.1 and later
  440. # RhostsRSAAuthentication : OpenSSH 1.2.1 and later
  441. # RSAAuthentication : OpenSSH 1.2.1 and later
  442. # ServerKeyBits : OpenSSH 1.2.1 and later
  443. # SkeyAuthentication : OpenSSH 1.2.1 and later [1]
  444. # StrictModes : OpenSSH 1.2.1 and later
  445. # Subsystem : OpenSSH 2.2.0 and later
  446. # SyslogFacility : OpenSSH 1.2.1 and later
  447. # TCPKeepAlive : OpenSSH 3.8.0 and later
  448. # UseDNS : OpenSSH 3.7.0 and later
  449. # UseLogin : OpenSSH 1.2.1 and later
  450. # UsePAM : OpenSSH 3.7.0 and later [1][2]
  451. # UsePrivilegeSeparation : OpenSSH 3.2.2 and later
  452. # VerifyReverseMapping : OpenSSH 3.1.0 and later
  453. # X11DisplayOffset : OpenSSH 1.2.1 and later [3]
  454. # X11Forwarding : OpenSSH 1.2.1 and later
  455. # X11UseLocalhost : OpenSSH 3.1.0 and later
  456. # XAuthLocation : OpenSSH 2.1.1 and later [3]
  457. #
  458. # [1] Option only available if activated at compile time
  459. # [2] Option specific for portable versions
  460. # [3] Option not used in our ssh server config file
  461. #***************************************************************************
  462. # Initialize sshd config with options actually supported in OpenSSH 2.9.9
  463. #
  464. logmsg 'generating ssh server config file...' if($verbose);
  465. @cfgarr = ();
  466. push @cfgarr, '# This is a generated file. Do not edit.';
  467. push @cfgarr, "# $sshdverstr sshd configuration file for curl testing";
  468. push @cfgarr, '#';
  469. # AllowUsers and DenyUsers options should use lowercase on Windows
  470. # and do not support quotes around values for some unknown reason.
  471. if ($sshdid =~ /OpenSSH-Windows/) {
  472. my $username_lc = lc $username;
  473. if (exists $ENV{USERDOMAIN}) {
  474. my $userdomain_lc = lc $ENV{USERDOMAIN};
  475. $username_lc = "$userdomain_lc\\$username_lc";
  476. }
  477. $username_lc =~ s/ /\?/g; # replace space with ?
  478. push @cfgarr, "DenyUsers !$username_lc";
  479. push @cfgarr, "AllowUsers $username_lc";
  480. } else {
  481. push @cfgarr, "DenyUsers !$username";
  482. push @cfgarr, "AllowUsers $username";
  483. }
  484. push @cfgarr, 'DenyGroups';
  485. push @cfgarr, 'AllowGroups';
  486. push @cfgarr, '#';
  487. push @cfgarr, "AuthorizedKeysFile $clipubkeyf_config";
  488. push @cfgarr, "AuthorizedKeysFile2 $clipubkeyf_config";
  489. push @cfgarr, "HostKey $hstprvkeyf_config";
  490. if ($sshdid !~ /OpenSSH-Windows/) {
  491. push @cfgarr, "PidFile $pidfile_config";
  492. }
  493. push @cfgarr, '#';
  494. push @cfgarr, "Port $port";
  495. push @cfgarr, "ListenAddress $listenaddr";
  496. push @cfgarr, 'Protocol 2';
  497. push @cfgarr, '#';
  498. push @cfgarr, 'AllowTcpForwarding yes';
  499. push @cfgarr, 'Banner none';
  500. push @cfgarr, 'ChallengeResponseAuthentication no';
  501. push @cfgarr, 'ClientAliveCountMax 3';
  502. push @cfgarr, 'ClientAliveInterval 0';
  503. push @cfgarr, 'GatewayPorts no';
  504. push @cfgarr, 'HostbasedAuthentication no';
  505. push @cfgarr, 'HostbasedUsesNameFromPacketOnly no';
  506. push @cfgarr, 'IgnoreRhosts yes';
  507. push @cfgarr, 'IgnoreUserKnownHosts yes';
  508. push @cfgarr, 'KeyRegenerationInterval 0';
  509. push @cfgarr, 'LoginGraceTime 30';
  510. push @cfgarr, "LogLevel $loglevel";
  511. push @cfgarr, 'MaxStartups 5';
  512. push @cfgarr, 'PasswordAuthentication no';
  513. push @cfgarr, 'PermitEmptyPasswords no';
  514. push @cfgarr, 'PermitRootLogin no';
  515. push @cfgarr, 'PrintLastLog no';
  516. push @cfgarr, 'PrintMotd no';
  517. push @cfgarr, 'PubkeyAuthentication yes';
  518. push @cfgarr, 'RhostsRSAAuthentication no';
  519. push @cfgarr, 'RSAAuthentication no';
  520. push @cfgarr, 'ServerKeyBits 768';
  521. push @cfgarr, 'StrictModes no';
  522. push @cfgarr, "Subsystem sftp \"$sftpsrv_config\"";
  523. push @cfgarr, 'SyslogFacility AUTH';
  524. push @cfgarr, 'UseLogin no';
  525. push @cfgarr, 'X11Forwarding no';
  526. push @cfgarr, '#';
  527. #***************************************************************************
  528. # Write out initial sshd configuration file for curl's tests
  529. #
  530. $error = dump_array($sshdconfig, @cfgarr);
  531. if($error) {
  532. logmsg $error;
  533. exit 1;
  534. }
  535. #***************************************************************************
  536. # Verifies at run time if sshd supports a given configuration file option
  537. #
  538. sub sshd_supports_opt {
  539. my ($option, $value) = @_;
  540. my $err;
  541. #
  542. if((($sshdid =~ /OpenSSH/) && ($sshdvernum >= 310)) ||
  543. ($sshdid =~ /SunSSH/)) {
  544. # ssh daemon supports command line options -t -f and -o
  545. $err = grep /((Unsupported)|(Bad configuration)|(Deprecated)) option.*$option/,
  546. qx("$sshd" -t -f $sshdconfig -o "$option=$value" 2>&1);
  547. return !$err;
  548. }
  549. if(($sshdid =~ /OpenSSH/) && ($sshdvernum >= 299)) {
  550. # ssh daemon supports command line options -t and -f
  551. $err = dump_array($sshdconfig, (@cfgarr, "$option $value"));
  552. if($err) {
  553. logmsg $err;
  554. return 0;
  555. }
  556. $err = grep /((Unsupported)|(Bad configuration)|(Deprecated)) option.*$option/,
  557. qx("$sshd" -t -f $sshdconfig 2>&1);
  558. unlink $sshdconfig;
  559. return !$err;
  560. }
  561. return 0;
  562. }
  563. #***************************************************************************
  564. # Kerberos Authentication support may have not been built into sshd
  565. #
  566. if(sshd_supports_opt('KerberosAuthentication','no')) {
  567. push @cfgarr, 'KerberosAuthentication no';
  568. }
  569. if(sshd_supports_opt('KerberosGetAFSToken','no')) {
  570. push @cfgarr, 'KerberosGetAFSToken no';
  571. }
  572. if(sshd_supports_opt('KerberosOrLocalPasswd','no')) {
  573. push @cfgarr, 'KerberosOrLocalPasswd no';
  574. }
  575. if(sshd_supports_opt('KerberosTgtPassing','no')) {
  576. push @cfgarr, 'KerberosTgtPassing no';
  577. }
  578. if(sshd_supports_opt('KerberosTicketCleanup','yes')) {
  579. push @cfgarr, 'KerberosTicketCleanup yes';
  580. }
  581. #***************************************************************************
  582. # Andrew File System support may have not been built into sshd
  583. #
  584. if(sshd_supports_opt('AFSTokenPassing','no')) {
  585. push @cfgarr, 'AFSTokenPassing no';
  586. }
  587. #***************************************************************************
  588. # S/Key authentication support may have not been built into sshd
  589. #
  590. if(sshd_supports_opt('SkeyAuthentication','no')) {
  591. push @cfgarr, 'SkeyAuthentication no';
  592. }
  593. #***************************************************************************
  594. # GSSAPI Authentication support may have not been built into sshd
  595. #
  596. my $sshd_builtwith_GSSAPI;
  597. if(sshd_supports_opt('GSSAPIAuthentication','no')) {
  598. push @cfgarr, 'GSSAPIAuthentication no';
  599. $sshd_builtwith_GSSAPI = 1;
  600. }
  601. if(sshd_supports_opt('GSSAPICleanupCredentials','yes')) {
  602. push @cfgarr, 'GSSAPICleanupCredentials yes';
  603. }
  604. if(sshd_supports_opt('GSSAPIKeyExchange','no')) {
  605. push @cfgarr, 'GSSAPIKeyExchange no';
  606. }
  607. if(sshd_supports_opt('GSSAPIStoreDelegatedCredentials','no')) {
  608. push @cfgarr, 'GSSAPIStoreDelegatedCredentials no';
  609. }
  610. if(sshd_supports_opt('GSSCleanupCreds','yes')) {
  611. push @cfgarr, 'GSSCleanupCreds yes';
  612. }
  613. if(sshd_supports_opt('GSSUseSessionCredCache','no')) {
  614. push @cfgarr, 'GSSUseSessionCredCache no';
  615. }
  616. push @cfgarr, '#';
  617. #***************************************************************************
  618. # Options that might be supported or not in sshd OpenSSH 2.9.9 and later
  619. #
  620. if(sshd_supports_opt('AcceptEnv','')) {
  621. push @cfgarr, 'AcceptEnv';
  622. }
  623. if(sshd_supports_opt('AddressFamily','any')) {
  624. # Address family must be specified before ListenAddress
  625. splice @cfgarr, 14, 0, 'AddressFamily any';
  626. }
  627. if(sshd_supports_opt('Compression','no')) {
  628. push @cfgarr, 'Compression no';
  629. }
  630. if(sshd_supports_opt('KbdInteractiveAuthentication','no')) {
  631. push @cfgarr, 'KbdInteractiveAuthentication no';
  632. }
  633. if(sshd_supports_opt('KeepAlive','no')) {
  634. push @cfgarr, 'KeepAlive no';
  635. }
  636. if(sshd_supports_opt('LookupClientHostnames','no')) {
  637. push @cfgarr, 'LookupClientHostnames no';
  638. }
  639. if(sshd_supports_opt('MaxAuthTries','10')) {
  640. push @cfgarr, 'MaxAuthTries 10';
  641. }
  642. if(sshd_supports_opt('PAMAuthenticationViaKbdInt','no')) {
  643. push @cfgarr, 'PAMAuthenticationViaKbdInt no';
  644. }
  645. if(sshd_supports_opt('PermitTunnel','no')) {
  646. push @cfgarr, 'PermitTunnel no';
  647. }
  648. if(sshd_supports_opt('PermitUserEnvironment','no')) {
  649. push @cfgarr, 'PermitUserEnvironment no';
  650. }
  651. if(sshd_supports_opt('RhostsAuthentication','no')) {
  652. push @cfgarr, 'RhostsAuthentication no';
  653. }
  654. if(sshd_supports_opt('TCPKeepAlive','no')) {
  655. push @cfgarr, 'TCPKeepAlive no';
  656. }
  657. if(sshd_supports_opt('UseDNS','no')) {
  658. push @cfgarr, 'UseDNS no';
  659. }
  660. if(sshd_supports_opt('UsePAM','no')) {
  661. push @cfgarr, 'UsePAM no';
  662. }
  663. if($sshdid =~ /OpenSSH/) {
  664. # http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6492415
  665. if(sshd_supports_opt('UsePrivilegeSeparation','no')) {
  666. push @cfgarr, 'UsePrivilegeSeparation no';
  667. }
  668. }
  669. if(sshd_supports_opt('VerifyReverseMapping','no')) {
  670. push @cfgarr, 'VerifyReverseMapping no';
  671. }
  672. if(sshd_supports_opt('X11UseLocalhost','yes')) {
  673. push @cfgarr, 'X11UseLocalhost yes';
  674. }
  675. push @cfgarr, '#';
  676. #***************************************************************************
  677. # Write out resulting sshd configuration file for curl's tests
  678. #
  679. $error = dump_array($sshdconfig, @cfgarr);
  680. if($error) {
  681. logmsg $error;
  682. exit 1;
  683. }
  684. #***************************************************************************
  685. # Verify that sshd actually supports our generated configuration file
  686. #
  687. if(system "\"$sshd\" -t -f $sshdconfig > $sshdlog 2>&1") {
  688. logmsg "sshd configuration file $sshdconfig failed verification";
  689. display_sshdlog();
  690. display_sshdconfig();
  691. exit 1;
  692. }
  693. #***************************************************************************
  694. # Generate ssh client host key database file for curl's tests
  695. #
  696. if((! -e $knownhosts) || (! -s $knownhosts)) {
  697. logmsg 'generating ssh client known hosts file...' if($verbose);
  698. unlink($knownhosts);
  699. if(open(RSAKEYFILE, "<$hstpubkeyf")) {
  700. my @rsahostkey = do { local $/ = ' '; <RSAKEYFILE> };
  701. if(close(RSAKEYFILE)) {
  702. if(open(KNOWNHOSTS, ">$knownhosts")) {
  703. print KNOWNHOSTS "$listenaddr ssh-rsa $rsahostkey[1]\n";
  704. if(!close(KNOWNHOSTS)) {
  705. $error = "Error: cannot close file $knownhosts";
  706. }
  707. }
  708. else {
  709. $error = "Error: cannot write file $knownhosts";
  710. }
  711. }
  712. else {
  713. $error = "Error: cannot close file $hstpubkeyf";
  714. }
  715. }
  716. else {
  717. $error = "Error: cannot read file $hstpubkeyf";
  718. }
  719. if($error) {
  720. logmsg $error;
  721. exit 1;
  722. }
  723. }
  724. #***************************************************************************
  725. # Convert paths for curl's tests running on Windows using Cygwin OpenSSH
  726. #
  727. my $identity_config = abs_path("$path/$identity");
  728. my $knownhosts_config = abs_path("$path/$knownhosts");
  729. if (pathhelp::os_is_win()) {
  730. # Ensure to use MinGW/Cygwin paths
  731. $identity_config = pathhelp::build_sys_abs_path($identity_config);
  732. $knownhosts_config = pathhelp::build_sys_abs_path($knownhosts_config);
  733. }
  734. if ($sshdid =~ /OpenSSH-Windows/) {
  735. # Ensure to use native Windows paths with OpenSSH for Windows
  736. $identity_config = pathhelp::sys_native_abs_path($identity);
  737. $knownhosts_config = pathhelp::sys_native_abs_path($knownhosts);
  738. }
  739. #***************************************************************************
  740. # ssh client configuration file options we might use and version support
  741. #
  742. # AddressFamily : OpenSSH 3.7.0 and later
  743. # BatchMode : OpenSSH 1.2.1 and later
  744. # BindAddress : OpenSSH 2.9.9 and later
  745. # ChallengeResponseAuthentication : OpenSSH 2.5.0 and later
  746. # CheckHostIP : OpenSSH 1.2.1 and later
  747. # Cipher : OpenSSH 1.2.1 and later [3]
  748. # Ciphers : OpenSSH 2.1.0 and later [3]
  749. # ClearAllForwardings : OpenSSH 2.9.9 and later
  750. # Compression : OpenSSH 1.2.1 and later
  751. # CompressionLevel : OpenSSH 1.2.1 and later [3]
  752. # ConnectionAttempts : OpenSSH 1.2.1 and later
  753. # ConnectTimeout : OpenSSH 3.7.0 and later
  754. # ControlMaster : OpenSSH 3.9.0 and later
  755. # ControlPath : OpenSSH 3.9.0 and later
  756. # DisableBanner : SunSSH 1.2.0 and later
  757. # DynamicForward : OpenSSH 2.9.0 and later
  758. # EnableSSHKeysign : OpenSSH 3.6.0 and later
  759. # EscapeChar : OpenSSH 1.2.1 and later [3]
  760. # ExitOnForwardFailure : OpenSSH 4.4.0 and later
  761. # ForwardAgent : OpenSSH 1.2.1 and later
  762. # ForwardX11 : OpenSSH 1.2.1 and later
  763. # ForwardX11Trusted : OpenSSH 3.8.0 and later
  764. # GatewayPorts : OpenSSH 1.2.1 and later
  765. # GlobalKnownHostsFile : OpenSSH 1.2.1 and later
  766. # GSSAPIAuthentication : OpenSSH 3.7.0 and later [1]
  767. # GSSAPIDelegateCredentials : OpenSSH 3.7.0 and later [1]
  768. # HashKnownHosts : OpenSSH 4.0.0 and later
  769. # Host : OpenSSH 1.2.1 and later
  770. # HostbasedAuthentication : OpenSSH 2.9.0 and later
  771. # HostKeyAlgorithms : OpenSSH 2.9.0 and later [3]
  772. # HostKeyAlias : OpenSSH 2.5.0 and later [3]
  773. # HostName : OpenSSH 1.2.1 and later
  774. # IdentitiesOnly : OpenSSH 3.9.0 and later
  775. # IdentityFile : OpenSSH 1.2.1 and later
  776. # IgnoreIfUnknown : SunSSH 1.2.0 and later
  777. # KeepAlive : OpenSSH 1.2.1 and later
  778. # KbdInteractiveAuthentication : OpenSSH 2.3.0 and later
  779. # KbdInteractiveDevices : OpenSSH 2.3.0 and later [3]
  780. # LocalCommand : OpenSSH 4.3.0 and later [3]
  781. # LocalForward : OpenSSH 1.2.1 and later [3]
  782. # LogLevel : OpenSSH 1.2.1 and later
  783. # MACs : OpenSSH 2.5.0 and later [3]
  784. # NoHostAuthenticationForLocalhost : OpenSSH 3.0.0 and later
  785. # NumberOfPasswordPrompts : OpenSSH 1.2.1 and later
  786. # PasswordAuthentication : OpenSSH 1.2.1 and later
  787. # PermitLocalCommand : OpenSSH 4.3.0 and later
  788. # Port : OpenSSH 1.2.1 and later
  789. # PreferredAuthentications : OpenSSH 2.5.2 and later
  790. # Protocol : OpenSSH 2.1.0 and later
  791. # ProxyCommand : OpenSSH 1.2.1 and later [3]
  792. # PubkeyAuthentication : OpenSSH 2.5.0 and later
  793. # RekeyLimit : OpenSSH 3.7.0 and later
  794. # RemoteForward : OpenSSH 1.2.1 and later [3]
  795. # RhostsRSAAuthentication : OpenSSH 1.2.1 and later
  796. # RSAAuthentication : OpenSSH 1.2.1 and later
  797. # SendEnv : OpenSSH 3.9.0 and later
  798. # ServerAliveCountMax : OpenSSH 3.8.0 and later
  799. # ServerAliveInterval : OpenSSH 3.8.0 and later
  800. # SmartcardDevice : OpenSSH 2.9.9 and later [1][3]
  801. # StrictHostKeyChecking : OpenSSH 1.2.1 and later
  802. # TCPKeepAlive : OpenSSH 3.8.0 and later
  803. # Tunnel : OpenSSH 4.3.0 and later
  804. # TunnelDevice : OpenSSH 4.3.0 and later [3]
  805. # UsePAM : OpenSSH 3.7.0 and later [1][2][3]
  806. # UsePrivilegedPort : OpenSSH 1.2.1 and later
  807. # User : OpenSSH 1.2.1 and later
  808. # UserKnownHostsFile : OpenSSH 1.2.1 and later
  809. # VerifyHostKeyDNS : OpenSSH 3.8.0 and later
  810. # XAuthLocation : OpenSSH 2.1.1 and later [3]
  811. #
  812. # [1] Option only available if activated at compile time
  813. # [2] Option specific for portable versions
  814. # [3] Option not used in our ssh client config file
  815. #***************************************************************************
  816. # Initialize ssh config with options actually supported in OpenSSH 2.9.9
  817. #
  818. logmsg 'generating ssh client config file...' if($verbose);
  819. @cfgarr = ();
  820. push @cfgarr, '# This is a generated file. Do not edit.';
  821. push @cfgarr, "# $sshverstr ssh client configuration file for curl testing";
  822. push @cfgarr, '#';
  823. push @cfgarr, 'Host *';
  824. push @cfgarr, '#';
  825. push @cfgarr, "Port $port";
  826. push @cfgarr, "HostName $listenaddr";
  827. push @cfgarr, "User $username";
  828. push @cfgarr, 'Protocol 2';
  829. push @cfgarr, '#';
  830. # BindAddress option is not supported by OpenSSH for Windows
  831. if (!($sshdid =~ /OpenSSH-Windows/)) {
  832. push @cfgarr, "BindAddress $listenaddr";
  833. }
  834. push @cfgarr, '#';
  835. push @cfgarr, "IdentityFile $identity_config";
  836. push @cfgarr, "UserKnownHostsFile $knownhosts_config";
  837. push @cfgarr, '#';
  838. push @cfgarr, 'BatchMode yes';
  839. push @cfgarr, 'ChallengeResponseAuthentication no';
  840. push @cfgarr, 'CheckHostIP no';
  841. push @cfgarr, 'ClearAllForwardings no';
  842. push @cfgarr, 'Compression no';
  843. push @cfgarr, 'ConnectionAttempts 3';
  844. push @cfgarr, 'ForwardAgent no';
  845. push @cfgarr, 'ForwardX11 no';
  846. push @cfgarr, 'GatewayPorts no';
  847. push @cfgarr, 'GlobalKnownHostsFile /dev/null';
  848. push @cfgarr, 'HostbasedAuthentication no';
  849. push @cfgarr, 'KbdInteractiveAuthentication no';
  850. push @cfgarr, "LogLevel $loglevel";
  851. push @cfgarr, 'NumberOfPasswordPrompts 0';
  852. push @cfgarr, 'PasswordAuthentication no';
  853. push @cfgarr, 'PreferredAuthentications publickey';
  854. push @cfgarr, 'PubkeyAuthentication yes';
  855. # RSA authentication options are not supported by OpenSSH for Windows
  856. if (!($sshdid =~ /OpenSSH-Windows/)) {
  857. push @cfgarr, 'RhostsRSAAuthentication no';
  858. push @cfgarr, 'RSAAuthentication no';
  859. }
  860. # Disabled StrictHostKeyChecking since it makes the tests fail on my
  861. # OpenSSH_6.0p1 on Debian Linux / Daniel
  862. push @cfgarr, 'StrictHostKeyChecking no';
  863. push @cfgarr, 'UsePrivilegedPort no';
  864. push @cfgarr, '#';
  865. #***************************************************************************
  866. # Options supported in ssh client newer than OpenSSH 2.9.9
  867. #
  868. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 370)) {
  869. push @cfgarr, 'AddressFamily any';
  870. }
  871. if((($sshid =~ /OpenSSH/) && ($sshvernum >= 370)) ||
  872. (($sshid =~ /SunSSH/) && ($sshvernum >= 120))) {
  873. push @cfgarr, 'ConnectTimeout 30';
  874. }
  875. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 390)) {
  876. push @cfgarr, 'ControlMaster no';
  877. }
  878. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 420)) {
  879. push @cfgarr, 'ControlPath none';
  880. }
  881. if(($sshid =~ /SunSSH/) && ($sshvernum >= 120)) {
  882. push @cfgarr, 'DisableBanner yes';
  883. }
  884. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 360)) {
  885. push @cfgarr, 'EnableSSHKeysign no';
  886. }
  887. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 440)) {
  888. push @cfgarr, 'ExitOnForwardFailure yes';
  889. }
  890. if((($sshid =~ /OpenSSH/) && ($sshvernum >= 380)) ||
  891. (($sshid =~ /SunSSH/) && ($sshvernum >= 120))) {
  892. push @cfgarr, 'ForwardX11Trusted no';
  893. }
  894. if(($sshd_builtwith_GSSAPI) && ($sshdid eq $sshid) &&
  895. ($sshdvernum == $sshvernum)) {
  896. push @cfgarr, 'GSSAPIAuthentication no';
  897. push @cfgarr, 'GSSAPIDelegateCredentials no';
  898. if($sshid =~ /SunSSH/) {
  899. push @cfgarr, 'GSSAPIKeyExchange no';
  900. }
  901. }
  902. if((($sshid =~ /OpenSSH/) && ($sshvernum >= 400)) ||
  903. (($sshid =~ /SunSSH/) && ($sshvernum >= 120))) {
  904. push @cfgarr, 'HashKnownHosts no';
  905. }
  906. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 390)) {
  907. push @cfgarr, 'IdentitiesOnly yes';
  908. }
  909. if(($sshid =~ /SunSSH/) && ($sshvernum >= 120)) {
  910. push @cfgarr, 'IgnoreIfUnknown no';
  911. }
  912. if((($sshid =~ /OpenSSH/) && ($sshvernum < 380)) ||
  913. ($sshid =~ /SunSSH/)) {
  914. push @cfgarr, 'KeepAlive no';
  915. }
  916. if((($sshid =~ /OpenSSH/) && ($sshvernum >= 300)) ||
  917. ($sshid =~ /SunSSH/)) {
  918. push @cfgarr, 'NoHostAuthenticationForLocalhost no';
  919. }
  920. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 430)) {
  921. push @cfgarr, 'PermitLocalCommand no';
  922. }
  923. if((($sshid =~ /OpenSSH/) && ($sshvernum >= 370)) ||
  924. (($sshid =~ /SunSSH/) && ($sshvernum >= 120))) {
  925. push @cfgarr, 'RekeyLimit 1G';
  926. }
  927. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 390)) {
  928. push @cfgarr, 'SendEnv';
  929. }
  930. if((($sshid =~ /OpenSSH/) && ($sshvernum >= 380)) ||
  931. (($sshid =~ /SunSSH/) && ($sshvernum >= 120))) {
  932. push @cfgarr, 'ServerAliveCountMax 3';
  933. push @cfgarr, 'ServerAliveInterval 0';
  934. }
  935. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 380)) {
  936. push @cfgarr, 'TCPKeepAlive no';
  937. }
  938. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 430)) {
  939. push @cfgarr, 'Tunnel no';
  940. }
  941. if(($sshid =~ /OpenSSH/) && ($sshvernum >= 380)) {
  942. push @cfgarr, 'VerifyHostKeyDNS no';
  943. }
  944. push @cfgarr, '#';
  945. #***************************************************************************
  946. # Write out resulting ssh client configuration file for curl's tests
  947. #
  948. $error = dump_array($sshconfig, @cfgarr);
  949. if($error) {
  950. logmsg $error;
  951. exit 1;
  952. }
  953. #***************************************************************************
  954. # Initialize client sftp config with options actually supported.
  955. #
  956. logmsg 'generating sftp client config file...' if($verbose);
  957. splice @cfgarr, 1, 1, "# $sshverstr sftp client configuration file for curl testing";
  958. #
  959. for(my $i = scalar(@cfgarr) - 1; $i > 0; $i--) {
  960. if($cfgarr[$i] =~ /^DynamicForward/) {
  961. splice @cfgarr, $i, 1;
  962. next;
  963. }
  964. if($cfgarr[$i] =~ /^ClearAllForwardings/) {
  965. splice @cfgarr, $i, 1, "ClearAllForwardings yes";
  966. next;
  967. }
  968. }
  969. #***************************************************************************
  970. # Write out resulting sftp client configuration file for curl's tests
  971. #
  972. $error = dump_array($sftpconfig, @cfgarr);
  973. if($error) {
  974. logmsg $error;
  975. exit 1;
  976. }
  977. @cfgarr = ();
  978. #***************************************************************************
  979. # Generate client sftp commands batch file for sftp server verification
  980. #
  981. logmsg 'generating sftp client commands file...' if($verbose);
  982. push @cfgarr, 'pwd';
  983. push @cfgarr, 'quit';
  984. $error = dump_array($sftpcmds, @cfgarr);
  985. if($error) {
  986. logmsg $error;
  987. exit 1;
  988. }
  989. @cfgarr = ();
  990. #***************************************************************************
  991. # Prepare command line of ssh server daemon
  992. #
  993. my $cmd = "\"$sshd\" -e -D -f $sshdconfig > $sshdlog 2>&1";
  994. logmsg "SCP/SFTP server listening on port $port" if($verbose);
  995. logmsg "RUN: $cmd" if($verbose);
  996. #***************************************************************************
  997. # Start the ssh server daemon on Windows without forking it
  998. #
  999. if ($sshdid =~ /OpenSSH-Windows/) {
  1000. # Fake pidfile for ssh server on Windows.
  1001. if(open(OUT, ">$pidfile")) {
  1002. print OUT $$ . "\n";
  1003. close(OUT);
  1004. }
  1005. # Flush output.
  1006. $| = 1;
  1007. # Put an "exec" in front of the command so that the child process
  1008. # keeps this child's process ID by being tied to the spawned shell.
  1009. exec("exec $cmd") || die "Can't exec() $cmd: $!";
  1010. # exec() will create a new process, but ties the existence of the
  1011. # new process to the parent waiting perl.exe and sh.exe processes.
  1012. # exec() should never return back here to this process. We protect
  1013. # ourselves by calling die() just in case something goes really bad.
  1014. die "error: exec() has returned";
  1015. }
  1016. #***************************************************************************
  1017. # Start the ssh server daemon without forking it
  1018. #
  1019. my $rc = system($cmd);
  1020. if($rc == -1) {
  1021. logmsg "\"$sshd\" failed with: $!";
  1022. }
  1023. elsif($rc & 127) {
  1024. logmsg sprintf("\"$sshd\" died with signal %d, and %s coredump",
  1025. ($rc & 127), ($rc & 128)?'a':'no');
  1026. }
  1027. elsif($verbose && ($rc >> 8)) {
  1028. logmsg sprintf("\"$sshd\" exited with %d", $rc >> 8);
  1029. }
  1030. #***************************************************************************
  1031. # Clean up once the server has stopped
  1032. #
  1033. unlink($hstprvkeyf, $hstpubkeyf, $hstpubmd5f,
  1034. $cliprvkeyf, $clipubkeyf, $knownhosts,
  1035. $sshdconfig, $sshconfig, $sftpconfig);
  1036. exit 0;