Skip to content

Fix test configuration for MLDSA composites and restore type discrimination checks #1266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stenslae wants to merge 1 commit into
base: master
Choose a base branch
from
+89 −6
Open

Fix test configuration for MLDSA composites and restore type discrimination checks #1266

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
95 changes: 89 additions & 6 deletions apps/wolfsshd/test/test_configuration.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,18 @@ void Log(const char *const fmt, ...)
va_end(vlist);
}

/* The default library callback writes to stdout, which interleaves badly with
* the buffered test output above; send library logs to stderr too. Debug lines
* are dropped: tests that drive expected rejections emit one per failure,
* splicing into the scenario lines this file leaves open until the verdict. */
static void TestLoggingCb(enum wolfSSH_LogLevel level,
const char *const msgStr)
{
if (level > WS_LOG_DEBUG) {
fprintf(stderr, "[%d] %s\n", (int)level, msgStr);
}
}

static void CleanupWildcardTest(void)
{
WDIR dir;
Expand Down Expand Up @@ -2995,6 +3007,10 @@ static word32 BuildWireKeyBlob(const char* type, const byte* payload,
return blobSz;
}

/* OpenSSH maps these RSA SHA-2 signature names onto ssh-rsa; mirrors
* AuthKeysTokenKeyType() in apps/wolfsshd/auth.c. */
static const char* const rsaAliases[] = { "rsa-sha2-256", "rsa-sha2-512" };

/* Build a mutable "<type> <base64(key)>" line; WSTRTOK mutates in place. */
static int BuildAuthKeysLineType(const char* type, const byte* key,
word32 keySz, char* lineOut, word32 lineOutSz)
Expand Down Expand Up @@ -3082,6 +3098,7 @@ static int test_CheckAuthKeysLineTypes(void)
#endif
#endif
#endif
#ifndef WOLFSSH_NO_MLDSA_COMPOSITES
#if !defined(WOLFSSH_NO_MLDSA44) && !defined(WOLFSSH_NO_ECDSA_SHA2_NISTP256)
"ssh-mldsa44-es256@wolfssl.com",
#endif
Expand All @@ -3104,6 +3121,7 @@ static int test_CheckAuthKeysLineTypes(void)
#if !defined(WOLFSSH_NO_MLDSA87) && defined(HAVE_ED448)
"ssh-mldsa87-ed448@wolfssl.com",
#endif
#endif /* !WOLFSSH_NO_MLDSA_COMPOSITES */
};
static const char keyAStr[] = "wolfssh-auth-key-test-A-AAAAAAA";
const byte* keyA = (const byte*)keyAStr;
Expand All @@ -3113,11 +3131,14 @@ static int test_CheckAuthKeysLineTypes(void)
word32 blobSz;
char line[256];
char lineCopy[256];
word32 i;
const word32 numTypes = (word32)(sizeof(types) / sizeof(types[0]));
const word32 numAliases = (word32)(sizeof(rsaAliases)
/ sizeof(rsaAliases[0]));
word32 i, j;
int ret = WS_SUCCESS;
int rc;

for (i = 0; i < (word32)(sizeof(types) / sizeof(types[0])); i++) {
for (i = 0; i < numTypes; i++) {
blobSz = BuildWireKeyBlob(types[i], keyA, keySz, blob, sizeof(blob));
if (blobSz == 0) {
Log(" CheckAuthKeysLine type %s: blob build failed.\n",
Expand All @@ -3143,13 +3164,75 @@ static int test_CheckAuthKeysLineTypes(void)
Log(" FAILED (rc=%d).\n", rc);
return WS_FATAL_ERROR;
}

/* Other types must reject this blob to catch prefix collisions. */
if (numTypes < 2) {
Log(" Skipping scenario: only one key type built, nothing to "
"reject %s blob against.\n", types[i]);
continue;
}
Log(" Testing scenario: all other types rejected "
"against %s blob.", types[i]);
for (j = 0; j < numTypes; j++) {
if (i == j) {
continue;
}
ret = BuildAuthKeysLineType(types[j], blob, blobSz, line,
sizeof(line));
if (ret != WS_SUCCESS) {
Log(" build of %s FAILED (ret=%d).\n", types[j], ret);
return ret;
}
WMEMCPY(lineCopy, line, WSTRLEN(line) + 1);
rc = CheckAuthKeysLine(lineCopy, (word32)WSTRLEN(lineCopy),
blob, blobSz, 0);
if (rc != WSSHD_AUTH_FAILURE) {
Log(" %s not rejected FAILED (rc=%d).\n", types[j], rc);
return WS_FATAL_ERROR;
}
}
Log(" PASSED.\n");
}

/* Reject line token naming a different key type. */
/* The alias maps to ssh-rsa only: a non-RSA blob must still be rejected. */
blobSz = BuildWireKeyBlob("ecdsa-sha2-nistp256", keyA, keySz, blob,
sizeof(blob));
if (blobSz == 0) {
return WS_BUFFER_E;
}
for (i = 0; i < numAliases; i++) {
const char* sigType = rsaAliases[i];

ret = BuildAuthKeysLineType(sigType, blob, blobSz, line,
sizeof(line));
if (ret != WS_SUCCESS) {
Log(" CheckAuthKeysLine type %s: build failed.\n", sigType);
return ret;
}
Log(" Testing scenario: %s token rejects an "
"ecdsa-sha2-nistp256 blob.", sigType);
WMEMCPY(lineCopy, line, WSTRLEN(line) + 1);
rc = CheckAuthKeysLine(lineCopy, (word32)WSTRLEN(lineCopy),
blob, blobSz, 0);
if (rc == WSSHD_AUTH_FAILURE) {
Log(" PASSED.\n");
}
else {
Log(" FAILED (rc=%d).\n", rc);
return WS_FATAL_ERROR;
}
}

/* The acceptance direction of the alias is covered by
* test_CheckAuthKeysLine(). */

/* Used by the mismatched-token case below. */
blobSz = BuildWireKeyBlob("ssh-rsa", keyA, keySz, blob, sizeof(blob));
if (blobSz == 0) {
return WS_BUFFER_E;
}

/* Reject line token naming a different key type. */
ret = BuildAuthKeysLineType("ssh-bogus-type", blob, blobSz, line,
sizeof(line));
if (ret != WS_SUCCESS) {
Expand Down Expand Up @@ -3399,9 +3482,7 @@ static int test_CheckAuthKeysLine(void)
}

if (ret == WS_SUCCESS) {
/* OpenSSH maps an RSA SHA-2 signature name onto ssh-rsa, so these
* lines authenticate an ssh-rsa key there and must here too. */
static const char* rsaAliases[] = { "rsa-sha2-256", "rsa-sha2-512" };
/* An RSA SHA-2 alias line authenticates an ssh-rsa key. */
word32 i;

for (i = 0; i < (word32)(sizeof(rsaAliases) / sizeof(rsaAliases[0]));
Expand Down Expand Up @@ -7285,6 +7366,8 @@ int main(int argc, char** argv)
(void)argc;
(void)argv;

wolfSSH_SetLoggingCb(TestLoggingCb);

CleanupWildcardTest();
ret = SetupWildcardTest();

Expand Down
Loading