romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 01:33:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

runtests: fix test key format for libssh2 WinCNG (and others)

Browse source 
SFTP/SCP tests were failing in CI with WinCNG libssh2 since we first
added such job. With `curl: (67) Authentication failure`.

The reason is that the default `ssh-keygen` RSA private key format
changed to OpenSSH (RFC4716) in 2018. libssh2 does not support this
format with some of its crypto backends.

Fix it by generating keys explicitly in PEM format as necessary via
the `-m` option. This format is universally recognized for RSA keys.

2018-08-24: https://www.openssh.com/txt/release-7.8: OpenSSH format becomes default
2010-08-23: https://www.openssh.com/txt/release-5.6: `-m` option first supported

This fixed the auth issue, just to reveal a known flakiness issue in
libssh2 + WinCNG, causing:
```
curl: (2) Failure establishing ssh session: -8, Unable to exchange encryption keys
```
Ref: https://github.com/curl/curl/actions/runs/14000494428/job/39205633258?pr=16781#step:15:1796
Tracked here: https://github.com/libssh2/libssh2/issues/804
Mitigated in libssh2 tests by retrying them.

Due to this, keep ignoring these test results.

Also:
- add an env to customize key format: `CURL_TEST_SSH_KEY_FORMAT`
- display the generated format in the log.
- GHA/linux: document the wolfSSH error code causing it to fail tests:
  ```
  curl: (79) wolfssh SFTP connect error -1051 / WS_MATCH_KEY_ALGO_E / cannot match key algo with peer
  ```

Follow-up to 4911e7af11 #16735
Follow-up to 0ec72c1ef8 #16672
Follow-up to e53523fef0 #14859
Follow-up to e26cbe20cb #13979

Closes #16781
This commit is contained in:
Viktor Szakats 2025-03-21 11:48:27 +01:00
parent dd0c9feb54
commit 89f306ae40
No known key found for this signature in database
GPG key ID: B5ABD165E2AEF201
4 changed files with 40 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

21
tests/sshserver.pl
View file

@ -60,6 +60,7 @@ use sshhelp qw(
$hstpubsha256f
$cliprvkeyf
$clipubkeyf
display_file_top
display_sshdconfig
display_sshconfig
display_sftpconfig
@ -408,16 +409,32 @@ if((! -e pp($hstprvkeyf)) || (! -s pp($hstprvkeyf)) ||
# Make sure all files are gone so ssh-keygen doesn't complain
unlink(pp($hstprvkeyf), pp($hstpubkeyf), pp($hstpubmd5f),
pp($hstpubsha256f), pp($cliprvkeyf), pp($clipubkeyf));
my $sshkeygenopt = '';
if(($sshid =~ /OpenSSH/) && ($sshvernum >= 560)) {
# Override the default key format. Necessary to force legacy PEM format
# for libssh2 crypto backends that do not understand the OpenSSH (RFC4716)
# format, e.g. WinCNG.
# Accepted values: RFC4716, PKCS8, PEM (see also 'man ssh-keygen')
if($ENV{'CURL_TEST_SSH_KEY_FORMAT'}) {
$sshkeygenopt .= ' -m ' . $ENV{'CURL_TEST_SSH_KEY_FORMAT'};
}
else {
$sshkeygenopt .= ' -m PEM'; # Use the most compatible RSA format for tests.
}
}
logmsg "generating host keys...\n" if($verbose);
if(system "\"$sshkeygen\" -q -t rsa -f " . pp($hstprvkeyf) . " -C 'curl test server' -N ''") {
if(system "\"$sshkeygen\" -q -t rsa -f " . pp($hstprvkeyf) . " -C 'curl test server' -N ''" . $sshkeygenopt) {
logmsg "Could not generate host key\n";
exit 1;
}
display_file_top(pp($hstprvkeyf));
logmsg "generating client keys...\n" if($verbose);
if(system "\"$sshkeygen\" -q -t rsa -f " . pp($cliprvkeyf) . " -C 'curl test client' -N ''") {
if(system "\"$sshkeygen\" -q -t rsa -f " . pp($cliprvkeyf) . " -C 'curl test client' -N ''" . $sshkeygenopt) {
logmsg "Could not generate client key\n";
exit 1;
}
display_file_top(pp($cliprvkeyf));
# Make sure that permissions are restricted so openssh doesn't complain
system "chmod 600 " . pp($hstprvkeyf);
system "chmod 600 " . pp($cliprvkeyf);