1# $OpenBSD: dropbear-kex.sh,v 1.4 2025/03/11 07:42:08 dtucker Exp $ 2# Placed in the Public Domain. 3 4tid="dropbear kex" 5 6if test "x$REGRESS_INTEROP_DROPBEAR" != "xyes" ; then 7 skip "dropbear interop tests not enabled" 8fi 9 10cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak 11 12kex="curve25519-sha256 curve25519-sha256@libssh.org" 13if $SSH -Q kex | grep 'diffie-hellman-group14-sha256' >/dev/null; then 14 kex="$kex diffie-hellman-group14-sha256" 15fi 16# There's no flag to query KEX, so if MACs does not contain SHA1, assume 17# there's also SHA1-based KEX methods either. 18if $SSH -Q kex | grep 'diffie-hellman-group14-sha1' >/dev/null && \ 19 $DBCLIENT -m help hst 2>&1 | grep -- '-sha1' >/dev/null ; then 20 kex="$kex diffie-hellman-group14-sha1" 21fi 22 23for k in $kex; do 24 verbose "$tid: kex $k" 25 rm -f ${COPY} 26 # dbclient doesn't have switch for kex, so force in server 27 (cat $OBJ/sshd_proxy.bak; echo "KexAlgorithms $k") >$OBJ/sshd_proxy 28 env HOME=$OBJ \ 29 ${DBCLIENT} -y -i $OBJ/.dropbear/id_ed25519 2>$OBJ/dbclient.log \ 30 -J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY} 31 if [ $? -ne 0 ]; then 32 fail "ssh cat $DATA failed" 33 fi 34 cmp ${DATA} ${COPY} || fail "corrupted copy" 35done 36rm -f ${COPY} 37