1#!/bin/sh 2# 3# usage: configs vmname test_config (or '' for default) 4# 5# Sets the following variables: 6# CONFIGFLAGS options to ./configure 7# SSHD_CONFOPTS sshd_config options 8# TEST_TARGET make target used when testing. defaults to "tests". 9# LTESTS 10 11config=$1 12if [ "$config" = "" ]; then 13 config="default" 14fi 15 16if [ ! -z "${LTESTS}" ]; then 17 OVERRIDE_LTESTS="${LTESTS}" 18fi 19 20unset CC CFLAGS CPPFLAGS LDFLAGS LTESTS SUDO 21 22TEST_TARGET="tests compat-tests" 23LTESTS="" 24SKIP_LTESTS="" 25SUDO=sudo # run with sudo by default 26TEST_SSH_UNSAFE_PERMISSIONS=1 27# Stop on first test failure to minimize logs 28TEST_SSH_FAIL_FATAL=yes 29 30CONFIGFLAGS="" 31LIBCRYPTOFLAGS="" 32 33case "$config" in 34 default|sol64) 35 ;; 36 c89) 37 # If we don't have LLONG_MAX, configure will figure out that it can 38 # get it by setting -std=gnu99, at which point we won't be testing 39 # C89 any more. To avoid this, feed it in via CFLAGS. 40 llong_max=`gcc -E -dM - </dev/null | \ 41 awk '$2=="__LONG_LONG_MAX__"{print $3}'` 42 CPPFLAGS="-DLLONG_MAX=${llong_max}" 43 44 CC="gcc" 45 CFLAGS="-Wall -std=c89 -pedantic -Werror=vla" 46 CONFIGFLAGS="--without-zlib" 47 LIBCRYPTOFLAGS="--without-openssl" 48 TEST_TARGET=t-exec 49 ;; 50 cygwin-release) 51 # See https://cygwin.com/git/?p=git/cygwin-packages/openssh.git;a=blob;f=openssh.cygport;hb=HEAD 52 CONFIGFLAGS="--with-xauth=/usr/bin/xauth --with-security-key-builtin" 53 CONFIGFLAGS="$CONFIGFLAGS --with-kerberos5=/usr --with-libedit --disable-strip" 54 ;; 55 clang-12-Werror) 56 CC="clang-12" 57 # clang's implicit-fallthrough requires that the code be annotated with 58 # __attribute__((fallthrough)) and does not understand /* FALLTHROUGH */ 59 CFLAGS="-Wall -Wextra -O2 -Wno-error=implicit-fallthrough -Wno-error=unused-parameter" 60 CONFIGFLAGS="--with-pam --with-Werror" 61 ;; 62 *-sanitize-*) 63 case "$config" in 64 gcc-*) 65 CC=gcc 66 ;; 67 clang-*) 68 # Find the newest available version of clang 69 for i in `seq 10 99`; do 70 clang="`which clang-$i 2>/dev/null`" 71 [ -x "$clang" ] && CC="$clang" 72 done 73 ;; 74 esac 75 # Put Sanitizer logs in regress dir. 76 SANLOGS=`pwd`/regress 77 # - We replace chroot with chdir so that the sanitizer in the preauth 78 # privsep process can read /proc. 79 # - clang does not recognizes explicit_bzero so we use bzero 80 # (see https://github.com/google/sanitizers/issues/1507 81 # - openssl and zlib trip ASAN. 82 # - sp_pwdp returned by getspnam trips ASAN, hence disabling shadow. 83 case "$config" in 84 *-sanitize-address) 85 CFLAGS="-fsanitize=address -fno-omit-frame-pointer" 86 LDFLAGS="-fsanitize=address" 87 CPPFLAGS='-Dchroot=chdir -Dexplicit_bzero=bzero -D_FORTIFY_SOURCE=0 -DASAN_OPTIONS=\"detect_leaks=0:log_path='$SANLOGS'/asan.log\"' 88 CONFIGFLAGS="" 89 TEST_TARGET="t-exec" 90 ;; 91 clang-sanitize-memory) 92 CFLAGS="-fsanitize=memory -fsanitize-memory-track-origins -fno-omit-frame-pointer" 93 LDFLAGS="-fsanitize=memory" 94 CPPFLAGS='-Dchroot=chdir -Dexplicit_bzero=bzero -DMSAN_OPTIONS=\"log_path='$SANLOGS'/msan.log\"' 95 CONFIGFLAGS="--without-zlib --without-shadow" 96 LIBCRYPTOFLAGS="--without-openssl" 97 TEST_TARGET="t-exec" 98 ;; 99 *-sanitize-undefined) 100 CFLAGS="-fsanitize=undefined" 101 LDFLAGS="-fsanitize=undefined" 102 ;; 103 *) 104 echo unknown sanitize option; 105 exit 1;; 106 esac 107 features="--disable-security-key --disable-pkcs11" 108 hardening="--without-sandbox --without-hardening --without-stackprotect" 109 privsep="--with-privsep-user=root" 110 CONFIGFLAGS="$CONFIGFLAGS $features $hardening $privsep" 111 # Because we hobble chroot we can't test it. 112 SKIP_LTESTS=sftp-chroot 113 ;; 114 gcc-11-Werror) 115 CC="gcc-11" 116 # -Wnoformat-truncation in gcc 7.3.1 20180130 fails on fmt_scaled 117 # -Wunused-result ignores (void) so is not useful. See 118 # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 119 CFLAGS="-O2 -Wno-format-truncation -Wimplicit-fallthrough=4 -Wno-unused-parameter -Wno-unused-result" 120 CONFIGFLAGS="--with-pam --with-Werror" 121 ;; 122 gcc-12-Werror) 123 CC="gcc-12" 124 # -Wnoformat-truncation in gcc 7.3.1 20180130 fails on fmt_scaled 125 # -Wunused-result ignores (void) so is not useful. See 126 # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 127 CFLAGS="-O2 -Wno-format-truncation -Wimplicit-fallthrough=4 -Wno-unused-parameter -Wno-unused-result" 128 CONFIGFLAGS="--with-pam --with-Werror" 129 ;; 130 clang*|gcc*) 131 CC="$config" 132 ;; 133 kitchensink) 134 CONFIGFLAGS="--with-kerberos5 --with-libedit --with-pam" 135 CONFIGFLAGS="${CONFIGFLAGS} --with-security-key-builtin --with-selinux" 136 CONFIGFLAGS="${CONFIGFLAGS} --with-linux-memlock-onfault" 137 CONFIGFLAGS="${CONFIGFLAGS} --with-audit=debug" 138 CFLAGS="-DSK_DEBUG -DSANDBOX_SECCOMP_FILTER_DEBUG" 139 EXTRA_TESTS="gss-auth" 140 ;; 141 hardenedmalloc) 142 CONFIGFLAGS="--with-ldflags=-lhardened_malloc" 143 ;; 144 tcmalloc) 145 CONFIGFLAGS="--with-ldflags=-ltcmalloc" 146 # tcmalloc may, depending on the stacktrace generator it uses, create 147 # pipe(2) fds during shared library initialisation. These will later 148 # get clobbered by ssh/sshd calling closefrom() and chaos will ensue. 149 # Tell tcmalloc to use an unwinder that doesn't pull this stuff. 150 TCMALLOC_STACKTRACE_METHOD=generic_fp 151 TEST_SSH_SSHD_ENV="TCMALLOC_STACKTRACE_METHOD=generic_fp" 152 export TCMALLOC_STACKTRACE_METHOD TEST_SSH_SSHD_ENV 153 154 SKIP_LTESTS="agent-restrict" 155 ;; 156 krb5|heimdal) 157 CONFIGFLAGS="--with-kerberos5" 158 EXTRA_TESTS="gss-auth" 159 ;; 160 libedit) 161 CONFIGFLAGS="--with-libedit" 162 ;; 163 musl) 164 CC="musl-gcc" 165 CONFIGFLAGS="--without-zlib" 166 LIBCRYPTOFLAGS="--without-openssl" 167 TEST_TARGET="t-exec" 168 ;; 169 pam-krb5) 170 CONFIGFLAGS="--with-pam --with-kerberos5" 171 SSHD_CONFOPTS="UsePam yes" 172 EXTRA_TESTS="gss-auth" 173 ;; 174 *pam) 175 CONFIGFLAGS="--with-pam" 176 SSHD_CONFOPTS="UsePam yes" 177 ;; 178 boringssl) 179 CONFIGFLAGS="--disable-pkcs11" 180 LIBCRYPTOFLAGS="--with-ssl-dir=/opt/boringssl" 181 ;; 182 aws-lc) 183 LIBCRYPTOFLAGS="--with-ssl-dir=/opt/aws-lc --with-rpath=-Wl,-rpath," 184 ;; 185 libressl-*) 186 LIBCRYPTOFLAGS="--with-ssl-dir=/opt/libressl --with-rpath=-Wl,-rpath," 187 ;; 188 dropbear-*) 189 CONFIGFLAGS="--with-dbclient=/usr/local/bin/plink --with-dropbear=/usr/local/sbin/dropbear" 190 # We don't need to rerun the regular tests, just the interop ones. 191 TEST_TARGET=interop-tests 192 ;; 193 putty-*) 194 CONFIGFLAGS="--with-plink=/usr/local/bin/plink --with-puttygen=/usr/local/bin/puttygen" 195 # We don't need to rerun the regular tests, just the interop ones. 196 TEST_TARGET=interop-tests 197 ;; 198 openssl-*) 199 LIBCRYPTOFLAGS="--with-ssl-dir=/opt/openssl --with-rpath=-Wl,-rpath," 200 # OpenSSL 1.1.1 specifically has a bug in its RNG that breaks reexec 201 # fallback. See https://bugzilla.mindrot.org/show_bug.cgi?id=3483 202 if [ "$config" = "openssl-1.1.1" ]; then 203 SKIP_LTESTS="reexec" 204 fi 205 ;; 206 selinux) 207 CONFIGFLAGS="--with-selinux --with-audit=linux" 208 ;; 209 sk) 210 CONFIGFLAGS="--with-security-key-builtin --with-security-key-standalone" 211 ;; 212 without-openssl) 213 LIBCRYPTOFLAGS="--without-openssl" 214 TEST_TARGET=t-exec 215 ;; 216 valgrind-[1-4]|valgrind-unit|valgrind-pam-1) 217 # rlimit sandbox and FORTIFY_SOURCE confuse Valgrind. 218 CONFIGFLAGS="--without-sandbox --without-hardening" 219 CONFIGFLAGS="$CONFIGFLAGS --with-cppflags=-D_FORTIFY_SOURCE=0" 220 if [ "${config}" = "valgrind-pam-1" ]; then 221 CONFIGFLAGS="$CONFIGFLAGS --with-pam" 222 SSHD_CONFOPTS="UsePam yes" 223 fi 224 TEST_TARGET="t-exec USE_VALGRIND=1" 225 TEST_SSH_ELAPSED_TIMES=1 226 export TEST_SSH_ELAPSED_TIMES 227 # Valgrind slows things down enough that the agent timeout test 228 # won't reliably pass, and the unit tests run longer than allowed 229 # by github so split into separate tests. 230 tests2="integrity try-ciphers rekey" 231 tests3="krl forward-control sshsig agent-restrict kextype sftp" 232 tests4="cert-userkey cert-hostkey kextype sftp-perm keygen-comment percent" 233 case "$config" in 234 valgrind-1|valgrind-pam) 235 # All tests except agent-timeout (which is flaky under valgrind), 236 # connection-timeout (which doesn't work since it's so slow) 237 # and hostbased (since valgrind won't let ssh exec keysign). 238 # Slow ones are run separately to increase parallelism. 239 SKIP_LTESTS="agent-timeout connection-timeout hostbased" 240 SKIP_LTESTS="$SKIP_LTESTS penalty-expire" 241 SKIP_LTESTS="$SKIP_LTESTS ${tests2} ${tests3} ${tests4} ${tests5}" 242 ;; 243 valgrind-2) 244 LTESTS="${tests2}" 245 ;; 246 valgrind-3) 247 LTESTS="${tests3}" 248 ;; 249 valgrind-4) 250 LTESTS="${tests4}" 251 ;; 252 valgrind-unit) 253 TEST_TARGET="unit USE_VALGRIND=1" 254 ;; 255 esac 256 ;; 257 zlib-develop) 258 INSTALL_ZLIB=develop 259 CONFIGFLAGS="--with-zlib=/opt/zlib --with-rpath=-Wl,-rpath," 260 ;; 261 *) 262 echo "Unknown configuration $config" 263 exit 1 264 ;; 265esac 266 267# The Solaris 64bit targets are special since they need a non-flag arg. 268case "$config" in 269 sol64*) 270 CONFIGFLAGS="--target=x86_64 --with-cflags=-m64 --with-ldflags=-m64 ${CONFIGFLAGS}" 271 LIBCRYPTOFLAGS="--with-ssl-dir=/usr/local/ssl64 --with-rpath=-Wl,-rpath," 272 ;; 273esac 274 275case "${TARGET_HOST}" in 276 aix*) 277 CONFIGFLAGS="--disable-security-key" 278 LIBCRYPTOFLAGS="--without-openssl" 279 # These are slow real or virtual machines so skip the slowest tests 280 # (which tend to be thw ones that transfer lots of data) so that the 281 # test run does not time out. 282 # The agent-restrict test fails due to some quoting issue when run 283 # with sh or ksh so specify bash for now. 284 TEST_TARGET="t-exec unit TEST_SHELL=bash" 285 SKIP_LTESTS="rekey sftp" 286 ;; 287 dfly58*|dfly60*) 288 # scp 3-way connection hangs on these so skip until sorted. 289 SKIP_LTESTS=scp3 290 ;; 291 fbsd6) 292 # Native linker is not great with PIC so OpenSSL is built w/out. 293 CONFIGFLAGS="${CONFIGFLAGS} --disable-security-key" 294 ;; 295 fbsd14-ppc64|nbsd-arm64be) 296 # Disable security key tests for bigendian interop test. 297 CONFIGFLAGS="${CONFIGFLAGS} --disable-security-key" 298 ;; 299 hurd) 300 SKIP_LTESTS="forwarding multiplex proxy-connect hostkey-agent agent-ptrace" 301 ;; 302 minix3) 303 CONFIGFLAGS="${CONFIGFLAGS} --disable-security-key" 304 # Unix domain sockets don't work quite like we expect, so also 305 # disable FD passing (and thus multiplexing). 306 CONFIGFLAGS="${CONFIGFLAGS} --disable-fd-passing" 307 LIBCRYPTOFLAGS="--without-openssl" 308 309 # Minix does not have a loopback interface so we have to skip any 310 # test that relies on one. 311 # Also, Minix seems to be very limited in the number of select() 312 # calls that can be operating concurrently, so prune additional tests for that. 313 T="addrmatch agent-restrict brokenkeys cfgmatch cfgmatchlisten cfgparse 314 connect connect-uri dynamic-forward exit-status forwarding 315 forward-control 316 hostkey-agent key-options keyscan knownhosts-command login-timeout 317 reconfigure reexec rekey scp scp-uri scp3 sftp sftp-badcmds 318 sftp-batch sftp-cmds sftp-glob sftp-perm sftp-uri stderr-data 319 transfer penalty penalty-expire" 320 SKIP_LTESTS="$(echo $T)" 321 TEST_TARGET=t-exec 322 SUDO="" 323 ;; 324 nbsd4) 325 # System compiler will ICE on some files with fstack-protector 326 # SHA256 functions in sha2.h conflict with OpenSSL's breaking sk-dummy 327 CONFIGFLAGS="${CONFIGFLAGS} --without-hardening --disable-security-key" 328 ;; 329 openwrt-mipsel) 330 # Test most of the flags that OpenWRT sets for their package build. 331 # We only do this on one OpenWRT target for better coverage. 332 # The installed shared libraries installed by default are stripped and 333 # can't be linked to on the target systems. 334 OPENWRT_FLAGS="--disable-strip --disable-lastlog 335 --disable-utmp --disable-utmpx --disable-wtmp --disable-wtmpx 336 --with-stackprotect --with-cflags-after=-fzero-call-used-regs=skip" 337 CONFIGFLAGS="${CONFIGFLAGS} $(echo ${OPENWRT_FLAGS}) --without-zlib --disable-security-key" 338 LIBCRYPTOFLAGS="--without-openssl" 339 TEST_TARGET="t-exec" 340 ;; 341 openwrt-*) 342 CONFIGFLAGS="${CONFIGFLAGS} --without-zlib --disable-security-key" 343 LIBCRYPTOFLAGS="--without-openssl" 344 TEST_TARGET="t-exec" 345 ;; 346 sol10|sol11) 347 # sol10 VM is 32bit and the unit tests are slow. 348 # sol11 has 4 test configs so skip unit tests to speed up. 349 TEST_TARGET="tests SKIP_UNIT=1" 350 ;; 351 win10) 352 # No sudo on Windows. 353 SUDO="" 354 ;; 355esac 356 357host=`./config.guess` 358case "$host" in 359*cygwin) 360 SUDO="" 361 # Don't run compat tests on cygwin as they don't currently compile. 362 TEST_TARGET="tests" 363 ;; 364*-darwin*) 365 # Unless specified otherwise, build without OpenSSL on Mac OS since 366 # modern versions don't ship with libcrypto. 367 LIBCRYPTOFLAGS="--without-openssl" 368 TEST_TARGET=t-exec 369 370 # On some OS X runners we can't write to /var/empty. 371 CONFIGFLAGS="${CONFIGFLAGS} --with-privsep-path=/usr/local/empty" 372 373 case "$host" in 374 *-darwin22.*) 375 # sudo -S nobody doesn't work on macos 13 for some reason. 376 SKIP_LTESTS="agent-getpeereid" ;; 377 esac 378 ;; 379*-solaris2.10) 380 # Only the sol10 VM has BSM libraries installed, so add that to 381 # the PAM test config. 382 if [ "${config}" = "pam" ]; then 383 CONFIGFLAGS="${CONFIGFLAGS} --with-audit=bsm" 384 fi 385 ;; 386esac 387 388# Unless specifically configured, search for a suitable version of OpenSSL, 389# otherwise build without it. 390if [ -z "${LIBCRYPTOFLAGS}" ]; then 391 LIBCRYPTOFLAGS="--without-openssl" 392 # last-match 393 for i in /usr /usr/local /usr/local/ssl /usr/local/opt/openssl; do 394 ver="none" 395 if [ -x ${i}/bin/openssl ]; then 396 ver="$(${i}/bin/openssl version)" 397 fi 398 case "$ver" in 399 none) ;; 400 "OpenSSL 0."*|"OpenSSL 1.0."*|"OpenSSL 1.1.0"*) ;; 401 "LibreSSL 2."*|"LibreSSL 3.0."*) ;; 402 *) LIBCRYPTOFLAGS="--with-ssl-dir=${i}" ;; 403 esac 404 done 405 if [ "${LIBCRYPTOFLAGS}" = "--without-openssl" ]; then 406 TEST_TARGET="t-exec" 407 fi 408fi 409 410CONFIGFLAGS="${CONFIGFLAGS} ${LIBCRYPTOFLAGS}" 411 412if [ -x "$(which plink 2>/dev/null)" ]; then 413 REGRESS_INTEROP_PUTTY=yes 414 export REGRESS_INTEROP_PUTTY 415fi 416 417if [ ! -z "${OVERRIDE_LTESTS}" ]; then 418 echo >&2 "Overriding LTESTS, was '${LTESTS}', now '${OVERRIDE_LTESTS}'" 419 LTESTS="${OVERRIDE_LTESTS}" 420fi 421 422export CC CFLAGS CPPFLAGS LDFLAGS LTESTS SUDO 423export TEST_TARGET TEST_SSH_UNSAFE_PERMISSIONS TEST_SSH_FAIL_FATAL 424