1#!/bin/sh 2# 3# usage: configs vmname test_config (or '' for default) 4# 5# Sets the following variables: 6# CONFIGFLAGS options to ./configure 7# SSHD_CONFOPTS sshd_config options 8# TEST_TARGET make target used when testing. defaults to "tests". 9# LTESTS 10 11config=$1 12if [ "$config" = "" ]; then 13 config="default" 14fi 15 16unset CC CFLAGS CPPFLAGS LDFLAGS LTESTS SUDO 17 18TEST_TARGET="tests compat-tests" 19LTESTS="" 20SKIP_LTESTS="" 21SUDO=sudo # run with sudo by default 22TEST_SSH_UNSAFE_PERMISSIONS=1 23# Stop on first test failure to minimize logs 24TEST_SSH_FAIL_FATAL=yes 25 26CONFIGFLAGS="" 27LIBCRYPTOFLAGS="" 28 29case "$config" in 30 default|sol64) 31 ;; 32 c89) 33 # If we don't have LLONG_MAX, configure will figure out that it can 34 # get it by setting -std=gnu99, at which point we won't be testing 35 # C89 any more. To avoid this, feed it in via CFLAGS. 36 llong_max=`gcc -E -dM - </dev/null | \ 37 awk '$2=="__LONG_LONG_MAX__"{print $3}'` 38 CPPFLAGS="-DLLONG_MAX=${llong_max}" 39 40 CC="gcc" 41 CFLAGS="-Wall -std=c89 -pedantic -Werror=vla" 42 CONFIGFLAGS="--without-zlib" 43 LIBCRYPTOFLAGS="--without-openssl" 44 TEST_TARGET=t-exec 45 ;; 46 cygwin-release) 47 # See https://cygwin.com/git/?p=git/cygwin-packages/openssh.git;a=blob;f=openssh.cygport;hb=HEAD 48 CONFIGFLAGS="--with-xauth=/usr/bin/xauth --with-security-key-builtin" 49 CONFIGFLAGS="$CONFIGFLAGS --with-kerberos5=/usr --with-libedit --disable-strip" 50 ;; 51 clang-12-Werror) 52 CC="clang-12" 53 # clang's implicit-fallthrough requires that the code be annotated with 54 # __attribute__((fallthrough)) and does not understand /* FALLTHROUGH */ 55 CFLAGS="-Wall -Wextra -O2 -Wno-error=implicit-fallthrough -Wno-error=unused-parameter" 56 CONFIGFLAGS="--with-pam --with-Werror" 57 ;; 58 *-sanitize-*) 59 case "$config" in 60 gcc-*) 61 CC=gcc 62 ;; 63 clang-*) 64 # Find the newest available version of clang 65 for i in `seq 10 99`; do 66 clang="`which clang-$i 2>/dev/null`" 67 [ -x "$clang" ] && CC="$clang" 68 done 69 ;; 70 esac 71 # Put Sanitizer logs in regress dir. 72 SANLOGS=`pwd`/regress 73 # - We replace chroot with chdir so that the sanitizer in the preauth 74 # privsep process can read /proc. 75 # - clang does not recognizes explicit_bzero so we use bzero 76 # (see https://github.com/google/sanitizers/issues/1507 77 # - openssl and zlib trip ASAN. 78 # - sp_pwdp returned by getspnam trips ASAN, hence disabling shadow. 79 case "$config" in 80 *-sanitize-address) 81 CFLAGS="-fsanitize=address -fno-omit-frame-pointer" 82 LDFLAGS="-fsanitize=address" 83 CPPFLAGS='-Dchroot=chdir -Dexplicit_bzero=bzero -D_FORTIFY_SOURCE=0 -DASAN_OPTIONS=\"detect_leaks=0:log_path='$SANLOGS'/asan.log\"' 84 CONFIGFLAGS="" 85 TEST_TARGET="t-exec" 86 ;; 87 clang-sanitize-memory) 88 CFLAGS="-fsanitize=memory -fsanitize-memory-track-origins -fno-omit-frame-pointer" 89 LDFLAGS="-fsanitize=memory" 90 CPPFLAGS='-Dchroot=chdir -Dexplicit_bzero=bzero -DMSAN_OPTIONS=\"log_path='$SANLOGS'/msan.log\"' 91 CONFIGFLAGS="--without-zlib --without-shadow" 92 LIBCRYPTOFLAGS="--without-openssl" 93 TEST_TARGET="t-exec" 94 ;; 95 *-sanitize-undefined) 96 CFLAGS="-fsanitize=undefined" 97 LDFLAGS="-fsanitize=undefined" 98 ;; 99 *) 100 echo unknown sanitize option; 101 exit 1;; 102 esac 103 features="--disable-security-key --disable-pkcs11" 104 hardening="--without-sandbox --without-hardening --without-stackprotect" 105 privsep="--with-privsep-user=root" 106 CONFIGFLAGS="$CONFIGFLAGS $features $hardening $privsep" 107 # Because we hobble chroot we can't test it. 108 SKIP_LTESTS=sftp-chroot 109 ;; 110 gcc-11-Werror) 111 CC="gcc-11" 112 # -Wnoformat-truncation in gcc 7.3.1 20180130 fails on fmt_scaled 113 # -Wunused-result ignores (void) so is not useful. See 114 # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 115 CFLAGS="-O2 -Wno-format-truncation -Wimplicit-fallthrough=4 -Wno-unused-parameter -Wno-unused-result" 116 CONFIGFLAGS="--with-pam --with-Werror" 117 ;; 118 gcc-12-Werror) 119 CC="gcc-12" 120 # -Wnoformat-truncation in gcc 7.3.1 20180130 fails on fmt_scaled 121 # -Wunused-result ignores (void) so is not useful. See 122 # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 123 CFLAGS="-O2 -Wno-format-truncation -Wimplicit-fallthrough=4 -Wno-unused-parameter -Wno-unused-result" 124 CONFIGFLAGS="--with-pam --with-Werror" 125 ;; 126 clang*|gcc*) 127 CC="$config" 128 ;; 129 kitchensink) 130 CONFIGFLAGS="--with-kerberos5 --with-libedit --with-pam" 131 CONFIGFLAGS="${CONFIGFLAGS} --with-security-key-builtin --with-selinux" 132 CFLAGS="-DSK_DEBUG -DSANDBOX_SECCOMP_FILTER_DEBUG" 133 ;; 134 hardenedmalloc) 135 CONFIGFLAGS="--with-ldflags=-lhardened_malloc" 136 ;; 137 tcmalloc) 138 CONFIGFLAGS="--with-ldflags=-ltcmalloc" 139 ;; 140 krb5|heimdal) 141 CONFIGFLAGS="--with-kerberos5" 142 ;; 143 libedit) 144 CONFIGFLAGS="--with-libedit" 145 ;; 146 musl) 147 CC="musl-gcc" 148 CONFIGFLAGS="--without-zlib" 149 LIBCRYPTOFLAGS="--without-openssl" 150 TEST_TARGET="t-exec" 151 ;; 152 pam-krb5) 153 CONFIGFLAGS="--with-pam --with-kerberos5" 154 SSHD_CONFOPTS="UsePam yes" 155 ;; 156 *pam) 157 CONFIGFLAGS="--with-pam" 158 SSHD_CONFOPTS="UsePam yes" 159 ;; 160 boringssl) 161 CONFIGFLAGS="--disable-pkcs11" 162 LIBCRYPTOFLAGS="--with-ssl-dir=/opt/boringssl --with-rpath=-Wl,-rpath," 163 ;; 164 libressl-*) 165 LIBCRYPTOFLAGS="--with-ssl-dir=/opt/libressl --with-rpath=-Wl,-rpath," 166 ;; 167 openssl-*) 168 LIBCRYPTOFLAGS="--with-ssl-dir=/opt/openssl --with-rpath=-Wl,-rpath," 169 # OpenSSL 1.1.1 specifically has a bug in its RNG that breaks reexec 170 # fallback. See https://bugzilla.mindrot.org/show_bug.cgi?id=3483 171 if [ "$config" = "openssl-1.1.1" ]; then 172 SKIP_LTESTS="reexec" 173 fi 174 ;; 175 selinux) 176 CONFIGFLAGS="--with-selinux" 177 ;; 178 sk) 179 CONFIGFLAGS="--with-security-key-builtin" 180 ;; 181 without-openssl) 182 LIBCRYPTOFLAGS="--without-openssl" 183 TEST_TARGET=t-exec 184 ;; 185 valgrind-[1-5]|valgrind-unit) 186 # rlimit sandbox and FORTIFY_SOURCE confuse Valgrind. 187 CONFIGFLAGS="--without-sandbox --without-hardening" 188 CONFIGFLAGS="$CONFIGFLAGS --with-cppflags=-D_FORTIFY_SOURCE=0" 189 TEST_TARGET="t-exec USE_VALGRIND=1" 190 TEST_SSH_ELAPSED_TIMES=1 191 export TEST_SSH_ELAPSED_TIMES 192 # Valgrind slows things down enough that the agent timeout test 193 # won't reliably pass, and the unit tests run longer than allowed 194 # by github so split into separate tests. 195 tests2="integrity try-ciphers" 196 tests3="krl forward-control sshsig agent-restrict kextype sftp" 197 tests4="cert-userkey cert-hostkey kextype sftp-perm keygen-comment percent" 198 tests5="rekey" 199 case "$config" in 200 valgrind-1) 201 # All tests except agent-timeout (which is flaky under valgrind), 202 # connection-timeout (which doesn't work since it's so slow) 203 # and hostbased (since valgrind won't let ssh exec keysign). 204 # Slow ones are run separately to increase parallelism. 205 SKIP_LTESTS="agent-timeout connection-timeout hostbased" 206 SKIP_LTESTS="$SKIP_LTESTS ${tests2} ${tests3} ${tests4} ${tests5}" 207 ;; 208 valgrind-2) 209 LTESTS="${tests2}" 210 ;; 211 valgrind-3) 212 LTESTS="${tests3}" 213 ;; 214 valgrind-4) 215 LTESTS="${tests4}" 216 ;; 217 valgrind-5) 218 LTESTS="${tests5}" 219 ;; 220 valgrind-unit) 221 TEST_TARGET="unit USE_VALGRIND=1" 222 ;; 223 esac 224 ;; 225 zlib-develop) 226 INSTALL_ZLIB=develop 227 CONFIGFLAGS="--with-zlib=/opt/zlib --with-rpath=-Wl,-rpath," 228 ;; 229 *) 230 echo "Unknown configuration $config" 231 exit 1 232 ;; 233esac 234 235# The Solaris 64bit targets are special since they need a non-flag arg. 236case "$config" in 237 sol64*) 238 CONFIGFLAGS="--target=x86_64 --with-cflags=-m64 --with-ldflags=-m64 ${CONFIGFLAGS}" 239 LIBCRYPTOFLAGS="--with-ssl-dir=/usr/local/ssl64 --with-rpath=-Wl,-rpath," 240 ;; 241esac 242 243case "${TARGET_HOST}" in 244 aix*) 245 CONFIGFLAGS="--disable-security-key" 246 LIBCRYPTOFLAGS="--without-openssl" 247 # These are slow real or virtual machines so skip the slowest tests 248 # (which tend to be thw ones that transfer lots of data) so that the 249 # test run does not time out. 250 # The agent-restrict test fails due to some quoting issue when run 251 # with sh or ksh so specify bash for now. 252 TEST_TARGET="t-exec unit TEST_SHELL=bash" 253 SKIP_LTESTS="rekey sftp" 254 ;; 255 debian-riscv64) 256 # This machine is fairly slow, so skip the unit tests. 257 TEST_TARGET="t-exec" 258 ;; 259 dfly58*|dfly60*) 260 # scp 3-way connection hangs on these so skip until sorted. 261 SKIP_LTESTS=scp3 262 ;; 263 fbsd6) 264 # Native linker is not great with PIC so OpenSSL is built w/out. 265 CONFIGFLAGS="${CONFIGFLAGS} --disable-security-key" 266 ;; 267 hurd) 268 SKIP_LTESTS="forwarding multiplex proxy-connect hostkey-agent agent-ptrace" 269 ;; 270 minix3) 271 CONFIGFLAGS="${CONFIGFLAGS} --disable-security-key" 272 LIBCRYPTOFLAGS="--without-openssl" 273 # Minix does not have a loopback interface so we have to skip any 274 # test that relies on one. 275 # Also, Minix seems to be very limited in the number of select() 276 # calls that can be operating concurrently, so prune additional tests for that. 277 T="addrmatch agent-restrict brokenkeys cfgmatch cfgmatchlisten cfgparse 278 connect connect-uri exit-status forwarding hostkey-agent 279 key-options keyscan knownhosts-command login-timeout 280 reconfigure reexec rekey scp scp-uri scp3 sftp sftp-badcmds 281 sftp-batch sftp-cmds sftp-glob sftp-perm sftp-uri stderr-data 282 transfer" 283 # Unix domain sockets don't work quite like we expect, so also skip any tests 284 # that use multiplexing. 285 T="$T connection-timeout dynamic-forward forward-control multiplex" 286 SKIP_LTESTS="$(echo $T)" 287 TEST_TARGET=t-exec 288 SUDO="" 289 ;; 290 nbsd4) 291 # System compiler will ICE on some files with fstack-protector 292 # SHA256 functions in sha2.h conflict with OpenSSL's breaking sk-dummy 293 CONFIGFLAGS="${CONFIGFLAGS} --without-hardening --disable-security-key" 294 ;; 295 openwrt-*) 296 CONFIGFLAGS="${CONFIGFLAGS} --without-zlib" 297 LIBCRYPTOFLAGS="--without-openssl" 298 TEST_TARGET="t-exec" 299 ;; 300 sol10|sol11) 301 # sol10 VM is 32bit and the unit tests are slow. 302 # sol11 has 4 test configs so skip unit tests to speed up. 303 TEST_TARGET="tests SKIP_UNIT=1" 304 ;; 305 win10) 306 # No sudo on Windows. 307 SUDO="" 308 ;; 309esac 310 311host=`./config.guess` 312case "$host" in 313*cygwin) 314 SUDO="" 315 # Don't run compat tests on cygwin as they don't currently compile. 316 TEST_TARGET="tests" 317 ;; 318*-darwin*) 319 # Unless specified otherwise, build without OpenSSL on Mac OS since 320 # modern versions don't ship with libcrypto. 321 LIBCRYPTOFLAGS="--without-openssl" 322 TEST_TARGET=t-exec 323 case "$host" in 324 *-darwin22.*) 325 # sudo -S nobody doesn't work on macos 13 for some reason. 326 SKIP_LTESTS="agent-getpeereid" ;; 327 esac 328 ;; 329esac 330 331# Unless specifically configured, search for a suitable version of OpenSSL, 332# otherwise build without it. 333if [ -z "${LIBCRYPTOFLAGS}" ]; then 334 LIBCRYPTOFLAGS="--without-openssl" 335 # last-match 336 for i in /usr /usr/local /usr/local/ssl /usr/local/opt/openssl; do 337 ver="none" 338 if [ -x ${i}/bin/openssl ]; then 339 ver="$(${i}/bin/openssl version)" 340 fi 341 case "$ver" in 342 none) ;; 343 "OpenSSL 0."*|"OpenSSL 1.0."*|"OpenSSL 1.1.0"*) ;; 344 "LibreSSL 2."*|"LibreSSL 3.0."*) ;; 345 *) LIBCRYPTOFLAGS="--with-ssl-dir=${i}" ;; 346 esac 347 done 348 if [ "${LIBCRYPTOFLAGS}" = "--without-openssl" ]; then 349 TEST_TARGET="t-exec" 350 fi 351fi 352 353CONFIGFLAGS="${CONFIGFLAGS} ${LIBCRYPTOFLAGS}" 354 355if [ -x "$(which plink 2>/dev/null)" ]; then 356 REGRESS_INTEROP_PUTTY=yes 357 export REGRESS_INTEROP_PUTTY 358fi 359 360export CC CFLAGS CPPFLAGS LDFLAGS LTESTS SUDO 361export TEST_TARGET TEST_SSH_UNSAFE_PERMISSIONS TEST_SSH_FAIL_FATAL 362