project=$1

version=$2

tarball=

uncompress_options=

source_dir=

server_executable=

if [[ $project == 'OpenSSH' ]]; then

tarball="openssh-${version}.tar.gz"

uncompress_options="xzf"

source_dir="openssh-${version}"

server_executable=sshd

elif [[ $project == 'Dropbear' ]]; then

tarball="dropbear-${version}.tar.bz2"

uncompress_options="xjf"

source_dir="dropbear-${version}"

server_executable=dropbear

elif [[ $project == 'TinySSH' ]]; then

tarball="${version}.tar.gz"

uncompress_options="xzf"

source_dir="tinyssh-${version}"

server_executable='build/bin/tinysshd'

fi

echo "Uncompressing ${project} ${version}..."

tar $uncompress_options $tarball

echo "Compiling ${project} ${version}..."

pushd $source_dir > /dev/null

# TinySSH has no configure script... only a Makefile.

if [[ $project == 'TinySSH' ]]; then

make -j 10

else

./configure && make -j 10

fi

if [[ ! -f $server_executable ]]; then

echo -e "${REDB}Error: ${server_executable} not built!${CLR}"

exit 1

fi

echo -e "\n${GREEN}Successfully built ${project} ${version}${CLR}\n"

popd > /dev/null

# Create a new temporary directory.

TMP_DIR=`mktemp -d /tmp/sshaudit-docker-XXXXXXXXXX`

# Copy the Dockerfile and all files in the test/docker/ dir to our new temp directory.

find test/docker/ -maxdepth 1 -type f | xargs cp -t $TMP_DIR

# Make the temp directory our working directory for the duration of the build

# process.

pushd $TMP_DIR > /dev/null

# Get the release keys.

get_dropbear_release_key

get_openssh_release_key

get_tinyssh_release_key

# Aside from checking the GPG signatures, we also compare against this known-good

# SHA-256 hash just in case.

get_openssh '4.0p1' '5adb9b2c2002650e15216bf94ed9db9541d9a17c96fcd876784861a8890bc92b'

get_openssh '5.6p1' '538af53b2b8162c21a293bb004ae2bdb141abd250f61b4cea55244749f3c6c2b'

get_openssh '8.0p1' 'bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0b437320c3481fd68'

get_dropbear '2019.78' '525965971272270995364a0eb01f35180d793182e63dd0b0c3eb0292291644a4'

get_tinyssh '20190101' '554a9a94e53b370f0cd0c5fbbd322c34d1f695cbcea6a6a32dcb8c9f595b3fea'

# Compile the versions of OpenSSH.

compile_openssh '4.0p1'

compile_openssh '5.6p1'

compile_openssh '8.0p1'

# Compile the versions of Dropbear.

compile_dropbear '2019.78'

# Compile the versions of TinySSH.

compile_tinyssh '20190101'

# Rename the default config files so we know they are our originals.

mv openssh-4.0p1/sshd_config sshd_config-4.0p1_orig

mv openssh-5.6p1/sshd_config sshd_config-5.6p1_orig

mv openssh-8.0p1/sshd_config sshd_config-8.0p1_orig

# Create the configurations for each test.

#

# OpenSSH v4.0p1

#

# Test 1: Basic test.

create_openssh_config '4.0p1' 'test1' "HostKey /etc/ssh/ssh1_host_key\nHostKey /etc/ssh/ssh_host_rsa_key_1024\nHostKey /etc/ssh/ssh_host_dsa_key"

#

# OpenSSH v5.6p1

#

# Test 1: Basic test.

create_openssh_config '5.6p1' 'test1' "HostKey /etc/ssh/ssh_host_rsa_key_1024\nHostKey /etc/ssh/ssh_host_dsa_key"

# Test 2: RSA 1024 host key with RSA 1024 certificate.

create_openssh_config '5.6p1' 'test2' "HostKey /etc/ssh/ssh_host_rsa_key_1024\nHostCertificate /etc/ssh/ssh_host_rsa_key_1024-cert_1024.pub"

# Test 3: RSA 1024 host key with RSA 3072 certificate.

create_openssh_config '5.6p1' 'test3' "HostKey /etc/ssh/ssh_host_rsa_key_1024\nHostCertificate /etc/ssh/ssh_host_rsa_key_1024-cert_3072.pub"

# Test 4: RSA 3072 host key with RSA 1024 certificate.

create_openssh_config '5.6p1' 'test4' "HostKey /etc/ssh/ssh_host_rsa_key_3072\nHostCertificate /etc/ssh/ssh_host_rsa_key_3072-cert_1024.pub"

# Test 5: RSA 3072 host key with RSA 3072 certificate.

create_openssh_config '5.6p1' 'test5' "HostKey /etc/ssh/ssh_host_rsa_key_3072\nHostCertificate /etc/ssh/ssh_host_rsa_key_3072-cert_3072.pub"

#

# OpenSSH v8.0p1

#

# Test 1: Basic test.

create_openssh_config '8.0p1' 'test1' "HostKey /etc/ssh/ssh_host_rsa_key_3072\nHostKey /etc/ssh/ssh_host_ecdsa_key\nHostKey /etc/ssh/ssh_host_ed25519_key"

# Test 2: ED25519 certificate test.

create_openssh_config '8.0p1' 'test2' "HostKey /etc/ssh/ssh_host_ed25519_key\nHostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub"

# Test 3: Hardened installation test.

create_openssh_config '8.0p1' 'test3' "HostKey /etc/ssh/ssh_host_ed25519_key\nKexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com"

# Now build the docker image!

docker build --tag $IMAGE_NAME:$IMAGE_VERSION .

popd > /dev/null

rm -rf $TMP_DIR

openssh_version=$1

test_number=$2

config_text=$3

cp sshd_config-${openssh_version}_orig sshd_config-${openssh_version}_${test_number}

echo -e "${config_text}" >> sshd_config-${openssh_version}_${test_number}

project=$1

key_url=$2

key_id=$3

release_key_fingerprint_expected=$4

# The TinySSH release key isn't on any website, apparently.

if [[ $project == 'TinySSH' ]]; then

gpg --recv-key $key_id

else

echo -e "\nGetting ${project} release key...\n"

wget -O key.asc $2

echo -e "\nImporting ${project} release key...\n"

gpg --import key.asc

rm key.asc

fi

local release_key_fingerprint_actual=`gpg --fingerprint ${key_id}`

if [[ $release_key_fingerprint_actual != *"$release_key_fingerprint_expected"* ]]; then

echo -e "\n${REDB}Error: ${project} release key fingerprint does not match expected value!\n\tExpected: $release_key_fingerprint_expected\n\tActual: $release_key_fingerprint_actual\n\nTerminating.${CLR}"

exit -1

fi

echo -e "\n\n${GREEN}${project} release key matches expected value.${CLR}\n"

version=$1

tarball_checksum_expected=$2

get_source 'Dropbear' $version $tarball_checksum_expected

version=$1

tarball_checksum_expected=$2

get_source 'OpenSSH' $version $tarball_checksum_expected

version=$1

tarball_checksum_expected=$2

get_source 'TinySSH' $version $tarball_checksum_expected