[apacheGH-445] Added StrictKexTest

sshd-core/src/test/java/org/apache/sshd/common/kex/extension/StrictKexTest.java

@@ -0,0 +1,183 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.sshd.common.kex.extension;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.util.Map;
+
+import org.apache.sshd.client.SshClient;
+import org.apache.sshd.client.session.ClientSession;
+import org.apache.sshd.common.kex.KexProposalOption;
+import org.apache.sshd.common.session.Session;
+import org.apache.sshd.common.session.SessionListener;
+import org.apache.sshd.common.session.helpers.SessionKexDetails;
+import org.apache.sshd.common.util.net.SshdSocketAddress;
+import org.apache.sshd.core.CoreModuleProperties;
+import org.apache.sshd.server.SshServer;
+import org.apache.sshd.util.test.BaseTestSupport;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.FixMethodOrder;
+import org.junit.Test;
+import org.junit.runners.MethodSorters;
+
+/**
+ * @author <a href="mailto:[email protected]">Apache MINA SSHD Project</a>
+ * @see <A HREF="https://github.com/apache/mina-sshd/issues/445">Terrapin Mitigation: &quot;strict-kex&quot;</A>
+ */
+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
+public class StrictKexTest extends BaseTestSupport {
+    private SshServer sshd;
+    private SshClient client;
+
+    public StrictKexTest() {
+        super();
+    }
+
+    @Override
+    protected SshServer setupTestServer() {
+        SshServer server = super.setupTestServer();
+        CoreModuleProperties.USE_STRICT_KEX.set(server, true);
+        return server;
+    }
+
+    @Override
+    protected SshClient setupTestClient() {
+        SshClient sshc = super.setupTestClient();
+        CoreModuleProperties.USE_STRICT_KEX.set(sshc, true);
+        return sshc;
+    }
+
+    @Before
+    public void setUp() throws Exception {
+        sshd = setupTestServer();
+        client = setupTestClient();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        if (sshd != null) {
+            sshd.stop(true);
+        }
+        if (client != null) {
+            client.stop();
+        }
+    }
+
+    @Test
+    public void testConnectionClosedIfFirstPacketNotKexInit() throws Exception {
+        // TODO
+    }
+
+    @Test
+    public void testStrictKexIgnoredIfNotFirstKexInit() throws Exception {
+        // TODO
+    }
+
+    @Test
+    public void testRekeyResetsPacketSequenceNumbers() throws Exception {
+        // TODO
+    }
+
+    @Test
+    public void testStrictKexNotActivatedIfClientDoesNotSupportIt() throws Exception {
+        testStrictKexNotActivatedIfNotSupportByPeer(false);
+    }
+
+    @Test
+    public void testStrictKexNotActivatedIfServerDoesNotSupportIt() throws Exception {
+        testStrictKexNotActivatedIfNotSupportByPeer(true);
+    }
+
+    private void testStrictKexNotActivatedIfNotSupportByPeer(boolean clientSupported) throws Exception {
+        if (clientSupported) {
+            CoreModuleProperties.USE_STRICT_KEX.set(sshd, false);
+        } else {
+            CoreModuleProperties.USE_STRICT_KEX.set(client, false);
+        }
+
+        sshd.addSessionListener(new SessionListener() {
+            @Override
+            public void sessionNegotiationEnd(
+                    Session session, Map<KexProposalOption, String> clientProposal,
+                    Map<KexProposalOption, String> serverProposal, Map<KexProposalOption, String> negotiatedOptions,
+                    Throwable reason) {
+                SessionKexDetails details = session.getSessionKexDetails();
+                assertEquals("StrictKexEnabled[server]", !clientSupported, details.isStrictKexEnabled());
+                assertFalse("StrictKexSignalled[server]", details.isStrictKexSignalled());
+            }
+        });
+
+        try (ClientSession session = obtainInitialTestClientSession()) {
+            SessionKexDetails details = session.getSessionKexDetails();
+            assertEquals("StrictKexEnabled[client]", clientSupported, details.isStrictKexEnabled());
+            assertFalse("StrictKexSignalled[client]", details.isStrictKexSignalled());
+        } finally {
+            client.stop();
+        }
+    }
+
+    private ClientSession obtainInitialTestClientSession() throws IOException {
+        sshd.start();
+        int port = sshd.getPort();
+
+        client.start();
+        return createTestClientSession(port);
+    }
+
+    private ClientSession createTestClientSession(int port) throws IOException {
+        ClientSession session = createTestClientSession(TEST_LOCALHOST, port);
+        try {
+            InetSocketAddress addr = SshdSocketAddress.toInetSocketAddress(session.getConnectAddress());
+            assertEquals("Mismatched connect host", TEST_LOCALHOST, addr.getHostString());
+
+            ClientSession returnValue = session;
+            session = null; // avoid 'finally' close
+            return returnValue;
+        } finally {
+            if (session != null) {
+                session.close();
+            }
+        }
+    }
+
+    private ClientSession createTestClientSession(String host, int port) throws IOException {
+        ClientSession session = client.connect(getCurrentTestName(), host, port)
+                .verify(CONNECT_TIMEOUT).getSession();
+        try {
+            session.addPasswordIdentity(getCurrentTestName());
+            session.auth().verify(AUTH_TIMEOUT);
+
+            InetSocketAddress addr = SshdSocketAddress.toInetSocketAddress(session.getConnectAddress());
+            assertNotNull("No reported connect address", addr);
+            assertEquals("Mismatched connect port", port, addr.getPort());
+
+            ClientSession returnValue = session;
+            session = null; // avoid 'finally' close
+            return returnValue;
+        } finally {
+            if (session != null) {
+                session.close();
+            }
+        }
+    }
+
+}