1*** Settings ***
2Documentation    Test BMC SSH security.
3
4Resource         ../lib/resource.robot
5Resource         ../lib/openbmc_ffdc_methods.robot
6
7Test Tags       BMC_SSH_Security
8
9*** Variables ***
10
11@{allowed_shell_rcs}   ${255}
12${ignore_err}          ${0}
13
14# Left anchor for this regex is either a space or a comma.
15${left_anchor}         [ ,]
16# Right anchor for this regex is either a comma or end-of-line.
17${right_anchor}        (,|$)
18
19${weak_key_regex}   ${left_anchor}(group1_sha1|DES-CBC3|CBC mode|group1|SHA1)${right_anchor}
20${mac_key_regex}    ${left_anchor}(MD5|96-bit MAC algorithms)${right_anchor}
21
22*** Test Cases ***
23
24Verify BMC SSH Weak Cipher And Algorithm
25    [Documentation]  Connect to BMC and verify no weak cipher and algorithm is
26    ...              supported.
27    [Tags]  Verify_BMC_SSH_Weak_Cipher_And_Algorithm
28
29    # The following is a sample of output from ssh -vv:
30    # This test requires OpenSSH and depends on output format of ssh -vv.
31    # debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,
32    #         ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,
33    #         diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,
34    #         diffie-hellman-group14-sha1
35    # debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa
36    # debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,
37    #         aes128-gcm@openssh.com,aes256-gcm@openssh.com
38    # debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,
39    #         aes128-gcm@openssh.com,aes256-gcm@openssh.com
40    # debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,
41    #         hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,
42    #         umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
43    # debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,
44    #         hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,
45    #         umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
46
47    # Example of weak algorithms to check:
48    # - encryption: triple-DES ("DES-CBC3").
49    # - encryption: CBC mode
50    # - MAC: MD5 and 96-bit MAC algorithms
51    # - KEX: diffie-hellman-group1(any) , (any) SHA1
52
53    Printn
54    ${ssh_cmd_buf}=  Catenate  ssh -o NumberOfPasswordPrompts=0 -o UserKnownHostsFile=/dev/null
55    ...  -o StrictHostKeyChecking=no -vv ${OPENBMC_HOST} 2>&1
56
57    ${rc}  ${std_err}=  Shell Cmd  ! ${ssh_cmd_buf}
58    Log  std_err=${std_err}  console=yes
59    Log  rc=${rc} console=yes
60
61    ${has_it}=  Run Keyword And Return Status  Should Contain  ${std_err}  Permission denied
62    Skip If  not ${has_it}
63    ...  Skipping test case since response is not as expected
64
65    Shell Cmd  ! ${ssh_cmd_buf} | egrep -- "${weak_key_regex}"
66    Shell Cmd  ! ${ssh_cmd_buf} | egrep -- "${mac_key_regex}"
67