Merge branch 'hans/ssh/random_modulus/OTP-13054' into maint

* hans/ssh/random_modulus/OTP-13054:
  ssh: correct a bad doc xref
  public_key: renamed priv/ssh_moduli -> priv/moduli
  ssh, public_key: updates after doc review
  ssh: changes after doc review
  ssh: extend 'dh_gex_limits' to server side
  ssh: option dh_gex_groups with tag ssh_moduli_file
  ssh, public_key: random selection of diffie-hellman moduli

3 files changed, 91 insertions, 44 deletions

diff --git a/lib/ssh/test/ssh_algorithms_SUITE.erl b/lib/ssh/test/ssh_algorithms_SUITE.erl
index 2ab83d84e1..85415a17de 100644
--- a/lib/ssh/test/ssh_algorithms_SUITE.erl
+++ b/lib/ssh/test/ssh_algorithms_SUITE.erl
@@ -83,7 +83,7 @@ init_per_suite(Config) ->
 	    ssh_test_lib:default_algorithms(sshc),
 	    ssh_test_lib:default_algorithms(sshd),
 	    {?DEFAULT_DH_GROUP_MIN,?DEFAULT_DH_GROUP_NBITS,?DEFAULT_DH_GROUP_MAX},
-	    [KeyLen || {KeyLen,_} <- ?dh_default_groups],
+	    public_key:dh_gex_group_sizes(),
 	    ?MAX_NUM_ALGORITHMS
 	    ]),
     ct:log("all() ->~n    ~p.~n~ngroups()->~n    ~p.~n",[all(),groups()]),
@@ -172,19 +172,50 @@ simple_exec(Config) ->
     ssh_test_lib:std_simple_exec(Host, Port, Config).
 
 %%--------------------------------------------------------------------
+%% Testing if no group matches
+simple_exec_groups_no_match_too_small(Config) ->
+    try simple_exec_group({400,500,600}, Config)
+    of
+	_ -> ct:fail("Exec though no group available")
+    catch
+	error:{badmatch,{error,"No possible diffie-hellman-group-exchange group found"}} ->
+	    ok
+    end.
+
+simple_exec_groups_no_match_too_large(Config) ->
+    try simple_exec_group({9200,9500,9700}, Config)
+    of
+	_ -> ct:fail("Exec though no group available")
+    catch
+	error:{badmatch,{error,"No possible diffie-hellman-group-exchange group found"}} ->
+	    ok
+    end.
+
+%%--------------------------------------------------------------------
 %% Testing all default groups
-simple_exec_group14(Config) -> simple_exec_group(2048, Config).
-simple_exec_group15(Config) -> simple_exec_group(3072, Config).
-simple_exec_group16(Config) -> simple_exec_group(4096, Config).
-simple_exec_group17(Config) -> simple_exec_group(6144, Config).
-simple_exec_group18(Config) -> simple_exec_group(8192, Config).
-
-simple_exec_group(I, Config) ->
-    Min = I-100,
-    Max = I+100,
-    {Host,Port} = ?config(srvr_addr, Config),
-    ssh_test_lib:std_simple_exec(Host, Port, Config,
-				 [{dh_gex_limits,{Min,I,Max}}]).
+simple_exec_groups(Config) ->
+    Sizes = interpolate( public_key:dh_gex_group_sizes() ),
+    lists:foreach(
+      fun(Sz) ->
+	      ct:log("Try size ~p",[Sz]),
+	      ct:comment(Sz),
+	      case simple_exec_group(Sz, Config) of
+		  expected -> ct:log("Size ~p ok",[Sz]);
+		  _ -> ct:log("Size ~p not ok",[Sz])
+	      end
+      end, Sizes),
+    ct:comment("~p",[lists:map(fun({_,I,_}) -> I;
+				  (I) -> I
+			       end,Sizes)]).
+
+
+interpolate([I1,I2|Is]) ->
+    OneThird = (I2-I1) div 3,
+    [I1,
+     {I1, I1 + OneThird, I2},
+     {I1, I1 + 2*OneThird, I2} | interpolate([I2|Is])];
+interpolate(Is) ->
+    Is.
 
 %%--------------------------------------------------------------------
 %% Use the ssh client of the OS to connect
@@ -283,11 +314,10 @@ specific_test_cases(Tag, Alg, SshcAlgos, SshdAlgos) ->
 	case {Tag,Alg} of
 	    {kex,_} when Alg == 'diffie-hellman-group-exchange-sha1' ;
 			 Alg == 'diffie-hellman-group-exchange-sha256' ->
-		[simple_exec_group14,
-		 simple_exec_group15,
-		 simple_exec_group16,
-		 simple_exec_group17,
-		 simple_exec_group18];
+		[simple_exec_groups,
+		 simple_exec_groups_no_match_too_large,
+		 simple_exec_groups_no_match_too_small
+		];
 	    _ ->
 		[]
 	end.
@@ -331,3 +361,11 @@ setup_pubkey(Config) ->
     ssh_test_lib:setup_dsa_known_host(DataDir, UserDir),
     Config.
 
+
+simple_exec_group(I, Config) when is_integer(I) ->
+    simple_exec_group({I,I,I}, Config);
+simple_exec_group({Min,I,Max}, Config) ->
+    {Host,Port} = ?config(srvr_addr, Config),
+    ssh_test_lib:std_simple_exec(Host, Port, Config,
+				 [{dh_gex_limits,{Min,I,Max}}]).
+
diff --git a/lib/ssh/test/ssh_protocol_SUITE.erl b/lib/ssh/test/ssh_protocol_SUITE.erl
index b84ccac885..3a7f47c2dd 100644
--- a/lib/ssh/test/ssh_protocol_SUITE.erl
+++ b/lib/ssh/test/ssh_protocol_SUITE.erl
@@ -66,9 +66,9 @@ groups() ->
       
      {kex, [], [no_common_alg_server_disconnects,
 		no_common_alg_client_disconnects,
-		gex_client_init_default_noexact,
-		gex_client_init_default_exact,
 		gex_client_init_option_groups,
+		gex_server_gex_limit,
+		gex_client_init_option_groups_moduli_file,
 		gex_client_init_option_groups_file
 		]},
      {service_requests, [], [bad_service_name,
@@ -91,10 +91,10 @@ end_per_suite(Config) ->
 init_per_testcase(no_common_alg_server_disconnects, Config) ->
     start_std_daemon(Config, [{preferred_algorithms,[{public_key,['ssh-rsa']}]}]);
 
-init_per_testcase(TC, Config) when TC == gex_client_init_default_noexact ;
-				   TC == gex_client_init_default_exact ;
-				   TC == gex_client_init_option_groups ;
-				   TC == gex_client_init_option_groups_file ->
+init_per_testcase(TC, Config) when TC == gex_client_init_option_groups ;
+				   TC == gex_client_init_option_groups_moduli_file ;
+				   TC == gex_client_init_option_groups_file ;
+				   TC == gex_server_gex_limit ->
     Opts = case TC of
 	       gex_client_init_option_groups ->
 		   [{dh_gex_groups, [{2345, 3, 41}]}];
@@ -102,6 +102,16 @@ init_per_testcase(TC, Config) when TC == gex_client_init_default_noexact ;
 		   DataDir = ?config(data_dir, Config),
 		   F = filename:join(DataDir, "dh_group_test"),
 		   [{dh_gex_groups, {file,F}}];
+	       gex_client_init_option_groups_moduli_file ->
+		   DataDir = ?config(data_dir, Config),
+		   F = filename:join(DataDir, "dh_group_test.moduli"),
+		   [{dh_gex_groups, {ssh_moduli_file,F}}];
+	       gex_server_gex_limit ->
+		    [{dh_gex_groups, [{ 500, 3, 18},
+				      {1000, 7, 91},
+				      {3000, 5, 61}]},
+		     {dh_gex_limits,{500,1500}}
+		    ];
 	       _ ->
 		   []
 	   end,
@@ -113,10 +123,10 @@ init_per_testcase(_TestCase, Config) ->
 
 end_per_testcase(no_common_alg_server_disconnects, Config) ->
     stop_std_daemon(Config);
-end_per_testcase(TC, Config) when TC == gex_client_init_default_noexact ;
-				  TC == gex_client_init_default_exact ;
-				  TC == gex_client_init_option_groups ;
-				  TC == gex_client_init_option_groups_file ->
+end_per_testcase(TC, Config) when TC == gex_client_init_option_groups ;
+				  TC == gex_client_init_option_groups_moduli_file ;
+				  TC == gex_client_init_option_groups_file ;
+				  TC == gex_server_gex_limit ->
     stop_std_daemon(Config);
 end_per_testcase(_TestCase, Config) ->
     check_std_daemon_works(Config, ?LINE).
@@ -332,28 +342,24 @@ no_common_alg_client_disconnects(Config) ->
     end.
 
 %%%--------------------------------------------------------------------
-gex_client_init_default_noexact(Config) ->
-    do_gex_client_init(Config, {2000, 3000, 4000},
-		       %% Warning, app knowledege:
-		       ?dh_group15).
-
-
-gex_client_init_default_exact(Config) ->
-    do_gex_client_init(Config, {2000, 2048, 4000},
-		       %% Warning, app knowledege:
-		       ?dh_group14).
-
-
 gex_client_init_option_groups(Config) ->
     do_gex_client_init(Config, {2000, 2048, 4000}, 
-		       {'n/a',{3,41}}).
-
+		       {3,41}).
 
 gex_client_init_option_groups_file(Config) ->
     do_gex_client_init(Config, {2000, 2048, 4000},
-		       {'n/a',{5,61}}).
+		       {5,61}).
+
+gex_client_init_option_groups_moduli_file(Config) ->
+    do_gex_client_init(Config, {2000, 2048, 4000},
+		       {5,16#B7}).
+
+gex_server_gex_limit(Config) ->
+    do_gex_client_init(Config, {1000, 3000, 4000},
+		       {7,91}).
+
 
-do_gex_client_init(Config, {Min,N,Max}, {_,{G,P}}) ->
+do_gex_client_init(Config, {Min,N,Max}, {G,P}) ->
     {ok,_} =
 	ssh_trpt_test_lib:exec(
 	  [{set_options, [print_ops, print_seqnums, print_messages]},
diff --git a/lib/ssh/test/ssh_protocol_SUITE_data/dh_group_test.moduli b/lib/ssh/test/ssh_protocol_SUITE_data/dh_group_test.moduli
new file mode 100644
index 0000000000..f6995ba4c9
--- /dev/null
+++ b/lib/ssh/test/ssh_protocol_SUITE_data/dh_group_test.moduli
@@ -0,0 +1,3 @@
+20151021104105 2 6 100 2222 5 B7
+20151021104106 2 6 100 1111 5 4F
+