name: wolfSSHd Test

on:
  push:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  create_matrix:
    runs-on: ubuntu-latest
    outputs:
        versions: ${{ steps.json.outputs.versions }}
    steps:
      - name: Create wolfSSL version matrix
        id: json
        run: |
          current=`curl -s https://api.github.com/repos/wolfssl/wolfssl/releases | grep tag_name | cut -d : -f 2,3 | tr -d \" | tr -d , | tr -d ' ' | head -1`
          last=`curl -s https://api.github.com/repos/wolfssl/wolfssl/releases | grep tag_name | cut -d : -f 2,3 | tr -d \" | tr -d , | tr -d ' ' | head -2 | tail -1`
          VERSIONS=$(echo "[ \"master\", \"$current\", \"$last\" ]")
          echo "wolfSSL versions found: $VERSIONS"
          echo "versions=$VERSIONS" >> $GITHUB_OUTPUT

  build_wolfssl:
    needs: create_matrix
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest ]
        wolfssl: ${{ fromJson(needs.create_matrix.outputs['versions']) }}
        mldsa: [ 'yes', 'no' ]
        include:
          - mldsa: 'yes'
            mldsa_flag: '--enable-mldsa'
          - mldsa: 'no'
            mldsa_flag: ''
    name: Build wolfssl
    runs-on: ${{ matrix.os }}
    timeout-minutes: 4
    steps:
      - name: Checking cache for wolfssl
        uses: actions/cache@v5
        id: cache-wolfssl
        with:
          path: build-dir/
          key: wolfssh-sshd-wolfssl-${{ matrix.wolfssl }}-${{ matrix.os }}-mldsa-${{ matrix.mldsa }}-v3
          lookup-only: true

      - name: Checkout, build, and install wolfssl
        if: steps.cache-wolfssl.outputs.cache-hit != 'true'
        uses: wolfSSL/actions-build-autotools-project@v1
        with:
          repository: wolfssl/wolfssl
          ref: ${{ matrix.wolfssl }}
          path: wolfssl
          configure: --enable-all ${{ matrix.mldsa_flag }}
          check: false
          install: true

  build_wolfssh:
    needs:
      - build_wolfssl
      - create_matrix
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest ]
        wolfssl: ${{ fromJson(needs.create_matrix.outputs['versions']) }}
        # The last two variants reuse the ML-DSA-enabled wolfSSL and build
        # wolfSSH with extra defines it has no configure option for: one
        # turns the composite algorithms off, one takes the small-stack
        # (heap-allocated) composite paths. Those legs stop after the sshd
        # tests; the later steps reconfigure without the extra define.
        mldsa: [ 'yes', 'no', 'yes-no-composites', 'yes-small-stack' ]
        include:
          - mldsa: 'yes'
            wolfssl_mldsa: 'yes'
            extra_flags: ''
          - mldsa: 'no'
            wolfssl_mldsa: 'no'
            extra_flags: ''
          - mldsa: 'yes-no-composites'
            wolfssl_mldsa: 'yes'
            extra_flags: ' -DWOLFSSH_NO_MLDSA_COMPOSITES'
          - mldsa: 'yes-small-stack'
            wolfssl_mldsa: 'yes'
            extra_flags: ' -DWOLFSSH_SMALL_STACK'
    name: Build and test the wolfsshd and wolfssh apps
    runs-on: ${{ matrix.os }}
    timeout-minutes: 10
    steps:
      - name: Checking cache for wolfssl
        uses: actions/cache@v5
        with:
          path: build-dir/
          key: wolfssh-sshd-wolfssl-${{ matrix.wolfssl }}-${{ matrix.os }}-mldsa-${{ matrix.wolfssl_mldsa }}-v3
          fail-on-cache-miss: true

      - uses: actions/checkout@v6
        with:
          path: wolfssh/

      - name: autogen
        working-directory: ./wolfssh/
        run: ./autogen.sh

      - name: configure
        working-directory: ./wolfssh/
        run : |
          ./configure --enable-all --enable-ossh-certs LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DWOLFSSH_NO_FPKI -DWOLFSSH_NO_SFTP_TIMEOUT -DWOLFSSH_MAX_SFTP_RW=4000000 -DMAX_PATH_SZ=120${{ matrix.extra_flags }}"

      - name: make check
        working-directory: ./wolfssh/
        run: make check

      - name: Run wolfSSHd tests
        working-directory: ./wolfssh/apps/wolfsshd/test
        run: |
          git log -3
          sudo ./run_all_sshd_tests.sh

      # could use optimization with caching
      - name: Test memory after close down
        working-directory: ./wolfssh/
        if: matrix.extra_flags == ''
        run: |
          sudo apt-get -y update
          sudo apt-get -y install valgrind
          touch sshd_config.txt
          ./configure --enable-all LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DWOLFSSH_NO_FPKI -DWOLFSSH_NO_SFTP_TIMEOUT -DWOLFSSH_MAX_SFTP_RW=4000000 -DMAX_PATH_SZ=120" --enable-static --disable-shared && make
          # wolfSSHd loads the host key through the secure gate; the daemon runs
          # under sudo (euid 0) so make the key root-owned and 0600.
          sudo chmod 600 ./keys/server-key.pem
          sudo chown 0:0 ./keys/server-key.pem
          sudo timeout --preserve-status -s 2 5 valgrind --error-exitcode=1 --leak-check=full ./apps/wolfsshd/wolfsshd -D -f sshd_config -h ./keys/server-key.pem -d -p 22222

      # regression test, check that cat command does not hang
      - name: Test cat command for hanging
        working-directory: ./wolfssh/
        if: matrix.extra_flags == ''
        timeout-minutes: 1
        run: |
          touch sshd_config.txt
          echo "AuthorizedKeysFile $PWD/authorized_keys_test" >> sshd_config.txt
          cat ./keys/hansel-*.pub > authorized_keys_test
          sed -i.bak "s/hansel/$USER/" ./authorized_keys_test
          ./configure --enable-all LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DWOLFSSH_NO_FPKI -DWOLFSSH_NO_SFTP_TIMEOUT -DWOLFSSH_MAX_SFTP_RW=4000000 -DMAX_PATH_SZ=120" --enable-static --disable-shared && make
          # Host key must be root-owned and 0600 for the sudo-launched daemon's
          # secure gate to load it.
          sudo chmod 600 ./keys/server-key.pem
          sudo chown 0:0 ./keys/server-key.pem
          sudo ./apps/wolfsshd/wolfsshd -f sshd_config.txt -h ./keys/server-key.pem -p 22225
          chmod 600 ./keys/hansel-key-rsa.pem
          tail -c 50000 /dev/urandom > test
          while ! nc -z 127.0.0.1 22225; do echo "waiting for wolfSSHd"; sleep 0.2; done
          cat test | ssh -vvv -T -i ./keys/hansel-key-rsa.pem -oStrictHostKeyChecking=no 127.0.0.1 -p 22225 'cat > test-file'
          diff test ~/test-file
          sudo pkill wolfsshd


      - name: configure with debug
        working-directory: ./wolfssh/
        if: matrix.extra_flags == ''
        run : |
          ./configure --enable-all --enable-debug LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DWOLFSSH_NO_FPKI -DWOLFSSH_NO_SFTP_TIMEOUT -DWOLFSSH_MAX_SFTP_RW=4000000 -DMAX_PATH_SZ=120"

      - name: make
        working-directory: ./wolfssh/
        if: matrix.extra_flags == ''
        run: make

      # ssh_kex_algos.sh requires debug output otherwise it is skipped
      - name: Run wolfSSHd tests with debug
        working-directory: ./wolfssh/apps/wolfsshd/test
        if: matrix.extra_flags == ''
        run: |
          git log -3
          sudo ./run_all_sshd_tests.sh --match ssh_kex_algos.sh