[Init] Initial commit - NetMesh terminal manager

domain/sshAlgorithmList.test.ts

@@ -0,0 +1,91 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createRequire } from "node:module";
+import {
+  effectiveDefaultAlgorithms,
+  SUPPORTED_ALGORITHMS_BY_CATEGORY,
+} from "./sshAlgorithmList.ts";
+const requireSsh2 = createRequire(import.meta.url);
+// Anchor the UI editor's supported lists to what ssh2 will actually
+// accept at connect time. If ssh2 drops a cipher / KEX / MAC at any
+// point (OpenSSL 3 already removed blowfish / arcfour / cast128, for
+// example) the editor must not offer it — picking it would throw
+// "Unsupported algorithm" synchronously before negotiation.
+const ssh2Constants = requireSsh2("ssh2/lib/protocol/constants.js");
+const SSH2_SUPPORTED_BY_CATEGORY: Record<string, readonly string[]> = {
+  kex: ssh2Constants.SUPPORTED_KEX,
+  cipher: ssh2Constants.SUPPORTED_CIPHER,
+  hmac: ssh2Constants.SUPPORTED_MAC,
+  serverHostKey: ssh2Constants.SUPPORTED_SERVER_HOST_KEY,
+  compress: ssh2Constants.SUPPORTED_COMPRESSION,
+};
+
+test("effectiveDefaultAlgorithms (modern) never seeds legacy SHA-1 KEX", () => {
+  const result = effectiveDefaultAlgorithms(false);
+  assert.ok(!result.kex.includes("diffie-hellman-group1-sha1"));
+  assert.ok(!result.kex.includes("diffie-hellman-group14-sha1"));
+  assert.ok(!result.kex.includes("diffie-hellman-group-exchange-sha1"));
+  // Modern KEX still present.
+  assert.ok(result.kex.includes("curve25519-sha256"));
+  assert.ok(result.kex.includes("diffie-hellman-group14-sha256"));
+});
+
+test("effectiveDefaultAlgorithms (modern) never seeds CBC / arcfour / MD5", () => {
+  const result = effectiveDefaultAlgorithms(false);
+  for (const algo of result.cipher) {
+    assert.ok(!algo.endsWith("-cbc"), `${algo} is a CBC cipher and should not be in modern defaults`);
+    assert.ok(!algo.startsWith("arcfour"), `${algo} (arcfour) should not be in modern defaults`);
+    assert.ok(algo !== "3des-cbc", "3des-cbc is legacy");
+  }
+  for (const algo of result.hmac) {
+    assert.ok(!algo.includes("md5"), `${algo} should not be in modern defaults`);
+  }
+});
+
+test("effectiveDefaultAlgorithms (modern) includes chacha20-poly1305", () => {
+  const result = effectiveDefaultAlgorithms(false);
+  assert.ok(result.cipher.includes("chacha20-poly1305@openssh.com"));
+});
+
+test("effectiveDefaultAlgorithms (legacy) appends sha1 KEX, CBC, and ssh-dss", () => {
+  const modern = effectiveDefaultAlgorithms(false);
+  const legacy = effectiveDefaultAlgorithms(true);
+
+  // Every modern algorithm is still present.
+  for (const category of Object.keys(modern) as (keyof typeof modern)[]) {
+    for (const algo of modern[category]) {
+      assert.ok(legacy[category].includes(algo), `${algo} missing from legacy ${category}`);
+    }
+  }
+
+  assert.ok(legacy.kex.includes("diffie-hellman-group14-sha1"));
+  assert.ok(legacy.kex.includes("diffie-hellman-group1-sha1"));
+  assert.ok(legacy.cipher.includes("aes128-cbc"));
+  assert.ok(legacy.cipher.includes("3des-cbc"));
+  assert.ok(legacy.serverHostKey.includes("ssh-dss"));
+});
+
+test("SUPPORTED_ALGORITHMS_BY_CATEGORY only lists algorithms ssh2 will actually accept", () => {
+  for (const category of Object.keys(SUPPORTED_ALGORITHMS_BY_CATEGORY) as (keyof typeof SUPPORTED_ALGORITHMS_BY_CATEGORY)[]) {
+    const ssh2Supported = SSH2_SUPPORTED_BY_CATEGORY[category];
+    assert.ok(ssh2Supported, `unexpected category ${category}`);
+    for (const algo of SUPPORTED_ALGORITHMS_BY_CATEGORY[category]) {
+      assert.ok(
+        ssh2Supported.includes(algo),
+        `${algo} (${category}) is in the UI list but ssh2 would reject it`,
+      );
+    }
+  }
+});
+
+test("effectiveDefaultAlgorithms output is a subset of SUPPORTED_ALGORITHMS_BY_CATEGORY", () => {
+  for (const enabled of [false, true]) {
+    const result = effectiveDefaultAlgorithms(enabled);
+    for (const category of Object.keys(result) as (keyof typeof result)[]) {
+      const supported = SUPPORTED_ALGORITHMS_BY_CATEGORY[category];
+      for (const algo of result[category]) {
+        assert.ok(supported.includes(algo), `${algo} (${category}) not in supported list`);
+      }
+    }
+  }
+});