tests: introduce pkd_hello

Introduce a sample public-key testing daemon to the 'pkd' test directory,
and add support code for cycling through various combinations of different
key exchange, cipher, and MAC algorithms.

The goal of the 'pkd_hello' test is to make it easy to test interactions
between non-libssh clients and a libssh-server, and to provide a starting
point for testing new implementations for key types, ciphers, MACs, and
so on.  The thinking is that testing a new algorithm should be as simple
as adding a new line for it in the PKDTESTS_* lists.

Macros are used to generate the tests and helper functions for a couple of
clients -- here, OpenSSH and dropbear are included for the first cut.  If
binaries are found for these clients, their test lists will be enabled;
when binaries are not found for a given client, those tests are skipped.

Tests are run in one large batch by default, but can also be run individually
to help with tracking down things like signature bugs that may take many
iterations to reproduce.

Each test logs its stdout and stderr to its own file, which is cleaned up
when a test succeeds.  For failures, those logs can be combined with verbose
libssh output from pkd itself to start debugging things.

Some example usages:

  pkd_hello
    Run all tests with default number of iterations.

  pkd_hello --list
    List available individual test names.

  pkd_hello -i 1000 -t torture_pkd_openssh_ecdsa_256_ecdh_sha2_nistp256
    Run only the torture_pkd_openssh_ecdsa_256_ecdh_sha2_nistp256
    testcase 1000 times.

  pkd_hello -v -v -v -v -e -o
    Run all tests with maximum libssh and pkd logging.

Included now in the tests are passes for the new SHA2 HMAC support,
as well as all existing kex, cipher, and MAC algorithms.

BUG: https://red.libssh.org/issues/144

Signed-off-by: Jon Simons <jon@jonsimons.org>
kex: server fix for first_kex_packet_follows

Ensure to honor the 'first_kex_packet_follow' field when processing
KEXINIT messages in the 'ssh_packet_kexinit' callback.  Until now
libssh would assume that this field is always unset (zero).  But
some clients may set this (dropbear at or beyond version 2013.57),
and it needs to be included when computing the session ID.

Also include logic for handling wrongly-guessed key exchange algorithms.
Save whether a client's guess is wrong in a new field in the session
struct: when set, the next KEX_DHINIT message to be processed will be
ignored per RFC 4253, 7.1.

While here, update both 'ssh_packet_kexinit' and 'make_sessionid' to
use softabs with a 4 space indent level throughout, and also convert
various error-checking to store intermediate values into an explicit
'rc'.

Patch adjusted from original in two ways: first ensure that client
tests remain passing (ie 'torture_connect'): restrict the changes in
'ssh_packet_kexinit' only for the 'server_kex' case; second, add a
NULL check in 'is_first_kex_packet_follows_guess_wrong' to prevent
seg fault via 'strdup'.

Signed-off-by: Jon Simons <jon@jonsimons.org>
dh: workaround curve25519 'K' bug in OpenSSH

Workaround for curve25519 bug in OpenSSH:

  * https://red.libssh.org/issues/159

For OpenSSH clients 6.5p1 or 6.6p1, ensure that bignum strings
used for the shared-secret 'K' value in key exchange with
curve25519-sha256@libssh.org are indeed 32 bytes.

Before this change, OpenSSH clients starting at version 6.5p1 will
sometimes, but not always, error out in the early key exchange
phase along the lines of:

    debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    ...
    debug1: sending SSH2_MSG_KEX_ECDH_INIT
    debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
    ...
    Warning: Permanently added '[localhost]:1234' (RSA) to the list of known hosts.
    hash mismatch
    debug1: ssh_rsa_verify: signature incorrect
    key_verify failed for server_host_key

After some digging it looks like there are some cases where the
ssh_string computed by libssh for its 'K' value does not have a
length of 32 bytes.  It is in these cases that OpenSSH clients
will fail signature verification during initial key exchange.
This is actually a bug in OpenSSH.

To workaround, for 6.5p1 and 6.6p1 clients, use a new helper for generating
'K' strings which inputs both a bignum and minimal size.  For the bad client
case, the 32 byte value is provided for the size; other key exchange
algorithms continue to use plain 'make_bignum_string' as before.

BUG: https://red.libssh.org/issues/159

Signed-off-by: Jon Simons <jon@jonsimons.org>
channel: fix build warning