- djm@cvs.openbsd.org 2010/02/26 20:33:21
[Makefile regress/cert-hostkey.sh regress/cert-userkey.sh]
regression tests for certified keys
This commit is contained in:
Damien Miller
parent
0a80ca190a
commit
58ac6de964
|
|
@ -30,6 +30,9 @@
|
|||
PROTOCOL.certkeys
|
||||
|
||||
feedback and ok markus@
|
||||
- djm@cvs.openbsd.org 2010/02/26 20:33:21
|
||||
[Makefile regress/cert-hostkey.sh regress/cert-userkey.sh]
|
||||
regression tests for certified keys
|
||||
|
||||
20100224
|
||||
- (djm) [pkcs11.h ssh-pkcs11-client.c ssh-pkcs11-helper.c ssh-pkcs11.c]
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# $OpenBSD: Makefile,v 1.51 2010/02/09 06:29:02 djm Exp $
|
||||
# $OpenBSD: Makefile,v 1.52 2010/02/26 20:33:21 djm Exp $
|
||||
|
||||
REGRESS_TARGETS= t1 t2 t3 t4 t5 t6 t7 t-exec
|
||||
tests: $(REGRESS_TARGETS)
|
||||
|
|
@ -52,7 +52,9 @@ LTESTS= connect \
|
|||
addrmatch \
|
||||
localcommand \
|
||||
forcecommand \
|
||||
portnum
|
||||
portnum \
|
||||
cert-hostkey \
|
||||
cert-userkey
|
||||
|
||||
INTEROP_TESTS= putty-transfer putty-ciphers putty-kex conch-ciphers
|
||||
#INTEROP_TESTS+=ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
|
||||
|
|
@ -66,6 +68,7 @@ CLEANFILES= t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
|
|||
ls.copy banner.in banner.out empty.in \
|
||||
scp-ssh-wrapper.scp ssh_proxy_envpass remote_pid \
|
||||
sshd_proxy_bak rsa_ssh2_cr.prv rsa_ssh2_crnl.prv \
|
||||
known_hosts-cert host_ca_key* cert_host_key* \
|
||||
putty.rsa2
|
||||
|
||||
# Enable all malloc(3) randomisations and checks
|
||||
|
|
|
|||
|
|
@ -0,0 +1,122 @@
|
|||
# $OpenBSD: cert-hostkey.sh,v 1.1 2010/02/26 20:33:21 djm Exp $
|
||||
# Placed in the Public Domain.
|
||||
|
||||
tid="certified host keys"
|
||||
|
||||
rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
|
||||
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
|
||||
|
||||
HOSTS='localhost-with-alias,127.0.0.1,::1'
|
||||
|
||||
# Create a CA key and add it to known hosts
|
||||
${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/host_ca_key ||\
|
||||
fail "ssh-keygen of host_ca_key failed"
|
||||
(
|
||||
echo -n '@cert-authority '
|
||||
echo -n "$HOSTS "
|
||||
cat $OBJ/host_ca_key.pub
|
||||
) > $OBJ/known_hosts-cert
|
||||
|
||||
# Generate and sign host keys
|
||||
for ktype in rsa dsa ; do
|
||||
verbose "$tid: sign host ${ktype} cert"
|
||||
# Generate and sign a host key
|
||||
${SSHKEYGEN} -q -N '' -t ${ktype} \
|
||||
-f $OBJ/cert_host_key_${ktype} || \
|
||||
fail "ssh-keygen of cert_host_key_${ktype} failed"
|
||||
${SSHKEYGEN} -h -q -s $OBJ/host_ca_key \
|
||||
-I "regress host key for $USER" \
|
||||
-n $HOSTS $OBJ/cert_host_key_${ktype} ||
|
||||
fail "couldn't sign cert_host_key_${ktype}"
|
||||
done
|
||||
|
||||
# Basic connect tests
|
||||
for privsep in yes no ; do
|
||||
for ktype in rsa dsa ; do
|
||||
verbose "$tid: host ${ktype} cert connect privsep $privsep"
|
||||
(
|
||||
cat $OBJ/sshd_proxy_bak
|
||||
echo HostKey $OBJ/cert_host_key_${ktype}
|
||||
echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
|
||||
echo UsePrivilegeSeparation $privsep
|
||||
) > $OBJ/sshd_proxy
|
||||
|
||||
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
|
||||
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
|
||||
-F $OBJ/ssh_proxy somehost true
|
||||
if [ $? -ne 0 ]; then
|
||||
fail "ssh cert connect failed"
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
test_one() {
|
||||
ident=$1
|
||||
result=$2
|
||||
sign_opts=$3
|
||||
|
||||
verbose "$tid: test host cert connect $ident expect $result"
|
||||
|
||||
${SSHKEYGEN} -q -s $OBJ/host_ca_key -I "regress host key for $USER" \
|
||||
$sign_opts \
|
||||
$OBJ/cert_host_key_rsa ||
|
||||
fail "couldn't sign cert_host_key_rsa"
|
||||
(
|
||||
cat $OBJ/sshd_proxy_bak
|
||||
echo HostKey $OBJ/cert_host_key_rsa
|
||||
echo HostCertificate $OBJ/cert_host_key_rsa-cert.pub
|
||||
) > $OBJ/sshd_proxy
|
||||
|
||||
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
|
||||
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
|
||||
-F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
||||
rc=$?
|
||||
if [ "x$result" = "xsuccess" ] ; then
|
||||
if [ $rc -ne 0 ]; then
|
||||
fail "ssh cert connect $ident failed unexpectedly"
|
||||
fi
|
||||
else
|
||||
if [ $rc -eq 0 ]; then
|
||||
fail "ssh cert connect $ident succeeded unexpectedly"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
test_one "user-certificate" failure "-n $HOSTS"
|
||||
test_one "empty principals" success "-h"
|
||||
test_one "wrong principals" failure "-h -n foo"
|
||||
test_one "cert not yet valid" failure "-h -V20200101:20300101"
|
||||
test_one "cert expired" failure "-h -V19800101:19900101"
|
||||
test_one "cert valid interval" success "-h -V-1w:+2w"
|
||||
test_one "cert has constraints" failure "-h -Oforce-command=false"
|
||||
|
||||
# Check downgrade of cert to raw key when no CA found
|
||||
rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
|
||||
for ktype in rsa dsa ; do
|
||||
verbose "$tid: host ${ktype} cert downgrade to raw key"
|
||||
# Generate and sign a host key
|
||||
${SSHKEYGEN} -q -N '' -t ${ktype} \
|
||||
-f $OBJ/cert_host_key_${ktype} || \
|
||||
fail "ssh-keygen of cert_host_key_${ktype} failed"
|
||||
${SSHKEYGEN} -h -q -s $OBJ/host_ca_key -I "regress host key for $USER" \
|
||||
-n $HOSTS $OBJ/cert_host_key_${ktype} ||
|
||||
fail "couldn't sign cert_host_key_${ktype}"
|
||||
(
|
||||
echo -n "$HOSTS "
|
||||
cat $OBJ/cert_host_key_${ktype}.pub
|
||||
) > $OBJ/known_hosts-cert
|
||||
(
|
||||
cat $OBJ/sshd_proxy_bak
|
||||
echo HostKey $OBJ/cert_host_key_${ktype}
|
||||
echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
|
||||
) > $OBJ/sshd_proxy
|
||||
|
||||
${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
|
||||
-oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
|
||||
-F $OBJ/ssh_proxy somehost true
|
||||
if [ $? -ne 0 ]; then
|
||||
fail "ssh cert connect failed"
|
||||
fi
|
||||
done
|
||||
|
||||
rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
# $OpenBSD: cert-userkey.sh,v 1.1 2010/02/26 20:33:21 djm Exp $
|
||||
# Placed in the Public Domain.
|
||||
|
||||
tid="certified user keys"
|
||||
|
||||
rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
|
||||
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
|
||||
|
||||
# Create a CA key and add it to authorized_keys
|
||||
${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_ca_key ||\
|
||||
fail "ssh-keygen of user_ca_key failed"
|
||||
(
|
||||
echo -n 'cert-authority '
|
||||
cat $OBJ/user_ca_key.pub
|
||||
) > $OBJ/authorized_keys_$USER
|
||||
|
||||
# Generate and sign user keys
|
||||
for ktype in rsa dsa ; do
|
||||
verbose "$tid: sign user ${ktype} cert"
|
||||
${SSHKEYGEN} -q -N '' -t ${ktype} \
|
||||
-f $OBJ/cert_user_key_${ktype} || \
|
||||
fail "ssh-keygen of cert_user_key_${ktype} failed"
|
||||
${SSHKEYGEN} -q -s $OBJ/user_ca_key -I \
|
||||
"regress user key for $USER" \
|
||||
-n $USER $OBJ/cert_user_key_${ktype} ||
|
||||
fail "couldn't sign cert_user_key_${ktype}"
|
||||
|
||||
done
|
||||
|
||||
# Basic connect tests
|
||||
for privsep in yes no ; do
|
||||
for ktype in rsa dsa ; do
|
||||
verbose "$tid: user ${ktype} cert connect privsep $privsep"
|
||||
(
|
||||
cat $OBJ/sshd_proxy_bak
|
||||
echo "UsePrivilegeSeparation $privsep"
|
||||
) > $OBJ/sshd_proxy
|
||||
|
||||
${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
|
||||
somehost true
|
||||
if [ $? -ne 0 ]; then
|
||||
fail "ssh cert connect failed"
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
verbose "$tid: ensure CA key does not authenticate user"
|
||||
${SSH} -2i $OBJ/user_ca_key -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
fail "ssh cert connect with CA key succeeded unexpectedly"
|
||||
fi
|
||||
|
||||
test_one() {
|
||||
ident=$1
|
||||
result=$2
|
||||
sign_opts=$3
|
||||
|
||||
verbose "$tid: test user cert connect $ident expect $result"
|
||||
|
||||
${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
|
||||
$sign_opts \
|
||||
$OBJ/cert_user_key_rsa ||
|
||||
fail "couldn't sign cert_user_key_rsa"
|
||||
|
||||
${SSH} -2i $OBJ/cert_user_key_rsa -F $OBJ/ssh_proxy \
|
||||
somehost true >/dev/null 2>&1
|
||||
rc=$?
|
||||
if [ "x$result" = "xsuccess" ] ; then
|
||||
if [ $rc -ne 0 ]; then
|
||||
fail "ssh cert connect $ident failed unexpectedly"
|
||||
fi
|
||||
else
|
||||
if [ $rc -eq 0 ]; then
|
||||
fail "ssh cert connect $ident succeeded unexpectedly"
|
||||
fi
|
||||
fi
|
||||
cleanup
|
||||
}
|
||||
|
||||
test_one "host-certificate" failure "-h"
|
||||
test_one "empty principals" success ""
|
||||
test_one "wrong principals" failure "-n foo"
|
||||
test_one "cert not yet valid" failure "-V20200101:20300101"
|
||||
test_one "cert expired" failure "-V19800101:19900101"
|
||||
test_one "cert valid interval" success "-V-1w:+2w"
|
||||
test_one "wrong source-address" failure "-Osource-address=10.0.0.0/8"
|
||||
test_one "force-command" failure "-Oforce-command=false"
|
||||
|
||||
rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
|
||||
Loading…
Reference in New Issue