regress/cert-hostkey.sh

   1 #       $OpenBSD: cert-hostkey.sh,v 1.5 2010/08/31 12:24:09 djm Exp $
   2 #       Placed in the Public Domain.
   3
   4 tid="certified host keys"
   5
   6 # used to disable ECC based tests on platforms without ECC
   7 ecdsa=""
   8 if grep "#define.*OPENSSL_HAS_ECC" ${BUILDDIR}/config.h >/dev/null 2>&1
   9 then
  10         ecdsa=ecdsa
  11 fi
  12
  13 rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
  14 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
  15
  16 HOSTS='localhost-with-alias,127.0.0.1,::1'
  17
  18 # Create a CA key and add it to known hosts
  19 ${SSHKEYGEN} -q -N '' -t rsa  -f $OBJ/host_ca_key ||\
  20         fail "ssh-keygen of host_ca_key failed"
  21 (
  22         echon '@cert-authority '
  23         echon "$HOSTS "
  24         cat $OBJ/host_ca_key.pub
  25 ) > $OBJ/known_hosts-cert
  26
  27 # Generate and sign host keys
  28 for ktype in rsa dsa $ecdsa ; do
  29         verbose "$tid: sign host ${ktype} cert"
  30         # Generate and sign a host key
  31         ${SSHKEYGEN} -q -N '' -t ${ktype} \
  32             -f $OBJ/cert_host_key_${ktype} || \
  33                 fail "ssh-keygen of cert_host_key_${ktype} failed"
  34         ${SSHKEYGEN} -h -q -s $OBJ/host_ca_key \
  35             -I "regress host key for $USER" \
  36             -n $HOSTS $OBJ/cert_host_key_${ktype} ||
  37                 fail "couldn't sign cert_host_key_${ktype}"
  38         # v00 ecdsa certs do not exist
  39         test "{ktype}" = "ecdsa" && continue
  40         cp $OBJ/cert_host_key_${ktype} $OBJ/cert_host_key_${ktype}_v00
  41         cp $OBJ/cert_host_key_${ktype}.pub $OBJ/cert_host_key_${ktype}_v00.pub
  42         ${SSHKEYGEN} -t v00 -h -q -s $OBJ/host_ca_key \
  43             -I "regress host key for $USER" \
  44             -n $HOSTS $OBJ/cert_host_key_${ktype}_v00 ||
  45                 fail "couldn't sign cert_host_key_${ktype}_v00"
  46 done
  47
  48 # Basic connect tests
  49 for privsep in yes no ; do
  50         for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00; do
  51                 verbose "$tid: host ${ktype} cert connect privsep $privsep"
  52                 (
  53                         cat $OBJ/sshd_proxy_bak
  54                         echo HostKey $OBJ/cert_host_key_${ktype}
  55                         echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
  56                         echo UsePrivilegeSeparation $privsep
  57                 ) > $OBJ/sshd_proxy
  58
  59                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
  60                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
  61                         -F $OBJ/ssh_proxy somehost true
  62                 if [ $? -ne 0 ]; then
  63                         fail "ssh cert connect failed"
  64                 fi
  65         done
  66 done
  67
  68 # Revoked certificates with key present
  69 (
  70         echon '@cert-authority '
  71         echon "$HOSTS "
  72         cat $OBJ/host_ca_key.pub
  73         echon '@revoked '
  74         echon "* "
  75         cat $OBJ/cert_host_key_rsa.pub
  76         echon '@revoked '
  77         echon "* "
  78         cat $OBJ/cert_host_key_ecdsa.pub
  79         echon '@revoked '
  80         echon "* "
  81         cat $OBJ/cert_host_key_dsa.pub
  82         echon '@revoked '
  83         echon "* "
  84         cat $OBJ/cert_host_key_rsa_v00.pub
  85         echon '@revoked '
  86         echon "* "
  87         cat $OBJ/cert_host_key_dsa_v00.pub
  88 ) > $OBJ/known_hosts-cert
  89 for privsep in yes no ; do
  90         for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00; do
  91                 verbose "$tid: host ${ktype} revoked cert privsep $privsep"
  92                 (
  93                         cat $OBJ/sshd_proxy_bak
  94                         echo HostKey $OBJ/cert_host_key_${ktype}
  95                         echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
  96                         echo UsePrivilegeSeparation $privsep
  97                 ) > $OBJ/sshd_proxy
  98
  99                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 100                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 101                         -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
 102                 if [ $? -eq 0 ]; then
 103                         fail "ssh cert connect succeeded unexpectedly"
 104                 fi
 105         done
 106 done
 107
 108 # Revoked CA
 109 (
 110         echon '@cert-authority '
 111         echon "$HOSTS "
 112         cat $OBJ/host_ca_key.pub
 113         echon '@revoked '
 114         echon "* "
 115         cat $OBJ/host_ca_key.pub
 116 ) > $OBJ/known_hosts-cert
 117 for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
 118         verbose "$tid: host ${ktype} revoked cert"
 119         (
 120                 cat $OBJ/sshd_proxy_bak
 121                 echo HostKey $OBJ/cert_host_key_${ktype}
 122                 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
 123         ) > $OBJ/sshd_proxy
 124         ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 125             -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 126                 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
 127         if [ $? -eq 0 ]; then
 128                 fail "ssh cert connect succeeded unexpectedly"
 129         fi
 130 done
 131
 132 # Create a CA key and add it to known hosts
 133 (
 134         echon '@cert-authority '
 135         echon "$HOSTS "
 136         cat $OBJ/host_ca_key.pub
 137 ) > $OBJ/known_hosts-cert
 138
 139 test_one() {
 140         ident=$1
 141         result=$2
 142         sign_opts=$3
 143
 144         for kt in rsa rsa_v00 ; do
 145                 case $kt in
 146                 *_v00) args="-t v00" ;;
 147                 *) args="" ;;
 148                 esac
 149
 150                 verbose "$tid: host cert connect $ident $kt expect $result"
 151                 ${SSHKEYGEN} -q -s $OBJ/host_ca_key \
 152                     -I "regress host key for $USER" \
 153                     $sign_opts $args \
 154                     $OBJ/cert_host_key_${kt} ||
 155                         fail "couldn't sign cert_host_key_${kt}"
 156                 (
 157                         cat $OBJ/sshd_proxy_bak
 158                         echo HostKey $OBJ/cert_host_key_${kt}
 159                         echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
 160                 ) > $OBJ/sshd_proxy
 161
 162                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 163                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 164                     -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
 165                 rc=$?
 166                 if [ "x$result" = "xsuccess" ] ; then
 167                         if [ $rc -ne 0 ]; then
 168                                 fail "ssh cert connect $ident failed unexpectedly"
 169                         fi
 170                 else
 171                         if [ $rc -eq 0 ]; then
 172                                 fail "ssh cert connect $ident succeeded unexpectedly"
 173                         fi
 174                 fi
 175         done
 176 }
 177
 178 test_one "user-certificate"     failure "-n $HOSTS"
 179 test_one "empty principals"     success "-h"
 180 test_one "wrong principals"     failure "-h -n foo"
 181 test_one "cert not yet valid"   failure "-h -V20200101:20300101"
 182 test_one "cert expired"         failure "-h -V19800101:19900101"
 183 test_one "cert valid interval"  success "-h -V-1w:+2w"
 184 test_one "cert has constraints" failure "-h -Oforce-command=false"
 185
 186 # Check downgrade of cert to raw key when no CA found
 187 for v in v01 v00 ;  do
 188         for ktype in rsa dsa $ecdsa ; do
 189                 # v00 ecdsa certs do not exist.
 190                 test "${v}${ktype}" = "v00ecdsa" && continue
 191                 rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
 192                 verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
 193                 # Generate and sign a host key
 194                 ${SSHKEYGEN} -q -N '' -t ${ktype} \
 195                     -f $OBJ/cert_host_key_${ktype} || \
 196                         fail "ssh-keygen of cert_host_key_${ktype} failed"
 197                 ${SSHKEYGEN} -t ${v} -h -q -s $OBJ/host_ca_key \
 198                     -I "regress host key for $USER" \
 199                     -n $HOSTS $OBJ/cert_host_key_${ktype} ||
 200                         fail "couldn't sign cert_host_key_${ktype}"
 201                 (
 202                         echon "$HOSTS "
 203                         cat $OBJ/cert_host_key_${ktype}.pub
 204                 ) > $OBJ/known_hosts-cert
 205                 (
 206                         cat $OBJ/sshd_proxy_bak
 207                         echo HostKey $OBJ/cert_host_key_${ktype}
 208                         echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
 209                 ) > $OBJ/sshd_proxy
 210
 211                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 212                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 213                         -F $OBJ/ssh_proxy somehost true
 214                 if [ $? -ne 0 ]; then
 215                         fail "ssh cert connect failed"
 216                 fi
 217         done
 218 done
 219
 220 # Wrong certificate
 221 (
 222         echon '@cert-authority '
 223         echon "$HOSTS "
 224         cat $OBJ/host_ca_key.pub
 225 ) > $OBJ/known_hosts-cert
 226 for v in v01 v00 ;  do
 227         for kt in rsa dsa $ecdsa ; do
 228                 # v00 ecdsa certs do not exist.
 229                 test "${v}${ktype}" = "v00ecdsa" && continue
 230                 rm -f $OBJ/cert_host_key*
 231                 # Self-sign key
 232                 ${SSHKEYGEN} -q -N '' -t ${kt} \
 233                     -f $OBJ/cert_host_key_${kt} || \
 234                         fail "ssh-keygen of cert_host_key_${kt} failed"
 235                 ${SSHKEYGEN} -t ${v} -h -q -s $OBJ/cert_host_key_${kt} \
 236                     -I "regress host key for $USER" \
 237                     -n $HOSTS $OBJ/cert_host_key_${kt} ||
 238                         fail "couldn't sign cert_host_key_${kt}"
 239                 verbose "$tid: host ${kt} connect wrong cert"
 240                 (
 241                         cat $OBJ/sshd_proxy_bak
 242                         echo HostKey $OBJ/cert_host_key_${kt}
 243                         echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
 244                 ) > $OBJ/sshd_proxy
 245
 246                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 247                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 248                         -F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
 249                 if [ $? -eq 0 ]; then
 250                         fail "ssh cert connect $ident succeeded unexpectedly"
 251                 fi
 252         done
 253 done
 254
 255 rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*