regress/cert-hostkey.sh

   1 #       $OpenBSD: cert-hostkey.sh,v 1.5 2010/08/31 12:24:09 djm Exp $
   2 #       Placed in the Public Domain.
   3
   4 tid="certified host keys"
   5
   6 # used to disable ECC based tests on platforms without ECC
   7 ecdsa=""
   8 if test "x$TEST_SSH_ECC" = "xyes"; then
   9         ecdsa=ecdsa
  10 fi
  11
  12 rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
  13 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
  14
  15 HOSTS='localhost-with-alias,127.0.0.1,::1'
  16
  17 # Create a CA key and add it to known hosts
  18 ${SSHKEYGEN} -q -N '' -t rsa  -f $OBJ/host_ca_key ||\
  19         fail "ssh-keygen of host_ca_key failed"
  20 (
  21         echon '@cert-authority '
  22         echon "$HOSTS "
  23         cat $OBJ/host_ca_key.pub
  24 ) > $OBJ/known_hosts-cert
  25
  26 # Generate and sign host keys
  27 for ktype in rsa dsa $ecdsa ; do
  28         verbose "$tid: sign host ${ktype} cert"
  29         # Generate and sign a host key
  30         ${SSHKEYGEN} -q -N '' -t ${ktype} \
  31             -f $OBJ/cert_host_key_${ktype} || \
  32                 fail "ssh-keygen of cert_host_key_${ktype} failed"
  33         ${SSHKEYGEN} -h -q -s $OBJ/host_ca_key \
  34             -I "regress host key for $USER" \
  35             -n $HOSTS $OBJ/cert_host_key_${ktype} ||
  36                 fail "couldn't sign cert_host_key_${ktype}"
  37         # v00 ecdsa certs do not exist
  38         test "${ktype}" = "ecdsa" && continue
  39         cp $OBJ/cert_host_key_${ktype} $OBJ/cert_host_key_${ktype}_v00
  40         cp $OBJ/cert_host_key_${ktype}.pub $OBJ/cert_host_key_${ktype}_v00.pub
  41         ${SSHKEYGEN} -t v00 -h -q -s $OBJ/host_ca_key \
  42             -I "regress host key for $USER" \
  43             -n $HOSTS $OBJ/cert_host_key_${ktype}_v00 ||
  44                 fail "couldn't sign cert_host_key_${ktype}_v00"
  45 done
  46
  47 # Basic connect tests
  48 for privsep in yes no ; do
  49         for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00; do
  50                 verbose "$tid: host ${ktype} cert connect privsep $privsep"
  51                 (
  52                         cat $OBJ/sshd_proxy_bak
  53                         echo HostKey $OBJ/cert_host_key_${ktype}
  54                         echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
  55                         echo UsePrivilegeSeparation $privsep
  56                 ) > $OBJ/sshd_proxy
  57
  58                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
  59                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
  60                         -F $OBJ/ssh_proxy somehost true
  61                 if [ $? -ne 0 ]; then
  62                         fail "ssh cert connect failed"
  63                 fi
  64         done
  65 done
  66
  67 # Revoked certificates with key present
  68 (
  69         echon '@cert-authority '
  70         echon "$HOSTS "
  71         cat $OBJ/host_ca_key.pub
  72         echon '@revoked '
  73         echon "* "
  74         cat $OBJ/cert_host_key_rsa.pub
  75         echon '@revoked '
  76         echon "* "
  77         cat $OBJ/cert_host_key_ecdsa.pub
  78         echon '@revoked '
  79         echon "* "
  80         cat $OBJ/cert_host_key_dsa.pub
  81         echon '@revoked '
  82         echon "* "
  83         cat $OBJ/cert_host_key_rsa_v00.pub
  84         echon '@revoked '
  85         echon "* "
  86         cat $OBJ/cert_host_key_dsa_v00.pub
  87 ) > $OBJ/known_hosts-cert
  88 for privsep in yes no ; do
  89         for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00; do
  90                 verbose "$tid: host ${ktype} revoked cert privsep $privsep"
  91                 (
  92                         cat $OBJ/sshd_proxy_bak
  93                         echo HostKey $OBJ/cert_host_key_${ktype}
  94                         echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
  95                         echo UsePrivilegeSeparation $privsep
  96                 ) > $OBJ/sshd_proxy
  97
  98                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
  99                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 100                         -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
 101                 if [ $? -eq 0 ]; then
 102                         fail "ssh cert connect succeeded unexpectedly"
 103                 fi
 104         done
 105 done
 106
 107 # Revoked CA
 108 (
 109         echon '@cert-authority '
 110         echon "$HOSTS "
 111         cat $OBJ/host_ca_key.pub
 112         echon '@revoked '
 113         echon "* "
 114         cat $OBJ/host_ca_key.pub
 115 ) > $OBJ/known_hosts-cert
 116 for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
 117         verbose "$tid: host ${ktype} revoked cert"
 118         (
 119                 cat $OBJ/sshd_proxy_bak
 120                 echo HostKey $OBJ/cert_host_key_${ktype}
 121                 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
 122         ) > $OBJ/sshd_proxy
 123         ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 124             -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 125                 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
 126         if [ $? -eq 0 ]; then
 127                 fail "ssh cert connect succeeded unexpectedly"
 128         fi
 129 done
 130
 131 # Create a CA key and add it to known hosts
 132 (
 133         echon '@cert-authority '
 134         echon "$HOSTS "
 135         cat $OBJ/host_ca_key.pub
 136 ) > $OBJ/known_hosts-cert
 137
 138 test_one() {
 139         ident=$1
 140         result=$2
 141         sign_opts=$3
 142
 143         for kt in rsa rsa_v00 ; do
 144                 case $kt in
 145                 *_v00) args="-t v00" ;;
 146                 *) args="" ;;
 147                 esac
 148
 149                 verbose "$tid: host cert connect $ident $kt expect $result"
 150                 ${SSHKEYGEN} -q -s $OBJ/host_ca_key \
 151                     -I "regress host key for $USER" \
 152                     $sign_opts $args \
 153                     $OBJ/cert_host_key_${kt} ||
 154                         fail "couldn't sign cert_host_key_${kt}"
 155                 (
 156                         cat $OBJ/sshd_proxy_bak
 157                         echo HostKey $OBJ/cert_host_key_${kt}
 158                         echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
 159                 ) > $OBJ/sshd_proxy
 160
 161                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 162                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 163                     -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
 164                 rc=$?
 165                 if [ "x$result" = "xsuccess" ] ; then
 166                         if [ $rc -ne 0 ]; then
 167                                 fail "ssh cert connect $ident failed unexpectedly"
 168                         fi
 169                 else
 170                         if [ $rc -eq 0 ]; then
 171                                 fail "ssh cert connect $ident succeeded unexpectedly"
 172                         fi
 173                 fi
 174         done
 175 }
 176
 177 test_one "user-certificate"     failure "-n $HOSTS"
 178 test_one "empty principals"     success "-h"
 179 test_one "wrong principals"     failure "-h -n foo"
 180 test_one "cert not yet valid"   failure "-h -V20200101:20300101"
 181 test_one "cert expired"         failure "-h -V19800101:19900101"
 182 test_one "cert valid interval"  success "-h -V-1w:+2w"
 183 test_one "cert has constraints" failure "-h -Oforce-command=false"
 184
 185 # Check downgrade of cert to raw key when no CA found
 186 for v in v01 v00 ;  do
 187         for ktype in rsa dsa $ecdsa ; do
 188                 # v00 ecdsa certs do not exist.
 189                 test "${v}${ktype}" = "v00ecdsa" && continue
 190                 rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
 191                 verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
 192                 # Generate and sign a host key
 193                 ${SSHKEYGEN} -q -N '' -t ${ktype} \
 194                     -f $OBJ/cert_host_key_${ktype} || \
 195                         fail "ssh-keygen of cert_host_key_${ktype} failed"
 196                 ${SSHKEYGEN} -t ${v} -h -q -s $OBJ/host_ca_key \
 197                     -I "regress host key for $USER" \
 198                     -n $HOSTS $OBJ/cert_host_key_${ktype} ||
 199                         fail "couldn't sign cert_host_key_${ktype}"
 200                 (
 201                         echon "$HOSTS "
 202                         cat $OBJ/cert_host_key_${ktype}.pub
 203                 ) > $OBJ/known_hosts-cert
 204                 (
 205                         cat $OBJ/sshd_proxy_bak
 206                         echo HostKey $OBJ/cert_host_key_${ktype}
 207                         echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
 208                 ) > $OBJ/sshd_proxy
 209
 210                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 211                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 212                         -F $OBJ/ssh_proxy somehost true
 213                 if [ $? -ne 0 ]; then
 214                         fail "ssh cert connect failed"
 215                 fi
 216         done
 217 done
 218
 219 # Wrong certificate
 220 (
 221         echon '@cert-authority '
 222         echon "$HOSTS "
 223         cat $OBJ/host_ca_key.pub
 224 ) > $OBJ/known_hosts-cert
 225 for v in v01 v00 ;  do
 226         for kt in rsa dsa $ecdsa ; do
 227                 # v00 ecdsa certs do not exist.
 228                 test "${v}${ktype}" = "v00ecdsa" && continue
 229                 rm -f $OBJ/cert_host_key*
 230                 # Self-sign key
 231                 ${SSHKEYGEN} -q -N '' -t ${kt} \
 232                     -f $OBJ/cert_host_key_${kt} || \
 233                         fail "ssh-keygen of cert_host_key_${kt} failed"
 234                 ${SSHKEYGEN} -t ${v} -h -q -s $OBJ/cert_host_key_${kt} \
 235                     -I "regress host key for $USER" \
 236                     -n $HOSTS $OBJ/cert_host_key_${kt} ||
 237                         fail "couldn't sign cert_host_key_${kt}"
 238                 verbose "$tid: host ${kt} connect wrong cert"
 239                 (
 240                         cat $OBJ/sshd_proxy_bak
 241                         echo HostKey $OBJ/cert_host_key_${kt}
 242                         echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
 243                 ) > $OBJ/sshd_proxy
 244
 245                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 246                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 247                         -F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
 248                 if [ $? -eq 0 ]; then
 249                         fail "ssh cert connect $ident succeeded unexpectedly"
 250                 fi
 251         done
 252 done
 253
 254 rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*