mirror of
git://anongit.mindrot.org/openssh.git
synced 2025-02-27 03:11:00 +00:00
upstream commit
regress test for CertificateFile; patch from Meghana Bhat via bz#2436 Upstream-Regress-ID: e7a6e980cbe0f8081ba2e83de40d06c17be8bd25
This commit is contained in:
djm@openbsd.org
Damien Miller
parent
905b054ed2
commit
e14ac43b75
@ -1,4 +1,4 @@
|
||||
# $OpenBSD: Makefile,v 1.81 2015/05/21 06:44:25 djm Exp $
|
||||
# $OpenBSD: Makefile,v 1.82 2015/09/24 06:16:53 djm Exp $
|
||||
|
||||
REGRESS_TARGETS= unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t-exec
|
||||
tests: prep $(REGRESS_TARGETS)
|
||||
@ -74,7 +74,8 @@ LTESTS= connect \
|
||||
hostkey-agent \
|
||||
keygen-knownhosts \
|
||||
hostkey-rotate \
|
||||
principals-command
|
||||
principals-command \
|
||||
cert-file
|
||||
|
||||
|
||||
# dhgex \
|
||||
|
||||
136
regress/cert-file.sh
Normal file
136
regress/cert-file.sh
Normal file
@ -0,0 +1,136 @@
|
||||
# $OpenBSD: cert-file.sh,v 1.1 2015/09/24 06:16:53 djm Exp $
|
||||
# Placed in the Public Domain.
|
||||
|
||||
tid="ssh with certificates"
|
||||
|
||||
rm -f $OBJ/user_ca_key* $OBJ/user_key*
|
||||
rm -f $OBJ/cert_user_key*
|
||||
|
||||
# Create a CA key
|
||||
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key1 ||\
|
||||
fatal "ssh-keygen failed"
|
||||
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key2 ||\
|
||||
fatal "ssh-keygen failed"
|
||||
|
||||
# Make some keys and certificates.
|
||||
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key1 || \
|
||||
fatal "ssh-keygen failed"
|
||||
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_key2 || \
|
||||
fatal "ssh-keygen failed"
|
||||
# Move the certificate to a different address to better control
|
||||
# when it is offered.
|
||||
${SSHKEYGEN} -q -s $OBJ/user_ca_key1 -I "regress user key for $USER" \
|
||||
-z $$ -n ${USER} $OBJ/user_key1 ||
|
||||
fail "couldn't sign user_key1 with user_ca_key1"
|
||||
mv $OBJ/user_key1-cert.pub $OBJ/cert_user_key1_1.pub
|
||||
${SSHKEYGEN} -q -s $OBJ/user_ca_key2 -I "regress user key for $USER" \
|
||||
-z $$ -n ${USER} $OBJ/user_key1 ||
|
||||
fail "couldn't sign user_key1 with user_ca_key2"
|
||||
mv $OBJ/user_key1-cert.pub $OBJ/cert_user_key1_2.pub
|
||||
|
||||
trace 'try with identity files'
|
||||
opts="-F $OBJ/ssh_proxy -oIdentitiesOnly=yes"
|
||||
opts2="$opts -i $OBJ/user_key1 -i $OBJ/user_key2"
|
||||
echo "cert-authority $(cat $OBJ/user_ca_key1.pub)" > $OBJ/authorized_keys_$USER
|
||||
|
||||
for p in ${SSH_PROTOCOLS}; do
|
||||
# Just keys should fail
|
||||
${SSH} $opts2 somehost exit 5$p
|
||||
r=$?
|
||||
if [ $r -eq 5$p ]; then
|
||||
fail "ssh succeeded with no certs in protocol $p"
|
||||
fi
|
||||
|
||||
# Keys with untrusted cert should fail.
|
||||
opts3="$opts2 -z $OBJ/cert_user_key1_2.pub"
|
||||
${SSH} $opts3 somehost exit 5$p
|
||||
r=$?
|
||||
if [ $r -eq 5$p ]; then
|
||||
fail "ssh succeeded with bad cert in protocol $p"
|
||||
fi
|
||||
|
||||
# Good cert with bad key should fail.
|
||||
opts3="$opts -i $OBJ/user_key2 -z $OBJ/cert_user_key1_1.pub"
|
||||
${SSH} $opts3 somehost exit 5$p
|
||||
r=$?
|
||||
if [ $r -eq 5$p ]; then
|
||||
fail "ssh succeeded with no matching key in protocol $p"
|
||||
fi
|
||||
|
||||
# Keys with one trusted cert, should succeed.
|
||||
opts3="$opts2 -z $OBJ/cert_user_key1_1.pub"
|
||||
${SSH} $opts3 somehost exit 5$p
|
||||
r=$?
|
||||
if [ $r -ne 5$p ]; then
|
||||
fail "ssh failed with trusted cert and key in protocol $p"
|
||||
fi
|
||||
|
||||
# Multiple certs and keys, with one trusted cert, should succeed.
|
||||
opts3="$opts2 -z $OBJ/cert_user_key1_2.pub -z $OBJ/cert_user_key1_1.pub"
|
||||
${SSH} $opts3 somehost exit 5$p
|
||||
r=$?
|
||||
if [ $r -ne 5$p ]; then
|
||||
fail "ssh failed with multiple certs in protocol $p"
|
||||
fi
|
||||
|
||||
#Keys with trusted certificate specified in config options, should succeed.
|
||||
opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
|
||||
${SSH} $opts3 somehost exit 5$p
|
||||
r=$?
|
||||
if [ $r -ne 5$p ]; then
|
||||
fail "ssh failed with trusted cert in config in protocol $p"
|
||||
fi
|
||||
done
|
||||
|
||||
#next, using an agent in combination with the keys
|
||||
SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1
|
||||
if [ $? -ne 2 ]; then
|
||||
fatal "ssh-add -l did not fail with exit code 2"
|
||||
fi
|
||||
|
||||
trace "start agent"
|
||||
eval `${SSHAGENT} -s` > /dev/null
|
||||
r=$?
|
||||
if [ $r -ne 0 ]; then
|
||||
fatal "could not start ssh-agent: exit code $r"
|
||||
fi
|
||||
|
||||
# add private keys to agent
|
||||
${SSHADD} -k $OBJ/user_key2 > /dev/null 2>&1
|
||||
if [ $? -ne 0 ]; then
|
||||
fatal "ssh-add did not succeed with exit code 0"
|
||||
fi
|
||||
${SSHADD} -k $OBJ/user_key1 > /dev/null 2>&1
|
||||
if [ $? -ne 0 ]; then
|
||||
fatal "ssh-add did not succeed with exit code 0"
|
||||
fi
|
||||
|
||||
# try ssh with the agent and certificates
|
||||
# note: ssh agent only uses certificates in protocol 2
|
||||
opts="-F $OBJ/ssh_proxy"
|
||||
# with no certificates, shoud fail
|
||||
${SSH} -2 $opts somehost exit 52
|
||||
if [ $? -eq 52 ]; then
|
||||
fail "ssh connect with agent in protocol 2 succeeded with no cert"
|
||||
fi
|
||||
|
||||
#with an untrusted certificate, should fail
|
||||
opts="$opts -z $OBJ/cert_user_key1_2.pub"
|
||||
${SSH} -2 $opts somehost exit 52
|
||||
if [ $? -eq 52 ]; then
|
||||
fail "ssh connect with agent in protocol 2 succeeded with bad cert"
|
||||
fi
|
||||
|
||||
#with an additional trusted certificate, should succeed
|
||||
opts="$opts -z $OBJ/cert_user_key1_1.pub"
|
||||
${SSH} -2 $opts somehost exit 52
|
||||
if [ $? -ne 52 ]; then
|
||||
fail "ssh connect with agent in protocol 2 failed with good cert"
|
||||
fi
|
||||
|
||||
trace "kill agent"
|
||||
${SSHAGENT} -k > /dev/null
|
||||
|
||||
#cleanup
|
||||
rm -f $OBJ/user_ca_key* $OBJ/user_key*
|
||||
rm -f $OBJ/cert_user_key*
|
||||
@ -1,4 +1,4 @@
|
||||
# $OpenBSD: limit-keytype.sh,v 1.1 2015/01/13 07:49:49 djm Exp $
|
||||
# $OpenBSD: limit-keytype.sh,v 1.2 2015/09/24 06:16:53 djm Exp $
|
||||
# Placed in the Public Domain.
|
||||
|
||||
tid="restrict pubkey type"
|
||||
@ -26,12 +26,11 @@ ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
|
||||
# Copy the private key alongside the cert to allow better control of when
|
||||
# it is offered.
|
||||
mv $OBJ/user_key3-cert.pub $OBJ/cert_user_key3.pub
|
||||
cp -p $OBJ/user_key3 $OBJ/cert_user_key3
|
||||
|
||||
grep -v IdentityFile $OBJ/ssh_proxy.orig > $OBJ/ssh_proxy
|
||||
|
||||
opts="-oProtocol=2 -F $OBJ/ssh_proxy -oIdentitiesOnly=yes"
|
||||
fullopts="$opts -i $OBJ/cert_user_key3 -i $OBJ/user_key1 -i $OBJ/user_key2"
|
||||
certopts="$opts -i $OBJ/user_key3 -oCertificateFile=$OBJ/cert_user_key3.pub"
|
||||
|
||||
echo mekmitasdigoat > $OBJ/authorized_principals_$USER
|
||||
cat $OBJ/user_key1.pub > $OBJ/authorized_keys_$USER
|
||||
@ -53,28 +52,28 @@ prepare_config() {
|
||||
prepare_config
|
||||
|
||||
# Check we can log in with all key types.
|
||||
${SSH} $opts -i $OBJ/cert_user_key3 proxy true || fatal "cert failed"
|
||||
${SSH} $certopts proxy true || fatal "cert failed"
|
||||
${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
|
||||
${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
|
||||
|
||||
# Allow plain Ed25519 and RSA. The certificate should fail.
|
||||
verbose "privsep=$privsep allow rsa,ed25519"
|
||||
verbose "allow rsa,ed25519"
|
||||
prepare_config "PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519"
|
||||
${SSH} $opts -i $OBJ/cert_user_key3 proxy true && fatal "cert succeeded"
|
||||
${SSH} $certopt proxy true && fatal "cert succeeded"
|
||||
${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
|
||||
${SSH} $opts -i $OBJ/user_key2 proxy true || fatal "key2 failed"
|
||||
|
||||
# Allow Ed25519 only.
|
||||
verbose "privsep=$privsep allow ed25519"
|
||||
verbose "allow ed25519"
|
||||
prepare_config "PubkeyAcceptedKeyTypes ssh-ed25519"
|
||||
${SSH} $opts -i $OBJ/cert_user_key3 proxy true && fatal "cert succeeded"
|
||||
${SSH} $certopts proxy true && fatal "cert succeeded"
|
||||
${SSH} $opts -i $OBJ/user_key1 proxy true || fatal "key1 failed"
|
||||
${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded"
|
||||
|
||||
# Allow all certs. Plain keys should fail.
|
||||
verbose "privsep=$privsep allow cert only"
|
||||
verbose "allow cert only"
|
||||
prepare_config "PubkeyAcceptedKeyTypes ssh-*-cert-v01@openssh.com"
|
||||
${SSH} $opts -i $OBJ/cert_user_key3 proxy true || fatal "cert failed"
|
||||
${SSH} $certopts proxy true || fatal "cert failed"
|
||||
${SSH} $opts -i $OBJ/user_key1 proxy true && fatal "key1 succeeded"
|
||||
${SSH} $opts -i $OBJ/user_key2 proxy true && fatal "key2 succeeded"
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user