mirror of git://anongit.mindrot.org/openssh.git
- markus@cvs.openbsd.org 2013/12/06 13:52:46
[regress/Makefile regress/agent.sh regress/cert-hostkey.sh]
[regress/cert-userkey.sh regress/keytype.sh]
test ed25519 support; from djm@
This commit is contained in:
Damien Miller
parent
f104da263d
commit
f54542af3a
|
|
@ -33,6 +33,10 @@
|
|||
- djm@cvs.openbsd.org 2013/12/07 00:19:15
|
||||
[key.c]
|
||||
set k->cert = NULL after freeing it
|
||||
- markus@cvs.openbsd.org 2013/12/06 13:52:46
|
||||
[regress/Makefile regress/agent.sh regress/cert-hostkey.sh]
|
||||
[regress/cert-userkey.sh regress/keytype.sh]
|
||||
test ed25519 support; from djm@
|
||||
- (djm) [blocks.c ed25519.c fe25519.c fe25519.h ge25519.c ge25519.h]
|
||||
[ge25519_base.data hash.c sc25519.c sc25519.h verify.c] Fix RCS idents
|
||||
- (djm) [Makefile.in] Add ed25519 sources
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# $OpenBSD: Makefile,v 1.66 2013/10/09 23:44:14 djm Exp $
|
||||
# $OpenBSD: Makefile,v 1.67 2013/12/06 13:52:46 markus Exp $
|
||||
|
||||
REGRESS_TARGETS= t1 t2 t3 t4 t5 t6 t7 t8 t9 t-exec
|
||||
REGRESS_TARGETS= t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t-exec
|
||||
tests: $(REGRESS_TARGETS)
|
||||
|
||||
# Interop tests are not run by default
|
||||
|
|
@ -153,6 +153,14 @@ t9: $(OBJ)/t9.out
|
|||
test "${TEST_SSH_ECC}" != yes || \
|
||||
${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t9.out > /dev/null
|
||||
|
||||
|
||||
$(OBJ)/t10.out:
|
||||
${TEST_SSH_SSHKEYGEN} -q -t ed25519 -N '' -f $@
|
||||
|
||||
t10: $(OBJ)/t10.out
|
||||
${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t10.out > /dev/null
|
||||
${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t10.out > /dev/null
|
||||
|
||||
t-exec: ${LTESTS:=.sh}
|
||||
@if [ "x$?" = "x" ]; then exit 0; fi; \
|
||||
for TEST in ""$?; do \
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# $OpenBSD: agent.sh,v 1.8 2013/05/17 00:37:40 dtucker Exp $
|
||||
# $OpenBSD: agent.sh,v 1.9 2013/12/06 13:52:46 markus Exp $
|
||||
# Placed in the Public Domain.
|
||||
|
||||
tid="simple agent test"
|
||||
|
|
@ -20,7 +20,7 @@ else
|
|||
fi
|
||||
trace "overwrite authorized keys"
|
||||
printf '' > $OBJ/authorized_keys_$USER
|
||||
for t in rsa rsa1; do
|
||||
for t in ed25519 rsa rsa1; do
|
||||
# generate user key for agent
|
||||
rm -f $OBJ/$t-agent
|
||||
${SSHKEYGEN} -q -N '' -t $t -f $OBJ/$t-agent ||\
|
||||
|
|
|
|||
|
|
@ -1,14 +1,8 @@
|
|||
# $OpenBSD: cert-hostkey.sh,v 1.7 2013/05/17 00:37:40 dtucker Exp $
|
||||
# $OpenBSD: cert-hostkey.sh,v 1.8 2013/12/06 13:52:46 markus Exp $
|
||||
# Placed in the Public Domain.
|
||||
|
||||
tid="certified host keys"
|
||||
|
||||
# used to disable ECC based tests on platforms without ECC
|
||||
ecdsa=""
|
||||
if test "x$TEST_SSH_ECC" = "xyes"; then
|
||||
ecdsa=ecdsa
|
||||
fi
|
||||
|
||||
rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
|
||||
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
|
||||
|
||||
|
|
@ -23,8 +17,17 @@ ${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/host_ca_key ||\
|
|||
cat $OBJ/host_ca_key.pub
|
||||
) > $OBJ/known_hosts-cert
|
||||
|
||||
PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/g;s/^ssh-//'`
|
||||
|
||||
type_has_legacy() {
|
||||
case $1 in
|
||||
ed25519*|ecdsa*) return 1 ;;
|
||||
esac
|
||||
return 0
|
||||
}
|
||||
|
||||
# Generate and sign host keys
|
||||
for ktype in rsa dsa $ecdsa ; do
|
||||
for ktype in $PLAIN_TYPES ; do
|
||||
verbose "$tid: sign host ${ktype} cert"
|
||||
# Generate and sign a host key
|
||||
${SSHKEYGEN} -q -N '' -t ${ktype} \
|
||||
|
|
@ -34,10 +37,10 @@ for ktype in rsa dsa $ecdsa ; do
|
|||
-I "regress host key for $USER" \
|
||||
-n $HOSTS $OBJ/cert_host_key_${ktype} ||
|
||||
fail "couldn't sign cert_host_key_${ktype}"
|
||||
# v00 ecdsa certs do not exist
|
||||
test "${ktype}" = "ecdsa" && continue
|
||||
type_has_legacy $ktype || continue
|
||||
cp $OBJ/cert_host_key_${ktype} $OBJ/cert_host_key_${ktype}_v00
|
||||
cp $OBJ/cert_host_key_${ktype}.pub $OBJ/cert_host_key_${ktype}_v00.pub
|
||||
verbose "$tid: sign host ${ktype}_v00 cert"
|
||||
${SSHKEYGEN} -t v00 -h -q -s $OBJ/host_ca_key \
|
||||
-I "regress host key for $USER" \
|
||||
-n $HOSTS $OBJ/cert_host_key_${ktype}_v00 ||
|
||||
|
|
@ -46,7 +49,7 @@ done
|
|||
|
||||
# Basic connect tests
|
||||
for privsep in yes no ; do
|
||||
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00; do
|
||||
for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
|
||||
verbose "$tid: host ${ktype} cert connect privsep $privsep"
|
||||
(
|
||||
cat $OBJ/sshd_proxy_bak
|
||||
|
|
@ -73,9 +76,16 @@ done
|
|||
printf "* "
|
||||
cat $OBJ/cert_host_key_rsa.pub
|
||||
if test "x$TEST_SSH_ECC" = "xyes"; then
|
||||
cat $OBJ/cert_host_key_ecdsa-sha2-nistp256.pub
|
||||
printf '@revoked '
|
||||
printf "* "
|
||||
cat $OBJ/cert_host_key_ecdsa.pub
|
||||
cat $OBJ/cert_host_key_ecdsa-sha2-nistp384.pub
|
||||
printf '@revoked '
|
||||
printf "* "
|
||||
cat $OBJ/cert_host_key_ecdsa-sha2-nistp521.pub
|
||||
printf '@revoked '
|
||||
printf "* "
|
||||
cat $OBJ/cert_host_key_ed25519.pub
|
||||
fi
|
||||
printf '@revoked '
|
||||
printf "* "
|
||||
|
|
@ -88,7 +98,7 @@ done
|
|||
cat $OBJ/cert_host_key_dsa_v00.pub
|
||||
) > $OBJ/known_hosts-cert
|
||||
for privsep in yes no ; do
|
||||
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00; do
|
||||
for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
|
||||
verbose "$tid: host ${ktype} revoked cert privsep $privsep"
|
||||
(
|
||||
cat $OBJ/sshd_proxy_bak
|
||||
|
|
@ -115,7 +125,7 @@ done
|
|||
printf "* "
|
||||
cat $OBJ/host_ca_key.pub
|
||||
) > $OBJ/known_hosts-cert
|
||||
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
|
||||
for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
|
||||
verbose "$tid: host ${ktype} revoked cert"
|
||||
(
|
||||
cat $OBJ/sshd_proxy_bak
|
||||
|
|
@ -186,9 +196,8 @@ test_one "cert has constraints" failure "-h -Oforce-command=false"
|
|||
|
||||
# Check downgrade of cert to raw key when no CA found
|
||||
for v in v01 v00 ; do
|
||||
for ktype in rsa dsa $ecdsa ; do
|
||||
# v00 ecdsa certs do not exist.
|
||||
test "${v}${ktype}" = "v00ecdsa" && continue
|
||||
for ktype in $PLAIN_TYPES ; do
|
||||
type_has_legacy $ktype || continue
|
||||
rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
|
||||
verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
|
||||
# Generate and sign a host key
|
||||
|
|
@ -225,9 +234,8 @@ done
|
|||
cat $OBJ/host_ca_key.pub
|
||||
) > $OBJ/known_hosts-cert
|
||||
for v in v01 v00 ; do
|
||||
for kt in rsa dsa $ecdsa ; do
|
||||
# v00 ecdsa certs do not exist.
|
||||
test "${v}${ktype}" = "v00ecdsa" && continue
|
||||
for kt in $PLAIN_TYPES ; do
|
||||
type_has_legacy $kt || continue
|
||||
rm -f $OBJ/cert_host_key*
|
||||
# Self-sign key
|
||||
${SSHKEYGEN} -q -N '' -t ${kt} \
|
||||
|
|
|
|||
|
|
@ -1,23 +1,26 @@
|
|||
# $OpenBSD: cert-userkey.sh,v 1.11 2013/05/17 00:37:40 dtucker Exp $
|
||||
# $OpenBSD: cert-userkey.sh,v 1.12 2013/12/06 13:52:46 markus Exp $
|
||||
# Placed in the Public Domain.
|
||||
|
||||
tid="certified user keys"
|
||||
|
||||
# used to disable ECC based tests on platforms without ECC
|
||||
ecdsa=""
|
||||
if test "x$TEST_SSH_ECC" = "xyes"; then
|
||||
ecdsa=ecdsa
|
||||
fi
|
||||
|
||||
rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
|
||||
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
|
||||
|
||||
PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/;s/^ssh-//'`
|
||||
|
||||
type_has_legacy() {
|
||||
case $1 in
|
||||
ed25519*|ecdsa*) return 1 ;;
|
||||
esac
|
||||
return 0
|
||||
}
|
||||
|
||||
# Create a CA key
|
||||
${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/user_ca_key ||\
|
||||
fail "ssh-keygen of user_ca_key failed"
|
||||
|
||||
# Generate and sign user keys
|
||||
for ktype in rsa dsa $ecdsa ; do
|
||||
for ktype in $PLAIN_TYPES ; do
|
||||
verbose "$tid: sign user ${ktype} cert"
|
||||
${SSHKEYGEN} -q -N '' -t ${ktype} \
|
||||
-f $OBJ/cert_user_key_${ktype} || \
|
||||
|
|
@ -25,18 +28,18 @@ for ktype in rsa dsa $ecdsa ; do
|
|||
${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
|
||||
-z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype} ||
|
||||
fail "couldn't sign cert_user_key_${ktype}"
|
||||
# v00 ecdsa certs do not exist
|
||||
test "${ktype}" = "ecdsa" && continue
|
||||
type_has_legacy $ktype || continue
|
||||
cp $OBJ/cert_user_key_${ktype} $OBJ/cert_user_key_${ktype}_v00
|
||||
cp $OBJ/cert_user_key_${ktype}.pub $OBJ/cert_user_key_${ktype}_v00.pub
|
||||
verbose "$tid: sign host ${ktype}_v00 cert"
|
||||
${SSHKEYGEN} -q -t v00 -s $OBJ/user_ca_key -I \
|
||||
"regress user key for $USER" \
|
||||
-n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype}_v00 ||
|
||||
fail "couldn't sign cert_user_key_${ktype}_v00"
|
||||
fatal "couldn't sign cert_user_key_${ktype}_v00"
|
||||
done
|
||||
|
||||
# Test explicitly-specified principals
|
||||
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
|
||||
for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
|
||||
for privsep in yes no ; do
|
||||
_prefix="${ktype} privsep $privsep"
|
||||
|
||||
|
|
@ -162,7 +165,7 @@ basic_tests() {
|
|||
extra_sshd="TrustedUserCAKeys $OBJ/user_ca_key.pub"
|
||||
fi
|
||||
|
||||
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
|
||||
for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
|
||||
for privsep in yes no ; do
|
||||
_prefix="${ktype} privsep $privsep $auth"
|
||||
# Simple connect
|
||||
|
|
@ -332,7 +335,7 @@ test_one "principals key option no principals" failure "" \
|
|||
|
||||
# Wrong certificate
|
||||
cat $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
|
||||
for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do
|
||||
for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
|
||||
case $ktype in
|
||||
*_v00) args="-t v00" ;;
|
||||
*) args="" ;;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# $OpenBSD: keytype.sh,v 1.2 2013/05/17 00:37:40 dtucker Exp $
|
||||
# $OpenBSD: keytype.sh,v 1.3 2013/12/06 13:52:46 markus Exp $
|
||||
# Placed in the Public Domain.
|
||||
|
||||
tid="login with different key types"
|
||||
|
|
@ -11,7 +11,7 @@ fi
|
|||
cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
|
||||
cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
|
||||
|
||||
ktypes="dsa-1024 rsa-2048 rsa-3072"
|
||||
ktypes="dsa-1024 rsa-2048 rsa-3072 ed25519-512"
|
||||
for i in `$SSH -Q key`; do
|
||||
case "$i" in
|
||||
ecdsa-sha2-nistp256) ktype="$ktype ecdsa-256" ;;
|
||||
|
|
|
|||
Loading…
Reference in New Issue