crypto/openssh/regress/cert-hostkey.sh

   1 #       $OpenBSD: cert-hostkey.sh,v 1.11 2015/01/19 06:01:32 djm Exp $
   2 #       Placed in the Public Domain.
   3
   4 tid="certified host keys"
   5
   6 rm -f $OBJ/known_hosts-cert* $OBJ/host_ca_key* $OBJ/host_revoked_*
   7 rm -f $OBJ/cert_host_key* $OBJ/host_krl_*
   8 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
   9
  10 HOSTS='localhost-with-alias,127.0.0.1,::1'
  11
  12 # Create a CA key and add it to known hosts. Ed25519 chosed for speed.
  13 ${SSHKEYGEN} -q -N '' -t ed25519  -f $OBJ/host_ca_key ||\
  14         fail "ssh-keygen of host_ca_key failed"
  15 (
  16         printf '@cert-authority '
  17         printf "$HOSTS "
  18         cat $OBJ/host_ca_key.pub
  19 ) > $OBJ/known_hosts-cert.orig
  20 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
  21
  22 # Plain text revocation files
  23 touch $OBJ/host_revoked_empty
  24 touch $OBJ/host_revoked_plain
  25 touch $OBJ/host_revoked_cert
  26 cp $OBJ/host_ca_key.pub $OBJ/host_revoked_ca
  27
  28 PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/g;s/^ssh-//'`
  29
  30 type_has_legacy() {
  31         case $1 in
  32                 ed25519*|ecdsa*) return 1 ;;
  33         esac
  34         return 0
  35 }
  36
  37 # Prepare certificate, plain key and CA KRLs
  38 ${SSHKEYGEN} -kf $OBJ/host_krl_empty || fatal "KRL init failed"
  39 ${SSHKEYGEN} -kf $OBJ/host_krl_plain || fatal "KRL init failed"
  40 ${SSHKEYGEN} -kf $OBJ/host_krl_cert || fatal "KRL init failed"
  41 ${SSHKEYGEN} -kf $OBJ/host_krl_ca $OBJ/host_ca_key.pub \
  42         || fatal "KRL init failed"
  43
  44 # Generate and sign host keys
  45 serial=1
  46 for ktype in $PLAIN_TYPES ; do
  47         verbose "$tid: sign host ${ktype} cert"
  48         # Generate and sign a host key
  49         ${SSHKEYGEN} -q -N '' -t ${ktype} \
  50             -f $OBJ/cert_host_key_${ktype} || \
  51                 fatal "ssh-keygen of cert_host_key_${ktype} failed"
  52         ${SSHKEYGEN} -ukf $OBJ/host_krl_plain \
  53             $OBJ/cert_host_key_${ktype}.pub || fatal "KRL update failed"
  54         cat $OBJ/cert_host_key_${ktype}.pub >> $OBJ/host_revoked_plain
  55         ${SSHKEYGEN} -h -q -s $OBJ/host_ca_key -z $serial \
  56             -I "regress host key for $USER" \
  57             -n $HOSTS $OBJ/cert_host_key_${ktype} ||
  58                 fatal "couldn't sign cert_host_key_${ktype}"
  59         ${SSHKEYGEN} -ukf $OBJ/host_krl_cert \
  60             $OBJ/cert_host_key_${ktype}-cert.pub || \
  61                 fatal "KRL update failed"
  62         cat $OBJ/cert_host_key_${ktype}-cert.pub >> $OBJ/host_revoked_cert
  63         serial=`expr $serial + 1`
  64         type_has_legacy $ktype || continue
  65         cp $OBJ/cert_host_key_${ktype} $OBJ/cert_host_key_${ktype}_v00
  66         cp $OBJ/cert_host_key_${ktype}.pub $OBJ/cert_host_key_${ktype}_v00.pub
  67         verbose "$tid: sign host ${ktype}_v00 cert"
  68         ${SSHKEYGEN} -t v00 -h -q -s $OBJ/host_ca_key \
  69             -I "regress host key for $USER" \
  70             -n $HOSTS $OBJ/cert_host_key_${ktype}_v00 ||
  71                 fatal "couldn't sign cert_host_key_${ktype}_v00"
  72         ${SSHKEYGEN} -ukf $OBJ/host_krl_cert \
  73             $OBJ/cert_host_key_${ktype}_v00-cert.pub || \
  74                 fatal "KRL update failed"
  75         cat $OBJ/cert_host_key_${ktype}_v00-cert.pub >> $OBJ/host_revoked_cert
  76 done
  77
  78 attempt_connect() {
  79         _ident="$1"
  80         _expect_success="$2"
  81         shift; shift
  82         verbose "$tid: $_ident expect success $_expect_success"
  83         cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
  84         ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
  85             -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
  86             "$@" -F $OBJ/ssh_proxy somehost true
  87         _r=$?
  88         if [ "x$_expect_success" = "xyes" ] ; then
  89                 if [ $_r -ne 0 ]; then
  90                         fail "ssh cert connect $_ident failed"
  91                 fi
  92         else
  93                 if [ $_r -eq 0 ]; then
  94                         fail "ssh cert connect $_ident succeeded unexpectedly"
  95                 fi
  96         fi
  97 }
  98
  99 # Basic connect and revocation tests.
 100 for privsep in yes no ; do
 101         for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
 102                 verbose "$tid: host ${ktype} cert connect privsep $privsep"
 103                 (
 104                         cat $OBJ/sshd_proxy_bak
 105                         echo HostKey $OBJ/cert_host_key_${ktype}
 106                         echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
 107                         echo UsePrivilegeSeparation $privsep
 108                 ) > $OBJ/sshd_proxy
 109
 110                 #               test name                         expect success
 111                 attempt_connect "$ktype basic connect"                  "yes"
 112                 attempt_connect "$ktype empty KRL"                      "yes" \
 113                     -oRevokedHostKeys=$OBJ/host_krl_empty
 114                 attempt_connect "$ktype KRL w/ plain key revoked"       "no" \
 115                     -oRevokedHostKeys=$OBJ/host_krl_plain
 116                 attempt_connect "$ktype KRL w/ cert revoked"            "no" \
 117                     -oRevokedHostKeys=$OBJ/host_krl_cert
 118                 attempt_connect "$ktype KRL w/ CA revoked"              "no" \
 119                     -oRevokedHostKeys=$OBJ/host_krl_ca
 120                 attempt_connect "$ktype empty plaintext revocation"     "yes" \
 121                     -oRevokedHostKeys=$OBJ/host_revoked_empty
 122                 attempt_connect "$ktype plain key plaintext revocation" "no" \
 123                     -oRevokedHostKeys=$OBJ/host_revoked_plain
 124                 attempt_connect "$ktype cert plaintext revocation"      "no" \
 125                     -oRevokedHostKeys=$OBJ/host_revoked_cert
 126                 attempt_connect "$ktype CA plaintext revocation"        "no" \
 127                     -oRevokedHostKeys=$OBJ/host_revoked_ca
 128         done
 129 done
 130
 131 # Revoked certificates with key present
 132 (
 133         printf '@cert-authority '
 134         printf "$HOSTS "
 135         cat $OBJ/host_ca_key.pub
 136         for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
 137                 test -f "$OBJ/cert_host_key_${ktype}.pub" || fatal "no pubkey"
 138                 printf "@revoked * `cat $OBJ/cert_host_key_${ktype}.pub`\n"
 139         done
 140 ) > $OBJ/known_hosts-cert.orig
 141 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
 142 for privsep in yes no ; do
 143         for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do
 144                 verbose "$tid: host ${ktype} revoked cert privsep $privsep"
 145                 (
 146                         cat $OBJ/sshd_proxy_bak
 147                         echo HostKey $OBJ/cert_host_key_${ktype}
 148                         echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
 149                         echo UsePrivilegeSeparation $privsep
 150                 ) > $OBJ/sshd_proxy
 151
 152                 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
 153                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 154                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 155                         -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
 156                 if [ $? -eq 0 ]; then
 157                         fail "ssh cert connect succeeded unexpectedly"
 158                 fi
 159         done
 160 done
 161
 162 # Revoked CA
 163 (
 164         printf '@cert-authority '
 165         printf "$HOSTS "
 166         cat $OBJ/host_ca_key.pub
 167         printf '@revoked '
 168         printf "* "
 169         cat $OBJ/host_ca_key.pub
 170 ) > $OBJ/known_hosts-cert.orig
 171 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
 172 for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do
 173         verbose "$tid: host ${ktype} revoked cert"
 174         (
 175                 cat $OBJ/sshd_proxy_bak
 176                 echo HostKey $OBJ/cert_host_key_${ktype}
 177                 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
 178         ) > $OBJ/sshd_proxy
 179         cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
 180         ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 181             -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 182                 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
 183         if [ $? -eq 0 ]; then
 184                 fail "ssh cert connect succeeded unexpectedly"
 185         fi
 186 done
 187
 188 # Create a CA key and add it to known hosts
 189 (
 190         printf '@cert-authority '
 191         printf "$HOSTS "
 192         cat $OBJ/host_ca_key.pub
 193 ) > $OBJ/known_hosts-cert.orig
 194 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
 195
 196 test_one() {
 197         ident=$1
 198         result=$2
 199         sign_opts=$3
 200
 201         for kt in rsa rsa_v00 ; do
 202                 case $kt in
 203                 *_v00) args="-t v00" ;;
 204                 *) args="" ;;
 205                 esac
 206
 207                 verbose "$tid: host cert connect $ident $kt expect $result"
 208                 ${SSHKEYGEN} -q -s $OBJ/host_ca_key \
 209                     -I "regress host key for $USER" \
 210                     $sign_opts $args \
 211                     $OBJ/cert_host_key_${kt} ||
 212                         fail "couldn't sign cert_host_key_${kt}"
 213                 (
 214                         cat $OBJ/sshd_proxy_bak
 215                         echo HostKey $OBJ/cert_host_key_${kt}
 216                         echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
 217                 ) > $OBJ/sshd_proxy
 218
 219                 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
 220                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 221                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 222                     -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
 223                 rc=$?
 224                 if [ "x$result" = "xsuccess" ] ; then
 225                         if [ $rc -ne 0 ]; then
 226                                 fail "ssh cert connect $ident failed unexpectedly"
 227                         fi
 228                 else
 229                         if [ $rc -eq 0 ]; then
 230                                 fail "ssh cert connect $ident succeeded unexpectedly"
 231                         fi
 232                 fi
 233         done
 234 }
 235
 236 test_one "user-certificate"     failure "-n $HOSTS"
 237 test_one "empty principals"     success "-h"
 238 test_one "wrong principals"     failure "-h -n foo"
 239 test_one "cert not yet valid"   failure "-h -V20200101:20300101"
 240 test_one "cert expired"         failure "-h -V19800101:19900101"
 241 test_one "cert valid interval"  success "-h -V-1w:+2w"
 242 test_one "cert has constraints" failure "-h -Oforce-command=false"
 243
 244 # Check downgrade of cert to raw key when no CA found
 245 for v in v01 v00 ;  do
 246         for ktype in $PLAIN_TYPES ; do
 247                 type_has_legacy $ktype || continue
 248                 rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
 249                 verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
 250                 # Generate and sign a host key
 251                 ${SSHKEYGEN} -q -N '' -t ${ktype} \
 252                     -f $OBJ/cert_host_key_${ktype} || \
 253                         fail "ssh-keygen of cert_host_key_${ktype} failed"
 254                 ${SSHKEYGEN} -t ${v} -h -q -s $OBJ/host_ca_key \
 255                     -I "regress host key for $USER" \
 256                     -n $HOSTS $OBJ/cert_host_key_${ktype} ||
 257                         fail "couldn't sign cert_host_key_${ktype}"
 258                 (
 259                         printf "$HOSTS "
 260                         cat $OBJ/cert_host_key_${ktype}.pub
 261                 ) > $OBJ/known_hosts-cert
 262                 (
 263                         cat $OBJ/sshd_proxy_bak
 264                         echo HostKey $OBJ/cert_host_key_${ktype}
 265                         echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
 266                 ) > $OBJ/sshd_proxy
 267
 268                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 269                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 270                         -F $OBJ/ssh_proxy somehost true
 271                 if [ $? -ne 0 ]; then
 272                         fail "ssh cert connect failed"
 273                 fi
 274         done
 275 done
 276
 277 # Wrong certificate
 278 (
 279         printf '@cert-authority '
 280         printf "$HOSTS "
 281         cat $OBJ/host_ca_key.pub
 282 ) > $OBJ/known_hosts-cert.orig
 283 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
 284 for v in v01 v00 ;  do
 285         for kt in $PLAIN_TYPES ; do
 286                 type_has_legacy $kt || continue
 287                 rm -f $OBJ/cert_host_key*
 288                 # Self-sign key
 289                 ${SSHKEYGEN} -q -N '' -t ${kt} \
 290                     -f $OBJ/cert_host_key_${kt} || \
 291                         fail "ssh-keygen of cert_host_key_${kt} failed"
 292                 ${SSHKEYGEN} -t ${v} -h -q -s $OBJ/cert_host_key_${kt} \
 293                     -I "regress host key for $USER" \
 294                     -n $HOSTS $OBJ/cert_host_key_${kt} ||
 295                         fail "couldn't sign cert_host_key_${kt}"
 296                 verbose "$tid: host ${kt} connect wrong cert"
 297                 (
 298                         cat $OBJ/sshd_proxy_bak
 299                         echo HostKey $OBJ/cert_host_key_${kt}
 300                         echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
 301                 ) > $OBJ/sshd_proxy
 302
 303                 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
 304                 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
 305                     -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
 306                         -F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
 307                 if [ $? -eq 0 ]; then
 308                         fail "ssh cert connect $ident succeeded unexpectedly"
 309                 fi
 310         done
 311 done
 312
 313 rm -f $OBJ/known_hosts-cert* $OBJ/host_ca_key* $OBJ/cert_host_key*