1 # $OpenBSD: krl.sh,v 1.2 2013/11/21 03:15:46 djm Exp $
2 # Placed in the Public Domain.
4 tid="key revocation lists"
6 # If we don't support ecdsa keys then this tell will be much slower.
8 if test "x$TEST_SSH_ECC" != "xyes"; then
12 # Do most testing with ssh-keygen; it uses the same verification code as sshd.
14 # Old keys will interfere with ssh-keygen.
15 rm -f $OBJ/revoked-* $OBJ/krl-*
18 $SSHKEYGEN -t $ECDSA -f $OBJ/revoked-ca -C "" -N "" > /dev/null ||
19 fatal "$SSHKEYGEN CA failed"
21 # A specification that revokes some certificates by serial numbers
22 # The serial pattern is chosen to ensure the KRL includes list, range and
24 cat << EOF >> $OBJ/revoked-serials
31 # The following sum to 500-799
42 # A specification that revokes some certificated by key ID.
43 touch $OBJ/revoked-keyid
44 for n in 1 2 3 4 10 15 30 50 `jot 500 300` 999 1000 1001 1002; do
45 # Fill in by-ID revocation spec.
46 echo "id: revoked $n" >> $OBJ/revoked-keyid
51 f=$OBJ/revoked-`printf "%04d" $N`
52 # Vary the keytype. We use mostly ECDSA since this is fastest by far.
55 2 | 10 | 510 | 1001) keytype=rsa;;
56 4 | 30 | 520 | 1002) keytype=dsa;;
58 $SSHKEYGEN -t $keytype -f $f -C "" -N "" > /dev/null \
59 || fatal "$SSHKEYGEN failed"
61 $SSHKEYGEN -s $OBJ/revoked-ca -z $n -I "revoked $N" $f >/dev/null 2>&1 \
62 || fatal "$SSHKEYGEN sign failed"
67 verbose "$tid: generating test keys"
68 REVOKED_SERIALS="1 4 10 50 500 510 520 799 999"
69 for n in $REVOKED_SERIALS ; do
71 REVOKED_KEYS="$REVOKED_KEYS ${f}.pub"
72 REVOKED_CERTS="$REVOKED_CERTS ${f}-cert.pub"
74 NOTREVOKED_SERIALS="5 9 14 16 29 30 49 51 499 800 1000 1001"
76 for n in $NOTREVOKED_SERIALS ; do
77 NOTREVOKED_KEYS="$NOTREVOKED_KEYS ${f}.pub"
78 NOTREVOKED_CERTS="$NOTREVOKED_CERTS ${f}-cert.pub"
83 $SSHKEYGEN $OPTS -kf $OBJ/krl-empty - </dev/null \
84 >/dev/null || fatal "$SSHKEYGEN KRL failed"
85 $SSHKEYGEN $OPTS -kf $OBJ/krl-keys $REVOKED_KEYS \
86 >/dev/null || fatal "$SSHKEYGEN KRL failed"
87 $SSHKEYGEN $OPTS -kf $OBJ/krl-cert $REVOKED_CERTS \
88 >/dev/null || fatal "$SSHKEYGEN KRL failed"
89 $SSHKEYGEN $OPTS -kf $OBJ/krl-all $REVOKED_KEYS $REVOKED_CERTS \
90 >/dev/null || fatal "$SSHKEYGEN KRL failed"
91 $SSHKEYGEN $OPTS -kf $OBJ/krl-ca $OBJ/revoked-ca.pub \
92 >/dev/null || fatal "$SSHKEYGEN KRL failed"
93 # KRLs from serial/key-id spec need the CA specified.
94 $SSHKEYGEN $OPTS -kf $OBJ/krl-serial $OBJ/revoked-serials \
95 >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly"
96 $SSHKEYGEN $OPTS -kf $OBJ/krl-keyid $OBJ/revoked-keyid \
97 >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly"
98 $SSHKEYGEN $OPTS -kf $OBJ/krl-serial -s $OBJ/revoked-ca $OBJ/revoked-serials \
99 >/dev/null || fatal "$SSHKEYGEN KRL failed"
100 $SSHKEYGEN $OPTS -kf $OBJ/krl-keyid -s $OBJ/revoked-ca.pub $OBJ/revoked-keyid \
101 >/dev/null || fatal "$SSHKEYGEN KRL failed"
104 ## XXX dump with trace and grep for set cert serials
105 ## XXX test ranges near (u64)-1, etc.
107 verbose "$tid: generating KRLs"
115 $SSHKEYGEN -Qf $KRL $KEY >/dev/null
117 if test "x$EXPECT_REVOKED" = "xyes" -a $result -eq 0 ; then
118 fatal "key $KEY not revoked by KRL $KRL: $TAG"
119 elif test "x$EXPECT_REVOKED" = "xno" -a $result -ne 0 ; then
120 fatal "key $KEY unexpectedly revoked by KRL $KRL: $TAG"
132 verbose "$tid: checking revocations for $TAG"
134 check_krl $f $OBJ/krl-empty no "$TAG"
135 check_krl $f $OBJ/krl-keys $KEYS_RESULT "$TAG"
136 check_krl $f $OBJ/krl-all $ALL_RESULT "$TAG"
137 check_krl $f $OBJ/krl-serial $SERIAL_RESULT "$TAG"
138 check_krl $f $OBJ/krl-keyid $KEYID_RESULT "$TAG"
139 check_krl $f $OBJ/krl-cert $CERTS_RESULT "$TAG"
140 check_krl $f $OBJ/krl-ca $CA_RESULT "$TAG"
143 # keys all serial keyid certs CA
144 test_all "$REVOKED_KEYS" "revoked keys" yes yes no no no no
145 test_all "$UNREVOKED_KEYS" "unrevoked keys" no no no no no no
146 test_all "$REVOKED_CERTS" "revoked certs" yes yes yes yes yes yes
147 test_all "$UNREVOKED_CERTS" "unrevoked certs" no no no no no yes
149 # Check update. Results should be identical.
150 verbose "$tid: testing KRL update"
151 for f in $OBJ/krl-keys $OBJ/krl-cert $OBJ/krl-all \
152 $OBJ/krl-ca $OBJ/krl-serial $OBJ/krl-keyid ; do
153 cp -f $OBJ/krl-empty $f
156 # keys all serial keyid certs CA
157 test_all "$REVOKED_KEYS" "revoked keys" yes yes no no no no
158 test_all "$UNREVOKED_KEYS" "unrevoked keys" no no no no no no
159 test_all "$REVOKED_CERTS" "revoked certs" yes yes yes yes yes yes
160 test_all "$UNREVOKED_CERTS" "unrevoked certs" no no no no no yes