blob: 62261cf8b3b52621d84c5fc9e77b0429ff8e918f [file] [log] [blame]
djm@openbsd.org67f14592016-05-02 09:52:00 +00001# $OpenBSD: cert-hostkey.sh,v 1.14 2016/05/02 09:52:00 djm Exp $
Damien Miller58ac6de2010-02-27 07:57:12 +11002# Placed in the Public Domain.
3
4tid="certified host keys"
5
djm@openbsd.orgd85e0622015-01-19 06:01:32 +00006rm -f $OBJ/known_hosts-cert* $OBJ/host_ca_key* $OBJ/host_revoked_*
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +00007rm -f $OBJ/cert_host_key* $OBJ/host_krl_*
markus@openbsd.org5bf09332015-07-10 06:23:25 +00008
9# Allow all hostkey/pubkey types, prefer certs for the client
10types=""
11for i in `$SSH -Q key`; do
12 if [ -z "$types" ]; then
13 types="$i"
14 continue
15 fi
16 case "$i" in
17 *cert*) types="$i,$types";;
18 *) types="$types,$i";;
19 esac
20done
21(
22 echo "HostKeyAlgorithms ${types}"
23 echo "PubkeyAcceptedKeyTypes *"
24) >> $OBJ/ssh_proxy
Damien Miller58ac6de2010-02-27 07:57:12 +110025cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
markus@openbsd.org5bf09332015-07-10 06:23:25 +000026(
27 echo "HostKeyAlgorithms *"
28 echo "PubkeyAcceptedKeyTypes *"
29) >> $OBJ/sshd_proxy_bak
Damien Miller58ac6de2010-02-27 07:57:12 +110030
31HOSTS='localhost-with-alias,127.0.0.1,::1'
32
djm@openbsd.org67f14592016-05-02 09:52:00 +000033kh_ca() {
34 for k in "$@" ; do
35 printf "@cert-authority $HOSTS "
36 cat $OBJ/$k || fatal "couldn't cat $k"
37 done
38}
39kh_revoke() {
40 for k in "$@" ; do
41 printf "@revoked * "
42 cat $OBJ/$k || fatal "couldn't cat $k"
43 done
44}
45
46# Create a CA key and add it to known hosts. Ed25519 chosen for speed.
47# RSA for testing RSA/SHA2 signatures.
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +000048${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/host_ca_key ||\
Damien Miller58ac6de2010-02-27 07:57:12 +110049 fail "ssh-keygen of host_ca_key failed"
djm@openbsd.org67f14592016-05-02 09:52:00 +000050${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/host_ca_key2 ||\
51 fail "ssh-keygen of host_ca_key failed"
52
53kh_ca host_ca_key.pub host_ca_key2.pub > $OBJ/known_hosts-cert.orig
djm@openbsd.orgd85e0622015-01-19 06:01:32 +000054cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
Damien Miller58ac6de2010-02-27 07:57:12 +110055
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +000056# Plain text revocation files
57touch $OBJ/host_revoked_empty
58touch $OBJ/host_revoked_plain
59touch $OBJ/host_revoked_cert
djm@openbsd.org67f14592016-05-02 09:52:00 +000060cat $OBJ/host_ca_key.pub $OBJ/host_ca_key2.pub > $OBJ/host_revoked_ca
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +000061
Damien Millerf54542a2013-12-07 16:32:44 +110062PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/g;s/^ssh-//'`
63
djm@openbsd.org67f14592016-05-02 09:52:00 +000064if echo "$PLAIN_TYPES" | grep '^rsa$' >/dev/null 2>&1 ; then
65 PLAIN_TYPES="$PLAIN_TYPES rsa-sha2-256 rsa-sha2-512"
66fi
67
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +000068# Prepare certificate, plain key and CA KRLs
69${SSHKEYGEN} -kf $OBJ/host_krl_empty || fatal "KRL init failed"
70${SSHKEYGEN} -kf $OBJ/host_krl_plain || fatal "KRL init failed"
71${SSHKEYGEN} -kf $OBJ/host_krl_cert || fatal "KRL init failed"
djm@openbsd.org67f14592016-05-02 09:52:00 +000072${SSHKEYGEN} -kf $OBJ/host_krl_ca $OBJ/host_ca_key.pub $OBJ/host_ca_key2.pub \
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +000073 || fatal "KRL init failed"
74
Damien Miller58ac6de2010-02-27 07:57:12 +110075# Generate and sign host keys
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +000076serial=1
djm@openbsd.org67f14592016-05-02 09:52:00 +000077for ktype in $PLAIN_TYPES ; do
Damien Miller58ac6de2010-02-27 07:57:12 +110078 verbose "$tid: sign host ${ktype} cert"
79 # Generate and sign a host key
80 ${SSHKEYGEN} -q -N '' -t ${ktype} \
81 -f $OBJ/cert_host_key_${ktype} || \
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +000082 fatal "ssh-keygen of cert_host_key_${ktype} failed"
83 ${SSHKEYGEN} -ukf $OBJ/host_krl_plain \
84 $OBJ/cert_host_key_${ktype}.pub || fatal "KRL update failed"
85 cat $OBJ/cert_host_key_${ktype}.pub >> $OBJ/host_revoked_plain
djm@openbsd.org67f14592016-05-02 09:52:00 +000086 case $ktype in
87 rsa-sha2-*) tflag="-t $ktype"; ca="$OBJ/host_ca_key2" ;;
88 *) tflag=""; ca="$OBJ/host_ca_key" ;;
89 esac
90 ${SSHKEYGEN} -h -q -s $ca -z $serial $tflag \
Damien Miller58ac6de2010-02-27 07:57:12 +110091 -I "regress host key for $USER" \
92 -n $HOSTS $OBJ/cert_host_key_${ktype} ||
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +000093 fatal "couldn't sign cert_host_key_${ktype}"
94 ${SSHKEYGEN} -ukf $OBJ/host_krl_cert \
95 $OBJ/cert_host_key_${ktype}-cert.pub || \
96 fatal "KRL update failed"
97 cat $OBJ/cert_host_key_${ktype}-cert.pub >> $OBJ/host_revoked_cert
98 serial=`expr $serial + 1`
Damien Miller58ac6de2010-02-27 07:57:12 +110099done
100
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +0000101attempt_connect() {
102 _ident="$1"
103 _expect_success="$2"
104 shift; shift
105 verbose "$tid: $_ident expect success $_expect_success"
djm@openbsd.orgd85e0622015-01-19 06:01:32 +0000106 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +0000107 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
108 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
109 "$@" -F $OBJ/ssh_proxy somehost true
110 _r=$?
111 if [ "x$_expect_success" = "xyes" ] ; then
112 if [ $_r -ne 0 ]; then
113 fail "ssh cert connect $_ident failed"
114 fi
115 else
116 if [ $_r -eq 0 ]; then
117 fail "ssh cert connect $_ident succeeded unexpectedly"
118 fi
119 fi
120}
121
122# Basic connect and revocation tests.
Damien Miller58ac6de2010-02-27 07:57:12 +1100123for privsep in yes no ; do
djm@openbsd.org67f14592016-05-02 09:52:00 +0000124 for ktype in $PLAIN_TYPES ; do
Damien Miller58ac6de2010-02-27 07:57:12 +1100125 verbose "$tid: host ${ktype} cert connect privsep $privsep"
126 (
127 cat $OBJ/sshd_proxy_bak
128 echo HostKey $OBJ/cert_host_key_${ktype}
129 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
130 echo UsePrivilegeSeparation $privsep
131 ) > $OBJ/sshd_proxy
132
djm@openbsd.org3dfd8d92014-12-04 22:31:50 +0000133 # test name expect success
134 attempt_connect "$ktype basic connect" "yes"
135 attempt_connect "$ktype empty KRL" "yes" \
136 -oRevokedHostKeys=$OBJ/host_krl_empty
137 attempt_connect "$ktype KRL w/ plain key revoked" "no" \
138 -oRevokedHostKeys=$OBJ/host_krl_plain
139 attempt_connect "$ktype KRL w/ cert revoked" "no" \
140 -oRevokedHostKeys=$OBJ/host_krl_cert
141 attempt_connect "$ktype KRL w/ CA revoked" "no" \
142 -oRevokedHostKeys=$OBJ/host_krl_ca
143 attempt_connect "$ktype empty plaintext revocation" "yes" \
144 -oRevokedHostKeys=$OBJ/host_revoked_empty
145 attempt_connect "$ktype plain key plaintext revocation" "no" \
146 -oRevokedHostKeys=$OBJ/host_revoked_plain
147 attempt_connect "$ktype cert plaintext revocation" "no" \
148 -oRevokedHostKeys=$OBJ/host_revoked_cert
149 attempt_connect "$ktype CA plaintext revocation" "no" \
150 -oRevokedHostKeys=$OBJ/host_revoked_ca
Damien Miller58ac6de2010-02-27 07:57:12 +1100151 done
152done
153
Damien Miller700dcfa2010-03-04 21:58:01 +1100154# Revoked certificates with key present
djm@openbsd.org67f14592016-05-02 09:52:00 +0000155kh_ca host_ca_key.pub host_ca_key2.pub > $OBJ/known_hosts-cert.orig
156for ktype in $PLAIN_TYPES ; do
157 test -f "$OBJ/cert_host_key_${ktype}.pub" || fatal "no pubkey"
158 kh_revoke cert_host_key_${ktype}.pub >> $OBJ/known_hosts-cert.orig
159done
djm@openbsd.orgd85e0622015-01-19 06:01:32 +0000160cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
Damien Miller700dcfa2010-03-04 21:58:01 +1100161for privsep in yes no ; do
djm@openbsd.org67f14592016-05-02 09:52:00 +0000162 for ktype in $PLAIN_TYPES ; do
Damien Miller700dcfa2010-03-04 21:58:01 +1100163 verbose "$tid: host ${ktype} revoked cert privsep $privsep"
164 (
165 cat $OBJ/sshd_proxy_bak
166 echo HostKey $OBJ/cert_host_key_${ktype}
167 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
168 echo UsePrivilegeSeparation $privsep
169 ) > $OBJ/sshd_proxy
170
djm@openbsd.orgd85e0622015-01-19 06:01:32 +0000171 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
Damien Miller700dcfa2010-03-04 21:58:01 +1100172 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
173 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
174 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
175 if [ $? -eq 0 ]; then
176 fail "ssh cert connect succeeded unexpectedly"
177 fi
178 done
179done
180
181# Revoked CA
djm@openbsd.org67f14592016-05-02 09:52:00 +0000182kh_ca host_ca_key.pub host_ca_key2.pub > $OBJ/known_hosts-cert.orig
183kh_revoke host_ca_key.pub host_ca_key2.pub >> $OBJ/known_hosts-cert.orig
djm@openbsd.orgd85e0622015-01-19 06:01:32 +0000184cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
djm@openbsd.org67f14592016-05-02 09:52:00 +0000185for ktype in $PLAIN_TYPES ; do
Damien Miller700dcfa2010-03-04 21:58:01 +1100186 verbose "$tid: host ${ktype} revoked cert"
187 (
188 cat $OBJ/sshd_proxy_bak
189 echo HostKey $OBJ/cert_host_key_${ktype}
190 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
191 ) > $OBJ/sshd_proxy
djm@openbsd.orgd85e0622015-01-19 06:01:32 +0000192 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
Damien Miller700dcfa2010-03-04 21:58:01 +1100193 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
194 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
195 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
196 if [ $? -eq 0 ]; then
197 fail "ssh cert connect succeeded unexpectedly"
198 fi
199done
200
201# Create a CA key and add it to known hosts
djm@openbsd.org67f14592016-05-02 09:52:00 +0000202kh_ca host_ca_key.pub host_ca_key2.pub > $OBJ/known_hosts-cert.orig
djm@openbsd.orgd85e0622015-01-19 06:01:32 +0000203cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
Damien Miller700dcfa2010-03-04 21:58:01 +1100204
Damien Miller58ac6de2010-02-27 07:57:12 +1100205test_one() {
206 ident=$1
207 result=$2
208 sign_opts=$3
Damien Miller53f4bb62010-04-18 08:15:14 +1000209
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000210 for kt in rsa ed25519 ; do
djm@openbsd.org67f14592016-05-02 09:52:00 +0000211 case $ktype in
212 rsa-sha2-*) tflag="-t $ktype"; ca="$OBJ/host_ca_key2" ;;
213 *) tflag=""; ca="$OBJ/host_ca_key" ;;
214 esac
215 ${SSHKEYGEN} -q -s $ca $tflag -I "regress host key for $USER" \
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000216 $sign_opts $OBJ/cert_host_key_${kt} ||
djm@openbsd.org67f14592016-05-02 09:52:00 +0000217 fatal "couldn't sign cert_host_key_${kt}"
Damien Miller53f4bb62010-04-18 08:15:14 +1000218 (
219 cat $OBJ/sshd_proxy_bak
220 echo HostKey $OBJ/cert_host_key_${kt}
221 echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
222 ) > $OBJ/sshd_proxy
djm@openbsd.org67f14592016-05-02 09:52:00 +0000223
djm@openbsd.orgd85e0622015-01-19 06:01:32 +0000224 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
Damien Miller53f4bb62010-04-18 08:15:14 +1000225 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
226 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
227 -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
228 rc=$?
229 if [ "x$result" = "xsuccess" ] ; then
230 if [ $rc -ne 0 ]; then
231 fail "ssh cert connect $ident failed unexpectedly"
232 fi
233 else
234 if [ $rc -eq 0 ]; then
235 fail "ssh cert connect $ident succeeded unexpectedly"
236 fi
Damien Miller58ac6de2010-02-27 07:57:12 +1100237 fi
Damien Miller53f4bb62010-04-18 08:15:14 +1000238 done
Damien Miller58ac6de2010-02-27 07:57:12 +1100239}
240
241test_one "user-certificate" failure "-n $HOSTS"
242test_one "empty principals" success "-h"
243test_one "wrong principals" failure "-h -n foo"
244test_one "cert not yet valid" failure "-h -V20200101:20300101"
245test_one "cert expired" failure "-h -V19800101:19900101"
246test_one "cert valid interval" success "-h -V-1w:+2w"
247test_one "cert has constraints" failure "-h -Oforce-command=false"
248
249# Check downgrade of cert to raw key when no CA found
djm@openbsd.org67f14592016-05-02 09:52:00 +0000250for ktype in $PLAIN_TYPES ; do
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000251 rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
252 verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
253 # Generate and sign a host key
djm@openbsd.org67f14592016-05-02 09:52:00 +0000254 ${SSHKEYGEN} -q -N '' -t ${ktype} -f $OBJ/cert_host_key_${ktype} || \
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000255 fail "ssh-keygen of cert_host_key_${ktype} failed"
djm@openbsd.org67f14592016-05-02 09:52:00 +0000256 case $ktype in
257 rsa-sha2-*) tflag="-t $ktype"; ca="$OBJ/host_ca_key2" ;;
258 *) tflag=""; ca="$OBJ/host_ca_key" ;;
259 esac
260 ${SSHKEYGEN} -h -q $tflag -s $ca $tflag \
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000261 -I "regress host key for $USER" \
262 -n $HOSTS $OBJ/cert_host_key_${ktype} ||
djm@openbsd.org67f14592016-05-02 09:52:00 +0000263 fatal "couldn't sign cert_host_key_${ktype}"
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000264 (
265 printf "$HOSTS "
266 cat $OBJ/cert_host_key_${ktype}.pub
267 ) > $OBJ/known_hosts-cert
268 (
269 cat $OBJ/sshd_proxy_bak
270 echo HostKey $OBJ/cert_host_key_${ktype}
271 echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
272 ) > $OBJ/sshd_proxy
djm@openbsd.org67f14592016-05-02 09:52:00 +0000273
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000274 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
275 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
276 -F $OBJ/ssh_proxy somehost true
277 if [ $? -ne 0 ]; then
278 fail "ssh cert connect failed"
279 fi
Damien Miller58ac6de2010-02-27 07:57:12 +1100280done
281
Damien Miller017d1e72010-03-04 21:57:21 +1100282# Wrong certificate
djm@openbsd.org67f14592016-05-02 09:52:00 +0000283kh_ca host_ca_key.pub host_ca_key2.pub > $OBJ/known_hosts-cert.orig
djm@openbsd.orgd85e0622015-01-19 06:01:32 +0000284cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
djm@openbsd.org67f14592016-05-02 09:52:00 +0000285for kt in $PLAIN_TYPES ; do
286 verbose "$tid: host ${kt} connect wrong cert"
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000287 rm -f $OBJ/cert_host_key*
288 # Self-sign key
djm@openbsd.org67f14592016-05-02 09:52:00 +0000289 ${SSHKEYGEN} -q -N '' -t ${kt} -f $OBJ/cert_host_key_${kt} || \
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000290 fail "ssh-keygen of cert_host_key_${kt} failed"
djm@openbsd.org67f14592016-05-02 09:52:00 +0000291 case $kt in
292 rsa-sha2-*) tflag="-t $kt" ;;
293 *) tflag="" ;;
294 esac
295 ${SSHKEYGEN} $tflag -h -q -s $OBJ/cert_host_key_${kt} \
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000296 -I "regress host key for $USER" \
297 -n $HOSTS $OBJ/cert_host_key_${kt} ||
djm@openbsd.org67f14592016-05-02 09:52:00 +0000298 fatal "couldn't sign cert_host_key_${kt}"
djm@openbsd.org6a977a42015-07-03 04:39:23 +0000299 (
300 cat $OBJ/sshd_proxy_bak
301 echo HostKey $OBJ/cert_host_key_${kt}
302 echo HostCertificate $OBJ/cert_host_key_${kt}-cert.pub
303 ) > $OBJ/sshd_proxy
304
305 cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert
306 ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
307 -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
308 -F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
309 if [ $? -eq 0 ]; then
310 fail "ssh cert connect $ident succeeded unexpectedly"
311 fi
Damien Miller017d1e72010-03-04 21:57:21 +1100312done
313
djm@openbsd.orgd85e0622015-01-19 06:01:32 +0000314rm -f $OBJ/known_hosts-cert* $OBJ/host_ca_key* $OBJ/cert_host_key*