From ec37a17eb677be03adf6a4e8db7d6712ddfc1a9d Mon Sep 17 00:00:00 2001 From: djm Date: Wed, 12 Sep 2018 01:23:48 +0000 Subject: [PATCH] test revocation by explicit hash and by fingerprint --- regress/usr.bin/ssh/krl.sh | 49 ++++++++++++++++++++++++++------------ 1 file changed, 34 insertions(+), 15 deletions(-) diff --git a/regress/usr.bin/ssh/krl.sh b/regress/usr.bin/ssh/krl.sh index 7a8ffa82aa2..eaef545a111 100644 --- a/regress/usr.bin/ssh/krl.sh +++ b/regress/usr.bin/ssh/krl.sh @@ -1,4 +1,4 @@ -# $OpenBSD: krl.sh,v 1.6 2015/01/30 01:11:39 djm Exp $ +# $OpenBSD: krl.sh,v 1.7 2018/09/12 01:23:48 djm Exp $ # Placed in the Public Domain. tid="key revocation lists" @@ -79,6 +79,15 @@ for n in $UNREVOKED_SERIALS ; do UCERTS="$UCERTS ${f}-cert.pub" done +# Specifications that revoke keys by hash. +touch $OBJ/revoked-sha1 $OBJ/revoked-sha256 $OBJ/revoked-hash +for rkey in $RKEYS; do + (printf "sha1: "; cat $rkey) >> $OBJ/revoked-sha1 + (printf "sha256: "; cat $rkey) >> $OBJ/revoked-sha256 + (printf "hash: "; $SSHKEYGEN -lf $rkey | \ + awk '{ print $2 }') >> $OBJ/revoked-hash +done + genkrls() { OPTS=$1 $SSHKEYGEN $OPTS -kf $OBJ/krl-empty - /dev/null || fatal "$SSHKEYGEN KRL failed" $SSHKEYGEN $OPTS -kf $OBJ/krl-ca $OBJ/revoked-ca.pub \ >/dev/null || fatal "$SSHKEYGEN KRL failed" +$SSHKEYGEN $OPTS -kf $OBJ/krl-sha1 $OBJ/revoked-sha1 \ + >/dev/null 2>&1 || fatal "$SSHKEYGEN KRL failed" +$SSHKEYGEN $OPTS -kf $OBJ/krl-sha256 $OBJ/revoked-sha256 \ + >/dev/null 2>&1 || fatal "$SSHKEYGEN KRL failed" +$SSHKEYGEN $OPTS -kf $OBJ/krl-hash $OBJ/revoked-hash \ + >/dev/null 2>&1 || fatal "$SSHKEYGEN KRL failed" # This should fail as KRLs from serial/key-id spec need the CA specified. $SSHKEYGEN $OPTS -kf $OBJ/krl-serial $OBJ/revoked-serials \ >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly" @@ -125,9 +140,9 @@ check_krl() { TAG=$4 $SSHKEYGEN -Qf $KRL $KEY >/dev/null result=$? - if test "x$EXPECT_REVOKED" = "xyes" -a $result -eq 0 ; then + if test "x$EXPECT_REVOKED" = "xy" -a $result -eq 0 ; then fatal "key $KEY not revoked by KRL $KRL: $TAG" - elif test "x$EXPECT_REVOKED" = "xno" -a $result -ne 0 ; then + elif test "x$EXPECT_REVOKED" = "xn" -a $result -ne 0 ; then fatal "key $KEY unexpectedly revoked by KRL $KRL: $TAG" fi } @@ -136,17 +151,21 @@ test_rev() { TAG=$2 KEYS_RESULT=$3 ALL_RESULT=$4 - SERIAL_RESULT=$5 - KEYID_RESULT=$6 - CERTS_RESULT=$7 - CA_RESULT=$8 - SERIAL_WRESULT=$9 - KEYID_WRESULT=$10 + HASH_RESULT=$5 + SERIAL_RESULT=$6 + KEYID_RESULT=$7 + CERTS_RESULT=$8 + CA_RESULT=$9 + SERIAL_WRESULT=$10 + KEYID_WRESULT=$11 verbose "$tid: checking revocations for $TAG" for f in $FILES ; do check_krl $f $OBJ/krl-empty no "$TAG" check_krl $f $OBJ/krl-keys $KEYS_RESULT "$TAG" check_krl $f $OBJ/krl-all $ALL_RESULT "$TAG" + check_krl $f $OBJ/krl-sha1 $HASH_RESULT "$TAG" + check_krl $f $OBJ/krl-sha256 $HASH_RESULT "$TAG" + check_krl $f $OBJ/krl-hash $HASH_RESULT "$TAG" check_krl $f $OBJ/krl-serial $SERIAL_RESULT "$TAG" check_krl $f $OBJ/krl-keyid $KEYID_RESULT "$TAG" check_krl $f $OBJ/krl-cert $CERTS_RESULT "$TAG" @@ -157,12 +176,12 @@ test_rev() { } test_all() { - # wildcard - # keys all sr# k.ID cert CA sr.# k.ID - test_rev "$RKEYS" "revoked keys" yes yes no no no no no no - test_rev "$UKEYS" "unrevoked keys" no no no no no no no no - test_rev "$RCERTS" "revoked certs" yes yes yes yes yes yes yes yes - test_rev "$UCERTS" "unrevoked certs" no no no no no yes no no + # wildcard + # keys all hash sr# ID cert CA srl ID + test_rev "$RKEYS" "revoked keys" y y y n n n n n n + test_rev "$UKEYS" "unrevoked keys" n n n n n n n n n + test_rev "$RCERTS" "revoked certs" y y y y y y y y y + test_rev "$UCERTS" "unrevoked certs" n n n n n n y n n } test_all -- 2.20.1