summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authordjm@openbsd.org <djm@openbsd.org>2015-01-18 22:00:18 +0000
committerDamien Miller <djm@mindrot.org>2015-01-20 00:26:13 +1100
commit7947810eab5fe0ad311f32a48f4d4eb1f71be6cf (patch)
treec1513f6abec3b307d01567e13326b3c2512cf5da
parent3a2b09d147a565d8a47edf37491e149a02c0d3a3 (diff)
upstream commit
regression test for known_host file editing using ssh-keygen (-H / -R / -F) after hostkeys_foreach() change; feedback and ok markus@
-rw-r--r--regress/Makefile8
-rw-r--r--regress/keygen-knownhosts.sh197
2 files changed, 202 insertions, 3 deletions
diff --git a/regress/Makefile b/regress/Makefile
index 23f1cbc9a..1c02aa819 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,4 +1,4 @@
1# $OpenBSD: Makefile,v 1.75 2015/01/18 19:47:55 djm Exp $ 1# $OpenBSD: Makefile,v 1.76 2015/01/18 22:00:18 djm Exp $
2 2
3REGRESS_TARGETS= unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t-exec 3REGRESS_TARGETS= unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t-exec
4tests: $(REGRESS_TARGETS) 4tests: $(REGRESS_TARGETS)
@@ -67,7 +67,8 @@ LTESTS= connect \
67 krl \ 67 krl \
68 multipubkey \ 68 multipubkey \
69 limit-keytype \ 69 limit-keytype \
70 hostkey-agent 70 hostkey-agent \
71 keygen-knownhosts
71 72
72 73
73# dhgex \ 74# dhgex \
@@ -97,7 +98,8 @@ CLEANFILES= t2.out t3.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
97 regress.log failed-regress.log ssh-log-wrapper.sh \ 98 regress.log failed-regress.log ssh-log-wrapper.sh \
98 sftp-server.sh sftp-server.log sftp.log setuid-allowed \ 99 sftp-server.sh sftp-server.log sftp.log setuid-allowed \
99 data ed25519-agent ed25519-agent.pub key.ed25519-512 \ 100 data ed25519-agent ed25519-agent.pub key.ed25519-512 \
100 key.ed25519-512.pub netcat host_krl_* host_revoked_* user_*key* 101 key.ed25519-512.pub netcat host_krl_* host_revoked_* \
102 kh.* user_*key*
101 103
102SUDO_CLEAN+= /var/run/testdata_${USER} /var/run/keycommand_${USER} 104SUDO_CLEAN+= /var/run/testdata_${USER} /var/run/keycommand_${USER}
103 105
diff --git a/regress/keygen-knownhosts.sh b/regress/keygen-knownhosts.sh
new file mode 100644
index 000000000..35a5ea499
--- /dev/null
+++ b/regress/keygen-knownhosts.sh
@@ -0,0 +1,197 @@
1# $OpenBSD: keygen-knownhosts.sh,v 1.1 2015/01/18 22:00:18 djm Exp $
2# Placed in the Public Domain.
3
4tid="ssh-keygen known_hosts"
5
6rm -f $OBJ/kh.*
7
8# Generate some keys for testing (just ed25519 for speed) and make a hosts file.
9for x in host-a host-b host-c host-d host-e host-f host-a2 host-b2; do
10 ${SSHKEYGEN} -qt ed25519 -f $OBJ/kh.$x -C "$x" -N "" || \
11 fatal "ssh-keygen failed"
12 # Add a comment that we expect should be preserved.
13 echo "# $x" >> $OBJ/kh.hosts
14 (
15 case "$x" in
16 host-a|host-b) echo -n "$x " ;;
17 host-c) echo -n "@cert-authority $x " ;;
18 host-d) echo -n "@revoked $x " ;;
19 host-e) echo -n "host-e* " ;;
20 host-f) echo -n "host-f,host-g,host-h " ;;
21 host-a2) echo -n "host-a " ;;
22 host-b2) echo -n "host-b " ;;
23 esac
24 cat $OBJ/kh.${x}.pub
25 # Blank line should be preserved.
26 echo "" >> $OBJ/kh.hosts
27 ) >> $OBJ/kh.hosts
28done
29
30# Generate a variant with an invalid line. We'll use this for most tests,
31# because keygen should be able to cope and it should be preserved in any
32# output file.
33cat $OBJ/kh.hosts >> $OBJ/kh.invalid
34echo "host-i " >> $OBJ/kh.invalid
35
36cp $OBJ/kh.invalid $OBJ/kh.invalid.orig
37cp $OBJ/kh.hosts $OBJ/kh.hosts.orig
38
39expect_key() {
40 _host=$1
41 _hosts=$2
42 _key=$3
43 _line=$4
44 _mark=$5
45 _marker=""
46 test "x$_mark" = "xCA" && _marker="@cert-authority "
47 test "x$_mark" = "xREVOKED" && _marker="@revoked "
48 test "x$_line" != "x" &&
49 echo "# Host $_host found: line $_line $_mark" >> $OBJ/kh.expect
50 echo -n "${_marker}$_hosts " >> $OBJ/kh.expect
51 cat $OBJ/kh.${_key}.pub >> $OBJ/kh.expect ||
52 fatal "${_key}.pub missing"
53}
54
55check_find() {
56 _host=$1
57 _name=$2
58 _keygenopt=$3
59 ${SSHKEYGEN} $_keygenopt -f $OBJ/kh.invalid -F $_host > $OBJ/kh.result
60 if ! diff -uw $OBJ/kh.expect $OBJ/kh.result ; then
61 fail "didn't find $_name"
62 fi
63}
64
65# Find key
66rm -f $OBJ/kh.expect
67expect_key host-a host-a host-a 2
68expect_key host-a host-a host-a2 20
69check_find host-a "simple find"
70
71# find CA key
72rm -f $OBJ/kh.expect
73expect_key host-c host-c host-c 8 CA
74check_find host-c "find CA key"
75
76# find revoked key
77rm -f $OBJ/kh.expect
78expect_key host-d host-d host-d 11 REVOKED
79check_find host-d "find revoked key"
80
81# find key with wildcard
82rm -f $OBJ/kh.expect
83expect_key host-e.somedomain "host-e*" host-e 14
84check_find host-e.somedomain "find wildcard key"
85
86# find key among multiple hosts
87rm -f $OBJ/kh.expect
88expect_key host-h "host-f,host-g,host-h " host-f 17
89check_find host-h "find multiple hosts"
90
91check_hashed_find() {
92 _host=$1
93 _name=$2
94 _file=$3
95 test "x$_file" = "x" && _file=$OBJ/kh.invalid
96 ${SSHKEYGEN} -f $_file -HF $_host | grep '|1|' | \
97 sed "s/^[^ ]*/$_host/" > $OBJ/kh.result
98 if ! diff -uw $OBJ/kh.expect $OBJ/kh.result ; then
99 fail "didn't find $_name"
100 fi
101}
102
103# Find key and hash
104rm -f $OBJ/kh.expect
105expect_key host-a host-a host-a
106expect_key host-a host-a host-a2
107check_hashed_find host-a "find simple and hash"
108
109# Find CA key and hash
110rm -f $OBJ/kh.expect
111expect_key host-c host-c host-c "" CA
112# CA key output is not hashed.
113check_find host-c "find simple and hash" -H
114
115# Find revoked key and hash
116rm -f $OBJ/kh.expect
117expect_key host-d host-d host-d "" REVOKED
118# Revoked key output is not hashed.
119check_find host-d "find simple and hash" -H
120
121# find key with wildcard and hash
122rm -f $OBJ/kh.expect
123expect_key host-e "host-e*" host-e ""
124# Key with wildcard hostname should not be hashed.
125check_find host-e "find wildcard key" -H
126
127# find key among multiple hosts
128rm -f $OBJ/kh.expect
129# Comma-separated hostnames should be expanded and hashed.
130expect_key host-f "host-h " host-f
131expect_key host-g "host-h " host-f
132expect_key host-h "host-h " host-f
133check_hashed_find host-h "find multiple hosts"
134
135# Attempt remove key on invalid file.
136cp $OBJ/kh.invalid.orig $OBJ/kh.invalid
137${SSHKEYGEN} -qf $OBJ/kh.invalid -R host-a 2>/dev/null
138diff -u $OBJ/kh.invalid $OBJ/kh.invalid.orig || fail "remove on invalid succeeded"
139
140# Remove key
141cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
142${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-a 2>/dev/null
143grep -v "^host-a " $OBJ/kh.hosts.orig > $OBJ/kh.expect
144diff -u $OBJ/kh.hosts $OBJ/kh.expect || fail "remove simple"
145
146# Remove CA key
147cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
148${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-c 2>/dev/null
149# CA key should not be removed.
150diff -u $OBJ/kh.hosts $OBJ/kh.hosts.orig || fail "remove CA"
151
152# Remove revoked key
153cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
154${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-d 2>/dev/null
155# revoked key should not be removed.
156diff -u $OBJ/kh.hosts $OBJ/kh.hosts.orig || fail "remove revoked"
157
158# Remove wildcard
159cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
160${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-e.blahblah 2>/dev/null
161grep -v "^host-e[*] " $OBJ/kh.hosts.orig > $OBJ/kh.expect
162diff -u $OBJ/kh.hosts $OBJ/kh.expect || fail "remove wildcard"
163
164# Remove multiple
165cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
166${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-h 2>/dev/null
167grep -v "^host-f," $OBJ/kh.hosts.orig > $OBJ/kh.expect
168diff -u $OBJ/kh.hosts $OBJ/kh.expect || fail "remove wildcard"
169
170# Attempt hash on invalid file
171cp $OBJ/kh.invalid.orig $OBJ/kh.invalid
172${SSHKEYGEN} -qf $OBJ/kh.invalid -H 2>/dev/null && fail "hash invalid succeeded"
173diff -u $OBJ/kh.invalid $OBJ/kh.invalid.orig || fail "invalid file modified"
174
175# Hash valid file
176cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
177${SSHKEYGEN} -qf $OBJ/kh.hosts -H 2>/dev/null || fail "hash failed"
178diff -u $OBJ/kh.hosts.old $OBJ/kh.hosts.orig || fail "backup differs"
179grep "^host-[abfgh]" $OBJ/kh.hosts && fail "original hostnames persist"
180
181cp $OBJ/kh.hosts $OBJ/kh.hashed.orig
182
183# Test lookup
184rm -f $OBJ/kh.expect
185expect_key host-a host-a host-a
186expect_key host-a host-a host-a2
187check_hashed_find host-a "find simple in hashed" $OBJ/kh.hosts
188
189# Test multiple expanded
190rm -f $OBJ/kh.expect
191expect_key host-h host-h host-f
192check_hashed_find host-h "find simple in hashed" $OBJ/kh.hosts
193
194# Test remove
195cp $OBJ/kh.hashed.orig $OBJ/kh.hashed
196${SSHKEYGEN} -qf $OBJ/kh.hashed -R host-a 2>/dev/null
197${SSHKEYGEN} -qf $OBJ/kh.hashed -F host-a && fail "found key after hashed remove"