- djm@cvs.openbsd.org 2013/01/18 00:45:29

     [regress/Makefile regress/cert-userkey.sh regress/krl.sh]
     Tests for Key Revocation Lists (KRLs)

1 files changed, 20 insertions, 2 deletions

diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh
index aa85cd6cb..3bba9f8f2 100644
--- a/regress/cert-userkey.sh
+++ b/regress/cert-userkey.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cert-userkey.sh,v 1.9 2012/10/19 05:10:42 djm Exp $
+#       $OpenBSD: cert-userkey.sh,v 1.10 2013/01/18 00:45:29 djm Exp $
 #       Placed in the Public Domain.
 
 tid="certified user keys"
@@ -184,14 +184,32 @@ basic_tests() {
                         (
                                 cat $OBJ/sshd_proxy_bak
                                 echo "UsePrivilegeSeparation $privsep"
-                                echo "RevokedKeys $OBJ/cert_user_key_${ktype}.pub"
+                                echo "RevokedKeys $OBJ/cert_user_key_revoked"
                                 echo "$extra_sshd"
                         ) > $OBJ/sshd_proxy
+                        cp $OBJ/cert_user_key_${ktype}.pub \
+                            $OBJ/cert_user_key_revoked
                         ${SSH} -2i $OBJ/cert_user_key_${ktype} \
                             -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
                         if [ $? -eq 0 ]; then
                                 fail "ssh cert connect succeeded unexpecedly"
                         fi
+                        verbose "$tid: ${_prefix} revoked via KRL"
+                        rm $OBJ/cert_user_key_revoked
+                        ${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked \
+                            $OBJ/cert_user_key_${ktype}.pub
+                        ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+                            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+                        if [ $? -eq 0 ]; then
+                                fail "ssh cert connect succeeded unexpecedly"
+                        fi
+                        verbose "$tid: ${_prefix} empty KRL"
+                        ${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked
+                        ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+                            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+                        if [ $? -ne 0 ]; then
+                                fail "ssh cert connect failed"
+                        fi
                 done
         
                 # Revoked CA