summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--regress/Makefile5
-rw-r--r--regress/hostkey-rotate.sh129
2 files changed, 132 insertions, 2 deletions
diff --git a/regress/Makefile b/regress/Makefile
index c920661ae..58bcb38b6 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,4 +1,4 @@
1# $OpenBSD: Makefile,v 1.77 2015/01/20 22:58:57 djm Exp $ 1# $OpenBSD: Makefile,v 1.78 2015/01/26 06:12:18 djm Exp $
2 2
3REGRESS_TARGETS= unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t-exec 3REGRESS_TARGETS= unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t-exec
4tests: $(REGRESS_TARGETS) 4tests: $(REGRESS_TARGETS)
@@ -68,7 +68,8 @@ LTESTS= connect \
68 multipubkey \ 68 multipubkey \
69 limit-keytype \ 69 limit-keytype \
70 hostkey-agent \ 70 hostkey-agent \
71 keygen-knownhosts 71 keygen-knownhosts \
72 hostkey-rotate
72 73
73 74
74# dhgex \ 75# dhgex \
diff --git a/regress/hostkey-rotate.sh b/regress/hostkey-rotate.sh
new file mode 100644
index 000000000..d964b35c2
--- /dev/null
+++ b/regress/hostkey-rotate.sh
@@ -0,0 +1,129 @@
1# $OpenBSD: hostkey-rotate.sh,v 1.1 2015/01/26 06:12:18 djm Exp $
2# Placed in the Public Domain.
3
4tid="hostkey rotate"
5
6# Need full names here since they are used in HostKeyAlgorithms
7HOSTKEY_TYPES="ecdsa-sha2-nistp256 ssh-ed25519 ssh-rsa ssh-dss"
8
9rm -f $OBJ/hkr.* $OBJ/ssh_proxy.orig
10
11grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig
12echo "UpdateHostkeys=yes" >> $OBJ/ssh_proxy
13rm $OBJ/known_hosts
14
15trace "prepare hostkeys"
16nkeys=0
17all_algs=""
18for k in `ssh -Q key-plain` ; do
19 ${SSHKEYGEN} -qt $k -f $OBJ/hkr.$k -N '' || fatal "ssh-keygen $k"
20 echo "Hostkey $OBJ/hkr.${k}" >> $OBJ/sshd_proxy.orig
21 nkeys=`expr $nkeys + 1`
22 test "x$all_algs" = "x" || all_algs="${all_algs},"
23 all_algs="${all_algs}$k"
24done
25
26dossh() {
27 # All ssh should succeed in this test
28 ${SSH} -F $OBJ/ssh_proxy "$@" x true || fail "ssh $@ failed"
29}
30
31expect_nkeys() {
32 _expected=$1
33 _message=$2
34 _n=`wc -l $OBJ/known_hosts | awk '{ print $1 }'` || fatal "wc failed"
35 [ "x$_n" = "x$_expected" ] || fail "$_message (got $_n wanted $_expected)"
36}
37
38check_key_present() {
39 _type=$1
40 _kfile=$2
41 _prog='print $2 " " $3'
42 test "x$_kfile" = "x" && _kfile="$OBJ/hkr.${_type}.pub"
43 _ktext=`awk "/ $_type / { $_prog }" < $OBJ/known_hosts` || \
44 fatal "awk failed"
45 grep -q "$_ktext" $_kfile
46}
47
48cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
49
50# Connect to sshd with StrictHostkeyChecking=no
51verbose "learn hostkey with StrictHostKeyChecking=no"
52>$OBJ/known_hosts
53dossh -oHostKeyAlgorithms=ssh-ed25519 -oStrictHostKeyChecking=no
54# Verify no additional keys learned
55expect_nkeys 1 "unstrict connect keys"
56check_key_present ssh-ed25519 || fail "unstrict didn't learn key"
57
58# Connect to sshd as usual
59verbose "learn additional hostkeys"
60dossh -oStrictHostKeyChecking=yes
61# Check that other keys learned
62expect_nkeys $nkeys "learn hostkeys"
63check_key_present ssh-rsa || fail "didn't learn keys"
64
65# Check each key type
66for k in `ssh -Q key-plain` ; do
67 verbose "learn additional hostkeys, type=$k"
68 dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$k,$all_algs
69 expect_nkeys $nkeys "learn hostkeys $k"
70 check_key_present $k || fail "didn't learn $k"
71done
72
73# Change one hostkey (non primary) and relearn
74verbose "learn changed non-primary hostkey"
75mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
76rm -f $OBJ/hkr.ssh-rsa
77${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa -N '' || fatal "ssh-keygen $k"
78dossh -oStrictHostKeyChecking=yes
79# Check that the key was replaced
80expect_nkeys $nkeys "learn hostkeys"
81check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
82check_key_present ssh-rsa || fail "didn't learn changed key"
83
84# Add new hostkey (primary type) to sshd and connect
85verbose "learn new primary hostkey"
86${SSHKEYGEN} -qt ssh-rsa -f $OBJ/hkr.ssh-rsa-new -N '' || fatal "ssh-keygen $k"
87( cat $OBJ/sshd_proxy.orig ; echo HostKey $OBJ/hkr.ssh-rsa-new ) \
88 > $OBJ/sshd_proxy
89# Check new hostkey added
90dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs
91expect_nkeys `expr $nkeys + 1` "learn hostkeys"
92check_key_present ssh-rsa || fail "current key missing"
93check_key_present ssh-rsa $OBJ/hkr.ssh-rsa-new.pub || fail "new key missing"
94
95# Remove old hostkey (primary type) from sshd
96verbose "rotate primary hostkey"
97cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
98mv $OBJ/hkr.ssh-rsa.pub $OBJ/hkr.ssh-rsa.pub.old
99mv $OBJ/hkr.ssh-rsa-new.pub $OBJ/hkr.ssh-rsa.pub
100mv $OBJ/hkr.ssh-rsa-new $OBJ/hkr.ssh-rsa
101# Check old hostkey removed
102dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa,$all_algs
103expect_nkeys $nkeys "learn hostkeys"
104check_key_present ssh-rsa $OBJ/hkr.ssh-rsa.pub.old && fail "old key present"
105check_key_present ssh-rsa || fail "didn't learn changed key"
106
107# Connect again, forcing rotated key
108verbose "check rotate primary hostkey"
109dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa
110expect_nkeys 1 "learn hostkeys"
111check_key_present ssh-rsa || fail "didn't learn changed key"
112
113# $OpenBSD: hostkey-rotate.sh,v 1.1 2015/01/26 06:12:18 djm Exp $
114# Placed in the Public Domain.
115
116tid="hostkey rotate"
117
118# Prepare hostkeys file with one key
119
120# Connect to sshd
121
122# Check that other keys learned
123
124# Change one hostkey (non primary)
125
126# Connect to sshd
127
128# Check that the key was replaced
129