summaryrefslogtreecommitdiff
path: root/regress/cert-file.sh
diff options
context:
space:
mode:
Diffstat (limited to 'regress/cert-file.sh')
-rw-r--r--regress/cert-file.sh131
1 files changed, 64 insertions, 67 deletions
diff --git a/regress/cert-file.sh b/regress/cert-file.sh
index 43b8e0201..8fd62c773 100644
--- a/regress/cert-file.sh
+++ b/regress/cert-file.sh
@@ -1,4 +1,4 @@
1# $OpenBSD: cert-file.sh,v 1.5 2017/03/11 23:44:16 djm Exp $ 1# $OpenBSD: cert-file.sh,v 1.6 2017/04/30 23:34:55 djm Exp $
2# Placed in the Public Domain. 2# Placed in the Public Domain.
3 3
4tid="ssh with certificates" 4tid="ssh with certificates"
@@ -54,66 +54,64 @@ cat $OBJ/ssh_proxy | grep -v IdentityFile > $OBJ/no_identity_config
54# XXX: verify that certificate used was what we expect. Needs exposure of 54# XXX: verify that certificate used was what we expect. Needs exposure of
55# keys via enviornment variable or similar. 55# keys via enviornment variable or similar.
56 56
57for p in ${SSH_PROTOCOLS}; do
58 # Key with no .pub should work - finding the equivalent *-cert.pub. 57 # Key with no .pub should work - finding the equivalent *-cert.pub.
59 verbose "protocol $p: identity cert with no plain public file" 58verbose "identity cert with no plain public file"
60 ${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \ 59${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \
61 -i $OBJ/user_key3 somehost exit 5$p 60 -i $OBJ/user_key3 somehost exit 52
62 [ $? -ne 5$p ] && fail "ssh failed" 61[ $? -ne 52 ] && fail "ssh failed"
63 62
64 # CertificateFile matching private key with no .pub file should work. 63# CertificateFile matching private key with no .pub file should work.
65 verbose "protocol $p: CertificateFile with no plain public file" 64verbose "CertificateFile with no plain public file"
66 ${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \ 65${SSH} -F $OBJ/no_identity_config -oIdentitiesOnly=yes \
67 -oCertificateFile=$OBJ/user_key3-cert.pub \ 66 -oCertificateFile=$OBJ/user_key3-cert.pub \
68 -i $OBJ/user_key3 somehost exit 5$p 67 -i $OBJ/user_key3 somehost exit 52
69 [ $? -ne 5$p ] && fail "ssh failed" 68[ $? -ne 52 ] && fail "ssh failed"
70 69
71 # Just keys should fail 70# Just keys should fail
72 verbose "protocol $p: plain keys" 71verbose "plain keys"
73 ${SSH} $opts2 somehost exit 5$p 72${SSH} $opts2 somehost exit 52
74 r=$? 73r=$?
75 if [ $r -eq 5$p ]; then 74if [ $r -eq 52 ]; then
76 fail "ssh succeeded with no certs in protocol $p" 75 fail "ssh succeeded with no certs"
77 fi 76fi
78 77
79 # Keys with untrusted cert should fail. 78# Keys with untrusted cert should fail.
80 verbose "protocol $p: untrusted cert" 79verbose "untrusted cert"
81 opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub" 80opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
82 ${SSH} $opts3 somehost exit 5$p 81${SSH} $opts3 somehost exit 52
83 r=$? 82r=$?
84 if [ $r -eq 5$p ]; then 83if [ $r -eq 52 ]; then
85 fail "ssh succeeded with bad cert in protocol $p" 84 fail "ssh succeeded with bad cert"
86 fi 85fi
87 86
88 # Good cert with bad key should fail. 87# Good cert with bad key should fail.
89 verbose "protocol $p: good cert, bad key" 88verbose "good cert, bad key"
90 opts3="$opts -i $OBJ/user_key2" 89opts3="$opts -i $OBJ/user_key2"
91 opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub" 90opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
92 ${SSH} $opts3 somehost exit 5$p 91${SSH} $opts3 somehost exit 52
93 r=$? 92r=$?
94 if [ $r -eq 5$p ]; then 93if [ $r -eq 52 ]; then
95 fail "ssh succeeded with no matching key in protocol $p" 94 fail "ssh succeeded with no matching key"
96 fi 95fi
97 96
98 # Keys with one trusted cert, should succeed. 97# Keys with one trusted cert, should succeed.
99 verbose "protocol $p: single trusted" 98verbose "single trusted"
100 opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub" 99opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
101 ${SSH} $opts3 somehost exit 5$p 100${SSH} $opts3 somehost exit 52
102 r=$? 101r=$?
103 if [ $r -ne 5$p ]; then 102if [ $r -ne 52 ]; then
104 fail "ssh failed with trusted cert and key in protocol $p" 103 fail "ssh failed with trusted cert and key"
105 fi 104fi
106 105
107 # Multiple certs and keys, with one trusted cert, should succeed. 106# Multiple certs and keys, with one trusted cert, should succeed.
108 verbose "protocol $p: multiple trusted" 107verbose "multiple trusted"
109 opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub" 108opts3="$opts2 -oCertificateFile=$OBJ/cert_user_key1_2.pub"
110 opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub" 109opts3="$opts3 -oCertificateFile=$OBJ/cert_user_key1_1.pub"
111 ${SSH} $opts3 somehost exit 5$p 110${SSH} $opts3 somehost exit 52
112 r=$? 111r=$?
113 if [ $r -ne 5$p ]; then 112if [ $r -ne 52 ]; then
114 fail "ssh failed with multiple certs in protocol $p" 113 fail "ssh failed with multiple certs"
115 fi 114fi
116done
117 115
118#next, using an agent in combination with the keys 116#next, using an agent in combination with the keys
119SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1 117SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1
@@ -139,26 +137,25 @@ if [ $? -ne 0 ]; then
139fi 137fi
140 138
141# try ssh with the agent and certificates 139# try ssh with the agent and certificates
142# note: ssh agent only uses certificates in protocol 2
143opts="-F $OBJ/ssh_proxy" 140opts="-F $OBJ/ssh_proxy"
144# with no certificates, shoud fail 141# with no certificates, shoud fail
145${SSH} -2 $opts somehost exit 52 142${SSH} $opts somehost exit 52
146if [ $? -eq 52 ]; then 143if [ $? -eq 52 ]; then
147 fail "ssh connect with agent in protocol 2 succeeded with no cert" 144 fail "ssh connect with agent in succeeded with no cert"
148fi 145fi
149 146
150#with an untrusted certificate, should fail 147#with an untrusted certificate, should fail
151opts="$opts -oCertificateFile=$OBJ/cert_user_key1_2.pub" 148opts="$opts -oCertificateFile=$OBJ/cert_user_key1_2.pub"
152${SSH} -2 $opts somehost exit 52 149${SSH} $opts somehost exit 52
153if [ $? -eq 52 ]; then 150if [ $? -eq 52 ]; then
154 fail "ssh connect with agent in protocol 2 succeeded with bad cert" 151 fail "ssh connect with agent in succeeded with bad cert"
155fi 152fi
156 153
157#with an additional trusted certificate, should succeed 154#with an additional trusted certificate, should succeed
158opts="$opts -oCertificateFile=$OBJ/cert_user_key1_1.pub" 155opts="$opts -oCertificateFile=$OBJ/cert_user_key1_1.pub"
159${SSH} -2 $opts somehost exit 52 156${SSH} $opts somehost exit 52
160if [ $? -ne 52 ]; then 157if [ $? -ne 52 ]; then
161 fail "ssh connect with agent in protocol 2 failed with good cert" 158 fail "ssh connect with agent in failed with good cert"
162fi 159fi
163 160
164trace "kill agent" 161trace "kill agent"