1 files changed, 35 insertions, 19 deletions

diff --git a/regress/principals-command.sh b/regress/principals-command.sh
index c0be7e747..9b38eb105 100644
--- a/regress/principals-command.sh
+++ b/regress/principals-command.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: principals-command.sh,v 1.1 2015/05/21 06:44:25 djm Exp $
+#       $OpenBSD: principals-command.sh,v 1.3 2016/09/26 21:34:38 bluhm Exp $
 #       Placed in the Public Domain.
 
 tid="authorized principals command"
@@ -6,41 +6,56 @@ tid="authorized principals command"
 rm -f $OBJ/user_ca_key* $OBJ/cert_user_key*
 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 
-if test -z "$SUDO" ; then
+if [ -z "$SUDO" -a ! -w /var/run ]; then
         echo "skipped (SUDO not set)"
         echo "need SUDO to create file in /var/run, test won't work without"
         exit 0
 fi
 
+SERIAL=$$
+
+# Create a CA key and a user certificate.
+${SSHKEYGEN} -q -N '' -t ed25519  -f $OBJ/user_ca_key || \
+        fatal "ssh-keygen of user_ca_key failed"
+${SSHKEYGEN} -q -N '' -t rsa -f $OBJ/cert_user_key || \
+        fatal "ssh-keygen of cert_user_key failed"
+${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "Joanne User" \
+    -z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key || \
+        fatal "couldn't sign cert_user_key"
+
+CERT_BODY=`cat $OBJ/cert_user_key-cert.pub | awk '{ print $2 }'`
+CA_BODY=`cat $OBJ/user_ca_key.pub | awk '{ print $2 }'`
+CERT_FP=`${SSHKEYGEN} -lf $OBJ/cert_user_key-cert.pub | awk '{ print $2 }'`
+CA_FP=`${SSHKEYGEN} -lf $OBJ/user_ca_key.pub | awk '{ print $2 }'`
+
 # Establish a AuthorizedPrincipalsCommand in /var/run where it will have
 # acceptable directory permissions.
-PRINCIPALS_CMD="/var/run/principals_command_${LOGNAME}"
-cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_CMD'"
+PRINCIPALS_COMMAND="/var/run/principals_command_${LOGNAME}"
+cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_COMMAND'"
 #!/bin/sh
 test "x\$1" != "x${LOGNAME}" && exit 1
+test "x\$2" != "xssh-rsa-cert-v01@openssh.com" && exit 1
+test "x\$3" != "xssh-ed25519" && exit 1
+test "x\$4" != "xJoanne User" && exit 1
+test "x\$5" != "x${SERIAL}" && exit 1
+test "x\$6" != "x${CA_FP}" && exit 1
+test "x\$7" != "x${CERT_FP}" && exit 1
+test "x\$8" != "x${CERT_BODY}" && exit 1
+test "x\$9" != "x${CA_BODY}" && exit 1
 test -f "$OBJ/authorized_principals_${LOGNAME}" &&
         exec cat "$OBJ/authorized_principals_${LOGNAME}"
 _EOF
 test $? -eq 0 || fatal "couldn't prepare principals command"
-$SUDO chmod 0755 "$PRINCIPALS_CMD"
+$SUDO chmod 0755 "$PRINCIPALS_COMMAND"
 
-if ! $OBJ/check-perm -m keys-command $PRINCIPALS_CMD ; then
-        echo "skipping: $PRINCIPALS_CMD is unsuitable as " \
+if ! $OBJ/check-perm -m keys-command $PRINCIPALS_COMMAND ; then
+        echo "skipping: $PRINCIPALS_COMMAND is unsuitable as " \
             "AuthorizedPrincipalsCommand"
-        $SUDO rm -f $PRINCIPALS_CMD
+        $SUDO rm -f $PRINCIPALS_COMMAND
         exit 0
 fi
 
-# Create a CA key and a user certificate.
-${SSHKEYGEN} -q -N '' -t ed25519  -f $OBJ/user_ca_key || \
-        fatal "ssh-keygen of user_ca_key failed"
-${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/cert_user_key || \
-        fatal "ssh-keygen of cert_user_key failed"
-${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
-    -z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key || \
-        fatal "couldn't sign cert_user_key"
-
-if [ -x $PRINCIPALS_CMD ]; then
+if [ -x $PRINCIPALS_COMMAND ]; then
         # Test explicitly-specified principals
         for privsep in yes no ; do
                 _prefix="privsep $privsep"
@@ -51,7 +66,8 @@ if [ -x $PRINCIPALS_CMD ]; then
                         cat $OBJ/sshd_proxy_bak
                         echo "UsePrivilegeSeparation $privsep"
                         echo "AuthorizedKeysFile none"
-                        echo "AuthorizedPrincipalsCommand $PRINCIPALS_CMD %u"
+                        echo "AuthorizedPrincipalsCommand $PRINCIPALS_COMMAND" \
+                            "%u %t %T %i %s %F %f %k %K"
                         echo "AuthorizedPrincipalsCommandUser ${LOGNAME}"
                         echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
                 ) > $OBJ/sshd_proxy