diff options
Diffstat (limited to 'regress/cert-hostkey.sh')
| -rw-r--r-- | regress/cert-hostkey.sh | 86 |
1 files changed, 40 insertions, 46 deletions
diff --git a/regress/cert-hostkey.sh b/regress/cert-hostkey.sh index de8652b0e5e2..a3414e1a5c50 100644 --- a/regress/cert-hostkey.sh +++ b/regress/cert-hostkey.sh @@ -1,4 +1,4 @@ -# $OpenBSD: cert-hostkey.sh,v 1.25 2021/06/08 22:30:27 djm Exp $ +# $OpenBSD: cert-hostkey.sh,v 1.27 2021/09/30 05:26:26 dtucker Exp $ # Placed in the Public Domain. tid="certified host keys" @@ -131,35 +131,32 @@ attempt_connect() { } # Basic connect and revocation tests. -for privsep in yes ; do - for ktype in $PLAIN_TYPES ; do - verbose "$tid: host ${ktype} cert connect privsep $privsep" - ( - cat $OBJ/sshd_proxy_bak - echo HostKey $OBJ/cert_host_key_${ktype} - echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub - echo UsePrivilegeSeparation $privsep - ) > $OBJ/sshd_proxy +for ktype in $PLAIN_TYPES ; do + verbose "$tid: host ${ktype} cert connect" + ( + cat $OBJ/sshd_proxy_bak + echo HostKey $OBJ/cert_host_key_${ktype} + echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub + ) > $OBJ/sshd_proxy - # test name expect success - attempt_connect "$ktype basic connect" "yes" - attempt_connect "$ktype empty KRL" "yes" \ - -oRevokedHostKeys=$OBJ/host_krl_empty - attempt_connect "$ktype KRL w/ plain key revoked" "no" \ - -oRevokedHostKeys=$OBJ/host_krl_plain - attempt_connect "$ktype KRL w/ cert revoked" "no" \ - -oRevokedHostKeys=$OBJ/host_krl_cert - attempt_connect "$ktype KRL w/ CA revoked" "no" \ - -oRevokedHostKeys=$OBJ/host_krl_ca - attempt_connect "$ktype empty plaintext revocation" "yes" \ - -oRevokedHostKeys=$OBJ/host_revoked_empty - attempt_connect "$ktype plain key plaintext revocation" "no" \ - -oRevokedHostKeys=$OBJ/host_revoked_plain - attempt_connect "$ktype cert plaintext revocation" "no" \ - -oRevokedHostKeys=$OBJ/host_revoked_cert - attempt_connect "$ktype CA plaintext revocation" "no" \ - -oRevokedHostKeys=$OBJ/host_revoked_ca - done + # test name expect success + attempt_connect "$ktype basic connect" "yes" + attempt_connect "$ktype empty KRL" "yes" \ + -oRevokedHostKeys=$OBJ/host_krl_empty + attempt_connect "$ktype KRL w/ plain key revoked" "no" \ + -oRevokedHostKeys=$OBJ/host_krl_plain + attempt_connect "$ktype KRL w/ cert revoked" "no" \ + -oRevokedHostKeys=$OBJ/host_krl_cert + attempt_connect "$ktype KRL w/ CA revoked" "no" \ + -oRevokedHostKeys=$OBJ/host_krl_ca + attempt_connect "$ktype empty plaintext revocation" "yes" \ + -oRevokedHostKeys=$OBJ/host_revoked_empty + attempt_connect "$ktype plain key plaintext revocation" "no" \ + -oRevokedHostKeys=$OBJ/host_revoked_plain + attempt_connect "$ktype cert plaintext revocation" "no" \ + -oRevokedHostKeys=$OBJ/host_revoked_cert + attempt_connect "$ktype CA plaintext revocation" "no" \ + -oRevokedHostKeys=$OBJ/host_revoked_ca done # Revoked certificates with key present @@ -169,24 +166,21 @@ for ktype in $PLAIN_TYPES ; do kh_revoke cert_host_key_${ktype}.pub >> $OBJ/known_hosts-cert.orig done cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert -for privsep in yes ; do - for ktype in $PLAIN_TYPES ; do - verbose "$tid: host ${ktype} revoked cert privsep $privsep" - ( - cat $OBJ/sshd_proxy_bak - echo HostKey $OBJ/cert_host_key_${ktype} - echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub - echo UsePrivilegeSeparation $privsep - ) > $OBJ/sshd_proxy +for ktype in $PLAIN_TYPES ; do + verbose "$tid: host ${ktype} revoked cert" + ( + cat $OBJ/sshd_proxy_bak + echo HostKey $OBJ/cert_host_key_${ktype} + echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub + ) > $OBJ/sshd_proxy - cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert - ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \ - -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \ - -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 - if [ $? -eq 0 ]; then - fail "ssh cert connect succeeded unexpectedly" - fi - done + cp $OBJ/known_hosts-cert.orig $OBJ/known_hosts-cert + ${SSH} -oUserKnownHostsFile=$OBJ/known_hosts-cert \ + -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \ + -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1 + if [ $? -eq 0 ]; then + fail "ssh cert connect succeeded unexpectedly" + fi done # Revoked CA |