1# $OpenBSD: krl.sh,v 1.7 2018/09/12 01:23:48 djm Exp $ 2# Placed in the Public Domain. 3 4tid="key revocation lists" 5 6# If we don't support ecdsa keys then this tell will be much slower. 7ECDSA=ecdsa 8if test "x$TEST_SSH_ECC" != "xyes"; then 9 ECDSA=rsa 10fi 11 12# Do most testing with ssh-keygen; it uses the same verification code as sshd. 13 14# Old keys will interfere with ssh-keygen. 15rm -f $OBJ/revoked-* $OBJ/krl-* 16 17# Generate a CA key 18$SSHKEYGEN -t $ECDSA -f $OBJ/revoked-ca -C "" -N "" > /dev/null || 19 fatal "$SSHKEYGEN CA failed" 20$SSHKEYGEN -t ed25519 -f $OBJ/revoked-ca2 -C "" -N "" > /dev/null || 21 fatal "$SSHKEYGEN CA2 failed" 22 23# A specification that revokes some certificates by serial numbers 24# The serial pattern is chosen to ensure the KRL includes list, range and 25# bitmap sections. 26cat << EOF >> $OBJ/revoked-serials 27serial: 1-4 28serial: 10 29serial: 15 30serial: 30 31serial: 50 32serial: 999 33# The following sum to 500-799 34serial: 500 35serial: 501 36serial: 502 37serial: 503-600 38serial: 700-797 39serial: 798 40serial: 799 41serial: 599-701 42# Some multiple consecutive serial number ranges 43serial: 10000-20000 44serial: 30000-40000 45EOF 46 47# A specification that revokes some certificated by key ID. 48touch $OBJ/revoked-keyid 49for n in 1 2 3 4 10 15 30 50 `jot 500 300` 999 1000 1001 1002; do 50 test "x$n" = "x499" && continue 51 # Fill in by-ID revocation spec. 52 echo "id: revoked $n" >> $OBJ/revoked-keyid 53done 54 55keygen() { 56 N=$1 57 f=$OBJ/revoked-`printf "%04d" $N` 58 # Vary the keytype. We use mostly ECDSA since this is fastest by far. 59 keytype=$ECDSA 60 case $N in 61 2 | 10 | 510 | 1001) keytype=rsa;; 62 4 | 30 | 520 | 1002) keytype=ed25519;; 63 esac 64 $SSHKEYGEN -t $keytype -f $f -C "" -N "" > /dev/null \ 65 || fatal "$SSHKEYGEN failed" 66 # Sign cert 67 $SSHKEYGEN -s $OBJ/revoked-ca -z $n -I "revoked $N" $f >/dev/null 2>&1 \ 68 || fatal "$SSHKEYGEN sign failed" 69 echo $f 70} 71 72# Generate some keys. 73verbose "$tid: generating test keys" 74REVOKED_SERIALS="1 4 10 50 500 510 520 799 999" 75for n in $REVOKED_SERIALS ; do 76 f=`keygen $n` 77 RKEYS="$RKEYS ${f}.pub" 78 RCERTS="$RCERTS ${f}-cert.pub" 79done 80UNREVOKED_SERIALS="5 9 14 16 29 49 51 499 800 1010 1011" 81UNREVOKED="" 82for n in $UNREVOKED_SERIALS ; do 83 f=`keygen $n` 84 UKEYS="$UKEYS ${f}.pub" 85 UCERTS="$UCERTS ${f}-cert.pub" 86done 87 88# Specifications that revoke keys by hash. 89touch $OBJ/revoked-sha1 $OBJ/revoked-sha256 $OBJ/revoked-hash 90for rkey in $RKEYS; do 91 (printf "sha1: "; cat $rkey) >> $OBJ/revoked-sha1 92 (printf "sha256: "; cat $rkey) >> $OBJ/revoked-sha256 93 (printf "hash: "; $SSHKEYGEN -lf $rkey | \ 94 awk '{ print $2 }') >> $OBJ/revoked-hash 95done 96 97genkrls() { 98 OPTS=$1 99$SSHKEYGEN $OPTS -kf $OBJ/krl-empty - </dev/null \ 100 >/dev/null || fatal "$SSHKEYGEN KRL failed" 101$SSHKEYGEN $OPTS -kf $OBJ/krl-keys $RKEYS \ 102 >/dev/null || fatal "$SSHKEYGEN KRL failed" 103$SSHKEYGEN $OPTS -kf $OBJ/krl-cert $RCERTS \ 104 >/dev/null || fatal "$SSHKEYGEN KRL failed" 105$SSHKEYGEN $OPTS -kf $OBJ/krl-all $RKEYS $RCERTS \ 106 >/dev/null || fatal "$SSHKEYGEN KRL failed" 107$SSHKEYGEN $OPTS -kf $OBJ/krl-ca $OBJ/revoked-ca.pub \ 108 >/dev/null || fatal "$SSHKEYGEN KRL failed" 109$SSHKEYGEN $OPTS -kf $OBJ/krl-sha1 $OBJ/revoked-sha1 \ 110 >/dev/null 2>&1 || fatal "$SSHKEYGEN KRL failed" 111$SSHKEYGEN $OPTS -kf $OBJ/krl-sha256 $OBJ/revoked-sha256 \ 112 >/dev/null 2>&1 || fatal "$SSHKEYGEN KRL failed" 113$SSHKEYGEN $OPTS -kf $OBJ/krl-hash $OBJ/revoked-hash \ 114 >/dev/null 2>&1 || fatal "$SSHKEYGEN KRL failed" 115# This should fail as KRLs from serial/key-id spec need the CA specified. 116$SSHKEYGEN $OPTS -kf $OBJ/krl-serial $OBJ/revoked-serials \ 117 >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly" 118$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid $OBJ/revoked-keyid \ 119 >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly" 120# These should succeed; they specify an explicit CA key. 121$SSHKEYGEN $OPTS -kf $OBJ/krl-serial -s $OBJ/revoked-ca \ 122 $OBJ/revoked-serials >/dev/null || fatal "$SSHKEYGEN KRL failed" 123$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid -s $OBJ/revoked-ca.pub \ 124 $OBJ/revoked-keyid >/dev/null || fatal "$SSHKEYGEN KRL failed" 125# These should succeed; they specify an wildcard CA key. 126$SSHKEYGEN $OPTS -kf $OBJ/krl-serial-wild -s NONE $OBJ/revoked-serials \ 127 >/dev/null || fatal "$SSHKEYGEN KRL failed" 128$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid-wild -s NONE $OBJ/revoked-keyid \ 129 >/dev/null || fatal "$SSHKEYGEN KRL failed" 130# Revoke the same serials with the second CA key to ensure a multi-CA 131# KRL is generated. 132$SSHKEYGEN $OPTS -kf $OBJ/krl-serial -u -s $OBJ/revoked-ca2 \ 133 $OBJ/revoked-serials >/dev/null || fatal "$SSHKEYGEN KRL failed" 134} 135 136## XXX dump with trace and grep for set cert serials 137## XXX test ranges near (u64)-1, etc. 138 139verbose "$tid: generating KRLs" 140genkrls 141 142check_krl() { 143 KEY=$1 144 KRL=$2 145 EXPECT_REVOKED=$3 146 TAG=$4 147 $SSHKEYGEN -Qf $KRL $KEY >/dev/null 148 result=$? 149 if test "x$EXPECT_REVOKED" = "xy" -a $result -eq 0 ; then 150 fatal "key $KEY not revoked by KRL $KRL: $TAG" 151 elif test "x$EXPECT_REVOKED" = "xn" -a $result -ne 0 ; then 152 fatal "key $KEY unexpectedly revoked by KRL $KRL: $TAG" 153 fi 154} 155test_rev() { 156 FILES=$1 157 TAG=$2 158 KEYS_RESULT=$3 159 ALL_RESULT=$4 160 HASH_RESULT=$5 161 SERIAL_RESULT=$6 162 KEYID_RESULT=$7 163 CERTS_RESULT=$8 164 CA_RESULT=$9 165 SERIAL_WRESULT=$10 166 KEYID_WRESULT=$11 167 verbose "$tid: checking revocations for $TAG" 168 for f in $FILES ; do 169 check_krl $f $OBJ/krl-empty no "$TAG" 170 check_krl $f $OBJ/krl-keys $KEYS_RESULT "$TAG" 171 check_krl $f $OBJ/krl-all $ALL_RESULT "$TAG" 172 check_krl $f $OBJ/krl-sha1 $HASH_RESULT "$TAG" 173 check_krl $f $OBJ/krl-sha256 $HASH_RESULT "$TAG" 174 check_krl $f $OBJ/krl-hash $HASH_RESULT "$TAG" 175 check_krl $f $OBJ/krl-serial $SERIAL_RESULT "$TAG" 176 check_krl $f $OBJ/krl-keyid $KEYID_RESULT "$TAG" 177 check_krl $f $OBJ/krl-cert $CERTS_RESULT "$TAG" 178 check_krl $f $OBJ/krl-ca $CA_RESULT "$TAG" 179 check_krl $f $OBJ/krl-serial-wild $SERIAL_WRESULT "$TAG" 180 check_krl $f $OBJ/krl-keyid-wild $KEYID_WRESULT "$TAG" 181 done 182} 183 184test_all() { 185 # wildcard 186 # keys all hash sr# ID cert CA srl ID 187 test_rev "$RKEYS" "revoked keys" y y y n n n n n n 188 test_rev "$UKEYS" "unrevoked keys" n n n n n n n n n 189 test_rev "$RCERTS" "revoked certs" y y y y y y y y y 190 test_rev "$UCERTS" "unrevoked certs" n n n n n n y n n 191} 192 193test_all 194 195# Check update. Results should be identical. 196verbose "$tid: testing KRL update" 197for f in $OBJ/krl-keys $OBJ/krl-cert $OBJ/krl-all \ 198 $OBJ/krl-ca $OBJ/krl-serial $OBJ/krl-keyid \ 199 $OBJ/krl-serial-wild $OBJ/krl-keyid-wild; do 200 cp -f $OBJ/krl-empty $f 201 genkrls -u 202done 203 204test_all 205