1# $OpenBSD: krl.sh,v 1.2 2013/11/21 03:15:46 djm Exp $ 2# Placed in the Public Domain. 3 4tid="key revocation lists" 5 6# If we don't support ecdsa keys then this tell will be much slower. 7ECDSA=ecdsa 8if test "x$TEST_SSH_ECC" != "xyes"; then 9 ECDSA=rsa 10fi 11 12# Do most testing with ssh-keygen; it uses the same verification code as sshd. 13 14# Old keys will interfere with ssh-keygen. 15rm -f $OBJ/revoked-* $OBJ/krl-* 16 17# Generate a CA key 18$SSHKEYGEN -t $ECDSA -f $OBJ/revoked-ca -C "" -N "" > /dev/null || 19 fatal "$SSHKEYGEN CA failed" 20 21# A specification that revokes some certificates by serial numbers 22# The serial pattern is chosen to ensure the KRL includes list, range and 23# bitmap sections. 24cat << EOF >> $OBJ/revoked-serials 25serial: 1-4 26serial: 10 27serial: 15 28serial: 30 29serial: 50 30serial: 999 31# The following sum to 500-799 32serial: 500 33serial: 501 34serial: 502 35serial: 503-600 36serial: 700-797 37serial: 798 38serial: 799 39serial: 599-701 40EOF 41 42# A specification that revokes some certificated by key ID. 43touch $OBJ/revoked-keyid 44for n in 1 2 3 4 10 15 30 50 `jot 500 300` 999 1000 1001 1002; do 45 # Fill in by-ID revocation spec. 46 echo "id: revoked $n" >> $OBJ/revoked-keyid 47done 48 49keygen() { 50 N=$1 51 f=$OBJ/revoked-`printf "%04d" $N` 52 # Vary the keytype. We use mostly ECDSA since this is fastest by far. 53 keytype=$ECDSA 54 case $N in 55 2 | 10 | 510 | 1001) keytype=rsa;; 56 4 | 30 | 520 | 1002) keytype=dsa;; 57 esac 58 $SSHKEYGEN -t $keytype -f $f -C "" -N "" > /dev/null \ 59 || fatal "$SSHKEYGEN failed" 60 # Sign cert 61 $SSHKEYGEN -s $OBJ/revoked-ca -z $n -I "revoked $N" $f >/dev/null 2>&1 \ 62 || fatal "$SSHKEYGEN sign failed" 63 echo $f 64} 65 66# Generate some keys. 67verbose "$tid: generating test keys" 68REVOKED_SERIALS="1 4 10 50 500 510 520 799 999" 69for n in $REVOKED_SERIALS ; do 70 f=`keygen $n` 71 REVOKED_KEYS="$REVOKED_KEYS ${f}.pub" 72 REVOKED_CERTS="$REVOKED_CERTS ${f}-cert.pub" 73done 74NOTREVOKED_SERIALS="5 9 14 16 29 30 49 51 499 800 1000 1001" 75NOTREVOKED="" 76for n in $NOTREVOKED_SERIALS ; do 77 NOTREVOKED_KEYS="$NOTREVOKED_KEYS ${f}.pub" 78 NOTREVOKED_CERTS="$NOTREVOKED_CERTS ${f}-cert.pub" 79done 80 81genkrls() { 82 OPTS=$1 83$SSHKEYGEN $OPTS -kf $OBJ/krl-empty - </dev/null \ 84 >/dev/null || fatal "$SSHKEYGEN KRL failed" 85$SSHKEYGEN $OPTS -kf $OBJ/krl-keys $REVOKED_KEYS \ 86 >/dev/null || fatal "$SSHKEYGEN KRL failed" 87$SSHKEYGEN $OPTS -kf $OBJ/krl-cert $REVOKED_CERTS \ 88 >/dev/null || fatal "$SSHKEYGEN KRL failed" 89$SSHKEYGEN $OPTS -kf $OBJ/krl-all $REVOKED_KEYS $REVOKED_CERTS \ 90 >/dev/null || fatal "$SSHKEYGEN KRL failed" 91$SSHKEYGEN $OPTS -kf $OBJ/krl-ca $OBJ/revoked-ca.pub \ 92 >/dev/null || fatal "$SSHKEYGEN KRL failed" 93# KRLs from serial/key-id spec need the CA specified. 94$SSHKEYGEN $OPTS -kf $OBJ/krl-serial $OBJ/revoked-serials \ 95 >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly" 96$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid $OBJ/revoked-keyid \ 97 >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly" 98$SSHKEYGEN $OPTS -kf $OBJ/krl-serial -s $OBJ/revoked-ca $OBJ/revoked-serials \ 99 >/dev/null || fatal "$SSHKEYGEN KRL failed" 100$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid -s $OBJ/revoked-ca.pub $OBJ/revoked-keyid \ 101 >/dev/null || fatal "$SSHKEYGEN KRL failed" 102} 103 104## XXX dump with trace and grep for set cert serials 105## XXX test ranges near (u64)-1, etc. 106 107verbose "$tid: generating KRLs" 108genkrls 109 110check_krl() { 111 KEY=$1 112 KRL=$2 113 EXPECT_REVOKED=$3 114 TAG=$4 115 $SSHKEYGEN -Qf $KRL $KEY >/dev/null 116 result=$? 117 if test "x$EXPECT_REVOKED" = "xyes" -a $result -eq 0 ; then 118 fatal "key $KEY not revoked by KRL $KRL: $TAG" 119 elif test "x$EXPECT_REVOKED" = "xno" -a $result -ne 0 ; then 120 fatal "key $KEY unexpectedly revoked by KRL $KRL: $TAG" 121 fi 122} 123test_all() { 124 FILES=$1 125 TAG=$2 126 KEYS_RESULT=$3 127 ALL_RESULT=$4 128 SERIAL_RESULT=$5 129 KEYID_RESULT=$6 130 CERTS_RESULT=$7 131 CA_RESULT=$8 132 verbose "$tid: checking revocations for $TAG" 133 for f in $FILES ; do 134 check_krl $f $OBJ/krl-empty no "$TAG" 135 check_krl $f $OBJ/krl-keys $KEYS_RESULT "$TAG" 136 check_krl $f $OBJ/krl-all $ALL_RESULT "$TAG" 137 check_krl $f $OBJ/krl-serial $SERIAL_RESULT "$TAG" 138 check_krl $f $OBJ/krl-keyid $KEYID_RESULT "$TAG" 139 check_krl $f $OBJ/krl-cert $CERTS_RESULT "$TAG" 140 check_krl $f $OBJ/krl-ca $CA_RESULT "$TAG" 141 done 142} 143# keys all serial keyid certs CA 144test_all "$REVOKED_KEYS" "revoked keys" yes yes no no no no 145test_all "$UNREVOKED_KEYS" "unrevoked keys" no no no no no no 146test_all "$REVOKED_CERTS" "revoked certs" yes yes yes yes yes yes 147test_all "$UNREVOKED_CERTS" "unrevoked certs" no no no no no yes 148 149# Check update. Results should be identical. 150verbose "$tid: testing KRL update" 151for f in $OBJ/krl-keys $OBJ/krl-cert $OBJ/krl-all \ 152 $OBJ/krl-ca $OBJ/krl-serial $OBJ/krl-keyid ; do 153 cp -f $OBJ/krl-empty $f 154 genkrls -u 155done 156# keys all serial keyid certs CA 157test_all "$REVOKED_KEYS" "revoked keys" yes yes no no no no 158test_all "$UNREVOKED_KEYS" "unrevoked keys" no no no no no no 159test_all "$REVOKED_CERTS" "revoked certs" yes yes yes yes yes yes 160test_all "$UNREVOKED_CERTS" "unrevoked certs" no no no no no yes 161