xref: /freebsd/crypto/openssh/regress/unittests/hostkeys/test_iterate.c (revision 1f4bcc459a76b7aa664f3fd557684cd0ba6da352) 
1 /* 	$OpenBSD: test_iterate.c,v 1.4 2015/03/31 22:59:01 djm Exp $ */
2 /*
3  * Regress test for hostfile.h hostkeys_foreach()
4  *
5  * Placed in the public domain
6  */
7 
8 #include "includes.h"
9 
10 #include <sys/types.h>
11 #include <sys/param.h>
12 #include <stdio.h>
13 #ifdef HAVE_STDINT_H
14 #include <stdint.h>
15 #endif
16 #include <stdlib.h>
17 #include <string.h>
18 
19 #include "../test_helper/test_helper.h"
20 
21 #include "sshkey.h"
22 #include "authfile.h"
23 #include "hostfile.h"
24 
25 struct expected {
26 	const char *key_file;		/* Path for key, NULL for none */
27 	int no_parse_status;		/* Expected status w/o key parsing */
28 	int no_parse_keytype;		/* Expected keytype w/o key parsing */
29 	int match_host_p;		/* Match 'prometheus.example.com' */
30 	int match_host_s;		/* Match 'sisyphus.example.com' */
31 	int match_ipv4;			/* Match '192.0.2.1' */
32 	int match_ipv6;			/* Match '2001:db8::1' */
33 	int match_flags;		/* Expected flags from match */
34 	struct hostkey_foreach_line l;	/* Expected line contents */
35 };
36 
37 struct cbctx {
38 	const struct expected *expected;
39 	size_t nexpected;
40 	size_t i;
41 	int flags;
42 	int match_host_p;
43 	int match_host_s;
44 	int match_ipv4;
45 	int match_ipv6;
46 };
47 
48 /*
49  * hostkeys_foreach() iterator callback that verifies the line passed
50  * against an array of expected entries.
51  */
52 static int
53 check(struct hostkey_foreach_line *l, void *_ctx)
54 {
55 	struct cbctx *ctx = (struct cbctx *)_ctx;
56 	const struct expected *expected;
57 	int parse_key = (ctx->flags & HKF_WANT_PARSE_KEY) != 0;
58 	const int matching = (ctx->flags & HKF_WANT_MATCH) != 0;
59 	u_int expected_status, expected_match;
60 	int expected_keytype;
61 
62 	test_subtest_info("entry %zu/%zu, file line %ld",
63 	    ctx->i + 1, ctx->nexpected, l->linenum);
64 
65 	for (;;) {
66 		ASSERT_SIZE_T_LT(ctx->i, ctx->nexpected);
67 		expected = ctx->expected + ctx->i++;
68 		/* If we are matching host/IP then skip entries that don't */
69 		if (!matching)
70 			break;
71 		if (ctx->match_host_p && expected->match_host_p)
72 			break;
73 		if (ctx->match_host_s && expected->match_host_s)
74 			break;
75 		if (ctx->match_ipv4 && expected->match_ipv4)
76 			break;
77 		if (ctx->match_ipv6 && expected->match_ipv6)
78 			break;
79 	}
80 	expected_status = (parse_key || expected->no_parse_status < 0) ?
81 	    expected->l.status : (u_int)expected->no_parse_status;
82 	expected_match = expected->l.match;
83 #define UPDATE_MATCH_STATUS(x) do { \
84 		if (ctx->x && expected->x) { \
85 			expected_match |= expected->x; \
86 			if (expected_status == HKF_STATUS_OK) \
87 				expected_status = HKF_STATUS_MATCHED; \
88 		} \
89 	} while (0)
90 	expected_keytype = (parse_key || expected->no_parse_keytype < 0) ?
91 	    expected->l.keytype : expected->no_parse_keytype;
92 
93 #ifndef WITH_SSH1
94 	if (parse_key && (expected->l.keytype == KEY_RSA1 ||
95 	    expected->no_parse_keytype == KEY_RSA1)) {
96 		expected_status = HKF_STATUS_INVALID;
97 		expected_keytype = KEY_UNSPEC;
98 		parse_key = 0;
99 	}
100 #endif
101 #ifndef OPENSSL_HAS_ECC
102 	if (expected->l.keytype == KEY_ECDSA ||
103 	    expected->no_parse_keytype == KEY_ECDSA) {
104 		expected_status = HKF_STATUS_INVALID;
105 		expected_keytype = KEY_UNSPEC;
106 		parse_key = 0;
107 	}
108 #endif
109 
110 	UPDATE_MATCH_STATUS(match_host_p);
111 	UPDATE_MATCH_STATUS(match_host_s);
112 	UPDATE_MATCH_STATUS(match_ipv4);
113 	UPDATE_MATCH_STATUS(match_ipv6);
114 
115 	ASSERT_PTR_NE(l->path, NULL); /* Don't care about path */
116 	ASSERT_LONG_LONG_EQ(l->linenum, expected->l.linenum);
117 	ASSERT_U_INT_EQ(l->status, expected_status);
118 	ASSERT_U_INT_EQ(l->match, expected_match);
119 	/* Not all test entries contain fulltext */
120 	if (expected->l.line != NULL)
121 		ASSERT_STRING_EQ(l->line, expected->l.line);
122 	ASSERT_INT_EQ(l->marker, expected->l.marker);
123 	/* XXX we skip hashed hostnames for now; implement checking */
124 	if (expected->l.hosts != NULL)
125 		ASSERT_STRING_EQ(l->hosts, expected->l.hosts);
126 	/* Not all test entries contain raw keys */
127 	if (expected->l.rawkey != NULL)
128 		ASSERT_STRING_EQ(l->rawkey, expected->l.rawkey);
129 	/* XXX synthesise raw key for cases lacking and compare */
130 	ASSERT_INT_EQ(l->keytype, expected_keytype);
131 	if (parse_key) {
132 		if (expected->l.key == NULL)
133 			ASSERT_PTR_EQ(l->key, NULL);
134 		if (expected->l.key != NULL) {
135 			ASSERT_PTR_NE(l->key, NULL);
136 			ASSERT_INT_EQ(sshkey_equal(l->key, expected->l.key), 1);
137 		}
138 	}
139 	if (parse_key && !(l->comment == NULL && expected->l.comment == NULL))
140 		ASSERT_STRING_EQ(l->comment, expected->l.comment);
141 	return 0;
142 }
143 
144 /* Loads public keys for a set of expected results */
145 static void
146 prepare_expected(struct expected *expected, size_t n)
147 {
148 	size_t i;
149 
150 	for (i = 0; i < n; i++) {
151 		if (expected[i].key_file == NULL)
152 			continue;
153 #ifndef WITH_SSH1
154 		if (expected[i].l.keytype == KEY_RSA1)
155 			continue;
156 #endif
157 #ifndef OPENSSL_HAS_ECC
158 		if (expected[i].l.keytype == KEY_ECDSA)
159 			continue;
160 #endif
161 		ASSERT_INT_EQ(sshkey_load_public(
162 		    test_data_file(expected[i].key_file), &expected[i].l.key,
163 		    NULL), 0);
164 	}
165 }
166 
167 struct expected expected_full[] = {
168 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
169 		NULL,				/* path, don't care */
170 		1,				/* line number */
171 		HKF_STATUS_COMMENT,		/* status */
172 		0,				/* match flags */
173 		"# Plain host keys, plain host names", /* full line, optional */
174 		MRK_NONE,			/* marker (CA / revoked) */
175 		NULL,				/* hosts text */
176 		NULL,				/* raw key, optional */
177 		KEY_UNSPEC,			/* key type */
178 		NULL,				/* deserialised key */
179 		NULL,				/* comment */
180 	} },
181 	{ "dsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
182 		NULL,
183 		2,
184 		HKF_STATUS_OK,
185 		0,
186 		NULL,
187 		MRK_NONE,
188 		"sisyphus.example.com",
189 		NULL,
190 		KEY_DSA,
191 		NULL,	/* filled at runtime */
192 		"DSA #1",
193 	} },
194 	{ "ecdsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
195 		NULL,
196 		3,
197 		HKF_STATUS_OK,
198 		0,
199 		NULL,
200 		MRK_NONE,
201 		"sisyphus.example.com",
202 		NULL,
203 		KEY_ECDSA,
204 		NULL,	/* filled at runtime */
205 		"ECDSA #1",
206 	} },
207 	{ "ed25519_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
208 		NULL,
209 		4,
210 		HKF_STATUS_OK,
211 		0,
212 		NULL,
213 		MRK_NONE,
214 		"sisyphus.example.com",
215 		NULL,
216 		KEY_ED25519,
217 		NULL,	/* filled at runtime */
218 		"ED25519 #1",
219 	} },
220 	{ "rsa1_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
221 		NULL,
222 		5,
223 		HKF_STATUS_OK,
224 		0,
225 		NULL,
226 		MRK_NONE,
227 		"sisyphus.example.com",
228 		NULL,
229 		KEY_RSA1,
230 		NULL,	/* filled at runtime */
231 		"RSA1 #1",
232 	} },
233 	{ "rsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
234 		NULL,
235 		6,
236 		HKF_STATUS_OK,
237 		0,
238 		NULL,
239 		MRK_NONE,
240 		"sisyphus.example.com",
241 		NULL,
242 		KEY_RSA,
243 		NULL,	/* filled at runtime */
244 		"RSA #1",
245 	} },
246 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
247 		NULL,
248 		7,
249 		HKF_STATUS_COMMENT,
250 		0,
251 		"",
252 		MRK_NONE,
253 		NULL,
254 		NULL,
255 		KEY_UNSPEC,
256 		NULL,
257 		NULL,
258 	} },
259 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
260 		NULL,
261 		8,
262 		HKF_STATUS_COMMENT,
263 		0,
264 		"# Plain host keys, hostnames + addresses",
265 		MRK_NONE,
266 		NULL,
267 		NULL,
268 		KEY_UNSPEC,
269 		NULL,
270 		NULL,
271 	} },
272 	{ "dsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
273 		NULL,
274 		9,
275 		HKF_STATUS_OK,
276 		0,
277 		NULL,
278 		MRK_NONE,
279 		"prometheus.example.com,192.0.2.1,2001:db8::1",
280 		NULL,
281 		KEY_DSA,
282 		NULL,	/* filled at runtime */
283 		"DSA #2",
284 	} },
285 	{ "ecdsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
286 		NULL,
287 		10,
288 		HKF_STATUS_OK,
289 		0,
290 		NULL,
291 		MRK_NONE,
292 		"prometheus.example.com,192.0.2.1,2001:db8::1",
293 		NULL,
294 		KEY_ECDSA,
295 		NULL,	/* filled at runtime */
296 		"ECDSA #2",
297 	} },
298 	{ "ed25519_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
299 		NULL,
300 		11,
301 		HKF_STATUS_OK,
302 		0,
303 		NULL,
304 		MRK_NONE,
305 		"prometheus.example.com,192.0.2.1,2001:db8::1",
306 		NULL,
307 		KEY_ED25519,
308 		NULL,	/* filled at runtime */
309 		"ED25519 #2",
310 	} },
311 	{ "rsa1_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
312 		NULL,
313 		12,
314 		HKF_STATUS_OK,
315 		0,
316 		NULL,
317 		MRK_NONE,
318 		"prometheus.example.com,192.0.2.1,2001:db8::1",
319 		NULL,
320 		KEY_RSA1,
321 		NULL,	/* filled at runtime */
322 		"RSA1 #2",
323 	} },
324 	{ "rsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
325 		NULL,
326 		13,
327 		HKF_STATUS_OK,
328 		0,
329 		NULL,
330 		MRK_NONE,
331 		"prometheus.example.com,192.0.2.1,2001:db8::1",
332 		NULL,
333 		KEY_RSA,
334 		NULL,	/* filled at runtime */
335 		"RSA #2",
336 	} },
337 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
338 		NULL,
339 		14,
340 		HKF_STATUS_COMMENT,
341 		0,
342 		"",
343 		MRK_NONE,
344 		NULL,
345 		NULL,
346 		KEY_UNSPEC,
347 		NULL,
348 		NULL,
349 	} },
350 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
351 		NULL,
352 		15,
353 		HKF_STATUS_COMMENT,
354 		0,
355 		"# Some hosts with wildcard names / IPs",
356 		MRK_NONE,
357 		NULL,
358 		NULL,
359 		KEY_UNSPEC,
360 		NULL,
361 		NULL,
362 	} },
363 	{ "dsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
364 		NULL,
365 		16,
366 		HKF_STATUS_OK,
367 		0,
368 		NULL,
369 		MRK_NONE,
370 		"*.example.com,192.0.2.*,2001:*",
371 		NULL,
372 		KEY_DSA,
373 		NULL,	/* filled at runtime */
374 		"DSA #3",
375 	} },
376 	{ "ecdsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
377 		NULL,
378 		17,
379 		HKF_STATUS_OK,
380 		0,
381 		NULL,
382 		MRK_NONE,
383 		"*.example.com,192.0.2.*,2001:*",
384 		NULL,
385 		KEY_ECDSA,
386 		NULL,	/* filled at runtime */
387 		"ECDSA #3",
388 	} },
389 	{ "ed25519_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
390 		NULL,
391 		18,
392 		HKF_STATUS_OK,
393 		0,
394 		NULL,
395 		MRK_NONE,
396 		"*.example.com,192.0.2.*,2001:*",
397 		NULL,
398 		KEY_ED25519,
399 		NULL,	/* filled at runtime */
400 		"ED25519 #3",
401 	} },
402 	{ "rsa1_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
403 		NULL,
404 		19,
405 		HKF_STATUS_OK,
406 		0,
407 		NULL,
408 		MRK_NONE,
409 		"*.example.com,192.0.2.*,2001:*",
410 		NULL,
411 		KEY_RSA1,
412 		NULL,	/* filled at runtime */
413 		"RSA1 #3",
414 	} },
415 	{ "rsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
416 		NULL,
417 		20,
418 		HKF_STATUS_OK,
419 		0,
420 		NULL,
421 		MRK_NONE,
422 		"*.example.com,192.0.2.*,2001:*",
423 		NULL,
424 		KEY_RSA,
425 		NULL,	/* filled at runtime */
426 		"RSA #3",
427 	} },
428 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
429 		NULL,
430 		21,
431 		HKF_STATUS_COMMENT,
432 		0,
433 		"",
434 		MRK_NONE,
435 		NULL,
436 		NULL,
437 		KEY_UNSPEC,
438 		NULL,
439 		NULL,
440 	} },
441 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
442 		NULL,
443 		22,
444 		HKF_STATUS_COMMENT,
445 		0,
446 		"# Hashed hostname and address entries",
447 		MRK_NONE,
448 		NULL,
449 		NULL,
450 		KEY_UNSPEC,
451 		NULL,
452 		NULL,
453 	} },
454 	{ "dsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, {
455 		NULL,
456 		23,
457 		HKF_STATUS_OK,
458 		0,
459 		NULL,
460 		MRK_NONE,
461 		NULL,
462 		NULL,
463 		KEY_DSA,
464 		NULL,	/* filled at runtime */
465 		"DSA #5",
466 	} },
467 	{ "ecdsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, {
468 		NULL,
469 		24,
470 		HKF_STATUS_OK,
471 		0,
472 		NULL,
473 		MRK_NONE,
474 		NULL,
475 		NULL,
476 		KEY_ECDSA,
477 		NULL,	/* filled at runtime */
478 		"ECDSA #5",
479 	} },
480 	{ "ed25519_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, {
481 		NULL,
482 		25,
483 		HKF_STATUS_OK,
484 		0,
485 		NULL,
486 		MRK_NONE,
487 		NULL,
488 		NULL,
489 		KEY_ED25519,
490 		NULL,	/* filled at runtime */
491 		"ED25519 #5",
492 	} },
493 	{ "rsa1_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, {
494 		NULL,
495 		26,
496 		HKF_STATUS_OK,
497 		0,
498 		NULL,
499 		MRK_NONE,
500 		NULL,
501 		NULL,
502 		KEY_RSA1,
503 		NULL,	/* filled at runtime */
504 		"RSA1 #5",
505 	} },
506 	{ "rsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, {
507 		NULL,
508 		27,
509 		HKF_STATUS_OK,
510 		0,
511 		NULL,
512 		MRK_NONE,
513 		NULL,
514 		NULL,
515 		KEY_RSA,
516 		NULL,	/* filled at runtime */
517 		"RSA #5",
518 	} },
519 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
520 		NULL,
521 		28,
522 		HKF_STATUS_COMMENT,
523 		0,
524 		"",
525 		MRK_NONE,
526 		NULL,
527 		NULL,
528 		KEY_UNSPEC,
529 		NULL,
530 		NULL,
531 	} },
532 	/*
533 	 * The next series have each key listed multiple times, as the
534 	 * hostname and addresses in the pre-hashed known_hosts are split
535 	 * to separate lines.
536 	 */
537 	{ "dsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, {
538 		NULL,
539 		29,
540 		HKF_STATUS_OK,
541 		0,
542 		NULL,
543 		MRK_NONE,
544 		NULL,
545 		NULL,
546 		KEY_DSA,
547 		NULL,	/* filled at runtime */
548 		"DSA #6",
549 	} },
550 	{ "dsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, {
551 		NULL,
552 		30,
553 		HKF_STATUS_OK,
554 		0,
555 		NULL,
556 		MRK_NONE,
557 		NULL,
558 		NULL,
559 		KEY_DSA,
560 		NULL,	/* filled at runtime */
561 		"DSA #6",
562 	} },
563 	{ "dsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, {
564 		NULL,
565 		31,
566 		HKF_STATUS_OK,
567 		0,
568 		NULL,
569 		MRK_NONE,
570 		NULL,
571 		NULL,
572 		KEY_DSA,
573 		NULL,	/* filled at runtime */
574 		"DSA #6",
575 	} },
576 	{ "ecdsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, {
577 		NULL,
578 		32,
579 		HKF_STATUS_OK,
580 		0,
581 		NULL,
582 		MRK_NONE,
583 		NULL,
584 		NULL,
585 		KEY_ECDSA,
586 		NULL,	/* filled at runtime */
587 		"ECDSA #6",
588 	} },
589 	{ "ecdsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, {
590 		NULL,
591 		33,
592 		HKF_STATUS_OK,
593 		0,
594 		NULL,
595 		MRK_NONE,
596 		NULL,
597 		NULL,
598 		KEY_ECDSA,
599 		NULL,	/* filled at runtime */
600 		"ECDSA #6",
601 	} },
602 	{ "ecdsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, {
603 		NULL,
604 		34,
605 		HKF_STATUS_OK,
606 		0,
607 		NULL,
608 		MRK_NONE,
609 		NULL,
610 		NULL,
611 		KEY_ECDSA,
612 		NULL,	/* filled at runtime */
613 		"ECDSA #6",
614 	} },
615 	{ "ed25519_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, {
616 		NULL,
617 		35,
618 		HKF_STATUS_OK,
619 		0,
620 		NULL,
621 		MRK_NONE,
622 		NULL,
623 		NULL,
624 		KEY_ED25519,
625 		NULL,	/* filled at runtime */
626 		"ED25519 #6",
627 	} },
628 	{ "ed25519_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, {
629 		NULL,
630 		36,
631 		HKF_STATUS_OK,
632 		0,
633 		NULL,
634 		MRK_NONE,
635 		NULL,
636 		NULL,
637 		KEY_ED25519,
638 		NULL,	/* filled at runtime */
639 		"ED25519 #6",
640 	} },
641 	{ "ed25519_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, {
642 		NULL,
643 		37,
644 		HKF_STATUS_OK,
645 		0,
646 		NULL,
647 		MRK_NONE,
648 		NULL,
649 		NULL,
650 		KEY_ED25519,
651 		NULL,	/* filled at runtime */
652 		"ED25519 #6",
653 	} },
654 	{ "rsa1_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, {
655 		NULL,
656 		38,
657 		HKF_STATUS_OK,
658 		0,
659 		NULL,
660 		MRK_NONE,
661 		NULL,
662 		NULL,
663 		KEY_RSA1,
664 		NULL,	/* filled at runtime */
665 		"RSA1 #6",
666 	} },
667 	{ "rsa1_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, {
668 		NULL,
669 		39,
670 		HKF_STATUS_OK,
671 		0,
672 		NULL,
673 		MRK_NONE,
674 		NULL,
675 		NULL,
676 		KEY_RSA1,
677 		NULL,	/* filled at runtime */
678 		"RSA1 #6",
679 	} },
680 	{ "rsa1_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, {
681 		NULL,
682 		40,
683 		HKF_STATUS_OK,
684 		0,
685 		NULL,
686 		MRK_NONE,
687 		NULL,
688 		NULL,
689 		KEY_RSA1,
690 		NULL,	/* filled at runtime */
691 		"RSA1 #6",
692 	} },
693 	{ "rsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, {
694 		NULL,
695 		41,
696 		HKF_STATUS_OK,
697 		0,
698 		NULL,
699 		MRK_NONE,
700 		NULL,
701 		NULL,
702 		KEY_RSA,
703 		NULL,	/* filled at runtime */
704 		"RSA #6",
705 	} },
706 	{ "rsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, {
707 		NULL,
708 		42,
709 		HKF_STATUS_OK,
710 		0,
711 		NULL,
712 		MRK_NONE,
713 		NULL,
714 		NULL,
715 		KEY_RSA,
716 		NULL,	/* filled at runtime */
717 		"RSA #6",
718 	} },
719 	{ "rsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, {
720 		NULL,
721 		43,
722 		HKF_STATUS_OK,
723 		0,
724 		NULL,
725 		MRK_NONE,
726 		NULL,
727 		NULL,
728 		KEY_RSA,
729 		NULL,	/* filled at runtime */
730 		"RSA #6",
731 	} },
732 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
733 		NULL,
734 		44,
735 		HKF_STATUS_COMMENT,
736 		0,
737 		"",
738 		MRK_NONE,
739 		NULL,
740 		NULL,
741 		KEY_UNSPEC,
742 		NULL,
743 		NULL,
744 	} },
745 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
746 		NULL,
747 		45,
748 		HKF_STATUS_COMMENT,
749 		0,
750 		"",
751 		MRK_NONE,
752 		NULL,
753 		NULL,
754 		KEY_UNSPEC,
755 		NULL,
756 		NULL,
757 	} },
758 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
759 		NULL,
760 		46,
761 		HKF_STATUS_COMMENT,
762 		0,
763 		"# Revoked and CA keys",
764 		MRK_NONE,
765 		NULL,
766 		NULL,
767 		KEY_UNSPEC,
768 		NULL,
769 		NULL,
770 	} },
771 	{ "rsa1_4.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
772 		NULL,
773 		47,
774 		HKF_STATUS_OK,
775 		0,
776 		NULL,
777 		MRK_REVOKE,
778 		"sisyphus.example.com",
779 		NULL,
780 		KEY_RSA1,
781 		NULL,	/* filled at runtime */
782 		"RSA1 #4",
783 	} },
784 	{ "ed25519_4.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
785 		NULL,
786 		48,
787 		HKF_STATUS_OK,
788 		0,
789 		NULL,
790 		MRK_REVOKE,
791 		"sisyphus.example.com",
792 		NULL,
793 		KEY_ED25519,
794 		NULL,	/* filled at runtime */
795 		"ED25519 #4",
796 	} },
797 	{ "ecdsa_4.pub" , -1, -1, HKF_MATCH_HOST, 0, 0, 0, -1, {
798 		NULL,
799 		49,
800 		HKF_STATUS_OK,
801 		0,
802 		NULL,
803 		MRK_CA,
804 		"prometheus.example.com",
805 		NULL,
806 		KEY_ECDSA,
807 		NULL,	/* filled at runtime */
808 		"ECDSA #4",
809 	} },
810 	{ "dsa_4.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, 0, 0, -1, {
811 		NULL,
812 		50,
813 		HKF_STATUS_OK,
814 		0,
815 		NULL,
816 		MRK_CA,
817 		"*.example.com",
818 		NULL,
819 		KEY_DSA,
820 		NULL,	/* filled at runtime */
821 		"DSA #4",
822 	} },
823 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
824 		NULL,
825 		51,
826 		HKF_STATUS_COMMENT,
827 		0,
828 		"",
829 		MRK_NONE,
830 		NULL,
831 		NULL,
832 		KEY_UNSPEC,
833 		NULL,
834 		NULL,
835 	} },
836 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
837 		NULL,
838 		52,
839 		HKF_STATUS_COMMENT,
840 		0,
841 		"# Some invalid lines",
842 		MRK_NONE,
843 		NULL,
844 		NULL,
845 		KEY_UNSPEC,
846 		NULL,
847 		NULL,
848 	} },
849 	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
850 		NULL,
851 		53,
852 		HKF_STATUS_INVALID,
853 		0,
854 		NULL,
855 		MRK_ERROR,
856 		NULL,
857 		NULL,
858 		KEY_UNSPEC,
859 		NULL,
860 		NULL,
861 	} },
862 	{ NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
863 		NULL,
864 		54,
865 		HKF_STATUS_INVALID,
866 		0,
867 		NULL,
868 		MRK_NONE,
869 		"sisyphus.example.com",
870 		NULL,
871 		KEY_UNSPEC,
872 		NULL,
873 		NULL,
874 	} },
875 	{ NULL, -1, -1, HKF_MATCH_HOST, 0, 0, 0, -1, {
876 		NULL,
877 		55,
878 		HKF_STATUS_INVALID,
879 		0,
880 		NULL,
881 		MRK_NONE,
882 		"prometheus.example.com",
883 		NULL,
884 		KEY_UNSPEC,
885 		NULL,
886 		NULL,
887 	} },
888 	{ NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
889 		NULL,
890 		56,
891 		HKF_STATUS_INVALID,	/* Would be ok if key not parsed */
892 		0,
893 		NULL,
894 		MRK_NONE,
895 		"sisyphus.example.com",
896 		NULL,
897 		KEY_UNSPEC,
898 		NULL,
899 		NULL,
900 	} },
901 	{ NULL, -1, -1, HKF_MATCH_HOST, 0, 0, 0, -1, {
902 		NULL,
903 		57,
904 		HKF_STATUS_INVALID,	/* Would be ok if key not parsed */
905 		0,
906 		NULL,
907 		MRK_NONE,
908 		"prometheus.example.com",
909 		NULL,
910 		KEY_UNSPEC,
911 		NULL,
912 		NULL,
913 	} },
914 	{ NULL, HKF_STATUS_OK, KEY_RSA1, 0, HKF_MATCH_HOST, 0, 0, -1, {
915 		NULL,
916 		58,
917 		HKF_STATUS_INVALID,	/* Would be ok if key not parsed */
918 		0,
919 		NULL,
920 		MRK_NONE,
921 		"sisyphus.example.com",
922 		NULL,
923 		KEY_UNSPEC,
924 		NULL,
925 		NULL,
926 	} },
927 	{ NULL, HKF_STATUS_OK, KEY_RSA1, HKF_MATCH_HOST, 0, 0, 0, -1, {
928 		NULL,
929 		59,
930 		HKF_STATUS_INVALID,	/* Would be ok if key not parsed */
931 		0,
932 		NULL,
933 		MRK_NONE,
934 		"prometheus.example.com",
935 		NULL,
936 		KEY_UNSPEC,
937 		NULL,	/* filled at runtime */
938 		NULL,
939 	} },
940 	{ NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
941 		NULL,
942 		60,
943 		HKF_STATUS_INVALID,
944 		0,
945 		NULL,
946 		MRK_NONE,
947 		"sisyphus.example.com",
948 		NULL,
949 		KEY_UNSPEC,
950 		NULL,	/* filled at runtime */
951 		NULL,
952 	} },
953 	{ NULL, HKF_STATUS_OK, KEY_RSA, HKF_MATCH_HOST, 0, 0, 0, -1, {
954 		NULL,
955 		61,
956 		HKF_STATUS_INVALID,	/* Would be ok if key not parsed */
957 		0,
958 		NULL,
959 		MRK_NONE,
960 		"prometheus.example.com",
961 		NULL,
962 		KEY_UNSPEC,
963 		NULL,	/* filled at runtime */
964 		NULL,
965 	} },
966 };
967 
968 void test_iterate(void);
969 
970 void
971 test_iterate(void)
972 {
973 	struct cbctx ctx;
974 
975 	TEST_START("hostkeys_iterate all with key parse");
976 	memset(&ctx, 0, sizeof(ctx));
977 	ctx.expected = expected_full;
978 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
979 	ctx.flags = HKF_WANT_PARSE_KEY;
980 	prepare_expected(expected_full, ctx.nexpected);
981 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
982 	    check, &ctx, NULL, NULL, ctx.flags), 0);
983 	TEST_DONE();
984 
985 	TEST_START("hostkeys_iterate all without key parse");
986 	memset(&ctx, 0, sizeof(ctx));
987 	ctx.expected = expected_full;
988 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
989 	ctx.flags = 0;
990 	prepare_expected(expected_full, ctx.nexpected);
991 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
992 	    check, &ctx, NULL, NULL, ctx.flags), 0);
993 	TEST_DONE();
994 
995 	TEST_START("hostkeys_iterate specify host 1");
996 	memset(&ctx, 0, sizeof(ctx));
997 	ctx.expected = expected_full;
998 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
999 	ctx.flags = 0;
1000 	ctx.match_host_p = 1;
1001 	prepare_expected(expected_full, ctx.nexpected);
1002 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1003 	    check, &ctx, "prometheus.example.com", NULL, ctx.flags), 0);
1004 	TEST_DONE();
1005 
1006 	TEST_START("hostkeys_iterate specify host 2");
1007 	memset(&ctx, 0, sizeof(ctx));
1008 	ctx.expected = expected_full;
1009 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1010 	ctx.flags = 0;
1011 	ctx.match_host_s = 1;
1012 	prepare_expected(expected_full, ctx.nexpected);
1013 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1014 	    check, &ctx, "sisyphus.example.com", NULL, ctx.flags), 0);
1015 	TEST_DONE();
1016 
1017 	TEST_START("hostkeys_iterate match host 1");
1018 	memset(&ctx, 0, sizeof(ctx));
1019 	ctx.expected = expected_full;
1020 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1021 	ctx.flags = HKF_WANT_MATCH;
1022 	ctx.match_host_p = 1;
1023 	prepare_expected(expected_full, ctx.nexpected);
1024 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1025 	    check, &ctx, "prometheus.example.com", NULL, ctx.flags), 0);
1026 	TEST_DONE();
1027 
1028 	TEST_START("hostkeys_iterate match host 2");
1029 	memset(&ctx, 0, sizeof(ctx));
1030 	ctx.expected = expected_full;
1031 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1032 	ctx.flags = HKF_WANT_MATCH;
1033 	ctx.match_host_s = 1;
1034 	prepare_expected(expected_full, ctx.nexpected);
1035 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1036 	    check, &ctx, "sisyphus.example.com", NULL, ctx.flags), 0);
1037 	TEST_DONE();
1038 
1039 	TEST_START("hostkeys_iterate specify host missing");
1040 	memset(&ctx, 0, sizeof(ctx));
1041 	ctx.expected = expected_full;
1042 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1043 	ctx.flags = 0;
1044 	prepare_expected(expected_full, ctx.nexpected);
1045 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1046 	    check, &ctx, "actaeon.example.org", NULL, ctx.flags), 0);
1047 	TEST_DONE();
1048 
1049 	TEST_START("hostkeys_iterate match host missing");
1050 	memset(&ctx, 0, sizeof(ctx));
1051 	ctx.expected = expected_full;
1052 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1053 	ctx.flags = HKF_WANT_MATCH;
1054 	prepare_expected(expected_full, ctx.nexpected);
1055 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1056 	    check, &ctx, "actaeon.example.org", NULL, ctx.flags), 0);
1057 	TEST_DONE();
1058 
1059 	TEST_START("hostkeys_iterate specify IPv4");
1060 	memset(&ctx, 0, sizeof(ctx));
1061 	ctx.expected = expected_full;
1062 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1063 	ctx.flags = 0;
1064 	ctx.match_ipv4 = 1;
1065 	prepare_expected(expected_full, ctx.nexpected);
1066 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1067 	    check, &ctx, "tiresias.example.org", "192.0.2.1", ctx.flags), 0);
1068 	TEST_DONE();
1069 
1070 	TEST_START("hostkeys_iterate specify IPv6");
1071 	memset(&ctx, 0, sizeof(ctx));
1072 	ctx.expected = expected_full;
1073 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1074 	ctx.flags = 0;
1075 	ctx.match_ipv6 = 1;
1076 	prepare_expected(expected_full, ctx.nexpected);
1077 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1078 	    check, &ctx, "tiresias.example.org", "2001:db8::1", ctx.flags), 0);
1079 	TEST_DONE();
1080 
1081 	TEST_START("hostkeys_iterate match IPv4");
1082 	memset(&ctx, 0, sizeof(ctx));
1083 	ctx.expected = expected_full;
1084 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1085 	ctx.flags = HKF_WANT_MATCH;
1086 	ctx.match_ipv4 = 1;
1087 	prepare_expected(expected_full, ctx.nexpected);
1088 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1089 	    check, &ctx, "tiresias.example.org", "192.0.2.1", ctx.flags), 0);
1090 	TEST_DONE();
1091 
1092 	TEST_START("hostkeys_iterate match IPv6");
1093 	memset(&ctx, 0, sizeof(ctx));
1094 	ctx.expected = expected_full;
1095 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1096 	ctx.flags = HKF_WANT_MATCH;
1097 	ctx.match_ipv6 = 1;
1098 	prepare_expected(expected_full, ctx.nexpected);
1099 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1100 	    check, &ctx, "tiresias.example.org", "2001:db8::1", ctx.flags), 0);
1101 	TEST_DONE();
1102 
1103 	TEST_START("hostkeys_iterate specify addr missing");
1104 	memset(&ctx, 0, sizeof(ctx));
1105 	ctx.expected = expected_full;
1106 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1107 	ctx.flags = 0;
1108 	prepare_expected(expected_full, ctx.nexpected);
1109 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1110 	    check, &ctx, "tiresias.example.org", "192.168.0.1", ctx.flags), 0);
1111 	TEST_DONE();
1112 
1113 	TEST_START("hostkeys_iterate match addr missing");
1114 	memset(&ctx, 0, sizeof(ctx));
1115 	ctx.expected = expected_full;
1116 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1117 	ctx.flags = HKF_WANT_MATCH;
1118 	prepare_expected(expected_full, ctx.nexpected);
1119 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1120 	    check, &ctx, "tiresias.example.org", "::1", ctx.flags), 0);
1121 	TEST_DONE();
1122 
1123 	TEST_START("hostkeys_iterate specify host 2 and IPv4");
1124 	memset(&ctx, 0, sizeof(ctx));
1125 	ctx.expected = expected_full;
1126 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1127 	ctx.flags = 0;
1128 	ctx.match_host_s = 1;
1129 	ctx.match_ipv4 = 1;
1130 	prepare_expected(expected_full, ctx.nexpected);
1131 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1132 	    check, &ctx, "sisyphus.example.com", "192.0.2.1", ctx.flags), 0);
1133 	TEST_DONE();
1134 
1135 	TEST_START("hostkeys_iterate match host 1 and IPv6");
1136 	memset(&ctx, 0, sizeof(ctx));
1137 	ctx.expected = expected_full;
1138 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1139 	ctx.flags = HKF_WANT_MATCH;
1140 	ctx.match_host_p = 1;
1141 	ctx.match_ipv6 = 1;
1142 	prepare_expected(expected_full, ctx.nexpected);
1143 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1144 	    check, &ctx, "prometheus.example.com", "2001:db8::1", ctx.flags), 0);
1145 	TEST_DONE();
1146 
1147 	TEST_START("hostkeys_iterate specify host 2 and IPv4 w/ key parse");
1148 	memset(&ctx, 0, sizeof(ctx));
1149 	ctx.expected = expected_full;
1150 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1151 	ctx.flags = HKF_WANT_PARSE_KEY;
1152 	ctx.match_host_s = 1;
1153 	ctx.match_ipv4 = 1;
1154 	prepare_expected(expected_full, ctx.nexpected);
1155 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1156 	    check, &ctx, "sisyphus.example.com", "192.0.2.1", ctx.flags), 0);
1157 	TEST_DONE();
1158 
1159 	TEST_START("hostkeys_iterate match host 1 and IPv6 w/ key parse");
1160 	memset(&ctx, 0, sizeof(ctx));
1161 	ctx.expected = expected_full;
1162 	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
1163 	ctx.flags = HKF_WANT_MATCH|HKF_WANT_PARSE_KEY;
1164 	ctx.match_host_p = 1;
1165 	ctx.match_ipv6 = 1;
1166 	prepare_expected(expected_full, ctx.nexpected);
1167 	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
1168 	    check, &ctx, "prometheus.example.com", "2001:db8::1", ctx.flags), 0);
1169 	TEST_DONE();
1170 }
1171 
1172