1262566Sdes# $OpenBSD: krl.sh,v 1.2 2013/11/21 03:15:46 djm Exp $ 2248613Sdes# Placed in the Public Domain. 3248613Sdes 4248613Sdestid="key revocation lists" 5248613Sdes 6248613Sdes# If we don't support ecdsa keys then this tell will be much slower. 7248613SdesECDSA=ecdsa 8248613Sdesif test "x$TEST_SSH_ECC" != "xyes"; then 9248613Sdes ECDSA=rsa 10248613Sdesfi 11248613Sdes 12248613Sdes# Do most testing with ssh-keygen; it uses the same verification code as sshd. 13248613Sdes 14248613Sdes# Old keys will interfere with ssh-keygen. 15248613Sdesrm -f $OBJ/revoked-* $OBJ/krl-* 16248613Sdes 17248613Sdes# Generate a CA key 18248613Sdes$SSHKEYGEN -t $ECDSA -f $OBJ/revoked-ca -C "" -N "" > /dev/null || 19248613Sdes fatal "$SSHKEYGEN CA failed" 20248613Sdes 21248613Sdes# A specification that revokes some certificates by serial numbers 22248613Sdes# The serial pattern is chosen to ensure the KRL includes list, range and 23248613Sdes# bitmap sections. 24248613Sdescat << EOF >> $OBJ/revoked-serials 25248613Sdesserial: 1-4 26248613Sdesserial: 10 27248613Sdesserial: 15 28248613Sdesserial: 30 29248613Sdesserial: 50 30248613Sdesserial: 999 31248613Sdes# The following sum to 500-799 32248613Sdesserial: 500 33248613Sdesserial: 501 34248613Sdesserial: 502 35248613Sdesserial: 503-600 36248613Sdesserial: 700-797 37248613Sdesserial: 798 38248613Sdesserial: 799 39248613Sdesserial: 599-701 40248613SdesEOF 41248613Sdes 42248613Sdes# A specification that revokes some certificated by key ID. 43248613Sdestouch $OBJ/revoked-keyid 44248613Sdesfor n in 1 2 3 4 10 15 30 50 `jot 500 300` 999 1000 1001 1002; do 45248613Sdes # Fill in by-ID revocation spec. 46248613Sdes echo "id: revoked $n" >> $OBJ/revoked-keyid 47248613Sdesdone 48248613Sdes 49248613Sdeskeygen() { 50248613Sdes N=$1 51248613Sdes f=$OBJ/revoked-`printf "%04d" $N` 52248613Sdes # Vary the keytype. We use mostly ECDSA since this is fastest by far. 53248613Sdes keytype=$ECDSA 54248613Sdes case $N in 55248613Sdes 2 | 10 | 510 | 1001) keytype=rsa;; 56248613Sdes 4 | 30 | 520 | 1002) keytype=dsa;; 57248613Sdes esac 58248613Sdes $SSHKEYGEN -t $keytype -f $f -C "" -N "" > /dev/null \ 59248613Sdes || fatal "$SSHKEYGEN failed" 60248613Sdes # Sign cert 61248613Sdes $SSHKEYGEN -s $OBJ/revoked-ca -z $n -I "revoked $N" $f >/dev/null 2>&1 \ 62248613Sdes || fatal "$SSHKEYGEN sign failed" 63248613Sdes echo $f 64248613Sdes} 65248613Sdes 66248613Sdes# Generate some keys. 67248613Sdesverbose "$tid: generating test keys" 68248613SdesREVOKED_SERIALS="1 4 10 50 500 510 520 799 999" 69248613Sdesfor n in $REVOKED_SERIALS ; do 70248613Sdes f=`keygen $n` 71248613Sdes REVOKED_KEYS="$REVOKED_KEYS ${f}.pub" 72248613Sdes REVOKED_CERTS="$REVOKED_CERTS ${f}-cert.pub" 73248613Sdesdone 74248613SdesNOTREVOKED_SERIALS="5 9 14 16 29 30 49 51 499 800 1000 1001" 75248613SdesNOTREVOKED="" 76248613Sdesfor n in $NOTREVOKED_SERIALS ; do 77248613Sdes NOTREVOKED_KEYS="$NOTREVOKED_KEYS ${f}.pub" 78248613Sdes NOTREVOKED_CERTS="$NOTREVOKED_CERTS ${f}-cert.pub" 79248613Sdesdone 80248613Sdes 81248613Sdesgenkrls() { 82248613Sdes OPTS=$1 83248613Sdes$SSHKEYGEN $OPTS -kf $OBJ/krl-empty - </dev/null \ 84248613Sdes >/dev/null || fatal "$SSHKEYGEN KRL failed" 85248613Sdes$SSHKEYGEN $OPTS -kf $OBJ/krl-keys $REVOKED_KEYS \ 86248613Sdes >/dev/null || fatal "$SSHKEYGEN KRL failed" 87248613Sdes$SSHKEYGEN $OPTS -kf $OBJ/krl-cert $REVOKED_CERTS \ 88248613Sdes >/dev/null || fatal "$SSHKEYGEN KRL failed" 89248613Sdes$SSHKEYGEN $OPTS -kf $OBJ/krl-all $REVOKED_KEYS $REVOKED_CERTS \ 90248613Sdes >/dev/null || fatal "$SSHKEYGEN KRL failed" 91248613Sdes$SSHKEYGEN $OPTS -kf $OBJ/krl-ca $OBJ/revoked-ca.pub \ 92248613Sdes >/dev/null || fatal "$SSHKEYGEN KRL failed" 93248613Sdes# KRLs from serial/key-id spec need the CA specified. 94248613Sdes$SSHKEYGEN $OPTS -kf $OBJ/krl-serial $OBJ/revoked-serials \ 95248613Sdes >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly" 96248613Sdes$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid $OBJ/revoked-keyid \ 97248613Sdes >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly" 98248613Sdes$SSHKEYGEN $OPTS -kf $OBJ/krl-serial -s $OBJ/revoked-ca $OBJ/revoked-serials \ 99248613Sdes >/dev/null || fatal "$SSHKEYGEN KRL failed" 100248613Sdes$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid -s $OBJ/revoked-ca.pub $OBJ/revoked-keyid \ 101248613Sdes >/dev/null || fatal "$SSHKEYGEN KRL failed" 102248613Sdes} 103248613Sdes 104262566Sdes## XXX dump with trace and grep for set cert serials 105262566Sdes## XXX test ranges near (u64)-1, etc. 106262566Sdes 107248613Sdesverbose "$tid: generating KRLs" 108248613Sdesgenkrls 109248613Sdes 110248613Sdescheck_krl() { 111248613Sdes KEY=$1 112248613Sdes KRL=$2 113248613Sdes EXPECT_REVOKED=$3 114248613Sdes TAG=$4 115248613Sdes $SSHKEYGEN -Qf $KRL $KEY >/dev/null 116248613Sdes result=$? 117248613Sdes if test "x$EXPECT_REVOKED" = "xyes" -a $result -eq 0 ; then 118248613Sdes fatal "key $KEY not revoked by KRL $KRL: $TAG" 119248613Sdes elif test "x$EXPECT_REVOKED" = "xno" -a $result -ne 0 ; then 120248613Sdes fatal "key $KEY unexpectedly revoked by KRL $KRL: $TAG" 121248613Sdes fi 122248613Sdes} 123248613Sdestest_all() { 124248613Sdes FILES=$1 125248613Sdes TAG=$2 126248613Sdes KEYS_RESULT=$3 127248613Sdes ALL_RESULT=$4 128248613Sdes SERIAL_RESULT=$5 129248613Sdes KEYID_RESULT=$6 130248613Sdes CERTS_RESULT=$7 131248613Sdes CA_RESULT=$8 132248613Sdes verbose "$tid: checking revocations for $TAG" 133248613Sdes for f in $FILES ; do 134248613Sdes check_krl $f $OBJ/krl-empty no "$TAG" 135248613Sdes check_krl $f $OBJ/krl-keys $KEYS_RESULT "$TAG" 136248613Sdes check_krl $f $OBJ/krl-all $ALL_RESULT "$TAG" 137248613Sdes check_krl $f $OBJ/krl-serial $SERIAL_RESULT "$TAG" 138248613Sdes check_krl $f $OBJ/krl-keyid $KEYID_RESULT "$TAG" 139248613Sdes check_krl $f $OBJ/krl-cert $CERTS_RESULT "$TAG" 140248613Sdes check_krl $f $OBJ/krl-ca $CA_RESULT "$TAG" 141248613Sdes done 142248613Sdes} 143248613Sdes# keys all serial keyid certs CA 144248613Sdestest_all "$REVOKED_KEYS" "revoked keys" yes yes no no no no 145248613Sdestest_all "$UNREVOKED_KEYS" "unrevoked keys" no no no no no no 146248613Sdestest_all "$REVOKED_CERTS" "revoked certs" yes yes yes yes yes yes 147248613Sdestest_all "$UNREVOKED_CERTS" "unrevoked certs" no no no no no yes 148248613Sdes 149248613Sdes# Check update. Results should be identical. 150248613Sdesverbose "$tid: testing KRL update" 151248613Sdesfor f in $OBJ/krl-keys $OBJ/krl-cert $OBJ/krl-all \ 152248613Sdes $OBJ/krl-ca $OBJ/krl-serial $OBJ/krl-keyid ; do 153248613Sdes cp -f $OBJ/krl-empty $f 154248613Sdes genkrls -u 155248613Sdesdone 156248613Sdes# keys all serial keyid certs CA 157248613Sdestest_all "$REVOKED_KEYS" "revoked keys" yes yes no no no no 158248613Sdestest_all "$UNREVOKED_KEYS" "unrevoked keys" no no no no no no 159248613Sdestest_all "$REVOKED_CERTS" "revoked certs" yes yes yes yes yes yes 160248613Sdestest_all "$UNREVOKED_CERTS" "unrevoked certs" no no no no no yes 161