Adding upstream version 1:9.6p1.upstream/1%9.6p1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 217 insertions, 0 deletions

diff --git a/regress/krl.sh b/regress/krl.sh
new file mode 100644
index 0000000..d560d61
--- /dev/null
+++ b/regress/krl.sh
@@ -0,0 +1,217 @@
+#	$OpenBSD: krl.sh,v 1.12 2023/01/16 04:11:29 djm Exp $
+#	Placed in the Public Domain.
+
+tid="key revocation lists"
+
+# Use ed25519 by default since it's fast and it's supported when building
+# w/out OpenSSL.  Populate ktype[2-4] with the other types if supported.
+ktype1=ed25519; ktype2=ed25519; ktype3=ed25519;
+ktype4=ed25519; ktype5=ed25519; ktype6=ed25519;
+for t in $SSH_KEYTYPES; do
+	case "$t" in
+		ecdsa*)		ktype2=ecdsa ;;
+		ssh-rsa)	ktype3=rsa ;;
+		ssh-dss)	ktype4=dsa ;;
+		sk-ssh-ed25519@openssh.com)		ktype5=ed25519-sk ;;
+		sk-ecdsa-sha2-nistp256@openssh.com)	ktype6=ecdsa-sk ;;
+	esac
+done
+
+# Do most testing with ssh-keygen; it uses the same verification code as sshd.
+
+# Old keys will interfere with ssh-keygen.
+rm -f $OBJ/revoked-* $OBJ/krl-*
+
+# Generate a CA key
+$SSHKEYGEN -t $ktype1 -f $OBJ/revoked-ca  -C "" -N "" > /dev/null ||
+	fatal "$SSHKEYGEN CA failed"
+$SSHKEYGEN -t $ktype2 -f $OBJ/revoked-ca2  -C "" -N "" > /dev/null ||
+	fatal "$SSHKEYGEN CA2 failed"
+
+# A specification that revokes some certificates by serial numbers
+# The serial pattern is chosen to ensure the KRL includes list, range and
+# bitmap sections.
+cat << EOF >> $OBJ/revoked-serials
+serial: 1-4
+serial: 10
+serial: 15
+serial: 30
+serial: 50
+serial: 90
+serial: 999
+# The following sum to 500-799
+serial: 500
+serial: 501
+serial: 502
+serial: 503-600
+serial: 700-797
+serial: 798
+serial: 799
+serial: 599-701
+# Some multiple consecutive serial number ranges
+serial: 10000-20000
+serial: 30000-40000
+EOF
+
+# A specification that revokes some certificated by key ID.
+touch $OBJ/revoked-keyid
+for n in 1 2 3 4 10 15 30 50 90 `jot 500 300` 999 1000 1001 1002; do
+	test "x$n" = "x499" && continue
+	# Fill in by-ID revocation spec.
+	echo "id: revoked $n" >> $OBJ/revoked-keyid
+done
+
+keygen() {
+	N=$1
+	f=$OBJ/revoked-`printf "%04d" $N`
+	# Vary the keytype. We use mostly ed25519 since this is fast and well
+	# supported.
+	keytype=$ktype1
+	case $N in
+	2  | 10 | 510 | 1001)	keytype=$ktype2 ;;
+	4  | 30 | 520 | 1002)	keytype=$ktype3 ;;
+	8  | 50 | 530 | 1003)	keytype=$ktype4 ;;
+	16 | 70 | 540 | 1004)	keytype=$ktype5 ;;
+	32 | 90 | 550 | 1005)	keytype=$ktype6 ;;
+	esac
+	$SSHKEYGEN -t $keytype -f $f -C "" -N "" > /dev/null \
+		|| fatal "$SSHKEYGEN failed"
+	# Sign cert
+	$SSHKEYGEN -s $OBJ/revoked-ca -z $n -I "revoked $N" $f >/dev/null 2>&1 \
+		|| fatal "$SSHKEYGEN sign failed"
+	echo $f
+}
+
+# Generate some keys.
+verbose "$tid: generating test keys"
+REVOKED_SERIALS="1 4 10 50 90 500 510 520 550 799 999"
+for n in $REVOKED_SERIALS ; do
+	f=`keygen $n`
+	RKEYS="$RKEYS ${f}.pub"
+	RCERTS="$RCERTS ${f}-cert.pub"
+done
+UNREVOKED_SERIALS="5 9 14 16 29 49 51 499 800 1010 1011"
+UNREVOKED=""
+for n in $UNREVOKED_SERIALS ; do
+	f=`keygen $n`
+	UKEYS="$UKEYS ${f}.pub"
+	UCERTS="$UCERTS ${f}-cert.pub"
+done
+
+# Specifications that revoke keys by hash.
+touch $OBJ/revoked-sha1 $OBJ/revoked-sha256 $OBJ/revoked-hash
+for rkey in $RKEYS; do
+	(printf "sha1: "; cat $rkey) >> $OBJ/revoked-sha1
+	(printf "sha256: "; cat $rkey) >> $OBJ/revoked-sha256
+	(printf "hash: "; $SSHKEYGEN -lf $rkey | \
+		awk '{ print $2 }') >> $OBJ/revoked-hash
+done
+
+genkrls() {
+	OPTS=$1
+$SSHKEYGEN $OPTS -kf $OBJ/krl-empty - </dev/null \
+	>/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-keys $RKEYS \
+	>/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-cert $RCERTS \
+	>/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-all $RKEYS $RCERTS \
+	>/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-ca $OBJ/revoked-ca.pub \
+	>/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-sha1 $OBJ/revoked-sha1 \
+	>/dev/null 2>&1 || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-sha256 $OBJ/revoked-sha256 \
+	>/dev/null 2>&1 || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-hash $OBJ/revoked-hash \
+	>/dev/null 2>&1 || fatal "$SSHKEYGEN KRL failed"
+# This should fail as KRLs from serial/key-id spec need the CA specified.
+$SSHKEYGEN $OPTS -kf $OBJ/krl-serial $OBJ/revoked-serials \
+	>/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid $OBJ/revoked-keyid \
+	>/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly"
+# These should succeed; they specify an explicit CA key.
+$SSHKEYGEN $OPTS -kf $OBJ/krl-serial -s $OBJ/revoked-ca \
+	$OBJ/revoked-serials >/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid -s $OBJ/revoked-ca.pub \
+	$OBJ/revoked-keyid >/dev/null || fatal "$SSHKEYGEN KRL failed"
+# These should succeed; they specify an wildcard CA key.
+$SSHKEYGEN $OPTS -kf $OBJ/krl-serial-wild -s NONE $OBJ/revoked-serials \
+	>/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid-wild -s NONE $OBJ/revoked-keyid \
+	>/dev/null || fatal "$SSHKEYGEN KRL failed"
+# Revoke the same serials with the second CA key to ensure a multi-CA
+# KRL is generated.
+$SSHKEYGEN $OPTS -kf $OBJ/krl-serial -u -s $OBJ/revoked-ca2 \
+	$OBJ/revoked-serials >/dev/null || fatal "$SSHKEYGEN KRL failed"
+}
+
+## XXX dump with trace and grep for set cert serials
+## XXX test ranges near (u64)-1, etc.
+
+verbose "$tid: generating KRLs"
+genkrls
+
+check_krl() {
+	KEY=$1
+	KRL=$2
+	EXPECT_REVOKED=$3
+	TAG=$4
+	$SSHKEYGEN -Qf $KRL $KEY >/dev/null
+	result=$?
+	if test "x$EXPECT_REVOKED" = "xy" -a $result -eq 0 ; then
+		fatal "key $KEY not revoked by KRL $KRL: $TAG"
+	elif test "x$EXPECT_REVOKED" = "xn" -a $result -ne 0 ; then
+		fatal "key $KEY unexpectedly revoked by KRL $KRL: $TAG"
+	fi
+}
+test_rev() {
+	FILES=$1
+	TAG=$2
+	KEYS_RESULT=$3
+	ALL_RESULT=$4
+	HASH_RESULT=$5
+	SERIAL_RESULT=$6
+	KEYID_RESULT=$7
+	CERTS_RESULT=$8
+	CA_RESULT=$9
+	SERIAL_WRESULT=${10}
+	KEYID_WRESULT=${11}
+	verbose "$tid: checking revocations for $TAG"
+	for f in $FILES ; do
+		check_krl $f $OBJ/krl-empty		no		"$TAG"
+		check_krl $f $OBJ/krl-keys		$KEYS_RESULT	"$TAG"
+		check_krl $f $OBJ/krl-all		$ALL_RESULT	"$TAG"
+		check_krl $f $OBJ/krl-sha1		$HASH_RESULT	"$TAG"
+		check_krl $f $OBJ/krl-sha256		$HASH_RESULT	"$TAG"
+		check_krl $f $OBJ/krl-hash		$HASH_RESULT	"$TAG"
+		check_krl $f $OBJ/krl-serial		$SERIAL_RESULT	"$TAG"
+		check_krl $f $OBJ/krl-keyid		$KEYID_RESULT	"$TAG"
+		check_krl $f $OBJ/krl-cert		$CERTS_RESULT	"$TAG"
+		check_krl $f $OBJ/krl-ca		$CA_RESULT	"$TAG"
+		check_krl $f $OBJ/krl-serial-wild	$SERIAL_WRESULT	"$TAG"
+		check_krl $f $OBJ/krl-keyid-wild	$KEYID_WRESULT	"$TAG"
+	done
+}
+
+test_all() {
+	#                                                           wildcard
+	#                                 keys all hash sr# ID cert  CA srl ID
+	test_rev "$RKEYS"     "revoked keys" y   y    y   n  n    n   n   n  n
+	test_rev "$UKEYS"   "unrevoked keys" n   n    n   n  n    n   n   n  n
+	test_rev "$RCERTS"   "revoked certs" y   y    y   y  y    y   y   y  y
+	test_rev "$UCERTS" "unrevoked certs" n   n    n   n  n    n   y   n  n
+}
+
+test_all
+
+# Check update. Results should be identical.
+verbose "$tid: testing KRL update"
+for f in $OBJ/krl-keys $OBJ/krl-cert $OBJ/krl-all \
+    $OBJ/krl-ca $OBJ/krl-serial $OBJ/krl-keyid \
+    $OBJ/krl-serial-wild $OBJ/krl-keyid-wild; do
+	cp -f $OBJ/krl-empty $f
+	genkrls -u
+done
+
+test_all