Skip to content

Commit 2f512f8

Browse files
djmdjmdjmdjm
committed
upstream: regress test for constrained PKCS#11 keys
OpenBSD-Regress-ID: b2f26ae95d609d12257b43aef7cd7714c82618ff
1 parent cdddd66 commit 2f512f8

File tree

2 files changed

+196
-2
lines changed

2 files changed

+196
-2
lines changed

‎regress/Makefile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# $OpenBSD: Makefile,v 1.129 2023/10/26 18:52:45 anton Exp $
1+
# $OpenBSD: Makefile,v 1.130 2023/12/18 14:49:39 djm Exp $
22

33
tests: prep file-tests t-exec unit
44

@@ -107,7 +107,8 @@ LTESTS= connect \
107107
hostbased \
108108
channel-timeout \
109109
connection-timeout \
110-
match-subsystem
110+
match-subsystem \
111+
agent-pkcs11-restrict
111112

112113
INTEROP_TESTS= putty-transfer putty-ciphers putty-kex conch-ciphers
113114
INTEROP_TESTS+= dropbear-ciphers dropbear-kex

‎regress/agent-pkcs11-restrict.sh‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
# $OpenBSD: agent-pkcs11-restrict.sh,v 1.1 2023/12/18 14:49:39 djm Exp $
2+
# Placed in the Public Domain.
3+
4+
tid="pkcs11 agent constraint test"
5+
6+
p11_setup || skip "No PKCS#11 library found"
7+
8+
rm -f $SSH_AUTH_SOCK $OBJ/agent.log $OBJ/host_[abcx]* $OBJ/user_[abcx]*
9+
rm -f $OBJ/sshd_proxy_host* $OBJ/ssh_output* $OBJ/expect_*
10+
rm -f $OBJ/ssh_proxy[._]* $OBJ/command $OBJ/authorized_keys_*
11+
12+
trace "generate host keys"
13+
for h in a b x ca ; do
14+
$SSHKEYGEN -q -t ed25519 -C host_$h -N '' -f $OBJ/host_$h || \
15+
fatal "ssh-keygen hostkey failed"
16+
done
17+
18+
# XXX test CA hostcerts too.
19+
20+
key_for() {
21+
case $h in
22+
a) K="${SSH_SOFTHSM_DIR}/RSA.pub" ;;
23+
b) K="${SSH_SOFTHSM_DIR}/EC.pub" ;;
24+
*) K="" ;;
25+
esac
26+
export K
27+
}
28+
29+
SSH_AUTH_SOCK="$OBJ/agent.sock"
30+
export SSH_AUTH_SOCK
31+
rm -f $SSH_AUTH_SOCK
32+
trace "start agent"
33+
${SSHAGENT} ${EXTRA_AGENT_ARGS} -d -a $SSH_AUTH_SOCK > $OBJ/agent.log 2>&1 &
34+
AGENT_PID=$!
35+
trap "kill $AGENT_PID" EXIT
36+
for x in 0 1 2 3 4 ; do
37+
# Give it a chance to start
38+
${SSHADD} -l > /dev/null 2>&1
39+
r=$?
40+
test $r -eq 1 && break
41+
sleep 1
42+
done
43+
if [ $r -ne 1 ]; then
44+
fatal "ssh-add -l did not fail with exit code 1 (got $r)"
45+
fi
46+
47+
# XXX a lot of this is a copy of agent-restrict.sh, but I couldn't see a nice
48+
# way to factor it out -djm
49+
50+
trace "prepare client config"
51+
egrep -vi '(identityfile|hostname|hostkeyalias|proxycommand)' \
52+
$OBJ/ssh_proxy > $OBJ/ssh_proxy.bak
53+
cat << _EOF > $OBJ/ssh_proxy
54+
IdentitiesOnly yes
55+
ForwardAgent yes
56+
ExitOnForwardFailure yes
57+
_EOF
58+
cp $OBJ/ssh_proxy $OBJ/ssh_proxy_noid
59+
for h in a b ; do
60+
key_for $h
61+
cat << _EOF >> $OBJ/ssh_proxy
62+
Host host_$h
63+
Hostname host_$h
64+
HostkeyAlias host_$h
65+
IdentityFile $K
66+
ProxyCommand ${SUDO} env SSH_SK_HELPER=\"$SSH_SK_HELPER\" ${OBJ}/sshd-log-wrapper.sh -i -f $OBJ/sshd_proxy_host_$h
67+
_EOF
68+
# Variant with no specified keys.
69+
cat << _EOF >> $OBJ/ssh_proxy_noid
70+
Host host_$h
71+
Hostname host_$h
72+
HostkeyAlias host_$h
73+
ProxyCommand ${SUDO} env SSH_SK_HELPER=\"$SSH_SK_HELPER\" ${OBJ}/sshd-log-wrapper.sh -i -f $OBJ/sshd_proxy_host_$h
74+
_EOF
75+
done
76+
cat $OBJ/ssh_proxy.bak >> $OBJ/ssh_proxy
77+
cat $OBJ/ssh_proxy.bak >> $OBJ/ssh_proxy_noid
78+
79+
LC_ALL=C
80+
export LC_ALL
81+
echo "SetEnv LC_ALL=${LC_ALL}" >> sshd_proxy
82+
83+
trace "prepare known_hosts"
84+
rm -f $OBJ/known_hosts
85+
for h in a b x ; do
86+
(printf "host_$h " ; cat $OBJ/host_${h}.pub) >> $OBJ/known_hosts
87+
done
88+
89+
trace "prepare server configs"
90+
egrep -vi '(hostkey|pidfile)' $OBJ/sshd_proxy \
91+
> $OBJ/sshd_proxy.bak
92+
for h in a b ; do
93+
cp $OBJ/sshd_proxy.bak $OBJ/sshd_proxy_host_$h
94+
cat << _EOF >> $OBJ/sshd_proxy_host_$h
95+
ExposeAuthInfo yes
96+
Hostkey $OBJ/host_$h
97+
_EOF
98+
cp $OBJ/sshd_proxy_host_$h $OBJ/sshd_proxy_host_${h}.bak
99+
done
100+
101+
trace "prepare authorized_keys"
102+
cat >> $OBJ/command << EOF
103+
#!/bin/sh
104+
echo USERAUTH
105+
cat \$SSH_USER_AUTH
106+
echo AGENT
107+
if $SSHADD -ql >/dev/null 2>&1 ; then
108+
$SSHADD -L | cut -d' ' -f1-2 | sort
109+
else
110+
echo NONE
111+
fi
112+
EOF
113+
chmod a+x $OBJ/command
114+
>$OBJ/authorized_keys_$USER
115+
for h in a b ; do
116+
key_for $h
117+
(printf "%s" "restrict,agent-forwarding,command=\"$OBJ/command\" ";
118+
cat $K) >> $OBJ/authorized_keys_$USER
119+
done
120+
121+
trace "unrestricted keys"
122+
$SSHADD -qD >/dev/null || fatal "clear agent failed"
123+
p11_ssh_add -qs ${TEST_SSH_PKCS11} ||
124+
fatal "failed to add keys"
125+
for h in a b ; do
126+
key_for $h
127+
echo USERAUTH > $OBJ/expect_$h
128+
printf "publickey " >> $OBJ/expect_$h
129+
cat $K >> $OBJ/expect_$h
130+
echo AGENT >> $OBJ/expect_$h
131+
$SSHADD -L | cut -d' ' -f1-2 | sort >> $OBJ/expect_$h
132+
${SSH} -F $OBJ/ssh_proxy -oIdentityFile=$K \
133+
host_$h true > $OBJ/ssh_output || fatal "test ssh $h failed"
134+
cmp $OBJ/expect_$h $OBJ/ssh_output || fatal "unexpected output"
135+
done
136+
137+
trace "restricted to different host"
138+
$SSHADD -qD >/dev/null || fatal "clear agent failed"
139+
p11_ssh_add -q -h host_x -s ${TEST_SSH_PKCS11} -H $OBJ/known_hosts ||
140+
fatal "failed to add keys"
141+
for h in a b ; do
142+
key_for $h
143+
${SSH} -F $OBJ/ssh_proxy -oIdentityFile=$K \
144+
host_$h true > $OBJ/ssh_output && fatal "test ssh $h succeeded"
145+
done
146+
147+
trace "restricted to destination host"
148+
$SSHADD -qD >/dev/null || fatal "clear agent failed"
149+
p11_ssh_add -q -h host_a -h host_b -s ${TEST_SSH_PKCS11} -H $OBJ/known_hosts ||
150+
fatal "failed to add keys"
151+
for h in a b ; do
152+
key_for $h
153+
echo USERAUTH > $OBJ/expect_$h
154+
printf "publickey " >> $OBJ/expect_$h
155+
cat $K >> $OBJ/expect_$h
156+
echo AGENT >> $OBJ/expect_$h
157+
echo NONE >> $OBJ/expect_$h
158+
${SSH} -F $OBJ/ssh_proxy -oIdentityFile=$K \
159+
host_$h true > $OBJ/ssh_output || fatal "test ssh $h failed"
160+
cmp $OBJ/expect_$h $OBJ/ssh_output || fatal "unexpected output"
161+
done
162+
163+
trace "restricted multihop"
164+
$SSHADD -qD >/dev/null || fatal "clear agent failed"
165+
p11_ssh_add -q -h host_a -h "host_a>host_b" \
166+
-s ${TEST_SSH_PKCS11} -H $OBJ/known_hosts || fatal "failed to add keys"
167+
key_for a
168+
AK=$K
169+
key_for b
170+
BK=$K
171+
# Prepare authorized_keys file to additionally ssh to host_b
172+
_command="echo LOCAL ; ${OBJ}/command ; echo REMOTE; ${SSH} -AF $OBJ/ssh_proxy -oIdentityFile=$BK host_b"
173+
(printf "%s" "restrict,agent-forwarding,command=\"$_command\" ";
174+
cat $BK) > $OBJ/authorized_keys_a
175+
grep -vi AuthorizedKeysFile $OBJ/sshd_proxy_host_a.bak > $OBJ/sshd_proxy_host_a
176+
echo "AuthorizedKeysFile $OBJ/authorized_keys_a" >> $OBJ/sshd_proxy_host_a
177+
# Prepare expected output from both hosts.
178+
echo LOCAL > $OBJ/expect_a
179+
echo USERAUTH >> $OBJ/expect_a
180+
printf "publickey " >> $OBJ/expect_a
181+
cat $AK >> $OBJ/expect_a
182+
echo AGENT >> $OBJ/expect_a
183+
$SSHADD -L | cut -d' ' -f1-2 | sort >> $OBJ/expect_a
184+
echo REMOTE >> $OBJ/expect_a
185+
echo USERAUTH >> $OBJ/expect_a
186+
printf "publickey " >> $OBJ/expect_a
187+
cat $BK >> $OBJ/expect_a
188+
echo AGENT >> $OBJ/expect_a
189+
echo NONE >> $OBJ/expect_a
190+
${SSH} -AF $OBJ/ssh_proxy -oIdentityFile=$AK \
191+
host_a whatever > $OBJ/ssh_output || fatal "test ssh $h failed"
192+
cmp $OBJ/expect_a $OBJ/ssh_output || fatal "unexpected output"
193+

0 commit comments

Comments
 (0)