diff options
| -rw-r--r-- | regress/sbin/iked/live/Makefile | 53 | ||||
| -rw-r--r-- | regress/sbin/iked/live/crt.in | 5 |
2 files changed, 55 insertions, 3 deletions
diff --git a/regress/sbin/iked/live/Makefile b/regress/sbin/iked/live/Makefile index 69ad27a2709..00810d1427f 100644 --- a/regress/sbin/iked/live/Makefile +++ b/regress/sbin/iked/live/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.33 2021/12/07 17:26:14 tobhe Exp $ +# $OpenBSD: Makefile,v 1.34 2021/12/21 13:50:35 tobhe Exp $ # Copyright (c) 2020 Tobias Heider <tobhe@openbsd.org> # @@ -114,6 +114,9 @@ SETUP_CONFIG = \ if [ "$$singleikesa" = true ]; then \ global="$${global}set enforcesingleikesa\n"; \ fi; \ + if [ "$$intermediate" = true ]; then \ + global="$${global}set cert_partial_chain\n"; \ + fi; \ confstr=""; \ if [ -n "$$config_address" ]; then \ if [ "$$side" = left ]; then \ @@ -192,6 +195,16 @@ SETUP_CERT = \ -req -in $$name-from-$$caname.csr -CA $$caname.crt -CAkey $$caname.key \ -CAcreateserial -out $$name-from-$$caname.crt +SETUP_INTERMEDIATE = \ + echo "ALTNAME = $$name-from-$$caname" > $$name-from-$$caname.cnf; \ + cat ${.CURDIR}/crt.in >> $$name-from-$$caname.cnf; \ + openssl genrsa -out $$name-from-$$caname.key 2048; \ + openssl req -config $$name-from-$$caname.cnf -new -key $$name-from-$$caname.key -nodes \ + -out $$name-from-$$caname.csr; \ + openssl x509 -extfile $$name-from-$$caname.cnf -extensions v3_intermediate_ca \ + -req -in $$name-from-$$caname.csr -CA $$caname.crt -CAkey $$caname.key \ + -CAcreateserial -out $$name-from-$$caname.crt + SETUP_CA = \ openssl genrsa -out $$caname.key 2048; \ openssl req -subj "/C=DE/ST=Bavaria/L=Munich/O=iked/CN=$$caname" \ @@ -209,21 +222,27 @@ cleanup: setup_certs: ca-both.crt left-from-ca-both.crt left.key right-from-ca-both.crt \ right.key ca-left.crt right-from-ca-left.crt ca-right.crt left-from-ca-right.crt \ - ca-none.crt left-from-ca-none.crt right-from-ca-none.crt + ca-none.crt left-from-ca-none.crt right-from-ca-none.crt \ + intermediate-from-ca-none.crt left-from-intermediate-from-ca-none.crt \ + right-from-intermediate-from-ca-none.crt echo "cd /etc/iked\n \ put left-from-ca-both.crt certs\n \ put left-from-ca-right.crt certs\n \ put left-from-ca-none.crt certs\n \ + put left-from-intermediate-from-ca-none.crt certs\n \ put right-from-ca-none.crt certs\n \ put left.key private/local.key\n \ + put intermediate-from-ca-none.crt ca\n \ put ca-left.crt ca\n \ put ca-both.crt ca\n" | sftp ${LEFT_SSH} -q; \ echo "cd /etc/iked\n \ put right-from-ca-both.crt certs\n \ put right-from-ca-left.crt certs\n \ put right-from-ca-none.crt certs\n \ + put right-from-intermediate-from-ca-none.crt certs\n \ put left-from-ca-none.crt certs\n \ put right.key private/local.key\n \ + put intermediate-from-ca-none.crt ca\n \ put ca-right.crt ca\n \ put ca-both.crt ca\n" | sftp ${RIGHT_SSH} -q; \ ssh ${LEFT_SSH} "openssl rsa -in /etc/iked/private/local.key -pubout > /etc/iked/local.pub"; \ @@ -275,6 +294,17 @@ left-from-ca-none.crt left.key: ca-none.crt ca-none.key right-from-ca-none.crt right.key: ca-none.crt ca-none.key caname=ca-none; name=right; ${SETUP_CERT} +intermediate-from-ca-none.crt intermediate-from-ca-none.key: + caname=ca-none name=intermediate; ${SETUP_INTERMEDIATE} + +left-from-intermediate-from-ca-none.crt left.key: \ + intermediate-from-ca-none.crt intermediate-from-ca-none.key + caname=intermediate-from-ca-none; name=left; ${SETUP_CERT} + +right-from-intermediate-from-ca-none.crt right.key: \ + intermediate-from-ca-none.crt intermediate-from-ca-none.key + caname=intermediate-from-ca-none; name=right; ${SETUP_CERT} + REGRESS_TARGETS = run-ping-fail run-ping-fail: ssh ${LEFT_SSH} "ipsecctl -F; pkill iked || true" @@ -488,6 +518,25 @@ run-psk: ${TEST_PING}; \ if [[ $$_ret -ne 0 ]]; then exit 1; fi +REGRESS_TARGETS += run-intermediate-fail +run-intermediate-fail: + leftid=left-from-intermediate-from-ca-none; \ + rightid=right-from-intermediate-from-ca-none; \ + ${SETUP_CONFIGS} + ${SETUP_START} + flowtype=esp; ${TEST_FLOWS}; if [[ $$_ret -ne 1 ]]; then exit 1; fi + ${TEST_PING}; if [[ $$_ret -ne 1 ]]; then exit 1; fi + +REGRESS_TARGETS += run-intermediate +run-intermediate: + intermediate=true; \ + leftid=left-from-intermediate-from-ca-none; \ + rightid=right-from-intermediate-from-ca-none; \ + ${SETUP_CONFIGS} + ${SETUP_START} + if [[ $$_ret -ne 0 ]]; then exit 1; fi + ${TEST_PING}; if [[ $$_ret -ne 0 ]]; then exit 1; fi + REGRESS_TARGETS += run-fragmentation run-fragmentation: flowtype=esp; \ diff --git a/regress/sbin/iked/live/crt.in b/regress/sbin/iked/live/crt.in index 4bc5381451d..1d564e5f006 100644 --- a/regress/sbin/iked/live/crt.in +++ b/regress/sbin/iked/live/crt.in @@ -1,4 +1,4 @@ -# $OpenBSD: crt.in,v 1.2 2020/01/15 22:47:24 tobhe Exp $ +# $OpenBSD: crt.in,v 1.3 2021/12/21 13:50:35 tobhe Exp $ [ req ] default_bits = 2048 # default strength of client certificates @@ -19,6 +19,9 @@ CN=${ENV::ALTNAME} [ req_cert_extensions ] subjectAltName = @alt_names #;otherName = ${ENV::ALTNAME}-other +[ v3_intermediate_ca ] +basicConstraints = critical, CA:true, pathlen:0 + [ alt_names ] DNS.1=${ENV::ALTNAME} DNS.2=${ENV::ALTNAME}-alternative |