1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
|
# $OpenBSD: keygen-knownhosts.sh,v 1.4 2018/06/01 03:52:37 djm Exp $
# Placed in the Public Domain.
tid="ssh-keygen known_hosts"
rm -f $OBJ/kh.*
# Generate some keys for testing (just ed25519 for speed) and make a hosts file.
for x in host-a host-b host-c host-d host-e host-f host-a2 host-b2; do
${SSHKEYGEN} -qt ed25519 -f $OBJ/kh.$x -C "$x" -N "" || \
fatal "ssh-keygen failed"
# Add a comment that we expect should be preserved.
echo "# $x" >> $OBJ/kh.hosts
(
case "$x" in
host-a|host-b) printf "$x " ;;
host-c) printf "@cert-authority $x " ;;
host-d) printf "@revoked $x " ;;
host-e) printf "host-e* " ;;
host-f) printf "host-f,host-g,host-h " ;;
host-a2) printf "host-a " ;;
host-b2) printf "host-b " ;;
esac
cat $OBJ/kh.${x}.pub
# Blank line should be preserved.
echo "" >> $OBJ/kh.hosts
) >> $OBJ/kh.hosts
done
# Generate a variant with an invalid line. We'll use this for most tests,
# because keygen should be able to cope and it should be preserved in any
# output file.
cat $OBJ/kh.hosts >> $OBJ/kh.invalid
echo "host-i " >> $OBJ/kh.invalid
cp $OBJ/kh.invalid $OBJ/kh.invalid.orig
cp $OBJ/kh.hosts $OBJ/kh.hosts.orig
expect_key() {
_host=$1
_hosts=$2
_key=$3
_line=$4
_mark=$5
_marker=""
test "x$_mark" = "xCA" && _marker="@cert-authority "
test "x$_mark" = "xREVOKED" && _marker="@revoked "
test "x$_line" != "x" &&
echo "# Host $_host found: line $_line $_mark" >> $OBJ/kh.expect
printf "${_marker}$_hosts " >> $OBJ/kh.expect
cat $OBJ/kh.${_key}.pub >> $OBJ/kh.expect ||
fatal "${_key}.pub missing"
}
check_find() {
_host=$1
_name=$2
shift; shift
${SSHKEYGEN} "$@" -f $OBJ/kh.invalid -F $_host > $OBJ/kh.result
if ! diff -w $OBJ/kh.expect $OBJ/kh.result ; then
fail "didn't find $_name"
fi
}
check_find_exit_code() {
_host=$1
_name=$2
_keygenopt=$3
_exp_exit_code=$4
${SSHKEYGEN} $_keygenopt -f $OBJ/kh.invalid -F $_host > /dev/null
if [ "$?" != "$_exp_exit_code" ] ; then
fail "Unexpected exit code $_name"
fi
}
# Find key
rm -f $OBJ/kh.expect
expect_key host-a host-a host-a 2
expect_key host-a host-a host-a2 20
check_find host-a "simple find"
# find CA key
rm -f $OBJ/kh.expect
expect_key host-c host-c host-c 8 CA
check_find host-c "find CA key"
# find revoked key
rm -f $OBJ/kh.expect
expect_key host-d host-d host-d 11 REVOKED
check_find host-d "find revoked key"
# find key with wildcard
rm -f $OBJ/kh.expect
expect_key host-e.somedomain "host-e*" host-e 14
check_find host-e.somedomain "find wildcard key"
# find key among multiple hosts
rm -f $OBJ/kh.expect
expect_key host-h "host-f,host-g,host-h " host-f 17
check_find host-h "find multiple hosts"
# Check exit code, known host
check_find_exit_code host-a "known host" "-q" "0"
# Check exit code, unknown host
check_find_exit_code host-aa "unknown host" "-q" "1"
# Check exit code, the hash mode, known host
check_find_exit_code host-a "known host" "-q -H" "0"
# Check exit code, the hash mode, unknown host
check_find_exit_code host-aa "unknown host" "-q -H" "1"
check_hashed_find() {
_host=$1
_name=$2
_file=$3
test "x$_file" = "x" && _file=$OBJ/kh.invalid
${SSHKEYGEN} -f $_file -HF $_host | grep '|1|' | \
sed "s/^[^ ]*/$_host/" > $OBJ/kh.result
if ! diff -w $OBJ/kh.expect $OBJ/kh.result ; then
fail "didn't find $_name"
fi
}
# Find key and hash
rm -f $OBJ/kh.expect
expect_key host-a host-a host-a
expect_key host-a host-a host-a2
check_hashed_find host-a "find simple and hash"
# Find CA key and hash
rm -f $OBJ/kh.expect
expect_key host-c host-c host-c "" CA
# CA key output is not hashed.
check_find host-c "find simple and hash" -Hq
# Find revoked key and hash
rm -f $OBJ/kh.expect
expect_key host-d host-d host-d "" REVOKED
# Revoked key output is not hashed.
check_find host-d "find simple and hash" -Hq
# find key with wildcard and hash
rm -f $OBJ/kh.expect
expect_key host-e "host-e*" host-e ""
# Key with wildcard hostname should not be hashed.
check_find host-e "find wildcard key" -Hq
# find key among multiple hosts
rm -f $OBJ/kh.expect
# Comma-separated hostnames should be expanded and hashed.
expect_key host-f "host-h " host-f
expect_key host-g "host-h " host-f
expect_key host-h "host-h " host-f
check_hashed_find host-h "find multiple hosts"
# Attempt remove key on invalid file.
cp $OBJ/kh.invalid.orig $OBJ/kh.invalid
${SSHKEYGEN} -qf $OBJ/kh.invalid -R host-a 2>/dev/null
diff $OBJ/kh.invalid $OBJ/kh.invalid.orig || fail "remove on invalid succeeded"
# Remove key
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-a 2>/dev/null
grep -v "^host-a " $OBJ/kh.hosts.orig > $OBJ/kh.expect
diff $OBJ/kh.hosts $OBJ/kh.expect || fail "remove simple"
# Remove CA key
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-c 2>/dev/null
# CA key should not be removed.
diff $OBJ/kh.hosts $OBJ/kh.hosts.orig || fail "remove CA"
# Remove revoked key
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-d 2>/dev/null
# revoked key should not be removed.
diff $OBJ/kh.hosts $OBJ/kh.hosts.orig || fail "remove revoked"
# Remove wildcard
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-e.blahblah 2>/dev/null
grep -v "^host-e[*] " $OBJ/kh.hosts.orig > $OBJ/kh.expect
diff $OBJ/kh.hosts $OBJ/kh.expect || fail "remove wildcard"
# Remove multiple
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -R host-h 2>/dev/null
grep -v "^host-f," $OBJ/kh.hosts.orig > $OBJ/kh.expect
diff $OBJ/kh.hosts $OBJ/kh.expect || fail "remove wildcard"
# Attempt hash on invalid file
cp $OBJ/kh.invalid.orig $OBJ/kh.invalid
${SSHKEYGEN} -qf $OBJ/kh.invalid -H 2>/dev/null && fail "hash invalid succeeded"
diff $OBJ/kh.invalid $OBJ/kh.invalid.orig || fail "invalid file modified"
# Hash valid file
cp $OBJ/kh.hosts.orig $OBJ/kh.hosts
${SSHKEYGEN} -qf $OBJ/kh.hosts -H 2>/dev/null || fail "hash failed"
diff $OBJ/kh.hosts.old $OBJ/kh.hosts.orig || fail "backup differs"
grep "^host-[abfgh]" $OBJ/kh.hosts && fail "original hostnames persist"
cp $OBJ/kh.hosts $OBJ/kh.hashed.orig
# Test lookup
rm -f $OBJ/kh.expect
expect_key host-a host-a host-a
expect_key host-a host-a host-a2
check_hashed_find host-a "find simple in hashed" $OBJ/kh.hosts
# Test multiple expanded
rm -f $OBJ/kh.expect
expect_key host-h host-h host-f
check_hashed_find host-h "find simple in hashed" $OBJ/kh.hosts
# Test remove
cp $OBJ/kh.hashed.orig $OBJ/kh.hashed
${SSHKEYGEN} -qf $OBJ/kh.hashed -R host-a 2>/dev/null
${SSHKEYGEN} -qf $OBJ/kh.hashed -F host-a && fail "found key after hashed remove"
|
