eiac/crypto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ssh/test: don't use DSA keys in integrations tests, update test RSA key

Browse Source 
on RHEL 9 OpenSSH does not support DSA keys and RSA keys with size less
than 2048 bits, furthermore signing with ssh-rsa (SHA-1 signatures) and
ssh-dss is not allowed, therefore:

1) replaced the 1024-bit RSA key used in the test with a new 2048-bit
   one
2) removed DSA key from itegration tests
3) allowed signature errors using ssh-rsa in agent integration tests, we
   also check SHA-2 variants that are not skipped

Fixes golang/go#65581

Change-Id: I54bf997b61ef4d91d38eb624275737ba7291bb20
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/562755
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Nicola Murino <nicola.murino@gmail.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This commit is contained in:
Nicola Murino
2024-02-14 13:16:51 +00:00
committed by Gopher Robot
parent 62c9f1799c
commit 1c981e6f81
5 changed files with 46 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssh/agent/client_test.go
+14 -7
View File
@@ -164,15 +164,23 @@ func testAgentInterface(t *testing.T, agent ExtendedAgent, key interface{}, cert
data := []byte("hello")
sig, err := agent.Sign(pubKey, data)
if err != nil {
t.Fatalf("Sign(%s): %v", pubKey.Type(), err)
}
if err := pubKey.Verify(data, sig); err != nil {
t.Fatalf("Verify(%s): %v", pubKey.Type(), err)
t.Logf("sign failed with key type %q", pubKey.Type())
// In integration tests ssh-dss and ssh-rsa (SHA1 signatures) may be
// disabled for security reasons, we check SHA-2 variants later.
if pubKey.Type() != ssh.KeyAlgoDSA && pubKey.Type() != ssh.KeyAlgoRSA && pubKey.Type() != ssh.CertAlgoRSAv01 {
t.Fatalf("Sign(%s): %v", pubKey.Type(), err)
}
} else {
if err := pubKey.Verify(data, sig); err != nil {
t.Logf("verify failed with key type %q", pubKey.Type())
if pubKey.Type() != ssh.KeyAlgoRSA {
t.Fatalf("Verify(%s): %v", pubKey.Type(), err)
}
}
}
// For tests on RSA keys, try signing with SHA-256 and SHA-512 flags
if pubKey.Type() == "ssh-rsa" {
if pubKey.Type() == ssh.KeyAlgoRSA {
sshFlagTest := func(flag SignatureFlags, expectedSigFormat string) {
sig, err = agent.SignWithFlags(pubKey, data, flag)
if err != nil {
@@ -185,7 +193,6 @@ func testAgentInterface(t *testing.T, agent ExtendedAgent, key interface{}, cert
t.Fatalf("Verify(%s): %v", pubKey.Type(), err)
}
}
sshFlagTest(0, ssh.KeyAlgoRSA)
sshFlagTest(SignatureFlagRsaSha256, ssh.KeyAlgoRSASHA256)
sshFlagTest(SignatureFlagRsaSha512, ssh.KeyAlgoRSASHA512)
}