Nicola Murino
1c981e6f81
on RHEL 9 OpenSSH does not support DSA keys and RSA keys with size less than 2048 bits, furthermore signing with ssh-rsa (SHA-1 signatures) and ssh-dss is not allowed, therefore: 1) replaced the 1024-bit RSA key used in the test with a new 2048-bit one 2) removed DSA key from itegration tests 3) allowed signature errors using ssh-rsa in agent integration tests, we also check SHA-2 variants that are not skipped Fixes golang/go#65581 Change-Id: I54bf997b61ef4d91d38eb624275737ba7291bb20 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/562755 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
77 lines
2.0 KiB
Go
77 lines
2.0 KiB
Go
// Copyright 2014 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
|
|
|
|
package test
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/rand"
|
|
"testing"
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
// Test both logging in with a cert, and also that the certificate presented by an OpenSSH host can be validated correctly
|
|
func TestCertLogin(t *testing.T) {
|
|
s := newServer(t)
|
|
|
|
// Use a key different from the default.
|
|
clientKey := testSigners["ed25519"]
|
|
caAuthKey := testSigners["ecdsa"]
|
|
cert := &ssh.Certificate{
|
|
Key: clientKey.PublicKey(),
|
|
ValidPrincipals: []string{username()},
|
|
CertType: ssh.UserCert,
|
|
ValidBefore: ssh.CertTimeInfinity,
|
|
}
|
|
if err := cert.SignCert(rand.Reader, caAuthKey); err != nil {
|
|
t.Fatalf("SetSignature: %v", err)
|
|
}
|
|
|
|
certSigner, err := ssh.NewCertSigner(cert, clientKey)
|
|
if err != nil {
|
|
t.Fatalf("NewCertSigner: %v", err)
|
|
}
|
|
|
|
conf := &ssh.ClientConfig{
|
|
User: username(),
|
|
HostKeyCallback: (&ssh.CertChecker{
|
|
IsHostAuthority: func(pk ssh.PublicKey, addr string) bool {
|
|
return bytes.Equal(pk.Marshal(), testPublicKeys["ca"].Marshal())
|
|
},
|
|
}).CheckHostKey,
|
|
}
|
|
conf.Auth = append(conf.Auth, ssh.PublicKeys(certSigner))
|
|
|
|
for _, test := range []struct {
|
|
addr string
|
|
succeed bool
|
|
}{
|
|
{addr: "host.example.com:22", succeed: true},
|
|
{addr: "host.example.com:10000", succeed: true}, // non-standard port must be OK
|
|
{addr: "host.example.com", succeed: false}, // port must be specified
|
|
{addr: "host.ex4mple.com:22", succeed: false}, // wrong host
|
|
} {
|
|
client, err := s.TryDialWithAddr(conf, test.addr)
|
|
|
|
// Always close client if opened successfully
|
|
if err == nil {
|
|
client.Close()
|
|
}
|
|
|
|
// Now evaluate whether the test failed or passed
|
|
if test.succeed {
|
|
if err != nil {
|
|
t.Fatalf("TryDialWithAddr: %v", err)
|
|
}
|
|
} else {
|
|
if err == nil {
|
|
t.Fatalf("TryDialWithAddr, unexpected success")
|
|
}
|
|
}
|
|
}
|
|
}
|