tests/keys-generate.sh - master - niceSOFT/libssh2

tests/keys-generate.sh
113 строк6 KB
Viktor Szakats
tests: add tests for signed hostkey: `ssh-ed25519-cert-v01@openssh.com`
10 авг 2026, 18:00
10 авг 2026, 18:006036e57
#!/bin/sh
#
# Copyright (C) Viktor Szakats
# SPDX-License-Identifier: BSD-3-Clause

set -eu

# Generate test keys

# tests/openssh_server

[ -d openssh_server ] || mkdir openssh_server
rm -f openssh_server/*_key
rm -f openssh_server/*_key-cert.pub

ssh-keygen -t rsa     -b 2048 -N ''          -m PEM     -C ''                             -f 'openssh_server/ssh_host_rsa_key'
ssh-keygen -t ecdsa   -b  256 -N ''          -m PEM     -C ''                             -f 'openssh_server/ssh_host_ecdsa_key'
ssh-keygen -t ed25519         -N ''          -m RFC4716 -C ''                             -f 'openssh_server/ssh_host_ed25519_key'

# tests/keys

[ -d keys ] || mkdir keys
rm -f keys/ca_*
rm -f keys/id_*

# host CAs
ssh-keygen -t ed25519         -N ''          -m RFC4716 -C 'ca_host_ed25519'              -f 'keys/ca_host_ed25519'

# user CAs
ssh-keygen -t rsa     -b 3072 -N ''          -m RFC4716 -C 'ca_user_rsa'                  -f 'keys/ca_user_rsa'
ssh-keygen -t ecdsa   -b  521 -N ''          -m RFC4716 -C 'ca_user_ecdsa'                -f 'keys/ca_user_ecdsa'
ssh-keygen -t ed25519         -N ''          -m RFC4716 -C 'ca_user_ed25519'              -f 'keys/ca_user_ed25519'

pw='libssh2'
id='identity'
pr="${1:-libssh2}"

# host certificates
ssh-keygen                 -h -I 'host_ed25519' -n "${pr}" -s 'keys/ca_host_ed25519'         'openssh_server/ssh_host_ed25519_key.pub'

# inspect PKCS8 private keys with command:
# $ openssl asn1parse -dump -in <id-filename>

ssh-keygen -t dsa             -N ''          -m PEM     -C 'id_dsa'                       -f 'keys/id_dsa'                         || touch 'keys/id_dsa.pub'
ssh-keygen -t dsa             -N ''          -m PEM     -C 'id_dsa_wrong'                 -f 'keys/id_dsa_wrong'                   || true # not to add to 'authorized_keys'
ssh-keygen -t rsa     -b 2048 -N ''          -m PEM     -C 'id_rsa_pem'                   -f 'keys/id_rsa_pem'
ssh-keygen -t rsa     -b 2048 -N "${pw}"     -m PEM     -C 'id_rsa_pem_encrypted'         -f 'keys/id_rsa_pem_encrypted'           # aes128-cbc
ssh-keygen -t rsa     -b 3072 -N ''          -m PKCS8   -C 'id_rsa_pkcs8'                 -f 'keys/id_rsa_pkcs8'
ssh-keygen -t rsa     -b 2048 -N "${pw}"     -m PKCS8   -C 'id_rsa_pkcs8_encrypted'       -f 'keys/id_rsa_pkcs8_encrypted'         # aes128-cbc
ssh-keygen -t rsa     -b 2048 -N ''          -m RFC4716 -C ''                             -f 'keys/id_rsa_openssh'                 # empty comment
ssh-keygen -t rsa     -b 2048 -N "${pw}"     -m RFC4716 -C 'id_rsa_openssh_encrypted'     -f 'keys/id_rsa_openssh_encrypted'       -Z aes256-gcm@openssh.com
ssh-keygen -t ecdsa   -b  521 -N ''          -m PEM     -C 'id_ecdsa_pem'                 -f 'keys/id_ecdsa_pem'
ssh-keygen -t ecdsa   -b  256 -N "${pw}"     -m PEM     -C 'id_ecdsa_pem_encrypted'       -f 'keys/id_ecdsa_pem_encrypted'         # aes128-cbc
ssh-keygen -t ecdsa   -b  384 -N ''          -m PKCS8   -C 'id_ecdsa_pkcs8'               -f 'keys/id_ecdsa_pkcs8'
ssh-keygen -t ecdsa   -b  521 -N "${pw}"     -m PKCS8   -C 'id_ecdsa_pkcs8_encrypted'     -f 'keys/id_ecdsa_pkcs8_encrypted'       # aes128-cbc
ssh-keygen -t ecdsa   -b  384 -N ''          -m RFC4716 -C ''                             -f 'keys/id_ecdsa_openssh'               # empty comment
ssh-keygen -t ecdsa   -b  256 -N "${pw}"     -m RFC4716 -C 'id_ecdsa_openssh_encrypted'   -f 'keys/id_ecdsa_openssh_encrypted'     -Z chacha20-poly1305@openssh.com
ssh-keygen -t ed25519         -N ''          -m PKCS8   -C 'id_ed25519_pkcs8'             -f 'keys/id_ed25519_pkcs8'
ssh-keygen -t ed25519         -N "${pw}"     -m PKCS8   -C 'id_ed25519_pkcs8_encrypted'   -f 'keys/id_ed25519_pkcs8_encrypted'     # aes128-cbc
ssh-keygen -t ed25519         -N ''          -m RFC4716 -C 'id_ed25519_openssh'           -f 'keys/id_ed25519_openssh'
ssh-keygen -t ed25519         -N "${pw}"     -m RFC4716 -C 'id_ed25519_openssh_encrypted' -f 'keys/id_ed25519_openssh_encrypted'   -Z aes256-ctr

ssh-keygen -t rsa     -b 4096 -N ''          -m PEM     -C 'id_rsa_pem_signed'            -f 'keys/id_rsa_pem_signed'
ssh-keygen -t ssh-rsa         -I "${id}" -n "${pr}"     -s 'keys/ca_user_rsa'                'keys/id_rsa_pem_signed.pub'
ssh-keygen -t rsa     -b 4096 -N ''          -m PEM     -C 'id_rsa_pem_sha2_512_signed'   -f 'keys/id_rsa_pem_sha2_512_signed'
ssh-keygen -t rsa-sha2-512    -I "${id}" -n "${pr}"     -s 'keys/ca_user_rsa'                'keys/id_rsa_pem_sha2_512_signed.pub'
ssh-keygen -t ecdsa   -b  384 -N ''          -m RFC4716 -C 'id_ecdsa_openssh_signed'      -f 'keys/id_ecdsa_openssh_signed'
ssh-keygen                    -I "${id}" -n "${pr}"     -s 'keys/ca_user_ecdsa'              'keys/id_ecdsa_openssh_signed.pub'
ssh-keygen -t ed25519         -N ''          -m RFC4716 -C 'id_ed25519_openssh_signed'    -f 'keys/id_ed25519_openssh_signed'
ssh-keygen                    -I "${id}" -n "${pr}"     -s 'keys/ca_user_ed25519'            'keys/id_ed25519_openssh_signed.pub'

cat \
  'keys/id_dsa.pub' \
  'keys/id_rsa_pem.pub' \
  'keys/id_rsa_pem_encrypted.pub' \
  'keys/id_rsa_pkcs8.pub' \
  'keys/id_rsa_pkcs8_encrypted.pub' \
  'keys/id_rsa_openssh.pub' \
  'keys/id_rsa_openssh_encrypted.pub' \
  'keys/id_ecdsa_pem.pub' \
  'keys/id_ecdsa_pem_encrypted.pub' \
  'keys/id_ecdsa_pkcs8.pub' \
  'keys/id_ecdsa_pkcs8_encrypted.pub' \
  'keys/id_ecdsa_openssh.pub' \
  'keys/id_ecdsa_openssh_encrypted.pub' \
  'keys/id_ed25519_pkcs8.pub' \
  'keys/id_ed25519_pkcs8_encrypted.pub' \
  'keys/id_ed25519_openssh.pub' \
  'keys/id_ed25519_openssh_encrypted.pub' \
  > 'openssh_server/authorized_keys'

cat \
  'keys/ca_user_rsa.pub' \
  'keys/ca_user_ecdsa.pub' \
  'keys/ca_user_ed25519.pub' \
  > 'openssh_server/ca_user_keys.pub'

# tests/test_*.c

echo 'Add these public keys and hashes to:'
echo ' - test_hostkey.c'
echo ' - test_hostkey_hash.c'

for fn in openssh_server/*_key.pub; do
  pub="$(grep -a -o -E ' [A-Za-z0-9+/=]+' < "${fn}" | head -1 | cut -c 2-)"
  printf '====== %s\n' "${fn}"
  printf 'BASE64 %s\n' "${pub}"
  {
    printf 'MD5    %s\n' "$(printf '%s' "${pub}" | base64 -d | md5sum | tr -d ' -')"
    printf 'SHA1   %s\n' "$(printf '%s' "${pub}" | base64 -d | sha1sum | tr -d ' -')"
    printf 'SHA256 %s\n' "$(printf '%s' "${pub}" | base64 -d | sha256sum | tr -d ' -')"
  } | tr '[:lower:]' '[:upper:]'
done