[openssh-commits] [openssh] 01/04: upstream: Restructure the SSHFP test in preparation for adding
git+noreply at mindrot.org
git+noreply at mindrot.org
Sun Jul 12 22:25:44 AEST 2026
This is an automated email from the git hooks/post-receive script.
dtucker pushed a commit to branch master
in repository openssh.
commit 4079e457eaade0b450411d637dfc4b663a2d0a80
Author: dtucker at openbsd.org <dtucker at openbsd.org>
AuthorDate: Sat Jul 11 09:59:10 2026 +0000
upstream: Restructure the SSHFP test in preparation for adding
other key types: - change the DNS names to be rsa.* for the existing RSA
fingerprints. - verify that all required SSHFP records exist in DNS. - only
run the RSA tests if the build supports RSA.
OpenBSD-Regress-ID: 03e4087c3bd09ad8bede788f76f0ab59b732639e
---
regress/sshfp-connect.sh | 86 +++++++++++++++++++++++++++++++-----------------
1 file changed, 55 insertions(+), 31 deletions(-)
diff --git a/regress/sshfp-connect.sh b/regress/sshfp-connect.sh
index 3c73a35d0..102446487 100644
--- a/regress/sshfp-connect.sh
+++ b/regress/sshfp-connect.sh
@@ -1,40 +1,64 @@
-# $OpenBSD: sshfp-connect.sh,v 1.5 2025/03/11 11:46:44 dtucker Exp $
+# $OpenBSD: sshfp-connect.sh,v 1.6 2026/07/11 09:59:10 dtucker Exp $
# Placed in the Public Domain.
# This test requires external setup and thus is skipped unless
# TEST_SSH_SSHFP_DOMAIN is set. It requires:
-# 1) A DNSSEC-enabled domain, which TEST_SSH_SSHFP_DOMAIN points to.
-# 2) A DNSSEC-validating resolver such as unwind(8).
-# 3) The following SSHFP records with fingerprints from rsa_openssh.pub
-# in that domain that are expected to succeed:
-# sshtest: valid sha1 and sha256 fingerprints.
-# sshtest-sha{1,256}, : valid fingerprints for that type only.
+# 1) A DNSSEC-validating resolver such as unwind(8).
+# 2) A DNSSEC-enabled domain, which TEST_SSH_SSHFP_DOMAIN points to,
+# containing he following SSHFP records with fingerprints from
+# rsa_openssh.pub in that domain that are expected to succeed:
+# rsa: valid sha1 and sha256 fingerprints.
+# rsa-sha{1,256}, : valid fingerprints for that type only.
# and the following records that are expected to fail:
-# sshtest-bad: invalid sha1 fingerprint and good sha256 fingerprint
-# sshtest-sha{1,256}-bad: invalid fingerprints for that type only.
-#
-# sshtest IN SSHFP 1 1 99C79CC09F5F81069CC017CDF9552CFC94B3B929
-# sshtest IN SSHFP 1 2 E30D6B9EB7A4DE495324E4D5870B8220577993EA6AF417E8E4A4F1C5 BF01A9B6
-# sshtest-sha1 IN SSHFP 1 1 99C79CC09F5F81069CC017CDF9552CFC94B3B929
-# sshtest-sha256 IN SSHFP 1 2 E30D6B9EB7A4DE495324E4D5870B8220577993EA6AF417E8E4A4F1C5 BF01A9B6
-# sshtest-bad IN SSHFP 1 2 E30D6B9EB7A4DE495324E4D5870B8220577993EA6AF417E8E4A4F1C5 BF01A9B6
-# sshtest-bad IN SSHFP 1 1 99C79CC09F5F81069CC017CDF9552CFC94B3B928
-# sshtest-sha1-bad IN SSHFP 1 1 99D79CC09F5F81069CC017CDF9552CFC94B3B929
-# sshtest-sha256-bad IN SSHFP 1 2 E30D6B9EB7A4DE495324E4D5870B8220577993EA6AF417E8E4A4F1C5 BF01A9B5
+# rsa-bad: invalid sha1 fingerprint and good sha256 fingerprint
+# rsa-sha{1,256}-bad: invalid fingerprints for that type only.
+
+dnsfps='\
+rsa IN SSHFP 1 1 99C79CC09F5F81069CC017CDF9552CFC94B3B929
+rsa IN SSHFP 1 2 E30D6B9EB7A4DE495324E4D5870B8220577993EA6AF417E8E4A4F1C5BF01A9B6
+rsa-sha1 IN SSHFP 1 1 99C79CC09F5F81069CC017CDF9552CFC94B3B929
+rsa-sha256 IN SSHFP 1 2 E30D6B9EB7A4DE495324E4D5870B8220577993EA6AF417E8E4A4F1C5BF01A9B6
+rsa-bad IN SSHFP 1 1 99C79CC09F5F81069CC017CDF9552CFC94B3B928
+rsa-bad IN SSHFP 1 2 E30D6B9EB7A4DE495324E4D5870B8220577993EA6AF417E8E4A4F1C5BF01A9B6
+rsa-sha1-bad IN SSHFP 1 1 99D79CC09F5F81069CC017CDF9552CFC94B3B929
+rsa-sha256-bad IN SSHFP 1 2 E30D6B9EB7A4DE495324E4D5870B8220577993EA6AF417E8E4A4F1C5BF01A9B5'
tid="sshfp connect"
-if ! $SSH -Q key-plain | grep ssh-rsa >/dev/null; then
- skip "RSA keys not supported."
-elif [ -z "${TEST_SSH_SSHFP_DOMAIN}" ]; then
+if [ -z "${TEST_SSH_SSHFP_DOMAIN}" ]; then
skip "TEST_SSH_SSHFP_DOMAIN not set."
-else
- # Prime any DNS caches and resolvers.
- for i in sshtest sshtest-sha1 sshtest-sha256; do
- host -t sshfp ${i}.${TEST_SSH_SSHFP_DOMAIN} >/dev/null 2>&1
- host -t sshfp ${i}-bad.${TEST_SSH_SSHFP_DOMAIN} >/dev/null 2>&1
- done
+fi
+
+# Check that the required DNS entries exist.
+# This also primes any DNS caches and resolvers.
+#
+# It uses here documents instead of the more obvious "foo | while read"
+# since the latter runs the loop inside a subshell and any variables set in it
+# vanish when the subshell does.
+while read line; do
+ name=`echo "$line" | awk '{print $1}'`
+ expected=`echo "$line" | awk '{print $4" "$5" "$6}'`
+ # Ensure at least one result matches exactly
+ matched=no
+ while read result; do
+ if [ "$result" = "$expected" ]; then
+ matched=yes
+ fi
+ done <<EOD
+`host -t sshfp "${name}.${TEST_SSH_SSHFP_DOMAIN}" | \
+ awk '{print $5" "$6" "$7$8}'`
+EOD
+ if [ "$matched" = "no" ]; then
+ fatal "$name.${TEST_SSH_SSHFP_DOMAIN} does not match required"
+ fi
+ trace "verified sshfp record '$name' -> '$expected'"
+done <<EOD
+$dnsfps
+EOD
+verbose "all required sshfp entries exist"
+if $SSH -Q key-plain | grep ssh-rsa >/dev/null; then
+ verbose "sshfp rsa"
# Set RSA host key to match fingerprints above.
mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
$SUDO cp $SRC/rsa_openssh.prv $OBJ/host.ssh-rsa
@@ -49,11 +73,11 @@ else
-e "/Hostname.*127.0.0.1/d" \
$OBJ/ssh_proxy.orig > $OBJ/ssh_proxy
- for n in sshtest sshtest-sha1 sshtest-sha256; do
+ for n in rsa rsa-sha1 rsa-sha256; do
trace "sshfp connect $n good fingerprint"
host="${n}.dtucker.net"
- opts="-F $OBJ/ssh_proxy -o VerifyHostKeyDNS=yes "
- opts="$opts -o HostKeyAlgorithms=rsa-sha2-512,rsa-sha2-256"
+ opts="-F $OBJ/ssh_proxy -oVerifyHostKeyDNS=yes"
+ opts="$opts -oHostKeyAlgorithms=rsa-sha2-512,rsa-sha2-256"
host="${n}.${TEST_SSH_SSHFP_DOMAIN}"
SSH_CONNECTION=`${SSH} $opts $host 'echo $SSH_CONNECTION'`
if [ $? -ne 0 ]; then
@@ -65,7 +89,7 @@ else
trace "sshfp connect $n bad fingerprint"
host="${n}-bad.${TEST_SSH_SSHFP_DOMAIN}"
- if ${SSH} $opts ${host} true; then
+ if ${SSH} $opts ${host} true 2>/dev/null; then
fail "sshfp-connect succeeded with bad SSHFP record"
fi
done
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list