[openssh-commits] [openssh] 80/87: upstream: regression test for sshkey_check_rsa_length() checking CA

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 1bb37a9aacdc1f206ccd9dd9819b3be9649a978c
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 01:37:30 2026 +0000

    upstream: regression test for sshkey_check_rsa_length() checking CA
    
    key length too.
    
    Anthropic ANT-2026-8H51SIF3
    
    OpenBSD-Regress-ID: 383f63e3a54010d19494b4196d94e2d60900b4ba
---
 regress/unittests/sshkey/test_sshkey.c | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
index 59efbb28e..f946b113c 100644
--- a/regress/unittests/sshkey/test_sshkey.c
+++ b/regress/unittests/sshkey/test_sshkey.c
@@ -1,4 +1,4 @@
-/* 	$OpenBSD: test_sshkey.c,v 1.34 2026/06/14 04:08:06 djm Exp $ */
+/* 	$OpenBSD: test_sshkey.c,v 1.35 2026/10/30 01:37:30 djm Exp $ */
 /*
  * Regress test for sshkey.h key management API
  *
@@ -635,6 +635,34 @@ sshkey_tests(void)
 	k1 = k2 = k3 = NULL;
 	sshbuf_free(b);
 	TEST_DONE();
+
+	TEST_START("RSA length check on certificate CA key");
+	/* non-RSA key certified by a 1024 bit RSA CA */
+	ASSERT_INT_EQ(sshkey_load_public(test_data_file("ed25519_1.pub"),
+	    &k1, NULL), 0);
+	k2 = get_private("rsa_1");
+	ASSERT_INT_EQ(sshkey_check_rsa_length(k2, 2048), SSH_ERR_KEY_LENGTH);
+	ASSERT_INT_EQ(sshkey_to_certified(k1), 0);
+	ASSERT_PTR_NE(k1->cert, NULL);
+	k1->cert->type = SSH2_CERT_TYPE_USER;
+	k1->cert->serial = 1234;
+	k1->cert->valid_after = 0;
+	k1->cert->valid_before = (uint64_t)-1;
+	ASSERT_INT_EQ(sshkey_from_private(k2, &k1->cert->signature_key), 0);
+	ASSERT_INT_EQ(sshkey_certify(k1, k2, NULL, NULL, NULL), 0);
+	b = sshbuf_new();
+	ASSERT_PTR_NE(b, NULL);
+	ASSERT_INT_EQ(sshkey_putb(k1, b), 0);
+	ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(b), sshbuf_len(b), &k3), 0);
+	ASSERT_INT_EQ(sshkey_check_rsa_length(k3, 0), 0);
+	ASSERT_INT_EQ(sshkey_check_rsa_length(k3, 1024), 0);
+	ASSERT_INT_EQ(sshkey_check_rsa_length(k3, 2048), SSH_ERR_KEY_LENGTH);
+	sshkey_free(k1);
+	sshkey_free(k2);
+	sshkey_free(k3);
+	k1 = k2 = k3 = NULL;
+	sshbuf_free(b);
+	TEST_DONE();
 #endif /* WITH_OPENSSL */
 }
 

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.