upstream: Only use supported key types during KRL test, preferring

ed25519 since it's supported by both OpenSSL and non-OpenSSL builds.

OpenBSD-Regress-ID: 9f2bb3eadd50fcc8245b1bd8fd6f0e53602f71aa

1 files changed, 19 insertions, 12 deletions

diff --git a/regress/krl.sh b/regress/krl.sh
index a70c79c66..e18d0ec7f 100644
--- a/regress/krl.sh
+++ b/regress/krl.sh
@@ -1,13 +1,18 @@
-#       $OpenBSD: krl.sh,v 1.7 2018/09/12 01:23:48 djm Exp $
+#       $OpenBSD: krl.sh,v 1.8 2019/07/25 09:17:35 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="key revocation lists"
 
-# If we don't support ecdsa keys then this tell will be much slower.
-ECDSA=ecdsa
-if test "x$TEST_SSH_ECC" != "xyes"; then
-        ECDSA=rsa
-fi
+# Use ed25519 by default since it's fast and it's supported when building
+# w/out OpenSSL.  Populate ktype[2-4] with the other types if supported.
+ktype1=ed25519; ktype2=ed25519; ktype3=ed25519; ktype4=ed25519
+for t in `${SSH} -Q key-plain`; do
+        case "$t" in
+                ecdsa*)         ktype2=ecdsa ;;
+                ssh-rsa)        ktype3=rsa ;;
+                ssh-dss)        ktype4=dsa ;;
+        esac
+done
 
 # Do most testing with ssh-keygen; it uses the same verification code as sshd.
 
@@ -15,9 +20,9 @@ fi
 rm -f $OBJ/revoked-* $OBJ/krl-*
 
 # Generate a CA key
-$SSHKEYGEN -t $ECDSA -f $OBJ/revoked-ca  -C "" -N "" > /dev/null ||
+$SSHKEYGEN -t $ktype1 -f $OBJ/revoked-ca  -C "" -N "" > /dev/null ||
         fatal "$SSHKEYGEN CA failed"
-$SSHKEYGEN -t ed25519 -f $OBJ/revoked-ca2  -C "" -N "" > /dev/null ||
+$SSHKEYGEN -t $ktype2 -f $OBJ/revoked-ca2  -C "" -N "" > /dev/null ||
         fatal "$SSHKEYGEN CA2 failed"
 
 # A specification that revokes some certificates by serial numbers
@@ -55,11 +60,13 @@ done
 keygen() {
         N=$1
         f=$OBJ/revoked-`printf "%04d" $N`
-        # Vary the keytype. We use mostly ECDSA since this is fastest by far.
-        keytype=$ECDSA
+        # Vary the keytype. We use mostly ed25519 since this is fast and well
+        # supported.
+        keytype=$ktype1
         case $N in
-        2 | 10 | 510 | 1001)    keytype=rsa;;
-        4 | 30 | 520 | 1002)    keytype=ed25519;;
+        2 | 10 | 510 | 1001)    keytype=$ktype2 ;;
+        4 | 30 | 520 | 1002)    keytype=$ktype3 ;;
+        8 | 50 | 530 | 1003)    keytype=$ktype4 ;;
         esac
         $SSHKEYGEN -t $keytype -f $f -C "" -N "" > /dev/null \
                 || fatal "$SSHKEYGEN failed"