1 files changed, 14 insertions, 3 deletions

diff --git a/regress/limit-keytype.sh b/regress/limit-keytype.sh
index 5c30af006..010a88cd7 100644
--- a/regress/limit-keytype.sh
+++ b/regress/limit-keytype.sh
@@ -1,20 +1,25 @@
-#       $OpenBSD: limit-keytype.sh,v 1.6 2019/07/26 04:22:21 dtucker Exp $
+#       $OpenBSD: limit-keytype.sh,v 1.9 2019/12/16 02:39:05 djm Exp $
 #       Placed in the Public Domain.
 
 tid="restrict pubkey type"
 
+# XXX sk-* keys aren't actually tested ATM.
+
 rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/user_key*
 rm -f $OBJ/authorized_principals_$USER $OBJ/cert_user_key*
 
 mv $OBJ/sshd_proxy $OBJ/sshd_proxy.orig
 mv $OBJ/ssh_proxy $OBJ/ssh_proxy.orig
 
-ktype1=ed25519; ktype2=$ktype1; ktype3=$ktype1; ktype4=$ktype1
-for t in `${SSH} -Q key-plain`; do
+ktype1=ed25519; ktype2=ed25519; ktype3=ed25519;
+ktype4=ed25519; ktype5=ed25519; ktype6=ed25519;
+for t in $SSH_KEYTYPES ; do 
         case "$t" in
                 ssh-rsa)        ktype2=rsa ;;
                 ecdsa*)         ktype3=ecdsa ;;  # unused
                 ssh-dss)        ktype4=dsa ;;
+                sk-ssh-ed25519@openssh.com)             ktype5=ed25519-sk ;;
+                sk-ecdsa-sha2-nistp256@openssh.com)     ktype6=ecdsa-sk ;;
         esac
 done
 
@@ -31,6 +36,10 @@ ${SSHKEYGEN} -q -N '' -t $ktype2 -f $OBJ/user_key3 || \
         fatal "ssh-keygen failed"
 ${SSHKEYGEN} -q -N '' -t $ktype4 -f $OBJ/user_key4 || \
         fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t $ktype5 -f $OBJ/user_key5 || \
+        fatal "ssh-keygen failed"
+${SSHKEYGEN} -q -N '' -t $ktype6 -f $OBJ/user_key6 || \
+        fatal "ssh-keygen failed"
 ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
         -z $$ -n ${USER},mekmitasdigoat $OBJ/user_key3 ||
                 fatal "couldn't sign user_key1"
@@ -68,6 +77,8 @@ keytype() {
                 ed25519)        printf "ssh-ed25519" ;;
                 dsa)            printf "ssh-dss" ;;
                 rsa)            printf "rsa-sha2-256,rsa-sha2-512,ssh-rsa" ;;
+                sk-ecdsa)       printf "sk-ecdsa-*" ;;
+                sk-ssh-ed25519) printf "sk-ssh-ed25519-*" ;;
         esac
 }