- markus@cvs.openbsd.org 2013/12/06 13:52:46

     [regress/Makefile regress/agent.sh regress/cert-hostkey.sh]
     [regress/cert-userkey.sh regress/keytype.sh]
     test ed25519 support; from djm@

diff --git a/ChangeLog b/ChangeLog
index cf5e0d504a6b58e163d3fdfe44b18d5a1a32d50c..5edeb82b2726fe86bb053ca15eeb6548f3618a8a 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -33,6 +33,10 @@
    - djm@cvs.openbsd.org 2013/12/07 00:19:15
      [key.c]
      set k->cert = NULL after freeing it
+   - markus@cvs.openbsd.org 2013/12/06 13:52:46
+     [regress/Makefile regress/agent.sh regress/cert-hostkey.sh]
+     [regress/cert-userkey.sh regress/keytype.sh]
+     test ed25519 support; from djm@
  - (djm) [blocks.c ed25519.c fe25519.c fe25519.h ge25519.c ge25519.h]
    [ge25519_base.data hash.c sc25519.c sc25519.h verify.c] Fix RCS idents
  - (djm) [Makefile.in] Add ed25519 sources

diff --git a/regress/Makefile b/regress/Makefile
index eca634a601ea3da740e46cf8ce7342ddb80119a0..098f2014b34312e978b5116eeb43a5d82390894e 100644 (file)
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,6 +1,6 @@
-#      $OpenBSD: Makefile,v 1.66 2013/10/09 23:44:14 djm Exp $
+#      $OpenBSD: Makefile,v 1.67 2013/12/06 13:52:46 markus Exp $
 
-REGRESS_TARGETS=       t1 t2 t3 t4 t5 t6 t7 t8 t9 t-exec
+REGRESS_TARGETS=       t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t-exec
 tests:         $(REGRESS_TARGETS)
 
 # Interop tests are not run by default
@@ -153,6 +153,14 @@ t9: $(OBJ)/t9.out
        test "${TEST_SSH_ECC}" != yes || \
        ${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t9.out > /dev/null
 
+
+$(OBJ)/t10.out:
+       ${TEST_SSH_SSHKEYGEN} -q -t ed25519 -N '' -f $@
+
+t10: $(OBJ)/t10.out
+       ${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t10.out > /dev/null
+       ${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t10.out > /dev/null
+
 t-exec:        ${LTESTS:=.sh}
        @if [ "x$?" = "x" ]; then exit 0; fi; \
        for TEST in ""$?; do \

diff --git a/regress/agent.sh b/regress/agent.sh
index be7d91334d655d5c7a0c3f545c3fead25c470092..90bad15d433c08d1c4402805c2e22f241df35429 100644 (file)
--- a/regress/agent.sh
+++ b/regress/agent.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: agent.sh,v 1.8 2013/05/17 00:37:40 dtucker Exp $
+#      $OpenBSD: agent.sh,v 1.9 2013/12/06 13:52:46 markus Exp $
 #      Placed in the Public Domain.
 
 tid="simple agent test"
@@ -20,7 +20,7 @@ else
        fi
        trace "overwrite authorized keys"
        printf '' > $OBJ/authorized_keys_$USER
-       for t in rsa rsa1; do
+       for t in ed25519 rsa rsa1; do
                # generate user key for agent
                rm -f $OBJ/$t-agent
                ${SSHKEYGEN} -q -N '' -t $t -f $OBJ/$t-agent ||\

diff --git a/regress/cert-hostkey.sh b/regress/cert-hostkey.sh
index 35cd392930a88873530c0afbc188b51ee3980bf4..da2cec87dabf49621cc232c63c7b4b0c769ce6bc 100644 (file)
--- a/regress/cert-hostkey.sh
+++ b/regress/cert-hostkey.sh
@@ -1,14 +1,8 @@
-#      $OpenBSD: cert-hostkey.sh,v 1.7 2013/05/17 00:37:40 dtucker Exp $
+#      $OpenBSD: cert-hostkey.sh,v 1.8 2013/12/06 13:52:46 markus Exp $
 #      Placed in the Public Domain.
 
 tid="certified host keys"
 
-# used to disable ECC based tests on platforms without ECC
-ecdsa=""
-if test "x$TEST_SSH_ECC" = "xyes"; then
-       ecdsa=ecdsa
-fi
-
 rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 
@@ -23,8 +17,17 @@ ${SSHKEYGEN} -q -N '' -t rsa  -f $OBJ/host_ca_key ||\
        cat $OBJ/host_ca_key.pub
 ) > $OBJ/known_hosts-cert
 
+PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/g;s/^ssh-//'`
+
+type_has_legacy() {
+       case $1 in
+               ed25519*|ecdsa*) return 1 ;;
+       esac
+       return 0
+}
+
 # Generate and sign host keys
-for ktype in rsa dsa $ecdsa ; do 
+for ktype in $PLAIN_TYPES ; do 
        verbose "$tid: sign host ${ktype} cert"
        # Generate and sign a host key
        ${SSHKEYGEN} -q -N '' -t ${ktype} \
@@ -34,10 +37,10 @@ for ktype in rsa dsa $ecdsa ; do
            -I "regress host key for $USER" \
            -n $HOSTS $OBJ/cert_host_key_${ktype} ||
                fail "couldn't sign cert_host_key_${ktype}"
-       # v00 ecdsa certs do not exist
-       test "${ktype}" = "ecdsa" && continue
+       type_has_legacy $ktype || continue
        cp $OBJ/cert_host_key_${ktype} $OBJ/cert_host_key_${ktype}_v00
        cp $OBJ/cert_host_key_${ktype}.pub $OBJ/cert_host_key_${ktype}_v00.pub
+       verbose "$tid: sign host ${ktype}_v00 cert"
        ${SSHKEYGEN} -t v00 -h -q -s $OBJ/host_ca_key \
            -I "regress host key for $USER" \
            -n $HOSTS $OBJ/cert_host_key_${ktype}_v00 ||
@@ -46,7 +49,7 @@ done
 
 # Basic connect tests
 for privsep in yes no ; do
-       for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00; do 
+       for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do 
                verbose "$tid: host ${ktype} cert connect privsep $privsep"
                (
                        cat $OBJ/sshd_proxy_bak
@@ -73,9 +76,16 @@ done
        printf "* "
        cat $OBJ/cert_host_key_rsa.pub
        if test "x$TEST_SSH_ECC" = "xyes"; then
+               cat $OBJ/cert_host_key_ecdsa-sha2-nistp256.pub
+               printf '@revoked '
+               printf "* "
+               cat $OBJ/cert_host_key_ecdsa-sha2-nistp384.pub
+               printf '@revoked '
+               printf "* "
+               cat $OBJ/cert_host_key_ecdsa-sha2-nistp521.pub
                printf '@revoked '
                printf "* "
-               cat $OBJ/cert_host_key_ecdsa.pub
+               cat $OBJ/cert_host_key_ed25519.pub
        fi
        printf '@revoked '
        printf "* "
@@ -88,7 +98,7 @@ done
        cat $OBJ/cert_host_key_dsa_v00.pub
 ) > $OBJ/known_hosts-cert
 for privsep in yes no ; do
-       for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00; do 
+       for ktype in $PLAIN_TYPES rsa_v00 dsa_v00; do 
                verbose "$tid: host ${ktype} revoked cert privsep $privsep"
                (
                        cat $OBJ/sshd_proxy_bak
@@ -115,7 +125,7 @@ done
        printf "* "
        cat $OBJ/host_ca_key.pub
 ) > $OBJ/known_hosts-cert
-for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do 
+for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do 
        verbose "$tid: host ${ktype} revoked cert"
        (
                cat $OBJ/sshd_proxy_bak
@@ -186,9 +196,8 @@ test_one "cert has constraints"     failure "-h -Oforce-command=false"
 
 # Check downgrade of cert to raw key when no CA found
 for v in v01 v00 ;  do 
-       for ktype in rsa dsa $ecdsa ; do 
-               # v00 ecdsa certs do not exist.
-               test "${v}${ktype}" = "v00ecdsa" && continue
+       for ktype in $PLAIN_TYPES ; do 
+               type_has_legacy $ktype || continue
                rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
                verbose "$tid: host ${ktype} ${v} cert downgrade to raw key"
                # Generate and sign a host key
@@ -225,9 +234,8 @@ done
        cat $OBJ/host_ca_key.pub
 ) > $OBJ/known_hosts-cert
 for v in v01 v00 ;  do 
-       for kt in rsa dsa $ecdsa ; do 
-               # v00 ecdsa certs do not exist.
-               test "${v}${ktype}" = "v00ecdsa" && continue
+       for kt in $PLAIN_TYPES ; do 
+               type_has_legacy $kt || continue
                rm -f $OBJ/cert_host_key*
                # Self-sign key
                ${SSHKEYGEN} -q -N '' -t ${kt} \

diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh
index 6018b38f49ea0fa5779debbd1ba1398022b43bac..b093a919614723770d28a8463528dd52b09f9841 100644 (file)
--- a/regress/cert-userkey.sh
+++ b/regress/cert-userkey.sh
@@ -1,23 +1,26 @@
-#      $OpenBSD: cert-userkey.sh,v 1.11 2013/05/17 00:37:40 dtucker Exp $
+#      $OpenBSD: cert-userkey.sh,v 1.12 2013/12/06 13:52:46 markus Exp $
 #      Placed in the Public Domain.
 
 tid="certified user keys"
 
-# used to disable ECC based tests on platforms without ECC
-ecdsa=""
-if test "x$TEST_SSH_ECC" = "xyes"; then
-       ecdsa=ecdsa
-fi
-
 rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 
+PLAIN_TYPES=`$SSH -Q key-plain | sed 's/^ssh-dss/ssh-dsa/;s/^ssh-//'`
+
+type_has_legacy() {
+       case $1 in
+               ed25519*|ecdsa*) return 1 ;;
+       esac
+       return 0
+}
+
 # Create a CA key
 ${SSHKEYGEN} -q -N '' -t rsa  -f $OBJ/user_ca_key ||\
        fail "ssh-keygen of user_ca_key failed"
 
 # Generate and sign user keys
-for ktype in rsa dsa $ecdsa ; do 
+for ktype in $PLAIN_TYPES ; do 
        verbose "$tid: sign user ${ktype} cert"
        ${SSHKEYGEN} -q -N '' -t ${ktype} \
            -f $OBJ/cert_user_key_${ktype} || \
@@ -25,18 +28,18 @@ for ktype in rsa dsa $ecdsa ; do
        ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
            -z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype} ||
                fail "couldn't sign cert_user_key_${ktype}"
-       # v00 ecdsa certs do not exist
-       test "${ktype}" = "ecdsa" && continue
+       type_has_legacy $ktype || continue
        cp $OBJ/cert_user_key_${ktype} $OBJ/cert_user_key_${ktype}_v00
        cp $OBJ/cert_user_key_${ktype}.pub $OBJ/cert_user_key_${ktype}_v00.pub
+       verbose "$tid: sign host ${ktype}_v00 cert"
        ${SSHKEYGEN} -q -t v00 -s $OBJ/user_ca_key -I \
            "regress user key for $USER" \
            -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype}_v00 ||
-               fail "couldn't sign cert_user_key_${ktype}_v00"
+               fatal "couldn't sign cert_user_key_${ktype}_v00"
 done
 
 # Test explicitly-specified principals
-for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do 
+for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do 
        for privsep in yes no ; do
                _prefix="${ktype} privsep $privsep"
 
@@ -162,7 +165,7 @@ basic_tests() {
                extra_sshd="TrustedUserCAKeys $OBJ/user_ca_key.pub"
        fi
        
-       for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do 
+       for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do 
                for privsep in yes no ; do
                        _prefix="${ktype} privsep $privsep $auth"
                        # Simple connect
@@ -332,7 +335,7 @@ test_one "principals key option no principals" failure "" \
 
 # Wrong certificate
 cat $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
-for ktype in rsa dsa $ecdsa rsa_v00 dsa_v00 ; do 
+for ktype in $PLAIN_TYPES rsa_v00 dsa_v00 ; do 
        case $ktype in
        *_v00) args="-t v00" ;;
        *) args="" ;;

diff --git a/regress/keytype.sh b/regress/keytype.sh
index 65436b2c01fead96e43c3f8d02e660a94dba0e4b..2c57ec6b15d2700f5e1bfc00a4e94a90254a0f1f 100644 (file)
--- a/regress/keytype.sh
+++ b/regress/keytype.sh
@@ -1,4 +1,4 @@
-#      $OpenBSD: keytype.sh,v 1.2 2013/05/17 00:37:40 dtucker Exp $
+#      $OpenBSD: keytype.sh,v 1.3 2013/12/06 13:52:46 markus Exp $
 #      Placed in the Public Domain.
 
 tid="login with different key types"
@@ -11,7 +11,7 @@ fi
 cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
 
-ktypes="dsa-1024 rsa-2048 rsa-3072"
+ktypes="dsa-1024 rsa-2048 rsa-3072 ed25519-512"
 for i in `$SSH -Q key`; do
        case "$i" in
                ecdsa-sha2-nistp256)    ktype="$ktype ecdsa-256" ;;