|
| 1 | +#!/bin/bash |
| 2 | + |
| 3 | +set -x |
| 4 | + |
| 5 | +echo "Running OpenSSL 3.6 verifier." | tee $logfile |
| 6 | + |
| 7 | +certsdir="artifacts_cms_v3" |
| 8 | +cmszip="artifacts_cms_v3.zip" |
| 9 | +inputdir="./providers" |
| 10 | +outputdir="./output/cms" |
| 11 | +logfile=$outputdir/openssl_cms.log |
| 12 | + |
| 13 | +# Start the results CSV file |
| 14 | +mkdir -p $outputdir |
| 15 | +printf "Build time: %s\n\n" "$(date)" | tee -a $logfile |
| 16 | + |
| 17 | +alreadyTestedSigOIDs=";" |
| 18 | +alreadyTestedKEMOIDs=";" |
| 19 | + |
| 20 | +check_signed_attrs() { |
| 21 | + signed_attrs=$1 |
| 22 | + ta_file=$2 |
| 23 | + |
| 24 | + openssl cms -verify -no_check_time -in $signed_attrs -inform DER -CAfile $ta_file |
| 25 | + if [ $? -ne 0 ]; then |
| 26 | + echo "ERROR: verifying signed attributes" | tee -a $logfile |
| 27 | + return 1 |
| 28 | + fi |
| 29 | + |
| 30 | + return 0 |
| 31 | +} |
| 32 | + |
| 33 | +# Requires an input: the TA file to test |
| 34 | +test_signed_attrs () { |
| 35 | + signed_attrs_file=$1 |
| 36 | + resultsfile=$2 |
| 37 | + |
| 38 | + output="" |
| 39 | + signed_attrs_filename=$(basename $signed_attrs_file) |
| 40 | + |
| 41 | + # strip off the friendly name |
| 42 | + signed_attrs_fileBasename=$(echo $signed_attrs_filename | egrep -o '[^-]*_signed_attrs.der$') |
| 43 | + |
| 44 | + # strip off the file suffix to get the OID name |
| 45 | + if [ $(expr match "$signed_attrs_fileBasename" ".*_signed_attrs\.der$") != 0 ]; then |
| 46 | + oid=${signed_attrs_fileBasename%_signed_attrs.der} |
| 47 | + else # It's some other filename |
| 48 | + printf "\nERROR: file name is not in the expected format: %s\n" $signed_attrs_file | tee -a $logfile |
| 49 | + return |
| 50 | + fi |
| 51 | + |
| 52 | + # some artifacts submit multiple copies of the same cert as .pem, .der, etc. Just skip the second one |
| 53 | + if [ $(expr match "$alreadyTestedSigOIDs" ".*\;$oid\;.*") != 0 ]; then |
| 54 | + printf "\nWarning: %s has been submitted multiple times by this provider. Skipping\n" $oid | tee -a $logfile |
| 55 | + return |
| 56 | + fi |
| 57 | + |
| 58 | + openssl list --signature-algorithms --kem-algorithms | grep " $oid," |
| 59 | + if [ $? != 0 ]; then |
| 60 | + printf "\nSkipping %s, unsupported\n" $signed_attrs_filename | tee -a $logfile |
| 61 | + return |
| 62 | + fi |
| 63 | + |
| 64 | + alreadyTestedSigOIDs=${alreadyTestedSigOIDs}$oid";" |
| 65 | + |
| 66 | + printf "\nTesting signed attributes %s\n" $signed_attrs_file | tee -a $logfile |
| 67 | + output+=$(check_signed_attrs $signed_attrs_file $(dirname $signed_attrs_file)/ta.der) |
| 68 | + status=$? |
| 69 | + if [ $status != 0 ]; then |
| 70 | + echo "Signed Attributes Result: FAIL" | tee -a $logfile |
| 71 | + echo "${oid},N" >> $resultsfile |
| 72 | + else |
| 73 | + echo "Signed Attributes Result: SUCCESS" | tee -a $logfile |
| 74 | + echo "${oid},Y" >> $resultsfile |
| 75 | + fi |
| 76 | + |
| 77 | + # log it to file and to stdout |
| 78 | + echo "$output" | tee -a $logfile |
| 79 | +} |
| 80 | + |
| 81 | +check_kemri() { |
| 82 | + eefile=$1 |
| 83 | + oid=$2 |
| 84 | + |
| 85 | + priv_key=$( find $(dirname $eefile) -name "*${oid}*_priv.der" -print -quit ) |
| 86 | + kemri_base=${eefile%_ee.der} |
| 87 | + for kemri_file in ${kemri_base}_kemri*.der; do |
| 88 | + if [[ "$kemri_file" == *"kmac"* ]]; then |
| 89 | + printf "\nSkipping KMAC %s\n" $kemri_file | tee -a $logfile |
| 90 | + continue |
| 91 | + fi |
| 92 | + OUTFILE=$(mktemp) |
| 93 | + rm -f $OUTFILE |
| 94 | + |
| 95 | + printf "\nTesting KEMRI %s\n" $kemri_file | tee -a $logfile |
| 96 | + |
| 97 | + openssl cms -decrypt -inform DER -in ${kemri_file} -recip ${eefile} \ |
| 98 | + -inkey ${priv_key} -keyform DER -out $OUTFILE |
| 99 | + if [ $? -ne 0 ]; then |
| 100 | + echo "ERROR: Decrypting KEMRI" | tee -a $logfile |
| 101 | + return 1 |
| 102 | + fi |
| 103 | + rm -f $OUTFILE |
| 104 | + done |
| 105 | + |
| 106 | + return 0 |
| 107 | +} |
| 108 | + |
| 109 | +# Requires an input: the TA file to test |
| 110 | +test_kemri() { |
| 111 | + eefile=$1 |
| 112 | + resultsfile=$2 |
| 113 | + |
| 114 | + output="" |
| 115 | + eefileBasename=$(basename $eefile) |
| 116 | + |
| 117 | + # strip off the friendly name |
| 118 | + eefileBasename=$(echo $eefileBasename | egrep -o '[^-]*_ee.der$') |
| 119 | + |
| 120 | + # strip off the file suffix to get the OID name |
| 121 | + if [ $(expr match "$eefileBasename" ".*_ee\.der$") != 0 ]; then |
| 122 | + oid=${eefileBasename%_ee.der} |
| 123 | + else # It's some other filename |
| 124 | + printf "\nERROR: file name is not in the expected format: %s\n" $eefile | tee -a $logfile |
| 125 | + return |
| 126 | + fi |
| 127 | + |
| 128 | + # some artifacts submit multiple copies of the same cert as .pem, .der, etc. Just skip the second one |
| 129 | + if [ $(expr match "$alreadyTestedKEMOIDs" ".*\;$oid\;.*") != 0 ]; then |
| 130 | + printf "\nWarning: %s has been submitted multiple times by this provider. Skipping\n" $oid | tee -a $logfile |
| 131 | + return |
| 132 | + fi |
| 133 | + |
| 134 | + openssl list --signature-algorithms --kem-algorithms | grep " $oid," |
| 135 | + if [ $? != 0 ]; then |
| 136 | + printf "\nSkipping %s, unsupported\n" $eefileBasename | tee -a $logfile |
| 137 | + return |
| 138 | + fi |
| 139 | + |
| 140 | + alreadyTestedKEMOIDs=${alreadyTestedKEMOIDs}$oid";" |
| 141 | + |
| 142 | + printf "\nTesting EE %s\n" $eefile | tee -a $logfile |
| 143 | + output+=$(check_kemri $eefile $oid) |
| 144 | + status=$? |
| 145 | + if [ $status != 0 ]; then |
| 146 | + echo "KemRecipientInfo Result: FAIL" | tee -a $logfile |
| 147 | + echo "${oid},N" >> $resultsfile |
| 148 | + else |
| 149 | + echo "KemRecipientInfo Result: SUCCESS" | tee -a $logfile |
| 150 | + echo "${oid},Y" >> $resultsfile |
| 151 | + fi |
| 152 | + |
| 153 | + # log it to file and to stdout |
| 154 | + echo "$output" | tee -a $logfile |
| 155 | +} |
| 156 | + |
| 157 | +# First, recurse into any provider dir |
| 158 | +for providerdir in $(ls -d $inputdir/*/); do |
| 159 | + provider=$(basename $providerdir) |
| 160 | + |
| 161 | + printf "\n**** BEGIN provider %s **** \n" $provider | tee -a $logfile |
| 162 | + |
| 163 | + # process certs |
| 164 | + zip=${providerdir}$cmszip |
| 165 | + if ! [ -f $zip ]; then |
| 166 | + continue |
| 167 | + fi |
| 168 | + unzipdir=${providerdir}$certsdir |
| 169 | + printf "\nUnzipping %s to %s\n" $zip $unzipdir | tee -a $logfile |
| 170 | + unzip -o $zip -d $unzipdir |
| 171 | + |
| 172 | + resultsfile=${outputdir}/${provider}_openssl.csv |
| 173 | + echo "key_algorithm_oid,type,test_result" > $resultsfile # CSV header row |
| 174 | + |
| 175 | + alreadyTestedSigOIDs=";" # for a guard to skip testing the same cert multiple times |
| 176 | + alreadyTestedKEMOIDs=";" # for a guard to skip testing the same cert multiple times |
| 177 | + # test each signed attributes fileartifact |
| 178 | + for signed_attrs_file in $(find $unzipdir \( -iname "*_signed_attrs.der" \)); do |
| 179 | + test_signed_attrs "$signed_attrs_file" "$resultsfile" |
| 180 | + done |
| 181 | + # test each KEMRI artifact |
| 182 | + for eefile in $(find $unzipdir \( -iname "*_ee.der" \)); do |
| 183 | + test_kemri "$eefile" "$resultsfile" |
| 184 | + done |
| 185 | + |
| 186 | + printf "\n**** DONE provider %s **** \n" $provider | tee -a $logfile |
| 187 | +done |
| 188 | + |
| 189 | +printf "\n**** DONE **** \n" | tee -a $logfile |
0 commit comments