# $Id$ # Hack to generate a small test repository for testing Apache + OpenSSL + RPKI use strict; my %resources; my %parent; my @ordering; my %hashes; my $openssl = "../../openssl/trunk/apps/openssl"; my $subdir = "apacheca"; my $passwd = "fnord"; my $keybits = 2048; my $verbose = 0; my $debug = 1; sub openssl { print(STDERR join(" ", qw(+ openssl), @_), "\n") if ($debug); !system($openssl, @_) or die("openssl @_ returned $?\n"); } # Ok, this is a bit complicated, but the idea is to let us specify the # resources we're giving to each leaf entity and let the program do # the work of figuring out what resources each issuers need to have, # the order in which we need to generate the certificates, which # certificates need to sign which other certificates, etcetera. # # This would be much easier to read in a sane language (eg, Scheme). { my @ctx; my $loop ; $loop= sub { my $x = shift; if (ref($x) eq "HASH") { while (my ($k, $v) = each(%$x)) { $parent{$k} = $ctx[@ctx - 1]; push(@ordering, $k); push(@ctx, $k); $loop->($v); pop(@ctx); } } else { for my $c (@ctx) { push(@{$resources{$c}}, @$x) } } }; $loop->({ RIR => { LIR1 => { ISP1 => [IPv4 => "10.0.1.1-10.0.3.255", AS => "33"], ISP2 => [IPv4 => "10.3.0.0-10.3.0.255"], }, LIR2 => { ISP3 => [IPv6 => "2002::44-2002::100"], ISP4 => [IPv6 => "2002::10:0:44", AS => "44"], }, }, }); } # Put this stuff into a subdirectory mkdir($subdir) unless (-d $subdir); chdir($subdir) or die; # Generate configurations for each entity. while (my ($entity, $resources) = each(%resources)) { my %r; print($entity, ":\n") if ($verbose); for (my $i = 0; $i < @$resources; $i += 2) { printf(" %4s: %s\n", $resources->[$i], $resources->[$i+1]) if ($verbose); push(@{$r{$resources->[$i]}}, $resources->[$i+1]); } open(F, ">${entity}.cnf") or die; print(F "[ ca ]\n", "default_ca = ca_default\n", "\n", "[ ca_default ]\n", "\n", "certificate = ${entity}.cer\n", "serial = ${entity}/serial\n", "private_key = ${entity}.key\n", "database = ${entity}/index\n", "new_certs_dir = ${entity}\n", "name_opt = ca_default\n", "cert_opt = ca_default\n", "default_days = 365\n", "default_crl_days = 30\n", "default_md = sha1\n", "preserve = no\n", "copy_extensions = copy\n", "policy = ca_policy_anything\n", "unique_subject = no\n", "\n", "[ ca_policy_anything ]\n", "countryName = optional\n", "stateOrProvinceName = optional\n", "localityName = optional\n", "organizationName = optional\n", "organizationalUnitName = optional\n", "commonName = supplied\n", "emailAddress = optional\n", "givenName = optional\n", "surname = optional\n", "\n", "[ req ]\n", "default_bits = $keybits\n", "encrypt_key = no\n", "distinguished_name = req_dn\n", "x509_extensions = req_x509_ext\n", "prompt = no\n", "\n", "[ req_dn ]\n", "\n", "CN = TEST ENTITY $entity\n", "\n", "[ req_x509_ext ]\n", "\n", "basicConstraints = critical,CA:true\n", "subjectKeyIdentifier = hash\n", "authorityKeyIdentifier = keyid\n", "keyUsage = critical,keyCertSign,cRLSign\n", "subjectInfoAccess = 1.3.6.1.5.5.7.48.5;URI:rsync://wombats-r-us.hactrn.net/\n"); print(F "authorityInfoAccess = caIssuers;URI:rsync://wombats-r-us.hactrn.net/$parent{$entity}.cer\n") if ($parent{$entity}); print(F "sbgp-autonomousSysNum = critical,\@asid_ext\n") if ($r{AS} || $r{RDI}); print(F "sbgp-ipAddrBlock = critical,\@addr_ext\n") if ($r{IPv4} || $r{IPv6}); print(F "\n[ asid_ext ]\n\n"); for my $n (qw(AS RDI)) { my $i = 0; for my $a (@{$r{$n}}) { print(F $n, ".", $i++, " = ", $a, "\n"); } } print(F "\n[ addr_ext ]\n\n"); for my $n (qw(IPv4 IPv6)) { my $i = 0; for my $a (@{$r{$n}}) { print(F $n, ".", $i++, " = ", $a, "\n"); } } close(F); } # Run OpenSSL to create the keys and certificates. We generate keys # separately to avoid wasting /dev/random bits if we need to change # the configuration. for my $entity (@ordering) { openssl("genrsa", "-out", "${entity}.key", $keybits) unless (-f "${entity}.key"); openssl("req", "-new", "-config", "${entity}.cnf", "-key", "${entity}.key", "-out", "${entity}.req"); mkdir($entity) unless (-d $entity); if (!-f "${entity}/index") { open(F, ">${entity}/index") or die; close(F); } if (!-f "${entity}/serial") { open(F, ">${entity}/serial") or die; print(F "01\n") or die; close(F); } openssl("ca", "-batch", "-verbose", "-out", "${entity}.cer", "-in", "${entity}.req", "-extensions", "req_x509_ext", "-extfile", "${entity}.cnf", ($parent{$entity} ? ("-config", "${parent{$entity}}.cnf") : ("-config", "${entity}.cnf", "-selfsign"))); } # Generate CRLs for my $entity (@ordering) { openssl("ca", "-batch", "-verbose", "-out", "${entity}.crl", "-config", "${entity}.cnf", "-gencrl"); } # Generate EE certs for my $parent (@ordering) { my $entity = "${parent}-EE"; open(F, ">${entity}.cnf") or die; print(F "[ req ]\n", "default_bits = $keybits\n", "encrypt_key = no\n", "distinguished_name = req_dn\n", "x509_extensions = req_x509_ext\n", "prompt = no\n", "\n", "[ req_dn ]\n", "\n", "CN = TEST ENDPOINT ENTITY ${entity}\n", "\n", "[ req_x509_ext ]\n", "\n", "basicConstraints = critical,CA:false\n", "subjectKeyIdentifier = hash\n", "authorityKeyIdentifier = keyid\n", "subjectInfoAccess = 1.3.6.1.5.5.7.48.5;URI:rsync://wombats-r-us.hactrn.net/\n", "authorityInfoAccess = caIssuers;URI:rsync://wombats-r-us.hactrn.net/$parent.cer\n", "\n"); close(F); openssl("genrsa", "-out", "${entity}.key", $keybits) unless (-f "${entity}.key"); openssl("req", "-new", "-config", "${entity}.cnf", "-key", "${entity}.key", "-out", "${entity}.req"); mkdir($entity) unless (-d $entity); if (!-f "${entity}/index") { open(F, ">${entity}/index") or die; close(F); } if (!-f "${entity}/serial") { open(F, ">${entity}/serial") or die; print(F "01\n") or die; close(F); } openssl("ca", "-batch", "-verbose", "-config", "${parent}.cnf", "-extensions", "req_x509_ext", "-extfile", "${entity}.cnf", "-out", "${entity}.cer", "-in", "${entity}.req"); } # Generate hashes for my $cert (map({("$_.cer", "$_-EE.cer")} @ordering)) { my $hash = `openssl x509 -noout -hash -in $cert`; chomp($hash); $hash .= "." . (0 + $hashes{$hash}++); unlink($hash) if (-l $hash); symlink($cert, $hash) or die("Couldn't link $hash to $cert: $!\n"); } # Generate PKCS12 forms of EE certificates # -chain argument to pkcs12 requires certificate store, which we configure via an environment variable $ENV{SSL_CERT_DIR} = do { my $pwd = `pwd`; chomp($pwd); $pwd; }; for my $ee (map({"$_-EE"} @ordering)) { my @cmd = ("pkcs12", "-export", "-in", "$ee.cer", "-inkey", "$ee.key", "-password", "pass:$passwd"); openssl(@cmd, "-out", "$ee.p12"); openssl(@cmd, "-out", "$ee.chain.p12", "-chain"); } # Finally, generate an unrelated self-signed certificate for the server my $hostname = `hostname`; chomp($hostname); open(F, ">server.cnf") or die; print(F "[ req ]\n", "default_bits = $keybits\n", "encrypt_key = no\n", "distinguished_name = req_dn\n", "prompt = no\n", "\n", "[ req_dn ]\n", "\n", "CN = $hostname\n", "\n"); close(F); openssl(qw(genrsa -out server.key), $keybits) unless (-f "server.key"); openssl(qw(req -new -config server.cnf -key server.key -out server.req)); openssl(qw(x509 -req -CAcreateserial -in server.req -out server.cer -signkey server.key)); # Local Variables: # compile-command: "perl generate-testrepo.pl" # End: 0dd20f79ae'>563cfd2d 
35c1ca65

563cfd2d




35c1ca65

563cfd2d

c4be735c





e6047c9f

563cfd2d

c4be735c




a25c336c

c4be735c






a25c336c

84a57b72





c4be735c


84a57b72













39676701





d662ed08

84a57b72

























c4be735c

84a57b72



c4be735c

35c1ca65


a25c336c

















ce5fd146

a25c336c






de95fb95

a25c336c








84a57b72








39676701

84a57b72

f284e73a

84a57b72


70b403f2


84a57b72

84a57b72






84a57b72



39676701

84a57b72


39676701

84a57b72












fc2941d9

84a57b72




872f29ce

84a57b72










e4294830

84a57b72



























0382c289

84a57b72







84a57b72





a25c336c

de186b43






84a57b72


e7d6021d

84a57b72

e7d6021d

a25c336c


84a57b72


39676701

84a57b72



39676701

84a57b72


39676701

84a57b72









e7d6021d

84a57b72
















39676701

84a57b72


39676701





84a57b72


39676701

84a57b72






39676701

84a57b72






39676701

84a57b72




39676701

84a57b72





39676701

84a57b72



39676701

84a57b72



39676701

84a57b72





33f3a4bf



84a57b72

ae0149bf

84a57b72



ae0149bf

563cfd2d

ae0149bf

35c1ca65

ae0149bf


563cfd2d

392e608f

84a57b72

ae0149bf

84a57b72



ae0149bf

563cfd2d

ae0149bf




563cfd2d

392e608f

84a57b72

ae0149bf

84a57b72



ae0149bf

563cfd2d

ae0149bf





563cfd2d

392e608f

84a57b72

de186b43






563cfd2d

de186b43








563cfd2d

de186b43


a25c336c






















39676701


84a57b72




39676701

84a57b72

39676701

98dab02c

39676701


98dab02c

39676701

98dab02c

39676701


563cfd2d

a590075c



39676701





98dab02c

84a57b72

ae0149bf

84a57b72




50d2b46b




















503cbb89


35c1ca65

84a57b72


ae0149bf

84a57b72




7c26e04d

84a57b72











ae0149bf

84a57b72




39676701

ae0149bf

84a57b72










884a764b







84a57b72


e4294830





563cfd2d

84a57b72

39676701

84a57b72

a590075c

563cfd2d

ccc2eb01


563cfd2d

39676701

e4294830



84a57b72






06bedea0

94b35d3c



563cfd2d

94b35d3c



39676701

84a57b72

35c1ca65

84a57b72

































c18ac0ec

















401bbea9

c18ac0ec















401bbea9

c18ac0ec




84a57b72



563cfd2d




















84a57b72



563cfd2d


84a57b72

3519e811


84a57b72

84a57b72




563cfd2d

84a57b72


872f29ce

84a57b72







33f3a4bf

84a57b72

563cfd2d

33f3a4bf

c4be735c




84a57b72





563cfd2d

84a57b72



39676701

84a57b72

563cfd2d

33f3a4bf


35c1ca65

33f3a4bf


c18ac0ec


84a57b72

33f3a4bf



ae0149bf

c18ac0ec






84a57b72

c18ac0ec


84a57b72

33f3a4bf

c18ac0ec

84a57b72

33f3a4bf

84a57b72

c18ac0ec

95159437

06f4f438




98dab02c





84a57b72




84a57b72

98dab02c

84a57b72

39676701

59156463




98dab02c


59156463



98dab02c

563cfd2d

a5d3a0f9





875f38a7

563cfd2d

875f38a7

a5d3a0f9

33f3a4bf

98dab02c

875f38a7







33f3a4bf

875f38a7


563cfd2d

875f38a7






ddfb8c4e



875f38a7





563cfd2d

875f38a7





98dab02c

33f3a4bf




563cfd2d

33f3a4bf







563cfd2d

ae0149bf







de186b43

a25c336c

84a57b72

84a57b72


563cfd2d

33f3a4bf

392e608f



563cfd2d

392e608f


84a57b72



392e608f



84a57b72


568f018e

563cfd2d

568f018e













f1ea2169



568f018e

84a57b72


f1ea2169


568f018e

f1ea2169

84a57b72



563cfd2d


1
2

3
4

5

6
7

8
9

10

11

12
13
14

15

16
17
18

19

20
21
22
23
24
25
26
27
28
29

30

31

32

33
34
35
36

37

38

39
40
41
42
43

44

45

46
47
48
49

50

51
52
53
54
55
56

57

58
59
60
61
62

63
64

65
66
67
68
69
70
71
72
73
74
75
76
77

78
79
80
81
82

83

84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

109

110
111
112

113

114
115

116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

133

134
135
136
137
138
139

140

141
142
143
144
145
146
147
148

149
150
151
152
153
154
155
156

157

158

159

160
161

162
163

164

165
166
167
168
169
170

171
172
173

174

175
176

177

178
179
180
181
182
183
184
185
186
187
188
189

190

191
192
193
194

195

196
197
198
199
200
201
202
203
204
205

206

207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233

234

235
236
237
238
239
240
241

242
243
244
245
246

247

248
249
250
251
252
253

254
255

256

257

258

259
260

261
262

263

264
265
266

267

268
269

270

271
272
273
274
275
276
277
278
279

280

281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296

297

298
299

300
301
302
303
304

305
306

307

308
309
310
311
312
313

314

315
316
317
318
319
320

321

322
323
324
325

326

327
328
329
330
331

332

333
334
335

336

337
338
339

340

341
342
343
344
345

346
347
348

349

350

351
352
353

354

355

356

357

358
359

360

361

362

363

364
365
366

367

368

369
370
371
372

373

374

375

376

377
378
379

380

381

382
383
384
385
386

387

388

389

390
391
392
393
394
395

396

397
398
399
400
401
402
403
404

405

406
407

408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429

430
431

432
433
434
435

436

437

438

439

440
441

442

443

444

445
446

447

448
449
450

451
452
453
454
455

456

457

458

459
460
461
462

463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482

483
484

485

486
487

488

489
490
491
492

493

494
495
496
497
498
499
500
501
502
503
504

505

506
507
508
509

510

511

512
513
514
515
516
517
518
519
520
521

522
523
524
525
526
527
528

529
530

531
532
533
534
535

536

537

538

539

540

541

542
543

544

545

546
547
548

549
550
551
552
553
554

555

556
557
558

559

560
561
562

563

564

565

566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598

599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615

616

617
618
619
620
621
622
623
624
625
626
627
628
629
630
631

632

633
634
635
636

637
638
639

640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659

660
661
662

663
664

665

666
667

668

669
670
671
672

673

674
675

676

677
678
679
680
681
682
683

684

685

686

687

688
689
690
691

692
693
694
695
696

697

698
699
700

701

702

703

704
705

706

707
708

709
710

711

712
713
714

715

716
717
718
719
720
721

722

723
724

725

726

727

728

729

730

731

732

733
734
735
736

737
738
739
740
741

742
743
744
745

746

747

748

749

750
751
752
753

754
755

756
757
758

759

760

761
762
763
764
765

766

767

768

769

770

771

772
773
774
775
776
777
778

779

780
781

782

783
784
785
786
787
788

789
790
791

792
793
794
795
796

797

798
799
800
801
802

803

804
805
806
807

808

809
810
811
812
813
814
815

816

817
818
819
820
821
822
823

824

825

826

827
828

829

830

831
832
833

834

835
836

837
838
839

840
841
842

843
844

845

846

847
848
849
850
851
852
853
854
855
856
857
858
859

860
861
862

863

864
865

866
867

868

869

870
871
872

873
874