1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
:
# $Id$
eval 'exec perl -w -S $0 ${1+"$@"}'
if 0;
my $openssl = "/u/sra/isc/route-pki/subvert-rpki.hactrn.net/openssl/trunk/apps/openssl";
exit unless (@ARGV);
open(F, "-|", "find", @ARGV, qw(-type f -name *.cer))
or die("Couldn't run find: $!\n");
chomp(my @files = <F>);
close(F);
# Convert to PEM ("openssl verify" is lame)
for (@files) {
my $f = $_;
s/\.cer$/.pem/; # This modifies @files
next if -f $_;
!system($openssl, qw(x509 -inform DER -in), $f, "-out", $_)
or die("Couldn't convert $f to PEM format: $!\n");
}
# Snarf all the AKI and SKI values from the certs we're examining
my %aki;
my %ski;
for my $f (@files) {
my ($a, $s);
open(F, "-|", $openssl, qw(x509 -noout -text -in), $f)
or die("Couldn't run openssl x509 on $f: $!\n");
while (<F>) {
chomp;
s/^\s*//;
s/^keyid://;
$a = $. + 1
if (/X509v3 Authority Key Identifier:/);
$s = $. + 1
if (/X509v3 Subject Key Identifier:/);
$aki{$f} = $_
if ($a && $. == $a);
$ski{$f} = $_
if ($s && $. == $s);
}
close(F);
}
# Figure out who everybody's parents are
my %daddy;
for my $f (@files) {
next unless ($aki{$f});
my @daddy = grep({ $ski{$_} eq $aki{$f} } @files);
$daddy{$f} = $daddy[0]
if (@daddy == 1 && $daddy[0] ne $f);
}
# Generate a test script based on all of the above
my $verbose = 1;
for my $f (@files) {
my @parents;
for (my $d = $daddy{$f}; $d; $d = $daddy{$d}) {
push(@parents, $d);
}
next unless (@parents);
print("echo ", "=" x 40, "\n",
"echo Checking chain:\n")
if ($verbose > 0);
for (($f, @parents)) {
print("echo ' File: $_'\n")
if ($verbose > 0);
print("$openssl x509 -noout -text -certopt no_header,no_signame,no_validity,no_pubkey,no_sigdump,no_version -in $_\n")
if ($verbose > 1);
}
print("cat >CAfile.pem");
print(" $_")
foreach (@parents);
print("\n",
"$openssl verify -verbose -CAfile CAfile.pem \\\n",
"\t$f\n",
"rm CAfile.pem\n");
}
|
