Skip to content

Commit 2a50b6d

Browse files
praveksharmapraveksharma
authored
Merge pull request #165 from romen/nt/oqs-prov-scripts
Update oqs-provider scripts for R4
2 parents 377b4b6 + abcc9dc commit 2a50b6d

13 files changed

+1137
-4
lines changed

‎.github/workflows/artifact_validation.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: Artifact validation
22

33
on:
4+
pull_request:
45
push:
56
branches: [ '*' ]
67

‎providers/oqs-provider/Makefile

+4-4
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@ PROVIDER_NAME := OQS
1111
DIRS := oqsprovider
1212

1313
# Script for Generating the artifacts (if any)
14-
GEN_SCRIPT := ./gen.sh
14+
GEN_SCRIPT := ./gen_r4.sh
1515
GEN_LOGFILE := logs/generate_log.txt
1616

1717
# Script for Verifying the artifacts (if any)
18-
VERIFY_SCRIPT := ./check.sh
18+
VERIFY_SCRIPT := ./check_r4.sh
1919
VERIFY_LOGFILE := logs/verify_log.txt
2020

2121
# Time
@@ -98,8 +98,8 @@ verify: requirements/verify
9898
echo "[ $(PROVIDER_NAME) ] Product: $$i" ; \
9999
echo "PRODUCT : $$i" >> "$(VERIFY_LOGFILE)" ; \
100100
echo >> "$(VERIFY_LOGFILE)" ; \
101-
result=`$(VERIFY_SCRIPT) "$$i" 2>&1 >> "$(VERIFY_LOGFILE)" `; \
102-
echo $$result >> "$(VERIFY_LOGFILE)" ; \
101+
result=`$(VERIFY_SCRIPT) "$$i" 2>>"$(VERIFY_LOGFILE)" | tee -a "$(VERIFY_LOGFILE)"`; \
102+
echo "$$result" >> "$(VERIFY_LOGFILE)" ; \
103103
echo >> "$(VERIFY_LOGFILE)"; \
104104
done ; \
105105
echo "----- END PROVIDER $(PROVIDER_NAME) -----" >> $(VERIFY_LOGFILE); \

‎providers/oqs-provider/artifacts_certs_r4.zip

92.6 KB
Binary file not shown.

‎providers/oqs-provider/ca.cnf

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
#
2+
# OpenSSL example configuration file.
3+
# See doc/man5/config.pod for more info.
4+
#
5+
# This is mostly being used for generation of certificate requests,
6+
# but may be used for auto loading of providers
7+
8+
# Note that you can include other files from the main configuration
9+
# file using the .include directive.
10+
.include oqsprov.cnf
11+
12+
####################################################################
13+
[ ca ] # The default CA section
14+
default_ca = CA_default # The default CA name
15+
16+
[ CA_default ] # Default settings for the intermediate CA
17+
dir = /root/oqsCA/intermediateCA # Intermediate CA directory
18+
certs = $dir/certs # Certificates directory
19+
crl_dir = $dir/crl # CRL directory
20+
new_certs_dir = $dir/newcerts # New certificates directory
21+
database = $dir/index.txt # Certificate index file
22+
serial = $dir/serial # Serial number file
23+
RANDFILE = $dir/private/.rand # Random number file
24+
private_key = $dir/private/intermediate.key.pem # Intermediate CA private key
25+
certificate = $dir/certs/intermediate.cert.pem # Intermediate CA certificate
26+
crl = $dir/crl/intermediate.crl.pem # Intermediate CA CRL
27+
crlnumber = $dir/crlnumber # Intermediate CA CRL number
28+
crl_extensions = crl_ext # CRL extensions
29+
default_crl_days = 30 # Default CRL validity days
30+
default_md = sha256 # Default message digest
31+
preserve = no # Preserve existing extensions
32+
email_in_dn = no # Exclude email from the DN
33+
name_opt = ca_default # Formatting options for names
34+
cert_opt = ca_default # Certificate output options
35+
policy = policy_loose # Certificate policy
36+
37+
[ policy_loose ] # Policy for less strict validation
38+
countryName = optional # Country is optional
39+
stateOrProvinceName = optional # State or province is optional
40+
localityName = optional # Locality is optional
41+
organizationName = optional # Organization is optional
42+
organizationalUnitName = optional # Organizational unit is optional
43+
commonName = supplied # Must provide a common name
44+
emailAddress = optional # Email address is optional
45+
46+
[ req ] # Request settings
47+
default_bits = 2048 # Default key size
48+
distinguished_name = req_distinguished_name # Default DN template
49+
string_mask = utf8only # UTF-8 encoding
50+
default_md = sha256 # Default message digest
51+
x509_extensions = v3_intermediate_ca # Extensions for intermediate CA certificate
52+
53+
[ req_distinguished_name ] # Template for the DN in the CSR
54+
countryName = CH
55+
stateOrProvinceName = State or Province Name
56+
localityName = Locality Name
57+
0.organizationName = Organization Name
58+
organizationalUnitName = Organizational Unit Name
59+
commonName = Common Name
60+
emailAddress = Email Address
61+
62+
[ v3_intermediate_ca ] # Intermediate CA certificate extensions
63+
subjectKeyIdentifier = hash # Subject key identifier
64+
authorityKeyIdentifier = keyid:always,issuer # Authority key identifier
65+
basicConstraints = critical, CA:true, pathlen:0 # Basic constraints for a CA
66+
keyUsage = critical, digitalSignature, cRLSign, keyCertSign # Key usage for a CA
67+
68+
[ crl_ext ] # CRL extensions
69+
authorityKeyIdentifier=keyid:always # Authority key identifier
70+
71+
[ server_cert ] # Server certificate extensions
72+
basicConstraints = CA:FALSE # Not a CA certificate
73+
nsCertType = server # Server certificate type
74+
keyUsage = critical, digitalSignature, keyEncipherment # Key usage for a server cert
75+
extendedKeyUsage = serverAuth # Extended key usage for server authentication purposes (e.g., TLS/SSL servers).
76+
authorityKeyIdentifier = keyid,issuer # Authority key identifier linking the certificate to the issuer's public key.
77+
authorityInfoAccess = OCSP;URI:http://ocsp.openquantumsafe.org
78+
79+
[ ocsp ]
80+
basicConstraints = CA:FALSE
81+
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
82+
extendedKeyUsage = OCSPSigning

‎providers/oqs-provider/check.sh

+193
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
function check_dir() {
6+
7+
# We want to check that the needed structures
8+
# are all in place
9+
DIR=$1
10+
11+
# Checks if we have the PEM version of the RootCA
12+
if ! [ -f "$DIR/ta/ta.pem" ]; then
13+
14+
# Checks for the RootCA in DER format
15+
if [ -f "$DIR/ta/ta.der" ] ; then
16+
17+
# Providing the PEM version of the RootCA
18+
echo "Converting $DIR/ta/ta.der to $DIR/ta/ta.pem ... "
19+
openssl x509 -inform DER -in "$DIR/ta/ta.der" -out "$DIR/ta/ta.pem"
20+
if [ $? -gt 0 ] ; then
21+
echo
22+
echo "ERROR: Cannot convert $DIR/ta/ta.der into PEM format"
23+
echo
24+
exit 1
25+
fi
26+
fi
27+
fi
28+
29+
# Checks if we have the PEM version of the
30+
# Intermediate CA
31+
if ! [ -f "$DIR/ca/ca.pem" ]; then
32+
33+
# Checks for the RootCA in DER format
34+
if [ -f "$DIR/ca/ca.der" ] ; then
35+
# Converts the DER into PEM
36+
openssl x509 -inform DER -in "$DIR/ca/ca.der" -out "$DIR/ca/ca.pem"
37+
if [ $? -gt 0 ] ; then
38+
echo
39+
echo "ERROR: Cannot convert $DIR/ca/ca.der into PEM format"
40+
echo
41+
exit 1
42+
fi
43+
fi
44+
fi
45+
46+
# Checks if we have the PEM version of the
47+
# EE cert
48+
if ! [ -f "$DIR/ee/cert.pem" ]; then
49+
# Checks for the EE cert in DER format
50+
if [ -f "$DIR/ee/cert.der" ] ; then
51+
# Converts the DER into PEM
52+
openssl x509 -inform DER -in "$DIR/ee/cert.der" -out "$DIR/ee/cert.pem"
53+
if [ $? -gt 0 ] ; then
54+
echo
55+
echo "ERROR: Cannot convert $DIR/ee/cert.der into PEM format"
56+
echo
57+
exit 1
58+
fi
59+
fi
60+
fi
61+
62+
}
63+
64+
check() {
65+
66+
# Extracts the argument
67+
DIR=$1
68+
result=""
69+
70+
# Change directory
71+
if ! [ -d "$DIR" ] ; then
72+
#echo "ERROR: missing dir $DIR"
73+
echo "N,N,N,N,N,N"
74+
return
75+
fi
76+
77+
# Change Directory
78+
cd "$DIR"
79+
80+
# Baseline test whether TA cert is well formed
81+
openssl x509 -in ta/ta.pem -text -noout 2>/dev/null > /dev/null
82+
if [ $? -ne 0 ]; then
83+
#echo "No suitable ta/ta.pem found."
84+
echo "N,N,N,N,N,N"
85+
return
86+
fi
87+
# Baseline test whether TA cert is self-signed
88+
openssl verify -CAfile ta/ta.pem ta/ta.pem 2>/dev/null >/dev/null
89+
if [ $? -ne 0 ]; then
90+
#echo "ta/ta.pem not self-signed."
91+
echo "N,N,N,N,N,N"
92+
return
93+
fi
94+
# Checking for some parsing errors
95+
openssl x509 -in ta/ta.pem -text -noout | grep error 2>/dev/null > /dev/null
96+
if [ $? -ne 0 ]; then
97+
#echo "No error parsing TA certificate in $1";
98+
# Extracting algorithm name
99+
openssl x509 -in ta/ta.pem -text -noout | grep "Public Key Algorithm" 2>&1 > /dev/null
100+
if [ $? -ne 0 ]; then
101+
echo "N,N,N,N,N,N"
102+
return
103+
fi
104+
# Verifying cert chain TA->CA
105+
openssl verify -CAfile ta/ta.pem ca/ca.pem 2>/dev/null >/dev/null
106+
if [ $? -ne 0 ]; then
107+
#echo "Error verifying $1/ca/ca.pem"
108+
echo "Y,N,N,N,N,N"
109+
return
110+
#else
111+
# echo "cert chain TA->CA verified for $1"
112+
fi
113+
else
114+
#echo "Error parsing TA certificate in $1"
115+
echo "N,N,N,N,N,N"
116+
return
117+
fi
118+
119+
# From this point on we know TA & CA are OK, so we collect specific test results
120+
ee_csr="N"
121+
ta_crl="N"
122+
ca_crl="N"
123+
124+
# Now check EE
125+
# First create cert chain
126+
cat ca/ca.pem ta/ta.pem > ca-chain.pem
127+
# then verify
128+
openssl verify -CAfile ca-chain.pem ee/cert.pem 2>/dev/null > /dev/null
129+
if [ $? -ne 0 ]; then
130+
#echo "Error verifying $1/ee/cert.pem"
131+
ee_crt="N"
132+
else
133+
ee_crt="Y"
134+
fi
135+
136+
if [ -f ee/cert.csr ]; then
137+
# EE CSR check
138+
openssl req -verify -in ee/cert.csr 2>/dev/null > /dev/null
139+
if [ $? -eq 0 ]; then
140+
ee_csr="Y"
141+
fi
142+
fi
143+
144+
if [ -f crl/crl_ta.crl ]; then
145+
# TA CRL check
146+
openssl crl -verify -in crl/crl_ta.crl -CAfile ta/ta.pem 2>/dev/null >/dev/null
147+
if [ $? -eq 0 ]; then
148+
ta_crl="Y"
149+
fi
150+
fi
151+
152+
if [ -f crl/crl_ca.crl ]; then
153+
# CA CRL check
154+
openssl crl -verify -in crl/crl_ca.crl -CAfile ca-chain.pem 2>/dev/null >/dev/null
155+
if [ $? -eq 0 ]; then
156+
ca_crl="Y"
157+
fi
158+
fi
159+
160+
# TODO: How to check OCSP artifact(s)??
161+
162+
echo "Y,Y,${ee_crt},${ee_csr},${ta_crl},${ca_crl}"
163+
cd ..
164+
}
165+
166+
if [ $# -ne 1 ]; then
167+
echo "No target directory to check provided. Exiting."
168+
exit -1
169+
else
170+
pushd $1 >/dev/null 2>/dev/null
171+
fi
172+
#echo "Checking in $(pwd)"
173+
if [ ! -d "artifacts" ]; then
174+
echo "No artifacts found. Exiting."
175+
exit -1
176+
fi
177+
cd artifacts
178+
echo "key_algorithm_oid,ta,ca,ee,csr,crl_ta,crl_ca"
179+
for oid_folder in *; do
180+
181+
target=${oid_folder}
182+
183+
# Executing the Check Script
184+
check_dir "${target}"
185+
if [ $? -ne 0 ]; then
186+
echo "${target},N,N,N,N,N,N"
187+
else
188+
result=$(check "${target}")
189+
echo "${target},${result}"
190+
fi
191+
192+
done
193+
popd 2>/dev/null >/dev/null

‎providers/oqs-provider/check_r3.sh

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
function check_cert() {
6+
7+
# We want to check that the needed structures
8+
# are all in place
9+
CERT=$1
10+
11+
# Checks if we have the PEM version of the RootCA
12+
if ! [ -f "$CERT.pem" ]; then
13+
14+
# Checks for the RootCA in DER format
15+
if [ -f "$CERT.der" ] ; then
16+
17+
# Providing the PEM version of the RootCA
18+
# echo "Converting $CERT.der to $CERT.pem ... "
19+
openssl x509 -inform DER -in "$CERT.der" -out "$CERT.pem"
20+
if [ $? -gt 0 ] ; then
21+
echo
22+
echo "ERROR: Cannot convert $CERT.der into PEM format"
23+
echo
24+
exit 1
25+
fi
26+
fi
27+
fi
28+
}
29+
30+
check() {
31+
32+
# Extracts the argument
33+
PEM=$1
34+
35+
# Baseline test whether TA cert is well formed
36+
openssl x509 -in $PEM -text -noout 2>/dev/null > /dev/null
37+
if [ $? -ne 0 ]; then
38+
# echo "${PEM} not suitable."
39+
echo "N"
40+
return
41+
fi
42+
# Baseline test whether TA cert is self-signed
43+
openssl verify -CAfile $PEM $PEM 2>/dev/null >/dev/null
44+
if [ $? -ne 0 ]; then
45+
echo "N"
46+
# echo "${PEM} not self-signed."
47+
return
48+
fi
49+
# Checking for some parsing errors
50+
openssl x509 -in $PEM -text -noout | grep error 2>/dev/null > /dev/null
51+
if [ $? -ne 0 ]; then
52+
#echo "No error parsing TA certificate in $1";
53+
# Extracting algorithm name
54+
openssl x509 -in $PEM -text -noout | grep "Public Key Algorithm" 2>&1 > /dev/null
55+
if [ $? -ne 0 ]; then
56+
echo "N"
57+
return
58+
fi
59+
else
60+
echo "N"
61+
# echo "Error parsing ${PEM}"
62+
return
63+
fi
64+
65+
echo "Y"
66+
cd ..
67+
}
68+
69+
if [ $# -ne 1 ]; then
70+
echo "No target directory to check provided. Exiting."
71+
exit -1
72+
else
73+
pushd $1 >/dev/null 2>/dev/null
74+
fi
75+
#echo "Checking in $(pwd)"
76+
if [ ! -d "artifacts" ]; then
77+
echo "No artifacts found. Exiting."
78+
exit -1
79+
fi
80+
cd artifacts
81+
echo "key_algorithm_oid,test_result"
82+
for oid_folder in 1*_ta.*; do
83+
target=$(echo $oid_folder | sed -r "s/(.*)_ta.*/\1/g")
84+
check_cert "${target}_ta"
85+
result=$(check "${target}_ta.pem")
86+
echo "${target},${result}"
87+
done
88+
popd 2>/dev/null >/dev/null

0 commit comments

Comments
 (0)