etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
gen_corpus.sh (2756B)
      1 #!/bin/bash
      2 # gen_corpus.sh - mint realistic DER seeds for the libksba harnesses with openssl.
      3 # Offline only: a throwaway mini-CA (conf/ca.cnf) signs a leaf, a CRL and an OCSP
      4 # response. Output: corpus/{cert,crl,cms,ocsp}/*.der
      5 set -euo pipefail
      6 
      7 SCRIPT_DIR="$(cd "$(dirname "${0}")" && pwd)"
      8 cd "${SCRIPT_DIR}"
      9 
     10 CADIR="$(mktemp -d)"
     11 export CADIR
     12 CONF="${SCRIPT_DIR}/conf/ca.cnf"
     13 trap 'rm -rf "${CADIR}"' EXIT
     14 
     15 log() { echo "[*] $*"; }
     16 ok()  { echo "[+] $*"; }
     17 
     18 mkdir -p corpus/cert corpus/crl corpus/cms corpus/ocsp
     19 mkdir -p "${CADIR}/newcerts"
     20 : > "${CADIR}/index.txt"
     21 echo 1000 > "${CADIR}/serial"
     22 echo 1000 > "${CADIR}/crlnumber"
     23 
     24 log "CA + leaf..."
     25 openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
     26     -keyout "${CADIR}/ca.key" -out "${CADIR}/ca.crt" \
     27     -subj "/CN=Fuzz Root CA/O=djnn/C=FR" \
     28     -addext "basicConstraints=critical,CA:TRUE" \
     29     -addext "keyUsage=critical,keyCertSign,cRLSign" 2>/dev/null
     30 
     31 openssl req -newkey rsa:2048 -nodes \
     32     -keyout "${CADIR}/leaf.key" -out "${CADIR}/leaf.csr" \
     33     -subj "/CN=leaf.example/O=djnn/C=FR" 2>/dev/null
     34 
     35 openssl ca -batch -config "${CONF}" -notext \
     36     -in "${CADIR}/leaf.csr" -out "${CADIR}/leaf.crt" 2>/dev/null
     37 
     38 openssl x509 -in "${CADIR}/ca.crt"   -outform DER -out corpus/cert/ca.der
     39 openssl x509 -in "${CADIR}/leaf.crt" -outform DER -out corpus/cert/leaf.der
     40 ok "cert seeds"
     41 
     42 log "CRL (empty + one revoked entry)..."
     43 openssl ca -batch -config "${CONF}" -gencrl -out "${CADIR}/crl-empty.pem" 2>/dev/null
     44 openssl crl -in "${CADIR}/crl-empty.pem" -outform DER -out corpus/crl/empty.der
     45 openssl ca -batch -config "${CONF}" -revoke "${CADIR}/leaf.crt" -crl_reason keyCompromise 2>/dev/null
     46 openssl ca -batch -config "${CONF}" -gencrl -out "${CADIR}/crl-revoked.pem" 2>/dev/null
     47 openssl crl -in "${CADIR}/crl-revoked.pem" -outform DER -out corpus/crl/revoked.der
     48 ok "CRL seeds"
     49 
     50 log "CMS / PKCS#7 signed..."
     51 echo "fuzz me" > "${CADIR}/msg.txt"
     52 openssl cms -sign -binary -nodetach -outform DER \
     53     -signer "${CADIR}/leaf.crt" -inkey "${CADIR}/leaf.key" \
     54     -in "${CADIR}/msg.txt" -out corpus/cms/signed.der 2>/dev/null
     55 ok "CMS seed"
     56 
     57 log "OCSP response (offline responder)..."
     58 if openssl ocsp -issuer "${CADIR}/ca.crt" -cert "${CADIR}/leaf.crt" \
     59         -reqout "${CADIR}/req.der" -no_nonce 2>/dev/null \
     60    && openssl ocsp -index "${CADIR}/index.txt" -CA "${CADIR}/ca.crt" \
     61         -rsigner "${CADIR}/ca.crt" -rkey "${CADIR}/ca.key" \
     62         -reqin "${CADIR}/req.der" -respout corpus/ocsp/resp.der -no_nonce 2>/dev/null; then
     63     ok "OCSP seed"
     64 else
     65     echo "[!] OCSP seed skipped (openssl ocsp responder unavailable); seeding with cert DER"
     66     cp corpus/cert/leaf.der corpus/ocsp/leaf.der
     67 fi
     68 
     69 echo
     70 ok "corpus ready:"
     71 find corpus -type f -printf '    %p (%s bytes)\n' | sort