Skip to content

Commit 88d5659

Browse files
aidangarskeaidangarske
committed
Make openssl-verify.sh actually verify and actually fail
1 parent bee99c9 commit 88d5659

1 file changed

Lines changed: 50 additions & 28 deletions

File tree

‎pkcs7/scripts/openssl-verify.sh‎

Lines changed: 50 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
# generate the necessary DER-encoded bundles.
1919

2020
EXPECTED_INNER_CONTENT="Hello World"
21+
FAILURES=0
2122
INNER_CONTENT_FILE="content.txt"
2223
AES256_KEY="0102030405060708010203040506070801020304050607080102030405060708"
2324
AES256_KEYID="02020304"
@@ -36,8 +37,12 @@ if ! [ -x "$(command -v openssl)" ]; then
3637
fi
3738

3839

39-
# Run all example applications that exist
40-
eval "./scripts/runall.sh"
40+
# Run all example applications that exist. Its status must gate the run: an app
41+
# that failed produces no bundle, and a missing bundle is skipped silently below.
42+
if ! ./scripts/runall.sh; then
43+
echo "runall.sh reported a failure; not treating the run as verified"
44+
FAILURES=$((FAILURES + 1))
45+
fi
4146

4247
echo ''
4348
echo '---------------------------------------------'
@@ -54,6 +59,7 @@ if [ -f 'encryptedData.der' ]; then
5459
echo -e '\tencryptedData.der:\t\t\t\tPASSED!'
5560
else
5661
echo -e '\tencryptedData.der:\t\t\t\tFAILED!'
62+
FAILURES=$((FAILURES + 1))
5763
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
5864
fi
5965
fi
@@ -62,13 +68,20 @@ fi
6268
# Trying to verify CompressedData bundle(s)
6369
echo -e "\nVerifying CompressedData Bundles:"
6470
if [ -f 'compressedData.der' ]; then
65-
OUTPUT=$(openssl cms -uncompress -in compressedData.der -inform der)
66-
67-
if [ "$OUTPUT" == "$EXPECTED_INNER_CONTENT" ]; then
68-
echo -e '\tcompressedData.der:\t\t\t\tPASSED!'
71+
# cms -uncompress needs an openssl built with zlib. Ubuntu's is not, so this
72+
# is an openssl capability gap, not an example failure.
73+
if openssl version -f 2>/dev/null | grep -q zlib; then
74+
OUTPUT=$(openssl cms -uncompress -in compressedData.der -inform der)
75+
76+
if [ "$OUTPUT" == "$EXPECTED_INNER_CONTENT" ]; then
77+
echo -e '\tcompressedData.der:\t\t\t\tPASSED!'
78+
else
79+
echo -e '\tcompressedData.der:\t\t\t\tFAILED!'
80+
FAILURES=$((FAILURES + 1))
81+
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
82+
fi
6983
else
70-
echo -e '\tcompressedData.der:\t\t\t\tFAILED!'
71-
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
84+
echo -e '\tcompressedData.der:\t\t\t\tSKIPPED (openssl has no zlib)'
7285
fi
7386
fi
7487

@@ -82,6 +95,7 @@ if [ -f 'envelopedDataKTRI.der' ]; then
8295
echo -e '\tenvelopedDataKTRI.der:\t\t\t\tPASSED!'
8396
else
8497
echo -e '\tenvelopedDataKTRI.der:\t\t\t\tFAILED!'
98+
FAILURES=$((FAILURES + 1))
8599
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
86100
fi
87101
fi
@@ -93,6 +107,7 @@ if [ -f 'envelopedDataKARI.der' ]; then
93107
echo -e '\tenvelopedDataKARI.der:\t\t\t\tPASSED!'
94108
else
95109
echo -e '\tenvelopedDataKARI.der:\t\t\t\tFAILED!'
110+
FAILURES=$((FAILURES + 1))
96111
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
97112
fi
98113
fi
@@ -104,6 +119,7 @@ if [ -f 'envelopedDataKEKRI.der' ]; then
104119
echo -e '\tenvelopedDataKEKRI.der:\t\t\t\tPASSED!'
105120
else
106121
echo -e '\tenvelopedDataKEKRI.der:\t\t\t\tFAILED!'
122+
FAILURES=$((FAILURES + 1))
107123
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
108124
fi
109125
fi
@@ -115,6 +131,7 @@ if [ -f 'envelopedDataPWRI.der' ]; then
115131
echo -e '\tenvelopedDataPWRI.der:\t\t\t\tPASSED!'
116132
else
117133
echo -e '\tenvelopedDataPWRI.der:\t\t\t\tFAILED!'
134+
FAILURES=$((FAILURES + 1))
118135
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
119136
fi
120137
fi
@@ -126,90 +143,95 @@ echo -e "\t[SKIPPING - openssl app doesn't support yet]"
126143
# Trying to verify SignedData bundle(s)
127144
echo -e "\nVerifying SignedData Bundles:"
128145
if [ -f 'signedData_attrs.der' ]; then
129-
OUTPUT=$(openssl cms -verify -in signedData_attrs.der -inform der -CAfile $RSA_RECIP_CERT 2>/dev/null)
146+
OUTPUT=$(openssl cms -verify -in signedData_attrs.der -inform der -CAfile $RSA_RECIP_CERT -purpose any 2>/dev/null)
130147

131148
if [ "$OUTPUT" == "$EXPECTED_INNER_CONTENT" ]; then
132149
echo -e '\tsignedData_attrs.der:\t\t\t\tPASSED!'
133150
else
134151
echo -e '\tsignedData_attrs.der:\t\t\t\tFAILED!'
152+
FAILURES=$((FAILURES + 1))
135153
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
136154
fi
137155
fi
138156

139157
if [ -f 'signedData_noattrs.der' ]; then
140-
OUTPUT=$(openssl cms -verify -in signedData_noattrs.der -inform der -CAfile $RSA_RECIP_CERT 2>/dev/null)
158+
OUTPUT=$(openssl cms -verify -in signedData_noattrs.der -inform der -CAfile $RSA_RECIP_CERT -certfile $RSA_RECIP_CERT -purpose any 2>/dev/null)
141159

142160
if [ "$OUTPUT" == "$EXPECTED_INNER_CONTENT" ]; then
143161
echo -e '\tsignedData_noattrs.der:\t\t\t\tPASSED!'
144162
else
145163
echo -e '\tsignedData_noattrs.der:\t\t\t\tFAILED!'
164+
FAILURES=$((FAILURES + 1))
146165
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
147166
fi
148167
fi
149168

150169
if [ -f 'signedFirmwarePkgData_attrs.der' ]; then
151-
OUTPUT=$(openssl cms -verify -in signedFirmwarePkgData_attrs.der -inform der -CAfile $RSA_RECIP_CERT 2>/dev/null)
170+
OUTPUT=$(openssl cms -verify -in signedFirmwarePkgData_attrs.der -inform der -CAfile $RSA_RECIP_CERT -purpose any 2>/dev/null)
152171

153172
if [ "$OUTPUT" == "$EXPECTED_INNER_CONTENT" ]; then
154173
echo -e '\tsignedFirmwarePkgData_attrs.der:\t\tPASSED!'
155174
else
156175
echo -e '\tsignedFirmwarePkgData_attrs.der:\t\tFAILED!'
176+
FAILURES=$((FAILURES + 1))
157177
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
158178
fi
159179
fi
160180

161181
if [ -f 'signedFirmwarePkgData_noattrs.der' ]; then
162-
OUTPUT=$(openssl cms -verify -in signedFirmwarePkgData_noattrs.der -inform der -CAfile $RSA_RECIP_CERT 2>/dev/null)
182+
OUTPUT=$(openssl cms -verify -in signedFirmwarePkgData_noattrs.der -inform der -CAfile $RSA_RECIP_CERT -purpose any 2>/dev/null)
163183

164184
if [ "$OUTPUT" == "$EXPECTED_INNER_CONTENT" ]; then
165185
echo -e '\tsignedFirmwarePkgData_noattrs.der:\t\tPASSED!'
166186
else
167187
echo -e '\tsignedFirmwarePkgData_noattrs.der:\t\tFAILED!'
188+
FAILURES=$((FAILURES + 1))
168189
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
169190
fi
170191
fi
171192

172193
if [ -f 'signedData_detached_attrs.der' ]; then
173-
OUTPUT=$(openssl cms -verify -in signedData_detached_attrs.der -inform der -CAfile $RSA_RECIP_CERT -content $INNER_CONTENT_FILE 2>/dev/null)
194+
OUTPUT=$(openssl cms -verify -in signedData_detached_attrs.der -inform der -CAfile $RSA_RECIP_CERT -purpose any -content $INNER_CONTENT_FILE 2>/dev/null)
174195

175196
if [ "$OUTPUT" == "$EXPECTED_INNER_CONTENT" ]; then
176197
echo -e '\tsignedData_detached_attrs.der:\t\t\tPASSED!'
177198
else
178199
echo -e '\tsignedData_detached_attrs.der:\t\t\tFAILED!'
200+
FAILURES=$((FAILURES + 1))
179201
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
180202
fi
181203
fi
182204

183205
if [ -f 'signedData_detached_noattrs.der' ]; then
184-
OUTPUT=$(openssl cms -verify -in signedData_detached_noattrs.der -inform der -CAfile $RSA_RECIP_CERT -content $INNER_CONTENT_FILE 2>/dev/null)
206+
OUTPUT=$(openssl cms -verify -in signedData_detached_noattrs.der -inform der -CAfile $RSA_RECIP_CERT -purpose any -content $INNER_CONTENT_FILE 2>/dev/null)
185207

186208
if [ "$OUTPUT" == "$EXPECTED_INNER_CONTENT" ]; then
187209
echo -e '\tsignedData_detached_noattrs.der:\t\tPASSED!'
188210
else
189211
echo -e '\tsignedData_detached_noattrs.der:\t\tFAILED!'
212+
FAILURES=$((FAILURES + 1))
190213
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
191214
fi
192215
fi
193216

194-
if [ -f 'signedData_cryptodev_attrs.der' ]; then
195-
OUTPUT=$(openssl cms -verify -in signedData_cryptodev_attrs.der -inform der -CAfile $RSA_RECIP_CERT 2>/dev/null)
217+
if [ -f 'signedData_cryptocb.der' ]; then
218+
# signedData-cryptocb signs with the ECC client cert, not the RSA one.
219+
OUTPUT=$(openssl cms -verify -in signedData_cryptocb.der -inform der -CAfile $ECC_RECIP_CERT -purpose any 2>/dev/null)
196220

197221
if [ "$OUTPUT" == "$EXPECTED_INNER_CONTENT" ]; then
198-
echo -e '\tsignedData_cryptodev_attrs.der:\t\t\tPASSED!'
222+
echo -e '\tsignedData_cryptocb.der:\t\t\tPASSED!'
199223
else
200-
echo -e '\tsignedData_cryptodev_attrs.der:\t\t\tFAILED!'
224+
echo -e '\tsignedData_cryptocb.der:\t\t\tFAILED!'
225+
FAILURES=$((FAILURES + 1))
201226
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
202227
fi
228+
else
229+
echo -e '\tsignedData_cryptocb.der:\t\t\tSKIPPED (needs --enable-cryptocb)'
203230
fi
204231

205-
if [ -f 'signedData_cryptodev_noattrs.der' ]; then
206-
OUTPUT=$(openssl cms -verify -in signedData_cryptodev_noattrs.der -inform der -CAfile $RSA_RECIP_CERT 2>/dev/null)
207-
208-
if [ "$OUTPUT" == "$EXPECTED_INNER_CONTENT" ]; then
209-
echo -e '\tsignedData_cryptodev_noattrs.der:\t\tPASSED!'
210-
else
211-
echo -e '\tsignedData_cryptodev_noattrs.der:\t\tFAILED!'
212-
echo -e "\t... output = $OUTPUT, expected '$EXPECTED_INNER_CONTENT'"
213-
fi
232+
if [ "$FAILURES" -ne 0 ]; then
233+
echo "$FAILURES openssl verification(s) FAILED"
234+
exit 1
214235
fi
215-
236+
echo "all openssl verifications passed"
237+
exit 0

0 commit comments

Comments
 (0)