From 01f96d30f6b533fc300f76be8a6cffcda5283748 Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Tue, 12 Mar 2024 11:30:34 +0000 Subject: [PATCH] genprotimg/samples/check_hostkeydoc: fix ShellCheck findings Fix ShellCheck findings and two typos. White spaces in filenames are now supported properly. Reviewed-by: Christoph Schlameuss Reviewed-by: Steffen Eiden Signed-off-by: Marc Hartmayer Signed-off-by: Steffen Eiden --- genprotimg/samples/check_hostkeydoc | 113 ++++++++++++++-------------- 1 file changed, 58 insertions(+), 55 deletions(-) diff --git a/genprotimg/samples/check_hostkeydoc b/genprotimg/samples/check_hostkeydoc index 00eff0a7..81da6347 100755 --- a/genprotimg/samples/check_hostkeydoc +++ b/genprotimg/samples/check_hostkeydoc @@ -4,7 +4,7 @@ # # Sample script to verify that a host key document is genuine by # verifying the issuer, the validity date and the signature. -# Optionally verify the full trust chain using a CA certficate. +# Optionally verify the full trust chain using a CA certificate. # # Sample invocation: # @@ -30,17 +30,20 @@ CRL_SERIAL_FILE=$(mktemp) # Cleanup on exit cleanup() { - rm -f $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE \ - $ISSUER_DN_FILE $SUBJECT_DN_FILE $DEF_ISSUER_ARMONK_DN_FILE $DEF_ISSUER_POUGHKEEPSIE_DN_FILE \ - $CANONICAL_ISSUER_DN_FILE $CRL_SERIAL_FILE + rm -f "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" \ + "$ISSUER_DN_FILE" "$SUBJECT_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" \ + "$CANONICAL_ISSUER_DN_FILE" "$CRL_SERIAL_FILE" } trap cleanup EXIT # Enhanced error checking for bash if [ -n "${BASH}" ] then + # shellcheck disable=SC3040 set -o posix + # shellcheck disable=SC3040 set -o pipefail + # shellcheck disable=SC3040 set -o nounset fi set -e @@ -49,7 +52,7 @@ set -e usage() { cat <<-EOF -Usage: `basename $1` [-d] [-c CA-cert] [-r CRL] host-key-doc signing-key-cert +Usage: $(basename "$1") [-d] [-c CA-cert] [-r CRL] host-key-doc signing-key-cert Verify an IBM Secure Execution host key document against a signing key. @@ -72,7 +75,7 @@ check_verify_chain() { # Verify certificate chain in case a CA certificate file/bundle # was specified on the command line. - if [ $# = 1 ] + if [ -z "$2" ] then cat >&2 <<-EOF !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! @@ -81,37 +84,37 @@ Make sure that '$1' is a valid certificate. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! EOF else - openssl verify -crl_download -crl_check $2 && - openssl verify -crl_download -crl_check -untrusted $2 $1 || + openssl verify -crl_download -crl_check "$2" && + openssl verify -crl_download -crl_check -untrusted "$2" "$1" || exit 1 fi } extract_pubkey() { - openssl x509 -in $1 -pubkey -noout > $2 + openssl x509 -in "$1" -pubkey -noout > "$2" } extract_signature() { # Assuming that the last field is the signature - SIGOFFSET=$(openssl asn1parse -in $1 | tail -1 | cut -d : -f 1) + SIGOFFSET=$(openssl asn1parse -in "$1" | tail -1 | cut -d : -f 1) - openssl asn1parse -in $1 -out $2 -strparse $SIGOFFSET -noout + openssl asn1parse -in "$1" -out "$2" -strparse "$SIGOFFSET" -noout } extract_body() { # Assuming that the first field is the full cert body - SIGOFFSET=$(openssl asn1parse -in $1 | head -2 | tail -1 | cut -d : -f 1) + SIGOFFSET=$(openssl asn1parse -in "$1" | head -2 | tail -1 | cut -d : -f 1) - openssl asn1parse -in $1 -out $2 -strparse $SIGOFFSET -noout + openssl asn1parse -in "$1" -out "$2" -strparse "$SIGOFFSET" -noout } verify_signature() { # Assuming that the signature algorithm is SHA512 with RSA - openssl sha512 -verify $1 -signature $2 $3 + openssl sha512 -verify "$1" -signature "$2" "$3" } canonical_dn() @@ -121,8 +124,8 @@ canonical_dn() DNTYPE=$3 OUTPUT=$4 - openssl $OBJTYPE -in $OBJ -$DNTYPE -noout -nameopt multiline \ - | LC_ALL=C sort | grep -v $DNTYPE= > $OUTPUT + openssl "$OBJTYPE" -in "$OBJ" -"$DNTYPE" -noout -nameopt multiline \ + | LC_ALL=C sort | grep -v "$DNTYPE"= > "$OUTPUT" } default_issuer_armonk() @@ -154,14 +157,14 @@ EOF # stripping off the prefix verify_default_issuer() { - default_issuer_pougkeepsie > $DEF_ISSUER_POUGHKEEPSIE_DN_FILE - default_issuer_armonk > $DEF_ISSUER_ARMONK_DN_FILE + default_issuer_pougkeepsie > "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" + default_issuer_armonk > "$DEF_ISSUER_ARMONK_DN_FILE" sed "s/\(^[ ]*organizationalUnitName[ ]*=[ ]*\).*\(Key Signing Service$\)/\1\2/" \ - $ISSUER_DN_FILE > $CANONICAL_ISSUER_DN_FILE + "$ISSUER_DN_FILE" > "$CANONICAL_ISSUER_DN_FILE" - if ! { diff $CANONICAL_ISSUER_DN_FILE $DEF_ISSUER_POUGHKEEPSIE_DN_FILE || - diff $CANONICAL_ISSUER_DN_FILE $DEF_ISSUER_ARMONK_DN_FILE; } >/dev/null 2>&1 + if ! { diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_POUGHKEEPSIE_DN_FILE" || + diff "$CANONICAL_ISSUER_DN_FILE" "$DEF_ISSUER_ARMONK_DN_FILE"; } >/dev/null 2>&1 then echo Incorrect default issuer >&2 && exit 1 fi @@ -169,7 +172,7 @@ verify_default_issuer() verify_issuer_files() { - if [ $1 -eq 1 ] + if [ "$1" -eq 1 ] then verify_default_issuer fi @@ -177,14 +180,14 @@ verify_issuer_files() cert_time() { - DATE=$(openssl x509 -in $1 -$2 -noout | sed "s/^.*=//") + DATE=$(openssl x509 -in "$1" -"$2" -noout | sed "s/^.*=//") date -d "$DATE" +%s } crl_time() { - DATE=$(openssl crl -in $1 -$2 -noout | sed "s/^.*=//") + DATE=$(openssl crl -in "$1" -"$2" -noout | sed "s/^.*=//") date -d "$DATE" +%s } @@ -196,7 +199,7 @@ verify_dates() MSG="${3:-Certificate}" NOW=$(date +%s) - if [ $START -le $NOW -a $NOW -le $END ] + if [ "$START" -le "$NOW" ] && [ "$NOW" -le "$END" ] then echo "${MSG} dates are OK" else @@ -206,20 +209,19 @@ verify_dates() crl_serials() { - openssl crl -in $1 -text -noout | \ - grep "Serial Number" > $CRL_SERIAL_FILE + openssl crl -in "$1" -text -noout | \ + grep "Serial Number" > "$CRL_SERIAL_FILE" } check_serial() { - CERT_SERIAL=$(openssl x509 -in $1 -noout -serial | cut -d = -f 2) + CERT_SERIAL=$(openssl x509 -in "$1" -noout -serial | cut -d = -f 2) - grep -q $CERT_SERIAL $CRL_SERIAL_FILE + grep -q "$CERT_SERIAL" "$CRL_SERIAL_FILE" } check_file() { - [ $# = 0 ] || [ -e "$1" ] || (echo "File '$1' not found" >&2 && exit 1) } @@ -248,7 +250,7 @@ shift "$((OPTIND - 1))" if [ $# -ne 2 ] then - usage $0 >&2 + usage "$0" >&2 exit 1 fi @@ -256,51 +258,52 @@ HKD_FILE=$1 HKSK_FILE=$2 # Check whether all specified files exist -check_file $HKD_FILE -check_file $HKSK_FILE -check_file $CA_FILE -check_file $CRL_FILE +check_file "$HKD_FILE" +check_file "$HKSK_FILE" +# CA and CRL are optional arguments +[ -n "$CA_FILE" ] && check_file "$CA_FILE" +[ -n "$CRL_FILE" ] && check_file "$CRL_FILE" # Check trust chain -check_verify_chain $HKSK_FILE $CA_FILE +check_verify_chain "$HKSK_FILE" "$CA_FILE" # Verify host key document signature -echo -n "Checking host key document signature: " -extract_pubkey $HKSK_FILE $ISSUER_PUBKEY_FILE && -extract_signature $HKD_FILE $SIGNATURE_FILE && -extract_body $HKD_FILE $BODY_FILE && -verify_signature $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE || +printf "Checking host key document signature: " +extract_pubkey "$HKSK_FILE" "$ISSUER_PUBKEY_FILE" && +extract_signature "$HKD_FILE" "$SIGNATURE_FILE" && +extract_body "$HKD_FILE" "$BODY_FILE" && +verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" || exit 1 # Verify the issuer -canonical_dn x509 $HKD_FILE issuer $ISSUER_DN_FILE -canonical_dn x509 $HKSK_FILE subject $SUBJECT_DN_FILE +canonical_dn x509 "$HKD_FILE" issuer "$ISSUER_DN_FILE" +canonical_dn x509 "$HKSK_FILE" subject "$SUBJECT_DN_FILE" verify_issuer_files $CHECK_DEFAULT_ISSUER # Verify dates -verify_dates $(cert_time $HKD_FILE startdate) $(cert_time $HKD_FILE enddate) +verify_dates "$(cert_time "$HKD_FILE" startdate)" "$(cert_time "$HKD_FILE" enddate)" # Check CRL if specified if [ -n "$CRL_FILE" ] then - echo -n "Checking CRL signature: " - extract_signature $CRL_FILE $SIGNATURE_FILE && - extract_body $CRL_FILE $BODY_FILE && - verify_signature $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE || + printf "Checking CRL signature: " + extract_signature "$CRL_FILE" "$SIGNATURE_FILE" && + extract_body "$CRL_FILE" "$BODY_FILE" && + verify_signature "$ISSUER_PUBKEY_FILE" "$SIGNATURE_FILE" "$BODY_FILE" || exit 1 - echo -n "CRL " - canonical_dn crl $CRL_FILE issuer $ISSUER_DN_FILE - canonical_dn x509 $HKSK_FILE subject $SUBJECT_DN_FILE + printf "CRL " + canonical_dn crl "$CRL_FILE" issuer "$ISSUER_DN_FILE" + canonical_dn x509 "$HKSK_FILE" subject "$SUBJECT_DN_FILE" verify_issuer_files $CHECK_DEFAULT_ISSUER - verify_dates $(crl_time $CRL_FILE lastupdate) $(crl_time $CRL_FILE nextupdate) 'CRL' + verify_dates "$(crl_time "$CRL_FILE" lastupdate)" "$(crl_time "$CRL_FILE" nextupdate)" 'CRL' - crl_serials $CRL_FILE - check_serial $HKD_FILE && + crl_serials "$CRL_FILE" + check_serial "$HKD_FILE" && echo "Certificate is revoked, do not use it anymore!" >&2 && exit 1 fi # We made it -echo All checks reqested for \'$HKD_FILE\' were successful +echo All checks requested for \'"$HKD_FILE"\' were successful