diff --git a/x509/ldapcrl_checkserial.sh b/x509/ldapcrl_checkserial.sh new file mode 100755 index 0000000000000000000000000000000000000000..4d886657dc643e9f2a5e0b0fc115fc4c92debddc --- /dev/null +++ b/x509/ldapcrl_checkserial.sh @@ -0,0 +1,239 @@ +#!/bin/bash +# +# ldapcrl_checkserial.sh +# +# Copyright (C) 2013, PrimeKey Solutions AB +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +program="ldapcrl_checkserial.sh" +version="0.1" + +function usage() { + cat <. +EOF +} + +function version() { + cat <. | ++-----------------------------------------------------------------------+ + +EOF +} + +# If no arguments were given, just show usage help. +if [[ -z $1 ]]; then + usage + exit 0 +fi + +# Set-up default parameters +ldapOptions=() +crlAttribute="certificateRevocationList" + +# Parse the arguments +while getopts "L:a:vh" opt; do + case "$opt" in + L) ldapOptions+=("$OPTARG");; + a) crlAttribute="$OPTARG";; + v) version + exit 0;; + h) usage + exit 0;; + *) usage + exit 1;; + esac +done +i=$OPTIND +shift $(($i-1)) + +# Read the positional arguments. +issuer="$1" +serial="$2" + +# Verify the arguments. +if [[ -z $issuer ]]; then + echo "Issuer was not specified." >&2 + exit 3 +fi +if [[ -z $serial ]]; then + echo "Serial number was not specified." >&2 + exit 3 +fi +if [[ ! $serial =~ ^[0123456789abcdefABCDEF]+$ ]]; then + echo "Invalid serial number specified: '$serial'" >&2 + echo "Serial number may contain the following characters: 0123456789abcdefABCDEF" >&2 + exit 3 +fi + +# Start assembling the ldapsearch command. Remove the cruft from output +# (comments etc), and also disable wrapping of long line.x +command=("ldapsearch" "-LLL" "-oldif-wrap=no") +# Pass the user-provided options. +command+=("${ldapOptions[@]}") +# Look only for entities that have the request CRL attribute, and return only +# that attribute. +command+=("(${crlAttribute}=*)") +command+=("${crlAttribute}") + +# Perform the ldap search. Store the result. Bail-out if an error has happened. +if ! searchResult=$("${command[@]}"); then + echo "Failed to perform ldapsearch with the provided options." >&2 + exit 10 +fi + +# Keep track of how many CRLs from the issuer have been processed, how many of +# those did contain (matched) the serial number, and how many of those did _not_ +# contain the serial number (non-matches). +processed=0 +matches=0 +nonMatches=0 + +# Output a useful begin message. +echo "CRL Issuer: $issuer" +echo "Serial number: $serial" +echo + +# Parse the LDAP search result. +while read line; do + # Have we encountered the DN attribute? + if [[ $line =~ ^dn: ]]; then + dn="${line#*: }" + # Have we encountered the CRL? + elif [[ $line =~ ^$crlAttribute ]]; then + crl="${line#*:: }" + # If we have reached a blank line, that means we can process our DN and CRL now. + elif [[ $line =~ ^$ && dn != "" && crl != "" ]]; then + # Get the CRL issuer from the list. + crlIssuer=$(echo $crl | base64 --decode | openssl crl -noout -inform DER -issuer | sed -e 's#^issuer=/##;s#/#,#g') + + # If the CRL was issued by requested issuer, process it. + if [[ $crlIssuer == $issuer ]]; then + echo "Located CRL for issuer under DN '$dn'." + let processed++ + + # Check if the requested serial number is present in the CRL. + if echo "$crl" | base64 --decode| openssl crl -inform DER -noout -text | grep 'Serial Number' \ + | sed -e 's/[[:blank:]]*Serial Number: //' | grep -q -i "^${serial}$"; then + echo "Serial number present." + let matches++ + else + echo "Serial number not present." + let nonMatches++ + fi + fi + + # Reset the parameters used for parsing. + unset dn crl + fi +done < <(echo -e "${searchResult}\n") +echo +echo "Total number of CRLs with designated issuer in LDAP: $processed" +echo "Number of CRLs that did contain the serial number: $matches" +echo "Number of CRLs that did not contain the serial number: $nonMatches" +echo +if [[ $processed == 0 ]]; then + echo "No CRL was found in LDAP directory with the specified issuer DN." + exit 11 +elif [[ $matches != $processed ]]; then + echo "Not all CRLs have passed the test." + exit 12 +else + echo "All CRLs have passed the test." + exit 0 +fi +