Ashin Walpola
d107534eb2
obu-firmware builds against the vanetza-idf C-ITS library, which until now came from the colleague's microbu-esp32c5 tree beside the repository and was not tracked here, so a clone of this repository could not build the firmware it ships. The library alone is now part of obu-firmware, as obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from there by default; -DVANETZA_IDF_DIR still points the build elsewhere. The rest of the colleague's tree (their own VAM firmware, PKI tooling, station-link Python tools, the V2X2MAP bridge) stays out of this repository and gitignored; nothing is pushed to their repository. NOTES.md, docs/06, TODO.md and the pcap verifier's usage line point at the new location.
106 lines
3.8 KiB
CMake
106 lines
3.8 KiB
CMake
if(NOT CERTIFY OR NOT CERTIFY_PQC OR NOT WORK_DIRECTORY)
|
|
message(FATAL_ERROR "CERTIFY, CERTIFY_PQC and WORK_DIRECTORY are required")
|
|
endif()
|
|
|
|
file(REMOVE_RECURSE "${WORK_DIRECTORY}")
|
|
file(MAKE_DIRECTORY "${WORK_DIRECTORY}")
|
|
|
|
function(run)
|
|
execute_process(
|
|
COMMAND ${ARGV}
|
|
WORKING_DIRECTORY "${WORK_DIRECTORY}"
|
|
RESULT_VARIABLE result
|
|
OUTPUT_VARIABLE output
|
|
ERROR_VARIABLE error)
|
|
if(NOT result EQUAL 0)
|
|
string(JOIN " " command ${ARGV})
|
|
message(FATAL_ERROR "Command failed (${result}): ${command}\n${output}${error}")
|
|
endif()
|
|
endfunction()
|
|
|
|
function(run_fails)
|
|
execute_process(
|
|
COMMAND ${ARGV}
|
|
WORKING_DIRECTORY "${WORK_DIRECTORY}"
|
|
RESULT_VARIABLE result
|
|
OUTPUT_VARIABLE output
|
|
ERROR_VARIABLE error)
|
|
if(result EQUAL 0)
|
|
string(JOIN " " command ${ARGV})
|
|
message(FATAL_ERROR "Command unexpectedly succeeded: ${command}\n${output}${error}")
|
|
endif()
|
|
endfunction()
|
|
|
|
function(check_show certificate material public_key_size signature_size)
|
|
execute_process(
|
|
COMMAND "${CERTIFY_PQC}" show "${certificate}"
|
|
WORKING_DIRECTORY "${WORK_DIRECTORY}"
|
|
RESULT_VARIABLE result
|
|
OUTPUT_VARIABLE output
|
|
ERROR_VARIABLE error)
|
|
if(NOT result EQUAL 0)
|
|
message(FATAL_ERROR "Cannot inspect ${certificate}:\n${output}${error}")
|
|
endif()
|
|
|
|
set(expectations
|
|
"Alternative material: ${material}"
|
|
"FN-DSA-512 public key: ${public_key_size} bytes"
|
|
"FN-DSA-512 signature: ${signature_size} bytes")
|
|
foreach(expectation IN LISTS expectations)
|
|
string(FIND "${output}" "${expectation}" position)
|
|
if(position EQUAL -1)
|
|
message(FATAL_ERROR
|
|
"Unexpected material in ${certificate}: missing '${expectation}'\n${output}")
|
|
endif()
|
|
endforeach()
|
|
endfunction()
|
|
|
|
run("${CERTIFY}" generate-key root.key)
|
|
run("${CERTIFY}" generate-key aa.key)
|
|
run("${CERTIFY}" generate-key ticket.key)
|
|
run("${CERTIFY_PQC}" generate-key root)
|
|
run("${CERTIFY_PQC}" generate-key aa)
|
|
|
|
run("${CERTIFY_PQC}" generate-root
|
|
--profile ecc --output ecc-root.cert --subject-key root.key --days 365
|
|
--aid 36 141)
|
|
run("${CERTIFY_PQC}" generate-aa
|
|
--profile ecc --output ecc-aa.cert
|
|
--sign-key root.key --sign-cert ecc-root.cert
|
|
--subject-key aa.key --days 180
|
|
--aid 36 141)
|
|
run("${CERTIFY_PQC}" generate-ticket
|
|
--profile ecc --output ecc-ticket.cert
|
|
--sign-key aa.key --sign-cert ecc-aa.cert
|
|
--subject-key ticket.key --days 7
|
|
--aid 141)
|
|
run("${CERTIFY_PQC}" verify-chain --profile ecc
|
|
--root ecc-root.cert --aa ecc-aa.cert --ticket ecc-ticket.cert --aid 141)
|
|
check_show(ecc-root.cert "none" 0 0)
|
|
check_show(ecc-aa.cert "none" 0 0)
|
|
check_show(ecc-ticket.cert "none" 0 0)
|
|
|
|
run("${CERTIFY_PQC}" generate-root
|
|
--output root.cert --subject-key root.key --subject-pqc-key root --days 365
|
|
--aid 36 141)
|
|
run("${CERTIFY_PQC}" generate-aa
|
|
--output aa.cert
|
|
--sign-key root.key --sign-cert root.cert --sign-pqc-key root
|
|
--subject-key aa.key --subject-pqc-key aa --days 180
|
|
--aid 36 141)
|
|
run("${CERTIFY_PQC}" generate-ticket
|
|
--output ticket.cert
|
|
--sign-key aa.key --sign-cert aa.cert --sign-pqc-key aa
|
|
--subject-key ticket.key --days 7
|
|
--aid 141)
|
|
run("${CERTIFY_PQC}" verify-chain
|
|
--root root.cert --aa aa.cert --ticket ticket.cert --aid 141)
|
|
check_show(root.cert "authority (key + signature)" 897 666)
|
|
check_show(aa.cert "authority (key + signature)" 897 666)
|
|
check_show(ticket.cert "end entity (signature only)" 0 666)
|
|
|
|
run_fails("${CERTIFY_PQC}" verify-chain --profile hybrid
|
|
--root ecc-root.cert --aa ecc-aa.cert --ticket ecc-ticket.cert --aid 141)
|
|
run_fails("${CERTIFY_PQC}" verify-chain --profile ecc
|
|
--root root.cert --aa aa.cert --ticket ticket.cert --aid 141)
|