1#! /usr/bin/env bash 2 3# Create a root CA, signing a leaf cert with a KDC principal otherName SAN, and 4# also a non-UTF8 smtpUtf8Mailbox SAN followed by an rfc822Name SAN and a DNS 5# name SAN. In the vulnerable EAI code, the KDC principal `otherName` should 6# trigger ASAN errors in DNS name checks, while the non-UTF8 `smtpUtf8Mailbox` 7# should likewise lead to ASAN issues with email name checks. 8 9rm -f root-key.pem root-cert.pem 10openssl req -nodes -new -newkey rsa:2048 -keyout kdc-root-key.pem \ 11 -x509 -subj /CN=Root -days 36524 -out kdc-root-cert.pem 12 13exts=$( 14 printf "%s\n%s\n%s\n%s = " \ 15 "subjectKeyIdentifier = hash" \ 16 "authorityKeyIdentifier = keyid" \ 17 "basicConstraints = CA:false" \ 18 "subjectAltName" 19 printf "%s, " "otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name" 20 printf "%s, " "otherName:1.3.6.1.5.5.7.8.9;IA5:moe@example.com" 21 printf "%s, " "email:joe@example.com" 22 printf "%s\n" "DNS:mx1.example.com" 23 printf "[kdc_princ_name]\n" 24 printf "realm = EXP:0, GeneralString:TEST.EXAMPLE\n" 25 printf "principal_name = EXP:1, SEQUENCE:kdc_principal_seq\n" 26 printf "[kdc_principal_seq]\n" 27 printf "name_type = EXP:0, INTEGER:1\n" 28 printf "name_string = EXP:1, SEQUENCE:kdc_principal_components\n" 29 printf "[kdc_principal_components]\n" 30 printf "princ1 = GeneralString:krbtgt\n" 31 printf "princ2 = GeneralString:TEST.EXAMPLE\n" 32 ) 33 34printf "%s\n" "$exts" 35 36openssl req -nodes -new -newkey rsa:2048 -keyout kdc-key.pem \ 37 -subj "/CN=TEST.EXAMPLE" | 38 openssl x509 -req -out kdc-cert.pem \ 39 -CA "kdc-root-cert.pem" -CAkey "kdc-root-key.pem" \ 40 -set_serial 2 -days 36524 \ 41 -extfile <(printf "%s\n" "$exts") 42