| 1 | #!/usr/bin/env perl
|
|---|
| 2 | # ***************************************************************************
|
|---|
| 3 | # * _ _ ____ _
|
|---|
| 4 | # * Project ___| | | | _ \| |
|
|---|
| 5 | # * / __| | | | |_) | |
|
|---|
| 6 | # * | (__| |_| | _ <| |___
|
|---|
| 7 | # * \___|\___/|_| \_\_____|
|
|---|
| 8 | # *
|
|---|
| 9 | # * Copyright (C) 1998 - 2016, Daniel Stenberg, <[email protected]>, et al.
|
|---|
| 10 | # *
|
|---|
| 11 | # * This software is licensed as described in the file COPYING, which
|
|---|
| 12 | # * you should have received as part of this distribution. The terms
|
|---|
| 13 | # * are also available at https://curl.haxx.se/docs/copyright.html.
|
|---|
| 14 | # *
|
|---|
| 15 | # * You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
|---|
| 16 | # * copies of the Software, and permit persons to whom the Software is
|
|---|
| 17 | # * furnished to do so, under the terms of the COPYING file.
|
|---|
| 18 | # *
|
|---|
| 19 | # * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
|---|
| 20 | # * KIND, either express or implied.
|
|---|
| 21 | # *
|
|---|
| 22 | # ***************************************************************************
|
|---|
| 23 | # This Perl script creates a fresh ca-bundle.crt file for use with libcurl.
|
|---|
| 24 | # It downloads certdata.txt from Mozilla's source tree (see URL below),
|
|---|
| 25 | # then parses certdata.txt and extracts CA Root Certificates into PEM format.
|
|---|
| 26 | # These are then processed with the OpenSSL commandline tool to produce the
|
|---|
| 27 | # final ca-bundle.crt file.
|
|---|
| 28 | # The script is based on the parse-certs script written by Roland Krikava.
|
|---|
| 29 | # This Perl script works on almost any platform since its only external
|
|---|
| 30 | # dependency is the OpenSSL commandline tool for optional text listing.
|
|---|
| 31 | # Hacked by Guenter Knauf.
|
|---|
| 32 | #
|
|---|
| 33 | use Encode;
|
|---|
| 34 | use Getopt::Std;
|
|---|
| 35 | use MIME::Base64;
|
|---|
| 36 | use strict;
|
|---|
| 37 | use warnings;
|
|---|
| 38 | use vars qw($opt_b $opt_d $opt_f $opt_h $opt_i $opt_k $opt_l $opt_m $opt_n $opt_p $opt_q $opt_s $opt_t $opt_u $opt_v $opt_w);
|
|---|
| 39 | use List::Util;
|
|---|
| 40 | use Text::Wrap;
|
|---|
| 41 | my $MOD_SHA = "Digest::SHA";
|
|---|
| 42 | eval "require $MOD_SHA";
|
|---|
| 43 | if ($@) {
|
|---|
| 44 | $MOD_SHA = "Digest::SHA::PurePerl";
|
|---|
| 45 | eval "require $MOD_SHA";
|
|---|
| 46 | }
|
|---|
| 47 | eval "require LWP::UserAgent";
|
|---|
| 48 |
|
|---|
| 49 | my %urls = (
|
|---|
| 50 | 'nss' =>
|
|---|
| 51 | 'https://hg.mozilla.org/projects/nss/raw-file/default/lib/ckfw/builtins/certdata.txt',
|
|---|
| 52 | 'central' =>
|
|---|
| 53 | 'https://hg.mozilla.org/mozilla-central/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt',
|
|---|
| 54 | 'beta' =>
|
|---|
| 55 | 'https://hg.mozilla.org/releases/mozilla-beta/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt',
|
|---|
| 56 | 'release' =>
|
|---|
| 57 | 'https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt',
|
|---|
| 58 | );
|
|---|
| 59 |
|
|---|
| 60 | $opt_d = 'release';
|
|---|
| 61 |
|
|---|
| 62 | # If the OpenSSL commandline is not in search path you can configure it here!
|
|---|
| 63 | my $openssl = 'openssl';
|
|---|
| 64 |
|
|---|
| 65 | my $version = '1.27';
|
|---|
| 66 |
|
|---|
| 67 | $opt_w = 76; # default base64 encoded lines length
|
|---|
| 68 |
|
|---|
| 69 | # default cert types to include in the output (default is to include CAs which may issue SSL server certs)
|
|---|
| 70 | my $default_mozilla_trust_purposes = "SERVER_AUTH";
|
|---|
| 71 | my $default_mozilla_trust_levels = "TRUSTED_DELEGATOR";
|
|---|
| 72 | $opt_p = $default_mozilla_trust_purposes . ":" . $default_mozilla_trust_levels;
|
|---|
| 73 |
|
|---|
| 74 | my @valid_mozilla_trust_purposes = (
|
|---|
| 75 | "DIGITAL_SIGNATURE",
|
|---|
| 76 | "NON_REPUDIATION",
|
|---|
| 77 | "KEY_ENCIPHERMENT",
|
|---|
| 78 | "DATA_ENCIPHERMENT",
|
|---|
| 79 | "KEY_AGREEMENT",
|
|---|
| 80 | "KEY_CERT_SIGN",
|
|---|
| 81 | "CRL_SIGN",
|
|---|
| 82 | "SERVER_AUTH",
|
|---|
| 83 | "CLIENT_AUTH",
|
|---|
| 84 | "CODE_SIGNING",
|
|---|
| 85 | "EMAIL_PROTECTION",
|
|---|
| 86 | "IPSEC_END_SYSTEM",
|
|---|
| 87 | "IPSEC_TUNNEL",
|
|---|
| 88 | "IPSEC_USER",
|
|---|
| 89 | "TIME_STAMPING",
|
|---|
| 90 | "STEP_UP_APPROVED"
|
|---|
| 91 | );
|
|---|
| 92 |
|
|---|
| 93 | my @valid_mozilla_trust_levels = (
|
|---|
| 94 | "TRUSTED_DELEGATOR", # CAs
|
|---|
| 95 | "NOT_TRUSTED", # Don't trust these certs.
|
|---|
| 96 | "MUST_VERIFY_TRUST", # This explicitly tells us that it ISN'T a CA but is otherwise ok. In other words, this should tell the app to ignore any other sources that claim this is a CA.
|
|---|
| 97 | "TRUSTED" # This cert is trusted, but only for itself and not for delegates (i.e. it is not a CA).
|
|---|
| 98 | );
|
|---|
| 99 |
|
|---|
| 100 | my $default_signature_algorithms = $opt_s = "MD5";
|
|---|
| 101 |
|
|---|
| 102 | my @valid_signature_algorithms = (
|
|---|
| 103 | "MD5",
|
|---|
| 104 | "SHA1",
|
|---|
| 105 | "SHA256",
|
|---|
| 106 | "SHA384",
|
|---|
| 107 | "SHA512"
|
|---|
| 108 | );
|
|---|
| 109 |
|
|---|
| 110 | $0 =~ s@.*(/|\\)@@;
|
|---|
| 111 | $Getopt::Std::STANDARD_HELP_VERSION = 1;
|
|---|
| 112 | getopts('bd:fhiklmnp:qs:tuvw:');
|
|---|
| 113 |
|
|---|
| 114 | if(!defined($opt_d)) {
|
|---|
| 115 | # to make plain "-d" use not cause warnings, and actually still work
|
|---|
| 116 | $opt_d = 'release';
|
|---|
| 117 | }
|
|---|
| 118 |
|
|---|
| 119 | # Use predefined URL or else custom URL specified on command line.
|
|---|
| 120 | my $url;
|
|---|
| 121 | if(defined($urls{$opt_d})) {
|
|---|
| 122 | $url = $urls{$opt_d};
|
|---|
| 123 | if(!$opt_k && $url !~ /^https:\/\//i) {
|
|---|
| 124 | die "The URL for '$opt_d' is not HTTPS. Use -k to override (insecure).\n";
|
|---|
| 125 | }
|
|---|
| 126 | }
|
|---|
| 127 | else {
|
|---|
| 128 | $url = $opt_d;
|
|---|
| 129 | }
|
|---|
| 130 |
|
|---|
| 131 | my $curl = `curl -V`;
|
|---|
| 132 |
|
|---|
| 133 | if ($opt_i) {
|
|---|
| 134 | print ("=" x 78 . "\n");
|
|---|
| 135 | print "Script Version : $version\n";
|
|---|
| 136 | print "Perl Version : $]\n";
|
|---|
| 137 | print "Operating System Name : $^O\n";
|
|---|
| 138 | print "Getopt::Std.pm Version : ${Getopt::Std::VERSION}\n";
|
|---|
| 139 | print "Encode::Encoding.pm Version : ${Encode::Encoding::VERSION}\n";
|
|---|
| 140 | print "MIME::Base64.pm Version : ${MIME::Base64::VERSION}\n";
|
|---|
| 141 | print "LWP::UserAgent.pm Version : ${LWP::UserAgent::VERSION}\n" if($LWP::UserAgent::VERSION);
|
|---|
| 142 | print "LWP.pm Version : ${LWP::VERSION}\n" if($LWP::VERSION);
|
|---|
| 143 | print "Digest::SHA.pm Version : ${Digest::SHA::VERSION}\n" if ($Digest::SHA::VERSION);
|
|---|
| 144 | print "Digest::SHA::PurePerl.pm Version : ${Digest::SHA::PurePerl::VERSION}\n" if ($Digest::SHA::PurePerl::VERSION);
|
|---|
| 145 | print ("=" x 78 . "\n");
|
|---|
| 146 | }
|
|---|
| 147 |
|
|---|
| 148 | sub warning_message() {
|
|---|
| 149 | if ( $opt_d =~ m/^risk$/i ) { # Long Form Warning and Exit
|
|---|
| 150 | print "Warning: Use of this script may pose some risk:\n";
|
|---|
| 151 | print "\n";
|
|---|
| 152 | print " 1) If you use HTTP URLs they are subject to a man in the middle attack\n";
|
|---|
| 153 | print " 2) Default to 'release', but more recent updates may be found in other trees\n";
|
|---|
| 154 | print " 3) certdata.txt file format may change, lag time to update this script\n";
|
|---|
| 155 | print " 4) Generally unwise to blindly trust CAs without manual review & verification\n";
|
|---|
| 156 | print " 5) Mozilla apps use additional security checks aren't represented in certdata\n";
|
|---|
| 157 | print " 6) Use of this script will make a security engineer grind his teeth and\n";
|
|---|
| 158 | print " swear at you. ;)\n";
|
|---|
| 159 | exit;
|
|---|
| 160 | } else { # Short Form Warning
|
|---|
| 161 | print "Warning: Use of this script may pose some risk, -d risk for more details.\n";
|
|---|
| 162 | }
|
|---|
| 163 | }
|
|---|
| 164 |
|
|---|
| 165 | sub HELP_MESSAGE() {
|
|---|
| 166 | print "Usage:\t${0} [-b] [-d<certdata>] [-f] [-i] [-k] [-l] [-n] [-p<purposes:levels>] [-q] [-s<algorithms>] [-t] [-u] [-v] [-w<l>] [<outputfile>]\n";
|
|---|
| 167 | print "\t-b\tbackup an existing version of ca-bundle.crt\n";
|
|---|
| 168 | print "\t-d\tspecify Mozilla tree to pull certdata.txt or custom URL\n";
|
|---|
| 169 | print "\t\t Valid names are:\n";
|
|---|
| 170 | print "\t\t ", join( ", ", map { ( $_ =~ m/$opt_d/ ) ? "$_ (default)" : "$_" } sort keys %urls ), "\n";
|
|---|
| 171 | print "\t-f\tforce rebuild even if certdata.txt is current\n";
|
|---|
| 172 | print "\t-i\tprint version info about used modules\n";
|
|---|
| 173 | print "\t-k\tallow URLs other than HTTPS, enable HTTP fallback (insecure)\n";
|
|---|
| 174 | print "\t-l\tprint license info about certdata.txt\n";
|
|---|
| 175 | print "\t-m\tinclude meta data in output\n";
|
|---|
| 176 | print "\t-n\tno download of certdata.txt (to use existing)\n";
|
|---|
| 177 | print wrap("\t","\t\t", "-p\tlist of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels. (default: $default_mozilla_trust_purposes:$default_mozilla_trust_levels)"), "\n";
|
|---|
| 178 | print "\t\t Valid purposes are:\n";
|
|---|
| 179 | print wrap("\t\t ","\t\t ", join( ", ", "ALL", @valid_mozilla_trust_purposes ) ), "\n";
|
|---|
| 180 | print "\t\t Valid levels are:\n";
|
|---|
| 181 | print wrap("\t\t ","\t\t ", join( ", ", "ALL", @valid_mozilla_trust_levels ) ), "\n";
|
|---|
| 182 | print "\t-q\tbe really quiet (no progress output at all)\n";
|
|---|
| 183 | print wrap("\t","\t\t", "-s\tcomma separated list of certificate signatures/hashes to output in plain text mode. (default: $default_signature_algorithms)\n");
|
|---|
| 184 | print "\t\t Valid signature algorithms are:\n";
|
|---|
| 185 | print wrap("\t\t ","\t\t ", join( ", ", "ALL", @valid_signature_algorithms ) ), "\n";
|
|---|
| 186 | print "\t-t\tinclude plain text listing of certificates\n";
|
|---|
| 187 | print "\t-u\tunlink (remove) certdata.txt after processing\n";
|
|---|
| 188 | print "\t-v\tbe verbose and print out processed CAs\n";
|
|---|
| 189 | print "\t-w <l>\twrap base64 output lines after <l> chars (default: ${opt_w})\n";
|
|---|
| 190 | exit;
|
|---|
| 191 | }
|
|---|
| 192 |
|
|---|
| 193 | sub VERSION_MESSAGE() {
|
|---|
| 194 | print "${0} version ${version} running Perl ${]} on ${^O}\n";
|
|---|
| 195 | }
|
|---|
| 196 |
|
|---|
| 197 | warning_message() unless ($opt_q || $url =~ m/^(ht|f)tps:/i );
|
|---|
| 198 | HELP_MESSAGE() if ($opt_h);
|
|---|
| 199 |
|
|---|
| 200 | sub report($@) {
|
|---|
| 201 | my $output = shift;
|
|---|
| 202 |
|
|---|
| 203 | print STDERR $output . "\n" unless $opt_q;
|
|---|
| 204 | }
|
|---|
| 205 |
|
|---|
| 206 | sub is_in_list($@) {
|
|---|
| 207 | my $target = shift;
|
|---|
| 208 |
|
|---|
| 209 | return defined(List::Util::first { $target eq $_ } @_);
|
|---|
| 210 | }
|
|---|
| 211 |
|
|---|
| 212 | # Parses $param_string as a case insensitive comma separated list with optional whitespace
|
|---|
| 213 | # validates that only allowed parameters are supplied
|
|---|
| 214 | sub parse_csv_param($$@) {
|
|---|
| 215 | my $description = shift;
|
|---|
| 216 | my $param_string = shift;
|
|---|
| 217 | my @valid_values = @_;
|
|---|
| 218 |
|
|---|
| 219 | my @values = map {
|
|---|
| 220 | s/^\s+//; # strip leading spaces
|
|---|
| 221 | s/\s+$//; # strip trailing spaces
|
|---|
| 222 | uc $_ # return the modified string as upper case
|
|---|
| 223 | } split( ',', $param_string );
|
|---|
| 224 |
|
|---|
| 225 | # Find all values which are not in the list of valid values or "ALL"
|
|---|
| 226 | my @invalid = grep { !is_in_list($_,"ALL",@valid_values) } @values;
|
|---|
| 227 |
|
|---|
| 228 | if ( scalar(@invalid) > 0 ) {
|
|---|
| 229 | # Tell the user which parameters were invalid and print the standard help message which will exit
|
|---|
| 230 | print "Error: Invalid ", $description, scalar(@invalid) == 1 ? ": " : "s: ", join( ", ", map { "\"$_\"" } @invalid ), "\n";
|
|---|
| 231 | HELP_MESSAGE();
|
|---|
| 232 | }
|
|---|
| 233 |
|
|---|
| 234 | @values = @valid_values if ( is_in_list("ALL",@values) );
|
|---|
| 235 |
|
|---|
| 236 | return @values;
|
|---|
| 237 | }
|
|---|
| 238 |
|
|---|
| 239 | sub sha256 {
|
|---|
| 240 | my $result;
|
|---|
| 241 | if ($Digest::SHA::VERSION || $Digest::SHA::PurePerl::VERSION) {
|
|---|
| 242 | open(FILE, $_[0]) or die "Can't open '$_[0]': $!";
|
|---|
| 243 | binmode(FILE);
|
|---|
| 244 | $result = $MOD_SHA->new(256)->addfile(*FILE)->hexdigest;
|
|---|
| 245 | close(FILE);
|
|---|
| 246 | } else {
|
|---|
| 247 | # Use OpenSSL command if Perl Digest::SHA modules not available
|
|---|
| 248 | $result = `"$openssl" dgst -r -sha256 "$_[0]"`;
|
|---|
| 249 | $result =~ s/^([0-9a-f]{64}) .+/$1/is;
|
|---|
| 250 | }
|
|---|
| 251 | return $result;
|
|---|
| 252 | }
|
|---|
| 253 |
|
|---|
| 254 |
|
|---|
| 255 | sub oldhash {
|
|---|
| 256 | my $hash = "";
|
|---|
| 257 | open(C, "<$_[0]") || return 0;
|
|---|
| 258 | while(<C>) {
|
|---|
| 259 | chomp;
|
|---|
| 260 | if($_ =~ /^\#\# SHA256: (.*)/) {
|
|---|
| 261 | $hash = $1;
|
|---|
| 262 | last;
|
|---|
| 263 | }
|
|---|
| 264 | }
|
|---|
| 265 | close(C);
|
|---|
| 266 | return $hash;
|
|---|
| 267 | }
|
|---|
| 268 |
|
|---|
| 269 | if ( $opt_p !~ m/:/ ) {
|
|---|
| 270 | print "Error: Mozilla trust identifier list must include both purposes and levels\n";
|
|---|
| 271 | HELP_MESSAGE();
|
|---|
| 272 | }
|
|---|
| 273 |
|
|---|
| 274 | (my $included_mozilla_trust_purposes_string, my $included_mozilla_trust_levels_string) = split( ':', $opt_p );
|
|---|
| 275 | my @included_mozilla_trust_purposes = parse_csv_param( "trust purpose", $included_mozilla_trust_purposes_string, @valid_mozilla_trust_purposes );
|
|---|
| 276 | my @included_mozilla_trust_levels = parse_csv_param( "trust level", $included_mozilla_trust_levels_string, @valid_mozilla_trust_levels );
|
|---|
| 277 |
|
|---|
| 278 | my @included_signature_algorithms = parse_csv_param( "signature algorithm", $opt_s, @valid_signature_algorithms );
|
|---|
| 279 |
|
|---|
| 280 | sub should_output_cert(%) {
|
|---|
| 281 | my %trust_purposes_by_level = @_;
|
|---|
| 282 |
|
|---|
| 283 | foreach my $level (@included_mozilla_trust_levels) {
|
|---|
| 284 | # for each level we want to output, see if any of our desired purposes are included
|
|---|
| 285 | return 1 if ( defined( List::Util::first { is_in_list( $_, @included_mozilla_trust_purposes ) } @{$trust_purposes_by_level{$level}} ) );
|
|---|
| 286 | }
|
|---|
| 287 |
|
|---|
| 288 | return 0;
|
|---|
| 289 | }
|
|---|
| 290 |
|
|---|
| 291 | my $crt = $ARGV[0] || 'ca-bundle.crt';
|
|---|
| 292 | (my $txt = $url) =~ s@(.*/|\?.*)@@g;
|
|---|
| 293 |
|
|---|
| 294 | my $stdout = $crt eq '-';
|
|---|
| 295 | my $resp;
|
|---|
| 296 | my $fetched;
|
|---|
| 297 |
|
|---|
| 298 | my $oldhash = oldhash($crt);
|
|---|
| 299 |
|
|---|
| 300 | report "SHA256 of old file: $oldhash";
|
|---|
| 301 |
|
|---|
| 302 | if(!$opt_n) {
|
|---|
| 303 | report "Downloading $txt ...";
|
|---|
| 304 |
|
|---|
| 305 | # If we have an HTTPS URL then use curl
|
|---|
| 306 | if($url =~ /^https:\/\//i) {
|
|---|
| 307 | if($curl) {
|
|---|
| 308 | if($curl =~ /^Protocols:.* https( |$)/m) {
|
|---|
| 309 | report "Get certdata with curl!";
|
|---|
| 310 | my $proto = !$opt_k ? "--proto =https" : "";
|
|---|
| 311 | my $quiet = $opt_q ? "-s" : "";
|
|---|
| 312 | my @out = `curl -w %{response_code} $proto $quiet -o "$txt" "$url"`;
|
|---|
| 313 | if(!$? && @out && $out[0] == 200) {
|
|---|
| 314 | $fetched = 1;
|
|---|
| 315 | report "Downloaded $txt";
|
|---|
| 316 | }
|
|---|
| 317 | else {
|
|---|
| 318 | report "Failed downloading via HTTPS with curl";
|
|---|
| 319 | if(-e $txt && !unlink($txt)) {
|
|---|
| 320 | report "Failed to remove '$txt': $!";
|
|---|
| 321 | }
|
|---|
| 322 | }
|
|---|
| 323 | }
|
|---|
| 324 | else {
|
|---|
| 325 | report "curl lacks https support";
|
|---|
| 326 | }
|
|---|
| 327 | }
|
|---|
| 328 | else {
|
|---|
| 329 | report "curl not found";
|
|---|
| 330 | }
|
|---|
| 331 | }
|
|---|
| 332 |
|
|---|
| 333 | # If nothing was fetched then use LWP
|
|---|
| 334 | if(!$fetched) {
|
|---|
| 335 | if($url =~ /^https:\/\//i) {
|
|---|
| 336 | report "Falling back to HTTP";
|
|---|
| 337 | $url =~ s/^https:\/\//http:\/\//i;
|
|---|
| 338 | }
|
|---|
| 339 | if(!$opt_k) {
|
|---|
| 340 | report "URLs other than HTTPS are disabled by default, to enable use -k";
|
|---|
| 341 | exit 1;
|
|---|
| 342 | }
|
|---|
| 343 | report "Get certdata with LWP!";
|
|---|
| 344 | if(!defined(${LWP::UserAgent::VERSION})) {
|
|---|
| 345 | report "LWP is not available (LWP::UserAgent not found)";
|
|---|
| 346 | exit 1;
|
|---|
| 347 | }
|
|---|
| 348 | my $ua = new LWP::UserAgent(agent => "$0/$version");
|
|---|
| 349 | $ua->env_proxy();
|
|---|
| 350 | $resp = $ua->mirror($url, $txt);
|
|---|
| 351 | if($resp && $resp->code eq '304') {
|
|---|
| 352 | report "Not modified";
|
|---|
| 353 | exit 0 if -e $crt && !$opt_f;
|
|---|
| 354 | }
|
|---|
| 355 | else {
|
|---|
| 356 | $fetched = 1;
|
|---|
| 357 | report "Downloaded $txt";
|
|---|
| 358 | }
|
|---|
| 359 | if(!$resp || $resp->code !~ /^(?:200|304)$/) {
|
|---|
| 360 | report "Unable to download latest data: "
|
|---|
| 361 | . ($resp? $resp->code . ' - ' . $resp->message : "LWP failed");
|
|---|
| 362 | exit 1 if -e $crt || ! -r $txt;
|
|---|
| 363 | }
|
|---|
| 364 | }
|
|---|
| 365 | }
|
|---|
| 366 |
|
|---|
| 367 | my $filedate = $resp ? $resp->last_modified : (stat($txt))[9];
|
|---|
| 368 | my $datesrc = "as of";
|
|---|
| 369 | if(!$filedate) {
|
|---|
| 370 | # mxr.mozilla.org gave us a time, hg.mozilla.org does not!
|
|---|
| 371 | $filedate = time();
|
|---|
| 372 | $datesrc="downloaded on";
|
|---|
| 373 | }
|
|---|
| 374 |
|
|---|
| 375 | # get the hash from the download file
|
|---|
| 376 | my $newhash= sha256($txt);
|
|---|
| 377 |
|
|---|
| 378 | if(!$opt_f && $oldhash eq $newhash) {
|
|---|
| 379 | report "Downloaded file identical to previous run\'s source file. Exiting";
|
|---|
| 380 | if($opt_u && -e $txt && !unlink($txt)) {
|
|---|
| 381 | report "Failed to remove $txt: $!\n";
|
|---|
| 382 | }
|
|---|
| 383 | exit;
|
|---|
| 384 | }
|
|---|
| 385 |
|
|---|
| 386 | report "SHA256 of new file: $newhash";
|
|---|
| 387 |
|
|---|
| 388 | my $currentdate = scalar gmtime($filedate);
|
|---|
| 389 |
|
|---|
| 390 | my $format = $opt_t ? "plain text and " : "";
|
|---|
| 391 | if( $stdout ) {
|
|---|
| 392 | open(CRT, '> -') or die "Couldn't open STDOUT: $!\n";
|
|---|
| 393 | } else {
|
|---|
| 394 | open(CRT,">$crt.~") or die "Couldn't open $crt.~: $!\n";
|
|---|
| 395 | }
|
|---|
| 396 | print CRT <<EOT;
|
|---|
| 397 | ##
|
|---|
| 398 | ## Bundle of CA Root Certificates
|
|---|
| 399 | ##
|
|---|
| 400 | ## Certificate data from Mozilla ${datesrc}: ${currentdate} GMT
|
|---|
| 401 | ##
|
|---|
| 402 | ## This is a bundle of X.509 certificates of public Certificate Authorities
|
|---|
| 403 | ## (CA). These were automatically extracted from Mozilla's root certificates
|
|---|
| 404 | ## file (certdata.txt). This file can be found in the mozilla source tree:
|
|---|
| 405 | ## ${url}
|
|---|
| 406 | ##
|
|---|
| 407 | ## It contains the certificates in ${format}PEM format and therefore
|
|---|
| 408 | ## can be directly used with curl / libcurl / php_curl, or with
|
|---|
| 409 | ## an Apache+mod_ssl webserver for SSL client authentication.
|
|---|
| 410 | ## Just configure this file as the SSLCACertificateFile.
|
|---|
| 411 | ##
|
|---|
| 412 | ## Conversion done with mk-ca-bundle.pl version $version.
|
|---|
| 413 | ## SHA256: $newhash
|
|---|
| 414 | ##
|
|---|
| 415 |
|
|---|
| 416 | EOT
|
|---|
| 417 |
|
|---|
| 418 | report "Processing '$txt' ...";
|
|---|
| 419 | my $caname;
|
|---|
| 420 | my $certnum = 0;
|
|---|
| 421 | my $skipnum = 0;
|
|---|
| 422 | my $start_of_cert = 0;
|
|---|
| 423 | my @precert;
|
|---|
| 424 |
|
|---|
| 425 | open(TXT,"$txt") or die "Couldn't open $txt: $!\n";
|
|---|
| 426 | while (<TXT>) {
|
|---|
| 427 | if (/\*\*\*\*\* BEGIN LICENSE BLOCK \*\*\*\*\*/) {
|
|---|
| 428 | print CRT;
|
|---|
| 429 | print if ($opt_l);
|
|---|
| 430 | while (<TXT>) {
|
|---|
| 431 | print CRT;
|
|---|
| 432 | print if ($opt_l);
|
|---|
| 433 | last if (/\*\*\*\*\* END LICENSE BLOCK \*\*\*\*\*/);
|
|---|
| 434 | }
|
|---|
| 435 | }
|
|---|
| 436 | elsif(/^# (Issuer|Serial Number|Subject|Not Valid Before|Not Valid After |Fingerprint \(MD5\)|Fingerprint \(SHA1\)):/) {
|
|---|
| 437 | push @precert, $_;
|
|---|
| 438 | next;
|
|---|
| 439 | }
|
|---|
| 440 | elsif(/^#|^\s*$/) {
|
|---|
| 441 | undef @precert;
|
|---|
| 442 | next;
|
|---|
| 443 | }
|
|---|
| 444 | chomp;
|
|---|
| 445 |
|
|---|
| 446 | # this is a match for the start of a certificate
|
|---|
| 447 | if (/^CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE/) {
|
|---|
| 448 | $start_of_cert = 1
|
|---|
| 449 | }
|
|---|
| 450 | if ($start_of_cert && /^CKA_LABEL UTF8 \"(.*)\"/) {
|
|---|
| 451 | $caname = $1;
|
|---|
| 452 | }
|
|---|
| 453 | my %trust_purposes_by_level;
|
|---|
| 454 | if ($start_of_cert && /^CKA_VALUE MULTILINE_OCTAL/) {
|
|---|
| 455 | my $data;
|
|---|
| 456 | while (<TXT>) {
|
|---|
| 457 | last if (/^END/);
|
|---|
| 458 | chomp;
|
|---|
| 459 | my @octets = split(/\\/);
|
|---|
| 460 | shift @octets;
|
|---|
| 461 | for (@octets) {
|
|---|
| 462 | $data .= chr(oct);
|
|---|
| 463 | }
|
|---|
| 464 | }
|
|---|
| 465 | # scan forwards until the trust part
|
|---|
| 466 | while (<TXT>) {
|
|---|
| 467 | last if (/^CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST/);
|
|---|
| 468 | chomp;
|
|---|
| 469 | }
|
|---|
| 470 | # now scan the trust part to determine how we should trust this cert
|
|---|
| 471 | while (<TXT>) {
|
|---|
| 472 | last if (/^#/);
|
|---|
| 473 | if (/^CKA_TRUST_([A-Z_]+)\s+CK_TRUST\s+CKT_NSS_([A-Z_]+)\s*$/) {
|
|---|
| 474 | if ( !is_in_list($1,@valid_mozilla_trust_purposes) ) {
|
|---|
| 475 | report "Warning: Unrecognized trust purpose for cert: $caname. Trust purpose: $1. Trust Level: $2";
|
|---|
| 476 | } elsif ( !is_in_list($2,@valid_mozilla_trust_levels) ) {
|
|---|
| 477 | report "Warning: Unrecognized trust level for cert: $caname. Trust purpose: $1. Trust Level: $2";
|
|---|
| 478 | } else {
|
|---|
| 479 | push @{$trust_purposes_by_level{$2}}, $1;
|
|---|
| 480 | }
|
|---|
| 481 | }
|
|---|
| 482 | }
|
|---|
| 483 |
|
|---|
| 484 | if ( !should_output_cert(%trust_purposes_by_level) ) {
|
|---|
| 485 | $skipnum ++;
|
|---|
| 486 | report "Skipping: $caname" if ($opt_v);
|
|---|
| 487 | } else {
|
|---|
| 488 | my $encoded = MIME::Base64::encode_base64($data, '');
|
|---|
| 489 | $encoded =~ s/(.{1,${opt_w}})/$1\n/g;
|
|---|
| 490 | my $pem = "-----BEGIN CERTIFICATE-----\n"
|
|---|
| 491 | . $encoded
|
|---|
| 492 | . "-----END CERTIFICATE-----\n";
|
|---|
| 493 | print CRT "\n$caname\n";
|
|---|
| 494 | print CRT @precert if($opt_m);
|
|---|
| 495 | my $maxStringLength = length(decode('UTF-8', $caname, Encode::FB_CROAK | Encode::LEAVE_SRC));
|
|---|
| 496 | if ($opt_t) {
|
|---|
| 497 | foreach my $key (keys %trust_purposes_by_level) {
|
|---|
| 498 | my $string = $key . ": " . join(", ", @{$trust_purposes_by_level{$key}});
|
|---|
| 499 | $maxStringLength = List::Util::max( length($string), $maxStringLength );
|
|---|
| 500 | print CRT $string . "\n";
|
|---|
| 501 | }
|
|---|
| 502 | }
|
|---|
| 503 | print CRT ("=" x $maxStringLength . "\n");
|
|---|
| 504 | if (!$opt_t) {
|
|---|
| 505 | print CRT $pem;
|
|---|
| 506 | } else {
|
|---|
| 507 | my $pipe = "";
|
|---|
| 508 | foreach my $hash (@included_signature_algorithms) {
|
|---|
| 509 | $pipe = "|$openssl x509 -" . $hash . " -fingerprint -noout -inform PEM";
|
|---|
| 510 | if (!$stdout) {
|
|---|
| 511 | $pipe .= " >> $crt.~";
|
|---|
| 512 | close(CRT) or die "Couldn't close $crt.~: $!";
|
|---|
| 513 | }
|
|---|
| 514 | open(TMP, $pipe) or die "Couldn't open openssl pipe: $!";
|
|---|
| 515 | print TMP $pem;
|
|---|
| 516 | close(TMP) or die "Couldn't close openssl pipe: $!";
|
|---|
| 517 | if (!$stdout) {
|
|---|
| 518 | open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!";
|
|---|
| 519 | }
|
|---|
| 520 | }
|
|---|
| 521 | $pipe = "|$openssl x509 -text -inform PEM";
|
|---|
| 522 | if (!$stdout) {
|
|---|
| 523 | $pipe .= " >> $crt.~";
|
|---|
| 524 | close(CRT) or die "Couldn't close $crt.~: $!";
|
|---|
| 525 | }
|
|---|
| 526 | open(TMP, $pipe) or die "Couldn't open openssl pipe: $!";
|
|---|
| 527 | print TMP $pem;
|
|---|
| 528 | close(TMP) or die "Couldn't close openssl pipe: $!";
|
|---|
| 529 | if (!$stdout) {
|
|---|
| 530 | open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!";
|
|---|
| 531 | }
|
|---|
| 532 | }
|
|---|
| 533 | report "Parsing: $caname" if ($opt_v);
|
|---|
| 534 | $certnum ++;
|
|---|
| 535 | $start_of_cert = 0;
|
|---|
| 536 | }
|
|---|
| 537 | undef @precert;
|
|---|
| 538 | }
|
|---|
| 539 |
|
|---|
| 540 | }
|
|---|
| 541 | close(TXT) or die "Couldn't close $txt: $!\n";
|
|---|
| 542 | close(CRT) or die "Couldn't close $crt.~: $!\n";
|
|---|
| 543 | unless( $stdout ) {
|
|---|
| 544 | if ($opt_b && -e $crt) {
|
|---|
| 545 | my $bk = 1;
|
|---|
| 546 | while (-e "$crt.~${bk}~") {
|
|---|
| 547 | $bk++;
|
|---|
| 548 | }
|
|---|
| 549 | rename $crt, "$crt.~${bk}~" or die "Failed to create backup $crt.~$bk}~: $!\n";
|
|---|
| 550 | } elsif( -e $crt ) {
|
|---|
| 551 | unlink( $crt ) or die "Failed to remove $crt: $!\n";
|
|---|
| 552 | }
|
|---|
| 553 | rename "$crt.~", $crt or die "Failed to rename $crt.~ to $crt: $!\n";
|
|---|
| 554 | }
|
|---|
| 555 | if($opt_u && -e $txt && !unlink($txt)) {
|
|---|
| 556 | report "Failed to remove $txt: $!\n";
|
|---|
| 557 | }
|
|---|
| 558 | report "Done ($certnum CA certs processed, $skipnum skipped).";
|
|---|
