diff options
Diffstat (limited to 'third_party/libwebrtc/tools_webrtc/sslroots')
| -rw-r--r-- | third_party/libwebrtc/tools_webrtc/sslroots/README.md | 21 | ||||
| -rw-r--r-- | third_party/libwebrtc/tools_webrtc/sslroots/generate_sslroots.py | 229 |
2 files changed, 250 insertions, 0 deletions
diff --git a/third_party/libwebrtc/tools_webrtc/sslroots/README.md b/third_party/libwebrtc/tools_webrtc/sslroots/README.md new file mode 100644 index 0000000000..0184a412a9 --- /dev/null +++ b/third_party/libwebrtc/tools_webrtc/sslroots/README.md @@ -0,0 +1,21 @@ +# Generate rtc_base/ssl_roots.h + +This directory contains a script to generate the content of +[rtc_base/ssl_roots.h][ssl-roots-header], to update the SSL roots shipped +by WebRTC follow this instructions: + +1. Download roots.pem from [pki.goog][pki-goog] or [curl.se][mozilla-cacert] + +2. Launch the script: + +``` +$ vpython3 tools_webrtc/sslroots/generate_sslroots.py <the pem file> +``` + +3. Step 2 should have generated an ssl_roots.h file right next to the pem file. + +4. Overwrite rtc_base/ssl_roots.h with the newly generated one. + +[ssl-roots-header]: https://cs.chromium.org/chromium/src/third_party/webrtc/rtc_base/ssl_roots.h +[pki-goog]: https://www.google.com/url?q=https://pki.google.com/roots.pem +[mozila-cacert]: https://curl.se/ca/cacert.pem diff --git a/third_party/libwebrtc/tools_webrtc/sslroots/generate_sslroots.py b/third_party/libwebrtc/tools_webrtc/sslroots/generate_sslroots.py new file mode 100644 index 0000000000..291c3ce3c8 --- /dev/null +++ b/third_party/libwebrtc/tools_webrtc/sslroots/generate_sslroots.py @@ -0,0 +1,229 @@ +#!/usr/bin/env vpython3 + +# -*- coding:utf-8 -*- +# Copyright (c) 2015 The WebRTC project authors. All Rights Reserved. +# +# Use of this source code is governed by a BSD-style license +# that can be found in the LICENSE file in the root of the source +# tree. An additional intellectual property rights grant can be found +# in the file PATENTS. All contributing project authors may +# be found in the AUTHORS file in the root of the source tree. +"""This is a tool to transform a crt file into a C/C++ header. + +Usage: +python3 generate_sslroots.py certfile.pem [--verbose | -v] [--full_cert | -f] + +Arguments: + -v Print output while running. + -f Add public key and certificate name. Default is to skip and reduce + generated file size. + +The supported cert files are: + - Google: https://pki.goog/roots.pem + - Mozilla: https://curl.se/docs/caextract.html +""" + +import subprocess +from optparse import OptionParser +import os +import re + +_GENERATED_FILE = 'ssl_roots.h' +_PREFIX = '__generated__' +_EXTENSION = '.crt' +_SUBJECT_NAME_ARRAY = 'subject_name' +_SUBJECT_NAME_VARIABLE = 'SubjectName' +_PUBLIC_KEY_ARRAY = 'public_key' +_PUBLIC_KEY_VARIABLE = 'PublicKey' +_CERTIFICATE_ARRAY = 'certificate' +_CERTIFICATE_VARIABLE = 'Certificate' +_CERTIFICATE_SIZE_VARIABLE = 'CertificateSize' +_INT_TYPE = 'size_t' +_CHAR_TYPE = 'unsigned char* const' +_VERBOSE = 'verbose' +_MOZILLA_BUNDLE_CHECK = '## Certificate data from Mozilla as of:' + + +def main(): + """The main entrypoint.""" + parser = OptionParser('usage %prog FILE') + parser.add_option('-v', '--verbose', dest='verbose', action='store_true') + parser.add_option('-f', '--full_cert', dest='full_cert', action='store_true') + options, args = parser.parse_args() + if len(args) < 1: + parser.error('No crt file specified.') + return + root_dir, bundle_type = _SplitCrt(args[0], options) + _GenCFiles(root_dir, options, bundle_type) + _Cleanup(root_dir) + + +def _SplitCrt(source_file, options): + sub_file_blocks = [] + label_name = '' + prev_line = None + root_dir = os.path.dirname(os.path.abspath(source_file)) + '/' + _PrintOutput(root_dir, options) + lines = None + with open(source_file) as f: + lines = f.readlines() + mozilla_bundle = any(l.startswith(_MOZILLA_BUNDLE_CHECK) for l in lines) + for line in lines: + if line.startswith('#'): + if mozilla_bundle: + continue + if line.startswith('# Label: '): + sub_file_blocks.append(line) + label = re.search(r'\".*\"', line) + temp_label = label.group(0) + end = len(temp_label) - 1 + label_name = _SafeName(temp_label[1:end]) + if mozilla_bundle and line.startswith('==='): + sub_file_blocks.append(line) + label_name = _SafeName(prev_line) + elif line.startswith('-----END CERTIFICATE-----'): + sub_file_blocks.append(line) + new_file_name = root_dir + _PREFIX + label_name + _EXTENSION + _PrintOutput('Generating: ' + new_file_name, options) + new_file = open(new_file_name, 'w') + for out_line in sub_file_blocks: + new_file.write(out_line) + new_file.close() + sub_file_blocks = [] + else: + sub_file_blocks.append(line) + prev_line = line + return root_dir, 'Mozilla' if mozilla_bundle else 'Google' + + +def _GenCFiles(root_dir, options, bundle_type): + output_header_file = open(root_dir + _GENERATED_FILE, 'w') + output_header_file.write(_CreateOutputHeader(bundle_type)) + if options.full_cert: + subject_name_list = _CreateArraySectionHeader(_SUBJECT_NAME_VARIABLE, + _CHAR_TYPE, options) + public_key_list = _CreateArraySectionHeader(_PUBLIC_KEY_VARIABLE, + _CHAR_TYPE, options) + certificate_list = _CreateArraySectionHeader(_CERTIFICATE_VARIABLE, + _CHAR_TYPE, options) + certificate_size_list = _CreateArraySectionHeader(_CERTIFICATE_SIZE_VARIABLE, + _INT_TYPE, options) + + for _, _, files in os.walk(root_dir): + for current_file in files: + if current_file.startswith(_PREFIX): + prefix_length = len(_PREFIX) + length = len(current_file) - len(_EXTENSION) + label = current_file[prefix_length:length] + filtered_output, cert_size = _CreateCertSection(root_dir, current_file, + label, options) + output_header_file.write(filtered_output + '\n\n\n') + if options.full_cert: + subject_name_list += _AddLabelToArray(label, _SUBJECT_NAME_ARRAY) + public_key_list += _AddLabelToArray(label, _PUBLIC_KEY_ARRAY) + certificate_list += _AddLabelToArray(label, _CERTIFICATE_ARRAY) + certificate_size_list += (' %s,\n') % (cert_size) + + if options.full_cert: + subject_name_list += _CreateArraySectionFooter() + output_header_file.write(subject_name_list) + public_key_list += _CreateArraySectionFooter() + output_header_file.write(public_key_list) + certificate_list += _CreateArraySectionFooter() + output_header_file.write(certificate_list) + certificate_size_list += _CreateArraySectionFooter() + output_header_file.write(certificate_size_list) + output_header_file.write(_CreateOutputFooter()) + output_header_file.close() + + +def _Cleanup(root_dir): + for f in os.listdir(root_dir): + if f.startswith(_PREFIX): + os.remove(root_dir + f) + + +def _CreateCertSection(root_dir, source_file, label, options): + command = 'openssl x509 -in %s%s -noout -C' % (root_dir, source_file) + _PrintOutput(command, options) + output = subprocess.getstatusoutput(command)[1] + decl_block = 'unsigned char .*_(%s|%s|%s)' %\ + (_SUBJECT_NAME_ARRAY, _PUBLIC_KEY_ARRAY, _CERTIFICATE_ARRAY) + prog = re.compile(decl_block, re.IGNORECASE) + renamed_output = prog.sub('const unsigned char ' + label + r'_\1', output) + + filtered_output = '' + cert_block = '^const unsigned char.*?};$' + prog2 = re.compile(cert_block, re.IGNORECASE | re.MULTILINE | re.DOTALL) + if not options.full_cert: + filtered_output = prog2.sub('', renamed_output, count=2) + else: + filtered_output = renamed_output + + cert_size_block = r'\d\d\d+' + prog3 = re.compile(cert_size_block, re.MULTILINE | re.VERBOSE) + result = prog3.findall(renamed_output) + cert_size = result[len(result) - 1] + + return filtered_output, cert_size + + +def _CreateOutputHeader(bundle_type): + output = ('/*\n' + ' * Copyright 2004 The WebRTC Project Authors. All rights ' + 'reserved.\n' + ' *\n' + ' * Use of this source code is governed by a BSD-style license\n' + ' * that can be found in the LICENSE file in the root of the ' + 'source\n' + ' * tree. An additional intellectual property rights grant can be ' + 'found\n' + ' * in the file PATENTS. All contributing project authors may\n' + ' * be found in the AUTHORS file in the root of the source tree.\n' + ' */\n\n' + '#ifndef RTC_BASE_SSL_ROOTS_H_\n' + '#define RTC_BASE_SSL_ROOTS_H_\n\n' + '// This file is the root certificates in C form.\n\n' + '// It was generated with the following script:\n' + '// tools_webrtc/sslroots/generate_sslroots.py' + ' %s_CA_bundle.pem\n\n' + '// clang-format off\n' + '// Don\'t bother formatting generated code,\n' + '// also it would breaks subject/issuer lines.\n\n' % bundle_type) + return output + + +def _CreateOutputFooter(): + return '// clang-format on\n\n#endif // RTC_BASE_SSL_ROOTS_H_\n' + + +def _CreateArraySectionHeader(type_name, type_type, options): + output = ('const %s kSSLCert%sList[] = {\n') % (type_type, type_name) + _PrintOutput(output, options) + return output + + +def _AddLabelToArray(label, type_name): + return ' %s_%s,\n' % (label, type_name) + + +def _CreateArraySectionFooter(): + return '};\n\n' + + +def _SafeName(original_file_name): + bad_chars = ' -./\\()áéíőú\r\n' + replacement_chars = '' + for _ in bad_chars: + replacement_chars += '_' + translation_table = str.maketrans(bad_chars, replacement_chars) + return original_file_name.translate(translation_table) + + +def _PrintOutput(output, options): + if options.verbose: + print(output) + + +if __name__ == '__main__': + main() |