romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 19:03:40 +03:00
Code Issues Projects Releases Packages Wiki Activity

Fix to skip untrusted certs.

Browse source
This commit is contained in:
Guenter Knauf 2011-09-04 17:05:49 +02:00
parent 476f194d7f
commit 809cde5416
1 changed files with 29 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

50
lib/mk-ca-bundle.pl
View file

@ -40,7 +40,7 @@ my $url = 'http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/
# If the OpenSSL commandline is not in search path you can configure it here! # If the OpenSSL commandline is not in search path you can configure it here!
my $openssl = 'openssl'; my $openssl = 'openssl';
my $version = '1.15'; my $version = '1.16';
getopts('bhilnqtuv'); getopts('bhilnqtuv');
@ -77,15 +77,13 @@ my $resp;
unless ($opt_n and -e $txt) { unless ($opt_n and -e $txt) {
print "Downloading '$txt' ...\n" if (!$opt_q); print "Downloading '$txt' ...\n" if (!$opt_q);
my $ua = new LWP::UserAgent(agent => "$0/$version"); my $ua = new LWP::UserAgent(agent => "$0/$version");
$ua->env_proxy(); $ua->env_proxy();
$resp = $ua->mirror($url, $txt); $resp = $ua->mirror($url, $txt);
} if ($resp && $resp->code eq '304') {
if ($resp && $resp->code eq '304') {
print "Not modified\n" unless $opt_q; print "Not modified\n" unless $opt_q;
exit 0; exit 0;
}
} }
my $currentdate = scalar gmtime($resp ? $resp->last_modified : (stat($txt))[9]); my $currentdate = scalar gmtime($resp ? $resp->last_modified : (stat($txt))[9]);
@ -124,6 +122,7 @@ close(CRT) or die "Couldn't close $crt: $!";
print "Processing '$txt' ...\n" if (!$opt_q); print "Processing '$txt' ...\n" if (!$opt_q);
my $caname; my $caname;
my $certnum = 0; my $certnum = 0;
my $skipnum = 0;
open(TXT,"$txt") or die "Couldn't open $txt: $!"; open(TXT,"$txt") or die "Couldn't open $txt: $!";
while (<TXT>) { while (<TXT>) {
if (/\*\*\*\*\* BEGIN LICENSE BLOCK \*\*\*\*\*/) { if (/\*\*\*\*\* BEGIN LICENSE BLOCK \*\*\*\*\*/) {
@ -147,6 +146,7 @@ while (<TXT>) {
if (/^CKA_LABEL\s+[A-Z0-9]+\s+\"(.*)\"/) { if (/^CKA_LABEL\s+[A-Z0-9]+\s+\"(.*)\"/) {
$caname = $1; $caname = $1;
} }
my $untrusted = 0;
if (/^CKA_VALUE MULTILINE_OCTAL/) { if (/^CKA_VALUE MULTILINE_OCTAL/) {
my $data; my $data;
while (<TXT>) { while (<TXT>) {
@ -158,28 +158,36 @@ while (<TXT>) {
$data .= chr(oct); $data .= chr(oct);
} }
} }
my $pem = "-----BEGIN CERTIFICATE-----\n" while (<TXT>) {
. MIME::Base64::encode($data) last if (/^#$/);
. "-----END CERTIFICATE-----\n"; $untrusted = 1 if (/^CKA_TRUST_SERVER_AUTH\s+CK_TRUST\s+CKT_NSS_NOT_TRUSTED$/);
open(CRT, ">>$crt") or die "Couldn't open $crt: $!";
print CRT "\n$caname\n";
print CRT ("=" x length($caname) . "\n");
if (!$opt_t) {
print CRT $pem;
} }
close(CRT) or die "Couldn't close $crt: $!"; if ($untrusted) {
if ($opt_t) { $skipnum ++;
open(TMP, "|$openssl x509 -md5 -fingerprint -text -inform PEM >> $crt") or die "Couldn't open openssl pipe: $!"; } else {
print TMP $pem; my $pem = "-----BEGIN CERTIFICATE-----\n"
close(TMP) or die "Couldn't close openssl pipe: $!"; . MIME::Base64::encode($data)
. "-----END CERTIFICATE-----\n";
open(CRT, ">>$crt") or die "Couldn't open $crt: $!";
print CRT "\n$caname\n";
print CRT ("=" x length($caname) . "\n");
if (!$opt_t) {
print CRT $pem;
}
close(CRT) or die "Couldn't close $crt: $!";
if ($opt_t) {
open(TMP, "|$openssl x509 -md5 -fingerprint -text -inform PEM >> $crt") or die "Couldn't open openssl pipe: $!";
print TMP $pem;
close(TMP) or die "Couldn't close openssl pipe: $!";
}
print "Parsing: $caname\n" if ($opt_v);
$certnum ++;
} }
print "Parsing: $caname\n" if ($opt_v);
$certnum ++;
} }
} }
close(TXT) or die "Couldn't close $txt: $!"; close(TXT) or die "Couldn't close $txt: $!";
unlink $txt if ($opt_u); unlink $txt if ($opt_u);
print "Done ($certnum CA certs processed).\n" if (!$opt_q); print "Done ($certnum CA certs processed, $skipnum skipped).\n" if (!$opt_q);
exit; exit;