Skip to content

use Python 3 urllib.request instead of openssl s_client #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
xry111 wants to merge 1 commit into
base: master
Choose a base branch
from
+38 −23
Open

use Python 3 urllib.request instead of openssl s_client #39

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 38 additions & 23 deletions make-ca
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,7 @@ function get_args(){
;;
-p | --proxy)
check_arg $1 $2
PROXY="${2}"
export https_proxy="${2}"
shift 2
;;
-r | --rebuild)
Expand Down Expand Up @@ -631,11 +631,40 @@ function write_java_p12() {
fi
}

function download_hg_mozilla() {
# $1 == URL
# $2 == Output File Path

/usr/bin/python3 << EOF
import ssl
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ctx.load_verify_locations(cafile = '${MOZILLA_CA_ROOT}')
ctx.load_verify_locations(capath = '${CERTDIR}')

import urllib.request
hdr = {'Accept-Encoding': 'gzip, identity'}
req = urllib.request.Request('$1', headers = hdr)
conn = urllib.request.urlopen(req, context = ctx)

data = conn.read()
if conn.headers.get('Content-Encoding') == 'gzip':
import gzip
data = gzip.decompress(data)
else:
assert(conn.headers.get('Content-Encoding') == 'identity')

of = open('$2', 'wb')
of.write(data)
EOF
}

# Process command line arguments
get_args $@

test ! -x "${OPENSSL}" && \
echo "OpenSSL not found at ${OPENSSL}. Exiting..." && exit 1
test ! -x "/usr/bin/python3" && \
echo "Python 3 not found at /usr/bin/python3. Exiting..." && exit 1
mkdir -p "${TEMPDIR}"/{certs,pki/anchors,work}

if test "${WITH_P12}" -eq "1"; then
Expand All @@ -660,27 +689,15 @@ fi
# Download certdata.txt if selected
if test "${GET}" == "1"; then
echo -n "Checking for new version of certdata.txt..."
HOST=$(echo "${URL}" | /usr/bin/cut -d / -f 3)
_url=$(echo "${URL}" | sed 's@raw-file@log@')
SARGS="-ign_eof -connect ${HOST}:443 -verifyCAfile ${MOZILLA_CA_ROOT}"
if test -d /etc/ssl/certs; then
SARGS="${SARGS} -verifyCApath ${CERTDIR}"
fi
SARGS="${SARGS} -verify_return_error"
if test "${PROXY}x" != "x"; then
SARGS="${SARGS} -proxy ${PROXY}"
fi
printf "GET ${_url} HTTP/1.1\nConnection: no-keep-alive\n\n" | \
${OPENSSL} s_client ${SARGS} 2> /dev/null > "${TEMPDIR}/certdata.txt.log"
unset _url
echo "done."

download_hg_mozilla "${_url}" "${TEMPDIR}/certdata.txt.log"
# Error out here if we couldn't get the file
grep -m1 "<i>" "${TEMPDIR}/certdata.txt.log" > /dev/null 2>&1
if test "$?" -gt 0; then
echo "Unable to get revision from server! Exiting."
exit 1
fi
unset _url
echo "done."

# See if we need to update before downloading the file
REVISION=$(grep -m1 "<i>" "${TEMPDIR}/certdata.txt.log" | cut -d "<" -f 1)
Expand All @@ -695,14 +712,12 @@ if test "${GET}" == "1"; then

# Download the new file
echo -n "Downloading certdata.txt..."
printf "GET ${URL} HTTP/1.1\nConnection: no-keep-alive\n\n" | \
${OPENSSL} s_client ${SARGS} 2> /dev/null >> "${CERTDATA}"
_line=$(( $(grep -n -m 1 "^#$" "${CERTDATA}" | cut -d ":" -f 1) - 1))
sed -e "1,${_line}d" -i "${CERTDATA}"
download_hg_mozilla "${URL}" "${CERTDATA}"
if test "$?" -gt 0; then
echo "Unable to download certdata.txt from server! Exiting."
exit 1
fi
sed "1i # Revision:${REVISION}" -i "${CERTDATA}"
mv "${CERTDATA}" "${CERTDATA}.tmp"
head -n -33 "${CERTDATA}.tmp" > "${CERTDATA}"
rm "${CERTDATA}.tmp"
echo "done."
fi

Expand Down