xref: /aosp_15_r20/external/libwebsockets/scripts/mozilla-trust-gen.sh (revision 1c60b9aca93fdbc9b5f19b2d2194c91294b22281)

#!/bin/bash

# This script fetches the current list of trusted CAs blessed by Mozilla
# for web tls validation, and processes it into two outputs
#
# - ./trust/webroot/* consisting of ./_trust/webroot/der  a static, serveable set
#     of trusted DER certs, with symlinks in ./_trust/webroot/by-skid and
#     ./_trust/webroot/by-iss allowing serving the DER matching a given
#     SubjectKeyIdentifier or Issuer + serial combination (suitably encoded)
#
# - ./_trust/blob-XXXX.bin  a single blob containing indexes and DER CA certs
#
# - ./_trust/trust_blob.h   a C uint8_t array formatted copy of blob-XXXX.bin

# The trust blob layout is currently
#
# 54 42 4c 42     Magic "TBLB"
# 00 01           MSB-first trust blob layout version
# XX XX           MSB-first count of certificates
# XX XX XX XX     MSB-first trust blob generation unix time
# XX XX XX XX     MSB-first offset of cert length table (MSB-first 16-bit length-per-cert)
# XX XX XX XX     MSB-first offset of SKID length table (8-bit length-per-cert)
# XX XX XX XX     MSB-first offset of SKID table
# XX XX XX XX     MSB-first total blob length
#
# XX .. XX        DER certs (start at +0x1c)
# XX .. XX        DER cert length table (MSB-first 16-bit per cert)
# XX .. XX        SKID length table (8-bit per cert)
# XX .. XX        SKID table (variable per cert)
#

echo "Mozilla trust bundle for TLS validation processing  Andy Green <[email protected]>"
echo

rm -rf _trust
mkdir _trust

wget -O _trust/trusted.txt "https://ccadb-public.secure.force.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites"
#cp ~/Downloads/IncludedRootsPEM.txt _trust/trusted.txt

if [ $? -ne 0 ]; then
	echo "Failed to get current website trust bundle"
	exit 1
fi

mkdir -p _trust/webroot/by-skid _trust/webroot/by-iss _trust/webroot/der

echo 0 > _trust/ofs
echo 0 > _trust/count
echo 0 > _trust/skidtab

GT=`date +%s`
BN=_trust/blob-$GT.bin

cat _trust/trusted.txt | while read _line ; do
	line=`echo -n $_line | sed 's/\r$//g'`
	if [ "$line" == "-----BEGIN CERTIFICATE-----" ] ; then
		echo $line > _trust/single
	else
		echo $line >> _trust/single

		if [ "$line" == "-----END CERTIFICATE-----" ] ; then
			openssl x509 -in _trust/single -text -noout > _trust/c1
			if [ $? -ne 0 ] ; then
				echo "FAILED"
				exit 1
			fi

			ISS=`cat _trust/c1 | grep Issuer: | sed "s/.*://g" | sed "s/^\ *//g"`
			SER=`cat _trust/c1 | grep "Serial Number:" | sed "s/.*://g" | sed "s/^\ *//g" | sed "s/\ .*//g"`
			if [ -z "$SER" ] ; then
				SER=`cat _trust/c1 | sed -e "1,/.*Serial Number:/ d" | head -n 1 | sed "s/^\ *//g" | sed "s/\ .*//g"`
			fi
			SKID=`cat _trust/c1 | sed -e '1,/.*X509v3 Subject Key Identifier:/ d' | sed -n '/Signature.*/q;p' | \
				grep ':' | grep -v ': ' | grep -v ':$' | grep -v U | grep -v k | grep -v T | grep -v "i" | \
				grep -v "S" | grep -v "V" | sed "s/^\ *//g"`
			SKID_NO_COLONS=`echo -n $SKID | sed "s/://g"`

			na=`cat _trust/c1 | grep "Not\ After\ :" | sed "s/.*\ :\ //g"`
			ct=`date +%s`
			ts=`date --date="$na" +%s`
			life_days=`echo -n "$(( ( $ts - $ct ) / 86400 ))"`

			echo "$life_days $safe" >> _trust/life
			if [ $life_days -lt 1095 ] ; then
				echo "$life_days $safe" >> _trust/life_lt_3y
			fi

			echo "issuer=\"$ISS\", serial=\"${SER^^}\", skid=\"${SKID_NO_COLONS^^}\", life_days=\"${life_days}\""

			issname=`echo -n "$ISS"_"$SER" | tr -cd '[a-zA-Z0-9]_'`
			skidname=`echo -n "$SKID_NO_COLONS" | tr -cd '[a-zA-Z0-9]_'`
			safe=$issname"_"$skidname

			cat _trust/single | grep -v -- '---' | base64 -d > _trust/webroot/der/$safe
			cd _trust/webroot/by-skid
			ln -sf ../der/$safe $SKID_NO_COLONS
			cd ../../..
			cd _trust/webroot/by-iss
			ln -sf ../der/$safe $issname
			cd ../../..

			DERSIZ=`cat _trust/single | grep -v -- '---' | base64 -d | wc -c | cut -d' ' -f1`

			cat _trust/single | grep -v -- '---' | base64 -d | hexdump -C | tr -s ' ' | sed 's/\ $//g' | \
				cut -d' ' -f 2-17 | cut -d'|' -f1 | grep -v 000 | sed "s/\ //g" | sed ':a;N;$!ba;s/\n//g' | xxd -r -p >> _trust/_ders

			printf "%04x" $DERSIZ | xxd -r -p  >> _trust/_derlens

echo $SKID

			if [ ! -z "$SKID" ] ; then
				echo -n "$SKID_NO_COLONS" | xxd -r -p >> _trust/_skid
			fi
			SKIDSIZ=`echo -n $SKID_NO_COLONS | xxd -r -p | wc -c | cut -d' ' -f1`
			printf "%02x" $SKIDSIZ | xxd -r -p  >> _trust/_skidlens

			OFS=`cat _trust/ofs`
			echo -n $(( $OFS + $DERSIZ )) > _trust/ofs
			COUNT=`cat _trust/count`
			echo -n $(( $COUNT +1 )) > _trust/count
			ST=`cat _trust/skidtab`
			echo -n $(( $ST + ( `echo -n $skidname | wc -c | cut -d' ' -f1` / 2 ) )) > _trust/skidtab

			rm -f _trust/single

		fi
	fi

done

	COUNT=`cat _trust/count`
	OFS=`cat _trust/ofs`
	ST=`cat _trust/skidtab`

	# everything in the layout framing is MSB-first

	# magic
	echo -n "TBLB" > $BN
	# blob layout version
	echo -n 0001 | xxd -r -p >> $BN
	# number of certs in the blob
	printf "%04x" $COUNT | xxd -r -p >> $BN
	# unix time blob was created
	printf "%08x" $GT | xxd -r -p >> $BN

	POS=28
	POS=$(( $POS + `cat _trust/_ders | wc -c | cut -d' ' -f1` ))

	# blob offset of start of cert length table
	printf "%08x" $POS | xxd -r -p >> $BN

	POS=$(( $POS + `cat _trust/_derlens | wc -c | cut -d' ' -f1` ))

	# blob offset of start of SKID length table
	printf "%08x" $POS | xxd -r -p >> $BN

	POS=$(( $POS + `cat _trust/_skidlens | wc -c | cut -d' ' -f1` ))

	# blob offset of start of SKID table
	printf "%08x" $POS | xxd -r -p >> $BN

	POS=$(( $POS + `cat _trust/_skid | wc -c | cut -d' ' -f1` ))

	# blob total length
	printf "%08x" $POS | xxd -r -p >> $BN


	# the DER table, start at +0x1c
	cat _trust/_ders >> $BN
	# the DER length table
	cat _trust/_derlens >> $BN
	# the SKID length table
	cat _trust/_skidlens >> $BN
	# the SKID table
	cat _trust/_skid >> $BN

# produce a C-friendly version of the blob

	cat $BN | hexdump -v -C | tr -s ' ' | sed 's/\ $//g' | \
		cut -d' ' -f 2-17 | cut -d'|' -f1 | grep -v 000 | sed "s/\ /,\ 0x/g" | sed "s/^/0x/g" | \
		sed 's/\, 0x$//g' | sed 's/$/,/g' >> _trust/trust_blob.h


	echo
	echo "$COUNT CA certs, $POS byte blob"
	echo
	echo "CAs expiring in less than 3 years (days left):"
	sort -h _trust/life_lt_3y

	rm -f _trust/count _trust/_idx _trust/_idx_skid _trust/ofs _trust/_skid _trust/skidtab _trust/life _trust/life_lt_3y _trust/c1 _trust/single _trust/_derlens _trust/_ders _trust/_skid _trust/_skidlens

exit 0