mcs/tools/security/mozroots.cs

   1 //
   2 // mozroots.cs: Import the Mozilla's trusted root certificates into Mono
   3 //
   4 // Authors:
   5 //      Sebastien Pouliot <sebastien@ximian.com>
   6 //
   7 // Copyright (C) 2005 Novell, Inc (http://www.novell.com)
   8 //
   9 // Permission is hereby granted, free of charge, to any person obtaining
  10 // a copy of this software and associated documentation files (the
  11 // "Software"), to deal in the Software without restriction, including
  12 // without limitation the rights to use, copy, modify, merge, publish,
  13 // distribute, sublicense, and/or sell copies of the Software, and to
  14 // permit persons to whom the Software is furnished to do so, subject to
  15 // the following conditions:
  16 //
  17 // The above copyright notice and this permission notice shall be
  18 // included in all copies or substantial portions of the Software.
  19 //
  20 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  21 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  22 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  23 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
  24 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
  25 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  26 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  27 //
  28
  29 using System;
  30 using System.Collections;
  31 using System.IO;
  32 using System.Net;
  33 using System.Reflection;
  34 using System.Security.Cryptography;
  35 using System.Text;
  36
  37 using Mono.Security.Authenticode;
  38 using Mono.Security.X509;
  39
  40 [assembly: AssemblyTitle ("Mozilla Roots Importer")]
  41 [assembly: AssemblyDescription ("Download and import trusted root certificates from Mozilla's MXR.")]
  42
  43 namespace Mono.Tools {
  44
  45         class MozRoots {
  46
  47                 // this URL is recommended by https://bugzilla.mozilla.org/show_bug.cgi?id=1279952#c8 and is also used as basis for curl's https://curl.haxx.se/ca/cacert.pem bundle
  48                 private const string defaultUrl = "https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt";
  49
  50                 static string url;
  51                 static string inputFile;
  52                 static string pkcs7filename;
  53                 static bool import;
  54                 static bool machine;
  55                 static bool confirmAddition;
  56                 static bool confirmRemoval;
  57                 static bool quiet;
  58
  59                 static byte[] DecodeOctalString (string s)
  60                 {
  61                         string[] pieces = s.Split ('\\');
  62                         byte[] data = new byte[pieces.Length - 1];
  63                         for (int i = 1; i < pieces.Length; i++) {
  64                                 data[i - 1] = (byte) ((pieces[i][0] - '0' << 6) + (pieces[i][1] - '0' << 3) + (pieces[i][2] - '0'));
  65                         }
  66                         return data;
  67                 }
  68
  69                 static X509Certificate DecodeCertificate (string s)
  70                 {
  71                         byte[] rawdata = DecodeOctalString (s);
  72                         return new X509Certificate (rawdata);
  73                 }
  74
  75                 static Stream GetFile ()
  76                 {
  77                         try {
  78                                 if (inputFile != null) {
  79                                         return File.OpenRead (inputFile);
  80                                 } else {
  81                                         WriteLine ("Downloading from '{0}'...", url);
  82                                         HttpWebRequest req = (HttpWebRequest) WebRequest.Create (url);
  83                                         req.Timeout = 10000;
  84                                         return req.GetResponse ().GetResponseStream ();
  85                                 }
  86                         } catch {
  87                                 return null;
  88                         }
  89                 }
  90
  91                 static X509CertificateCollection DecodeCollection ()
  92                 {
  93                         X509CertificateCollection roots = new X509CertificateCollection ();
  94                         StringBuilder sb = new StringBuilder ();
  95                         bool processing = false;
  96
  97                         using (Stream s = GetFile ()) {
  98                                 if (s == null) {
  99                                         WriteLine ("Couldn't retrieve the file using the supplied information.");
 100                                         return null;
 101                                 }
 102
 103                                 StreamReader sr = new StreamReader (s);
 104                                 while (true) {
 105                                         string line = sr.ReadLine ();
 106                                         if (line == null)
 107                                                 break;
 108
 109                                         if (processing) {
 110                                                 if (line.StartsWith ("END")) {
 111                                                         processing = false;
 112                                                         X509Certificate root = DecodeCertificate (sb.ToString ());
 113                                                         roots.Add (root);
 114
 115                                                         sb = new StringBuilder ();
 116                                                         continue;
 117                                                 }
 118                                                 sb.Append (line);
 119                                         } else {
 120                                                 processing = line.StartsWith ("CKA_VALUE MULTILINE_OCTAL");
 121                                         }
 122                                 }
 123                                 return roots;
 124                         }
 125                 }
 126
 127                 static int Process ()
 128                 {
 129                         ServicePointManager.ServerCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => {
 130                                 if (sslPolicyErrors != System.Net.Security.SslPolicyErrors.None)
 131                                         Console.WriteLine ("WARNING: Downloading the trusted certificate list couldn't be done securely (error: {0}), continuing anyway. If you're using mozroots to bootstrap Mono's trust store on a clean system this might be OK, otherwise it could indicate a network intrusion. Please ensure you're using a trusted network or move to cert-sync.", sslPolicyErrors);
 132
 133                                 // this is very bad, but on a clean system without an existing trust store we don't really have a better option
 134                                 return true;
 135                         };
 136
 137                         X509CertificateCollection roots = DecodeCollection ();
 138                         if (roots == null) {
 139                                 return 1;
 140                         } else if (roots.Count == 0) {
 141                                 WriteLine ("No certificates were found.");
 142                                 return 0;
 143                         }
 144
 145                         if (pkcs7filename != null) {
 146                                 SoftwarePublisherCertificate pkcs7 = new SoftwarePublisherCertificate ();
 147                                 pkcs7.Certificates.AddRange (roots);
 148
 149                                 WriteLine ("Saving root certificates into '{0}' file...", pkcs7filename);
 150                                 using (FileStream fs = File.OpenWrite (pkcs7filename)) {
 151                                         byte[] data = pkcs7.GetBytes ();
 152                                         fs.Write (data, 0, data.Length);
 153                                         fs.Close ();
 154                                 }
 155                         }
 156
 157                         if (import) {
 158                                 WriteLine ("Importing certificates into {0} store...",
 159                                         machine ? "machine" : "user");
 160
 161                                 X509Stores stores = (machine ? X509StoreManager.LocalMachine : X509StoreManager.CurrentUser);
 162                                 X509CertificateCollection trusted = stores.TrustedRoot.Certificates;
 163                                 int additions = 0;
 164                                 foreach (X509Certificate root in roots) {
 165                                         if (!trusted.Contains (root)) {
 166                                                 if (!confirmAddition || AskConfirmation ("add", root)) {
 167                                                         stores.TrustedRoot.Import (root);
 168                                                         if (confirmAddition)
 169                                                                 WriteLine ("Certificate added.{0}", Environment.NewLine);
 170                                                         additions++;
 171                                                 }
 172                                         }
 173                                 }
 174                                 if (additions > 0)
 175                                         WriteLine ("{0} new root certificates were added to your trust store.", additions);
 176
 177                                 X509CertificateCollection removed = new X509CertificateCollection ();
 178                                 foreach (X509Certificate trust in trusted) {
 179                                         if (!roots.Contains (trust)) {
 180                                                 removed.Add (trust);
 181                                         }
 182                                 }
 183                                 if (removed.Count > 0) {
 184                                         if (confirmRemoval) {
 185                                                 WriteLine ("{0} previously trusted certificates were not part of the update.", removed.Count);
 186                                         } else {
 187                                                 WriteLine ("{0} previously trusted certificates were removed.", removed.Count);
 188                                         }
 189
 190                                         foreach (X509Certificate old in removed) {
 191                                                 if (!confirmRemoval || AskConfirmation ("remove", old)) {
 192                                                         stores.TrustedRoot.Remove (old);
 193                                                         if (confirmRemoval)
 194                                                                 WriteLine ("Certificate removed.{0}", Environment.NewLine);
 195                                                 }
 196                                         }
 197                                 }
 198                                 WriteLine ("Import process completed.{0}", Environment.NewLine);
 199                         }
 200                         return 0;
 201                 }
 202
 203                 static string Thumbprint (string algorithm, X509Certificate certificate)
 204                 {
 205                         HashAlgorithm hash = HashAlgorithm.Create (algorithm);
 206                         byte[] digest = hash.ComputeHash (certificate.RawData);
 207                         return BitConverter.ToString (digest);
 208                 }
 209
 210                 static bool AskConfirmation (string action, X509Certificate certificate)
 211                 {
 212                         // the quiet flag is ignored for confirmations
 213                         Console.WriteLine ();
 214                         Console.WriteLine ("Issuer: {0}", certificate.IssuerName);
 215                         Console.WriteLine ("Serial number: {0}", BitConverter.ToString (certificate.SerialNumber));
 216                         Console.WriteLine ("Valid from {0} to {1}", certificate.ValidFrom, certificate.ValidUntil);
 217                         Console.WriteLine ("Thumbprint SHA-1: {0}", Thumbprint ("SHA1", certificate));
 218                         Console.WriteLine ("Thumbprint MD5:   {0}", Thumbprint ("MD5", certificate));
 219                         while (true) {
 220                                 Console.Write ("Are you sure you want to {0} this certificate ? ", action);
 221                                 string s = Console.ReadLine ().ToLower ();
 222                                 if (s == "yes")
 223                                         return true;
 224                                 else if (s == "no")
 225                                         return false;
 226                         }
 227                 }
 228
 229                 static bool ParseOptions (string[] args)
 230                 {
 231                         if (args.Length < 1)
 232                                 return false;
 233
 234                         // set defaults
 235                         url = defaultUrl;
 236                         confirmAddition = true;
 237                         confirmRemoval = true;
 238
 239                         for (int i = 0; i < args.Length; i++) {
 240                                 switch (args[i]) {
 241                                 case "--url":
 242                                         if (i >= args.Length - 1)
 243                                                 return false;
 244                                         url = args[++i];
 245                                         break;
 246                                 case "--file":
 247                                         if (i >= args.Length - 1)
 248                                                 return false;
 249                                         inputFile = args[++i];
 250                                         break;
 251                                 case "--pkcs7":
 252                                         if (i >= args.Length - 1)
 253                                                 return false;
 254                                         pkcs7filename = args[++i];
 255                                         break;
 256                                 case "--import":
 257                                         import = true;
 258                                         break;
 259                                 case "--machine":
 260                                         machine = true;
 261                                         break;
 262                                 case "--sync":
 263                                         confirmAddition = false;
 264                                         confirmRemoval = false;
 265                                         break;
 266                                 case "--ask":
 267                                         confirmAddition = true;
 268                                         confirmRemoval = true;
 269                                         break;
 270                                 case "--ask-add":
 271                                         confirmAddition = true;
 272                                         confirmRemoval = false;
 273                                         break;
 274                                 case "--ask-remove":
 275                                         confirmAddition = false;
 276                                         confirmRemoval = true;
 277                                         break;
 278                                 case "--quiet":
 279                                         quiet = true;
 280                                         break;
 281                                 default:
 282                                         WriteLine ("Unknown option '{0}'.");
 283                                         return false;
 284                                 }
 285                         }
 286                         return true;
 287                 }
 288
 289                 static void Header ()
 290                 {
 291                         Console.WriteLine (new AssemblyInfo ().ToString ());
 292                         Console.WriteLine ("WARNING: mozroots is deprecated, please move to cert-sync instead.");
 293                         Console.WriteLine ();
 294                 }
 295
 296                 static void Help ()
 297                 {
 298                         Console.WriteLine ("Usage: mozroots [--import [--machine] [--sync | --ask | --ask-add | --ask-remove]]");
 299                         Console.WriteLine ("Where the basic options are:");
 300                         Console.WriteLine (" --import\tImport the certificates into the trust store.");
 301                         Console.WriteLine (" --sync\t\tSynchronize (add/remove) the trust store with the certificates.");
 302                         Console.WriteLine (" --ask\t\tAlways confirm before adding or removing trusted certificates.");
 303                         Console.WriteLine (" --ask-add\tAlways confirm before adding a new trusted certificate.");
 304                         Console.WriteLine (" --ask-remove\tAlways confirm before removing an existing trusted certificate.");
 305                         Console.WriteLine ("{0}and the advanced options are", Environment.NewLine);
 306                         Console.WriteLine (" --url url\tSpecify an alternative URL for downloading the trusted");
 307                         Console.WriteLine ("\t\tcertificates (MXR source format).");
 308                         Console.WriteLine (" --file name\tDo not download but use the specified file.");
 309                         Console.WriteLine (" --pkcs7 name\tExport the certificates into a PKCS#7 file.");
 310                         Console.WriteLine (" --machine\tImport the certificate in the machine trust store.");
 311                         Console.WriteLine ("\t\tThe default is to import into the user store.");
 312                         Console.WriteLine (" --quiet\tLimit console output to errors and confirmations messages.");
 313                 }
 314
 315                 static void WriteLine (string str)
 316                 {
 317                         if (!quiet)
 318                                 Console.WriteLine (str);
 319                 }
 320
 321                 static void WriteLine (string format, params object[] args)
 322                 {
 323                         if (!quiet)
 324                                 Console.WriteLine (format, args);
 325                 }
 326
 327                 static int Main (string[] args)
 328                 {
 329                         try {
 330                                 if (!ParseOptions (args)) {
 331                                         Header ();
 332                                         Help ();
 333                                         return 1;
 334                                 }
 335                                 if (!quiet) {
 336                                         Header ();
 337                                 }
 338                                 return Process ();
 339                         }
 340                         catch (Exception e) {
 341                                 // ignore quiet on exception
 342                                 Console.WriteLine ("Error: {0}", e);
 343                                 return 1;
 344                         }
 345                 }
 346         }
 347 }