mk-ca-bundle: Update the vbscript version

Bring the VBScript version more in line with the perl version:

- Change timestamp to UTC.

- Change URL retrieval to HTTPS-only by default.

- Comment out the options that disabled SSL cert checking by default.

- Assume OpenSSL is present, get SHA256. And add a flag to toggle it.

- Fix cert issuer name output.

The cert issuer output is now ansi, converted from UTF-8. Prior to this
it was corrupt UTF-8. It turns out though we can work with UTF-8 the
FSO object that writes ca-bundle can't write UTF-8, so there will have
to be some alternative if UTF-8 is needed (like an ADODB.Stream).

- Disable the certificate text info feature.

The certificate text info doesn't work properly with any recent OpenSSL.

diff --git a/lib/mk-ca-bundle.pl b/lib/mk-ca-bundle.pl
index 38e7ff73c829f7d1b990271a489b103694928296..75278f168ac7bfe895f58ee491b8c544d16edc98 100755 (executable)
--- a/lib/mk-ca-bundle.pl
+++ b/lib/mk-ca-bundle.pl
@@ -244,7 +244,8 @@ sub sha256 {
     close(FILE);
   } else {
     # Use OpenSSL command if Perl Digest::SHA modules not available
-    $result = (split(/ |\r|\n/,`$openssl dgst -sha256 $_[0]`))[1];
+    $result = `"$openssl" dgst -r -sha256 "$_[0]"`;
+    $result =~ s/^([0-9a-f]{64}) .+/$1/is;
   }
   return $result;
 }
@@ -392,7 +393,7 @@ print CRT <<EOT;
 ##
 ## Bundle of CA Root Certificates
 ##
-## Certificate data from Mozilla ${datesrc}: ${currentdate}
+## Certificate data from Mozilla ${datesrc}: ${currentdate} GMT
 ##
 ## This is a bundle of X.509 certificates of public Certificate Authorities
 ## (CA). These were automatically extracted from Mozilla's root certificates

diff --git a/lib/mk-ca-bundle.vbs b/lib/mk-ca-bundle.vbs
index b0d94277946632ee73f06bf18b4cee7a4c8f0f09..38eb48abad50dc5414840b0798335dca300b1b28 100755 (executable)
--- a/lib/mk-ca-bundle.vbs
+++ b/lib/mk-ca-bundle.vbs
@@ -26,17 +26,20 @@
 '* Hacked by Guenter Knauf\r
 '***************************************************************************\r
 Option Explicit\r
-Const myVersion = "0.3.9"\r
+Const myVersion = "0.4.0"\r
 \r
-Const myUrl = "http://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt"\r
+Const myUrl = "https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt"\r
 Const myOpenssl = "openssl.exe"\r
 \r
-Const myCdSavF = FALSE       ' Flag: save downloaded data to file certdata.txt\r
+Const myUseOpenSSL = TRUE    ' Flag: set FALSE if openssl is not present\r
+Const myCdSavF = TRUE        ' Flag: save downloaded data to file certdata.txt\r
 Const myCaBakF = TRUE        ' Flag: backup existing ca-bundle certificate\r
 Const myAskLiF = TRUE        ' Flag: display certdata.txt license agreement\r
-Const myAskTiF = TRUE        ' Flag: ask to include certificate text info\r
 Const myWrapLe = 76          ' Default length of base64 output lines\r
 \r
+' cert info code doesn't work properly with any recent openssl, leave disabled.\r
+Const myAskTiF = FALSE       ' Flag: ask to include certificate text info\r
+\r
 '******************* Nothing to configure below! *******************\r
 Dim objShell, objNetwork, objFSO, objHttp\r
 Dim myBase, mySelf, myFh, myTmpFh, myCdData, myCdFile, myCaFile, myTmpName, myBakNum, myOptTxt, i\r
@@ -53,8 +56,12 @@ myTmpName = InputBox("Enter output filename:", mySelf, myCaFile)
 If Not (myTmpName = "") Then\r
   myCaFile = myTmpName\r
 End If\r
-' Lets ignore SSL invalid cert errors\r
-objHttp.Option(4) = 256 + 512 + 4096 + 8192\r
+If (myCdFile = "") Then\r
+  MsgBox("URL does not contain filename!"), vbCritical, mySelf\r
+  WScript.Quit 1\r
+End If\r
+' Uncomment the line below to ignore SSL invalid cert errors\r
+' objHttp.Option(4) = 256 + 512 + 4096 + 8192\r
 objHttp.SetTimeouts 0, 5000, 10000, 10000\r
 objHttp.Open "GET", myUrl, FALSE\r
 objHttp.setRequestHeader "User-Agent", WScript.ScriptName & "/" & myVersion\r
@@ -63,15 +70,13 @@ If Not (objHttp.Status = 200) Then
   MsgBox("Failed to download '" & myCdFile & "': " & objHttp.Status & " - " & objHttp.StatusText), vbCritical, mySelf\r
   WScript.Quit 1\r
 End If\r
-' Convert data from ResponseBody instead of using ResponseText because of UTF-8\r
-myCdData = ConvertBinaryData(objHttp.ResponseBody)\r
-Set objHttp = Nothing\r
 ' Write received data to file if enabled\r
 If (myCdSavF = TRUE) Then\r
-  Set myFh = objFSO.OpenTextFile(myCdFile, 2, TRUE)\r
-  myFh.Write myCdData\r
-  myFh.Close\r
+  Call SaveBinaryData(myCdFile, objHttp.ResponseBody)\r
 End If\r
+' Convert data from ResponseBody instead of using ResponseText because of UTF-8\r
+myCdData = ConvertBinaryData(objHttp.ResponseBody)\r
+Set objHttp = Nothing\r
 ' Backup exitsing ca-bundle certificate file\r
 If (myCaBakF = TRUE) Then\r
   If objFSO.FileExists(myCaFile) Then\r
@@ -104,20 +109,27 @@ myData = ""
 myLines = Split(myCdData, vbLf, -1)\r
 Set myFh = objFSO.OpenTextFile(myCaFile, 2, TRUE)\r
 myFh.Write "##" & vbLf\r
-myFh.Write "## " & myCaFile & " -- Bundle of CA Root Certificates" & vbLf\r
+myFh.Write "## Bundle of CA Root Certificates" & vbLf\r
 myFh.Write "##" & vbLf\r
-myFh.Write "## Converted at: " & Now & vbLf\r
+myFh.Write "## Certificate data from Mozilla as of: " & _\r
+  ConvertDateToString(LocalDateToUTC(Now)) & " GMT" & vbLf\r
 myFh.Write "##" & vbLf\r
 myFh.Write "## This is a bundle of X.509 certificates of public Certificate Authorities" & vbLf\r
 myFh.Write "## (CA). These were automatically extracted from Mozilla's root certificates" & vbLf\r
 myFh.Write "## file (certdata.txt).  This file can be found in the mozilla source tree:" & vbLf\r
-myFh.Write "## '/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt'" & vbLf\r
+myFh.Write "## " & myUrl & vbLf\r
 myFh.Write "##" & vbLf\r
 myFh.Write "## It contains the certificates in PEM format and therefore" & vbLf\r
 myFh.Write "## can be directly used with curl / libcurl / php_curl, or with" & vbLf\r
 myFh.Write "## an Apache+mod_ssl webserver for SSL client authentication." & vbLf\r
 myFh.Write "## Just configure this file as the SSLCACertificateFile." & vbLf\r
 myFh.Write "##" & vbLf\r
+myFh.Write "## Conversion done with mk-ca-bundle.vbs version " & myVersion & "." & vbLf\r
+If (myCdSavF = TRUE) And (myUseOpenSSL = TRUE) Then\r
+  myFh.Write "## SHA256: " & FileSHA256(myCdFile) & vbLf\r
+End If\r
+myFh.Write "##" & vbLf & vbLf\r
+\r
 myFh.Write vbLf\r
 For i = 0 To UBound(myLines)\r
   If InstrRev(myLines(i), "CKA_LABEL ") Then\r
@@ -216,11 +228,24 @@ Function ConvertBinaryData(arrBytes)
   objStream.Write arrBytes\r
   objStream.Position = 0\r
   objStream.Type = 2\r
-  objStream.Charset = "ascii"\r
+  objStream.Charset = "utf-8"\r
   ConvertBinaryData = objStream.ReadText\r
   Set objStream = Nothing\r
 End Function\r
 \r
+Function SaveBinaryData(filename, data)\r
+  Const adTypeBinary = 1\r
+  Const adSaveCreateOverWrite = 2\r
+  Dim objStream\r
+  Set objStream = CreateObject("ADODB.Stream")\r
+  objStream.Type = adTypeBinary\r
+  objStream.Open\r
+  objStream.Write data\r
+  objStream.SaveToFile filename, adSaveCreateOverWrite\r
+  objStream.Close\r
+  Set objStream = Nothing\r
+End Function\r
+\r
 Function RegExprFirst(SearchPattern, TheString)\r
   Dim objRegExp, Matches                        ' create variables.\r
   Set objRegExp = New RegExp                    ' create a regular expression.\r
@@ -283,4 +308,61 @@ Function MyASC(OneChar)
   If OneChar = "" Then MyASC = 0 Else MyASC = Asc(OneChar)\r
 End Function\r
 \r
+' Return the date in the same format as perl to match mk-ca-bundle.pl output:\r
+' Wed Sep  7 03:12:05 2016\r
+Function ConvertDateToString(input)\r
+  Dim output\r
+  output = WeekDayName(WeekDay(input), TRUE) & " " & _\r
+           MonthName(Month(input), TRUE) & " "\r
+  If (Len(Day(input)) = 1) Then\r
+    output = output & " "\r
+  End If\r
+  output = output & _\r
+           Day(input) & " " & _\r
+           FormatDateTime(input, vbShortTime) & ":"\r
+  If (Len(Second(input)) = 1) Then\r
+    output = output & "0"\r
+  End If\r
+  output = output & _\r
+           Second(input) & " " & _\r
+           Year(input)\r
+  ConvertDateToString = output\r
+End Function\r
+\r
+' Convert local Date to UTC. Microsoft says:\r
+' Use Win32_ComputerSystem CurrentTimeZone property, because it automatically\r
+' adjusts the Time Zone bias for daylight saving time; Win32_Time Zone Bias\r
+' property does not.\r
+' https://msdn.microsoft.com/en-us/library/windows/desktop/ms696015.aspx\r
+Function LocalDateToUTC(localdate)\r
+  Dim item, offset\r
+  For Each item In GetObject("winmgmts:").InstancesOf("Win32_ComputerSystem")\r
+    offset = item.CurrentTimeZone ' the offset in minutes\r
+  Next\r
+  If (offset < 0) Then\r
+    LocalDateToUTC = DateAdd("n",  ABS(offset), localdate)\r
+  Else\r
+    LocalDateToUTC = DateAdd("n", -ABS(offset), localdate)\r
+  End If\r
+  'objShell.PopUp LocalDateToUTC\r
+End Function\r
 \r
+Function FileSHA256(filename)\r
+  Dim cmd, rval, tmpOut, tmpFh\r
+  if (myUseOpenSSL = TRUE) Then\r
+    tmpOut = objFSO.GetSpecialFolder(2).Path & "\" & objFSO.GetTempName\r
+    cmd = """" & myOpenssl & """ dgst -r -sha256 -out """ & tmpOut & """ """ & filename & """"\r
+    rval = objShell.Run(cmd, 0, TRUE)\r
+    If Not (rval = 0) Then\r
+      MsgBox("Failed to get sha256 of """ & filename & """ with OpenSSL commandline!"), vbCritical, mySelf\r
+      objFSO.DeleteFile tmpOut, TRUE\r
+      WScript.Quit 3\r
+    End If\r
+    Set tmpFh = objFSO.OpenTextFile(tmpOut, 1)\r
+    FileSHA256 = RegExprFirst("^([0-9a-f]{64}) .+", tmpFh.ReadAll)\r
+    tmpFh.Close\r
+    objFSO.DeleteFile tmpOut, TRUE\r
+  Else\r
+    FileSHA256 = ""\r
+  End If\r
+End Function\r