get_mozilla_ciphers.py 6.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213
  1. #!/usr/bin/python
  2. # coding=utf-8
  3. # Copyright 2011-2015, The Tor Project, Inc
  4. # original version by Arturo Filastò
  5. # See LICENSE for licensing information
  6. # This script parses Firefox and OpenSSL sources, and uses this information
  7. # to generate a ciphers.inc file.
  8. #
  9. # It takes two arguments: the location of a firefox source directory, and the
  10. # location of an openssl source directory.
  11. import os
  12. import re
  13. import sys
  14. if len(sys.argv) != 3:
  15. print >>sys.stderr, "Syntax: get_mozilla_ciphers.py <firefox-source-dir> <openssl-source-dir>"
  16. sys.exit(1)
  17. ff_root = sys.argv[1]
  18. ossl_root = sys.argv[2]
  19. def ff(s):
  20. return os.path.join(ff_root, s)
  21. def ossl(s):
  22. return os.path.join(ossl_root, s)
  23. #####
  24. # Read the cpp file to understand what Ciphers map to what name :
  25. # Make "ciphers" a map from name used in the javascript to a cipher macro name
  26. fileA = open(ff('security/manager/ssl/nsNSSComponent.cpp'),'r')
  27. # The input format is a file containing exactly one section of the form:
  28. # static CipherPref CipherPrefs[] = {
  29. # {"name", MACRO_NAME}, // comment
  30. # ...
  31. # {NULL, 0}
  32. # }
  33. inCipherSection = False
  34. cipherLines = []
  35. for line in fileA:
  36. if line.startswith('static const CipherPref sCipherPrefs[]'):
  37. # Get the starting boundary of the Cipher Preferences
  38. inCipherSection = True
  39. elif inCipherSection:
  40. line = line.strip()
  41. if line.startswith('{ nullptr, 0}'):
  42. # At the ending boundary of the Cipher Prefs
  43. break
  44. else:
  45. cipherLines.append(line)
  46. fileA.close()
  47. # Parse the lines and put them into a dict
  48. ciphers = {}
  49. cipher_pref = {}
  50. key_pending = None
  51. for line in cipherLines:
  52. m = re.search(r'^{\s*\"([^\"]+)\",\s*(\S+)\s*(?:,\s*(true|false))?\s*}', line)
  53. if m:
  54. assert not key_pending
  55. key,value,enabled = m.groups()
  56. if enabled == 'true':
  57. ciphers[key] = value
  58. cipher_pref[value] = key
  59. continue
  60. m = re.search(r'^{\s*\"([^\"]+)\",', line)
  61. if m:
  62. assert not key_pending
  63. key_pending = m.group(1)
  64. continue
  65. m = re.search(r'^\s*(\S+)(?:,\s*(true|false))+\s*}', line)
  66. if m:
  67. assert key_pending
  68. key = key_pending
  69. value,enabled = m.groups()
  70. key_pending = None
  71. if enabled == 'true':
  72. ciphers[key] = value
  73. cipher_pref[value] = key
  74. ####
  75. # Now find the correct order for the ciphers
  76. fileC = open(ff('security/nss/lib/ssl/ssl3con.c'), 'r')
  77. firefox_ciphers = []
  78. inEnum=False
  79. for line in fileC:
  80. if not inEnum:
  81. if "ssl3CipherSuiteCfg cipherSuites[" in line:
  82. inEnum = True
  83. continue
  84. if line.startswith("};"):
  85. break
  86. m = re.match(r'^\s*\{\s*([A-Z_0-9]+),', line)
  87. if m:
  88. firefox_ciphers.append(m.group(1))
  89. fileC.close()
  90. #####
  91. # Read the JS file to understand what ciphers are enabled. The format is
  92. # pref("name", true/false);
  93. # Build a map enabled_ciphers from javascript name to "true" or "false",
  94. # and an (unordered!) list of the macro names for those ciphers that are
  95. # enabled.
  96. fileB = open(ff('netwerk/base/security-prefs.js'), 'r')
  97. enabled_ciphers = {}
  98. for line in fileB:
  99. m = re.match(r'pref\(\"([^\"]+)\"\s*,\s*(\S*)\s*\)', line)
  100. if not m:
  101. continue
  102. key, val = m.groups()
  103. if key.startswith("security.ssl3"):
  104. enabled_ciphers[key] = val
  105. fileB.close()
  106. used_ciphers = []
  107. for k, v in enabled_ciphers.items():
  108. if v == "true":
  109. used_ciphers.append(ciphers[k])
  110. #oSSLinclude = ('/usr/include/openssl/ssl3.h', '/usr/include/openssl/ssl.h',
  111. # '/usr/include/openssl/ssl2.h', '/usr/include/openssl/ssl23.h',
  112. # '/usr/include/openssl/tls1.h')
  113. oSSLinclude = ['ssl3.h', 'ssl.h'
  114. 'ssl2.h', 'ssl23.h',
  115. 'tls1.h']
  116. #####
  117. # This reads the hex code for the ciphers that are used by firefox.
  118. # sslProtoD is set to a map from macro name to macro value in sslproto.h;
  119. # cipher_codes is set to an (unordered!) list of these hex values.
  120. sslProto = open(ff('security/nss/lib/ssl/sslproto.h'), 'r')
  121. sslProtoD = {}
  122. for line in sslProto:
  123. m = re.match('#define\s+(\S+)\s+(\S+)', line)
  124. if m:
  125. key, value = m.groups()
  126. sslProtoD[key] = value
  127. sslProto.close()
  128. cipher_codes = []
  129. for x in used_ciphers:
  130. cipher_codes.append(sslProtoD[x].lower())
  131. ####
  132. # Now read through all the openssl include files, and try to find the openssl
  133. # macro names for those files.
  134. openssl_macro_by_hex = {}
  135. all_openssl_macros = {}
  136. for fl in oSSLinclude:
  137. fname = ossl("include/openssl/"+fl)
  138. if not os.path.exists(fname):
  139. continue
  140. fp = open(fname, 'r')
  141. for line in fp.readlines():
  142. m = re.match('# *define\s+(\S+)\s+(\S+)', line)
  143. if m:
  144. value,key = m.groups()
  145. if key.startswith('0x') and "_CK_" in value:
  146. key = key.replace('0x0300','0x').lower()
  147. #print "%s %s" % (key, value)
  148. openssl_macro_by_hex[key] = value
  149. all_openssl_macros[value]=key
  150. fp.close()
  151. # Now generate the output.
  152. print """\
  153. /* This is an include file used to define the list of ciphers clients should
  154. * advertise. Before including it, you should define the CIPHER and XCIPHER
  155. * macros.
  156. *
  157. * This file was automatically generated by get_mozilla_ciphers.py.
  158. */"""
  159. # Go in order by the order in CipherPrefs
  160. for firefox_macro in firefox_ciphers:
  161. try:
  162. js_cipher_name = cipher_pref[firefox_macro]
  163. except KeyError:
  164. # This one has no javascript preference.
  165. continue
  166. # The cipher needs to be enabled in security-prefs.js
  167. if enabled_ciphers.get(js_cipher_name, 'false') != 'true':
  168. continue
  169. hexval = sslProtoD[firefox_macro].lower()
  170. try:
  171. openssl_macro = openssl_macro_by_hex[hexval.lower()]
  172. openssl_macro = openssl_macro.replace("_CK_", "_TXT_")
  173. if openssl_macro not in all_openssl_macros:
  174. raise KeyError()
  175. format = {'hex':hexval, 'macro':openssl_macro, 'note':""}
  176. except KeyError:
  177. # openssl doesn't have a macro for this.
  178. format = {'hex':hexval, 'macro':firefox_macro,
  179. 'note':"/* No openssl macro found for "+hexval+" */\n"}
  180. res = """\
  181. %(note)s#ifdef %(macro)s
  182. CIPHER(%(hex)s, %(macro)s)
  183. #else
  184. XCIPHER(%(hex)s, %(macro)s)
  185. #endif""" % format
  186. print res