diff options
| -rwxr-xr-x | branding/scripts/check-ca-crt.py | 46 | ||||
| -rwxr-xr-x | branding/scripts/vendorize.py | 99 | ||||
| -rw-r--r-- | branding/template/config.go | 32 |
3 files changed, 177 insertions, 0 deletions
diff --git a/branding/scripts/check-ca-crt.py b/branding/scripts/check-ca-crt.py new file mode 100755 index 0000000..6462467 --- /dev/null +++ b/branding/scripts/check-ca-crt.py @@ -0,0 +1,46 @@ +#!/usr/bin/env python3 +import re +import sys +import urllib.request + +SCRIPT_NAME = 'check-ca-crt.py' + +USAGE = '''Check that the stored provider CA matches the one announced online. +Usage: {name} <provider> <uri> + +Example: {name} riseup black.riseup.net'''.format(name=SCRIPT_NAME) + + +def getLocalCert(provider): + sanitized = re.sub(r'[^\w\s-]', '', provider).strip().lower() + with open('config/{provider}-ca.crt'.format(provider=sanitized)) as crt: + return crt.read().strip() + + +def getRemoteCert(uri): + fp = urllib.request.urlopen('https://' + uri + '/ca.crt') + remote_cert = fp.read().decode('utf-8').strip() + fp.close() + return remote_cert + + +if __name__ == '__main__': + + if len(sys.argv) != 3: + print('[!] Not enough arguments') + print(USAGE) + sys.exit(1) + + provider = sys.argv[1] + uri = sys.argv[2] + + local = getLocalCert(provider) + remote = getRemoteCert(uri) + + try: + assert local == remote + except AssertionError: + print('[!] ERROR: remote and local CA certs do not match') + sys.exit(1) + else: + print('OK') diff --git a/branding/scripts/vendorize.py b/branding/scripts/vendorize.py new file mode 100755 index 0000000..46cc1e6 --- /dev/null +++ b/branding/scripts/vendorize.py @@ -0,0 +1,99 @@ +#!/usr/bin/env python3 + +import os +import sys + +from string import Template +import configparser + +OUTFILE = 'config.go' +INFILE = 'config.go.tmpl' +CONFIGFILE = 'config/vendor.conf' +SCRIPT_NAME = 'vendorize' + + +def getProviderData(config): + default = config['default']['provider'] + print("[+] Configured provider:", default) + + c = config[default] + d = dict() + + keys = ('name', 'applicationName', 'binaryName', + 'providerURL', 'tosURL', 'helpURL', + 'donateURL', 'apiURL', 'geolocationAPI', 'caCertString') + + for value in keys: + d[value] = c.get(value) + + return d + + +def addCaData(data, configfile): + provider = data.get('name').lower() + folder, f = os.path.split(configfile) + caFile = os.path.join(folder, provider + '-ca.crt') + if not os.path.isfile(caFile): + bail('[!] Cannot find CA file in {path}'.format(path=caFile)) + with open(caFile) as ca: + data['caCertString'] = ca.read().strip() + + +def writeOutput(data, infile, outfile): + + with open(infile) as infile: + s = Template(infile.read()) + + with open(outfile, 'w') as outf: + outf.write(s.substitute(data)) + + +def bail(msg=None): + if not msg: + print('Usage: {scriptname}.py <template> <config> <output>'.format( + scriptname=SCRIPT_NAME)) + else: + print(msg) + sys.exit(1) + + +if __name__ == "__main__": + infile = outfile = "" + + if len(sys.argv) > 4: + bail() + + elif len(sys.argv) == 1: + infile = INFILE + outfile = OUTFILE + configfile = CONFIGFILE + else: + try: + infile = sys.argv[1] + configfile = sys.argv[2] + outfile = sys.argv[3] + except IndexError: + bail() + + if not os.path.isfile(infile): + bail('[!] Cannot find template in {path}'.format( + path=os.path.abspath(infile))) + elif not os.path.isfile(configfile): + bail('[!] Cannot find config in {path}'.format( + path=os.path.abspath(configfile))) + else: + print('[+] Using {path} as template'.format( + path=os.path.abspath(infile))) + print('[+] Using {path} as config'.format( + path=os.path.abspath(configfile))) + + config = configparser.ConfigParser() + config.read(configfile) + + data = getProviderData(config) + addCaData(data, configfile) + writeOutput(data, infile, outfile) + + print('[+] Wrote configuration for {provider} to {outf}'.format( + provider=data.get('name'), + outf=os.path.abspath(outfile))) diff --git a/branding/template/config.go b/branding/template/config.go new file mode 100644 index 0000000..c3a9a33 --- /dev/null +++ b/branding/template/config.go @@ -0,0 +1,32 @@ +/* + DO NOT EDIT -------------------------------------------------- + + This file has been automatically generated by `go generate`. + Any changes will be overriden. + + DO NOT EDIT -------------------------------------------------- +*/ + +package config + +/* All these constants are defined in the vendor.conf file +*/ +const ( + Provider = "$providerURL" + ApplicationName = "$applicationName" + BinaryName = "$binaryName" + DonateURL = "$donateURL" + HelpURL = "$helpURL" + TosURL = "$tosURL" + APIURL = "$apiURL" + GeolocationAPI = "$geolocationAPI" +) + +/* + +CaCert : a string containing a representation of the provider CA, used to + sign the webapp and openvpn certificates. should be placed in + config/[provider]-ca.crt + +*/ +var CaCert = []byte(`$caCertString`) |