diff options
Diffstat (limited to 'tools/josef_experimental_auditor.py')
| -rwxr-xr-x | tools/josef_experimental_auditor.py | 49 |
1 files changed, 27 insertions, 22 deletions
diff --git a/tools/josef_experimental_auditor.py b/tools/josef_experimental_auditor.py index 05f7a9a..78a3fe2 100755 --- a/tools/josef_experimental_auditor.py +++ b/tools/josef_experimental_auditor.py @@ -18,12 +18,12 @@ DEFAULT_CUR_FILE = 'all-sth.json' base_urls = [ # "https://plausible.ct.nordu.net/", # "https://ct1.digicert-ct.com/log/", - "https://ct.izenpe.com/", + # "https://ct.izenpe.com/", # "https://log.certly.io/", # "https://ct.googleapis.com/aviator/", # "https://ct.googleapis.com/pilot/", # "https://ct.googleapis.com/rocketeer/", - "https://ctlog.api.venafi.com/", + # "https://ctlog.api.venafi.com/", "https://ct.ws.symantec.com/", ] @@ -55,7 +55,7 @@ monitored_domains = [ # ".se", ] -cert_data = [] +# cert_data = [] # class cert(subject, issuer, log): # def __init__(self): @@ -205,17 +205,12 @@ def verify_inclusion_all(old, new): print time.strftime('%H:%M:%S') + " ERROR: Failed to prove inclusion of all new entries in " + url errors.append(time.strftime('%H:%M:%S') + " ERROR: Failed to prove inclusion of all new entries in " + url) -def check_domain(raw_entry): +def check_domain(raw_entry, log=None): orig_entry = extract_original_entry(raw_entry) - cert_info = get_cert_info(orig_entry[0][0]) - # for md in monitored_domains: - # if md in cert_info["subject"]: - # print md + " (" + cert_info["subject"].split("CN=")[1] + ") certifed by " + cert_info["issuer"] - try: - # print cert_info["subject"] + " certifed by " + cert_info["issuer"] - cert_data.append(cert_info) - except: - pass + cert_info = my_get_cert_info(orig_entry[0][0]) + if log: + cert_info["log"] = log[8:-1] # strip generic URL stuff + return cert_info def fetch_and_increment_subtree(old_sth, new_sth_in, subtree, base_url): @@ -228,10 +223,11 @@ def fetch_and_increment_subtree(old_sth, new_sth_in, subtree, base_url): pre_size = idx entries = get_entries(base_url, idx, new_sth["tree_size"]-1)["entries"] new_leafs = [] + tmp_cert_data = [] for item in entries: - check_domain(item) + tmp_cert_data.append(check_domain(item, base_url)) new_leafs.append(get_leaf_hash(base64.b64decode(item["leaf_input"]))) - # write_file("cert_data.json", cert_data) + append_file("cert_data.json", tmp_cert_data) idx += len(new_leafs) print time.strftime('%H:%M:%S') + " Got entries " + str(pre_size) + " to " \ + str(idx -1) + " (" + str(len(new_leafs)) +" entries) from " + base_url @@ -252,11 +248,12 @@ def fetch_and_build_subtree(old_sth, base_url): pre_size = idx entries = get_entries(base_url, idx, sth["tree_size"]-1)["entries"] new_leafs = [] + tmp_cert_data = [] for item in entries: - check_domain(item) + tmp_cert_data.append(check_domain(item, base_url)) new_leafs.append(get_leaf_hash(base64.b64decode(item["leaf_input"]))) idx += len(new_leafs) - # write_file("cert_data.json", cert_data) + append_file("cert_data.json", tmp_cert_data) print time.strftime('%H:%M:%S') + " Got entries " + str(pre_size) + " to " + str(idx) + " from " + base_url subtree = reduce_tree(new_leafs, subtree) @@ -269,7 +266,8 @@ def fetch_and_build_subtree(old_sth, base_url): def verify_subtree(old_sth, subtree, base_url): try: sth = old_sth[base_url] - root = base64.b64encode(reduce_subtree_to_root(subtree)[0]) + tmp = list(subtree) + root = base64.b64encode(reduce_subtree_to_root(tmp)[0]) if root == sth["sha256_root_hash"]: print time.strftime('%H:%M:%S') + " Verifying root hashes for " + base_url + "...OK." @@ -372,7 +370,16 @@ def write_file(fn, content): tempname = fn + ".new" open(tempname, 'w').write(json.dumps(content)) mv_file(tempname, fn) - print "wrote " + fn + # print "wrote " + fn + +def append_file(fn, content): + with open(fn, 'a') as f: + for item in content: + try: + f.write(json.dumps(item)) + except: + # print "failed to write " + str(item) + pass def main(args): @@ -436,19 +443,17 @@ def main(args): write_file(args.cur_sth, sth) if args.monitor: - # Run for one log only all_subtrees = {} print time.strftime('%H:%M:%S') + " Building trees from entries. This may take a while, go get coffee or something..." for url in base_urls: all_subtrees[url] = fetch_and_build_subtree(sth, url) verify_subtree(sth, all_subtrees[url], url) - while True: time.sleep(30) new_sth = fetch_all_sth() for url in base_urls: - if sth[url]["tree_size"] != new_sth[url]["tree_size"]: + if url in sth and url in new_sth and sth[url]["tree_size"] != new_sth[url]["tree_size"]: all_subtrees[url] = fetch_and_increment_subtree(sth, new_sth, all_subtrees[url], url) verify_subtree(new_sth, all_subtrees[url], url) sth = new_sth |