Implement MD5 hashing in ssl-observatory.js

jsha · jsha · commit 87968753c72e · 2015-01-15T17:22:46.000-08:00
diff --git a/makexpi.sh b/makexpi.sh
@@ -73,7 +73,7 @@ die() {
   exit 1
 }
 
-if [ "$1" != "--fast" ] ; then
+if [ "$1" != "--fast" -a -z "$FAST" ] ; then
   if [ -f utils/trivial-validate.py ]; then
     VALIDATE="python2.7 ./utils/trivial-validate.py --ignoredups google --ignoredups facebook"
   elif [ -f trivial-validate.py ] ; then
diff --git a/src/components/ssl-observatory.js b/src/components/ssl-observatory.js
@@ -57,6 +57,7 @@ INCLUDE('Root-CAs');
 INCLUDE('sha256');
 INCLUDE('X509ChainWhitelist');
 INCLUDE('NSS');
+INCLUDE('md5');
 
 function SSLObservatory() {
   this.prefs = CC["@mozilla.org/preferences-service;1"]
@@ -292,9 +293,31 @@ SSLObservatory.prototype = {
   },
   */
 
+  // Calculate the MD5 fingerprint for a cert. This is the fingerprint of the
+  // DER-encoded form, same as the result of
+  // openssl x509 -md5 -fingerprint -noout
+  // We use this because the SSL Observatory depends in many places on a special
+  // fingerprint which is the concatenation of MD5+SHA1, and the MD5 fingerprint
+  // is no longer available on the cert object.
+  // Implementation cribbed from
+  // https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsICryptoHash
+  md5Fingerprint: function(cert) {
+    var len = new Object();
+    var derData = cert.getRawDER(len);
+    var ch = CC["@mozilla.org/security/hash;1"].createInstance(CI.nsICryptoHash);
+    ch.init(ch.MD5);
+    ch.update(derData,derData.length);
+    var h = ch.finish(false);
+
+    function toHexString(charCode) {
+      return ("0" + charCode.toString(16)).slice(-2);
+    }
+    return [toHexString(h.charCodeAt(i)) for (i in h)].join("").toUpperCase();
+  },
+
   ourFingerprint: function(cert) {
     // Calculate our custom fingerprint from an nsIX509Cert
-    return (cert.md5Fingerprint+cert.sha1Fingerprint).replace(":", "", "g");
+    return (this.md5Fingerprint(cert)+cert.sha1Fingerprint).replace(":", "", "g");
   },
 
   observe: function(subject, topic, data) {

Original file line number	Diff line number	Diff line change
`@@ -73,7 +73,7 @@ die() {`
`73`	`73`	`exit 1`
`74`	`74`	`}`
`75`	`75`
`76`		`-if [ "$1" != "--fast" ] ; then`
	`76`	`+if [ "$1" != "--fast" -a -z "$FAST" ] ; then`
`77`	`77`	`if [ -f utils/trivial-validate.py ]; then`
`78`	`78`	`VALIDATE="python2.7 ./utils/trivial-validate.py --ignoredups google --ignoredups facebook"`
`79`	`79`	`elif [ -f trivial-validate.py ] ; then`