aboutsummaryrefslogtreecommitdiff
path: root/scripts/irbe-setup.py
diff options
context:
space:
mode:
authorRob Austein <sra@hactrn.net>2008-02-27 19:02:11 +0000
committerRob Austein <sra@hactrn.net>2008-02-27 19:02:11 +0000
commite1bc9584d821857a9a1869f38b934812ff60f7fb (patch)
treec9c1f45818ab9f4e6dacefc1428c9a9dcb67c0fd /scripts/irbe-setup.py
parenta9ecdddda7c364cd62dbd1c16fc0f19615fe288e (diff)
Filename cleanup
svn path=/rpkid/Makefile; revision=1531
Diffstat (limited to 'scripts/irbe-setup.py')
-rw-r--r--scripts/irbe-setup.py125
1 files changed, 0 insertions, 125 deletions
diff --git a/scripts/irbe-setup.py b/scripts/irbe-setup.py
deleted file mode 100644
index 90ea5113..00000000
--- a/scripts/irbe-setup.py
+++ /dev/null
@@ -1,125 +0,0 @@
-# $Id$
-
-# Copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN")
-#
-# Permission to use, copy, modify, and distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-
-"""Set up the relationship between an IRBE and an RPKI engine given an
-IRDB. Our main task here is to create child objects in the RPKI
-engine for every registrant object in the IRDB.
-"""
-
-import os, MySQLdb, getopt, sys, lxml.etree, lxml.sax
-import rpki.left_right, rpki.relaxng, rpki.cms, rpki.https
-import rpki.x509, rpki.config, rpki.log
-
-rpki.log.init("irbe-setup")
-
-cfg = rpki.config.parser("irbe.conf", "irbe-cli")
-
-db = MySQLdb.connect(user = cfg.get("sql-username", section = "irdbd"),
- db = cfg.get("sql-database", section = "irdbd"),
- passwd = cfg.get("sql-password", section = "irdbd"))
-cur = db.cursor()
-
-cms_certs = rpki.x509.X509_chain(Auto_files = cfg.multiget("cms-cert"))
-cms_key = rpki.x509.RSA( Auto_file = cfg.get( "cms-key"))
-cms_ta = rpki.x509.X509( Auto_file = cfg.get( "cms-ta"))
-https_certs = rpki.x509.X509_chain(Auto_files = cfg.multiget("https-cert"))
-https_key = rpki.x509.RSA( Auto_file = cfg.get( "https-key"))
-https_tas = rpki.x509.X509_chain(Auto_files = cfg.multiget("https-ta"))
-https_url = cfg.get( "https-url")
-
-def call_rpkid(pdu):
- """Hand a PDU to rpkid and get back the response. Just throw an
- exception if anything bad happens, no fancy error handling.
- """
-
- pdu.type = "query"
- msg = rpki.left_right.msg((pdu,))
- elt = msg.toXML()
- try:
- rpki.relaxng.left_right.assertValid(elt)
- except lxml.etree.DocumentInvalid:
- print lxml.etree.tostring(elt, pretty_print = True, encoding = "us-ascii")
- raise
- elt = rpki.cms.xml_verify(cms = rpki.https.client(privateKey = https_key,
- certChain = https_certs,
- x509TrustList = https_tas,
- url = https_url,
- msg = rpki.cms.xml_sign(elt = elt,
- key = cms_key,
- certs = cms_certs)),
- ta = cms_ta)
- try:
- rpki.relaxng.left_right.assertValid(elt)
- except lxml.etree.DocumentInvalid:
- print lxml.etree.tostring(elt, pretty_print = True, encoding = "us-ascii")
- raise
- msg = rpki.left_right.sax_handler.saxify(elt)
- pdu = msg[0]
- assert len(msg) == 1 and pdu.type == "reply" and not isinstance(pdu, rpki.left_right.report_error_elt)
- return pdu
-
-print "Create a self instance"
-pdu = call_rpkid(rpki.left_right.self_elt.make_pdu(action = "create", crl_interval = 84600))
-self_id = pdu.self_id
-
-print "Create a business signing context"
-pdu = rpki.left_right.bsc_elt.make_pdu(action = "create", self_id = self_id, generate_keypair = True)
-pdu.signing_cert.append(rpki.x509.X509(Auto_file = "biz-certs/Bob-CA.cer"))
-pdu = call_rpkid(pdu)
-bsc_id = pdu.bsc_id
-
-print "Issue the business cert"
-i,o = os.popen2(("openssl", "x509", "-req",
- "-CA", "biz-certs/Bob-CA.cer",
- "-CAkey", "biz-certs/Bob-CA.key",
- "-CAserial", "biz-certs/Bob-CA.srl"))
-i.write(pdu.pkcs10_cert_request.get_PEM())
-i.close()
-cer = rpki.x509.X509(PEM = o.read())
-o.close()
-
-print "Set up the business cert chain"
-pdu = rpki.left_right.bsc_elt.make_pdu(action = "set", self_id = self_id, bsc_id = bsc_id)
-pdu.signing_cert.append(cer)
-call_rpkid(pdu)
-
-print "Create a repository context"
-pdu = call_rpkid(rpki.left_right.repository_elt.make_pdu(action = "create", self_id = self_id, bsc_id = bsc_id))
-repository_id = pdu.repository_id
-
-print "Create a parent context"
-ta = rpki.x509.X509(Auto_file = "biz-certs/Elena-Root.cer")
-pdu = call_rpkid(rpki.left_right.parent_elt.make_pdu(
- action = "create", self_id = self_id, bsc_id = bsc_id, repository_id = repository_id, cms_ta = ta, https_ta = ta,
- peer_contact_uri = "https://localhost:44333/", sia_base = "rsync://wombat.invalid/"))
-parent_id = pdu.parent_id
-
-print "Create child contexts for everybody"
-print "Using a single cert for all of these registrants is a crock"
-
-cer = rpki.x509.X509(Auto_file = "biz-certs/Frank-Root.cer")
-
-cur.execute("SELECT registrant_id, subject_name FROM registrant")
-registrants = cur.fetchall()
-
-for registrant_id, subject_name in registrants:
- print "Attempting to bind", registrant_id, subject_name
- pdu = call_rpkid(rpki.left_right.child_elt.make_pdu(action = "create", self_id = self_id, bsc_id = bsc_id, cms_ta = cer))
- print "Attempting to bind", registrant_id, subject_name, pdu.child_id
- cur.execute("""UPDATE registrant
- SET rpki_self_id = %d, rpki_child_id = %d
- WHERE registrant_id = %d
- """, (self_id, pdu.child_id, registrant_id))