diff options
| -rw-r--r-- | rpkid/irdbd.py | 204 | ||||
| -rw-r--r-- | rpkid/pubd.py | 158 | ||||
| -rw-r--r-- | rpkid/rootd.py | 299 | ||||
| -rw-r--r-- | rpkid/rpki/irdbd.py | 225 | ||||
| -rw-r--r-- | rpkid/rpki/pubd.py | 169 | ||||
| -rw-r--r-- | rpkid/rpki/rootd.py | 320 | ||||
| -rw-r--r-- | rpkid/rpki/rpkid.py | 106 | ||||
| -rw-r--r-- | rpkid/rpkid.py | 83 |
8 files changed, 836 insertions, 728 deletions
diff --git a/rpkid/irdbd.py b/rpkid/irdbd.py index 8f6413a2..ef99048e 100644 --- a/rpkid/irdbd.py +++ b/rpkid/irdbd.py @@ -1,13 +1,7 @@ """ -IR database daemon. - -Usage: python irdbd.py [ { -c | --config } configfile ] [ { -h | --help } ] - -Default configuration file is irdbd.conf, override with --config option. - $Id$ -Copyright (C) 2009--2010 Internet Systems Consortium ("ISC") +Copyright (C) 2010 Internet Systems Consortium ("ISC") Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above @@ -20,198 +14,8 @@ INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - -Portions copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") - -Permission to use, copy, modify, and distribute this software for any -purpose with or without fee is hereby granted, provided that the above -copyright notice and this permission notice appear in all copies. - -THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH -REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, -INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -PERFORMANCE OF THIS SOFTWARE. """ -from __future__ import with_statement - -import sys, os, time, getopt, urlparse, warnings -import rpki.http, rpki.config, rpki.resource_set, rpki.relaxng -import rpki.exceptions, rpki.left_right, rpki.log, rpki.x509 - -# Silence warning while loading MySQLdb in Python 2.6, sigh -if hasattr(warnings, "catch_warnings"): - with warnings.catch_warnings(): - warnings.simplefilter("ignore", DeprecationWarning) - import MySQLdb -else: - import MySQLdb - -def handle_list_resources(q_pdu, r_msg): - - r_pdu = rpki.left_right.list_resources_elt() - r_pdu.tag = q_pdu.tag - r_pdu.self_handle = q_pdu.self_handle - r_pdu.child_handle = q_pdu.child_handle - - cur.execute( - "SELECT registrant_id, valid_until FROM registrant WHERE registry_handle = %s AND registrant_handle = %s", - (q_pdu.self_handle, q_pdu.child_handle)) - - if cur.rowcount != 1: - raise rpki.exceptions.NotInDatabase, \ - "This query should have produced a single exact match, something's messed up (rowcount = %d, self_handle = %s, child_handle = %s)" \ - % (cur.rowcount, q_pdu.self_handle, q_pdu.child_handle) - - registrant_id, valid_until = cur.fetchone() - - r_pdu.valid_until = valid_until.strftime("%Y-%m-%dT%H:%M:%SZ") - - r_pdu.asn = rpki.resource_set.resource_set_as.from_sql( - cur, - "SELECT start_as, end_as FROM registrant_asn WHERE registrant_id = %s", - (registrant_id,)) - - r_pdu.ipv4 = rpki.resource_set.resource_set_ipv4.from_sql( - cur, - "SELECT start_ip, end_ip FROM registrant_net WHERE registrant_id = %s AND version = 4", - (registrant_id,)) - - r_pdu.ipv6 = rpki.resource_set.resource_set_ipv6.from_sql( - cur, - "SELECT start_ip, end_ip FROM registrant_net WHERE registrant_id = %s AND version = 6", - (registrant_id,)) - - r_msg.append(r_pdu) - -def handle_list_roa_requests(q_pdu, r_msg): - - cur.execute( - "SELECT roa_request_id, asn FROM roa_request WHERE roa_request_handle = %s", - (q_pdu.self_handle,)) - - for roa_request_id, asn in cur.fetchall(): - - r_pdu = rpki.left_right.list_roa_requests_elt() - r_pdu.tag = q_pdu.tag - r_pdu.self_handle = q_pdu.self_handle - r_pdu.asn = asn - - r_pdu.ipv4 = rpki.resource_set.roa_prefix_set_ipv4.from_sql( - cur, - "SELECT prefix, prefixlen, max_prefixlen FROM roa_request_prefix WHERE roa_request_id = %s AND version = 4", - (roa_request_id,)) - - r_pdu.ipv6 = rpki.resource_set.roa_prefix_set_ipv6.from_sql( - cur, - "SELECT prefix, prefixlen, max_prefixlen FROM roa_request_prefix WHERE roa_request_id = %s AND version = 6", - (roa_request_id,)) - - r_msg.append(r_pdu) - -handle_dispatch = { - rpki.left_right.list_resources_elt : handle_list_resources, - rpki.left_right.list_roa_requests_elt : handle_list_roa_requests } - -def handler(query, path, cb): - try: - - db.ping(True) - - r_msg = rpki.left_right.msg.reply() - - try: - - q_msg = rpki.left_right.cms_msg(DER = query).unwrap((bpki_ta, rpkid_cert)) - - if not isinstance(q_msg, rpki.left_right.msg) or not q_msg.is_query(): - raise rpki.exceptions.BadQuery, "Unexpected %r PDU" % q_msg - - for q_pdu in q_msg: - - try: - if type(q_pdu) not in handle_dispatch: - raise rpki.exceptions.BadQuery, "Unexpected %r PDU" % q_pdu - handle_dispatch[type(q_pdu)](q_pdu, r_msg) - - except (rpki.async.ExitNow, SystemExit): - raise - - except Exception, data: - rpki.log.traceback() - r_msg.append(rpki.left_right.report_error_elt.from_exception(data, q_pdu.self_handle, q_pdu.tag)) - - except (rpki.async.ExitNow, SystemExit): - raise - - except Exception, data: - rpki.log.traceback() - r_msg.append(rpki.left_right.report_error_elt.from_exception(data)) - - cb(200, rpki.left_right.cms_msg().wrap(r_msg, irdbd_key, irdbd_cert)) - - except (rpki.async.ExitNow, SystemExit): - raise - - except Exception, data: - rpki.log.traceback() - - # We only get here in cases where we couldn't or wouldn't generate - # <report_error/>, so just return HTTP failure. - - cb(500, "Unhandled exception %s: %s" % (data.__class__.__name__, data)) - -os.environ["TZ"] = "UTC" -time.tzset() - -cfg_file = "irdbd.conf" - -opts, argv = getopt.getopt(sys.argv[1:], "c:dh?", ["config=", "debug", "help"]) -for o, a in opts: - if o in ("-h", "--help", "-?"): - print __doc__ - sys.exit(0) - if o in ("-c", "--config"): - cfg_file = a - elif o in ("-d", "--debug"): - rpki.log.use_syslog = False -if argv: - raise rpki.exceptions.CommandParseFailure, "Unexpected arguments %s" % argv - -rpki.log.init("irdbd") - -cfg = rpki.config.parser(cfg_file, "irdbd") - -startup_msg = cfg.get("startup-message", "") -if startup_msg: - rpki.log.info(startup_msg) - -cfg.set_global_flags() - -db = MySQLdb.connect(user = cfg.get("sql-username"), - db = cfg.get("sql-database"), - passwd = cfg.get("sql-password")) - -cur = db.cursor() -db.autocommit(True) - -bpki_ta = rpki.x509.X509(Auto_update = cfg.get("bpki-ta")) -rpkid_cert = rpki.x509.X509(Auto_update = cfg.get("rpkid-cert")) -irdbd_cert = rpki.x509.X509(Auto_update = cfg.get("irdbd-cert")) -irdbd_key = rpki.x509.RSA( Auto_update = cfg.get("irdbd-key")) - -u = urlparse.urlparse(cfg.get("http-url")) - -assert u.scheme in ("", "http") and \ - u.username is None and \ - u.password is None and \ - u.params == "" and \ - u.query == "" and \ - u.fragment == "" - -rpki.http.server(host = u.hostname or "localhost", - port = u.port or 443, - handlers = ((u.path, handler),)) +if __name__ == "__main__": + import rpki.irdbd + rpki.irdbd.main() diff --git a/rpkid/pubd.py b/rpkid/pubd.py index b28646f3..c806d124 100644 --- a/rpkid/pubd.py +++ b/rpkid/pubd.py @@ -1,15 +1,7 @@ """ -RPKI publication engine. - -Usage: python pubd.py [ { -c | --config } configfile ] - [ { -h | --help } ] - [ { -p | --profile } outputfile ] - -Default configuration file is pubd.conf, override with --config option. - $Id$ -Copyright (C) 2009--2010 Internet Systems Consortium ("ISC") +Copyright (C) 2010 Internet Systems Consortium ("ISC") Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above @@ -22,150 +14,8 @@ INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - -Portions copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") - -Permission to use, copy, modify, and distribute this software for any -purpose with or without fee is hereby granted, provided that the above -copyright notice and this permission notice appear in all copies. - -THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH -REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, -INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -PERFORMANCE OF THIS SOFTWARE. """ -import os, time, getopt, sys, re -import rpki.resource_set, rpki.up_down, rpki.x509, rpki.sql -import rpki.http, rpki.config, rpki.exceptions, rpki.relaxng -import rpki.log, rpki.publication - -class pubd_context(object): - """ - A container for various pubd parameters. - """ - - def __init__(self, cfg): - - self.sql = rpki.sql.session(cfg) - - self.bpki_ta = rpki.x509.X509(Auto_update = cfg.get("bpki-ta")) - self.irbe_cert = rpki.x509.X509(Auto_update = cfg.get("irbe-cert")) - self.pubd_cert = rpki.x509.X509(Auto_update = cfg.get("pubd-cert")) - self.pubd_key = rpki.x509.RSA( Auto_update = cfg.get("pubd-key")) - - self.http_server_host = cfg.get("server-host", "") - self.http_server_port = int(cfg.get("server-port", "4434")) - - self.publication_base = cfg.get("publication-base", "publication/") - - self.publication_multimodule = cfg.getboolean("publication-multimodule", False) - - def handler_common(self, query, client, cb, certs, crl = None): - """ - Common PDU handler code. - """ - - def done(r_msg): - reply = rpki.publication.cms_msg().wrap(r_msg, self.pubd_key, self.pubd_cert, crl) - self.sql.sweep() - cb(reply) - - q_msg = rpki.publication.cms_msg(DER = query).unwrap(certs) - q_msg.serve_top_level(self, client, done) - - def control_handler(self, query, path, cb): - """ - Process one PDU from the IRBE. - """ - - def done(x): - cb(200, x) - - rpki.log.trace() - try: - self.sql.ping() - self.handler_common(query, None, done, (self.bpki_ta, self.irbe_cert)) - except (rpki.async.ExitNow, SystemExit): - raise - except Exception, data: - rpki.log.traceback() - cb(500, "Unhandled exception %s" % data) - - client_url_regexp = re.compile("/client/([-A-Z0-9_/]+)$", re.I) - - def client_handler(self, query, path, cb): - """ - Process one PDU from a client. - """ - - def done(x): - cb(200, x) - - rpki.log.trace() - try: - self.sql.ping() - match = self.client_url_regexp.search(path) - if match is None: - raise rpki.exceptions.BadContactURL, "Bad path: %s" % path - client_handle = match.group(1) - client = rpki.publication.client_elt.sql_fetch_where1(self, "client_handle = %s", (client_handle,)) - if client is None: - raise rpki.exceptions.ClientNotFound, "Could not find client %s" % client_handle - config = rpki.publication.config_elt.fetch(self) - if config is None or config.bpki_crl is None: - raise rpki.exceptions.CMSCRLNotSet - self.handler_common(query, client, done, (self.bpki_ta, client.bpki_cert, client.bpki_glue), config.bpki_crl) - except (rpki.async.ExitNow, SystemExit): - raise - except Exception, data: - rpki.log.traceback() - cb(500, "Could not process PDU: %s" % data) - -os.environ["TZ"] = "UTC" -time.tzset() - -cfg_file = "pubd.conf" -profile = False - -opts, argv = getopt.getopt(sys.argv[1:], "c:dhp:?", ["config=", "debug", "help"]) -for o, a in opts: - if o in ("-h", "--help", "-?"): - print __doc__ - sys.exit(0) - elif o in ("-c", "--config"): - cfg_file = a - elif o in ("-d", "--debug"): - rpki.log.use_syslog = False - elif o in ("-p", "--profile"): - profile = a -if argv: - raise rpki.exceptions.CommandParseFailure, "Unexpected arguments %s" % argv - -rpki.log.init("pubd") - -def main(): - - cfg = rpki.config.parser(cfg_file, "pubd") - - if profile: - rpki.log.info("Running in profile mode with output to %s" % profile) - - cfg.set_global_flags() - - pctx = pubd_context(cfg) - - rpki.http.server( - host = pctx.http_server_host, - port = pctx.http_server_port, - handlers = (("/control", pctx.control_handler), - ("/client/", pctx.client_handler))) - -if profile: - import cProfile - cProfile.run("main()", profile) -else: - main() +if __name__ == "__main__": + import rpki.pubd + rpki.pubd.main() diff --git a/rpkid/rootd.py b/rpkid/rootd.py index ac38d76d..dd6adb41 100644 --- a/rpkid/rootd.py +++ b/rpkid/rootd.py @@ -1,15 +1,7 @@ """ -Trivial RPKI up-down protocol root server, for testing. Not suitable -for production use. Overrides a bunch of method definitions from the -rpki.* classes in order to reuse as much code as possible. - -Usage: python rootd.py [ { -c | --config } configfile ] [ { -h | --help } ] - -Default configuration file is rootd.conf, override with --config option. - $Id$ -Copyright (C) 2009--2010 Internet Systems Consortium ("ISC") +Copyright (C) 2010 Internet Systems Consortium ("ISC") Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above @@ -22,291 +14,8 @@ INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - -Portions copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") - -Permission to use, copy, modify, and distribute this software for any -purpose with or without fee is hereby granted, provided that the above -copyright notice and this permission notice appear in all copies. - -THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH -REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, -INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -PERFORMANCE OF THIS SOFTWARE. """ -import os, time, getopt, sys -import rpki.resource_set, rpki.up_down, rpki.left_right, rpki.x509 -import rpki.http, rpki.config, rpki.exceptions, rpki.relaxng -import rpki.sundial, rpki.log - -rpki_root_cert = None - -def get_root_cert(): - global rpki_root_cert - rpki.log.debug("Read root cert %s" % rpki_root_cert_file) - rpki_root_cert = rpki.x509.X509(Auto_file = rpki_root_cert_file) - -def root_newer_than_subject(): - return os.stat(rpki_root_cert_file).st_mtime > os.stat(rpki_root_dir + rpki_subject_cert).st_mtime - -def get_subject_cert(): - filename = rpki_root_dir + rpki_subject_cert - try: - x = rpki.x509.X509(Auto_file = filename) - rpki.log.debug("Read subject cert %s" % filename) - return x - except IOError: - return None - -def set_subject_cert(cert): - filename = rpki_root_dir + rpki_subject_cert - rpki.log.debug("Writing subject cert %s, SKI %s" % (filename, cert.hSKI())) - f = open(filename, "wb") - f.write(cert.get_DER()) - f.close() - -def del_subject_cert(): - filename = rpki_root_dir + rpki_subject_cert - rpki.log.debug("Deleting subject cert %s" % filename) - os.remove(filename) - -def get_subject_pkcs10(): - try: - x = rpki.x509.PKCS10(Auto_file = rpki_subject_pkcs10) - rpki.log.debug("Read subject PKCS #10 %s" % rpki_subject_pkcs10) - return x - except IOError: - return None - -def set_subject_pkcs10(pkcs10): - rpki.log.debug("Writing subject PKCS #10 %s" % rpki_subject_pkcs10) - f = open(rpki_subject_pkcs10, "wb") - f.write(pkcs10.get_DER()) - f.close() - -def del_subject_pkcs10(): - rpki.log.debug("Deleting subject PKCS #10 %s" % rpki_subject_pkcs10) - try: - os.remove(rpki_subject_pkcs10) - except OSError: - pass - -def issue_subject_cert_maybe(new_pkcs10): - now = rpki.sundial.now() - subject_cert = get_subject_cert() - old_pkcs10 = get_subject_pkcs10() - if new_pkcs10 is not None and new_pkcs10 != old_pkcs10: - set_subject_pkcs10(new_pkcs10) - if subject_cert is not None: - rpki.log.debug("PKCS #10 changed, regenerating subject certificate") - subject_cert = None - if subject_cert is not None and subject_cert.getNotAfter() <= now + rpki_subject_regen: - rpki.log.debug("Subject certificate has reached expiration threshold, regenerating") - subject_cert = None - if subject_cert is not None and root_newer_than_subject(): - rpki.log.debug("Root certificate has changed, regenerating subject") - subject_cert = None - get_root_cert() - if subject_cert is not None: - return subject_cert - pkcs10 = old_pkcs10 if new_pkcs10 is None else new_pkcs10 - if pkcs10 is None: - rpki.log.debug("No PKCS #10 request, can't generate subject certificate yet") - return None - resources = rpki_root_cert.get_3779resources() - rpki.log.info("Generating subject cert with resources " + str(resources)) - req_key = pkcs10.getPublicKey() - req_sia = pkcs10.get_SIA() - crldp = rpki_base_uri + rpki_root_crl - serial = now.totimestamp() - subject_cert = rpki_root_cert.issue( - keypair = rpki_root_key, - subject_key = req_key, - serial = serial, - sia = req_sia, - aia = rpki_root_cert_uri, - crldp = crldp, - resources = resources, - notAfter = now + rpki_subject_lifetime) - crl = rpki.x509.CRL.generate( - keypair = rpki_root_key, - issuer = rpki_root_cert, - serial = serial, - thisUpdate = now, - nextUpdate = now + rpki_subject_lifetime, - revokedCertificates = ()) - rpki.log.debug("Writing CRL %s" % (rpki_root_dir + rpki_root_crl)) - f = open(rpki_root_dir + rpki_root_crl, "wb") - f.write(crl.get_DER()) - f.close() - manifest_resources = rpki.resource_set.resource_bag.from_inheritance() - manifest_keypair = rpki.x509.RSA.generate() - manifest_cert = rpki_root_cert.issue( - keypair = rpki_root_key, - subject_key = manifest_keypair.get_RSApublic(), - serial = serial + 1, - sia = None, - aia = rpki_root_cert_uri, - crldp = crldp, - resources = manifest_resources, - notAfter = now + rpki_subject_lifetime, - is_ca = False) - manifest = rpki.x509.SignedManifest.build( - serial = serial, - thisUpdate = now, - nextUpdate = now + rpki_subject_lifetime, - names_and_objs = [(rpki_subject_cert, subject_cert), (rpki_root_crl, crl)], - keypair = manifest_keypair, - certs = manifest_cert) - rpki.log.debug("Writing manifest %s" % (rpki_root_dir + rpki_root_manifest)) - f = open(rpki_root_dir + rpki_root_manifest, "wb") - f.write(manifest.get_DER()) - f.close() - set_subject_cert(subject_cert) - return subject_cert - -def compose_response(r_msg, pkcs10 = None): - subject_cert = issue_subject_cert_maybe(pkcs10) - rc = rpki.up_down.class_elt() - rc.class_name = rpki_class_name - rc.cert_url = rpki.up_down.multi_uri(rpki_root_cert_uri) - rc.from_resource_bag(rpki_root_cert.get_3779resources()) - rc.issuer = rpki_root_cert - r_msg.payload.classes.append(rc) - if subject_cert is not None: - rc.certs.append(rpki.up_down.certificate_elt()) - rc.certs[0].cert_url = rpki.up_down.multi_uri(rpki_base_uri + rpki_subject_cert) - rc.certs[0].cert = subject_cert - -class list_pdu(rpki.up_down.list_pdu): - def serve_pdu(self, q_msg, r_msg, ignored, callback, errback): - r_msg.payload = rpki.up_down.list_response_pdu() - compose_response(r_msg) - callback() - -class issue_pdu(rpki.up_down.issue_pdu): - def serve_pdu(self, q_msg, r_msg, ignored, callback, errback): - self.pkcs10.check_valid_rpki() - r_msg.payload = rpki.up_down.issue_response_pdu() - compose_response(r_msg, self.pkcs10) - callback() - -class revoke_pdu(rpki.up_down.revoke_pdu): - def serve_pdu(self, q_msg, r_msg, ignored, callback, errback): - subject_cert = get_subject_cert() - if subject_cert is None or subject_cert.gSKI() != self.ski: - raise rpki.exceptions.NotInDatabase - del_subject_cert() - del_subject_pkcs10() - r_msg.payload = rpki.up_down.revoke_response_pdu() - r_msg.payload.class_name = self.class_name - r_msg.payload.ski = self.ski - callback() - -class message_pdu(rpki.up_down.message_pdu): - - name2type = { - "list" : list_pdu, - "list_response" : rpki.up_down.list_response_pdu, - "issue" : issue_pdu, - "issue_response" : rpki.up_down.issue_response_pdu, - "revoke" : revoke_pdu, - "revoke_response" : rpki.up_down.revoke_response_pdu, - "error_response" : rpki.up_down.error_response_pdu } - - type2name = dict((v, k) for k, v in name2type.items()) - - def log_query(self, child): - """ - Log query we're handling. - """ - rpki.log.info("Serving %s query" % self.type) - -class sax_handler(rpki.up_down.sax_handler): - pdu = message_pdu - -class cms_msg(rpki.up_down.cms_msg): - saxify = sax_handler.saxify - -def up_down_handler(query, path, cb): - try: - q_msg = cms_msg(DER = query).unwrap((bpki_ta, child_bpki_cert)) - except (rpki.async.ExitNow, SystemExit): - raise - except Exception, e: - rpki.log.traceback() - return cb(400, "Could not process PDU: %s" % e) - - def done(r_msg): - cb(200, cms_msg().wrap(r_msg, rootd_bpki_key, rootd_bpki_cert, rootd_bpki_crl)) - - try: - q_msg.serve_top_level(None, done) - except (rpki.async.ExitNow, SystemExit): - raise - except Exception, e: - rpki.log.traceback() - try: - done(q_msg.serve_error(e)) - except (rpki.async.ExitNow, SystemExit): - raise - except Exception, e: - rpki.log.traceback() - cb(500, "Could not process PDU: %s" % e) - -os.environ["TZ"] = "UTC" -time.tzset() - -cfg_file = "rootd.conf" - -opts, argv = getopt.getopt(sys.argv[1:], "c:dh?", ["config=", "debug", "help"]) -for o, a in opts: - if o in ("-h", "--help", "-?"): - print __doc__ - sys.exit(0) - elif o in ("-c", "--config"): - cfg_file = a - elif o in ("-d", "--debug"): - rpki.log.use_syslog = False -if argv: - raise rpki.exceptions.CommandParseFailure, "Unexpected arguments %s" % argv - -rpki.log.init("rootd") - -cfg = rpki.config.parser(cfg_file, "rootd") - -cfg.set_global_flags() - -bpki_ta = rpki.x509.X509(Auto_file = cfg.get("bpki-ta")) -rootd_bpki_key = rpki.x509.RSA( Auto_file = cfg.get("rootd-bpki-key")) -rootd_bpki_cert = rpki.x509.X509(Auto_file = cfg.get("rootd-bpki-cert")) -rootd_bpki_crl = rpki.x509.CRL( Auto_file = cfg.get("rootd-bpki-crl")) -child_bpki_cert = rpki.x509.X509(Auto_file = cfg.get("child-bpki-cert")) - -http_server_host = cfg.get("server-host", "") -http_server_port = int(cfg.get("server-port")) - -rpki_class_name = cfg.get("rpki-class-name", "wombat") - -rpki_root_dir = cfg.get("rpki-root-dir") -rpki_base_uri = cfg.get("rpki-base-uri", "rsync://" + rpki_class_name + ".invalid/") - -rpki_root_key = rpki.x509.RSA( Auto_file = cfg.get("rpki-root-key")) -rpki_root_cert_file = cfg.get("rpki-root-cert") -rpki_root_cert_uri = cfg.get("rpki-root-cert-uri", rpki_base_uri + "Root.cer") - -rpki_root_manifest = cfg.get("rpki-root-manifest", "Root.mnf") -rpki_root_crl = cfg.get("rpki-root-crl", "Root.crl") -rpki_subject_cert = cfg.get("rpki-subject-cert", "Child.cer") -rpki_subject_pkcs10 = cfg.get("rpki-subject-pkcs10", "Child.pkcs10") - -rpki_subject_lifetime = rpki.sundial.timedelta.parse(cfg.get("rpki-subject-lifetime", "30d")) -rpki_subject_regen = rpki.sundial.timedelta.parse(cfg.get("rpki-subject-regen", rpki_subject_lifetime.convert_to_seconds() / 2)) - -rpki.http.server(host = http_server_host, - port = http_server_port, - handlers = up_down_handler) +if __name__ == "__main__": + import rpki.rootd + rpki.rootd.main() diff --git a/rpkid/rpki/irdbd.py b/rpkid/rpki/irdbd.py new file mode 100644 index 00000000..a90f71ce --- /dev/null +++ b/rpkid/rpki/irdbd.py @@ -0,0 +1,225 @@ +""" +IR database daemon. + +Usage: python irdbd.py [ { -c | --config } configfile ] [ { -h | --help } ] + +Default configuration file is irdbd.conf, override with --config option. + +$Id$ + +Copyright (C) 2009--2010 Internet Systems Consortium ("ISC") + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +PERFORMANCE OF THIS SOFTWARE. + +Portions copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH +REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, +INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +PERFORMANCE OF THIS SOFTWARE. +""" + +from __future__ import with_statement + +import sys, os, time, getopt, urlparse, warnings +import rpki.http, rpki.config, rpki.resource_set, rpki.relaxng +import rpki.exceptions, rpki.left_right, rpki.log, rpki.x509 + +# Silence warning while loading MySQLdb in Python 2.6, sigh +if hasattr(warnings, "catch_warnings"): + with warnings.catch_warnings(): + warnings.simplefilter("ignore", DeprecationWarning) + import MySQLdb +else: + import MySQLdb + +class main(object): + + def handle_list_resources(self, q_pdu, r_msg): + + r_pdu = rpki.left_right.list_resources_elt() + r_pdu.tag = q_pdu.tag + r_pdu.self_handle = q_pdu.self_handle + r_pdu.child_handle = q_pdu.child_handle + + self.cur.execute( + "SELECT registrant_id, valid_until FROM registrant WHERE registry_handle = %s AND registrant_handle = %s", + (q_pdu.self_handle, q_pdu.child_handle)) + + if self.cur.rowcount != 1: + raise rpki.exceptions.NotInDatabase, \ + "This query should have produced a single exact match, something's messed up (rowcount = %d, self_handle = %s, child_handle = %s)" \ + % (self.cur.rowcount, q_pdu.self_handle, q_pdu.child_handle) + + registrant_id, valid_until = self.cur.fetchone() + + r_pdu.valid_until = valid_until.strftime("%Y-%m-%dT%H:%M:%SZ") + + r_pdu.asn = rpki.resource_set.resource_set_as.from_sql( + self.cur, + "SELECT start_as, end_as FROM registrant_asn WHERE registrant_id = %s", + (registrant_id,)) + + r_pdu.ipv4 = rpki.resource_set.resource_set_ipv4.from_sql( + self.cur, + "SELECT start_ip, end_ip FROM registrant_net WHERE registrant_id = %s AND version = 4", + (registrant_id,)) + + r_pdu.ipv6 = rpki.resource_set.resource_set_ipv6.from_sql( + self.cur, + "SELECT start_ip, end_ip FROM registrant_net WHERE registrant_id = %s AND version = 6", + (registrant_id,)) + + r_msg.append(r_pdu) + + def handle_list_roa_requests(self, q_pdu, r_msg): + + self.cur.execute( + "SELECT roa_request_id, asn FROM roa_request WHERE roa_request_handle = %s", + (q_pdu.self_handle,)) + + for roa_request_id, asn in self.cur.fetchall(): + + r_pdu = rpki.left_right.list_roa_requests_elt() + r_pdu.tag = q_pdu.tag + r_pdu.self_handle = q_pdu.self_handle + r_pdu.asn = asn + + r_pdu.ipv4 = rpki.resource_set.roa_prefix_set_ipv4.from_sql( + self.cur, + "SELECT prefix, prefixlen, max_prefixlen FROM roa_request_prefix WHERE roa_request_id = %s AND version = 4", + (roa_request_id,)) + + r_pdu.ipv6 = rpki.resource_set.roa_prefix_set_ipv6.from_sql( + self.cur, + "SELECT prefix, prefixlen, max_prefixlen FROM roa_request_prefix WHERE roa_request_id = %s AND version = 6", + (roa_request_id,)) + + r_msg.append(r_pdu) + + handle_dispatch = { + rpki.left_right.list_resources_elt : handle_list_resources, + rpki.left_right.list_roa_requests_elt : handle_list_roa_requests } + + def handler(self, query, path, cb): + try: + + self.db.ping(True) + + r_msg = rpki.left_right.msg.reply() + + try: + + q_msg = rpki.left_right.cms_msg(DER = query).unwrap((self.bpki_ta, self.rpkid_cert)) + + if not isinstance(q_msg, rpki.left_right.msg) or not q_msg.is_query(): + raise rpki.exceptions.BadQuery, "Unexpected %r PDU" % q_msg + + for q_pdu in q_msg: + + try: + + try: + h = self.handle_dispatch[type(q_pdu)] + except KeyError: + raise rpki.exceptions.BadQuery, "Unexpected %r PDU" % q_pdu + else: + h(self, q_pdu, r_msg) + + except (rpki.async.ExitNow, SystemExit): + raise + + except Exception, data: + rpki.log.traceback() + r_msg.append(rpki.left_right.report_error_elt.from_exception(data, q_pdu.self_handle, q_pdu.tag)) + + except (rpki.async.ExitNow, SystemExit): + raise + + except Exception, data: + rpki.log.traceback() + r_msg.append(rpki.left_right.report_error_elt.from_exception(data)) + + cb(200, rpki.left_right.cms_msg().wrap(r_msg, self.irdbd_key, self.irdbd_cert)) + + except (rpki.async.ExitNow, SystemExit): + raise + + except Exception, data: + rpki.log.traceback() + + # We only get here in cases where we couldn't or wouldn't generate + # <report_error/>, so just return HTTP failure. + + cb(500, "Unhandled exception %s: %s" % (data.__class__.__name__, data)) + + def __init__(self): + + os.environ["TZ"] = "UTC" + time.tzset() + + cfg_file = "irdbd.conf" + + opts, argv = getopt.getopt(sys.argv[1:], "c:dh?", ["config=", "debug", "help"]) + for o, a in opts: + if o in ("-h", "--help", "-?"): + print __doc__ + sys.exit(0) + if o in ("-c", "--config"): + cfg_file = a + elif o in ("-d", "--debug"): + rpki.log.use_syslog = False + if argv: + raise rpki.exceptions.CommandParseFailure, "Unexpected arguments %s" % argv + + rpki.log.init("irdbd") + + self.cfg = rpki.config.parser(cfg_file, "irdbd") + + startup_msg = self.cfg.get("startup-message", "") + if startup_msg: + rpki.log.info(startup_msg) + + self.cfg.set_global_flags() + + self.db = MySQLdb.connect(user = self.cfg.get("sql-username"), + db = self.cfg.get("sql-database"), + passwd = self.cfg.get("sql-password")) + + self.cur = self.db.cursor() + self.db.autocommit(True) + + self.bpki_ta = rpki.x509.X509(Auto_update = self.cfg.get("bpki-ta")) + self.rpkid_cert = rpki.x509.X509(Auto_update = self.cfg.get("rpkid-cert")) + self.irdbd_cert = rpki.x509.X509(Auto_update = self.cfg.get("irdbd-cert")) + self.irdbd_key = rpki.x509.RSA( Auto_update = self.cfg.get("irdbd-key")) + + u = urlparse.urlparse(self.cfg.get("http-url")) + + assert u.scheme in ("", "http") and \ + u.username is None and \ + u.password is None and \ + u.params == "" and \ + u.query == "" and \ + u.fragment == "" + + rpki.http.server(host = u.hostname or "localhost", + port = u.port or 443, + handlers = ((u.path, self.handler),)) diff --git a/rpkid/rpki/pubd.py b/rpkid/rpki/pubd.py new file mode 100644 index 00000000..c842b6c6 --- /dev/null +++ b/rpkid/rpki/pubd.py @@ -0,0 +1,169 @@ +""" +RPKI publication engine. + +Usage: python pubd.py [ { -c | --config } configfile ] + [ { -h | --help } ] + [ { -p | --profile } outputfile ] + +Default configuration file is pubd.conf, override with --config option. + +$Id$ + +Copyright (C) 2009--2010 Internet Systems Consortium ("ISC") + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +PERFORMANCE OF THIS SOFTWARE. + +Portions copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH +REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, +INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +PERFORMANCE OF THIS SOFTWARE. +""" + +import os, time, getopt, sys, re +import rpki.resource_set, rpki.up_down, rpki.x509, rpki.sql +import rpki.http, rpki.config, rpki.exceptions, rpki.relaxng +import rpki.log, rpki.publication + +class main(object): + """ + Main program for pubd. + """ + + def __init__(self): + + os.environ["TZ"] = "UTC" + time.tzset() + + self.cfg_file = "pubd.conf" + self.profile = False + + opts, argv = getopt.getopt(sys.argv[1:], "c:dhp:?", ["config=", "debug", "help"]) + for o, a in opts: + if o in ("-h", "--help", "-?"): + print __doc__ + sys.exit(0) + elif o in ("-c", "--config"): + self.cfg_file = a + elif o in ("-d", "--debug"): + rpki.log.use_syslog = False + elif o in ("-p", "--profile"): + self.profile = a + if argv: + raise rpki.exceptions.CommandParseFailure, "Unexpected arguments %s" % argv + + rpki.log.init("pubd") + + if self.profile: + import cProfile + cProfile.run("self.main()", self.profile) + else: + self.main() + + def main(self): + + self.cfg = rpki.config.parser(self.cfg_file, "pubd") + + if self.profile: + rpki.log.info("Running in profile mode with output to %s" % self.profile) + + self.cfg.set_global_flags() + + self.sql = rpki.sql.session(self.cfg) + + self.bpki_ta = rpki.x509.X509(Auto_update = self.cfg.get("bpki-ta")) + self.irbe_cert = rpki.x509.X509(Auto_update = self.cfg.get("irbe-cert")) + self.pubd_cert = rpki.x509.X509(Auto_update = self.cfg.get("pubd-cert")) + self.pubd_key = rpki.x509.RSA( Auto_update = self.cfg.get("pubd-key")) + + self.http_server_host = self.cfg.get("server-host", "") + self.http_server_port = int(self.cfg.get("server-port", "4434")) + + self.publication_base = self.cfg.get("publication-base", "publication/") + + self.publication_multimodule = self.cfg.getboolean("publication-multimodule", False) + + rpki.http.server( + host = self.http_server_host, + port = self.http_server_port, + handlers = (("/control", self.control_handler), + ("/client/", self.client_handler))) + + def handler_common(self, query, client, cb, certs, crl = None): + """ + Common PDU handler code. + """ + + def done(r_msg): + reply = rpki.publication.cms_msg().wrap(r_msg, self.pubd_key, self.pubd_cert, crl) + self.sql.sweep() + cb(reply) + + q_msg = rpki.publication.cms_msg(DER = query).unwrap(certs) + q_msg.serve_top_level(self, client, done) + + def control_handler(self, query, path, cb): + """ + Process one PDU from the IRBE. + """ + + def done(x): + cb(200, x) + + rpki.log.trace() + try: + self.sql.ping() + self.handler_common(query, None, done, (self.bpki_ta, self.irbe_cert)) + except (rpki.async.ExitNow, SystemExit): + raise + except Exception, data: + rpki.log.traceback() + cb(500, "Unhandled exception %s" % data) + + client_url_regexp = re.compile("/client/([-A-Z0-9_/]+)$", re.I) + + def client_handler(self, query, path, cb): + """ + Process one PDU from a client. + """ + + def done(x): + cb(200, x) + + rpki.log.trace() + try: + self.sql.ping() + match = self.client_url_regexp.search(path) + if match is None: + raise rpki.exceptions.BadContactURL, "Bad path: %s" % path + client_handle = match.group(1) + client = rpki.publication.client_elt.sql_fetch_where1(self, "client_handle = %s", (client_handle,)) + if client is None: + raise rpki.exceptions.ClientNotFound, "Could not find client %s" % client_handle + config = rpki.publication.config_elt.fetch(self) + if config is None or config.bpki_crl is None: + raise rpki.exceptions.CMSCRLNotSet + self.handler_common(query, client, done, (self.bpki_ta, client.bpki_cert, client.bpki_glue), config.bpki_crl) + except (rpki.async.ExitNow, SystemExit): + raise + except Exception, data: + rpki.log.traceback() + cb(500, "Could not process PDU: %s" % data) diff --git a/rpkid/rpki/rootd.py b/rpkid/rpki/rootd.py new file mode 100644 index 00000000..74674b57 --- /dev/null +++ b/rpkid/rpki/rootd.py @@ -0,0 +1,320 @@ +""" +Trivial RPKI up-down protocol root server, for testing. Not suitable +for production use. Overrides a bunch of method definitions from the +rpki.* classes in order to reuse as much code as possible. + +Usage: python rootd.py [ { -c | --config } configfile ] [ { -h | --help } ] + +Default configuration file is rootd.conf, override with --config option. + +$Id$ + +Copyright (C) 2009--2010 Internet Systems Consortium ("ISC") + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +PERFORMANCE OF THIS SOFTWARE. + +Portions copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH +REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, +INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +PERFORMANCE OF THIS SOFTWARE. +""" + +import os, time, getopt, sys +import rpki.resource_set, rpki.up_down, rpki.left_right, rpki.x509 +import rpki.http, rpki.config, rpki.exceptions, rpki.relaxng +import rpki.sundial, rpki.log + +rootd = None + +class list_pdu(rpki.up_down.list_pdu): + def serve_pdu(self, q_msg, r_msg, ignored, callback, errback): + r_msg.payload = rpki.up_down.list_response_pdu() + rootd.compose_response(r_msg) + callback() + +class issue_pdu(rpki.up_down.issue_pdu): + def serve_pdu(self, q_msg, r_msg, ignored, callback, errback): + self.pkcs10.check_valid_rpki() + r_msg.payload = rpki.up_down.issue_response_pdu() + rootd.compose_response(r_msg, self.pkcs10) + callback() + +class revoke_pdu(rpki.up_down.revoke_pdu): + def serve_pdu(self, q_msg, r_msg, ignored, callback, errback): + rootd.subject_cert = get_subject_cert() + if subject_cert is None or subject_cert.gSKI() != self.ski: + raise rpki.exceptions.NotInDatabase + rootd.del_subject_cert() + rootd.del_subject_pkcs10() + r_msg.payload = rpki.up_down.revoke_response_pdu() + r_msg.payload.class_name = self.class_name + r_msg.payload.ski = self.ski + callback() + +class message_pdu(rpki.up_down.message_pdu): + + name2type = { + "list" : list_pdu, + "list_response" : rpki.up_down.list_response_pdu, + "issue" : issue_pdu, + "issue_response" : rpki.up_down.issue_response_pdu, + "revoke" : revoke_pdu, + "revoke_response" : rpki.up_down.revoke_response_pdu, + "error_response" : rpki.up_down.error_response_pdu } + + type2name = dict((v, k) for k, v in name2type.items()) + + def log_query(self, child): + """ + Log query we're handling. + """ + rpki.log.info("Serving %s query" % self.type) + +class sax_handler(rpki.up_down.sax_handler): + pdu = message_pdu + +class cms_msg(rpki.up_down.cms_msg): + saxify = sax_handler.saxify + +class main(object): + + rpki_root_cert = None + + def get_root_cert(self): + rpki.log.debug("Read root cert %s" % self.rpki_root_cert_file) + self.rpki_root_cert = rpki.x509.X509(Auto_file = self.rpki_root_cert_file) + + def root_newer_than_subject(self): + return os.stat(self.rpki_root_cert_file).st_mtime > os.stat(self.rpki_root_dir + self.rpki_subject_cert).st_mtime + + def get_subject_cert(self): + filename = self.rpki_root_dir + self.rpki_subject_cert + try: + x = rpki.x509.X509(Auto_file = filename) + rpki.log.debug("Read subject cert %s" % filename) + return x + except IOError: + return None + + def set_subject_cert(self, cert): + filename = self.rpki_root_dir + self.rpki_subject_cert + rpki.log.debug("Writing subject cert %s, SKI %s" % (filename, cert.hSKI())) + f = open(filename, "wb") + f.write(cert.get_DER()) + f.close() + + def del_subject_cert(self): + filename = self.rpki_root_dir + self.rpki_subject_cert + rpki.log.debug("Deleting subject cert %s" % filename) + os.remove(filename) + + def get_subject_pkcs10(self): + try: + x = rpki.x509.PKCS10(Auto_file = self.rpki_subject_pkcs10) + rpki.log.debug("Read subject PKCS #10 %s" % self.rpki_subject_pkcs10) + return x + except IOError: + return None + + def set_subject_pkcs10(self, pkcs10): + rpki.log.debug("Writing subject PKCS #10 %s" % self.rpki_subject_pkcs10) + f = open(self.rpki_subject_pkcs10, "wb") + f.write(pkcs10.get_DER()) + f.close() + + def del_subject_pkcs10(self): + rpki.log.debug("Deleting subject PKCS #10 %s" % self.rpki_subject_pkcs10) + try: + os.remove(self.rpki_subject_pkcs10) + except OSError: + pass + + def issue_subject_cert_maybe(self, new_pkcs10): + now = rpki.sundial.now() + subject_cert = self.get_subject_cert() + old_pkcs10 = self.get_subject_pkcs10() + if new_pkcs10 is not None and new_pkcs10 != old_pkcs10: + self.set_subject_pkcs10(new_pkcs10) + if subject_cert is not None: + rpki.log.debug("PKCS #10 changed, regenerating subject certificate") + subject_cert = None + if subject_cert is not None and subject_cert.getNotAfter() <= now + self.rpki_subject_regen: + rpki.log.debug("Subject certificate has reached expiration threshold, regenerating") + subject_cert = None + if subject_cert is not None and self.root_newer_than_subject(): + rpki.log.debug("Root certificate has changed, regenerating subject") + subject_cert = None + self.get_root_cert() + if subject_cert is not None: + return subject_cert + pkcs10 = old_pkcs10 if new_pkcs10 is None else new_pkcs10 + if pkcs10 is None: + rpki.log.debug("No PKCS #10 request, can't generate subject certificate yet") + return None + resources = self.rpki_root_cert.get_3779resources() + rpki.log.info("Generating subject cert with resources " + str(resources)) + req_key = pkcs10.getPublicKey() + req_sia = pkcs10.get_SIA() + crldp = self.rpki_base_uri + self.rpki_root_crl + serial = now.totimestamp() + subject_cert = self.rpki_root_cert.issue( + keypair = self.rpki_root_key, + subject_key = req_key, + serial = serial, + sia = req_sia, + aia = self.rpki_root_cert_uri, + crldp = crldp, + resources = resources, + notAfter = now + self.rpki_subject_lifetime) + crl = rpki.x509.CRL.generate( + keypair = self.rpki_root_key, + issuer = self.rpki_root_cert, + serial = serial, + thisUpdate = now, + nextUpdate = now + self.rpki_subject_lifetime, + revokedCertificates = ()) + rpki.log.debug("Writing CRL %s" % (self.rpki_root_dir + self.rpki_root_crl)) + f = open(self.rpki_root_dir + self.rpki_root_crl, "wb") + f.write(crl.get_DER()) + f.close() + manifest_resources = rpki.resource_set.resource_bag.from_inheritance() + manifest_keypair = rpki.x509.RSA.generate() + manifest_cert = self.rpki_root_cert.issue( + keypair = self.rpki_root_key, + subject_key = manifest_keypair.get_RSApublic(), + serial = serial + 1, + sia = None, + aia = self.rpki_root_cert_uri, + crldp = crldp, + resources = manifest_resources, + notAfter = now + self.rpki_subject_lifetime, + is_ca = False) + manifest = rpki.x509.SignedManifest.build( + serial = serial, + thisUpdate = now, + nextUpdate = now + self.rpki_subject_lifetime, + names_and_objs = [(self.rpki_subject_cert, subject_cert), (self.rpki_root_crl, crl)], + keypair = manifest_keypair, + certs = manifest_cert) + rpki.log.debug("Writing manifest %s" % (self.rpki_root_dir + self.rpki_root_manifest)) + f = open(self.rpki_root_dir + self.rpki_root_manifest, "wb") + f.write(manifest.get_DER()) + f.close() + self.set_subject_cert(subject_cert) + return subject_cert + + def compose_response(self, r_msg, pkcs10 = None): + subject_cert = self.issue_subject_cert_maybe(pkcs10) + rc = rpki.up_down.class_elt() + rc.class_name = self.rpki_class_name + rc.cert_url = rpki.up_down.multi_uri(self.rpki_root_cert_uri) + rc.from_resource_bag(self.rpki_root_cert.get_3779resources()) + rc.issuer = self.rpki_root_cert + r_msg.payload.classes.append(rc) + if subject_cert is not None: + rc.certs.append(rpki.up_down.certificate_elt()) + rc.certs[0].cert_url = rpki.up_down.multi_uri(self.rpki_base_uri + self.rpki_subject_cert) + rc.certs[0].cert = subject_cert + + def up_down_handler(self, query, path, cb): + try: + q_msg = cms_msg(DER = query).unwrap((self.bpki_ta, self.child_bpki_cert)) + except (rpki.async.ExitNow, SystemExit): + raise + except Exception, e: + rpki.log.traceback() + return cb(400, "Could not process PDU: %s" % e) + + def done(r_msg): + cb(200, cms_msg().wrap(r_msg, self.rootd_bpki_key, self.rootd_bpki_cert, self.rootd_bpki_crl)) + + try: + q_msg.serve_top_level(None, done) + except (rpki.async.ExitNow, SystemExit): + raise + except Exception, e: + rpki.log.traceback() + try: + done(q_msg.serve_error(e)) + except (rpki.async.ExitNow, SystemExit): + raise + except Exception, e: + rpki.log.traceback() + cb(500, "Could not process PDU: %s" % e) + + def __init__(self): + + global rootd + rootd = self # Gross, but simpler than what we'd have to do otherwise + + os.environ["TZ"] = "UTC" + time.tzset() + + self.cfg_file = "rootd.conf" + + opts, argv = getopt.getopt(sys.argv[1:], "c:dh?", ["config=", "debug", "help"]) + for o, a in opts: + if o in ("-h", "--help", "-?"): + print __doc__ + sys.exit(0) + elif o in ("-c", "--config"): + self.cfg_file = a + elif o in ("-d", "--debug"): + rpki.log.use_syslog = False + if argv: + raise rpki.exceptions.CommandParseFailure, "Unexpected arguments %s" % argv + + rpki.log.init("rootd") + + self.cfg = rpki.config.parser(self.cfg_file, "rootd") + + self.cfg.set_global_flags() + + self.bpki_ta = rpki.x509.X509(Auto_file = self.cfg.get("bpki-ta")) + self.rootd_bpki_key = rpki.x509.RSA( Auto_file = self.cfg.get("rootd-bpki-key")) + self.rootd_bpki_cert = rpki.x509.X509(Auto_file = self.cfg.get("rootd-bpki-cert")) + self.rootd_bpki_crl = rpki.x509.CRL( Auto_file = self.cfg.get("rootd-bpki-crl")) + self.child_bpki_cert = rpki.x509.X509(Auto_file = self.cfg.get("child-bpki-cert")) + + self.http_server_host = self.cfg.get("server-host", "") + self.http_server_port = int(self.cfg.get("server-port")) + + self.rpki_class_name = self.cfg.get("rpki-class-name", "wombat") + + self.rpki_root_dir = self.cfg.get("rpki-root-dir") + self.rpki_base_uri = self.cfg.get("rpki-base-uri", "rsync://" + self.rpki_class_name + ".invalid/") + + self.rpki_root_key = rpki.x509.RSA( Auto_file = self.cfg.get("rpki-root-key")) + self.rpki_root_cert_file = self.cfg.get("rpki-root-cert") + self.rpki_root_cert_uri = self.cfg.get("rpki-root-cert-uri", self.rpki_base_uri + "Root.cer") + + self.rpki_root_manifest = self.cfg.get("rpki-root-manifest", "Root.mnf") + self.rpki_root_crl = self.cfg.get("rpki-root-crl", "Root.crl") + self.rpki_subject_cert = self.cfg.get("rpki-subject-cert", "Child.cer") + self.rpki_subject_pkcs10 = self.cfg.get("rpki-subject-pkcs10", "Child.pkcs10") + + self.rpki_subject_lifetime = rpki.sundial.timedelta.parse(self.cfg.get("rpki-subject-lifetime", "30d")) + self.rpki_subject_regen = rpki.sundial.timedelta.parse(self.cfg.get("rpki-subject-regen", self.rpki_subject_lifetime.convert_to_seconds() / 2)) + + rpki.http.server(host = self.http_server_host, + port = self.http_server_port, + handlers = self.up_down_handler) diff --git a/rpkid/rpki/rpkid.py b/rpkid/rpki/rpkid.py new file mode 100644 index 00000000..927e1456 --- /dev/null +++ b/rpkid/rpki/rpkid.py @@ -0,0 +1,106 @@ +""" +RPKI engine daemon. + +Usage: python rpkid.py [ { -c | --config } configfile ] + [ { -h | --help } ] + [ { -p | --profile } outputfile ] + +Default configuration file is rpkid.conf, override with --config option. + +$Id$ + +Copyright (C) 2009--2010 Internet Systems Consortium ("ISC") + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +PERFORMANCE OF THIS SOFTWARE. + +Portions copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH +REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, +INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +PERFORMANCE OF THIS SOFTWARE. +""" + +import os, time, getopt, sys +import rpki.resource_set, rpki.up_down, rpki.left_right, rpki.x509, rpki.sql +import rpki.http, rpki.config, rpki.exceptions, rpki.relaxng, rpki.log +import rpki.rpki_engine + +class main(object): + """ + Main program for rpkid. This class probably ought to be merged with + rpki.rpki_engine.rpkid_context, but that can wait, for today the + task is to move all the real code out of the scripts, this is the + minimal necessary change to do that. + """ + + def __init__(self): + + os.environ["TZ"] = "UTC" + time.tzset() + + self.cfg_file = "rpkid.conf" + self.profile = None + + opts, argv = getopt.getopt(sys.argv[1:], "c:dhp:?", ["config=", "debug", "help", "profile="]) + for o, a in opts: + if o in ("-h", "--help", "-?"): + print __doc__ + sys.exit(0) + elif o in ("-d", "--debug"): + rpki.log.use_syslog = False + elif o in ("-c", "--config"): + self.cfg_file = a + elif o in ("-p", "--profile"): + self.profile = a + if argv: + raise rpki.exceptions.CommandParseFailure, "Unexpected arguments %s" % argv + + rpki.log.init("rpkid") + + if self.profile: + import cProfile + cProfile.run("self.main()", self.profile) + else: + self.main() + + def main(self): + + self.cfg = rpki.config.parser(self.cfg_file, "rpkid") + + startup_msg = self.cfg.get("startup-message", "") + if startup_msg: + rpki.log.info(startup_msg) + + if self.profile: + rpki.log.info("Running in profile mode with output to %s" % self.profile) + + self.cfg.set_global_flags() + + gctx = rpki.rpki_engine.rpkid_context(self.cfg) + + gctx.start_cron() + + rpki.http.server( + host = gctx.http_server_host, + port = gctx.http_server_port, + handlers = (("/left-right", gctx.left_right_handler), + ("/up-down/", gctx.up_down_handler), + ("/cronjob", gctx.cronjob_handler))) diff --git a/rpkid/rpkid.py b/rpkid/rpkid.py index d5bccce6..181fabf9 100644 --- a/rpkid/rpkid.py +++ b/rpkid/rpkid.py @@ -1,15 +1,7 @@ """ -RPKI engine daemon. This is still very much a work in progress. - -Usage: python rpkid.py [ { -c | --config } configfile ] - [ { -h | --help } ] - [ { -p | --profile } outputfile ] - -Default configuration file is rpkid.conf, override with --config option. - $Id$ -Copyright (C) 2009--2010 Internet Systems Consortium ("ISC") +Copyright (C) 2010 Internet Systems Consortium ("ISC") Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above @@ -22,75 +14,8 @@ INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - -Portions copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") - -Permission to use, copy, modify, and distribute this software for any -purpose with or without fee is hereby granted, provided that the above -copyright notice and this permission notice appear in all copies. - -THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH -REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, -INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -PERFORMANCE OF THIS SOFTWARE. """ -import os, time, getopt, sys -import rpki.resource_set, rpki.up_down, rpki.left_right, rpki.x509, rpki.sql -import rpki.http, rpki.config, rpki.exceptions, rpki.relaxng, rpki.log -import rpki.rpki_engine - -os.environ["TZ"] = "UTC" -time.tzset() - -cfg_file = "rpkid.conf" -profile = None - -opts, argv = getopt.getopt(sys.argv[1:], "c:dhp:?", ["config=", "debug", "help", "profile="]) -for o, a in opts: - if o in ("-h", "--help", "-?"): - print __doc__ - sys.exit(0) - elif o in ("-d", "--debug"): - rpki.log.use_syslog = False - elif o in ("-c", "--config"): - cfg_file = a - elif o in ("-p", "--profile"): - profile = a -if argv: - raise rpki.exceptions.CommandParseFailure, "Unexpected arguments %s" % argv - -rpki.log.init("rpkid") - -def main(): - - cfg = rpki.config.parser(cfg_file, "rpkid") - - startup_msg = cfg.get("startup-message", "") - if startup_msg: - rpki.log.info(startup_msg) - - if profile: - rpki.log.info("Running in profile mode with output to %s" % profile) - - cfg.set_global_flags() - - gctx = rpki.rpki_engine.rpkid_context(cfg) - - gctx.start_cron() - - rpki.http.server( - host = gctx.http_server_host, - port = gctx.http_server_port, - handlers = (("/left-right", gctx.left_right_handler), - ("/up-down/", gctx.up_down_handler), - ("/cronjob", gctx.cronjob_handler))) - -if profile: - import cProfile - cProfile.run("main()", profile) -else: - main() +if __name__ == "__main__": + import rpki.rpkid + rpki.rpkid.main() |