diff options
Diffstat (limited to 'rpkid/tests')
| -rw-r--r-- | rpkid/tests/rootd.yaml | 24 | ||||
| -rw-r--r-- | rpkid/tests/testpoke.py | 163 | ||||
| -rw-r--r-- | rpkid/tests/testpoke.xsl | 78 | ||||
| -rw-r--r-- | rpkid/tests/testpoke.yaml | 28 |
4 files changed, 293 insertions, 0 deletions
diff --git a/rpkid/tests/rootd.yaml b/rpkid/tests/rootd.yaml new file mode 100644 index 00000000..2ee5dcd4 --- /dev/null +++ b/rpkid/tests/rootd.yaml @@ -0,0 +1,24 @@ +# $Id$ +--- +version: 1 +posturl: https://localhost:4401/up-down/1 +recipient-id: "rootd" +sender-id: "RIR" + +cms-cert-file: RIR-RPKI-EE.cer +cms-key-file: RIR-RPKI-EE.key +cms-ca-cert-file: rootd-TA.cer +cms-cert-chain-file: [ RIR-RPKI-CA.cer ] + +ssl-cert-file: RIR-RPKI-EE.cer +ssl-key-file: RIR-RPKI-EE.key +ssl-ca-cert-file: rootd-TA.cer + +requests: + list: + type: list + issue: + type: issue + class: 1 + sia: + - rsync://localhost:4400/testbed/RIR/ diff --git a/rpkid/tests/testpoke.py b/rpkid/tests/testpoke.py new file mode 100644 index 00000000..949cd464 --- /dev/null +++ b/rpkid/tests/testpoke.py @@ -0,0 +1,163 @@ +""" +Trivial RPKI up-down protocol client, for testing. + +Configuration file is YAML to be compatable with APNIC rpki_poke.pl tool. + +Usage: python testpoke.py [ { -y | --yaml } configfile ] + [ { -r | --request } requestname ] + [ { -d | --debug } ] + [ { -h | --help } ] + +Default configuration file is testpoke.yaml, override with --yaml option. + +$Id$ + +Copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH +REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, +INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +PERFORMANCE OF THIS SOFTWARE. +""" + +import os, time, getopt, sys, yaml +import rpki.resource_set, rpki.up_down, rpki.left_right, rpki.x509 +import rpki.https, rpki.config, rpki.exceptions +import rpki.relaxng, rpki.oids, rpki.log, rpki.async + +os.environ["TZ"] = "UTC" +time.tzset() + +def usage(code): + print __doc__ + sys.exit(code) + +yaml_file = "testpoke.yaml" +yaml_cmd = None +debug = False + +opts, argv = getopt.getopt(sys.argv[1:], "y:r:h?d", ["yaml=", "request=", "help", "debug"]) +for o, a in opts: + if o in ("-h", "--help", "-?"): + usage(0) + elif o in ("-y", "--yaml"): + yaml_file = a + elif o in ("-r", "--request"): + yaml_cmd = a + elif o in ("-d", "--debug"): + debug = True +if argv: + usage(1) + +rpki.log.init("testpoke") + +if debug: + rpki.log.set_trace(True) + +f = open(yaml_file) +yaml_data = yaml.load(f) +f.close() + +if yaml_cmd is None and len(yaml_data["requests"]) == 1: + yaml_cmd = yaml_data["requests"].keys()[0] + +if yaml_cmd is None: + usage(1) + +yaml_req = yaml_data["requests"][yaml_cmd] + +def get_PEM(name, cls, y = yaml_data): + if name in y: + return cls(PEM = y[name]) + if name + "-file" in y: + return cls(PEM_file = y[name + "-file"]) + return None + +def get_PEM_chain(name, cert = None): + chain = [] + if cert is not None: + chain.append(cert) + if name in yaml_data: + chain.extend([rpki.x509.X509(PEM = x) for x in yaml_data[name]]) + elif name + "-file" in yaml_data: + chain.extend([rpki.x509.X509(PEM_file = x) for x in yaml_data[name + "-file"]]) + return chain + +def query_up_down(q_pdu): + q_msg = rpki.up_down.message_pdu.make_query( + payload = q_pdu, + sender = yaml_data["sender-id"], + recipient = yaml_data["recipient-id"]) + q_cms = rpki.up_down.cms_msg.wrap(q_msg, cms_key, cms_certs, cms_crl) + + def done(der): + r_msg, r_xml = rpki.up_down.cms_msg.unwrap(der, [cms_ta] + cms_ca_certs, pretty_print = True) + print r_xml + try: + r_msg.payload.check_response() + except (rpki.async.ExitNow, SystemExit): + raise + except Exception, e: + fail(e) + #rpki.async.exit_event_loop() + + rpki.https.want_persistent_client = False + + rpki.https.client( + server_ta = [https_ta] + https_ca_certs, + client_key = https_key, + client_cert = https_cert, + msg = q_cms, + url = yaml_data["posturl"], + callback = done, + errback = fail) + +def do_list(): + query_up_down(rpki.up_down.list_pdu()) + +def do_issue(): + q_pdu = rpki.up_down.issue_pdu() + req_key = get_PEM("cert-request-key", rpki.x509.RSA, yaml_req) or cms_key + sia = ((rpki.oids.name2oid["id-ad-caRepository"], ("uri", yaml_req["sia"][0])), + (rpki.oids.name2oid["id-ad-rpkiManifest"], ("uri", yaml_req["sia"][0] + req_key.gSKI() + ".mnf"))) + q_pdu.class_name = yaml_req["class"] + q_pdu.pkcs10 = rpki.x509.PKCS10.create_ca(req_key, sia) + query_up_down(q_pdu) + +def do_revoke(): + q_pdu = rpki.up_down.revoke_pdu() + q_pdu.class_name = yaml_req["class"] + q_pdu.ski = yaml_req["ski"] + query_up_down(q_pdu) + +dispatch = { "list" : do_list, "issue" : do_issue, "revoke" : do_revoke } + +def fail(e): + if debug: + rpki.log.traceback() + sys.exit("Testpoke failed: %s" % e) + +cms_ta = get_PEM("cms-ca-cert", rpki.x509.X509) +cms_cert = get_PEM("cms-cert", rpki.x509.X509) +cms_key = get_PEM("cms-key", rpki.x509.RSA) +cms_crl = get_PEM("cms-crl", rpki.x509.CRL) +cms_certs = get_PEM_chain("cms-cert-chain", cms_cert) +cms_ca_certs = get_PEM_chain("cms-ca-certs") + +https_ta = get_PEM("ssl-ca-cert", rpki.x509.X509) +https_key = get_PEM("ssl-key", rpki.x509.RSA) +https_cert = get_PEM("ssl-cert", rpki.x509.X509) +https_ca_certs = get_PEM_chain("ssl-ca-certs") + +try: + dispatch[yaml_req["type"]]() + rpki.async.event_loop() +except Exception, e: + fail(e) diff --git a/rpkid/tests/testpoke.xsl b/rpkid/tests/testpoke.xsl new file mode 100644 index 00000000..91658b0b --- /dev/null +++ b/rpkid/tests/testpoke.xsl @@ -0,0 +1,78 @@ +<!-- -*- SGML -*- + - $Id$ + - + - Copyright (C) 2008 American Registry for Internet Numbers ("ARIN") + - + - Permission to use, copy, modify, and distribute this software for any + - purpose with or without fee is hereby granted, provided that the above + - copyright notice and this permission notice appear in all copies. + - + - THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH + - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + - AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, + - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + - PERFORMANCE OF THIS SOFTWARE. + --> + +<!-- + - Decoder ring for testpoke.py XML output. Use this to get a + - (somewhat) human-readable listing and to put OpenSSL-style + - delimiters onto the certificates so that "openssl x509" can read + - the result. With a tad more work, we could select just one out of + - the set of multiple certificates, or output YAML. For the moment, + - I'll settle for being readable by human beings and OpenSSL. + --> + +<xsl:transform xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0" + xmlns:rpkiud="http://www.apnic.net/specs/rescerts/up-down/"> + + <xsl:output method="text"/> + + <xsl:param name="show-issuer" select="0"/> + + <xsl:template match="/rpkiud:message[@type = 'list_response']"> + <xsl:value-of select="concat('[Message]', ' ', + 'Version: ', @version, ' ', + 'Sender: ', @sender, ' ', + 'Recipient: ', @recipient, ' ')"/> + <xsl:apply-templates select="rpkiud:class"/> + </xsl:template> + + <xsl:template match="rpkiud:class"> + <xsl:value-of select="concat(' ', + '[Class]', ' ', + 'Name: ', @class_name, ' ', + 'Issuer URL: ', @cert_url, ' ', + 'ASNs: ', @resource_set_as, ' ', + 'IPv4: ', @resource_set_ipv4, ' ', + 'IPv6: ', @resource_set_ipv6, ' ', + 'NotAfter: ', @resource_set_notafter, ' ', + 'SIA head: ', @suggested_sia_head, ' ')"/> + <xsl:if test="$show-issuer"> + <xsl:apply-templates select="rpkiud:issuer"/> + </xsl:if> + <xsl:apply-templates select="rpkiud:certificate"/> + </xsl:template> + + <xsl:template match="rpkiud:certificate"> + <xsl:value-of select="concat(' ', + '[Certificate]', ' ', + 'Subject URL: ', @cert_url, ' ', + 'Req ASNs: ', @resource_set_as, ' ', + 'Req IPv4: ', @resource_set_ipv4, ' ', + 'Req IPv6: ', @resource_set_ipv6, ' ')"/> + <xsl:call-template name="show-pem"/> + </xsl:template> + + <xsl:template match="rpkiud:issuer" name="show-pem"> + <xsl:text> </xsl:text> + <xsl:text>-----BEGIN CERTIFICATE-----</xsl:text> + <xsl:text> </xsl:text> + <xsl:value-of select="text()"/> + <xsl:text>-----END CERTIFICATE-----</xsl:text> + <xsl:text> </xsl:text> + </xsl:template> + +</xsl:transform> diff --git a/rpkid/tests/testpoke.yaml b/rpkid/tests/testpoke.yaml new file mode 100644 index 00000000..22e2d35f --- /dev/null +++ b/rpkid/tests/testpoke.yaml @@ -0,0 +1,28 @@ +--- +# $Id$ + +version: 1 +posturl: https://localhost:4433/up-down/1 +recipient-id: wombat +sender-id: "1" + +cms-cert-file: biz-certs/Frank-EE.cer +cms-key-file: biz-certs/Frank-EE.key +cms-ca-cert-file: biz-certs/Bob-Root.cer +cms-cert-chain-file: [ biz-certs/Frank-CA.cer ] + +ssl-cert-file: biz-certs/Frank-EE.cer +ssl-key-file: biz-certs/Frank-EE.key +ssl-ca-cert-file: biz-certs/Bob-Root.cer + +requests: + list: + type: list + issue: + type: issue + class: 1 + sia: [ "rsync://bandicoot.invalid/some/where/" ] + revoke: + type: revoke + class: 1 + ski: "CB5K6APY-4KcGAW9jaK_cVPXKX0" |