diff options
Diffstat (limited to 'scripts')
| -rw-r--r-- | scripts/rpki/cms.py | 10 | ||||
| -rw-r--r-- | scripts/rpki/left_right.py | 34 | ||||
| -rw-r--r-- | scripts/rpki/sql.py | 4 | ||||
| -rw-r--r-- | scripts/rpki/up_down.py | 29 | ||||
| -rwxr-xr-x | scripts/rpkid.py | 57 |
5 files changed, 82 insertions, 52 deletions
diff --git a/scripts/rpki/cms.py b/scripts/rpki/cms.py index 633ab1dc..86a73643 100644 --- a/scripts/rpki/cms.py +++ b/scripts/rpki/cms.py @@ -6,7 +6,7 @@ For the moment these just call the OpenSSL CLI tool, which is slow, requires disk I/O, and likes PEM format. Fix this later. """ -import os, rpki.x509, rpki.exceptions +import os, rpki.x509, rpki.exceptions, lxml.etree # openssl smime -sign -nodetach -outform DER -signer biz-certs/Alice-EE.cer -certfile biz-certs/Alice-CA.cer -inkey biz-certs/Alice-EE.key -in PLAN -out PLAN.der @@ -65,3 +65,11 @@ def decode(cms, ta): return xml else: raise rpki.exceptions.CMSVerificationFailed, "CMS verification failed with status %s" % status + +def xml_decode(elt, ta): + """Composite routine to decode CMS-wrapped XML.""" + return lxml.etree.fromstring(decode(elt, ta)) + +def xml_encode(elt, key, certs): + """Composite routine to encode CMS-wrapped XML.""" + return encode(lxml.etree.tostring(elt, pretty_print=True, encoding="us-ascii", xml_declaration=True), key, certs) diff --git a/scripts/rpki/left_right.py b/scripts/rpki/left_right.py index 6d885da4..4715700e 100644 --- a/scripts/rpki/left_right.py +++ b/scripts/rpki/left_right.py @@ -85,16 +85,16 @@ class data_elt(base_elt, rpki.sql.sql_persistant): def serve_post_save_hook(self, q_pdu, r_pdu): pass - def serve_create(self, db, cur, r_msg): + def serve_create(self, gctx, r_msg): r_pdu = self.make_reply() self.serve_pre_save_hook(self, r_pdu) - self.sql_store(db, cur) + self.sql_store(gctx.db, gctx.cur) setattr(r_pdu, self.sql_template.index, getattr(self, self.sql_template.index)) self.serve_post_save_hook(self, r_pdu) r_msg.append(r_pdu) - def serve_set(self, db, cur, r_msg): - db_pdu = self.sql_fetch(db, cur, getattr(self, self.sql_template.index)) + def serve_set(self, gctx, r_msg): + db_pdu = self.sql_fetch(gctx.db, gctx.cur, getattr(self, self.sql_template.index)) if db_pdu is not None: r_pdu = self.make_reply() for a in db_pdu.sql_template.columns[1:]: @@ -103,34 +103,34 @@ class data_elt(base_elt, rpki.sql.sql_persistant): setattr(db_pdu, a, v) db_pdu.sql_dirty = True db_pdu.serve_pre_save_hook(self, r_pdu) - db_pdu.sql_store(db, cur) + db_pdu.sql_store(gctx.db, gctx.cur) db_pdu.serve_post_save_hook(self, r_pdu) r_msg.append(r_pdu) else: r_msg.append(make_error_report(self)) - def serve_get(self, db, cur, r_msg): - r_pdu = self.sql_fetch(db, cur, getattr(self, self.sql_template.index)) + def serve_get(self, gctx, r_msg): + r_pdu = self.sql_fetch(gctx.db, gctx.cur, getattr(self, self.sql_template.index)) if r_pdu is not None: self.make_reply(r_pdu) r_msg.append(r_pdu) else: r_msg.append(make_error_report(self)) - def serve_list(self, db, cur, r_msg): - for r_pdu in self.sql_fetch_all(db, cur): + def serve_list(self, gctx, r_msg): + for r_pdu in self.sql_fetch_all(gctx.db, gctx.cur): self.make_reply(r_pdu) r_msg.append(r_pdu) - def serve_destroy(self, db, cur, r_msg): - db_pdu = self.sql_fetch(db, cur, getattr(self, self.sql_template.index)) + def serve_destroy(self, gctx, r_msg): + db_pdu = self.sql_fetch(gctx.db, gctx.cur, getattr(self, self.sql_template.index)) if db_pdu is not None: - db_pdu.sql_delete(db, cur) + db_pdu.sql_delete(gctx.db, gctx.cur) r_msg.append(self.make_reply()) else: r_msg.append(make_error_report(self)) - def serve_dispatch(self, db, cur, r_msg): + def serve_dispatch(self, gctx, r_msg): dispatch = { "create" : self.serve_create, "set" : self.serve_set, "get" : self.serve_get, @@ -138,7 +138,7 @@ class data_elt(base_elt, rpki.sql.sql_persistant): "destroy" : self.serve_destroy } if self.type != "query" or self.action not in dispatch: raise rpki.exceptions.BadQuery, "Unexpected query: type %s, action %s" % (self.type, self.action) - dispatch[self.action](db, cur, r_msg) + dispatch[self.action](gctx, r_msg) class extension_preference_elt(base_elt): """Container for extension preferences.""" @@ -346,7 +346,7 @@ class child_elt(data_elt): sql_template = rpki.sql.template("child", "child_id", "self_id", "bsc_id", "peer_ta") def sql_fetch_hook(self, db, cur): - self.cas = rpki.sql.get_column(db, cur, "SELECT ca_id FROM child_ca_link WHERE child_id = %s", self.child_id) + self.cas = rpki.sql.fetch_column(cur, "SELECT ca_id FROM child_ca_link WHERE child_id = %s", self.child_id) cur.execute("SELECT ca_detail_id, cert FROM child_ca_certificate WHERE child_id = %s", self.child_id) self.certs = dict((ca_detail_id, rpki.x509.X509(DER=cert)) for (ca_detail_id, cert) in cur.fetchall()) @@ -593,10 +593,10 @@ class msg(list): elt.extend([i.toXML() for i in self]) return elt - def serve_top_level(self, db, cur): + def serve_top_level(self, gctx): r_msg = self.__class__() for q_pdu in self: - q_pdu.serve_dispatch(db, cur, r_msg) + q_pdu.serve_dispatch(gctx, r_msg) return r_msg class sax_handler(rpki.sax_utils.handler): diff --git a/scripts/rpki/sql.py b/scripts/rpki/sql.py index 41e6a0e1..bab07e5e 100644 --- a/scripts/rpki/sql.py +++ b/scripts/rpki/sql.py @@ -36,7 +36,7 @@ def cache_clear(): sql_cache = {} -def get_column(db, cur, *query): +def fetch_column(cur, *query): """Pull a single column from SQL, return it as a list.""" cur.execute(*query) @@ -168,7 +168,7 @@ class ca_obj(sql_persistant): sql_template = template("ca", "ca_id", "last_crl_sn", "next_crl_update", "last_issued_sn", "last_manifest_sn", "next_manifest_update", "sia_uri", "parent_id") def sql_fetch_hook(self, db, cur): - self.children = get_column(db, cur, "SELECT child_id FROM child_ca_link WHERE ca_id = %s", self.ca_id) + self.children = fetch_column(cur, "SELECT child_id FROM child_ca_link WHERE ca_id = %s", self.ca_id) def sql_insert_hook(self, db, cur): if self.children: diff --git a/scripts/rpki/up_down.py b/scripts/rpki/up_down.py index bdd18aa1..507e42e6 100644 --- a/scripts/rpki/up_down.py +++ b/scripts/rpki/up_down.py @@ -45,7 +45,7 @@ class base_elt(object): if value is not None: lxml.etree.SubElement(elt, "{%s}%s" % (xmlns, name), nsmap=nsmap).text = base64.b64encode(value) - def serve_pdu(db, cur, self, r_msg, child): + def serve_pdu(self, gctx, r_msg, child): raise NotImplementedError class multi_uri(list): @@ -140,6 +140,29 @@ class list_pdu(base_elt): """Generate (empty) payload of "list" PDU.""" return [] + def serve_pdu(self, gctx, r_msg, child): + raise NotImplementedError + + # Tasks: + # + # 1) extract child's resource set from irdb + # + # 2) for every ca, compute intersection of child's resource set + # with ca's resource set; if result is non-null, this ca is one + # of the resource classes for this child + # + # 3) establish ca_child_link bindings based on (2)? + # + # 4) generate result pdu + + child_data = irdb_query(child) + r_msg.payload = list_response_pdu() + for ca in rpki.sql.fetch_column(gctx.cur, "SELECT ca_id FROM child_ca_link WHERE child_id = %s" % child.child_id): + klass = class_elt() + r_msg.payload.classes.append(klass) + klass.class_name = ca.ca_id + raise NotImplementedError + class list_response_pdu(base_elt): """Up-Down protocol "list_response" PDU.""" @@ -279,9 +302,9 @@ class message_pdu(base_elt): def __str__(self): lxml.etree.tostring(self.toXML(), pretty_print=True, encoding="UTF-8") - def serve_top_level(self, db, cur, child): + def serve_top_level(self, gctx, child): r_msg = self.__class__() - self.payload.serve_pdu(db, cur, self, r_msg, child) + self.payload.serve_pdu(self, gctx, r_msg, child) return r_msg class sax_handler(rpki.sax_utils.handler): diff --git a/scripts/rpkid.py b/scripts/rpkid.py index 11edb1aa..cdac0c60 100755 --- a/scripts/rpkid.py +++ b/scripts/rpkid.py @@ -8,21 +8,15 @@ framework onto which I'm bolting various parts for testing. import tlslite.api, MySQLdb, xml.sax, lxml.etree, lxml.sax, POW, POW.pkix, traceback import rpki.https, rpki.config, rpki.resource_set, rpki.up_down, rpki.left_right, rpki.relaxng, rpki.cms, rpki.exceptions -def decode(msg, cms_ta): - return lxml.etree.fromstring(rpki.cms.decode(msg, cms_ta)) - -def encode(msg, cms_key, cms_certs): - return rpki.cms.encode(lxml.etree.tostring(msg, pretty_print=True, encoding="us-ascii", xml_declaration=True), cms_key, cms_certs) - def left_right_handler(query, path): try: - q_elt = decode(query, cms_ta_irbe) + q_elt = rpki.cms.xml_decode(query, gctx.cms_ta_irbe) rpki.relaxng.left_right.assertValid(q_elt) q_msg = rpki.left_right.sax_handler.saxify(q_elt) - r_msg = q_msg.serve_top_level(db, cur) + r_msg = q_msg.serve_top_level(gctx) r_elt = r_msg.toXML() rpki.relaxng.left_right.assertValid(r_elt) - return 200, encode(r_elt, cms_key, cms_certs) + return 200, rpki.cms.xml_encode(r_elt, gctx.cms_key, gctx.cms_certs) except Exception, data: traceback.print_exc() return 500, "Unhandled exception %s" % data @@ -32,18 +26,17 @@ def up_down_handler(query, path): child_id = path.partition("/up-down/")[2] if not child_id.isdigit(): raise rpki.exceptions.BadContactURL, "Bad path: %s" % path - child = rpki.left_right.child_elt.sql_fetch(db, cur, long(child_id)) + child = rpki.left_right.child_elt.sql_fetch(gctx.db, gctx.cur, long(child_id)) if child is None: raise rpki.exceptions.NotFound, "Could not find CMS TA to verify request" - bsc = rpki.left_right.bsc_elt.sql_fetch(db, cur, child.bsc_id) - - q_elt = decode(query, child.peer_ta) + bsc = rpki.left_right.bsc_elt.sql_fetch(gctx.db, gctx.cur, child.bsc_id) + q_elt = rpki.cms.xml_decode(query, child.peer_ta) rpki.relaxng.up_down.assertValid(q_elt) q_msg = rpki.up_down.sax_handler.saxify(q_elt) - r_msg = q_msg.serve_top_level(db, cur) + r_msg = q_msg.serve_top_level(gctx) r_elt = r_msg.toXML() rpki.relaxng.up_down.assertValid(r_elt) - return 200, encode(r_elt, bsc.private_key_id, bsc.signing_cert) + return 200, rpki.cms.xml_encode(r_elt, bsc.private_key_id, bsc.signing_cert) except Exception, data: traceback.print_exc() return 500, "Unhandled exception %s" % data @@ -51,26 +44,32 @@ def up_down_handler(query, path): def cronjob_handler(query, path): raise NotImplementedError -cfg = rpki.config.parser("re.conf") -section = "rpki" +class global_context(object): + """A place to stash various global parameters.""" + pass + +gctx = global_context() + +gctx.cfg = rpki.config.parser("re.conf") +gctx.cfg_section = "rpki" -db = MySQLdb.connect(user = cfg.get(section, "sql-username"), - db = cfg.get(section, "sql-database"), - passwd = cfg.get(section, "sql-password")) +gctx.db = MySQLdb.connect(user = gctx.cfg.get(gctx.cfg_section, "sql-username"), + db = gctx.cfg.get(gctx.cfg_section, "sql-database"), + passwd = gctx.cfg.get(gctx.cfg_section, "sql-password")) -cur = db.cursor() +gctx.cur = gctx.db.cursor() -cms_ta_irdb = cfg.get(section, "cms-ta-irdb") -cms_ta_irbe = cfg.get(section, "cms-ta-irbe") -cms_key = cfg.get(section, "cms-key") -cms_certs = cfg.multiget(section, "cms-cert") +gctx.cms_ta_irdb = gctx.cfg.get(gctx.cfg_section, "cms-ta-irdb") +gctx.cms_ta_irbe = gctx.cfg.get(gctx.cfg_section, "cms-ta-irbe") +gctx.cms_key = gctx.cfg.get(gctx.cfg_section, "cms-key") +gctx.cms_certs = gctx.cfg.multiget(gctx.cfg_section, "cms-cert") -https_key = rpki.x509.RSA_Keypair(PEM_file = cfg.get(section, "https-key")) -https_certs = certChain = rpki.x509.X509_chain() +gctx.https_key = rpki.x509.RSA_Keypair(PEM_file = gctx.cfg.get(gctx.cfg_section, "https-key")) +gctx.https_certs = certChain = rpki.x509.X509_chain() -https_certs.load_from_PEM(cfg.multiget(section, "https-cert")) +gctx.https_certs.load_from_PEM(gctx.cfg.multiget(gctx.cfg_section, "https-cert")) -rpki.https.server(privateKey=https_key, certChain=https_certs, +rpki.https.server(privateKey=gctx.https_key, certChain=gctx.https_certs, handlers=(("/left-right", left_right_handler), ("/up-down/", up_down_handler), ("/cronjob", cronjob_handler))) |