From 8725496e91cee1728787acd40ed7f920c7f9f29b Mon Sep 17 00:00:00 2001 From: Rob Austein Date: Wed, 25 May 2016 03:16:49 +0000 Subject: New script to install an RPKI root key salvaged from an old rootd installation on top of the active CADetail of a new-style rootd-less rpkid configuration. This has been tested, but only lightly, and only in the lab. This script is dangerous. Do not run it unless you really know what you are doing, and even then you probably do not want to run it on anything but a brand new installation with no existing RPKI data. See #816. svn path=/branches/tk705/; revision=6438 --- potpourri/whack-rpki-root-key.py | 157 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 157 insertions(+) create mode 100644 potpourri/whack-rpki-root-key.py (limited to 'potpourri') diff --git a/potpourri/whack-rpki-root-key.py b/potpourri/whack-rpki-root-key.py new file mode 100644 index 00000000..15dba2fc --- /dev/null +++ b/potpourri/whack-rpki-root-key.py @@ -0,0 +1,157 @@ +#!/usr/bin/env python + +# $Id$ + +# Copyright (C) 2016 Parsons Government Services ("PARSONS") +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notices and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND PARSONS DISCLAIMS ALL +# WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED +# WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL +# PARSONS BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR +# CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS +# OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, +# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION +# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +""" +Replace key in an rpkid root Parent object with a different key, +presumably salvaged from an old rootd configuration. + +This does horrible things to the internal state of your rpkid +installation. Do not use it unless you understand exactly what +it does and know why running it is necessary. + +YOU HAVE BEEN WARNED. + +Not to be used without a doctor's prescription and a paid-up life +insurance policy. +""" + +import os +import sys +import time +import argparse +import urlparse + +import rpki.config +import rpki.x509 +import rpki.resource_set + +os.environ.update(TZ = "UTC") +time.tzset() + +cfg = rpki.config.argparser(doc = __doc__) +cfg.argparser.add_argument("--simon-says-whack-my-rpki-root", + action = "store_true") +cfg.argparser.add_argument("-k", "--root-key", + type = lambda s: rpki.x509.RSA(Auto_file = s), + help = "root key to install") +cfg.argparser.add_argument("-b", "--backup", + help = "back up currently installed root key before whacking") +args = cfg.argparser.parse_args() + +if not args.simon_says_whack_my_rpki_root: + sys.exit("You didn't say \"Simon says\"") + +print "Loading rpkidb environment" +os.environ.update(DJANGO_SETTINGS_MODULE = "rpki.django_settings.rpkid") +import django +django.setup() +import rpki.rpkidb +from django.db.models import Q + +# We expect to find exactly one root CADetail object. + +print "Looking for rpkidb root CADetail" +ca_detail = rpki.rpkidb.models.CADetail.objects.get( + ~Q(ca__parent__root_asn_resources = "")| + ~Q(ca__parent__root_ipv4_resources = "")| + ~Q(ca__parent__root_ipv6_resources = "")) + +if args.backup: + print "Backing up installed root key to", args.backup + with os.fdopen(os.open(args.backup, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0700), "w") as f: + f.write(ca_detail.private_key_id.get_PEM()) + +print "Extracting data from old CADetail" +old_cer = ca_detail.latest_ca_cert +old_crl = ca_detail.latest_crl +old_mft = ca_detail.latest_manifest +old_uri = ca_detail.ca_cert_uri + +old_mft.get_POW().extractWithoutVerifying() + +mft_uri = old_cer.get_sia_manifest_uri() +crl_uri = os.path.splitext(mft_uri)[0] + ".crl" +mft_cer = rpki.x509.X509(POW = old_mft.get_POW().certs()[0]) + +gski = args.root_key.gSKI() + +def fix_uri(uri): + return "{head}/{gski}{fn2}".format( + head = os.path.dirname(uri), + gski = gski, + fn2 = os.path.splitext(uri)[1]) + +new_uri = fix_uri(old_uri) + +print "Generating new root certificate" +new_cer = rpki.x509.X509.self_certify( + keypair = args.root_key, + subject_key = args.root_key.get_public(), + serial = old_cer.getSerial(), + sia = (fix_uri(old_cer.get_sia_directory_uri()), + fix_uri(mft_uri), None, old_cer.get_sia_rrdp_notify()), + notBefore = old_cer.getNotBefore(), + notAfter = old_cer.getNotAfter(), + resources = old_cer.get_3779resources()) + +print "Generating new root CRL" +new_crl = rpki.x509.CRL.generate( + keypair = args.root_key, + issuer = new_cer, + serial = old_crl.getCRLNumber(), + thisUpdate = old_crl.getThisUpdate(), + nextUpdate = old_crl.getNextUpdate(), + revokedCertificates = ()) + +print "Generating new root manifest EE certificate" +mft_cer = new_cer.issue( + keypair = args.root_key, + subject_key = ca_detail.manifest_public_key, + serial = mft_cer.getSerial(), + sia = (None, None, + fix_uri(mft_cer.get_sia_object_uri()), + mft_cer.get_sia_rrdp_notify()), + resources = rpki.resource_set.resource_bag.from_inheritance(), + aia = new_uri, + crldp = fix_uri(crl_uri), + notBefore = mft_cer.getNotBefore(), + notAfter = mft_cer.getNotAfter(), + is_ca = False) + +print "Generating new root manifest" +new_mft = rpki.x509.SignedManifest.build( + keypair = ca_detail.manifest_private_key_id, + certs = mft_cer, + serial = old_mft.get_POW().getManifestNumber(), + thisUpdate = old_mft.getThisUpdate(), + nextUpdate = old_mft.getNextUpdate(), + names_and_objs = [(gski + ".crl", new_crl)]) + +print "Updating CADetail" +ca_detail.public_key = args.root_key.get_public() +ca_detail.private_key_id = args.root_key +ca_detail.crl_published = None +ca_detail.manifest_published = None +ca_detail.ca_cert_uri = new_uri +ca_detail.latest_ca_cert = new_cer +ca_detail.latest_crl = new_crl +ca_detail.latest_manifest = new_mft + +print "Saving updated CADetail" +ca_detail.save() -- cgit v1.2.3