From 32b7a7b22c11129c2c17d8adc3f6aceac0e6de0b Mon Sep 17 00:00:00 2001 From: Rob Austein Date: Sun, 16 Sep 2007 21:06:15 +0000 Subject: Switch to using APNIC's preferred version of the up-down protocol schema. I still think the folks at APNIC are wrong about allowing bogus error codes to slip past schema checking, but coding around this problem is less work in the long run than maintaining a forked schema would be. Time to bury the hatchet and move on. svn path=/scripts/Makefile; revision=975 --- scripts/Makefile | 5 - scripts/encode-test.py | 2 +- scripts/rpki/up_down.py | 44 +++- scripts/rpkid.py | 2 +- scripts/up-down-medium-schema.rnc | 79 ------- scripts/up-down-medium-schema.rng | 258 --------------------- .../up-down-protocol-samples/issue_response.xml | 8 +- scripts/up-down-protocol-samples/list_response.xml | 12 +- scripts/xml-parse-test.py | 2 +- 9 files changed, 54 insertions(+), 358 deletions(-) delete mode 100644 scripts/up-down-medium-schema.rnc delete mode 100644 scripts/up-down-medium-schema.rng (limited to 'scripts') diff --git a/scripts/Makefile b/scripts/Makefile index 26d31538..5aa33cba 100644 --- a/scripts/Makefile +++ b/scripts/Makefile @@ -11,11 +11,6 @@ all:: left-right-schema.rng left-right-schema.rng: left-right-schema.rnc trang left-right-schema.rnc left-right-schema.rng -all:: up-down-medium-schema.rng - -up-down-medium-schema.rng: up-down-medium-schema.rnc - trang up-down-medium-schema.rnc up-down-medium-schema.rng - all:: up-down-schema.rng up-down-schema.rng: up-down-schema.rnc diff --git a/scripts/encode-test.py b/scripts/encode-test.py index 08f78d82..b4709866 100755 --- a/scripts/encode-test.py +++ b/scripts/encode-test.py @@ -23,7 +23,7 @@ def main(): dir = "biz-certs" cer = "biz-certs/Alice-EE.cer" key = "biz-certs/Alice-EE.key" - rng = "up-down-medium-schema.rng" + rng = "up-down-schema.rng" for x in xml: print x diff --git a/scripts/rpki/up_down.py b/scripts/rpki/up_down.py index 256ef790..d1437775 100644 --- a/scripts/rpki/up_down.py +++ b/scripts/rpki/up_down.py @@ -45,13 +45,37 @@ class base_elt(object): if value is not None: lxml.etree.SubElement(elt, "{%s}%s" % (xmlns, name), nsmap=nsmap).text = base64.b64encode(value) +class multi_uri(list): + """Container for a set of URIs.""" + + def __init__(self, ini): + """Initialize a set of URIs, which includes basic some syntax checking.""" + if isinstance(ini, (list, tuple)): + self[:] = ini + elif isinstance(ini, str): + self[:] = ini.split(",") + for s in self: + assert s.strip() == s and s.find("://") >= 0, "Bad URI \"%s\"" % s + else: + raise TypeError + + def __str__(self): + return ",".join(self) + + def rsync(self): + """Find first rsync://... URI in self.""" + for s in self: + if s.startswith("rsync://"): + return s + return None + class certificate_elt(base_elt): """Up-Down protocol representation of an issued certificate.""" def startElement(self, stack, name, attrs): """Handle attributes of element.""" assert name == "certificate", "Unexpected name %s, stack %s" % (name, stack) - self.cert_url = attrs["cert_url"] + self.cert_url = multi_uri(attrs["cert_url"]) self.req_resource_set_as = resource_set.resource_set_as(attrs.get("req_resource_set_as")) self.req_resource_set_ipv4 = resource_set.resource_set_ipv4(attrs.get("req_resource_set_ipv4")) self.req_resource_set_ipv6 = resource_set.resource_set_ipv6(attrs.get("req_resource_set_ipv6")) @@ -84,7 +108,7 @@ class class_elt(base_elt): elif name != "issuer": assert name == "class", "Unexpected name %s, stack %s" % (name, stack) self.class_name = attrs["class_name"] - self.cert_url = attrs["cert_url"] + self.cert_url = multi_uri(attrs["cert_url"]) self.suggested_sia_head = attrs.get("suggested_sia_head") self.resource_set_as = resource_set.resource_set_as(attrs["resource_set_as"]) self.resource_set_ipv4 = resource_set.resource_set_ipv4(attrs["resource_set_ipv4"]) @@ -180,10 +204,23 @@ class revoke_response_pdu(revoke_pdu): class error_response_pdu(base_elt): """Up-Down protocol "error_response" PDU.""" + codes = { + 1101 : "Already processing request", + 1102 : "Version number error", + 1103 : "Unrecognised request type", + 1201 : "Request - no such resource class", + 1202 : "Request - no resources allocated in resource class", + 1203 : "Request - badly formed certificate request", + 1301 : "Revoke - no such resource class", + 1302 : "Revoke - no such key", + 2001 : "Internal Server Error - Request not performed" } + def endElement(self, stack, name, text): """Handle "error_response" PDU.""" if name == "status": - self.status = int(text) + code = int(text) + assert code in self.codes + self.status = code elif name == "last_message_processed": self.last_message_processed = text elif name == "description": @@ -195,6 +232,7 @@ class error_response_pdu(base_elt): def toXML(self): """Generate payload of "error_response" PDU.""" + assert self.status in self.codes elt = self.make_elt("status") elt.text = str(self.status) return [elt] diff --git a/scripts/rpkid.py b/scripts/rpkid.py index a8eb024c..483ad5be 100755 --- a/scripts/rpkid.py +++ b/scripts/rpkid.py @@ -88,7 +88,7 @@ db = MySQLdb.connect(user = cfg.get(section, "sql-username"), cur = db.cursor() lr_rng = rpki.relaxng.RelaxNG("left-right-schema.rng") -ud_rng = rpki.relaxng.RelaxNG("up-down-medium-schema.rng") +ud_rng = rpki.relaxng.RelaxNG("up-down-schema.rng") cms_ta_irdb = cfg.get(section, "cms-ta-irdb") cms_ta_irbe = cfg.get(section, "cms-ta-irbe") diff --git a/scripts/up-down-medium-schema.rnc b/scripts/up-down-medium-schema.rnc deleted file mode 100644 index 623d83b5..00000000 --- a/scripts/up-down-medium-schema.rnc +++ /dev/null @@ -1,79 +0,0 @@ -# $Id$ -# -# RelaxNG (Compact Syntax) Schema -# for RPKI up-down protocol. This is based on the schema in the APNIC -# Wiki, but has tighter constraints on some fields. -# -# libxml2 (including xmllint) only groks the XML syntax of RelaxNG, so -# run the output of this script through a converter like trang to get -# XML syntax. - - default namespace = "http://www.apnic.net/specs/rescerts/up-down/" - - grammar { - start = element message { - attribute version { xsd:positiveInteger { maxInclusive="1" } }, - attribute sender { xsd:token { maxLength="1024" } }, - attribute recipient { xsd:token { maxLength="1024" } }, - payload - } - - payload |= attribute type { "list" }, list_request - payload |= attribute type { "list_response"}, list_response - payload |= attribute type { "issue" }, issue_request - payload |= attribute type { "issue_response"}, issue_response - payload |= attribute type { "revoke" }, revoke_request - payload |= attribute type { "revoke_response"}, revoke_response - payload |= attribute type { "error_response"}, error_response - - list_request = empty - list_response = class* - - class = element class { - attribute class_name { xsd:token { maxLength="1024" } }, - attribute cert_url { xsd:anyURI { maxLength="1024" } }, - attribute resource_set_as { xsd:string { maxLength="512000" pattern="[\-,0-9]*" } }, - attribute resource_set_ipv4 { xsd:string { maxLength="512000" pattern="[\-,/.0-9]*" } }, - attribute resource_set_ipv6 { xsd:string { maxLength="512000" pattern="[\-,/:0-9a-fA-F]*" } }, - attribute suggested_sia_head { xsd:anyURI { maxLength="1024" pattern="rsync://.+"} }?, - element certificate { - attribute cert_url { xsd:anyURI { maxLength="1024" } }, - attribute req_resource_set_as { xsd:string { maxLength="512000" pattern="[\-,0-9]*" } }?, - attribute req_resource_set_ipv4 { xsd:string { maxLength="512000" pattern="[\-,/.0-9]*" } }?, - attribute req_resource_set_ipv6 { xsd:string { maxLength="512000" pattern="[\-,/:0-9a-fA-F]*" } }?, - xsd:base64Binary { maxLength="512000" } - }*, - element issuer { xsd:base64Binary { maxLength="512000" } } - } - - issue_request = element request { - attribute class_name { xsd:token { maxLength="1024" } }, - attribute req_resource_set_as { xsd:string { maxLength="512000" pattern="[\-,0-9]*" } }?, - attribute req_resource_set_ipv4 { xsd:string { maxLength="512000" pattern="[\-,/.0-9]*" } }?, - attribute req_resource_set_ipv6 { xsd:string { maxLength="512000" pattern="[\-,/:0-9a-fA-F]*" } }?, - xsd:base64Binary { maxLength="512000" } - } - issue_response = class - - revoke_request = revocation - revoke_response = revocation - - revocation = element key { - attribute class_name { xsd:token { maxLength="1024" } }, - attribute ski { xsd:token { maxLength="1024" } } - } - - error_response = - element status { - "1101" | # Already processing request - "1102" | # version number error - "1103" | # unrecognised request type - "1201" | # request - no such resource class - "1202" | # request - no resources allocated in resource class - "1203" | # request - badly formed certificate request - "1301" | # revoke - no such resource class - "1302" | # revoke - no such key - "2001" # Internal Server Error - Request not performed - }, - element description { attribute xml:lang { xsd:language }, xsd:string { maxLength="1024" } }? - } diff --git a/scripts/up-down-medium-schema.rng b/scripts/up-down-medium-schema.rng deleted file mode 100644 index d9c84489..00000000 --- a/scripts/up-down-medium-schema.rng +++ /dev/null @@ -1,258 +0,0 @@ - - - - - - - - 1 - - - - - 1024 - - - - - 1024 - - - - - - - - list - - - - - - list_response - - - - - - issue - - - - - - issue_response - - - - - - revoke - - - - - - revoke_response - - - - - - error_response - - - - - - - - - - - - - - - - 1024 - - - - - 1024 - - - - - 512000 - [\-,0-9]* - - - - - 512000 - [\-,/.0-9]* - - - - - 512000 - [\-,/:0-9a-fA-F]* - - - - - - 1024 - rsync://.+ - - - - - - - - 1024 - - - - - - 512000 - [\-,0-9]* - - - - - - - 512000 - [\-,/.0-9]* - - - - - - - 512000 - [\-,/:0-9a-fA-F]* - - - - - 512000 - - - - - - 512000 - - - - - - - - - 1024 - - - - - - 512000 - [\-,0-9]* - - - - - - - 512000 - [\-,/.0-9]* - - - - - - - 512000 - [\-,/:0-9a-fA-F]* - - - - - 512000 - - - - - - - - - - - - - - - - - 1024 - - - - - 1024 - - - - - - - - 1101 - - 1102 - - 1103 - - 1201 - - 1202 - - 1203 - - 1301 - - 1302 - - 2001 - - - - - - - - - - 1024 - - - - - diff --git a/scripts/up-down-protocol-samples/issue_response.xml b/scripts/up-down-protocol-samples/issue_response.xml index 849626c6..39f6b954 100644 --- a/scripts/up-down-protocol-samples/issue_response.xml +++ b/scripts/up-down-protocol-samples/issue_response.xml @@ -5,12 +5,12 @@ recipient="recipient name" type="issue_response"> - @@ -36,7 +36,7 @@ AIYRKF4k4ZDYZ9gA/LYnH56xvpEXwRE1bpxgUC5n8wQrdIn5/pJz3R5EgWe4CGOo n/SMvEfe8d+LEc0C7LmtCwYoDOKENoOF809GVkbV9fjL8w== - @@ -62,7 +62,7 @@ 2emkoegzzS2cN+5I5I+O8IRnZInqmiPgEgElgEFw+rg6xw23yax5Nyqx12J56tt0 tPWGhrYe1dCwKZajWKn3P9+NMcGQ0d8bw/QU+B3RyVeVfw== - diff --git a/scripts/up-down-protocol-samples/list_response.xml b/scripts/up-down-protocol-samples/list_response.xml index a2598d33..9e368f5a 100644 --- a/scripts/up-down-protocol-samples/list_response.xml +++ b/scripts/up-down-protocol-samples/list_response.xml @@ -5,12 +5,12 @@ recipient="recipient name" type="list_response"> - @@ -36,7 +36,7 @@ AIYRKF4k4ZDYZ9gA/LYnH56xvpEXwRE1bpxgUC5n8wQrdIn5/pJz3R5EgWe4CGOo n/SMvEfe8d+LEc0C7LmtCwYoDOKENoOF809GVkbV9fjL8w== - @@ -62,7 +62,7 @@ 2emkoegzzS2cN+5I5I+O8IRnZInqmiPgEgElgEFw+rg6xw23yax5Nyqx12J56tt0 tPWGhrYe1dCwKZajWKn3P9+NMcGQ0d8bw/QU+B3RyVeVfw== - @@ -114,11 +114,11 @@ - + MIIDzDCCArSgAwIBAgIBCTANBgkqhkiG9w0BAQUFADAbMRkwFwYDVQQDExBURVNU IEVOVElUWSBMSVIxMB4XDTA3MDgwMTE0NDgyMloXDTA4MDczMTE0NDgyMlowGzEZ MBcGA1UEAxMQVEVTVCBFTlRJVFkgSVNQMjCCASIwDQYJKoZIhvcNAQEBBQADggEP diff --git a/scripts/xml-parse-test.py b/scripts/xml-parse-test.py index ed437789..73ab295d 100755 --- a/scripts/xml-parse-test.py +++ b/scripts/xml-parse-test.py @@ -42,7 +42,7 @@ def lr_tester(elt_in, elt_out, msg): pprint_cert(cert) test(fileglob="up-down-protocol-samples/*.xml", - schema="up-down-medium-schema.rng", + schema="up-down-schema.rng", sax_handler=rpki.up_down.sax_handler, encoding="utf-8", tester=ud_tester) -- cgit v1.2.3