path: root/myrpki.rototill/setup.py

"""
$Id$

Copyright (C) 2010  Internet Systems Consortium ("ISC")

Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE OF THIS SOFTWARE.
"""

import subprocess, csv, re, os, getopt, sys, base64, time, glob
import myrpki, rpki.config, rpki.cli, rpki.sundial

from xml.etree.ElementTree import Element, SubElement, ElementTree

PEMElement = myrpki.PEMElement

def read_xml_handle_tree(filename):
  handle = os.path.splitext(os.path.split(filename)[-1])[0]
  etree  = myrpki.etree_read(filename)
  return handle, etree

class main(rpki.cli.Cmd):

  prompt = "setup> "

  completedefault = rpki.cli.Cmd.filename_complete

  me = None
  parents = {}
  children = {}
  repositories = {}


  def __init__(self):
    os.environ["TZ"] = "UTC"
    time.tzset()

    self.cfg_file = os.getenv("MYRPKI_CONF", "myrpki.conf")

    opts, argv = getopt.getopt(sys.argv[1:], "c:h?", ["config=", "help"])
    for o, a in opts:
      if o in ("-c", "--config"):
        self.cfg_file = a
      elif o in ("-h", "--help", "-?"):
        argv = ["help"]

    if not argv or argv[0] != "help":
      self.read_config()

    rpki.cli.Cmd.__init__(self, argv)


  def read_config(self):

    self.cfg = rpki.config.parser(self.cfg_file, "myrpki")
    myrpki.openssl = self.cfg.get("openssl", "openssl")
    self.histfile  = self.cfg.get("history_file", ".setup_history")

    self.handle    = self.cfg.get("handle")
    self.run_rpkid = self.cfg.getboolean("run_rpkid")
    self.run_pubd  = self.cfg.getboolean("run_pubd")
    self.run_rootd = self.cfg.getboolean("run_rootd")

    self.entitydb_dir = self.cfg.get("entitydb_dir", "entitydb")

    if self.run_rootd and (not self.run_pubd or not self.run_rpkid):
      raise RuntimeError, "Can't run rootd unless also running rpkid and pubd"

    self.bpki_resources = myrpki.CA(self.cfg_file, self.cfg.get("bpki_resources_directory"))
    if self.run_rpkid or self.run_pubd or self.run_rootd:
      self.bpki_servers = myrpki.CA(self.cfg_file, self.cfg.get("bpki_servers_directory"))

    self.pubd_contact_info = self.cfg.get("pubd_contact_info", "")

    self.rsync_module = self.cfg.get("publication_rsync_module")
    self.rsync_server = self.cfg.get("publication_rsync_server")


  def entitydb(self, *args):
    return os.path.join(self.entitydb_dir, *args)


  def load_xml(self):
    try:
      self.me = myrpki.etree_read(self.entitydb("identity.xml"))
    except IOError:
      self.me = None
    self.parents      = dict(read_xml_handle_tree(i) for i in glob.glob(self.entitydb("parents", "*.xml")))
    self.children     = dict(read_xml_handle_tree(i) for i in glob.glob(self.entitydb("children", "*.xml")))
    self.repositories = dict(read_xml_handle_tree(i) for i in glob.glob(self.entitydb("repositories", "*.xml")))

    if False:
      print "++ Loaded ++"
      print handle, self.me
      print "Parents:     ", self.parents
      print "Children:    ", self.children
      print "Repositories:", self.repositories
      print "-- Loaded --"


  def do_initialize(self, arg):
    if arg:
      raise RuntimeError, "This command takes no arguments"

    print "Generating RSA keys, this may take a little while..."

    self.bpki_resources.setup(self.cfg.get("bpki_resources_ta_dn",
                                           "/CN=%s BPKI Resource Trust Anchor" % self.handle))
    if self.run_rpkid or self.run_pubd or self.run_rootd:
      self.bpki_servers.setup(self.cfg.get("bpki_servers_ta_dn",
                                           "/CN=%s BPKI Server Trust Anchor" % self.handle))

    # Create entitydb directories.

    for i in ("parents", "children", "repositories", "pubclients"):
      d = self.entitydb(i)
      if not os.path.exists(d):
        os.makedirs(d)

    if self.run_rpkid or self.run_pubd or self.run_rootd:

      if self.run_rpkid:
        self.bpki_servers.ee(self.cfg.get("bpki_rpkid_ee_dn",
                                          "/CN=%s rpkid server certificate" % self.handle), "rpkid")
        self.bpki_servers.ee(self.cfg.get("bpki_irdbd_ee_dn",
                                          "/CN=%s irdbd server certificate" % self.handle), "irdbd")
      if self.run_pubd:
        self.bpki_servers.ee(self.cfg.get("bpki_pubd_ee_dn",
                                          "/CN=%s pubd server certificate" % self.handle), "pubd")
      if self.run_rpkid or self.run_pubd:
        self.bpki_servers.ee(self.cfg.get("bpki_irbe_ee_dn",
                                          "/CN=%s irbe client certificate" % self.handle), "irbe")
      if self.run_rootd:
        self.bpki_servers.ee(self.cfg.get("bpki_rootd_ee_dn",
                                          "/CN=%s rootd server certificate" % self.handle), "rootd")

    # Build the identity.xml file.  Need to check for existing file so we don't
    # overwrite?  Worry about that later.

    e = Element("identity", handle = self.handle)
    PEMElement(e, "bpki_ta", self.bpki_resources.cer)
    myrpki.etree_write(e, self.entitydb("identity.xml"))

    # If we're running rootd, construct a fake parent to go with it,
    # and cross-certify in both directions so we can talk to rootd.

    if self.run_rootd:

      e = Element("parent", parent_handle = "rootd", child_handle = self.handle,
                  service_url = "https://localhost:%s/" % self.cfg.get("rootd_server_port"),
                  valid_until = str(rpki.sundial.now() + rpki.sundial.timedelta(days = 365)))
      PEMElement(e, "bpki_resource_ta", self.bpki_servers.cer)
      PEMElement(e, "bpki_server_ta", self.bpki_servers.cer)
      PEMElement(e, "bpki_child_ta", self.bpki_resources.cer)
      SubElement(e, "repository", type = "offer")
      myrpki.etree_write(e, self.entitydb("parents", "rootd.xml"))

      self.bpki_resources.xcert(self.bpki_servers.cer)

      rootd_child_fn = self.cfg.get("child-bpki-cert", None, "rootd")
      if not os.path.exists(rootd_child_fn):
        os.link(self.bpki_servers.xcert(self.bpki_resources.cer), rootd_child_fn)

    # If we're running pubd, construct repository request for it, as
    # if we had received an offer.

    if self.run_pubd:
      e = Element("repository", type = "request", handle = self.handle)
      SubElement(e, "contact_info").text = self.pubd_contact_info
      PEMElement(e, "bpki_ta", self.bpki_resources.cer)
      myrpki.etree_write(e, self.entitydb("repositories", "%s.xml" % self.handle))


  def do_answer_child(self, arg):

    self.load_xml()

    child_handle = None

    opts, argv = getopt.getopt(arg.split(), "", ["child_handle="])
    for o, a in opts:
      if o == "--child_handle":
        child_handle = a
    
    if len(argv) != 1:
      raise RuntimeError, "Need to specify filename for child.xml"

    if not self.run_rpkid:
      raise RuntimeError, "Don't (yet) know how to set up child unless we run rpkid"

    c = myrpki.etree_read(argv[0])

    if child_handle is None:
      child_handle = c.get("handle")

    print "Child calls itself %r, we call it %r" % (c.get("handle"), child_handle)

    self.bpki_servers.fxcert(c.findtext("bpki_ta"))

    e = Element("parent", parent_handle = self.handle, child_handle = child_handle,
                service_url = "https://%s:%s/up-down/%s/%s" % (self.cfg.get("rpkid_server_host"),
                                                               self.cfg.get("rpkid_server_port"),
                                                               self.handle, child_handle),
                valid_until = str(rpki.sundial.now() + rpki.sundial.timedelta(days = 365)))

    PEMElement(e, "bpki_resource_ta", self.bpki_resources.cer)
    PEMElement(e, "bpki_server_ta",   self.bpki_servers.cer)
    SubElement(e, "bpki_child_ta").text = c.findtext("bpki_ta")

    repos = [(n, r) for n, r in self.repositories.iteritems() if r.get("type") == "confirmed"]
    if len(repos) < 1:
      print "Couldn't find any usable repositories, not giving referral"
    elif len(repos) > 1:
      print "Too many repositories, I don't know what to do, not giving referral"
    else:
      repo_handle, repo = repos[0]
      if repo_handle == self.handle:
        SubElement(e, "repository", type = "offer")
      else:
        r = SubElement(e, "repository", type = "hint",
                       proposed_sia_base = repo.get("sia_base") + child_handle + "/")
        SubElement(r, "contact_info").text = repo.findtext("contact_info")
        # CMS-signed blob authorizing use of part of our space by our
        # child goes here, once I've written that code.

    myrpki.etree_write(e, self.entitydb("children", "%s.xml" % child_handle))


  def do_process_parent_answer(self, arg):

    self.load_xml()

    parent_handle = None
    repository_handle = None

    opts, argv = getopt.getopt(arg.split(), "", ["parent_handle=", "repository_handle="])
    for o, a in opts:
      if o == "--parent_handle":
        parent_handle = a
      elif o == "--repository_handle":
        repository_handle = a

    if len(argv) != 1:
      raise RuntimeError, "Need to specify filename for parent.xml on command line"

    p = myrpki.etree_read(argv[0])

    if parent_handle is None:
      parent_handle = p.get("parent_handle")

    if repository_handle is None:
      repository_handle = parent_handle

    print "Parent calls itself %r, we call it %r" % (p.get("parent_handle"), parent_handle)
    print "Parent calls us %r" % p.get("child_handle")
    print "We call repository %r" % repository_handle

    self.bpki_resources.fxcert(p.findtext("bpki_resource_ta"))
    self.bpki_resources.fxcert(p.findtext("bpki_server_ta"))

    myrpki.etree_write(p, self.entitydb("parents", "%s.xml" % parent_handle))

    r = p.find("repository")

    if r is not None and r.get("type") in ("offer", "hint"):
      r.set("handle", self.handle)
      PEMElement(r, "bpki_ta", self.bpki_resources.cer)
      myrpki.etree_write(r, self.entitydb("repositories", "%s.xml" % repository_handle))

    else:
      print "Couldn't find repository offer or hint"


  def do_answer_repository_client(self, arg):

    self.load_xml()

    sia_base = None

    opts, argv = getopt.getopt(arg.split(), "", ["sia_base="])
    for o, a in opts:
      if o == "--sia_base":
        sia_base = a
    
    if len(argv) != 1:
      raise RuntimeError, "Need to specify filename for client.xml"

    c = myrpki.etree_read(argv[0])

    # Critical thing at this point is to figure out what client's
    # sia_base value should be.  Three cases:
    #
    # - client has no particular relationship to any other client:
    #   sia_base is top-level, or as close as we can make it taking
    #   rsyncd module into account (maybe homed under us, hmm, how do
    #   we detect case where we are talking to ourself?)
    #
    # - client is a direct child of ours to whom we (in our parent
    #   role) made an offer of publication service.  client homes
    #   under us, presumably.
    #
    # - client is a child of a client of ours who referred the new
    #   client to us, along with a signed referral.  signed referral
    #   includes sia_base of referring client, new client homes under
    #   that per referring client's wishes.
    #
    # ... which implies that there's a fourth case, where we are both
    # the client and the server.

    # Checking of signed referrals goes somewhere around here.  Must
    # be after reading client's XML, but before deciding what the
    # client's sia_base and handle will be.

    # For the moment we cheat egregiously, no crypto, blind trust of
    # what we're sent, while I focus on the basic semantics.
    #
    if sia_base is None and c.get("proposed_sia_base"):
      sia_base = c.get("proposed_sia_base")
    elif sia_base is None and c.get("handle") == self.handle:
      sia_base = "rsync://%s/%s/" % (self.rsync_server, self.rsync_module)
    else:
      sia_base = "rsync://%s/%s/%s/" % (self.rsync_server, self.rsync_module, c.get("handle"))

    client_handle = "/".join(sia_base.rstrip("/").split("/")[3:])

    print "Client calls itself %r, we call it %r" % (c.get("handle"), client_handle)

    self.bpki_servers.fxcert(c.findtext("bpki_ta"))

    e = Element("repository", type = "confirmed",
                repository_handle = self.handle,
                client_handle = client_handle,
                sia_base = sia_base,
                service_url = "https://%s:%s/client/%s" % (self.cfg.get("pubd_server_host"),
                                                           self.cfg.get("pubd_server_port"),
                                                           client_handle))

    PEMElement(e, "bpki_server_ta", self.bpki_servers.cer)
    SubElement(e, "bpki_client_ta").text = c.findtext("bpki_ta")
    SubElement(e, "contact_info").text = self.pubd_contact_info
    myrpki.etree_write(e, self.entitydb("pubclients", "%s.xml" % client_handle.replace("/", ".")))


  def do_process_repository_answer(self, arg):

    self.load_xml()

    repository_handle = None

    opts, argv = getopt.getopt(arg.split(), "", ["repository_handle="])
    for o, a in opts:
      if o == "--repository_handle":
        repository_handle = a

    if len(argv) != 1:
      raise RuntimeError, "Need to specify filename for repository.xml on command line"

    r = myrpki.etree_read(argv[0])

    if repository_handle is None:
       repository_handle = r.get("repository_handle")

    print "Repository calls itself %r, we call it %r" % (r.get("repository_handle"), repository_handle)
    print "Repository calls us %r" % r.get("client_handle")

    myrpki.etree_write(r, self.entitydb("repositories", "%s.xml" % repository_handle))


  def do_compose_request_to_host(self, arg):
    pass

  def do_answer_hosted_entity(self, arg):
    pass

  def do_process_host_answer(self, arg):
    pass


if __name__ == "__main__":
  main()