path: root/myrpki/myrpki.py

"""
Read an OpenSSL-style config file and a bunch of .csv files to find
out about parents and children and resources and ROA requests, oh my.
Run OpenSSL command line tool to construct BPKI certificates,
including cross-certification of other entities' BPKI certificates.

Package up all of the above as a single XML file which user can then
ship off to the IRBE.  If an XML file already exists, check it for
data coming back from the IRBE (principally PKCS #10 requests for our
BSC) and update it with current data.

The general idea here is that this one XML file contains all of the
data that needs to be exchanged as part of ordinary update operations;
each party updates it as necessary, then ships it to the other via
some secure channel: carrier pigeon, USB stick, gpg-protected email,
we don't really care.

This one program is written a little differently from all the other
Python RPKI programs.  This one program is intended to run as a
stand-alone script, without the other programs present.  It does
require a reasonably up-to-date version of the OpenSSL command line
tool (the one built as a side effect of building rcynic will do), but
it does -not- require POW or any Python libraries beyond what ships
with Python 2.5.  So this script uses xml.etree from the Python
standard libraries instead of lxml.etree, which sacrifices XML schema
validation support in favor of portability, and so forth.

To make things a little weirder, as a convenience to IRBE operators,
this script can itself be loaded as a Python module and invoked as
part of another program.  This requires a few minor contortions, but
avoids duplicating common code.

$Id$

Copyright (C) 2009  Internet Systems Consortium ("ISC")

Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE OF THIS SOFTWARE.
"""

# Only standard Python libraries for this program, please.

import subprocess, csv, re, os, getopt, sys, ConfigParser, base64

from xml.etree.ElementTree import Element, SubElement, ElementTree

# Our XML namespace. 

namespace = "http://www.hactrn.net/uris/rpki/myrpki/"

# Dialect for our use of CSV files, here to make it easy to change if
# your site needs to do something different.  See doc for the csv
# module in the Python standard libraries for details if you need to
# customize this.

csv_dialect = csv.get_dialect("excel-tab")

# Whether to include incomplete entries when rendering to XML.

allow_incomplete = False

# Whether to whine about incomplete entries while rendering to XML.

whine = False

class comma_set(set):
  """
  Minor customization of set(), to provide a print syntax.
  """

  def __str__(self):
    return ",".join(self)

class roa_request(object):
  """
  Representation of a ROA request.
  """

  v4re = re.compile("^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]+(-[0-9]+)?$", re.I)
  v6re = re.compile("^([0-9a-f]{0,4}:){0,15}[0-9a-f]{0,4}/[0-9]+(-[0-9]+)?$", re.I)

  def __init__(self, asn):
    self.asn = asn
    self.v4 = comma_set()
    self.v6 = comma_set()

  def __repr__(self):
    s = "<%s asn %s" % (self.__class__.__name__, self.asn)
    if self.v4:
      s += " v4 %s" % self.v4
    if self.v6:
      s += " v6 %s" % self.v6
    return s + ">"

  def add(self, prefix):
    """
    Add one prefix to this ROA request.
    """
    if self.v4re.match(prefix):
      self.v4.add(prefix)
    elif self.v6re.match(prefix):
      self.v6.add(prefix)
    else:
      raise RuntimeError, "Bad prefix syntax: %r" % (prefix,)

  def xml(self, e):
    """
    Generate XML element represeting representing this ROA request.
    """
    SubElement(e, "roa_request",
               asn = self.asn,
               v4 = str(self.v4),
               v6 = str(self.v6))

class roa_requests(dict):
  """
  Database of ROA requests.
  """

  def add(self, asn, prefix):
    """
    Add one <ASN, prefix> pair to ROA request database.
    """
    if asn not in self:
      self[asn] = roa_request(asn)
    self[asn].add(prefix)

  def xml(self, e):
    """
    Render ROA requests as XML elements.
    """
    for r in self.itervalues():
      r.xml(e)

  @classmethod
  def from_csv(cls, roa_csv_file):
    """
    Parse ROA requests from CSV file.
    """
    self = cls()
    # format:  p/n-m asn
    for pnm, asn in csv_open(roa_csv_file):
      self.add(asn = asn, prefix = pnm)
    return self

class child(object):
  """
  Representation of one child entity.
  """

  v4re = re.compile("^(([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]+)|(([0-9]{1,3}\.){3}[0-9]{1,3}-([0-9]{1,3}\.){3}[0-9]{1,3})$", re.I)
  v6re = re.compile("^(([0-9a-f]{0,4}:){0,15}[0-9a-f]{0,4}/[0-9]+)|(([0-9a-f]{0,4}:){0,15}[0-9a-f]{0,4}-([0-9a-f]{0,4}:){0,15}[0-9a-f]{0,4})$", re.I)

  def __init__(self, handle):
    self.handle = handle
    self.asns = comma_set()
    self.v4 = comma_set()
    self.v6 = comma_set()
    self.validity = None
    self.bpki_certificate = None

  def __repr__(self):
    s = "<%s %s" % (self.__class__.__name__, self.handle)
    if self.asns:
      s += " asn %s" % self.asns
    if self.v4:
      s += " v4 %s" % self.v4
    if self.v6:
      s += " v6 %s" % self.v6
    if self.validity:
      s += " valid %s" % self.validity
    if self.bpki_certificate:
      s += " cert %s" % self.bpki_certificate
    return s + ">"

  def add(self, prefix = None, asn = None, validity = None, bpki_certificate = None):
    """
    Add prefix, autonomous system number, validity date, or BPKI
    certificate for this child.
    """
    if prefix is not None:
      if self.v4re.match(prefix):
        self.v4.add(prefix)
      elif self.v6re.match(prefix):
        self.v6.add(prefix)
      else:
        raise RuntimeError, "Bad prefix syntax: %r" % (prefix,)
    if asn is not None:
      self.asns.add(asn)
    if validity is not None:
      self.validity = validity
    if bpki_certificate is not None:
      self.bpki_certificate = bpki_certificate

  def xml(self, e):
    """
    Render this child as an XML element.
    """
    complete = self.bpki_certificate and self.validity
    if whine and not complete:
      print "Incomplete child entry %s" % self
    if complete or allow_incomplete:
      e = SubElement(e, "child",
                     handle = self.handle,
                     valid_until = self.validity,
                     asns = str(self.asns),
                     v4 = str(self.v4),
                     v6 = str(self.v6))
      if self.bpki_certificate:
        PEMElement(e, "bpki_certificate", self.bpki_certificate)

class children(dict):
  """
  Database of children.
  """

  def add(self, handle, prefix = None, asn = None, validity = None, bpki_certificate = None):
    """
    Add resources to a child, creating the child object if necessary.
    """
    if handle not in self:
      self[handle] = child(handle)
    self[handle].add(prefix = prefix, asn = asn, validity = validity, bpki_certificate = bpki_certificate)

  def xml(self, e):
    """
    Render children database to XML.
    """
    for c in self.itervalues():
      c.xml(e)

  @classmethod
  def from_csv(cls, children_csv_file, prefix_csv_file, asn_csv_file, xcert):
    """
    Parse child resources, certificates, and validity dates from CSV files.
    """
    self = cls()
    # childname date pemfile
    for handle, date, pemfile in csv_open(children_csv_file):
      self.add(handle = handle, validity = date, bpki_certificate = xcert(pemfile))
    # childname p/n
    for handle, pn in csv_open(prefix_csv_file):
      self.add(handle = handle, prefix = pn)
    # childname asn
    for handle, asn in csv_open(asn_csv_file):
      self.add(handle = handle, asn = asn)
    return self

class parent(object):
  """
  Representation of one parent entity.
  """

  def __init__(self, handle):
    self.handle = handle
    self.service_uri = None
    self.bpki_cms_certificate = None
    self.bpki_https_certificate = None
    self.myhandle = None
    self.sia_base = None

  def __repr__(self):
    s = "<%s %s" % (self.__class__.__name__, self.handle)
    if self.myhandle:
      s += " myhandle %s" % self.myhandle
    if self.service_uri:
      s += " uri %s" % self.service_uri
    if self.sia_base:
      s += " sia %s" % self.sia_base
    if self.bpki_cms_certificate:
      s += " cms %s" % self.bpki_cms_certificate
    if self.bpki_https_certificate:
      s += " https %s" % self.bpki_https_certificate
    return s + ">"

  def add(self, service_uri = None,
          bpki_cms_certificate = None,
          bpki_https_certificate = None,
          myhandle = None,
          sia_base = None):
    """
    Add service URI or BPKI certificates to this parent object.
    """
    if service_uri is not None:
      self.service_uri = service_uri
    if bpki_cms_certificate is not None:
      self.bpki_cms_certificate = bpki_cms_certificate
    if bpki_https_certificate is not None:
      self.bpki_https_certificate = bpki_https_certificate
    if myhandle is not None:
      self.myhandle = myhandle
    if sia_base is not None:
      self.sia_base = sia_base

  def xml(self, e):
    """
    Render this parent object to XML.
    """
    complete = self.bpki_cms_certificate and self.bpki_https_certificate and self.myhandle and self.service_uri and self.sia_base
    if whine and not complete:
      print "Incomplete parent entry %s" % self
    if complete or allow_incomplete:
      e = SubElement(e, "parent",
                     handle = self.handle,
                     myhandle = self.myhandle,
                     service_uri = self.service_uri,
                     sia_base = self.sia_base)
      if self.bpki_cms_certificate:
        PEMElement(e, "bpki_cms_certificate", self.bpki_cms_certificate)
      if self.bpki_https_certificate:
        PEMElement(e, "bpki_https_certificate", self.bpki_https_certificate)

class parents(dict):
  """
  Database of parent objects.
  """

  def add(self, handle,
          service_uri = None,
          bpki_cms_certificate = None,
          bpki_https_certificate = None,
          myhandle = None,
          sia_base = None):
    """
    Add service URI or certificates to parent object, creating it if necessary.
    """
    if handle not in self:
      self[handle] = parent(handle)
    self[handle].add(service_uri = service_uri,
                     bpki_cms_certificate = bpki_cms_certificate,
                     bpki_https_certificate = bpki_https_certificate,
                     myhandle = myhandle,
                     sia_base = sia_base)

  def xml(self, e):
    for c in self.itervalues():
      c.xml(e)

  @classmethod
  def from_csv(cls, parents_csv_file, xcert):
    """
    Parse parent data from CSV file.
    """
    self = cls()
    # parentname service_uri parent_bpki_cms_pemfile parent_bpki_https_pemfile myhandle sia_base
    for handle, service_uri, parent_cms_pemfile, parent_https_pemfile, myhandle, sia_base in csv_open(parents_csv_file):
      self.add(handle = handle,
               service_uri = service_uri,
	       bpki_cms_certificate = xcert(parent_cms_pemfile),
	       bpki_https_certificate = xcert(parent_https_pemfile),
               myhandle = myhandle,
               sia_base = sia_base)
    return self

def csv_open(filename):
  """
  Open a CSV file, with settings that make it a tab-delimited file.
  You may need to tweak this function for your environment, see the
  csv module in the Python standard libraries for details.
  """
  return csv.reader(open(filename, "rb"), dialect = csv_dialect)

def PEMElement(e, tag, filename):
  """
  Create an XML element containing Base64 encoded data taken from a
  PEM file.
  """
  e = SubElement(e, tag)
  e.text = "".join(p.strip() for p in open(filename).readlines()[1:-1])

class CA(object):
  """
  Representation of one certification authority.
  """

  # Mapping of path restriction values we use to OpenSSL config file
  # section names.

  path_restriction = { 0 : "ca_x509_ext_xcert0",
                       1 : "ca_x509_ext_xcert1" }

  def __init__(self, cfg, dir):
    self.cfg    = cfg
    self.dir    = dir
    self.cer    = dir + "/ca.cer"
    self.key    = dir + "/ca.key"
    self.req    = dir + "/ca.req"
    self.crl    = dir + "/ca.crl"
    self.index  = dir + "/index"
    self.serial = dir + "/serial"
    self.crlnum = dir + "/crl_number"

    self.env = { "PATH" : os.environ["PATH"],
                 "BPKI_DIRECTORY" : dir,
                 "RANDFILE" : ".OpenSSL.whines.unless.I.set.this" }

  def run_ca(self, *args):
    """
    Run OpenSSL "ca" command with tailored environment variables and common initial
    arguments.
    """
    cmd = ("openssl", "ca", "-notext", "-batch", "-config",  self.cfg) + args
    subprocess.check_call(cmd, env = self.env)

  def run_req(self, key_file, req_file):
    """
    Run OpenSSL "req" command with tailored environment variables and common arguments.
    """
    if not os.path.exists(key_file) or not os.path.exists(req_file):
      subprocess.check_call(("openssl", "req", "-new", "-sha256", "-newkey", "rsa:2048",
                             "-config", self.cfg, "-keyout", key_file, "-out", req_file),
                            env = self.env)
    
  @staticmethod
  def touch_file(filename, content = None):
    """
    Create dumb little text files expected by OpenSSL "ca" utility.
    """
    if not os.path.exists(filename):
      f = open(filename, "w")
      if content is not None:
        f.write(content)
      f.close()

  def setup(self, ca_name):
    """
    Set up this CA.  ca_name is an X.509 distinguished name in
    /tag=val/tag=val format.
    """

    modified = False

    if not os.path.exists(self.dir):
      os.makedirs(self.dir)
      self.touch_file(self.index)
      self.touch_file(self.serial, "01\n")
      self.touch_file(self.crlnum, "01\n")

    self.run_req(key_file = self.key, req_file = self.req)

    if not os.path.exists(self.cer):
      modified = True
      self.run_ca("-selfsign", "-extensions", "ca_x509_ext_ca", "-subj", ca_name, "-in", self.req, "-out", self.cer)

    if not os.path.exists(self.crl):
      modified = True
      self.run_ca("-gencrl", "-out", self.crl)

    return modified

  def ee(self, ee_name, base_name):
    """
    Issue an end-enity certificate.
    """
    key_file = "%s/%s.key" % (self.dir, base_name)
    req_file = "%s/%s.req" % (self.dir, base_name)
    cer_file = "%s/%s.cer" % (self.dir, base_name)
    self.run_req(key_file = key_file, req_file = req_file)
    if not os.path.exists(cer_file):
      self.run_ca("-extensions", "ca_x509_ext_ee", "-subj", ee_name, "-in", req_file, "-out", cer_file)
      return True
    else:
      return False

  def bsc(self, pkcs10):
    """
    Issue BSC certificiate, if we have a PKCS #10 request for it.
    """

    if pkcs10 is None:
      return None, None
    
    pkcs10 = base64.b64decode(pkcs10)

    assert pkcs10

    p = subprocess.Popen(("openssl", "dgst", "-md5"), stdin = subprocess.PIPE, stdout = subprocess.PIPE)
    hash = p.communicate(pkcs10)[0].strip()
    if p.wait() != 0:
      raise RuntimeError, "Couldn't hash PKCS#10 request"

    req_file = "%s/bsc.%s.req" % (self.dir, hash)
    cer_file = "%s/bsc.%s.cer" % (self.dir, hash)

    if not os.path.exists(cer_file):

      p = subprocess.Popen(("openssl", "req", "-inform", "DER", "-out", req_file), stdin = subprocess.PIPE)
      p.communicate(pkcs10)
      if p.wait() != 0:
        raise RuntimeError, "Couldn't store PKCS #10 request"

      self.run_ca("-extensions", "ca_x509_ext_ee", "-in", req_file, "-out", cer_file)

    return req_file, cer_file

  def fxcert(self, filename, cert, path_restriction = 0):
    """
    Write PEM certificate to file, then cross-certify.
    """
    fn = os.path.join(self.dir, filename)
    f = open(fn, "w")
    f.write(cert)
    f.close()
    return self.xcert(fn, path_restriction)

  def xcert(self, cert, path_restriction = 0):
    """
    Cross-certify a certificate represented as a PEM file.
    """

    if not cert:
      return None

    if not os.path.exists(cert):
      #print "Certificate %s doesn't exist, skipping" % cert
      return None

    # Extract public key and subject name from PEM file and hash it so
    # we can use the result as a tag for cross-certifying this cert.

    p1 = subprocess.Popen(("openssl", "x509", "-noout", "-pubkey", "-subject", "-in", cert), stdout = subprocess.PIPE)
    p2 = subprocess.Popen(("openssl", "dgst", "-md5"), stdin = p1.stdout, stdout = subprocess.PIPE)

    xcert = "%s/xcert.%s.cer" % (self.dir, p2.communicate()[0].strip())

    if p1.wait() != 0 or p2.wait() != 0:
      raise RuntimeError, "Couldn't generate cross-certification tag for %r" % cert

    # Cross-certify the cert we were given, if we haven't already.
    # This only works for self-signed certs, due to limitations of the
    # OpenSSL command line tool, but that suffices for our purposes.

    if not os.path.exists(xcert):
      self.run_ca("-ss_cert", cert, "-out", xcert, "-extensions", self.path_restriction[path_restriction])

    return xcert

def extract_resources():
  """
  Extract RFC 3779 resources from a certificate.  Not written yet.

  """
  raise NotImplementedError


def main(argv = ()):
  """
  Main program.  Must be callable from other programs as well as being
  invoked directly when this module is run as a script.
  """

  cfg_file        = "myrpki.conf"
  myrpki_section  = "myrpki"

  opts, argv = getopt.getopt(argv, "c:h:?", ["config=", "help"])
  for o, a in opts:
    if o in ("-h", "--help", "-?"):
      print __doc__
      sys.exit(0)
    elif o in ("-c", "--config"):
      cfg_file = a
  if argv:
    raise RuntimeError, "Unexpected arguments %r" % (argv,)

  cfg = ConfigParser.RawConfigParser()
  cfg.readfp(open(cfg_file, "r"), cfg_file)

  my_handle                     = cfg.get(myrpki_section, "handle")
  roa_csv_file                  = cfg.get(myrpki_section, "roa_csv")
  children_csv_file             = cfg.get(myrpki_section, "children_csv")
  parents_csv_file              = cfg.get(myrpki_section, "parents_csv")
  prefix_csv_file               = cfg.get(myrpki_section, "prefix_csv")
  asn_csv_file                  = cfg.get(myrpki_section, "asn_csv")
  bpki_dir                      = cfg.get(myrpki_section, "bpki_directory")
  xml_filename                  = cfg.get(myrpki_section, "xml_filename")
  repository_bpki_certificate   = cfg.get(myrpki_section, "repository_bpki_certificate")
  repository_handle             = cfg.get(myrpki_section, "repository_handle")

  bpki = CA(cfg_file, bpki_dir)
  bpki.setup("/CN=%s TA" % my_handle)

  if os.path.exists(xml_filename):
    e = ElementTree(file = xml_filename).getroot()
    bsc_req, bsc_cer = bpki.bsc(e.findtext("{%s}%s" % (namespace, "bpki_bsc_pkcs10")))
  else:
    bsc_req, bsc_cer = None, None

  e = Element("myrpki", xmlns = namespace, version = "1", handle = my_handle, repository_handle = repository_handle)

  roa_requests.from_csv(roa_csv_file).xml(e)

  children.from_csv(
    children_csv_file = children_csv_file,
    prefix_csv_file = prefix_csv_file,
    asn_csv_file = asn_csv_file,
    xcert = bpki.xcert).xml(e)

  parents.from_csv(
    parents_csv_file = parents_csv_file,
    xcert = bpki.xcert).xml(e)

  PEMElement(e, "bpki_ca_certificate", bpki.cer)
  PEMElement(e, "bpki_crl",            bpki.crl)

  if os.path.exists(repository_bpki_certificate):
    PEMElement(e, "bpki_repository_certificate", bpki.xcert(repository_bpki_certificate))

  if bsc_cer:
    PEMElement(e, "bpki_bsc_certificate", bsc_cer)

  if bsc_req:
    PEMElement(e, "bpki_bsc_pkcs10", bsc_req)

  # I still miss SYSCAL(RENMWO)

  ElementTree(e).write(xml_filename + ".tmp")
  os.rename(xml_filename + ".tmp", xml_filename)

# When this file is run as a script, run main() with command line
# arguments.  main() can't use sys.argv directly as that might be the
# command line for some other program that loads this module.

if __name__ == "__main__":
  main(sys.argv[1:])