openssl/trunk/crypto/conf/conf_lib.c


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
7# $Id$

import tlslite.api, MySQLdb, urlparse
import rpki.https, rpki.config, rpki.resource_set, rpki.cms

def handler(query, path):
  try:
    q_xml = rpki.cms.verify(query, cms_ta)
    print q_xml
    q_elt = lxml.etree.fromstring(q_xml)
    rng.assertValid(q_elt)
    saxer = rpki.left_right.sax_handler()
    lxml.sax.saxify(q_elt, saxer)
    q_msg = saxer.result
    assert instanceof(q_msg, rpki.left_right.msg)
    r_msg = rpki.left_right.msg()
    for q_pdu in q_msg:
      assert isinstance(q_pdu, rpki.left_right.list_resources_elt) and q_pdu.type == "query"

      r_pdu = rpki.left_right.list_resources_elt()
      r_pdu.type = "reply"
      r_pdu.self_id = q_pdu.self_id
      r_pdu.child_id = q_pdu.child_id

      if q_pdu.child_id is not None:
        field = "child_id"
      else:
        field = "self_id"

      cur.execute("SELECT registrant_id, subject_name, valid_until FROM registrant WHERE registrant.%s = %s" % (field, getattr(q_pdu, field)))
      assert cur.rowcount == 1, "This query should have produced a single exact match, something's messed up (self_id = %s, child_id = %s)" % (self_id, child_id)

      registrant_id, subject_name, valid_until = cur.fetchone()
      r_pdu.subject_name = subject_name
      r_pdu.valid_until = valid_until.strftime("%Y-%m-%dT%H:%M:%SZ")
      r_pdu.as   = rpki.resource_set.resource_set_as.from_sql(cur,   "SELECT start_as, end_as FROM asn WHERE registrant_id = %s" % registrant_id)
      r_pdu.ipv4 = rpki.resource_set.resource_set_ipv4.from_sql(cur, "SELECT start_ip, end_ip FROM net WHERE registrant_id = %s AND version = 4" % registrant_id)
      r_pdu.ipv6 = rpki.resource_set.resource_set_ipv6.from_sql(cur, "SELECT start_ip, end_ip FROM net WHERE registrant_id = %s AND version = 6" % registrant_id)
      r_msg.append(r_pdu)

    r_elt = r_msg.toXML()
    rng.assertValid(r_elt)
    r_xml = lxml.etree.tostring(r_elt, pretty_print=True, encoding="us-ascii", xml_declaration=True)
    r_cms = rpki.cms.sign(r_xml, cfg.get(section, "cms-key"), cfg.multiget(section, "cms-cert"))

    return 200, r_cms

  except Exception, data:
    # This should generate a <report_error/> PDU, but this will do for initial debugging
    return 500, "Unhandled exception %s" % data

cfg = rpki.config.parser("irbe.conf")
cfg_section = "irdb"

db = MySQLdb.connect(user   = cfg.get(cfg_section, "sql-username"),
                     db     = cfg.get(cfg_section, "sql-database"),
                     passwd = cfg.get(cfg_section, "sql-password"))

cur = db.cursor()

cms_ta          = rpki.x509.X509(Auto_file = cfg.get(cfg_section, "cms-ta"))
cms_key         = rpki.x509.RSA(Auto_file = cfg.get(cfg_section, "cms-key"))
cms_certs       = rpki.x509.X509_chain(Auto_files = cfg.multiget(cfg_section, "cms-cert"))

u = urlparse.urlparse(cfg.get(cfg_section, "https-url"))

assert u.scheme in ("", "https") and \
       u.username is None and \
       u.password is None and \
       u.params   == "" and \
       u.query    == "" and \
       u.fragment == ""

rpki.https.server(privateKey = rpki.x509.RSA(Auto_file = cfg.get(cfg_section, "https-key")),
                  certChain  = rpki.x509.X509_chain(Auto_files = cfg.multiget(cfg_section, "https-cert")),
                  host       = u.hostname or "localhost",
                  port       = u.port or 443,
                  handlers   = ((u.path, handler),))

lass="n">default_CONF_method->init(conf);
	conf->data = hash;
	}

/* The following section contains the "CONF classic" functions,
   rewritten in terms of the new CONF interface. */

int CONF_set_default_method(CONF_METHOD *meth)
	{
	default_CONF_method = meth;
	return 1;
	}

LHASH *CONF_load(LHASH *conf, const char *file, long *eline)
	{
	LHASH *ltmp;
	BIO *in=NULL;

#ifdef OPENSSL_SYS_VMS
	in=BIO_new_file(file, "r");
#else
	in=BIO_new_file(file, "rb");
#endif
	if (in == NULL)
		{
		CONFerr(CONF_F_CONF_LOAD,ERR_R_SYS_LIB);
		return NULL;
		}

	ltmp = CONF_load_bio(conf, in, eline);
	BIO_free(in);

	return ltmp;
	}

#ifndef OPENSSL_NO_FP_API
LHASH *CONF_load_fp(LHASH *conf, FILE *fp,long *eline)
	{
	BIO *btmp;
	LHASH *ltmp;
	if(!(btmp = BIO_new_fp(fp, BIO_NOCLOSE))) {
		CONFerr(CONF_F_CONF_LOAD_FP,ERR_R_BUF_LIB);
		return NULL;
	}
	ltmp = CONF_load_bio(conf, btmp, eline);
	BIO_free(btmp);
	return ltmp;
	}
#endif

LHASH *CONF_load_bio(LHASH *conf, BIO *bp,long *eline)
	{
	CONF ctmp;
	int ret;

	CONF_set_nconf(&ctmp, conf);

	ret = NCONF_load_bio(&ctmp, bp, eline);
	if (ret)
		return ctmp.data;
	return NULL;
	}

STACK_OF(CONF_VALUE) *CONF_get_section(LHASH *conf,const char *section)
	{
	if (conf == NULL)
		{
		return NULL;
		}
	else
		{
		CONF ctmp;
		CONF_set_nconf(&ctmp, conf);
		return NCONF_get_section(&ctmp, section);
		}
	}

char *CONF_get_string(LHASH *conf,const char *group,const char *name)
	{
	if (conf == NULL)
		{
		return NCONF_get_string(NULL, group, name);
		}
	else
		{
		CONF ctmp;
		CONF_set_nconf(&ctmp, conf);
		return NCONF_get_string(&ctmp, group, name);
		}
	}

long CONF_get_number(LHASH *conf,const char *group,const char *name)
	{
	int status;
	long result = 0;

	if (conf == NULL)
		{
		status = NCONF_get_number_e(NULL, group, name, &result);
		}
	else
		{
		CONF ctmp;
		CONF_set_nconf(&ctmp, conf);
		status = NCONF_get_number_e(&ctmp, group, name, &result);
		}

	if (status == 0)
		{
		/* This function does not believe in errors... */
		ERR_clear_error();
		}
	return result;
	}

void CONF_free(LHASH *conf)
	{
	CONF ctmp;
	CONF_set_nconf(&ctmp, conf);
	NCONF_free_data(&ctmp);
	}

#ifndef OPENSSL_NO_FP_API
int CONF_dump_fp(LHASH *conf, FILE *out)
	{
	BIO *btmp;
	int ret;

	if(!(btmp = BIO_new_fp(out, BIO_NOCLOSE))) {
		CONFerr(CONF_F_CONF_DUMP_FP,ERR_R_BUF_LIB);
		return 0;
	}
	ret = CONF_dump_bio(conf, btmp);
	BIO_free(btmp);
	return ret;
	}
#endif

int CONF_dump_bio(LHASH *conf, BIO *out)
	{
	CONF ctmp;
	CONF_set_nconf(&ctmp, conf);
	return NCONF_dump_bio(&ctmp, out);
	}

/* The following section contains the "New CONF" functions.  They are
   completely centralised around a new CONF structure that may contain
   basically anything, but at least a method pointer and a table of data.
   These functions are also written in terms of the bridge functions used
   by the "CONF classic" functions, for consistency.  */

CONF *NCONF_new(CONF_METHOD *meth)
	{
	CONF *ret;

	if (meth == NULL)
		meth = NCONF_default();

	ret = meth->create(meth);
	if (ret == NULL)
		{
		CONFerr(CONF_F_NCONF_NEW,ERR_R_MALLOC_FAILURE);
		return(NULL);
		}

	return ret;
	}

void NCONF_free(CONF *conf)
	{
	if (conf == NULL)
		return;
	conf->meth->destroy(conf);
	}

void NCONF_free_data(CONF *conf)
	{
	if (conf == NULL)
		return;
	conf->meth->destroy_data(conf);
	}

int NCONF_load(CONF *conf, const char *file, long *eline)
	{
	if (conf == NULL)
		{
		CONFerr(CONF_F_NCONF_LOAD,CONF_R_NO_CONF);
		return 0;
		}

	return conf->meth->load(conf, file, eline);
	}

#ifndef OPENSSL_NO_FP_API
int NCONF_load_fp(CONF *conf, FILE *fp,long *eline)
	{
	BIO *btmp;
	int ret;
	if(!(btmp = BIO_new_fp(fp, BIO_NOCLOSE)))
		{
		CONFerr(CONF_F_NCONF_LOAD_FP,ERR_R_BUF_LIB);
		return 0;
		}
	ret = NCONF_load_bio(conf, btmp, eline);
	BIO_free(btmp);
	return ret;
	}
#endif

int NCONF_load_bio(CONF *conf, BIO *bp,long *eline)
	{
	if (conf == NULL)
		{
		CONFerr(CONF_F_NCONF_LOAD_BIO,CONF_R_NO_CONF);
		return 0;
		}

	return conf->meth->load_bio(conf, bp, eline);
	}

STACK_OF(CONF_VALUE) *NCONF_get_section(const CONF *conf,const char *section)
	{
	if (conf == NULL)
		{
		CONFerr(CONF_F_NCONF_GET_SECTION,CONF_R_NO_CONF);
		return NULL;
		}

	if (section == NULL)
		{
		CONFerr(CONF_F_NCONF_GET_SECTION,CONF_R_NO_SECTION);
		return NULL;
		}

	return _CONF_get_section_values(conf, section);
	}

char *NCONF_get_string(const CONF *conf,const char *group,const char *name)
	{
	char *s = _CONF_get_string(conf, group, name);

        /* Since we may get a value from an environment variable even
           if conf is NULL, let's check the value first */
        if (s) return s;

	if (conf == NULL)
		{
		CONFerr(CONF_F_NCONF_GET_STRING,
                        CONF_R_NO_CONF_OR_ENVIRONMENT_VARIABLE);
		return NULL;
		}
	CONFerr(CONF_F_NCONF_GET_STRING,
		CONF_R_NO_VALUE);
	ERR_add_error_data(4,"group=",group," name=",name);
	return NULL;
	}

int NCONF_get_number_e(const CONF *conf,const char *group,const char *name,
		       long *result)
	{
	char *str;

	if (result == NULL)
		{
		CONFerr(CONF_F_NCONF_GET_NUMBER_E,ERR_R_PASSED_NULL_PARAMETER);
		return 0;
		}

	str = NCONF_get_string(conf,group,name);

	if (str == NULL)
		return 0;

	for (*result = 0;conf->meth->is_number(conf, *str);)
		{
		*result = (*result)*10 + conf->meth->to_int(conf, *str);
		str++;
		}

	return 1;
	}

#ifndef OPENSSL_NO_FP_API
int NCONF_dump_fp(const CONF *conf, FILE *out)
	{
	BIO *btmp;
	int ret;
	if(!(btmp = BIO_new_fp(out, BIO_NOCLOSE))) {
		CONFerr(CONF_F_NCONF_DUMP_FP,ERR_R_BUF_LIB);
		return 0;
	}
	ret = NCONF_dump_bio(conf, btmp);
	BIO_free(btmp);
	return ret;
	}
#endif

int NCONF_dump_bio(const CONF *conf, BIO *out)
	{
	if (conf == NULL)
		{
		CONFerr(CONF_F_NCONF_DUMP_BIO,CONF_R_NO_CONF);
		return 0;
		}

	return conf->meth->dump(conf, out);
	}


/* This function should be avoided */
#if 0
long NCONF_get_number(CONF *conf,char *group,char *name)
	{
	int status;
	long ret=0;

	status = NCONF_get_number_e(conf, group, name, &ret);
	if (status == 0)
		{
		/* This function does not believe in errors... */
		ERR_get_error();
		}
	return ret;
	}
#endif