""" Classes dealing with sets of resources. The basic mechanics of a resource set are the same for any of the resources we handle (ASNs, IPv4 addresses, or IPv6 addresses), so we can provide the same operations on any of them, even though the underlying details vary. We also provide some basic set operations (union, intersection, etc). $Id$ Copyright (C) 2009--2012 Internet Systems Consortium ("ISC") Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. Portions copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. """ import re import math import rpki.oids import rpki.exceptions import rpki.POW ## @var inherit_token # Token used to indicate inheritance in read and print syntax. inherit_token = "" re_asn_range = re.compile("^([0-9]+)-([0-9]+)$") re_address_range = re.compile("^([0-9:.a-fA-F]+)-([0-9:.a-fA-F]+)$") re_prefix_with_maxlen = re.compile("^([0-9:.a-fA-F]+)/([0-9]+)-([0-9]+)$") re_prefix = re.compile("^([0-9:.a-fA-F]+)/([0-9]+)$") class resource_range(object): """ Generic resource range type. Assumes underlying type is some kind of integer. This is a virtual class. You probably don't want to use this type directly. """ def __init__(self, range_min, range_max): assert range_min.__class__ is range_max.__class__, \ "Type mismatch, %r doesn't match %r" % (range_min.__class__, range_max.__class__) assert range_min <= range_max, "Mis-ordered range: %s before %s" % (range_min, range_max) self.min = range_min self.max = range_max def __cmp__(self, other): assert self.__class__ is other.__class__, \ "Type mismatch, comparing %r with %r" % (self.__class__, other.__class__) return cmp(self.min, other.min) or cmp(self.max, other.max) class resource_range_as(resource_range): """ Range of Autonomous System Numbers. Denotes a single ASN by a range whose min and max values are identical. """ ## @var datum_type # Type of underlying data (min and max). datum_type = long def __init__(self, range_min, range_max): resource_range.__init__(self, long(range_min) if isinstance(range_min, int) else range_min, long(range_max) if isinstance(range_max, int) else range_max) def __str__(self): """ Convert a resource_range_as to string format. """ if self.min == self.max: return str(self.min) else: return str(self.min) + "-" + str(self.max) @classmethod def parse_str(cls, x): """ Parse ASN resource range from text (eg, XML attributes). """ r = re_asn_range.match(x) if r: return cls(long(r.group(1)), long(r.group(2))) else: return cls(long(x), long(x)) @classmethod def from_strings(cls, a, b = None): """ Construct ASN range from strings. """ if b is None: b = a return cls(long(a), long(b)) class resource_range_ip(resource_range): """ Range of (generic) IP addresses. Prefixes are converted to ranges on input, and ranges that can be represented as prefixes are written as prefixes on output. This is a virtual class. You probably don't want to use it directly. """ ## @var datum_type # Type of underlying data (min and max). datum_type = rpki.POW.IPAddress def prefixlen(self): """ Determine whether a resource_range_ip can be expressed as a prefix. Returns prefix length if it can, otherwise raises MustBePrefix exception. """ mask = self.min ^ self.max if self.min & mask != 0: raise rpki.exceptions.MustBePrefix prefixlen = self.min.bits while mask & 1: prefixlen -= 1 mask >>= 1 if mask: raise rpki.exceptions.MustBePrefix return prefixlen @property def can_be_prefix(self): """ Boolean property indicating whether this range can be expressed as a prefix. This just calls .prefixlen() to do the work, so that we can keep the logic in one place. This property is useful primarily in context where catching an exception isn't practical. """ try: self.prefixlen() return True except rpki.exceptions.MustBePrefix: return False def __str__(self): """ Convert a resource_range_ip to string format. """ try: return str(self.min) + "/" + str(self.prefixlen()) except rpki.exceptions.MustBePrefix: return str(self.min) + "-" + str(self.max) @classmethod def parse_str(cls, x): 
/* crypto/x509/x509_def.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <stdio.h>
#include "cryptlib.h"
#include <openssl/crypto.h>
#include <openssl/x509.h>

const char *X509_get_default_private_dir(void)
	{ return(X509_PRIVATE_DIR); }
	
const char *X509_get_default_cert_area(void)
	{ return(X509_CERT_AREA); }

const char *X509_get_default_cert_dir(void)
	{ return(X509_CERT_DIR); }

const char *X509_get_default_cert_file(void)
	{ return(X509_CERT_FILE); }

const char *X509_get_default_cert_dir_env(void)
	{ return(X509_CERT_DIR_EVP); }

const char *X509_get_default_cert_file_env(void)
	{ return(X509_CERT_FILE_EVP); }
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-19 05:17:29 +0000
\ not other.v6.issubset(self.v6) @classmethod def from_inheritance(cls): """ Build a resource bag that just inherits everything from its parent. """ self = cls() self.asn = resource_set_as() self.v4 = resource_set_ipv4() self.v6 = resource_set_ipv6() self.asn.inherit = True self.v4.inherit = True self.v6.inherit = True return self @classmethod def from_str(cls, text, allow_overlap = False): """ Parse a comma-separated text string into a resource_bag. Not particularly efficient, fix that if and when it becomes an issue. """ asns = [] v4s = [] v6s = [] for word in text.split(","): if "." in word: v4s.append(word) elif ":" in word: v6s.append(word) else: asns.append(word) return cls(asn = resource_set_as(",".join(asns), allow_overlap) if asns else None, v4 = resource_set_ipv4(",".join(v4s), allow_overlap) if v4s else None, v6 = resource_set_ipv6(",".join(v6s), allow_overlap) if v6s else None) @classmethod def from_POW_rfc3779(cls, resources): """ Build a resource_bag from data returned by rpki.POW.X509.getRFC3779(). The conversion to long for v4 and v6 is (intended to be) temporary: in the long run, we should be using rpki.POW.IPAddress rather than long here. """ asn = inherit_token if resources[0] == "inherit" else [resource_range_as( r[0], r[1]) for r in resources[0] or ()] v4 = inherit_token if resources[1] == "inherit" else [resource_range_ipv4(r[0], r[1]) for r in resources[1] or ()] v6 = inherit_token if resources[2] == "inherit" else [resource_range_ipv6(r[0], r[1]) for r in resources[2] or ()] return cls(resource_set_as(asn) if asn else None, resource_set_ipv4(v4) if v4 else None, resource_set_ipv6(v6) if v6 else None) def empty(self): """ True iff all resource sets in this bag are empty. """ return not self.asn and not self.v4 and not self.v6 def __nonzero__(self): return not self.empty() def __eq__(self, other): return self.asn == other.asn and \ self.v4 == other.v4 and \ self.v6 == other.v6 and \ self.valid_until == other.valid_until def __ne__(self, other): return not (self == other) def intersection(self, other): """ Compute intersection with another resource_bag. valid_until attribute (if any) inherits from self. """ return self.__class__(self.asn & other.asn, self.v4 & other.v4, self.v6 & other.v6, self.valid_until) __and__ = intersection def union(self, other): """ Compute union with another resource_bag. valid_until attribute (if any) inherits from self. """ return self.__class__(self.asn | other.asn, self.v4 | other.v4, self.v6 | other.v6, self.valid_until) __or__ = union def difference(self, other): """ Compute difference against another resource_bag. valid_until attribute (if any) inherits from self """ return self.__class__(self.asn - other.asn, self.v4 - other.v4, self.v6 - other.v6, self.valid_until) __sub__ = difference def symmetric_difference(self, other): """ Compute symmetric difference against another resource_bag. valid_until attribute (if any) inherits from self """ return self.__class__(self.asn ^ other.asn, self.v4 ^ other.v4, self.v6 ^ other.v6, self.valid_until) __xor__ = symmetric_difference def __str__(self): s = "" if self.asn: s += "ASN: %s" % self.asn if self.v4: if s: s += ", " s += "V4: %s" % self.v4 if self.v6: if s: s += ", " s += "V6: %s" % self.v6 return s # Sadly, there are enough differences between RFC 3779 and the data # structures in the latest proposed ROA format that we can't just use # the RFC 3779 code for ROAs. So we need a separate set of classes # that are similar in concept but different in detail, with conversion # functions. Such is life. I suppose it might be possible to do this # with multiple inheritance, but that's probably more bother than it's # worth. class roa_prefix(object): """ ROA prefix. This is similar to the resource_range_ip class, but differs in that it only represents prefixes, never ranges, and includes the maximum prefix length as an additional value. This is a virtual class, you probably don't want to use it directly. """ ## @var prefix # The prefix itself, an IP address with bits beyond the prefix # length zeroed. ## @var prefixlen # (Minimum) prefix length. ## @var max_prefixlen # Maxmimum prefix length. def __init__(self, prefix, prefixlen, max_prefixlen = None): """ Initialize a ROA prefix. max_prefixlen is optional and defaults to prefixlen. max_prefixlen must not be smaller than prefixlen. """ if max_prefixlen is None: max_prefixlen = prefixlen assert max_prefixlen >= prefixlen, "Bad max_prefixlen: %d must not be shorter than %d" % (max_prefixlen, prefixlen) self.prefix = prefix self.prefixlen = prefixlen self.max_prefixlen = max_prefixlen def __cmp__(self, other): """ Compare two ROA prefix objects. Comparision is based on prefix, prefixlen, and max_prefixlen, in that order. """ assert self.__class__ is other.__class__ return (cmp(self.prefix, other.prefix) or cmp(self.prefixlen, other.prefixlen) or cmp(self.max_prefixlen, other.max_prefixlen)) def __str__(self): """ Convert a ROA prefix to string format. """ if self.prefixlen == self.max_prefixlen: return str(self.prefix) + "/" + str(self.prefixlen) else: return str(self.prefix) + "/" + str(self.prefixlen) + "-" + str(self.max_prefixlen) def to_resource_range(self): """ Convert this ROA prefix to the equivilent resource_range_ip object. This is an irreversable transformation because it loses the max_prefixlen attribute, nothing we can do about that. """ return self.range_type.make_prefix(self.prefix, self.prefixlen) def min(self): """ Return lowest address covered by prefix. """ return self.prefix def max(self): """ Return highest address covered by prefix. """ return self.prefix | ((1 << (self.prefix.bits - self.prefixlen)) - 1) def to_POW_roa_tuple(self): """ Convert a resource_range_ip to rpki.POW.ROA.setPrefixes() format. """ return self.prefix, self.prefixlen, self.max_prefixlen @classmethod def parse_str(cls, x): """ Parse ROA prefix from text (eg, an XML attribute). """ r = re_prefix_with_maxlen.match(x) if r: return cls(rpki.POW.IPAddress(r.group(1)), int(r.group(2)), int(r.group(3))) r = re_prefix.match(x) if r: return cls(rpki.POW.IPAddress(r.group(1)), int(r.group(2))) raise rpki.exceptions.BadROAPrefix, 'Bad ROA prefix "%s"' % (x) class roa_prefix_ipv4(roa_prefix): """ IPv4 ROA prefix. """ ## @var range_type # Type of corresponding resource_range_ip. range_type = resource_range_ipv4 class roa_prefix_ipv6(roa_prefix): """ IPv6 ROA prefix. """ ## @var range_type # Type of corresponding resource_range_ip. range_type = resource_range_ipv6 class roa_prefix_set(list): """ Set of ROA prefixes, analogous to the resource_set_ip class. """ def __init__(self, ini = None): """ Initialize a ROA prefix set. """ list.__init__(self) if isinstance(ini, str) and len(ini): self.extend(self.parse_str(s) for s in ini.split(",")) elif isinstance(ini, (list, tuple)): self.extend(ini) else: assert ini is None or ini == "", "Unexpected initializer: %s" % str(ini) self.sort() def __str__(self): """ Convert a ROA prefix set to string format. """ return ",".join(str(x) for x in self) @classmethod def parse_str(cls, s): """ Parse ROA prefix from text (eg, an XML attribute). This method is a backwards compatability shim. """ return cls.prefix_type.parse_str(s) def to_resource_set(self): """ Convert a ROA prefix set to a resource set. This is an irreversable transformation. We have to compute a union here because ROA prefix sets can include overlaps, while RFC 3779 resource sets cannot. This is ugly, and there is almost certainly a more efficient way to do this, but start by getting the output right before worrying about making it fast or pretty. """ r = self.resource_set_type() s = self.resource_set_type() s.append(None) for p in self: s[0] = p.to_resource_range() r |= s return r @classmethod def from_sql(cls, sql, query, args = None): """ Create ROA prefix set from an SQL query. sql is an object that supports execute() and fetchall() methods like a DB API 2.0 cursor object. query is an SQL query that returns a sequence of (prefix, prefixlen, max_prefixlen) triples. """ sql.execute(query, args) return cls([cls.prefix_type(rpki.POW.IPAddress(x), int(y), int(z)) for (x, y, z) in sql.fetchall()]) @classmethod def from_django(cls, iterable): """ Create ROA prefix set from a Django query. iterable is something which returns (prefix, prefixlen, max_prefixlen) triples. """ return cls([cls.prefix_type(rpki.POW.IPAddress(x), int(y), int(z)) for (x, y, z) in iterable]) def to_POW_roa_tuple(self): """ Convert ROA prefix set to form used by rpki.POW.ROA.setPrefixes(). """ if self: return tuple(a.to_POW_roa_tuple() for a in self) else: return None class roa_prefix_set_ipv4(roa_prefix_set): """ Set of IPv4 ROA prefixes. """ ## @var prefix_type # Type of underlying roa_prefix. prefix_type = roa_prefix_ipv4 ## @var resource_set_type # Type of corresponding resource_set_ip class. resource_set_type = resource_set_ipv4 # Fix back link from resource_set to roa_prefix resource_set_ipv4.roa_prefix_set_type = roa_prefix_set_ipv4 class roa_prefix_set_ipv6(roa_prefix_set): """ Set of IPv6 ROA prefixes. """ ## @var prefix_type # Type of underlying roa_prefix. prefix_type = roa_prefix_ipv6 ## @var resource_set_type # Type of corresponding resource_set_ip class. resource_set_type = resource_set_ipv6 # Fix back link from resource_set to roa_prefix resource_set_ipv6.roa_prefix_set_type = roa_prefix_set_ipv6 class roa_prefix_bag(object): """ Container to simplify passing around the combination of an IPv4 ROA prefix set and an IPv6 ROA prefix set. """ ## @var v4 # Set of IPv4 prefixes. ## @var v6 # Set of IPv6 prefixes. def __init__(self, v4 = None, v6 = None): self.v4 = v4 or roa_prefix_set_ipv4() self.v6 = v6 or roa_prefix_set_ipv6() def __eq__(self, other): return self.v4 == other.v4 and self.v6 == other.v6 def __ne__(self, other): return not (self == other) # Test suite for set operations. if __name__ == "__main__": def testprefix(v): return " (%s)" % v.to_roa_prefix_set() if isinstance(v, resource_set_ip) else "" def test1(t, s1, s2): if isinstance(s1, str) and isinstance(s2, str): print "x: ", s1 print "y: ", s2 r1 = t(s1) r2 = t(s2) print "x: ", r1, testprefix(r1) print "y: ", r2, testprefix(r2) v1 = r1._comm(r2) v2 = r2._comm(r1) assert v1[0] == v2[1] and v1[1] == v2[0] and v1[2] == v2[2] for i in r1: assert i in r1 and i.min in r1 and i.max in r1 for i in r2: assert i in r2 and i.min in r2 and i.max in r2 for i in v1[0]: assert i in r1 and i not in r2 for i in v1[1]: assert i not in r1 and i in r2 for i in v1[2]: assert i in r1 and i in r2 v1 = r1 | r2 v2 = r2 | r1 assert v1 == v2 print "x|y:", v1, testprefix(v1) v1 = r1 - r2 v2 = r2 - r1 print "x-y:", v1, testprefix(v1) print "y-x:", v2, testprefix(v2) v1 = r1 ^ r2 v2 = r2 ^ r1 assert v1 == v2 print "x^y:", v1, testprefix(v1) v1 = r1 & r2 v2 = r2 & r1 assert v1 == v2 print "x&y:", v1, testprefix(v1) def test2(t, s1, s2): print "x: ", s1 print "y: ", s2 r1 = t(s1) r2 = t(s2) print "x: ", r1 print "y: ", r2 print "x>y:", (r1 > r2) print "xy:", (r1 > r2) print "x