aboutsummaryrefslogtreecommitdiff
path: root/openssl/trunk/ssl/s3_meth.c
blob: 6a6eb1c58f80cbb8e1b9fda9ff8ad35c201047ba (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
/* ssl/s3_meth.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <stdio.h>
#include <openssl/objects.h>
#include "ssl_locl.h"

static SSL_METHOD *ssl3_get_method(int ver);
static SSL_METHOD *ssl3_get_method(int ver)
	{
	if (ver == SSL3_VERSION)
		return(SSLv3_method());
	else 
		return(NULL);
	}

IMPLEMENT_ssl3_meth_func(SSLv3_method,
			ssl3_accept,
			ssl3_connect,
			ssl3_get_method)
/span> getopt, sys, base64, urlparse import rpki.sundial, rpki.myrpki, rpki.config from lxml.etree import Element, SubElement, ElementTree section_regexp = re.compile("\s*\[\s*(.+?)\s*\]\s*$") variable_regexp = re.compile("\s*([-a-zA-Z0-9_]+)(\s*=\s*)(.+?)\s*$") cfg_file = "rpki.conf" template_file = os.path.join(os.path.dirname(sys.argv[0]), "examples", "rpki.conf") new_cfg_file = None preserve_valid_until = False opts, argv = getopt.getopt(sys.argv[1:], "c:hn:pt:?", ["config=", "new_config=", "preserve_valid_until", "template_config=", "help"]) for o, a in opts: if o in ("-h", "--help", "-?"): print __doc__ sys.exit(0) elif o in ("-c", "--config"): cfg_file = a elif o in ("-n", "--new_config"): new_cfg_file = a elif o in ("-p", "--preserve_valid_until"): preserve_valid_until = True elif o in ("-t", "--template_config"): template_file = a if argv: raise RuntimeError, "Unexpected arguments %r" % (argv,) if os.path.samefile(cfg_file, template_file): raise RuntimeError, "Old config and template for new config can't be the same file" if new_cfg_file is None: new_cfg_file = cfg_file + ".new" if os.path.exists(new_cfg_file): raise RuntimeError, "%s already exists, NOT overwriting" % new_cfg_file cfg = rpki.config.parser(cfg_file) # These have no counterparts in new config file, just read them from old repository_bpki_certificate = cfg.get(option = "repository_bpki_certificate", section = "myrpki") repository_handle = cfg.get(option = "repository_handle", section = "myrpki") parents_csv = cfg.get(option = "parents_csv", section = "myrpki", default = "parents.csv") children_csv = cfg.get(option = "children_csv", section = "myrpki", default = "children.csv") pubclients_csv = cfg.get(option = "pubclients_csv", section = "myrpki", default = "pubclients.csv") pubd_base = cfg.get(option = "pubd_base", section = "myirbe") # Here we need to construct values for the new config file from the # old one. Basic model here is to look at whatever variables need to # be set in the template (mostly just the [myrpki], I hope), pull # necessary data from old config file any way we can. Stuff that # didn't make the jump from old config file to new we can just ignore, # stuff that is automated via macro expansions in the new config file # should be ok without modification. r = {} if cfg.has_section("myrpki"): for i in ("handle", "roa_csv", "prefix_csv", "asn_csv", "xml_filename"): r["myrpki", i] = cfg.get(section = "myrpki", option = i) r["myrpki", "bpki_resources_directory"] = cfg.get(option = "bpki_directory", section = "myrpki") if cfg.has_section("myirbe"): r["myrpki", "bpki_servers_directory"] = cfg.get(option = "bpki_directory", section = "myirbe") r["myrpki", "run_rpkid"] = True r["myrpki", "run_pubd"] = cfg.getboolean(option = "want_pubd", section = "myirbe", default = False) r["myrpki", "run_rootd"] = cfg.getboolean(option = "want_rootd", section = "myirbe", default = False) else: for i in ("run_rpkid", "run_pubd", "run_rootd"): r["myrpki", i] = False if cfg.has_section("rpkid"): r["myrpki", "rpkid_server_host"] = cfg.get(option = "server-host", section = "rpkid") r["myrpki", "rpkid_server_port"] = cfg.get(option = "server-port", section = "rpkid") if cfg.has_section("irdbd"): u = urlparse.urlparse(cfg.get(option = "https-url", section = "irdbd")) r["myrpki", "irdbd_server_host"] = u.hostname or "localhost" r["myrpki", "irdbd_server_port"] = u.port or 443 if cfg.has_section("pubd"): r["myrpki", "pubd_server_host"] = cfg.get(option = "server-host", section = "pubd") r["myrpki", "pubd_server_port"] = cfg.get(option = "server-port", section = "pubd") r["myrpki", "publication_base_directory"] = cfg.get(option = "publication-base", section = "pubd") if cfg.has_section("rootd"): r["myrpki", "rootd_server_port"] = cfg.get(option = "server-port", section = "rootd") u = urlparse.urlparse(cfg.get(option = "rpki-base-uri", section = "rootd")) r["myrpki", "publication_rsync_server"] = u.netloc for i in ("rpkid", "irdbd", "pubd"): if cfg.has_section(i): for j in ("sql-database", "sql-username", "sql-password"): r[i, j] = cfg.get(section = i, option = j) f = open(new_cfg_file, "w") f.write("# Automatically converted from %s using %s as a template.\n\n" % (cfg_file, template_file)) section = None for line in open(template_file): m = section_regexp.match(line) if m: section = m.group(1) m = variable_regexp.match(line) if m: option, whitespace = m.group(1, 2) else: option = None if (section, option) in r: line = "%s%s%s\n" % (option, whitespace, r[section, option]) f.write(line) f.close() print "Wrote", new_cfg_file # Get all of these from the new config file; in theory we just set all # of them, but we want to use values matching new config in any case. newcfg = rpki.config.parser(new_cfg_file, "myrpki") handle = newcfg.get("handle") bpki_resources_directory = newcfg.get("bpki_resources_directory") bpki_servers_directory = newcfg.get("bpki_servers_directory") pubd_server_host = newcfg.get("pubd_server_host") pubd_server_port = newcfg.get("pubd_server_port") rpkid_server_host = newcfg.get("rpkid_server_host") rpkid_server_port = newcfg.get("rpkid_server_port") entitydb_dir = newcfg.get("entitydb_dir", "entitydb") bpki_resources_pemfile = bpki_resources_directory + "/ca.cer" bpki_servers_pemfile = bpki_servers_directory + "/ca.cer" def entitydb(*args): return os.path.join(entitydb_dir, *args) # Now convert the .csv files. It'd be nice to have XML validation # enabled for this, so try to turn it on ourselves if the magic # environment variable hasn't already been set. rng_file = os.path.join(os.path.dirname(sys.argv[0]), "myrpki.rng") if not os.getenv("MYRPKI_RNG") and os.path.exists(rng_file): os.putenv("MYRPKI_RNG", rng_file) for d in map(entitydb, ("children", "parents", "repositories", "pubclients")): if not os.path.exists(d): os.makedirs(d) one_year_from_now = str(rpki.sundial.now() + rpki.sundial.timedelta(days = 365)) if os.path.exists(children_csv): for child_handle, valid_until, child_resource_pemfile in rpki.myrpki.csv_reader(children_csv, columns = 3): try: e = Element("parent", valid_until = valid_until if preserve_valid_until else one_year_from_now, service_uri = "https://%s:%s/up-down/%s/%s" % (rpkid_server_host, rpkid_server_port, handle, child_handle), child_handle = child_handle, parent_handle = handle) rpki.myrpki.PEMElement(e, "bpki_resource_ta", bpki_resources_pemfile) rpki.myrpki.PEMElement(e, "bpki_server_ta", bpki_servers_pemfile) rpki.myrpki.PEMElement(e, "bpki_child_ta", child_resource_pemfile) rpki.myrpki.etree_write(e, entitydb("children", "%s.xml" % child_handle)) except IOError: pass if os.path.exists(parents_csv): for parent_handle, parent_service_uri, parent_cms_pemfile, parent_https_pemfile, parent_myhandle, parent_sia_base in rpki.myrpki.csv_reader(parents_csv, columns = 6): try: e = Element("parent", valid_until = one_year_from_now, service_uri = parent_service_uri, child_handle = parent_myhandle, parent_handle = parent_handle) rpki.myrpki.PEMElement(e, "bpki_resource_ta", parent_cms_pemfile) rpki.myrpki.PEMElement(e, "bpki_server_ta", parent_https_pemfile) rpki.myrpki.PEMElement(e, "bpki_child_ta", bpki_resources_pemfile) rpki.myrpki.etree_write(e, entitydb("parents", "%s.xml" % parent_handle)) client_handle = "/".join(parent_sia_base.rstrip("/").split("/")[3:]) assert client_handle.startswith(repository_handle) e = Element("repository", parent_handle = parent_handle, client_handle = client_handle, service_uri = "%s/client/%s" % (pubd_base.rstrip("/"), client_handle), sia_base = parent_sia_base, type = "confirmed") rpki.myrpki.PEMElement(e, "bpki_server_ta", repository_bpki_certificate) rpki.myrpki.PEMElement(e, "bpki_client_ta", bpki_resources_pemfile) SubElement(e, "contact_info").text = "Automatically generated by convert-csv.py" rpki.myrpki.etree_write(e, entitydb("repositories", "%s.xml" % parent_handle)) except IOError: pass if os.path.exists(pubclients_csv): for client_handle, client_resource_pemfile, client_sia_base in rpki.myrpki.csv_reader(pubclients_csv, columns = 3): try: parent_handle = client_handle.split("/")[-2] if "/" in client_handle else handle e = Element("repository", parent_handle = parent_handle, client_handle = client_handle, service_uri = "https://%s:%s/client/%s" % (pubd_server_host, pubd_server_port, client_handle), sia_base = client_sia_base, type = "confirmed") rpki.myrpki.PEMElement(e, "bpki_server_ta", bpki_servers_pemfile) rpki.myrpki.PEMElement(e, "bpki_client_ta", client_resource_pemfile) SubElement(e, "contact_info").text = "Automatically generated by convert-csv.py" rpki.myrpki.etree_write(e, entitydb("pubclients", "%s.xml" % client_handle.replace("/", "."))) except IOError: pass