path: root/rp/rcynic/rcynicng

#!/usr/bin/env python

# $Id$

"""
Reimplementation of rcynic in Python.  Work in progress.

Well, OK, at the moment this doesn't even come close to being a
replacement for the C version of rcynic, must less adding the new
features that were the reason for bothering with all this.  Right now,
this is just a test framework for the new POW.c code to support Python
RP code.  Gotta start somewhere.
"""

import os
import sys
import time
import logging
import argparse
import subprocess

import tornado.gen
import tornado.locks
import tornado.ioloop
import tornado.queues
import tornado.process

import rpki.POW

from rpki.oids import id_kp_bgpsec_router

from lxml.etree import ElementTree, Element, SubElement, Comment

logger = logging.getLogger("rcynicng")

codes = rpki.POW.validation_status

class Generation(object):

    all = []

    def __init__(self, name, tree):
        self.name = name
        self.tree = tree
        self.all.append(self)
        self.pos = len(self.all)
        setattr(self.__class__, name, self)

    def __hash__(self):
        return hash(self.name)

    def __cmp__(self, other):
        return cmp(self.pos, 0 if other is None else other.pos)

    def __str__(self):
        return self.name


class Status(object):
    """
    Validation status database, like validation_status_t in rcynic:tos.

    rcynic:tos version of this data structure is stored as an AVL
    tree, because the OpenSSL STACK_OF() sort-and-bsearch turned out
    to be a very poor choice for the input data.  Remains to be seen
    whether we need to do something like that here too.
    """

    db = dict()

    def __init__(self, uri, generation):
        assert generation is None or isinstance(generation, Generation)
        self.uri = uri
        self._generation = generation
        self._timestamp = None
        self.status = set()

    def __str__(self):
        return "{my.timestamp} {my.uri} {status} {my.generation}".format(
            my = self, status = ",".join(str(s) for s in sorted(self.status)))

    @property
    def timestamp(self):
        return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(self._timestamp))

    @property
    def generation(self):
        return str(self._generation)

    @classmethod
    def update(cls, uri, generation):
        try:
            key  = (uri, generation)
            self = cls.db[key]
        except KeyError:
            self = cls.db[key] = cls(uri, generation)
        self._timestamp = time.time()
        return self.status

    @classmethod
    def add(cls, uri, generation, *codes):
        status = cls.update(uri, generation)
        for code in codes:
            status.add(code)


class X509(rpki.POW.X509):

    @classmethod
    def derReadURI(cls, uri, generation, cms = None):
        fn = uri_to_filename(uri, generation.tree)
        if not os.path.exists(fn):
            Status.add(uri, generation, codes.OBJECT_NOT_FOUND)
            return None
        if cms is None:
            with open(fn, "rb") as f:
                der = f.read()
        else:
            # XXX awful kludge to work around current lack of subclass
            # support in rpki.POW.CMS.certs().
            der = cms.certs()[0].derWrite()
        self = cls.derRead(der)
        self.uri = uri
        self.fn  = fn
        self.generation = generation
        self.sha256 = sha256(der) if cms is None else None
        self.bc    = self.getBasicConstraints()
        self.aki   = self.getAKI()
        self.ski   = self.getSKI()
        self.eku   = self.getEKU()
        self.aia   = self.getAIA()
        self.sia   = self.getSIA()
        self.crldp = self.getCRLDP()
        self.is_ca = self.bc is not None and self.bc[0]
        self.caDirectory, self.rpkiManifest, self.signedObjectRepository, self.rpkiNotify \
                          = self.sia or (None, None, None, None)
        return self

    @staticmethod
    def count_uris(uris, scheme = "rsync://"):
        count = 0
        if uris is not None:
            for uri in uris:
                if uri.startswith(scheme):
                    count += 1
        return count

    def check(self, trusted = None, crl = None):
        status = Status.update(self.uri, self.generation)
        is_ta = trusted is None
        is_routercert = (self.eku is not None and id_kp_bgpsec_router in self.eku and
                         not self.is_ca and self.uri.endswith(".cer"))
        if self.eku is not None and (self.is_ca or not self.uri.endswith(".cer")):
            status.add(codes.INAPPROPRIATE_EKU_EXTENSION)
        if is_ta and not self.is_ca:
            status.add(codes.MALFORMED_TRUST_ANCHOR)
        if is_ta and self.aia is not None:
            status.add(codes.AIA_EXTENSION_FORBIDDEN)
        if not is_ta and self.aia is None:
            status.add(codes.AIA_EXTENSION_MISSING)
        if is_routercert and self.sia is not None:
            status.add(codes.SIA_EXTENSION_FORBIDDEN)
        if not is_routercert and self.sia is None:
            status.add(codes.SIA_EXTENSION_MISSING)
        if is_ta and self.crldp is not None:
            status.add(codes.CRLDP_EXTENSION_FORBIDDEN)
        if not is_ta and self.crldp is None:
            status.add(codes.CRLDP_EXTENSION_MISSING)
        n_rsync_caIssuers              = self.count_uris(self.aia)
        n_rsync_caDirectory            = self.count_uris(self.caDirectory)
        n_rsync_rpkiManifest           = self.count_uris(self.rpkiManifest)
        n_rsync_signedObjectRepository = self.count_uris(self.signedObjectRepository)
        if n_rsync_caIssuers > 1 or n_rsync_caDirectory > 1 or n_rsync_rpkiManifest > 1 or n_rsync_signedObjectRepository > 1:
            status.add(codes.MULTIPLE_RSYNC_URIS_IN_EXTENSION)
        if self.aia is not None and n_rsync_caIssuers == 0:
            status.add(codes.MALFORMED_AIA_EXTENSION)
        if self.is_ca:
            ok = n_rsync_caDirectory != 0 and n_rsync_rpkiManifest != 0 and n_rsync_signedObjectRepository == 0
        elif not is_routercert:
            ok = n_rsync_caDirectory == 0 and n_rsync_rpkiManifest == 0 and n_rsync_signedObjectRepository != 0
        else:
            ok = self.sia is None
        if not ok:
            status.add(codes.MALFORMED_SIA_EXTENSION)
        if not is_ta and self.count_uris(self.crldp) == 0:
            status.add(codes.MALFORMED_CRLDP_EXTENSION)
        try:
            self.verify(trusted = [self] if trusted is None else trusted, crl = crl, status = status)
        except rpki.POW.ValidationError:
            status.add(codes.OBJECT_REJECTED)
        codes.normalize(status)
        return not any(s.kind == "bad" for s in status)


class CRL(rpki.POW.CRL):

    @classmethod
    def derReadURI(cls, uri, generation):
        fn = uri_to_filename(uri, generation.tree)
        if not os.path.exists(fn):
            Status.add(uri, generation, codes.OBJECT_NOT_FOUND)
            return None
        with open(fn, "rb") as f:
            der = f.read()
        self = cls.derRead(der)
        self.uri = uri
        self.fn  = fn
        self.generation = generation
        self.sha256     = sha256(der)
        self.aki        = self.getAKI()
        self.thisUpdate = self.getThisUpdate()
        self.nextUpdate = self.getNextUpdate()
        self.number     = self.getCRLNumber()
        return self

    def check(self, issuer):
        status = Status.update(self.uri, self.generation)
        try:
            self.verify(issuer, status)
        except rpki.POW.ValidationError:
            status.add(codes.OBJECT_REJECTED)
        codes.normalize(status)
        return not any(s.kind == "bad" for s in status)


class Ghostbuster(rpki.POW.CMS):

    @classmethod
    def derReadURI(cls, uri, generation):
        fn = uri_to_filename(uri, generation.tree)
        if not os.path.exists(fn):
            Status.add(uri, generation, codes.OBJECT_NOT_FOUND)
            return None
        with open(fn, "rb") as f:
            der = f.read()
        self = cls.derRead(der)
        self.uri = uri
        self.fn  = fn
        self.generation = generation
        self.sha256 = sha256(der)
        self.ee     = X509.derReadURI(uri, generation, self)
        self.vcard  = None
        return self

    def check(self, trusted = None, crl = None):
        status = Status.update(self.uri, self.generation)
        self.ee.check(trusted = trusted, crl = crl)
        try:
            self.vcard = self.verify()
        except rpki.POW.ValidationError:
            status.add(codes.OBJECT_REJECTED)
        codes.normalize(status)
        return not any(s.kind == "bad" for s in status)


class Manifest(rpki.POW.Manifest):

    @classmethod
    def derReadURI(cls, uri, generation):
        fn = uri_to_filename(uri, generation.tree)
        if not os.path.exists(fn):
            Status.add(uri, generation, codes.OBJECT_NOT_FOUND)
            return None
        with open(fn, "rb") as f:
            der = f.read()
        self = cls.derRead(der)
        self.uri = uri
        self.fn  = fn
        self.ee  = X509.derReadURI(uri, generation, self)
        self.fah = None
        self.generation = generation
        self.thisUpdate = None
        self.nextUpdate = None
        self.number     = None
        return self

    def check(self, trusted = None, crl = None):
        status = Status.update(self.uri, self.generation)
        self.ee.check(trusted = trusted, crl = crl)
        try:
            self.verify()
        except rpki.POW.ValidationError:
            status.add(codes.OBJECT_REJECTED)
        self.thisUpdate = self.getThisUpdate()
        self.nextUpdate = self.getNextUpdate()
        self.number     = self.getManifestNumber()
        self.fah        = self.getFiles()
        codes.normalize(status)
        return not any(s.kind == "bad" for s in status)

    def find_crl_uris(self):
        diruri = self.uri[:self.uri.rindex("/") + 1]
        for fn, digest in self.fah:
            if fn.endswith(".crl"):
                yield diruri + fn, digest


class ROA(rpki.POW.ROA):

    @classmethod
    def derReadURI(cls, uri, generation):
        fn = uri_to_filename(uri, generation.tree)
        if not os.path.exists(fn):
            Status.add(uri, generation, codes.OBJECT_NOT_FOUND)
            return None
        with open(fn, "rb") as f:
            der = f.read()
        self = cls.derRead(der)
        self.uri = uri
        self.fn  = fn
        self.generation = generation
        self.sha256     = sha256(der)
        self.ee         = X509.derReadURI(uri, generation, self)
        self.asn        = None
        self.prefixes   = None
        return self

    def check(self, trusted = None, crl = None):
        status = Status.update(self.uri, self.generation)
        self.ee.check(trusted = trusted, crl = crl)
        try:
            vcard = self.verify()
        except rpki.POW.ValidationError:
            status.add(codes.OBJECT_REJECTED)
        self.asn      = self.getASID()
        self.prefixes = self.getPrefixes()
        codes.normalize(status)
        return not any(s.kind == "bad" for s in status)


class  WalkFrame(object):
    """
    Certificate tree walk stack frame.  This is basically just a
    preamble and a loop, broken out into several separate methods so
    that we can fork new tasks in the middle then resume processing of
    the current state machine (ie, this frame) when appropriate (eg,
    after an rsync or RRDP fetch completes).
    """

    def __init__(self, cer):
        self.cer = cer
        self.state = self.initial

    @tornado.gen.coroutine
    def __call__(self, wsk):
        yield self.state(wsk)

    @tornado.gen.coroutine
    def initial(self, wsk):
        self.diruri = first_rsync_uri(self.cer.caDirectory)

        fetch = Fetcher(self.diruri)

        if fetch.needed():

            # This is where we'd fork another wsk task so we can keep
            # busy while rsync is running.  Defer that until linear
            # version is working, so for now just wait for rsync.

            yield fetch.fetch()

        self.state = self.ready

    @tornado.gen.coroutine
    def ready(self, wsk):
        self.trusted = wsk.trusted()

        mft_uri = first_rsync_uri(self.cer.rpkiManifest)

        crl_candidates = []

        # NB: CRL checks on manifest EE certificates deferred until we've picked a CRL.

        self.current_mft = Manifest.derReadURI(mft_uri, Generation.current)
        if self.current_mft is not None and self.current_mft.check(trusted = self.trusted):
            crl_candidates.extend(self.current_mft.find_crl_uris())
        else:
            self.current_mft = None

        self.backup_mft  = Manifest.derReadURI(mft_uri, Generation.backup)
        if self.backup_mft is not None and self.backup_mft.check(trusted = self.trusted):
            crl_candidates.extend(self.backup_mft.find_crl_uris())
        else:
            self.backup_mft = None

        if self.current_mft is None and self.backup_mft is None:
            wsk.pop()
            return

        crls = {}
        for uri, digest in crl_candidates:
            for generation in (Generation.current, Generation.backup):
                key = (uri, generation)
                if key not in crls:
                    crls[key] = CRL.derReadURI(uri, generation)

        self.crl = None
        for uri, digest in crl_candidates:
            for generation in (Generation.current, Generation.backup):
                crl = crls[uri, generation]
                if crl is None or crl == self.crl:
                    continue
                if crl.sha256 != digest:
                    Status.add(uri, generation, codes.DIGEST_MISMATCH)
                    continue
                if not crl.check(self.trusted[0]) or (self.crl is not None and crl.number < self.crl.number):
                    continue
                if self.crl is None or crl.number > self.crl.number or crl.thisUpdate > self.crl.thisUpdate:
                    self.crl = crl

        if self.crl is None:
            wsk.pop()
            return

        #logger.debug("Picked %s CRL %s", self.crl.generation, self.crl.uri)

        if self.current_mft is not None and self.crl.isRevoked(self.current_mft.ee):
            Status.add(self.current_mft.uri, self.current_mft.generation, codes.MANIFEST_EE_REVOKED)
            self.current_mft = None

        if self.backup_mft is not None and self.crl.isRevoked(self.backup_mft.ee):
            Status.add(self.backup_mft.uri, self.backup_mft.generation, codes.MANIFEST_EE_REVOKED)
            self.backup_mft = None

        if self.current_mft is None and self.backup_mft is None:
            wsk.pop()
            return

        # Use an explicit iterator so we can resume it later.
        # Run the loop in a separate method for the same reason.

        assert self.current_mft is not None or self.backup_mft is not None

        if self.current_mft is not None:
            self.mft_iterator = iter(self.current_mft.getFiles())
            self.generation   = Generation.current
        else:
            self.mft_iterator = iter(self.backup_mft.getFiles())
            self.generation   = Generation.backup

        self.state = self.loop

    @tornado.gen.coroutine
    def loop(self, wsk):

        #logger.debug("Processing %s %s", self.generation.name, (self.current_mft or self.backup_mft).uri)

        counter = 0
        counter_max_before_yield = 50

        for fn, digest in self.mft_iterator:

            counter += 1
            if counter > counter_max_before_yield:
                yield tornado.gen.moment
                counter = 0

            uri = self.diruri + fn

            if uri == self.crl.uri:
                continue

            if fn.endswith(".roa"):
                roa = ROA.derReadURI(uri, self.generation)
                roa.check()             # XXX Do something with result
                continue

            if fn.endswith(".gbr"):
                gbr = Ghostbuster.derReadURI(uri, self.generation)
                gbr.check()             # XXX Do something with result
                continue

            if fn.endswith(".cer"):
                cer = X509.derReadURI(uri, self.generation)
                cer.check()             # XXX Do something with result
                if cer.is_ca:
                    wsk.push(cer)

                    # XXX Temporary: Need to integrate with FSM
                    # looping, rsync fetching, etc -- this is just a
                    # hack to preserve old walk_tree() behavior
                    # temporarily for testing.

                    return

                continue

            Status.add(uri, self.generation, codes.UNKNOWN_OBJECT_TYPE_SKIPPED)

        if self.generation is Generation.current and self.backup_mft is not None:
            self.mft_iterator = iter(self.backup_mft.getFiles())
            self.generation   = Generation.backup
        else:
            wsk.pop()


class WalkTask(object):
    """
    Task corresponding to one walk stack, roughly analgous to
    STACK_OF(walk_ctx_t) in rcynic:tos.
    """

    def __init__(self, wsk = None):
        self.wsk = [] if wsk is None else wsk

    @tornado.gen.coroutine
    def __call__(self):
        while self.wsk:
            yield self.wsk[-1](wsk = self)

    def push(self, cer):
        self.wsk.append(WalkFrame(cer))

    def pop(self):
        return self.wsk.pop()

    def clone(self):
        return WalkTask(wsk = list(self.wsk))

    def trusted(self):
        stack = [w.cer for w in self.wsk]
        stack.reverse()
        return stack



# Probably do need some analogue of the rsync_history database, for
# tracking down hosts, URIs already fetched, and (perhaps) limiting
# simultaneous connection attempts to a single host.


task_queue = tornado.queues.Queue()


def parse_arguments():

    def check_dir(s):
        if not os.path.isdir(s):
            raise argparse.ArgumentTypeError("%r is not a directory" % s)
        return s

    def posint(s):
        i = int(s)
        if i <= 0:
            raise argparse.ArgumentTypeError("%r is not a positive integer " % s)
        return i

    parser = argparse.ArgumentParser(description = __doc__)
    parser.add_argument("--unauthenticated",   type = check_dir, default = "rcynic-data/unauthenticated")
    parser.add_argument("--old-authenticated", type = check_dir, default = "rcynic-data/authenticated.old")
    parser.add_argument("--tals",              type = check_dir, default = "sample-trust-anchors")
    parser.add_argument("--output",                              default = "rcynic-data/rcynicng-output")
    parser.add_argument("--workers",           type = posint,    default = 10)
    parser.add_argument("--no-fetch",                            action  = "store_true")
    parser.add_argument("--xml-file", type = argparse.FileType("w"), default = "rcynicng.xml")
    return parser.parse_args()


def read_tals():
    for root, dirs, files in os.walk(args.tals):
        for fn in files:
            if fn.endswith(".tal"):
                furi = "file://" + os.path.abspath(os.path.join(root, fn))
                try:
                    with open(os.path.join(root, fn), "r") as f:
                        lines = f.readlines()
                    uri = lines.pop(0).strip()
                    b64 = "".join(lines[lines.index("\n"):])
                    key = rpki.POW.Asymmetric.derReadPublic(b64.decode("base64"))
                    if not uri.endswith(".cer"):
                        Status.add(furi, None, codes.MALFORMED_TAL_URI)
                    yield uri, key
                except:
                    Status.add(furi, None, codes.UNREADABLE_TRUST_ANCHOR_LOCATOR)


def uri_to_filename(uri, base = None):
    fn = uri[uri.index("://")+3:]
    if base is not None:
        fn = os.path.join(base, fn)
    return fn

def first_uri(uris, scheme):
    if uris is not None:
        for uri in uris:
            if uri.startswith(scheme):
                return uri
    return None

def first_rsync_uri(uris):
    return first_uri(uris, "rsync://")

def sha256(bytes):
    d = rpki.POW.Digest(rpki.POW.SHA256_DIGEST)
    d.update(bytes)
    return d.digest()


class Fetcher(object):
    """
    Network transfer methods and history database.

    At the moment this is rsync-only; eventually it will include
    support for HTTPS and RRDP.
    """

    # Internal protocol:
    #
    # - Instances which have just gotten to the query stage are not registered
    #
    # - Instances which are in progress are listed in .history and
    #   have a Condition object in .pending; instances which depend on
    #   this should wait for the condition, then return.
    #
    # - Instances which have completed are listed in .history and have
    # .pending set to None.

    _rsync_deadhosts = set()
    _rsync_history = dict()

    def __init__(self, uri):
        self.uri = uri
        self.pending = None
        self.status = None
        self.runtime = None

    def _rsync_split_uri(self):
        return tuple(self.uri.rstrip("/").split("/")[2:])

    def _rsync_find(self, path):
        for i in xrange(1, len(path)):
            target = path[:i+1]
            try:
                return self._rsync_history[target]
            except KeyError:
                continue
        return None

    def needed(self):
        if args.no_fetch:
            return False
        if self.uri.startswith("rsync://"):
            return self._rsync_needed()
        raise ValueError

    def _rsync_needed(self):
        path = self._rsync_split_uri()
        if path[0] in self._rsync_deadhosts:
            return False
        entry = self._rsync_find(path)
        return entry is None or entry.pending is not None

    def fetch(self):
        if self.uri.startswith("rsync://"):
            return self._rsync_fetch()
        raise ValueError

    @tornado.gen.coroutine
    def _rsync_fetch(self):
        assert self.uri.startswith("rsync://") and (self.uri.endswith(".cer") or self.uri.endswith("/"))

        if args.no_fetch:
            return
        path = self._rsync_split_uri()
        dead = path[0] in self._rsync_deadhosts
        other = self._rsync_find(path)
        if not dead and other is not None and other.pending is not None:
            yield other.pending.wait()
        if dead or other is not None:
            return

        self.pending = tornado.locks.Condition()
        self._rsync_history[path] = self

        try:
            cmd = ["rsync", "--update", "--times", "--copy-links", "--itemize-changes"]
            if self.uri.endswith("/"):
                cmd.append("--recursive")
                cmd.append("--delete")
            cmd.append(self.uri)
            cmd.append(uri_to_filename(self.uri, args.unauthenticated))

            dn = os.path.dirname(cmd[-1])
            if not os.path.exists(dn):
                os.makedirs(dn)

            # We use the stdout close from rsync to detect when the  subprocess has finished.
            # There's a lovely tornado.process.Subprocess.wait_for_exit() method which does
            # exactly what one would think we'd want -- but Unix signal handling still hasn't
            # caught up to the software interrupt architecture ITS had forty years ago, so
            # signals still cause random "system call interrupted" failures in other libraries.
            # Nothing Tornado can do about this, so we avoid signals entirely and collect the
            # process exit status directly from the operating system.  In theory, the WNOHANG
            # isn't necessary here, we use it anyway to be safe in case theory is wrong.

            t0 = time.time()
            rsync = tornado.process.Subprocess(cmd, stdout = tornado.process.Subprocess.STREAM, stderr = subprocess.STDOUT)
            logger.debug("rsync[%s] started \"%s\"", rsync.pid, " ".join(cmd))
            output = yield rsync.stdout.read_until_close()
            pid, self.status = os.waitpid(rsync.pid, os.WNOHANG)
            t1 = time.time()
            self.runtime = t1 - t0
            if (pid, self.status) == (0, 0):
                logger.warn("rsync[%s] Couldn't get real exit status without blocking, sorry", rsync.pid)
            for line in output.splitlines():
                logger.debug("rsync[%s] %s", rsync.pid, line)
            logger.debug("rsync[%s] finished after %s seconds with status 0x%x", rsync.pid, self.runtime, self.status)

            # Should do something with rsync result and validation status database here.

        finally:
            pending = self.pending
            self.pending = None
            pending.notify_all()


class CheckTALTask(object):

    def __init__(self, uri, key):
        self.uri = uri
        self.key = key

    def __repr__(self):
        return "<CheckTALTask: \"{}\">".format(self.uri)

    @tornado.gen.coroutine
    def __call__(self):
        yield Fetcher(self.uri).fetch()
        for generation in (Generation.current, Generation.backup):
            if (yield self.check(generation)):
                logger.debug("Starting walk of %s", self.uri)
                wsk = WalkTask()
                wsk.push(self.cer)
                task_queue.put(wsk)
                return
        else:
            Status.add(self.uri, None, codes.TRUST_ANCHOR_SKIPPED)

    @tornado.gen.coroutine
    def check(self, generation):
        status = Status.update(self.uri, generation)
        self.cer = X509.derReadURI(self.uri, generation)
        ok = False
        if self.cer is None:
            status.add(codes.UNREADABLE_TRUST_ANCHOR)
            status.add(codes.OBJECT_REJECTED)
        elif self.key.derWritePublic() != self.cer.getPublicKey().derWritePublic():
            status.add(codes.TRUST_ANCHOR_KEY_MISMATCH)
            status.add(codes.OBJECT_REJECTED)
        elif not self.cer.check():
            status.add(codes.OBJECT_REJECTED)
        else:
            ok = True
        raise tornado.gen.Return(ok)


@tornado.gen.coroutine
def worker(meself):
    #
    # NB: This particular style of control loop REQUIRES an except
    #     clause, even if that except clause is just a pass statement.
    #
    while True:
        task = yield task_queue.get()
        try:
            #logger.debug("Worker %s starting %s", meself, task)
            yield task()
        except:
            logger.exception("Worker %s caught unhandled exception from %s", meself, task)
        finally:
            task_queue.task_done()
            #logger.debug("Worker %s finished %s", meself, task)


@tornado.gen.coroutine
def main():
    for i in xrange(args.workers):
        tornado.ioloop.IOLoop.current().spawn_callback(worker, i)
    yield [task_queue.put(CheckTALTask(uri, key)) for uri, key in read_tals()]
    yield task_queue.join()


def final_report():
    # Should be doing something to generate rcynic.xml here.

    if True:
        # rcynic-version = "", summary-version="", reporting-hostname=""
        doc = Element("rcynic-summary")
        labels = SubElement(doc, "labels")
        for code in codes.all():
            SubElement(labels, code.name).text = code.text
        for uri in Status.db:
            status = Status.db[uri]
            ts  = str(status.timestamp)
            gen = str(status.generation)
            uri = status.uri
            for sym in sorted(status.status):
                SubElement(doc, "validation_status", timestamp = ts, status = str(sym), generation = gen).text = uri
        #
        # Should generate <rsync_history/> elements here too, later
        #
        ElementTree(doc).write(file = args.xml_file, pretty_print = True)
    elif False:
        for uri in sorted(Status.db):
            print Status.db[uri]
    else:
        print "{} entries in status database".format(len(Status.db))

os.putenv("TZ", "UTC")
time.tzset()

args = parse_arguments()

Generation("current", args.unauthenticated)
Generation("backup",  args.old_authenticated)

# Put this under config/argparse control later, for now I want to see everything
logging.getLogger().setLevel(logging.DEBUG)

tornado.ioloop.IOLoop.current().run_sync(main)

final_report()