1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
|
# $Id$
#
# Copyright (C) 2015--2016 Parsons Government Services ("PARSONS")
# Portions copyright (C) 2014 Dragon Research Labs ("DRL")
# Portions copyright (C) 2009--2013 Internet Systems Consortium ("ISC")
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notices and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND PARSONS, DRL, AND ISC DISCLAIM
# ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
# PARSONS, DRL, OR ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
# CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
# OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
"""
Command line configuration and control tool for rpkid et al.
Type "help" at the inernal prompt, or run the program with the --help option for
an overview of the available commands; type "help foo" for (more) detailed help
on the "foo" command.
"""
import os
import sys
import pwd
import time
import argparse
import rpki.config
import rpki.sundial
import rpki.log
import rpki.resource_set
import rpki.relaxng
import rpki.exceptions
import rpki.left_right
import rpki.x509
import rpki.version
from lxml.etree import SubElement
from rpki.cli import Cmd, parsecmd, cmdarg
module_doc = __doc__
class swap_uids(object):
"""
Context manager to wrap os.setreuid() calls safely.
"""
def __init__(self):
self.uid = os.getuid()
self.euid = os.geteuid()
def __enter__(self):
os.setreuid(self.euid, self.uid)
return self
def __exit__(self, _type, value, traceback):
os.setreuid(self.uid, self.euid)
return False
def open_swapped_uids(*open_args):
"""
Open a file with UIDs swapped for the duration of the open() call.
"""
with swap_uids():
return open(*open_args)
class main(Cmd):
prompt = "rpkic> "
completedefault = Cmd.filename_complete
# Top-level argparser, for stuff that one might want when starting
# up the interactive command loop. Not sure -i belongs here, but
# it's harmless so leave it here for the moment.
top_argparser = argparse.ArgumentParser(add_help = False)
top_argparser.add_argument("-c", "--config",
help = "override default location of configuration file")
top_argparser.add_argument("-i", "--identity", "--handle",
help = "set initial entity handdle")
top_argparser.add_argument("--profile",
help = "enable profiling, saving data to PROFILE")
# Argparser for non-interactive commands (no command loop).
full_argparser = argparse.ArgumentParser(parents = [top_argparser],
description = module_doc)
argsubparsers = full_argparser.add_subparsers(title = "Commands", metavar = "")
def __init__(self):
Cmd.__init__(self)
os.environ["TZ"] = "UTC"
time.tzset()
# Try parsing just the arguments that make sense if we're
# going to be running an interactive command loop. If that
# parses everything, we're interactive, otherwise, it's either
# a non-interactive command or a parse error, so we let the full
# parser sort that out for us.
args, argv = self.top_argparser.parse_known_args()
self.interactive = not argv
if not self.interactive:
args = self.full_argparser.parse_args()
self.cfg_file = args.config
self.handle = args.identity
if args.profile:
import cProfile
prof = cProfile.Profile()
try:
prof.runcall(self.main, args)
finally:
prof.dump_stats(args.profile)
print "Dumped profile data to %s" % args.profile
else:
self.main(args)
def main(self, args):
self.read_config()
if self.interactive:
self.cmdloop_with_history()
else:
args.func(self, args)
def read_history(self):
"""
UID-swapping wrapper for parent .read_history() method.
"""
with swap_uids():
Cmd.read_history(self)
def save_history(self):
"""
UID-swapping wrapper for parent .save_history() method.
"""
with swap_uids():
Cmd.save_history(self)
def read_config(self):
# pylint: disable=W0201,W0602,W0621
global rpki
try:
cfg = rpki.config.parser(set_filename = self.cfg_file, section = "myrpki")
cfg.configure_logging(
args = argparse.Namespace(
log_destination = "stderr",
log_level = "warning"),
ident = "rpkic")
cfg.set_global_flags()
except IOError, e:
sys.exit("%s: %s" % (e.strerror, e.filename))
self.histfile = cfg.get("history_file", os.path.expanduser("~/.rpkic_history"))
self.autosync = cfg.getboolean("autosync", True, section = "rpkic")
os.environ.update(DJANGO_SETTINGS_MODULE = "rpki.django_settings.irdb")
import django
django.setup()
import rpki.irdb
try:
rpki.irdb.models.ca_certificate_lifetime = rpki.sundial.timedelta.parse(
cfg.get("bpki_ca_certificate_lifetime", section = "rpkic"))
except rpki.config.ConfigParser.Error:
pass
try:
rpki.irdb.models.ee_certificate_lifetime = rpki.sundial.timedelta.parse(
cfg.get("bpki_ee_certificate_lifetime", section = "rpkic"))
except rpki.config.ConfigParser.Error:
pass
try:
rpki.irdb.models.crl_interval = rpki.sundial.timedelta.parse(
cfg.get("bpki_crl_interval", section = "rpkic"))
except rpki.config.ConfigParser.Error:
pass
self.zoo = rpki.irdb.Zookeeper(cfg = cfg, handle = self.handle, logstream = sys.stdout)
def do_help(self, arg):
"""
List available commands with "help" or detailed help with "help cmd".
"""
argv = arg.split()
if not argv:
#return self.full_argparser.print_help()
return self.print_topics(
self.doc_header,
sorted(set(name[3:] for name in self.get_names()
if name.startswith("do_")
and getattr(self, name).__doc__)),
15, 80)
try:
return getattr(self, "help_" + argv[0])()
except AttributeError:
pass
func = getattr(self, "do_" + argv[0], None)
try:
return func.argparser.print_help()
except AttributeError:
pass
try:
return self.stdout.write(func.__doc__ + "\n")
except AttributeError:
pass
self.stdout.write((self.nohelp + "\n") % arg)
def irdb_handle_complete(self, manager, text, line, begidx, endidx):
return [obj.handle for obj in manager.all() if obj.handle and obj.handle.startswith(text)]
@parsecmd(argsubparsers,
cmdarg("handle", help = "new handle"))
def do_select_identity(self, args):
"""
Select an identity handle for use with later commands.
"""
self.zoo.reset_identity(args.handle)
def complete_select_identity(self, *args):
return self.irdb_handle_complete(rpki.irdb.models.ResourceHolderCA.objects, *args)
@parsecmd(argsubparsers)
def do_initialize(self, args):
"""
Initialize an RPKI installation. DEPRECATED.
This command reads the configuration file, creates the BPKI and
EntityDB directories, generates the initial BPKI certificates, and
creates an XML file describing the resource-holding aspect of this
RPKI installation.
"""
r = self.zoo.initialize()
with swap_uids():
r.save("%s.identity.xml" % self.zoo.handle, sys.stdout)
self.zoo.write_bpki_files()
@parsecmd(argsubparsers,
cmdarg("handle", help = "handle of entity to create"))
def do_create_identity(self, args):
"""
Create a new resource-holding entity.
Returns XML file describing the new resource holder.
This command is idempotent: calling it for a resource holder which
already exists returns the existing identity.
"""
self.zoo.reset_identity(args.handle)
r = self.zoo.initialize_resource_bpki()
with swap_uids():
r.save("%s.identity.xml" % self.zoo.handle, sys.stdout)
@parsecmd(argsubparsers)
def do_initialize_server_bpki(self, args):
"""
Initialize server BPKI portion of an RPKI installation.
Reads server configuration from configuration file and creates the
server BPKI objects needed to start daemons.
"""
self.zoo.initialize_server_bpki()
self.zoo.write_bpki_files()
@parsecmd(argsubparsers)
def do_update_bpki(self, args):
"""
Update BPKI certificates. Assumes an existing RPKI installation.
Basic plan here is to reissue all BPKI certificates we can, right
now. In the long run we might want to be more clever about only
touching ones that need maintenance, but this will do for a start.
We also reissue CRLs for all CAs.
Most likely this should be run under cron.
"""
self.zoo.update_bpki()
self.zoo.write_bpki_files()
try:
self.zoo.synchronize_bpki()
except Exception, e:
print "Couldn't push updated BPKI material into daemons: %s" % e
@parsecmd(argsubparsers,
cmdarg("--child_handle", help = "override default handle for new child"),
cmdarg("--valid_until", help = "override default validity interval"),
cmdarg("child_xml", help = "XML file containing child's identity"))
def do_configure_child(self, args):
"""
Configure a new child of this RPKI entity.
This command extracts the child's data from an XML input file,
cross-certifies the child's resource-holding BPKI certificate, and
generates an XML output file describing the relationship between
the child and this parent, including this parent's BPKI data and
up-down protocol service URI.
"""
with open_swapped_uids(args.child_xml) as f:
r, child_handle = self.zoo.configure_child(f, args.child_handle, args.valid_until)
with swap_uids():
r.save("%s.%s.parent-response.xml" % (self.zoo.handle, child_handle), sys.stdout)
self.zoo.synchronize_ca()
@parsecmd(argsubparsers,
cmdarg("child_handle", help = "handle of child to delete"))
def do_delete_child(self, args):
"""
Delete a child of this RPKI entity.
"""
try:
self.zoo.delete_child(args.child_handle)
self.zoo.synchronize_ca()
except rpki.irdb.models.ResourceHolderCA.DoesNotExist:
print "No such resource holder \"%s\"" % self.zoo.handle
except rpki.irdb.models.Child.DoesNotExist:
print "No such child \"%s\"" % args.child_handle
def complete_delete_child(self, *args):
return self.irdb_handle_complete(self.zoo.resource_ca.children, *args)
@parsecmd(argsubparsers,
cmdarg("--parent_handle", help = "override default handle for new parent"),
cmdarg("parent_xml", help = "XML file containing parent's response"))
def do_configure_parent(self, args):
"""
Configure a new parent of this RPKI entity.
This command reads the parent's response XML, extracts the
parent's BPKI and service URI information, cross-certifies the
parent's BPKI data into this entity's BPKI, and checks for offers
or referrals of publication service. If a publication offer or
referral is present, we generate a request-for-service message to
that repository, in case the user wants to avail herself of the
referral or offer.
We do NOT attempt automatic synchronization with rpkid at the
completion of this command, because synchronization at this point
will usually fail due to the repository not being set up yet. If
you know what you are doing and for some reason really want to
synchronize here, run the synchronize command yourself.
"""
with open_swapped_uids(args.parent_xml) as f:
r, parent_handle = self.zoo.configure_parent(f, args.parent_handle)
with swap_uids():
r.save("%s.%s.repository-request.xml" % (self.zoo.handle, parent_handle), sys.stdout)
@parsecmd(argsubparsers,
cmdarg("parent_handle", help = "handle of parent to delete"))
def do_delete_parent(self, args):
"""
Delete a parent of this RPKI entity.
"""
try:
self.zoo.delete_parent(args.parent_handle)
self.zoo.synchronize_ca()
except rpki.irdb.models.ResourceHolderCA.DoesNotExist:
print "No such resource holder \"%s\"" % self.zoo.handle
except rpki.irdb.models.Parent.DoesNotExist:
print "No such parent \"%s\"" % args.parent_handle
def complete_delete_parent(self, *args):
return self.irdb_handle_complete(self.zoo.resource_ca.parents, *args)
@parsecmd(argsubparsers,
cmdarg("--resources", help = "restrict root to specified resources",
type = rpki.resource_set.resource_bag.from_str,
default = "0.0.0.0/0,::/0,0-4294967295"),
cmdarg("--root_handle", help = "override default handle for new root"))
def do_configure_root(self, args):
"""
Configure the current resource holding identity as a root.
Returns repository request XML file like configure_parent does.
"""
print "Generating root for resources {!s}".format(args.resources) # XXX
r = self.zoo.configure_root(args.root_handle, args.resources)
if r is not None:
with swap_uids():
r.save("%s.%s.repository-request.xml" % (self.zoo.handle, self.zoo.handle), sys.stdout)
self.zoo.write_bpki_files()
@parsecmd(argsubparsers)
def do_delete_root(self, args):
"""
Delete local RPKI root as parent of the current entity.
"""
raise NotImplementedError
@parsecmd(argsubparsers,
cmdarg("--root_handle", help = "override default handle"),
cmdarg("--output_file", help = "override default output filename"))
def do_extract_root_certificate(self, args):
"""
Extract self-signed RPKI certificate from a root object.
"""
cert, uris = self.zoo.extract_root_certificate_and_uris(args.root_handle)
if cert is None:
print "No certificate currently available"
else:
fn = args.output_file or (cert.gSKI() + ".cer")
with open_swapped_uids(fn, "wb") as f:
print "Writing", f.name
f.write(cert.get_DER())
@parsecmd(argsubparsers,
cmdarg("--root_handle", help = "override default handle"),
cmdarg("--output_file", help = "override default output filename"))
def do_extract_root_tal(self, args):
"""
Extract self-signed RPKI certificate from a root object.
"""
cert, uris = self.zoo.extract_root_certificate_and_uris(args.root_handle)
if cert is None:
print "No certificate currently available"
else:
fn = args.output_file or (cert.gSKI() + ".tal")
with open_swapped_uids(fn, "w") as f:
print "Writing", f.name
for uri in uris:
f.write(uri + "\n")
f.write("\n")
f.write(cert.getPublicKey().get_Base64())
@parsecmd(argsubparsers,
cmdarg("--flat", help = "use flat publication scheme", action = "store_true"),
cmdarg("--sia_base", help = "override SIA base value"),
cmdarg("client_xml", help = "XML file containing client request"))
def do_configure_publication_client(self, args):
"""
Configure publication server to know about a new client.
This command reads the client's request for service,
cross-certifies the client's BPKI data, and generates a response
message containing the repository's BPKI data and service URI.
"""
with open_swapped_uids(args.client_xml) as f:
r, client_handle = self.zoo.configure_publication_client(f, args.sia_base, args.flat)
with swap_uids():
r.save("%s.repository-response.xml" % client_handle.replace("/", "."), sys.stdout)
try:
self.zoo.synchronize_pubd()
except rpki.irdb.models.Repository.DoesNotExist:
pass
@parsecmd(argsubparsers,
cmdarg("client_handle", help = "handle of client to delete"))
def do_delete_publication_client(self, args):
"""
Delete a publication client of this RPKI entity.
"""
try:
self.zoo.delete_publication_client(args.client_handle)
self.zoo.synchronize_pubd()
except rpki.irdb.models.ResourceHolderCA.DoesNotExist:
print "No such resource holder \"%s\"" % self.zoo.handle
except rpki.irdb.models.Client.DoesNotExist:
print "No such client \"%s\"" % args.client_handle
def complete_delete_publication_client(self, *args):
return self.irdb_handle_complete(self.zoo.server_ca.clients, *args)
@parsecmd(argsubparsers,
cmdarg("--parent_handle", help = "override default parent handle"),
cmdarg("repository_xml", help = "XML file containing repository response"))
def do_configure_repository(self, args):
"""
Configure a publication repository for this RPKI entity.
This command reads the repository's response to this entity's
request for publication service, extracts and cross-certifies the
BPKI data and service URI, and links the repository data with the
corresponding parent data in our local database.
"""
with open_swapped_uids(args.repository_xml) as f:
self.zoo.configure_repository(f, args.parent_handle)
self.zoo.synchronize_ca()
@parsecmd(argsubparsers,
cmdarg("repository_handle", help = "handle of repository to delete"))
def do_delete_repository(self, args):
"""
Delete a repository of this RPKI entity.
"""
try:
self.zoo.delete_repository(args.repository_handle)
self.zoo.synchronize_ca()
except rpki.irdb.models.ResourceHolderCA.DoesNotExist:
print "No such resource holder \"%s\"" % self.zoo.handle
except rpki.irdb.models.Repository.DoesNotExist:
print "No such repository \"%s\"" % args.repository_handle
def complete_delete_repository(self, *args):
return self.irdb_handle_complete(self.zoo.resource_ca.repositories, *args)
@parsecmd(argsubparsers)
def do_delete_identity(self, args):
"""
Delete the current RPKI identity (rpkid <tenant/> object).
"""
try:
self.zoo.delete_tenant()
self.zoo.synchronize_deleted_ca()
except rpki.irdb.models.ResourceHolderCA.DoesNotExist:
print "No such resource holder \"%s\"" % self.zoo.handle
@parsecmd(argsubparsers,
cmdarg("--valid_until", help = "override default new validity interval"),
cmdarg("child_handle", help = "handle of child to renew"))
def do_renew_child(self, args):
"""
Update validity period for one child entity.
"""
self.zoo.renew_children(args.child_handle, args.valid_until)
self.zoo.synchronize_ca()
if self.autosync:
self.zoo.run_rpkid_now()
def complete_renew_child(self, *args):
return self.irdb_handle_complete(self.zoo.resource_ca.children, *args)
@parsecmd(argsubparsers,
cmdarg("--valid_until", help = "override default new validity interval"))
def do_renew_all_children(self, args):
"""
Update validity period for all child entities.
"""
self.zoo.renew_children(None, args.valid_until)
self.zoo.synchronize_ca()
if self.autosync:
self.zoo.run_rpkid_now()
@parsecmd(argsubparsers,
cmdarg("prefixes_csv", help = "CSV file listing prefixes"))
def do_load_prefixes(self, args):
"""
Load prefixes into IRDB from CSV file.
"""
with open_swapped_uids(args.prefixes_csv) as f:
self.zoo.load_prefixes(f, True)
if self.autosync:
self.zoo.run_rpkid_now()
@parsecmd(argsubparsers)
def do_show_child_resources(self, args):
"""
Show resources assigned to children.
"""
for child in self.zoo.resource_ca.children.all():
resources = child.resource_bag
print "Child:", child.handle
if resources.asn:
print " ASN:", resources.asn
if resources.v4:
print " IPv4:", resources.v4
if resources.v6:
print " IPv6:", resources.v6
@parsecmd(argsubparsers)
def do_show_roa_requests(self, args):
"""
Show ROA requests.
"""
for roa_request in self.zoo.resource_ca.roa_requests.all():
prefixes = roa_request.roa_prefix_bag
print "ASN: ", roa_request.asn
if prefixes.v4:
print " IPv4:", prefixes.v4
if prefixes.v6:
print " IPv6:", prefixes.v6
@parsecmd(argsubparsers)
def do_show_ghostbuster_requests(self, args):
"""
Show Ghostbuster requests.
"""
for ghostbuster_request in self.zoo.resource_ca.ghostbuster_requests.all():
print "Parent:", ghostbuster_request.parent or "*"
print ghostbuster_request.vcard
@parsecmd(argsubparsers)
def do_show_received_resources(self, args):
"""
Show resources received by this entity from its parent(s).
"""
q_msg = self.zoo.compose_left_right_query()
SubElement(q_msg, rpki.left_right.tag_list_received_resources, tenant_handle = self.zoo.handle)
for r_pdu in self.zoo.call_rpkid(q_msg):
print "Parent: ", r_pdu.get("parent_handle")
print " notBefore:", r_pdu.get("notBefore")
print " notAfter: ", r_pdu.get("notAfter")
print " URI: ", r_pdu.get("uri")
print " SIA URI: ", r_pdu.get("sia_uri")
print " AIA URI: ", r_pdu.get("aia_uri")
print " ASN: ", r_pdu.get("asn")
print " IPv4: ", r_pdu.get("ipv4")
print " IPv6: ", r_pdu.get("ipv6")
@parsecmd(argsubparsers)
def do_show_published_objects(self, args):
"""
Show published objects.
"""
q_msg = self.zoo.compose_left_right_query()
SubElement(q_msg, rpki.left_right.tag_list_published_objects, tenant_handle = self.zoo.handle)
for r_pdu in self.zoo.call_rpkid(q_msg):
uri = r_pdu.get("uri")
track = rpki.x509.uri_dispatch(uri)(Base64 = r_pdu.text).tracking_data(uri)
child_handle = r_pdu.get("child_handle")
if child_handle is None:
print track
else:
print track, child_handle
@parsecmd(argsubparsers)
def do_show_bpki(self, args):
"""
Show this entity's BPKI objects.
"""
print "Self: ", self.zoo.resource_ca.handle
print " notBefore:", self.zoo.resource_ca.certificate.getNotBefore()
print " notAfter: ", self.zoo.resource_ca.certificate.getNotAfter()
print " Subject: ", self.zoo.resource_ca.certificate.getSubject()
print " SKI: ", self.zoo.resource_ca.certificate.hSKI()
for bsc in self.zoo.resource_ca.bscs.all():
print "BSC: ", bsc.handle
print " notBefore:", bsc.certificate.getNotBefore()
print " notAfter: ", bsc.certificate.getNotAfter()
print " Subject: ", bsc.certificate.getSubject()
print " SKI: ", bsc.certificate.hSKI()
for parent in self.zoo.resource_ca.parents.all():
print "Parent: ", parent.handle
print " notBefore:", parent.certificate.getNotBefore()
print " notAfter: ", parent.certificate.getNotAfter()
print " Subject: ", parent.certificate.getSubject()
print " SKI: ", parent.certificate.hSKI()
print " URL: ", parent.service_uri
for child in self.zoo.resource_ca.children.all():
print "Child: ", child.handle
print " notBefore:", child.certificate.getNotBefore()
print " notAfter: ", child.certificate.getNotAfter()
print " Subject: ", child.certificate.getSubject()
print " SKI: ", child.certificate.hSKI()
for repository in self.zoo.resource_ca.repositories.all():
print "Repository: ", repository.handle
print " notBefore:", repository.certificate.getNotBefore()
print " notAfter: ", repository.certificate.getNotAfter()
print " Subject: ", repository.certificate.getSubject()
print " SKI: ", repository.certificate.hSKI()
print " URL: ", repository.service_uri
@parsecmd(argsubparsers,
cmdarg("asns_csv", help = "CSV file listing ASNs"))
def do_load_asns(self, args):
"""
Load ASNs into IRDB from CSV file.
"""
with open_swapped_uids(args.asns_csv) as f:
self.zoo.load_asns(f, True)
if self.autosync:
self.zoo.run_rpkid_now()
@parsecmd(argsubparsers,
cmdarg("roa_requests_csv", help = "CSV file listing ROA requests"))
def do_load_roa_requests(self, args):
"""
Load ROA requests into IRDB from CSV file.
"""
with open_swapped_uids(args.roa_requests_csv) as f:
self.zoo.load_roa_requests(f)
if self.autosync:
self.zoo.run_rpkid_now()
@parsecmd(argsubparsers,
cmdarg("ghostbuster_requests", help = "file listing Ghostbuster requests as a sequence of VCards"))
def do_load_ghostbuster_requests(self, args):
"""
Load Ghostbuster requests into IRDB from file.
"""
with open_swapped_uids(args.ghostbuster_requests) as f:
self.zoo.load_ghostbuster_requests(f)
if self.autosync:
self.zoo.run_rpkid_now()
@parsecmd(argsubparsers,
cmdarg("--valid_until", help = "override default validity interval"),
cmdarg("router_certificate_request_xml", help = "file containing XML router certificate request"))
def do_add_router_certificate_request(self, args):
"""
Load router certificate request(s) into IRDB from XML file.
"""
with open_swapped_uids(args.router_certificate_request_xml) as f:
self.zoo.add_router_certificate_request(f, args.valid_until)
if self.autosync:
self.zoo.run_rpkid_now()
@parsecmd(argsubparsers,
cmdarg("gski", help = "g(SKI) of router certificate request to delete"))
def do_delete_router_certificate_request(self, args):
"""
Delete a router certificate request from the IRDB.
"""
try:
self.zoo.delete_router_certificate_request(args.gski)
if self.autosync:
self.zoo.run_rpkid_now()
except rpki.irdb.models.ResourceHolderCA.DoesNotExist:
print "No such resource holder \"%s\"" % self.zoo.handle
except rpki.irdb.models.EECertificateRequest.DoesNotExist:
print "No certificate request matching g(SKI) \"%s\"" % args.gski
def complete_delete_router_certificate_request(self, text, line, begidx, endidx):
return [obj.gski for obj in self.zoo.resource_ca.ee_certificate_requests.all()
if obj.gski and obj.gski.startswith(text)]
@parsecmd(argsubparsers)
def do_show_router_certificate_requests(self, args):
"""
Show this entity's router certificate requests.
"""
for req in self.zoo.resource_ca.ee_certificate_requests.all():
print "%s %s %s %s" % (req.gski, req.valid_until, req.cn, req.sn)
# What about updates? Validity interval, change router-id, change
# ASNs. Not sure what this looks like yet, blunder ahead with the
# core code while mulling over the UI.
@parsecmd(argsubparsers)
def do_synchronize(self, args):
"""
Whack daemons to match IRDB.
This command may be replaced by implicit synchronization embedded
in of other commands, haven't decided yet.
"""
self.zoo.synchronize()
@parsecmd(argsubparsers)
def do_force_publication(self, args):
"""
Whack rpkid to force (re)publication of everything.
This is not usually necessary, as rpkid automatically publishes
changes it makes, but this command can be useful occasionally when
a fault or configuration error has left rpkid holding data which
it has not been able to publish.
"""
self.zoo.publish_world_now()
@parsecmd(argsubparsers)
def do_force_reissue(self, args):
"""
Whack rpkid to force reissuance of everything.
This is not usually necessary, as rpkid reissues automatically
objects automatically as needed, but this command can be useful
occasionally when a fault or configuration error has prevented
rpkid from reissuing when it should have.
"""
self.zoo.reissue()
@parsecmd(argsubparsers)
def do_force_run_now(self, args):
"""
Force rpkid to run periodic tasks for this Tenant immediately.
This is not usually necessary, as rpkid runs all of these
tasks on a regular schedule, but this command can be useful
occasionally when configuration change is taking a long time
to percolate through a series of parent/child exchanges.
"""
self.zoo.run_rpkid_now()
@parsecmd(argsubparsers)
def do_up_down_rekey(self, args):
"""
Initiate a "rekey" operation.
This tells rpkid to generate new keys for each certificate issued
to it via the up-down protocol.
Rekeying is the first stage of a key rollover operation. You will
need to follow it up later with a "revoke" operation to clean up
the old keys
"""
self.zoo.rekey()
@parsecmd(argsubparsers)
def do_up_down_revoke(self, args):
"""
Initiate a "revoke" operation.
This tells rpkid to clean up old keys formerly used by
certificates issued to it via the up-down protocol.
This is the cleanup stage of a key rollover operation.
"""
self.zoo.revoke()
@parsecmd(argsubparsers)
def do_revoke_forgotten(self, args):
"""
Initiate a "revoke_forgotten" operation.
This tells rpkid to ask its parent to revoke certificates for
which rpkid does not know the private keys.
This should never happen during ordinary operation, but can happen
if rpkid is misconfigured or its database has been damaged, so we
need a way to resynchronize rpkid with its parent in such cases.
We could do this automatically, but as we don't know the precise
cause of the failure we don't know if it's recoverable locally
(eg, from an SQL backup), so we require a manual trigger before
discarding possibly-useful certificates.
"""
self.zoo.revoke_forgotten()
@parsecmd(argsubparsers)
def do_clear_all_sql_cms_replay_protection(self, args):
"""
Tell rpkid and pubd to clear replay protection.
This clears the replay protection timestamps stored in SQL for all
entities known to rpkid and pubd. This is a fairly blunt
instrument, but as we don't expect this to be necessary except in
the case of gross misconfiguration, it should suffice
"""
self.zoo.clear_all_sql_cms_replay_protection()
@parsecmd(argsubparsers)
def do_version(self, args):
"""
Show current software version number.
"""
print rpki.version.VERSION
@parsecmd(argsubparsers)
def do_list_tenant_handles(self, args):
"""
List all <tenant/> handles in this rpkid instance.
"""
for ca in rpki.irdb.models.ResourceHolderCA.objects.all():
print ca.handle
|