uri

#!/usr/bin/env python
#
# $Id$
#
# Copyright (C) 2015-2016  Parsons Government Services ("PARSONS")
# Portions copyright (C) 2014  Dragon Research Labs ("DRL")
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notices and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND PARSONS AND DRL DISCLAIM ALL
# WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL
# PARSONS OR DRL BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
# CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
# OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

"""
Extract URIs from the SIA, AIA, and CRLDP extensions of one or more
X.509v3 certificates.

Input files must be in DER format and may be either X.509v3 certificates
or CMS objects which contain X.509v3 certificates in the CMS wrapper.
"""

import rpki.config
import rpki.POW

class Certificate(object):

    @staticmethod
    def first_whatever(uris, prefix):
        if uris is not None:
            for uri in uris:
                if uri.startswith(prefix):
                    return uri
        return None

    def first_rsync(self, uris):
        return self.first_whatever(uris, "rsync://")

    def first_https(self, uris):
        return self.first_whatever(uris, "https://")

    def first_http(self, uris):
        return self.first_whatever(uris, "http://")

    def __init__(self, fn):
        try:
            x = rpki.POW.X509.derReadFile(fn)
        except:
            try:
                cms = rpki.POW.CMS.derReadFile(fn)
                cms.extractWithoutVerifying()
                x = cms.certs()[0]
            except:
                raise ValueError
        sia = x.getSIA() or (None, None, None, None)
        self.fn = fn
        self.uris = (
            ("AIA:caIssuers",    self.first_rsync(x.getAIA())),
            ("SIA:caRepository", self.first_rsync(sia[0])),
            ("SIA:rpkiManifest", self.first_rsync(sia[1])),
            ("SIA:signedObject", self.first_rsync(sia[2])),
            ("SIA:rpkiNotify",   self.first_https(sia[3]) or self.first_http(sia[3])),
            ("CRLDP",            self.first_rsync(x.getCRLDP())))

    def __str__(self):
        words = [self.fn] if args.single_line else ["File: " + self.fn]
        words.extend(" %s: %s" % (tag, uri) for tag, uri in self.uris if uri is not None)
        return ("" if args.single_line else "\n").join(words)

cfg = rpki.config.argparser(doc = __doc__)
cfg.argparser.add_argument("-s", "--single-line", action = "store_true", help = "single output line per object")
cfg.argparser.add_argument("certs", nargs = "+", type = Certificate, help = "RPKI objects to examine")
args = cfg.argparser.parse_args()

for cert in args.certs:
    print cert