Skip to content
Permalink
Browse files

New script to install an RPKI root key salvaged from an old rootd

installation on top of the active CADetail of a new-style rootd-less
rpkid configuration.

This has been tested, but only lightly, and only in the lab.

This script is dangerous.  Do not run it unless you really know what
you are doing, and even then you probably do not want to run it on
anything but a brand new installation with no existing RPKI data.

See #816.

svn path=/branches/tk705/; revision=6438
  • Loading branch information
sraustein committed May 25, 2016
1 parent d74fe6c commit 8725496e91cee1728787acd40ed7f920c7f9f29b
Showing with 157 additions and 0 deletions.
  1. +157 −0 potpourri/whack-rpki-root-key.py
@@ -0,0 +1,157 @@
#!/usr/bin/env python

# $Id$

# Copyright (C) 2016 Parsons Government Services ("PARSONS")
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notices and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND PARSONS DISCLAIMS ALL
# WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
# PARSONS BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
# CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
# OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
# NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
# WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

"""
Replace key in an rpkid root Parent object with a different key,
presumably salvaged from an old rootd configuration.
This does horrible things to the internal state of your rpkid
installation. Do not use it unless you understand exactly what
it does and know why running it is necessary.
YOU HAVE BEEN WARNED.
Not to be used without a doctor's prescription and a paid-up life
insurance policy.
"""

import os
import sys
import time
import argparse
import urlparse

import rpki.config
import rpki.x509
import rpki.resource_set

os.environ.update(TZ = "UTC")
time.tzset()

cfg = rpki.config.argparser(doc = __doc__)
cfg.argparser.add_argument("--simon-says-whack-my-rpki-root",
action = "store_true")
cfg.argparser.add_argument("-k", "--root-key",
type = lambda s: rpki.x509.RSA(Auto_file = s),
help = "root key to install")
cfg.argparser.add_argument("-b", "--backup",
help = "back up currently installed root key before whacking")
args = cfg.argparser.parse_args()

if not args.simon_says_whack_my_rpki_root:
sys.exit("You didn't say \"Simon says\"")

print "Loading rpkidb environment"
os.environ.update(DJANGO_SETTINGS_MODULE = "rpki.django_settings.rpkid")
import django
django.setup()
import rpki.rpkidb
from django.db.models import Q

# We expect to find exactly one root CADetail object.

print "Looking for rpkidb root CADetail"
ca_detail = rpki.rpkidb.models.CADetail.objects.get(
~Q(ca__parent__root_asn_resources = "")|
~Q(ca__parent__root_ipv4_resources = "")|
~Q(ca__parent__root_ipv6_resources = ""))

if args.backup:
print "Backing up installed root key to", args.backup
with os.fdopen(os.open(args.backup, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0700), "w") as f:
f.write(ca_detail.private_key_id.get_PEM())

print "Extracting data from old CADetail"
old_cer = ca_detail.latest_ca_cert
old_crl = ca_detail.latest_crl
old_mft = ca_detail.latest_manifest
old_uri = ca_detail.ca_cert_uri

old_mft.get_POW().extractWithoutVerifying()

mft_uri = old_cer.get_sia_manifest_uri()
crl_uri = os.path.splitext(mft_uri)[0] + ".crl"
mft_cer = rpki.x509.X509(POW = old_mft.get_POW().certs()[0])

gski = args.root_key.gSKI()

def fix_uri(uri):
return "{head}/{gski}{fn2}".format(
head = os.path.dirname(uri),
gski = gski,
fn2 = os.path.splitext(uri)[1])

new_uri = fix_uri(old_uri)

print "Generating new root certificate"
new_cer = rpki.x509.X509.self_certify(
keypair = args.root_key,
subject_key = args.root_key.get_public(),
serial = old_cer.getSerial(),
sia = (fix_uri(old_cer.get_sia_directory_uri()),
fix_uri(mft_uri), None, old_cer.get_sia_rrdp_notify()),
notBefore = old_cer.getNotBefore(),
notAfter = old_cer.getNotAfter(),
resources = old_cer.get_3779resources())

print "Generating new root CRL"
new_crl = rpki.x509.CRL.generate(
keypair = args.root_key,
issuer = new_cer,
serial = old_crl.getCRLNumber(),
thisUpdate = old_crl.getThisUpdate(),
nextUpdate = old_crl.getNextUpdate(),
revokedCertificates = ())

print "Generating new root manifest EE certificate"
mft_cer = new_cer.issue(
keypair = args.root_key,
subject_key = ca_detail.manifest_public_key,
serial = mft_cer.getSerial(),
sia = (None, None,
fix_uri(mft_cer.get_sia_object_uri()),
mft_cer.get_sia_rrdp_notify()),
resources = rpki.resource_set.resource_bag.from_inheritance(),
aia = new_uri,
crldp = fix_uri(crl_uri),
notBefore = mft_cer.getNotBefore(),
notAfter = mft_cer.getNotAfter(),
is_ca = False)

print "Generating new root manifest"
new_mft = rpki.x509.SignedManifest.build(
keypair = ca_detail.manifest_private_key_id,
certs = mft_cer,
serial = old_mft.get_POW().getManifestNumber(),
thisUpdate = old_mft.getThisUpdate(),
nextUpdate = old_mft.getNextUpdate(),
names_and_objs = [(gski + ".crl", new_crl)])

print "Updating CADetail"
ca_detail.public_key = args.root_key.get_public()
ca_detail.private_key_id = args.root_key
ca_detail.crl_published = None
ca_detail.manifest_published = None
ca_detail.ca_cert_uri = new_uri
ca_detail.latest_ca_cert = new_cer
ca_detail.latest_crl = new_crl
ca_detail.latest_manifest = new_mft

print "Saving updated CADetail"
ca_detail.save()

0 comments on commit 8725496

Please sign in to comment.
You can’t perform that action at this time.