benmaddison / rpkimancer

A tool for performing RPKI incantations

rpkimancer

rpkimancer /ɑː-piː-keɪ-aɪ-mænsə/

"One who may be called upon to perform those secret rites and incantations necessary for the creation or interpretation of the mystical artifacts of the RPKI."

About

A library and associated command line utility for quickly creating and reading arbitrary RPKI signed objects.

The primary motivation was to be able to construct new RPKI signed object types directly from an ASN.1 CONTENT-TYPE instance definition with minimal boilerplate and zero custom encoding logic.

The base distribution comes with the necessary plumbing to read and write the currently standardised object types:

• Manifests (RFC6486)
• ROAs (RFC6482)
• Ghostbuster Records (RFC6493)

Additional signed objects can be supported via a plug-in system.

This is not an RP or a CA.

Minimal validation is done on object creation. This is intentional, since a valid use-case is to create almost valid objects to recreate RP bugs.

Similarly, the de-serialisation code contains no crypto validation at all.

Installation

Python version 3.8 or greater is required.

A package is available on PyPI. You can:

python3 -m pip install rpkimancer

Usage

The CLI tools (in the rpkimancer.cli package) provide examples of library usage.

The rpkincant CLI tool ships with two subcommands:

• rpkincant conjure:

  Creates a simple example repo with a TA and a single sub-ordinate CA.

  All the CRLs and Manifests are generated, along with a ROA and a GBR issued by the CA. A TAL for the TA is also generated.

• rpkimancer perceive:

  Reads DER encoded signed objects from disk, and deserialises them based on the type indicated by the file extension.

  The result is written to STDOUT by default, in a variety of selectable formats.

Writing Plug-ins

Plug-ins implementing new signed object types can advertise the required components to rpkimancer using the following entry points:

• rpkimancer.asn1.modules:

  A python package containing ASN.1 modules (which must be named *.asn) to be compiled to python code at run time.

  Each ASN.1 module will end up being available as a class in rpkimancer.asn1.mod.

• rpkimancer.sigobj:

  A class inheriting from rpkimancer.sigobj.base.SignedObject. The SignedObject class will usually only need to set the econtent_cls attribute to a class inheriting from rpkimancer.sigobj.base.EncapsulatedContent.

  See the implementations in the rpkimancer.sigobj package for examples.

  The entry point is used to map file extensions to implementations by tools like rpkincant perceive.

• rpkimancer.cli:

  Used to add additional subcommands to the rpkincant CLI tool.

  The target should be a class inheriting from rpkimancer.cli.BaseCommand, and implementing the .init_parser(...) and .run(...) methods.

• rpkimancer.cli.conjure:

  Used to add CLI arguments and object construction code to the rpkincant conjure subcommand.

  The target should be a class inheriting from rpkimancer.cli.conjure.ConjurePlugin, and implementing the .init_parser(...) and .run(...) methods.

Contributing

Both feature contributions and bug fixes are very welcome.

Please open an issue for discussion before expending energy on an implementation.

Pre-standard RPKI object implementations will not be accepted into the main library. These should be implemented in a standalone plug-in distribution while still in the I-D phase.

To set up a development environment:

python3 -m venv .venv
. .venv/bin/activate
python -m pip install -r packaging/requirements-dev.txt

And to run the tests and other CI jobs locally:

tox

rpkimancer's Issues

update codecov-action to v2

Support for RFC3779 IP address ranges

Unpin `flake8` dependency

flake8 >= 5.0.0 breaks flake8-bandit plugin.
See tylerwince/flake8-bandit#33
Unpin once this issue is resolved

Add helper class for cli argument defaults

Built-in container types (e.g. list) call __repr__() on elements
when converted to str.

As a result, default values for multivalued options are shown using
repr rather than str in help output.

Add a list subclass with overridden __str__() to make this prettier.

Initial Update

The bot created this issue to inform you that pyup.io has been set up on this repo.
Once you have closed it, the bot will open pull requests for updates as soon as they are available.

Support for reading resource certificates from DER

A number of internal attributes on subclasses of cert.base.BaseResouceCertificate
are set during __init__(...), and cannot be recovered from the DER encoding of
the underlying X.509 certificate.

An alternate constructor, e.g. .from_der(cls, data: bytes) should allow the
construction of a new instance, with only RSA private key missing from the internal
data.

include signing-time in CMS signed objects

While trying to create a MVP for ASPA-version-1 I noticed that the sample objects produced by rpkimancer do not contain a singing time attribute. After @job's changed proposed in https://github.com/job/draft-sidrops-cms-signing-time these objects will no longer parse.

add AS range to default CA cert

Support for issuing BGPsec certificates

add WIP OIDs registry