From fe4fa5f0cb7457efa1afaefc28a91a1b14ac579e Mon Sep 17 00:00:00 2001 From: Likun Zhang Date: Fri, 18 Jun 2010 11:28:49 +0000 Subject: [PATCH] 1. Remove certificate file 'bindctl.pem'. 2. Add options -c(--certificate-chain) to bindctl. 3. Override class HTTPSConnection to support server certificate validation. git-svn-id: svn://bind10.isc.org/svn/bind10/branches/trac127@2167 e5f2f494-b856-4b98-b285-d166d9295462 --- src/bin/bindctl/Makefile.am | 13 ---------- src/bin/bindctl/bindcmd.py | 39 +++++++++++++++++++--------- src/bin/bindctl/bindctl-source.py.in | 20 ++++++-------- src/bin/bindctl/bindctl.pem | 36 ------------------------- 4 files changed, 35 insertions(+), 73 deletions(-) delete mode 100644 src/bin/bindctl/bindctl.pem diff --git a/src/bin/bindctl/Makefile.am b/src/bin/bindctl/Makefile.am index 4c9d0dbcfe..f4337535d7 100644 --- a/src/bin/bindctl/Makefile.am +++ b/src/bin/bindctl/Makefile.am @@ -9,8 +9,6 @@ python_PYTHON = __init__.py bindcmd.py cmdparse.py exception.py moduleinfo.py my pythondir = $(pyexecdir)/bindctl bindctldir = $(DESTDIR)$(pkgdatadir) -bindctl_DATA = bindctl.pem -EXTRA_DIST += bindctl.pem CLEANFILES = bindctl @@ -26,14 +24,3 @@ bindctl: bindctl-source.py -e "s|@@SYSCONFDIR@@|@sysconfdir@|" \ -e "s|@@LIBEXECDIR@@|$(pkglibexecdir)|" bindctl-source.py >$@ chmod a+x $@ - -if INSTALL_CONFIGURATIONS - -# TODO: permissions handled later -install-data-local: - $(mkinstalldirs) $(DESTDIR)/@sysconfdir@/@PACKAGE@ - if test ! -f $(DESTDIR)$(sysconfdir)/@PACKAGE@/bindctl.pem; then \ - $(INSTALL_DATA) $(srcdir)/bindctl.pem $(DESTDIR)$(sysconfdir)/@PACKAGE@/ ; \ - fi - -endif diff --git a/src/bin/bindctl/bindcmd.py b/src/bin/bindctl/bindcmd.py index 7c87d46d6b..dab8bfc8d9 100644 --- a/src/bin/bindctl/bindcmd.py +++ b/src/bin/bindctl/bindcmd.py @@ -58,10 +58,34 @@ Type \" help\" for help on the specific module. Type \" help\" for help on the specific command. \nAvailable module names: """ +class ValidatedHTTPSConnection(http.client.HTTPSConnection): + '''Overrides HTTPSConnection to support certification + validation. ''' + def __init__(self, host, ca_certs): + http.client.HTTPSConnection.__init__(self, host) + self.ca_certs = ca_certs + + def connect(self): + ''' Overrides the connect() so that we do + certificate validation. ''' + sock = socket.create_connection((self.host, self.port), + self.timeout) + if self._tunnel_host: + self.sock = sock + self._tunnel() + + req_cert = ssl.CERT_NONE + if self.ca_certs: + req_cert = ssl.CERT_REQUIRED + self.sock = ssl.wrap_socket(sock, self.key_file, + self.cert_file, + cert_reqs=req_cert, + ca_certs=self.ca_certs) + class BindCmdInterpreter(Cmd): """simple bindctl example.""" - def __init__(self, server_port = 'localhost:8080', pem_file = "bindctl.pem"): + def __init__(self, server_port = 'localhost:8080', pem_file = None): Cmd.__init__(self) self.location = "" self.prompt_end = '> ' @@ -70,19 +94,10 @@ class BindCmdInterpreter(Cmd): self.modules = OrderedDict() self.add_module_info(ModuleInfo("help", desc = "Get help for bindctl")) self.server_port = server_port - self.pem_file = pem_file - self._connect_to_cmd_ctrld() + self.conn = ValidatedHTTPSConnection(self.server_port, + ca_certs=pem_file) self.session_id = self._get_session_id() - def _connect_to_cmd_ctrld(self): - '''Connect to cmdctl in SSL context. ''' - try: - self.conn = http.client.HTTPSConnection(self.server_port, - cert_file=self.pem_file) - except Exception as e: - print(e, "can't connect to %s, please make sure cmd-ctrld is running" % - self.server_port) - def _get_session_id(self): '''Generate one session id for the connection. ''' rand = os.urandom(16) diff --git a/src/bin/bindctl/bindctl-source.py.in b/src/bin/bindctl/bindctl-source.py.in index bbe3b50273..f564ed50aa 100644 --- a/src/bin/bindctl/bindctl-source.py.in +++ b/src/bin/bindctl/bindctl-source.py.in @@ -97,13 +97,16 @@ def check_addr(option, opt_str, value, parser): def set_bindctl_options(parser): parser.add_option('-p', '--port', dest = 'port', type = 'int', - action = 'callback', callback=check_port, - default = '8080', help = 'port for cmdctl of bind10') + action = 'callback', callback=check_port, + default = '8080', help = 'port for cmdctl of bind10') parser.add_option('-a', '--address', dest = 'addr', type = 'string', - action = 'callback', callback=check_addr, - default = '127.0.0.1', help = 'IP address for cmdctl of bind10') + action = 'callback', callback=check_addr, + default = '127.0.0.1', help = 'IP address for cmdctl of bind10') + parser.add_option('-c', '--certificate-chain', dest = 'cert_chain', + type = 'string', action = 'store', + help = 'PEM formatted server certificate validation chain file') if __name__ == '__main__': try: @@ -111,14 +114,7 @@ if __name__ == '__main__': set_bindctl_options(parser) (options, args) = parser.parse_args() server_addr = options.addr + ':' + str(options.port) - # If B10_FROM_SOURCE is set in the environment, we use PEM file - # from a directory relative to that, otherwise we use the one - # installed on the system - if "B10_FROM_SOURCE" in os.environ: - SYSCONF_PATH = os.environ["B10_FROM_SOURCE"] + "/src/bin/bindctl" - else: - SYSCONF_PATH = "@@SYSCONFDIR@@/@PACKAGE@" - tool = BindCmdInterpreter(server_addr, pem_file = SYSCONF_PATH + "/bindctl.pem") + tool = BindCmdInterpreter(server_addr, pem_file=options.cert_chain) prepare_config_commands(tool) tool.run() except Exception as e: diff --git a/src/bin/bindctl/bindctl.pem b/src/bin/bindctl/bindctl.pem deleted file mode 100644 index a076da5c00..0000000000 --- a/src/bin/bindctl/bindctl.pem +++ /dev/null @@ -1,36 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIICXAIBAAKBgQDpICWxJGKMvUhLFPbf5n8ZWogqjYcQqqoHqHVRHYjyiey6FZdt -ZkY2s1gYh0G0NXtimlIgic+vEcFe7vdmyKntW7DYDaqAj0KrED7RKAj8324jNbSJ -HtLP4evvJep3vsoNtTvNuceQJ46vukxyxgg3DuC9kVqPuD8CZ1Rq4ATyiwIDAQAB -AoGBAOJlOtV+DUq6Y2Ou91VXRiU8GzKgAQP5iWgoe84Ljbxkn4XThBxVD2j94Fbp -u7AjpDCMx6cbzpoo9w6XqaGizAmAehIfTE3eFYs74N/FM09Wg2OSDyxMY0jgyECU -A4ukjlPwcGDbmgbmlY3i+FVHp+zCgtZEsMC1IAosMac1BoX5AkEA/lrXWaVtH8bo -mut3GBaXvubZMdaUr0BUd5a9q+tt4dQcKG1kFqgCNKhNhBIcpiMVcz+jGmOuopNA -8dnUGqv3FQJBAOqiJ54ZvOTWNDpJIe02wIXRxRmc1xhHFCqYP23KxBVrAcTYB19J -lesov/hEbnGLCbKS/naZJ1zrTImUPNRLqx8CQCzDtA7U7GWhTiKluioFH+O7IRKC -X1yQh80cPHlbT9VkzSfYSLssCmdWD35k6aHbntTPqFbmoD+AhveJjKi9BxkCQDwX -1c+/RcrSNcQr0N2hZUOgyztZGRnlsnuKTMyA3yGhK23P6mt0PEpjQG+Ej0jTVGOB -FF0pspQwy4R9C+tPif8CQH36NNlXBfVNmT7kDtyLmaE6pID0vY9duX56BJbU1R0x -SQ8/LcfJagk6gvp08OyYCPA+WZ7u/bas9R/nMTCLivc= ------END RSA PRIVATE KEY----- ------BEGIN CERTIFICATE----- -MIIDhzCCAvCgAwIBAgIJALwngNFik7ONMA0GCSqGSIb3DQEBBQUAMIGKMQswCQYD -VQQGEwJjbjEQMA4GA1UECBMHYmVpamluZzEQMA4GA1UEBxMHYmVpamluZzEOMAwG -A1UEChMFY25uaWMxDjAMBgNVBAsTBWNubmljMRMwEQYDVQQDEwp6aGFuZ2xpa3Vu -MSIwIAYJKoZIhvcNAQkBFhN6aGFuZ2xpa3VuQGNubmljLmNuMB4XDTEwMDEwNzEy -NDcxOFoXDTExMDEwNzEyNDcxOFowgYoxCzAJBgNVBAYTAmNuMRAwDgYDVQQIEwdi -ZWlqaW5nMRAwDgYDVQQHEwdiZWlqaW5nMQ4wDAYDVQQKEwVjbm5pYzEOMAwGA1UE -CxMFY25uaWMxEzARBgNVBAMTCnpoYW5nbGlrdW4xIjAgBgkqhkiG9w0BCQEWE3po -YW5nbGlrdW5AY25uaWMuY24wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOkg -JbEkYoy9SEsU9t/mfxlaiCqNhxCqqgeodVEdiPKJ7LoVl21mRjazWBiHQbQ1e2Ka -UiCJz68RwV7u92bIqe1bsNgNqoCPQqsQPtEoCPzfbiM1tIke0s/h6+8l6ne+yg21 -O825x5Anjq+6THLGCDcO4L2RWo+4PwJnVGrgBPKLAgMBAAGjgfIwge8wHQYDVR0O -BBYEFJKM/O0ViGlwtb3JEci/DLTO/7DaMIG/BgNVHSMEgbcwgbSAFJKM/O0ViGlw -tb3JEci/DLTO/7DaoYGQpIGNMIGKMQswCQYDVQQGEwJjbjEQMA4GA1UECBMHYmVp -amluZzEQMA4GA1UEBxMHYmVpamluZzEOMAwGA1UEChMFY25uaWMxDjAMBgNVBAsT -BWNubmljMRMwEQYDVQQDEwp6aGFuZ2xpa3VuMSIwIAYJKoZIhvcNAQkBFhN6aGFu -Z2xpa3VuQGNubmljLmNuggkAvCeA0WKTs40wDAYDVR0TBAUwAwEB/zANBgkqhkiG -9w0BAQUFAAOBgQBh5N6isMAQAFFD+pbfpppjQlO4vUNcEdzPdeuBFaf9CsX5ZdxV -jmn1ZuGm6kRzqUPwPSxvCIAY0wuSu1g7YREPAZ3XBVwcg6262iGOA6n7E+nv5PLz -EuZ1oUg+IfykUIoflKH6xZB4MyPL+EgkMT+i9BrngaXHXF8tEO30YppMiA== ------END CERTIFICATE-----