A tool for performing RPKI incantations
Project description
rpkimancer
rpkimancer /ɑː-piː-keɪ-aɪ-mænsə/
"One who may be called upon to perform those secret rites and incantations necessary for the creation or interpretation of the mystical artifacts of the RPKI."
About
A library and associated command line utility for quickly creating and reading arbitrary RPKI signed objects.
The primary motivation was to be able to construct new object types directly
from the ASN.1 EncapsulatedContentInfo
definition with minimal boilerplate
and zero custom encoding logic.
The base distribution comes with the necessary plumbing to read and write the currently standardised object types:
- Manifests (RFC6486)
- ROAs (RFC6482)
- Ghostbuster Records (RFC6493)
Additional signed objects can be supported via a plugin system.
This not an RP or a CA.
Minimal validation is done on object creation. This is intentional, since a valid use-case is to create almost valid objects to recreate RP bugs.
Similarly, the de-serialisation code contains no crypto validation at all.
Installation
Python version 3.8 or greater is required.
A package is available on PyPI. You can:
python3 -m pip install rpkimancer
Usage
The CLI tools (in the rpkimancer.cli
package) provide examples of library usage.
The rpkincant
CLI tool ships with two subcommands:
-
rpkincant conjure
:Creates a simple example repo with a TA and a single sub-ordinate CA.
All the CRLs and Manifests are generated, along with a ROA and a GBR issued by the CA. A TAL for the TA is also generated.
-
rpkimancer perceive
:Reads DER encoded signed objects from disk, and deserialises them based on the type indicated by the file extension.
The result is written to STDOUT by default, in a variety of selectable formats.
Writing Plugins
Plugins implementing new signed object types can advertise the required
components to rpkimancer
using the following entry points:
-
rpkimancer.asn1.modules
:A python package containing ASN.1 modules (which must be named
*.asn
) to be compiled to python code at run time.Each ASN.1 module will end up being available as a
class
inrpkimancer.asn1.mod
. -
rpkimancer.sigobj
:A
class
inheriting fromrpkimancer.sigobj.base.SignedObject
. TheSignedObject
class will usually only need to set theecontent_cls
attribute to a class inheriting fromrpkimancer.sigobj.base.EncapsulatedContent
.See the implementations in the
rpkimancer.sigobj
package for examples.The entry point is used to map file extensions to implementations by tools like
rpkincant perceive
. -
rpkimancer.cli
:Used to add additional subcommands to the
rpkincant
CLI tool.The target should be a
class
inheriting fromrpkimancer.cli.BaseCommand
, and implementing the.init_parser(...)
and.run(...)
methods. -
rpkimancer.cli.conjure
:Used to add CLI arguments and object construction code to the
rpkincant conjure
subcommand.The target should be a class inheriting from
rpkimancer.cli.conjure.ConjurePlugin
, and implementing the.init_parser(...)
and.run(...)
methods.
Contributing
Both feature contributions and bug fixes are very welcome.
Please open an issue for discussion before expending energy on an implementation.
Pre-standard RPKI object implementations will not be accepted into the main library. These should be implemented in a standalone plugin distribution while still in the I-D phase.
To set up a development environment:
python3 -m venv .venv
. .venv/bin/activate
python -m pip install packaging/requirements-dev.txt
And to run the tests and other CI jobs locally:
tox
MIT License
Copyright (c) 2021 Ben Maddison
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for rpkimancer-0.1.1-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 4feee91c99236c9028deaf530d6fef00e46e5771a0ba1d32e7bcd1d03d466326 |
|
MD5 | 9bed202ffedeb10d9a99a3da6fce75e0 |
|
BLAKE2b-256 | 63d7faec0e69bda2e2bba0d80232bb6b473c114331405ab53bccc99df00fb80d |