convert_server_keys.py 3.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116
  1. import psycopg2
  2. import yaml
  3. import sys
  4. import json
  5. import time
  6. import hashlib
  7. from syutil.base64util import encode_base64
  8. from syutil.crypto.signing_key import read_signing_keys
  9. from syutil.crypto.jsonsign import sign_json
  10. from syutil.jsonutil import encode_canonical_json
  11. def select_v1_keys(connection):
  12. cursor = connection.cursor()
  13. cursor.execute("SELECT server_name, key_id, verify_key FROM server_signature_keys")
  14. rows = cursor.fetchall()
  15. cursor.close()
  16. results = {}
  17. for server_name, key_id, verify_key in rows:
  18. results.setdefault(server_name, {})[key_id] = encode_base64(verify_key)
  19. return results
  20. def select_v1_certs(connection):
  21. cursor = connection.cursor()
  22. cursor.execute("SELECT server_name, tls_certificate FROM server_tls_certificates")
  23. rows = cursor.fetchall()
  24. cursor.close()
  25. results = {}
  26. for server_name, tls_certificate in rows:
  27. results[server_name] = tls_certificate
  28. return results
  29. def select_v2_json(connection):
  30. cursor = connection.cursor()
  31. cursor.execute("SELECT server_name, key_id, key_json FROM server_keys_json")
  32. rows = cursor.fetchall()
  33. cursor.close()
  34. results = {}
  35. for server_name, key_id, key_json in rows:
  36. results.setdefault(server_name, {})[key_id] = json.loads(str(key_json).decode("utf-8"))
  37. return results
  38. def convert_v1_to_v2(server_name, valid_until, keys, certificate):
  39. return {
  40. "old_verify_keys": {},
  41. "server_name": server_name,
  42. "verify_keys": {
  43. key_id: {"key": key}
  44. for key_id, key in keys.items()
  45. },
  46. "valid_until_ts": valid_until,
  47. "tls_fingerprints": [fingerprint(certificate)],
  48. }
  49. def fingerprint(certificate):
  50. finger = hashlib.sha256(certificate)
  51. return {"sha256": encode_base64(finger.digest())}
  52. def rows_v2(server, json):
  53. valid_until = json["valid_until_ts"]
  54. key_json = encode_canonical_json(json)
  55. for key_id in json["verify_keys"]:
  56. yield (server, key_id, "-", valid_until, valid_until, buffer(key_json))
  57. def main():
  58. config = yaml.load(open(sys.argv[1]))
  59. valid_until = int(time.time() / (3600 * 24)) * 1000 * 3600 * 24
  60. server_name = config["server_name"]
  61. signing_key = read_signing_keys(open(config["signing_key_path"]))[0]
  62. database = config["database"]
  63. assert database["name"] == "psycopg2", "Can only convert for postgresql"
  64. args = database["args"]
  65. args.pop("cp_max")
  66. args.pop("cp_min")
  67. connection = psycopg2.connect(**args)
  68. keys = select_v1_keys(connection)
  69. certificates = select_v1_certs(connection)
  70. json = select_v2_json(connection)
  71. result = {}
  72. for server in keys:
  73. if not server in json:
  74. v2_json = convert_v1_to_v2(
  75. server, valid_until, keys[server], certificates[server]
  76. )
  77. v2_json = sign_json(v2_json, server_name, signing_key)
  78. result[server] = v2_json
  79. yaml.safe_dump(result, sys.stdout, default_flow_style=False)
  80. rows = list(
  81. row for server, json in result.items()
  82. for row in rows_v2(server, json)
  83. )
  84. cursor = connection.cursor()
  85. cursor.executemany(
  86. "INSERT INTO server_keys_json ("
  87. " server_name, key_id, from_server,"
  88. " ts_added_ms, ts_valid_until_ms, key_json"
  89. ") VALUES (%s, %s, %s, %s, %s, %s)",
  90. rows
  91. )
  92. connection.commit()
  93. if __name__ == '__main__':
  94. main()