X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=cadi%2Faaf%2Fsrc%2Fmain%2Fjava%2Forg%2Fonap%2Faaf%2Fcadi%2Fconfigure%2FAgent.java;h=74f0916d3239edab07e5ccc0d2ae9aabcfdb506c;hb=be1edcb6830745015f5de72e820f40f36dd571ad;hp=7d149fcad54b8484f8238e32cde0ec4f86e6c154;hpb=988fd491d52a9074fe75ebe86e024c6889a46cc3;p=aaf%2Fauthz.git diff --git a/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/Agent.java b/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/Agent.java index 7d149fca..74f0916d 100644 --- a/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/Agent.java +++ b/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/Agent.java @@ -7,9 +7,9 @@ * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * + * * http://www.apache.org/licenses/LICENSE-2.0 - * + * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -28,7 +28,6 @@ import java.io.IOException; import java.net.ConnectException; import java.net.HttpURLConnection; import java.net.InetAddress; -import java.net.URISyntaxException; import java.net.UnknownHostException; import java.nio.file.Files; import java.security.KeyPair; @@ -94,11 +93,11 @@ public class Agent { public static final String PKCS12 = "pkcs12"; public static final String JKS = "jks"; private static final String SCRIPT="script"; - + private static final String CM_VER = "1.0"; public static final int PASS_SIZE = 24; private static int TIMEOUT; - + private static RosettaDF reqDF; private static RosettaDF certDF; private static RosettaDF artifactsDF; @@ -107,10 +106,10 @@ public class Agent { private static ErrMessage errMsg; private static Map placeArtifact; private static RosettaEnv env; - + private static boolean doExit; private static AAFCon aafcon; - + private static List CRED_TAGS = Arrays.asList(new String[] { Config.CADI_KEYFILE, Config.AAF_APPID, Config.AAF_APPPASS, @@ -149,8 +148,8 @@ public class Agent { } else { try { AAFSSO aafsso=null; - PropAccess access=null; - + PropAccess access=null; + String hasEtc = null; for(String a : args) { if(a.startsWith(Config.CADI_PROP_FILES)) { @@ -165,7 +164,7 @@ public class Agent { configNoPasswd=true; } } - + if(access==null) { if(args.length>1 && args[1].contains("@")) { String domain = FQI.reverseDomain(args[1]); @@ -181,9 +180,9 @@ public class Agent { } } } - } + } } - + if(access==null) { for(Entry es : System.getProperties().entrySet()) { if(Config.CADI_PROP_FILES.equals(es.getKey())) { @@ -194,7 +193,7 @@ public class Agent { // When using Config file, check if Cred Exists, and if not, work with Deployer. if(access!=null && !"config".equals(args[0]) && access.getProperty(Config.AAF_APPPASS)==null && access.getProperty(Config.CADI_ALIAS)==null) { - // not enough credentials to use Props. Use AAFSSO + // not enough credentials to use Props. Use AAFSSO access = null; } @@ -213,7 +212,7 @@ public class Agent { if (args.length>1) { if (!args[0].equals("keypairgen")) { props.put(Config.AAF_APPID, args[1]); - } + } } return props; } @@ -221,7 +220,7 @@ public class Agent { access = aafsso.access(); } } - + if (aafsso!=null && aafsso.loginOnly()) { aafsso.setLogDefault(); aafsso.writeFiles(); @@ -239,7 +238,7 @@ public class Agent { access.setProperty(p.substring(0,eq), p.substring(eq+1)); } } - + if (cmds.size()==0) { if (aafsso!=null) { aafsso.setLogDefault(); @@ -251,7 +250,7 @@ public class Agent { System.out.println(" update []"); System.out.println(" delete []"); System.out.println(" copy [,]*"); - System.out.println(" place []"); + System.out.println(" place [[,]*"); System.out.println(" showpass []"); System.out.println(" check []"); System.out.println(" keypairgen "); @@ -262,28 +261,28 @@ public class Agent { System.out.println(" ** Type with no params for Tool Help"); System.out.println(" ** If using with Agent, preface with \"cadi\""); System.out.println(" cadi "); - + if (doExit) { System.exit(1); } } - + TIMEOUT = Integer.parseInt(env.getProperty(Config.AAF_CONN_TIMEOUT, "5000")); - + reqDF = env.newDataFactory(CertificateRequest.class); artifactsDF = env.newDataFactory(Artifacts.class); certDF = env.newDataFactory(CertInfo.class); configDF = env.newDataFactory(Configuration.class); permDF = env.newDataFactory(Perms.class); errMsg = new ErrMessage(env); - + placeArtifact = new HashMap<>(); placeArtifact.put(JKS, new PlaceArtifactInKeystore(JKS)); placeArtifact.put(PKCS12, new PlaceArtifactInKeystore(PKCS12)); placeArtifact.put(FILE, new PlaceArtifactInFiles()); placeArtifact.put(PRINT, new PlaceArtifactOnStream(System.out)); placeArtifact.put(SCRIPT, new PlaceArtifactScripts()); - + Trans trans = env.newTrans(); String token; if ((token=access.getProperty("oauth_token"))!=null) { @@ -294,13 +293,13 @@ public class Agent { // show Std out again aafsso.setLogDefault(); aafsso.setStdErrDefault(); - + /*urls=*/loadURLs(access); aafsso.writeFiles(); } - - - + + + String cmd = cmds.removeFirst(); switch(cmd) { case "place": @@ -397,7 +396,7 @@ public class Agent { lhost=Config.AAF_LOCATE_URL_TAG; } value = rph.replacements(AGENT_LOAD_URLS, - proto + lhost + "/%CNS.%AAF_NS." + ("aaf".equals(u)?"service":u) + ':' + version, + proto + lhost + "/%CNS.%AAF_NS." + ("aaf".equals(u)?"service":u) + ':' + version, null,dot_le); if(append!=null) { value+=append; @@ -457,7 +456,7 @@ public class Agent { } return alias!=null?alias:AAFSSO.cons.readLine("AppID: "); } - return cmds.removeFirst(); + return cmds.removeFirst(); } private static String machine(Deque cmds) throws UnknownHostException { @@ -489,7 +488,7 @@ public class Agent { arti.setMechid(mechID!=null?mechID:AAFSSO.cons.readLine("AppID: ")); arti.setMachine(machine!=null?machine:AAFSSO.cons.readLine("Machine (%s): ",InetAddress.getLocalHost().getHostName())); arti.setCa(AAFSSO.cons.readLine("CA: (%s): ","aaf")); - + String resp = AAFSSO.cons.readLine("Types [file,pkcs12,jks,script] (%s): ", PKCS12); for (String s : Split.splitTrim(',', resp)) { arti.getType().add(s); @@ -506,7 +505,7 @@ public class Agent { arti.setOsUser(AAFSSO.cons.readLine("OS User (%s): ", System.getProperty("user.name"))); arti.setRenewDays(Integer.parseInt(AAFSSO.cons.readLine("Renewal Days (%s):", "30"))); arti.setNotification(toNotification(AAFSSO.cons.readLine("Notification (mailto owner):", ""))); - + TimeTaken tt = trans.start("Create Artifact", Env.REMOTE); try { Future future = aafcon.client(CM_VER).create("/cert/artifacts", artifactsDF, artifacts); @@ -531,7 +530,7 @@ public class Agent { } return notification; } - + private static void readArtifact(Trans trans, AAFCon aafcon, Deque cmds) throws Exception { String mechID = fqi(cmds); @@ -541,14 +540,14 @@ public class Agent { try { Future future = aafcon.client(CM_VER) .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF,"Authorization","Bearer " + trans.getProperty("oauth_token")); - + if (future.get(TIMEOUT)) { boolean printed = false; for (Artifact a : future.value.getArtifact()) { - AAFSSO.cons.printf("AppID: %s\n",a.getMechid()); - AAFSSO.cons.printf(" Sponsor: %s\n",a.getSponsor()); - AAFSSO.cons.printf("Machine: %s\n",a.getMachine()); - AAFSSO.cons.printf("CA: %s\n",a.getCa()); + AAFSSO.cons.printf("AppID: %s\n",a.getMechid()); + AAFSSO.cons.printf(" Sponsor: %s\n",a.getSponsor()); + AAFSSO.cons.printf("Machine: %s\n",a.getMachine()); + AAFSSO.cons.printf("CA: %s\n",a.getCa()); StringBuilder sb = new StringBuilder(); boolean first = true; for (String t : a.getType()) { @@ -557,7 +556,7 @@ public class Agent { sb.append(t); } AAFSSO.cons.printf("Types: %s\n",sb); - AAFSSO.cons.printf("Namespace: %s\n",a.getNs()); + AAFSSO.cons.printf("Namespace: %s\n",a.getNs()); AAFSSO.cons.printf("Directory: %s\n",a.getDir()); AAFSSO.cons.printf("O/S User: %s\n",a.getOsUser()); AAFSSO.cons.printf("Renew Days: %d\n",a.getRenewDays()); @@ -574,7 +573,7 @@ public class Agent { tt.done(); } } - + private static void copyArtifact(Trans trans, AAFCon aafcon, Deque cmds) throws Exception { String mechID = fqi(cmds); String machine = machine(cmds); @@ -586,7 +585,7 @@ public class Agent { try { Future future = aafcon.client(CM_VER) .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF); - + if (future.get(TIMEOUT)) { boolean printed = false; for (Artifact a : future.value.getArtifact()) { @@ -599,7 +598,7 @@ public class Agent { trans.error().printf("Call to AAF Certman failed, %s", errMsg.toMsg(fup)); } - + printed = true; } } @@ -623,13 +622,13 @@ public class Agent { try { Future fread = aafcon.client(CM_VER) .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF); - + if (fread.get(TIMEOUT)) { Artifacts artifacts = new Artifacts(); for (Artifact a : fread.value.getArtifact()) { Artifact arti = new Artifact(); artifacts.getArtifact().add(arti); - + AAFSSO.cons.printf("For %s on %s\n", a.getMechid(),a.getMachine()); arti.setMechid(a.getMechid()); arti.setMachine(a.getMachine()); @@ -641,7 +640,7 @@ public class Agent { else{sb.append(',');} sb.append(t); } - + String resp = AAFSSO.cons.readLine("Types [file,jks,pkcs12] (%s): ", sb); for (String s : Split.splitTrim(',', resp)) { arti.getType().add(s); @@ -657,7 +656,7 @@ public class Agent { arti.setOsUser(AAFSSO.cons.readLine("OS User (%s): ", a.getOsUser())); arti.setRenewDays(Integer.parseInt(AAFSSO.cons.readLine("Renew Days (%s):", a.getRenewDays()))); arti.setNotification(toNotification(AAFSSO.cons.readLine("Notification (%s):", a.getNotification()))); - + } if (artifacts.getArtifact().size()==0) { AAFSSO.cons.printf("Artifact for %s %s does not exist", mechID, machine); @@ -678,16 +677,16 @@ public class Agent { tt.done(); } } - + private static void deleteArtifact(Trans trans, AAFCon aafcon, Deque cmds) throws Exception { String mechid = fqi(cmds); String machine = machine(cmds); - + TimeTaken tt = trans.start("Delete Artifact", Env.REMOTE); try { Future future = aafcon.client(CM_VER) .delete("/cert/artifacts/"+mechid+"/"+machine,"application/json" ); - + if (future.get(TIMEOUT)) { trans.info().printf("Call to AAF Certman successful %s, %s",mechid,machine); } else { @@ -699,7 +698,7 @@ public class Agent { } } - + private static boolean placeCerts(Trans trans, AAFCon aafcon, Deque cmds) throws Exception { boolean rv = false; @@ -712,8 +711,9 @@ public class Agent { machine = fqdns[1]; } else { key = machine; + fqdns = machines(cmds); } - + TimeTaken tt = trans.start("Place Artifact", Env.REMOTE); try { Future acf = aafcon.client(CM_VER) @@ -728,8 +728,11 @@ public class Agent { CertificateRequest cr = new CertificateRequest(); cr.setMechid(a.getMechid()); cr.setSponsor(a.getSponsor()); + cr.getFqdns().add(machine); for (int i=0;i f = aafcon.client(CM_VER) .updateRespondString("/cert/" + a.getCa()+"?withTrust",reqDF, cr); @@ -761,7 +764,7 @@ public class Agent { } return rv; } - + private static void notifyPlaced(Artifact a, boolean rv) { } @@ -783,10 +786,10 @@ public class Agent { boolean allowed; for (Artifact a : acf.value.getArtifact()) { allowed = id!=null && (id.equals(a.getSponsor()) || - (id.equals(a.getMechid()) + (id.equals(a.getMechid()) && aafcon.securityInfo().defSS.getClass().isAssignableFrom(HBasicAuthSS.class))); if (!allowed) { - Future pf = aafcon.client(CM_VER).read("/cert/may/" + + Future pf = aafcon.client(CM_VER).read("/cert/may/" + a.getNs()+"|certman|"+a.getCa()+"|showpass","*/*"); if (pf.get(TIMEOUT)) { allowed = true; @@ -809,11 +812,11 @@ public class Agent { } finally { fis.close(); } - + File f = new File(dir,a.getNs()+".keyfile"); if (f.exists()) { Symm symm = ArtifactDir.getSymm(f); - + for (Iterator> iter = props.entrySet().iterator(); iter.hasNext();) { Entry en = iter.next(); if (en.getValue().toString().startsWith("enc:")) { @@ -835,13 +838,13 @@ public class Agent { } } - + private static void keypairGen(final Trans trans, final PropAccess access, final Deque cmds) throws IOException { final String fqi = fqi(cmds); final String ns = FQI.reverseDomain(fqi); File dir = new File(access.getProperty(Config.CADI_ETCDIR,".")); // default to current Directory File f = new File(dir,ns+".key"); - + if (f.exists()) { String line = AAFSSO.cons.readLine("%s exists. Overwrite? (y/n): ", f.getCanonicalPath()); if (!"Y".equalsIgnoreCase(line)) { @@ -849,7 +852,7 @@ public class Agent { return; } } - + KeyPair kp = Factory.generateKeyPair(trans); ArtifactDir.write(f, Chmod.to400, Factory.toString(trans, kp.getPrivate())); System.out.printf("Wrote %s\n", f.getCanonicalFile()); @@ -858,7 +861,7 @@ public class Agent { ArtifactDir.write(f, Chmod.to644, Factory.toString(trans, kp.getPublic())); System.out.printf("Wrote %s\n", f.getCanonicalFile()); } - + private static void config(Trans trans, PropAccess propAccess, String[] args, Deque cmds) throws Exception { TimeTaken tt = trans.start("Get Configuration", Env.REMOTE); try { @@ -880,7 +883,7 @@ public class Agent { for (String tag : LOC_TAGS) { loc.add(tag, getProperty(propAccess, trans, false, tag, "%s: ",tag)); } - + String keyfile = cred.getKeyPath(); if(keyfile!=null) { File fkeyfile = new File(keyfile); @@ -901,13 +904,13 @@ public class Agent { } } } - + // load all properties that are already setup. Map aaf_urls = loadURLs(propAccess); for(Entry es : aaf_urls.entrySet()) { app.add(es.getKey(), es.getValue()); } - + app.add(Config.AAF_LOCATE_URL, Config.getAAFLocateUrl(propAccess)); app.add(Config.AAF_ENV,propAccess, "DEV"); String release = propAccess.getProperty(Config.AAF_DEPLOYED_VERSION); @@ -923,7 +926,7 @@ public class Agent { app.add(key, aaf_loc_prop.getValue().toString()); } } - + app.add(Config.AAF_APPID, fqi); String cts = propAccess.getProperty(Config.CADI_TRUSTSTORE); @@ -941,7 +944,7 @@ public class Agent { if (fcpf.exists()) { int lastSep = cts.lastIndexOf(File.pathSeparator); origTruststore = new File(fcpf.getParentFile(),lastSep>=0?cts.substring(lastSep):cts); - if (origTruststore.exists()) { + if (origTruststore.exists()) { break; } } @@ -950,7 +953,7 @@ public class Agent { throw new CadiException(cts + " does not exist"); } } - + } if (!newTruststore.exists() && origTruststore.exists()) { Files.copy(origTruststore.toPath(), newTruststore.toPath()); @@ -960,14 +963,14 @@ public class Agent { System.out.println("New Truststore is " + newTruststore); cred.add(Config.CADI_TRUSTSTORE, newTruststore.getCanonicalPath()); cred.add(Config.CADI_TRUSTSTORE_PASSWORD, "changeit" /* Java default */); - + String cpf = propAccess.getProperty(Config.CADI_PROP_FILES); if (cpf!=null){ - String[] propFiles = Split.splitTrim(File.pathSeparatorChar, cpf); + String[] propFiles = Split.splitTrim(File.pathSeparatorChar, cpf); for (int pfi = propFiles.length-1;pfi>=0;--pfi) { String f = propFiles[pfi]; System.out.format("Reading %s\n",f); - FileInputStream fis = new FileInputStream(f); + FileInputStream fis = new FileInputStream(f); try { Properties props = new Properties(); props.load(fis); @@ -1010,7 +1013,7 @@ public class Agent { } } } - + PropHolder.writeAll(); } finally { tt.done(); @@ -1062,12 +1065,12 @@ public class Agent { /** * Check returns Error Codes, so that Scripts can know what to do - * + * * 0 - Check Complete, nothing to do * 1 - General Error * 2 - Error for specific Artifact - read check.msg * 10 - Certificate Updated - check.msg is email content - * + * * @param trans * @param aafcon * @param cmds @@ -1078,10 +1081,10 @@ public class Agent { int exitCode=1; String mechID = fqi(cmds); String machine = machine(cmds); - + TimeTaken tt = trans.start("Check Certificate", Env.REMOTE); try { - + Future acf = aafcon.client(CM_VER) .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF); if (acf.get(TIMEOUT)) { @@ -1102,10 +1105,10 @@ public class Agent { } finally { fis.close(); } - - String prop; + + String prop; File f; - + if ((prop=trans.getProperty(Config.CADI_KEYFILE))==null || !(f=new File(prop)).exists()) { trans.error().printf("Keyfile must exist to check Certificates for %s on %s", @@ -1120,7 +1123,7 @@ public class Agent { Symm symm = ArtifactDir.getSymm(f); KeyStore ks = KeyStore.getInstance("JKS"); - + fis = new FileInputStream(ksf); try { ks.load(fis,symm.depass(ksps).toCharArray()); @@ -1140,21 +1143,21 @@ public class Agent { renew.setTime(cert.getNotAfter()); renew.add(GregorianCalendar.DAY_OF_MONTH,-1*a.getRenewDays()); if (renew.after(now)) { - msg = String.format("X509Certificate for %s on %s has been checked on %s. It expires on %s; it will not be renewed until %s.\n", + msg = String.format("X509Certificate for %s on %s has been checked on %s. It expires on %s; it will not be renewed until %s.\n", a.getMechid(), a.getMachine(),Chrono.dateOnlyStamp(now),cert.getNotAfter(),Chrono.dateOnlyStamp(renew)); trans.info().log(msg); exitCode = 0; // OK } else { - trans.info().printf("X509Certificate for %s on %s expiration, %s, needs Renewal.\n", + trans.info().printf("X509Certificate for %s on %s expiration, %s, needs Renewal.\n", a.getMechid(), a.getMachine(),cert.getNotAfter()); cmds.offerLast(mechID); cmds.offerLast(machine); if (placeCerts(trans,aafcon,cmds)) { - msg = String.format("X509Certificate for %s on %s has been renewed. Ensure services using are refreshed.\n", + msg = String.format("X509Certificate for %s on %s has been renewed. Ensure services using are refreshed.\n", a.getMechid(), a.getMachine()); exitCode = 10; // Refreshed } else { - msg = String.format("X509Certificate for %s on %s attempted renewal, but failed. Immediate Investigation is required!\n", + msg = String.format("X509Certificate for %s on %s attempted renewal, but failed. Immediate Investigation is required!\n", a.getMechid(), a.getMachine()); exitCode = 1; // Error Renewing } @@ -1169,7 +1172,7 @@ public class Agent { } } } - + } } } @@ -1185,7 +1188,7 @@ public class Agent { } } - - + +