cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/Agent.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.cadi.configure;
  23
  24 import java.io.File;
  25 import java.io.FileInputStream;
  26 import java.io.FileOutputStream;
  27 import java.io.IOException;
  28 import java.net.ConnectException;
  29 import java.net.HttpURLConnection;
  30 import java.net.InetAddress;
  31 import java.net.UnknownHostException;
  32 import java.nio.file.Files;
  33 import java.security.KeyPair;
  34 import java.security.KeyStore;
  35 import java.security.cert.X509Certificate;
  36 import java.util.ArrayDeque;
  37 import java.util.Arrays;
  38 import java.util.Deque;
  39 import java.util.GregorianCalendar;
  40 import java.util.HashMap;
  41 import java.util.Iterator;
  42 import java.util.List;
  43 import java.util.Map;
  44 import java.util.Map.Entry;
  45 import java.util.Properties;
  46
  47 import org.onap.aaf.cadi.Access;
  48 import org.onap.aaf.cadi.CadiException;
  49 import org.onap.aaf.cadi.CmdLine;
  50 import org.onap.aaf.cadi.LocatorException;
  51 import org.onap.aaf.cadi.PropAccess;
  52 import org.onap.aaf.cadi.Symm;
  53 import org.onap.aaf.cadi.aaf.client.ErrMessage;
  54 import org.onap.aaf.cadi.aaf.v2_0.AAFCon;
  55 import org.onap.aaf.cadi.aaf.v2_0.AAFConHttp;
  56 import org.onap.aaf.cadi.client.Future;
  57 import org.onap.aaf.cadi.client.Rcli;
  58 import org.onap.aaf.cadi.client.Retryable;
  59 import org.onap.aaf.cadi.config.Config;
  60 import org.onap.aaf.cadi.config.RegistrationPropHolder;
  61 import org.onap.aaf.cadi.config.SecurityInfoC;
  62 import org.onap.aaf.cadi.http.HBasicAuthSS;
  63 import org.onap.aaf.cadi.locator.SingleEndpointLocator;
  64 import org.onap.aaf.cadi.sso.AAFSSO;
  65 import org.onap.aaf.cadi.util.Chmod;
  66 import org.onap.aaf.cadi.util.FQI;
  67 import org.onap.aaf.misc.env.APIException;
  68 import org.onap.aaf.misc.env.Data.TYPE;
  69 import org.onap.aaf.misc.env.Env;
  70 import org.onap.aaf.misc.env.TimeTaken;
  71 import org.onap.aaf.misc.env.Trans;
  72 import org.onap.aaf.misc.env.util.Chrono;
  73 import org.onap.aaf.misc.env.util.Split;
  74 import org.onap.aaf.misc.rosetta.env.RosettaDF;
  75 import org.onap.aaf.misc.rosetta.env.RosettaEnv;
  76
  77 import aaf.v2_0.Perm;
  78 import aaf.v2_0.Perms;
  79 import certman.v1_0.Artifacts;
  80 import certman.v1_0.Artifacts.Artifact;
  81 import certman.v1_0.CertInfo;
  82 import certman.v1_0.CertificateRequest;
  83 import locate.v1_1.Configuration;
  84 import locate.v1_1.Configuration.Props;
  85
  86 public class Agent {
  87     private static final String HASHES = "################################################################";
  88     private static final String PRINT = "print";
  89     private static final String FILE = "file";
  90     public static final String PKCS12 = "pkcs12";
  91     public static final String JKS = "jks";
  92     private static final String SCRIPT="script";
  93
  94     private static final String CM_VER = "1.0";
  95     public static final int PASS_SIZE = 24;
  96     private static int TIMEOUT;
  97
  98     private static RosettaDF<CertificateRequest> reqDF;
  99     private static RosettaDF<CertInfo> certDF;
 100     private static RosettaDF<Artifacts> artifactsDF;
 101     private static RosettaDF<Configuration> configDF;
 102     private static RosettaDF<Perms> permDF;
 103     private static ErrMessage errMsg;
 104     private static Map<String,PlaceArtifact> placeArtifact;
 105     private static RosettaEnv env;
 106
 107     private static boolean doExit;
 108     private static AAFCon<?> aafcon;
 109
 110     private static List<String> CRED_TAGS = Arrays.asList(new String[] {
 111             Config.CADI_KEYFILE,
 112             Config.AAF_APPID, Config.AAF_APPPASS,
 113             Config.CADI_KEYSTORE, Config.CADI_KEYSTORE_PASSWORD, Config.CADI_KEY_PASSWORD,
 114             Config.CADI_TRUSTSTORE,Config.CADI_TRUSTSTORE_PASSWORD,
 115             Config.CADI_ALIAS, Config.CADI_X509_ISSUERS
 116             });
 117     private static List<String> LOC_TAGS = Arrays.asList(new String[] {
 118                 Config.CADI_LATITUDE, Config.CADI_LONGITUDE
 119                 });
 120     // Note: This is set by loadURLs. Use that function as singleton, not directly.
 121         private static Map<String,String> aaf_urls = null;
 122
 123
 124     public static void main(String[] args) {
 125         int exitCode = 0;
 126         doExit = true;
 127         if (args.length>0 && "cadi".equals(args[0])) {
 128             String[] newArgs = new String[args.length-1];
 129             System.arraycopy(args, 1, newArgs, 0, newArgs.length);
 130             if (newArgs.length==0) {
 131                 System.out.println(HASHES);
 132                 System.out.println("Note: Cadi CmdLine is a separate component.  When running with\n\t"
 133                         + "Agent, always preface with \"cadi\",\n\tex: cadi keygen [<keyfile>]");
 134                 System.out.println(HASHES);
 135             }
 136             CmdLine.main(newArgs);
 137         } else {
 138             try {
 139                 AAFSSO aafsso=null;
 140                 PropAccess access;
 141
 142                 if (args.length>1 && args[0].equals("validate") ) {
 143                     int idx = args[1].indexOf('=');
 144                     aafsso = null;
 145                     access = new PropAccess(
 146                                 (idx<0?Config.CADI_PROP_FILES:args[1].substring(0, idx))+
 147                                 '='+
 148                                 (idx<0?args[1]:args[1].substring(idx+1)));
 149                 } else {
 150                     aafsso= new AAFSSO(args, new AAFSSO.ProcessArgs() {
 151                         @Override
 152                         public Properties process(String[] args, Properties props) {
 153                             if (args.length>1) {
 154                                 if (!args[0].equals("keypairgen")) {
 155                                     props.put(Config.AAF_APPID, args[1]);
 156                                 }
 157                             }
 158                             return props;
 159                         }
 160                     });
 161                     access = aafsso.access();
 162                 }
 163
 164                 if (aafsso!=null && aafsso.loginOnly()) {
 165                     aafsso.setLogDefault();
 166                     aafsso.writeFiles();
 167                     System.out.println("AAF SSO information created in ~/.aaf");
 168                 } else {
 169                     env = new RosettaEnv(access.getProperties());
 170                     Deque<String> cmds = new ArrayDeque<String>();
 171                     for (String p : args) {
 172                         int eq;
 173                         if ("-noexit".equalsIgnoreCase(p)) {
 174                             doExit = false;
 175                         } else if ((eq=p.indexOf('=')) < 0) {
 176                             cmds.add(p);
 177                         } else {
 178                                 access.setProperty(p.substring(0,eq), p.substring(eq+1));
 179                         }
 180                     }
 181
 182                     if (cmds.size()==0) {
 183                         if (aafsso!=null) {
 184                             aafsso.setLogDefault();
 185                         }
 186                         // NOTE: CHANGE IN CMDS should be reflected in AAFSSO constructor, to get FQI->aaf-id or not
 187                         System.out.println("Usage: java -jar <cadi-aaf-*-full.jar> cmd [<tag=value>]*");
 188                         System.out.println("   create     <FQI> [<machine>]");
 189                         System.out.println("   read       <FQI> [<machine>]");
 190                         System.out.println("   update     <FQI> [<machine>]");
 191                         System.out.println("   delete     <FQI> [<machine>]");
 192                         System.out.println("   copy       <FQI> <machine> <newmachine>[,<newmachine>]*");
 193                         System.out.println("   place      <FQI> [<machine>]");
 194                         System.out.println("   showpass   <FQI> [<machine>]");
 195                         System.out.println("   check      <FQI> [<machine>]");
 196                         System.out.println("   keypairgen <FQI>");
 197                         System.out.println("   config     <FQI>");
 198                         System.out.println("   validate   <NS>.props>");
 199                         System.out.println("   --- Additional Tool Access ---");
 200                         System.out.println("     ** Type with no params for Tool Help");
 201                         System.out.println("     ** If using with Agent, preface with \"cadi\"");
 202                         System.out.println("   cadi <cadi tool params, see -?>");
 203
 204                         if (doExit) {
 205                             System.exit(1);
 206                         }
 207                     }
 208
 209                     TIMEOUT = Integer.parseInt(env.getProperty(Config.AAF_CONN_TIMEOUT, "5000"));
 210
 211                     reqDF = env.newDataFactory(CertificateRequest.class);
 212                     artifactsDF = env.newDataFactory(Artifacts.class);
 213                     certDF = env.newDataFactory(CertInfo.class);
 214                     configDF = env.newDataFactory(Configuration.class);
 215                     permDF = env.newDataFactory(Perms.class);
 216                     errMsg = new ErrMessage(env);
 217
 218                     placeArtifact = new HashMap<>();
 219                     placeArtifact.put(JKS, new PlaceArtifactInKeystore(JKS));
 220                     placeArtifact.put(PKCS12, new PlaceArtifactInKeystore(PKCS12));
 221                     placeArtifact.put(FILE, new PlaceArtifactInFiles());
 222                     placeArtifact.put(PRINT, new PlaceArtifactOnStream(System.out));
 223                     placeArtifact.put(SCRIPT, new PlaceArtifactScripts());
 224
 225                     Trans trans = env.newTrans();
 226                     String token;
 227                     if ((token=access.getProperty("oauth_token"))!=null) {
 228                         trans.setProperty("oauth_token", token);
 229                     }
 230                     try {
 231                         if (aafsso!=null) {
 232                         // show Std out again
 233                             aafsso.setLogDefault();
 234                             aafsso.setStdErrDefault();
 235
 236                             Map<String, String> aaf_urls = loadURLs(access);
 237                             aafsso.addProp(Config.AAF_URL_CM, aaf_urls.get(Config.AAF_URL_CM));
 238                             aafsso.writeFiles();
 239                         }
 240
 241
 242
 243                         String cmd = cmds.removeFirst();
 244                         switch(cmd) {
 245                             case "place":
 246                                 placeCerts(trans,aafcon(access),cmds);
 247                                 break;
 248                             case "create":
 249                                 createArtifact(trans, aafcon(access),cmds);
 250                                 break;
 251                             case "read":
 252                                 readArtifact(trans, aafcon(access), cmds);
 253                                 break;
 254                             case "copy":
 255                                 copyArtifact(trans, aafcon(access), cmds);
 256                                 break;
 257                             case "update":
 258                                 updateArtifact(trans, aafcon(access), cmds);
 259                                 break;
 260                             case "delete":
 261                                 deleteArtifact(trans, aafcon(access), cmds);
 262                                 break;
 263                             case "showpass":
 264                                 showPass(trans, aafcon(access), cmds);
 265                                 break;
 266                             case "keypairgen":
 267                                 keypairGen(trans, access, cmds);
 268                                 break;
 269                             case "config":
 270                                 config(trans,access,args,cmds);
 271                                 break;
 272                             case "validate":
 273                                 validate(access);
 274                                 break;
 275                             case "check":
 276                                 try {
 277                                     exitCode = check(trans,aafcon(access),cmds);
 278                                 } catch (Exception e) {
 279                                     exitCode = 1;
 280                                     throw e;
 281                                 }
 282                                 break;
 283                             default:
 284                                 AAFSSO.cons.printf("Unknown command \"%s\"\n", cmd);
 285                         }
 286                     } finally {
 287                         StringBuilder sb = new StringBuilder();
 288                         trans.auditTrail(4, sb, Trans.REMOTE);
 289                         if (sb.length()>0) {
 290                             trans.info().log("Trans Info\n",sb);
 291                         }
 292                     }
 293                     if (aafsso!=null) {
 294                         aafsso.close();
 295                     }
 296                 }
 297             } catch (Exception e) {
 298                 e.printStackTrace();
 299             }
 300         }
 301         if (exitCode != 0 && doExit) {
 302             System.exit(exitCode);
 303         }
 304     }
 305
 306     public synchronized static Map<String,String> loadURLs(Access access) throws UnknownHostException, CadiException {
 307                 if(aaf_urls==null) {
 308                 Map<String,String> rv = new HashMap<>();
 309                 RegistrationPropHolder rph = new RegistrationPropHolder(access, 0);
 310                 String dot_le = access.getProperty(Config.AAF_LOCATOR_CONTAINER,null);
 311                 dot_le=dot_le==null?"":'.'+dot_le;
 312                 String version = access.getProperty(Config.AAF_API_VERSION,Config.AAF_DEFAULT_API_VERSION);
 313                 for(String u : new String[] {"aaf","locate","oauth","cm","gui","fs","hello","token","introspect"}) {
 314                         String proto = "fs".equals(u)?"http://":"https://";
 315                         String lhost;
 316                         if("locate".equals(u)) {
 317                                 lhost=rph.default_fqdn;
 318                         } else {
 319                                 lhost=Config.AAF_LOCATE_URL_TAG;
 320                         }
 321                         String value = rph.replacements("Agent:loadURLs",
 322                                         proto + lhost + "/AAF_NS." + ("aaf".equals(u)?"service":u) + ':' + version,
 323                                         null,dot_le);
 324                         switch(u) {
 325                                 case "aaf": rv.put(Config.AAF_URL, value); break;
 326                                 case "locate": rv.put(Config.AAF_LOCATE_URL, value); break;
 327                                 case "token": rv.put(Config.AAF_OAUTH2_TOKEN_URL, value); break;
 328                                 case "introspect": rv.put(Config.AAF_OAUTH2_INTROSPECT_URL, value); break;
 329                                 case "cm": rv.put(Config.AAF_URL_CM, value); break;
 330                                 case "gui": rv.put(Config.AAF_URL_GUI, value); break;
 331                                 case "fs": rv.put(Config.AAF_URL_FS, value); break;
 332                                 case "hello": rv.put(Config.AAF_URL_HELLO, value); break;
 333                                 default:
 334                                 rv.put("aaf_url_" + u, value);
 335                         }
 336                 };
 337                 aaf_urls = rv;
 338                 }
 339             return aaf_urls;
 340         }
 341
 342         public static void fillMissing(PropAccess access, Map<String, String> map) {
 343                 for(Entry<String, String> es : map.entrySet()) {
 344                         if(access.getProperty(es.getKey())==null) {
 345                                 access.setProperty(es.getKey(),es.getValue());
 346                         }
 347                 }
 348         }
 349
 350         private static synchronized AAFCon<?> aafcon(Access access) throws APIException, CadiException, LocatorException {
 351         if (aafcon==null) {
 352             aafcon = new AAFConHttp(access,Config.AAF_URL_CM);
 353         }
 354         return aafcon;
 355     }
 356
 357     private static String getProperty(PropAccess pa, Env env, boolean secure, String tag, String prompt, Object ... def) {
 358         String value;
 359         if ((value=pa.getProperty(tag))==null) {
 360             if (secure) {
 361                 value = new String(AAFSSO.cons.readPassword(prompt, def));
 362             } else {
 363                 value = AAFSSO.cons.readLine(prompt,def).trim();
 364             }
 365             if (value!=null) {
 366                 if (value.length()>0) {
 367                     pa.setProperty(tag,value);
 368                     env.setProperty(tag,value);
 369                 } else if (def.length==1) {
 370                     value=def[0].toString();
 371                     pa.setProperty(tag,value);
 372                     env.setProperty(tag,value);
 373                 }
 374             }
 375         }
 376         return value;
 377     }
 378
 379     private static String fqi(Deque<String> cmds) {
 380         if (cmds.size()<1) {
 381             String alias = env.getProperty(Config.CADI_ALIAS);
 382             return alias!=null?alias:AAFSSO.cons.readLine("AppID: ");
 383         }
 384         return cmds.removeFirst();
 385     }
 386
 387     private static String machine(Deque<String> cmds) throws UnknownHostException {
 388         if (cmds.size()>0) {
 389             return cmds.removeFirst();
 390         } else {
 391             String mach = env.getProperty(Config.HOSTNAME);
 392             return mach!=null?mach:InetAddress.getLocalHost().getHostName();
 393         }
 394     }
 395
 396     private static String[] machines(Deque<String> cmds)  {
 397         String machines;
 398         if (cmds.size()>0) {
 399             machines = cmds.removeFirst();
 400         } else {
 401             machines = AAFSSO.cons.readLine("Machines (sep by ','): ");
 402         }
 403         return Split.split(',', machines);
 404     }
 405
 406     private static void createArtifact(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 407         final String mechID = fqi(cmds);
 408         final String machine = machine(cmds);
 409
 410         Artifacts artifacts = new Artifacts();
 411         Artifact arti = new Artifact();
 412         artifacts.getArtifact().add(arti);
 413         arti.setMechid(mechID!=null?mechID:AAFSSO.cons.readLine("AppID: "));
 414         arti.setMachine(machine!=null?machine:AAFSSO.cons.readLine("Machine (%s): ",InetAddress.getLocalHost().getHostName()));
 415         arti.setCa(AAFSSO.cons.readLine("CA: (%s): ","aaf"));
 416
 417         String resp = AAFSSO.cons.readLine("Types [file,pkcs12,jks,script] (%s): ", PKCS12);
 418         for (String s : Split.splitTrim(',', resp)) {
 419             arti.getType().add(s);
 420         }
 421         // Always do Script
 422         if (!resp.contains(SCRIPT)) {
 423             arti.getType().add(SCRIPT);
 424         }
 425
 426         // Note: Sponsor is set on Creation by CM
 427         String configRootName = FQI.reverseDomain(arti.getMechid());
 428         arti.setNs(AAFSSO.cons.readLine("Namespace (%s): ",configRootName));
 429         arti.setDir(AAFSSO.cons.readLine("Directory (%s): ", System.getProperty("user.dir")));
 430         arti.setOsUser(AAFSSO.cons.readLine("OS User (%s): ", System.getProperty("user.name")));
 431         arti.setRenewDays(Integer.parseInt(AAFSSO.cons.readLine("Renewal Days (%s):", "30")));
 432         arti.setNotification(toNotification(AAFSSO.cons.readLine("Notification (mailto owner):", "")));
 433
 434         TimeTaken tt = trans.start("Create Artifact", Env.REMOTE);
 435         try {
 436             Future<Artifacts> future = aafcon.client(CM_VER).create("/cert/artifacts", artifactsDF, artifacts);
 437             if (future.get(TIMEOUT)) {
 438                 trans.info().printf("Call to AAF Certman successful %s, %s",arti.getMechid(), arti.getMachine());
 439             } else {
 440                 trans.error().printf("Call to AAF Certman failed, %s",
 441                     errMsg.toMsg(future));
 442             }
 443         } finally {
 444             tt.done();
 445         }
 446     }
 447
 448     private static String toNotification(String notification) {
 449         if (notification==null) {
 450             notification="";
 451         } else if (notification.length()>0) {
 452             if (notification.indexOf(':')<0) {
 453                 notification = "mailto:" + notification;
 454             }
 455         }
 456         return notification;
 457     }
 458
 459
 460     private static void readArtifact(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 461         String mechID = fqi(cmds);
 462         String machine = machine(cmds);
 463
 464         TimeTaken tt = trans.start("Read Artifact", Env.SUB);
 465         try {
 466             Future<Artifacts> future = aafcon.client(CM_VER)
 467                     .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF,"Authorization","Bearer " + trans.getProperty("oauth_token"));
 468
 469             if (future.get(TIMEOUT)) {
 470                 boolean printed = false;
 471                 for (Artifact a : future.value.getArtifact()) {
 472                     AAFSSO.cons.printf("AppID:          %s\n",a.getMechid());
 473                     AAFSSO.cons.printf("  Sponsor:       %s\n",a.getSponsor());
 474                     AAFSSO.cons.printf("Machine:         %s\n",a.getMachine());
 475                     AAFSSO.cons.printf("CA:              %s\n",a.getCa());
 476                     StringBuilder sb = new StringBuilder();
 477                     boolean first = true;
 478                     for (String t : a.getType()) {
 479                         if (first) {first=false;}
 480                         else{sb.append(',');}
 481                         sb.append(t);
 482                     }
 483                     AAFSSO.cons.printf("Types:           %s\n",sb);
 484                     AAFSSO.cons.printf("Namespace:       %s\n",a.getNs());
 485                     AAFSSO.cons.printf("Directory:       %s\n",a.getDir());
 486                     AAFSSO.cons.printf("O/S User:        %s\n",a.getOsUser());
 487                     AAFSSO.cons.printf("Renew Days:      %d\n",a.getRenewDays());
 488                     AAFSSO.cons.printf("Notification     %s\n",a.getNotification());
 489                     printed = true;
 490                 }
 491                 if (!printed) {
 492                     AAFSSO.cons.printf("Artifact for %s %s does not exist\n", mechID, machine);
 493                 }
 494             } else {
 495                 trans.error().log(errMsg.toMsg(future));
 496             }
 497         } finally {
 498             tt.done();
 499         }
 500     }
 501
 502     private static void copyArtifact(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 503         String mechID = fqi(cmds);
 504         String machine = machine(cmds);
 505         String[] newmachs = machines(cmds);
 506         if (machine==null || newmachs == null) {
 507             trans.error().log("No machines listed to copy to");
 508         } else {
 509             TimeTaken tt = trans.start("Copy Artifact", Env.REMOTE);
 510             try {
 511                 Future<Artifacts> future = aafcon.client(CM_VER)
 512                         .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF);
 513
 514                 if (future.get(TIMEOUT)) {
 515                     boolean printed = false;
 516                     for (Artifact a : future.value.getArtifact()) {
 517                         for (String m : newmachs) {
 518                             a.setMachine(m);
 519                             Future<Artifacts> fup = aafcon.client(CM_VER).update("/cert/artifacts", artifactsDF, future.value);
 520                             if (fup.get(TIMEOUT)) {
 521                                 trans.info().printf("Copy of %s %s successful to %s",mechID,machine,m);
 522                             } else {
 523                                 trans.error().printf("Call to AAF Certman failed, %s",
 524                                     errMsg.toMsg(fup));
 525                             }
 526
 527                             printed = true;
 528                         }
 529                     }
 530                     if (!printed) {
 531                         AAFSSO.cons.printf("Artifact for %s %s does not exist", mechID, machine);
 532                     }
 533                 } else {
 534                     trans.error().log(errMsg.toMsg(future));
 535                 }
 536             } finally {
 537                 tt.done();
 538             }
 539         }
 540     }
 541
 542     private static void updateArtifact(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 543         String mechID = fqi(cmds);
 544         String machine = machine(cmds);
 545
 546         TimeTaken tt = trans.start("Update Artifact", Env.REMOTE);
 547         try {
 548             Future<Artifacts> fread = aafcon.client(CM_VER)
 549                     .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF);
 550
 551             if (fread.get(TIMEOUT)) {
 552                 Artifacts artifacts = new Artifacts();
 553                 for (Artifact a : fread.value.getArtifact()) {
 554                     Artifact arti = new Artifact();
 555                     artifacts.getArtifact().add(arti);
 556
 557                     AAFSSO.cons.printf("For %s on %s\n", a.getMechid(),a.getMachine());
 558                     arti.setMechid(a.getMechid());
 559                     arti.setMachine(a.getMachine());
 560                     arti.setCa(AAFSSO.cons.readLine("CA: (%s): ",a.getCa()));
 561                     StringBuilder sb = new StringBuilder();
 562                     boolean first = true;
 563                     for (String t : a.getType()) {
 564                         if (first) {first=false;}
 565                         else{sb.append(',');}
 566                         sb.append(t);
 567                     }
 568
 569                     String resp = AAFSSO.cons.readLine("Types [file,jks,pkcs12] (%s): ", sb);
 570                     for (String s : Split.splitTrim(',', resp)) {
 571                         arti.getType().add(s);
 572                     }
 573                     // Always do Script
 574                     if (!resp.contains(SCRIPT)) {
 575                         arti.getType().add(SCRIPT);
 576                     }
 577
 578                     // Note: Sponsor is set on Creation by CM
 579                     arti.setNs(AAFSSO.cons.readLine("Namespace (%s): ",a.getNs()));
 580                     arti.setDir(AAFSSO.cons.readLine("Directory (%s): ", a.getDir()));
 581                     arti.setOsUser(AAFSSO.cons.readLine("OS User (%s): ", a.getOsUser()));
 582                     arti.setRenewDays(Integer.parseInt(AAFSSO.cons.readLine("Renew Days (%s):", a.getRenewDays())));
 583                     arti.setNotification(toNotification(AAFSSO.cons.readLine("Notification (%s):", a.getNotification())));
 584
 585                 }
 586                 if (artifacts.getArtifact().size()==0) {
 587                     AAFSSO.cons.printf("Artifact for %s %s does not exist", mechID, machine);
 588                 } else {
 589                     Future<Artifacts> fup = aafcon.client(CM_VER).update("/cert/artifacts", artifactsDF, artifacts);
 590                     if (fup.get(TIMEOUT)) {
 591                         trans.info().printf("Call to AAF Certman successful %s, %s",mechID,machine);
 592                     } else {
 593                         trans.error().printf("Call to AAF Certman failed, %s",
 594                             errMsg.toMsg(fup));
 595                     }
 596                 }
 597             } else {
 598                 trans.error().printf("Call to AAF Certman failed, %s %s, %s",
 599                         errMsg.toMsg(fread),mechID,machine);
 600             }
 601         } finally {
 602             tt.done();
 603         }
 604     }
 605
 606     private static void deleteArtifact(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 607         String mechid = fqi(cmds);
 608         String machine = machine(cmds);
 609
 610         TimeTaken tt = trans.start("Delete Artifact", Env.REMOTE);
 611         try {
 612             Future<Void> future = aafcon.client(CM_VER)
 613                     .delete("/cert/artifacts/"+mechid+"/"+machine,"application/json" );
 614
 615             if (future.get(TIMEOUT)) {
 616                 trans.info().printf("Call to AAF Certman successful %s, %s",mechid,machine);
 617             } else {
 618                 trans.error().printf("Call to AAF Certman failed, %s %s, %s",
 619                     errMsg.toMsg(future),mechid,machine);
 620             }
 621         } finally {
 622             tt.done();
 623         }
 624     }
 625
 626
 627
 628     private static boolean placeCerts(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 629         boolean rv = false;
 630         String mechID = fqi(cmds);
 631         String machine = machine(cmds);
 632         String[] fqdns = Split.split(':', machine);
 633         String key;
 634         if (fqdns.length>1) {
 635             key = fqdns[0];
 636             machine = fqdns[1];
 637         } else {
 638             key = machine;
 639         }
 640
 641         TimeTaken tt = trans.start("Place Artifact", Env.REMOTE);
 642         try {
 643             Future<Artifacts> acf = aafcon.client(CM_VER)
 644                     .read("/cert/artifacts/"+mechID+'/'+key, artifactsDF);
 645             if (acf.get(TIMEOUT)) {
 646                 if (acf.value.getArtifact()==null || acf.value.getArtifact().isEmpty()) {
 647                     AAFSSO.cons.printf("===> There are no artifacts for %s on machine '%s'\n", mechID, key);
 648                 } else {
 649                     for (Artifact a : acf.value.getArtifact()) {
 650                         String osID = System.getProperty("user.name");
 651                         if (a.getOsUser().equals(osID)) {
 652                             CertificateRequest cr = new CertificateRequest();
 653                             cr.setMechid(a.getMechid());
 654                             cr.setSponsor(a.getSponsor());
 655                             for (int i=0;i<fqdns.length;++i) {
 656                                 cr.getFqdns().add(fqdns[i]);
 657                             }
 658                             Future<String> f = aafcon.client(CM_VER)
 659                                     .updateRespondString("/cert/" + a.getCa()+"?withTrust",reqDF, cr);
 660                             if (f.get(TIMEOUT)) {
 661                                 CertInfo capi = certDF.newData().in(TYPE.JSON).load(f.body()).asObject();
 662                                 for (String type : a.getType()) {
 663                                     PlaceArtifact pa = placeArtifact.get(type);
 664                                     if (pa!=null) {
 665                                         if (rv = pa.place(trans, capi, a,machine)) {
 666                                             notifyPlaced(a,rv);
 667                                         }
 668                                     }
 669                                 }
 670                                 // Cover for the above multiple pass possibilities with some static Data, then clear per Artifact
 671                             } else {
 672                                 trans.error().log(errMsg.toMsg(f));
 673                             }
 674                         } else {
 675                             trans.error().log("You must be OS User \"" + a.getOsUser() +"\" to place Certificates on this box");
 676                         }
 677                     }
 678                 }
 679                 PropHolder.writeAll();
 680             } else {
 681                 trans.error().log(errMsg.toMsg(acf));
 682             }
 683         } finally {
 684             tt.done();
 685         }
 686         return rv;
 687     }
 688
 689     private static void notifyPlaced(Artifact a, boolean rv) {
 690     }
 691
 692     private static void showPass(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 693         String mechID = fqi(cmds);
 694         String machine = machine(cmds);
 695
 696         TimeTaken tt = trans.start("Show Password", Env.REMOTE);
 697         try {
 698             Future<Artifacts> acf = aafcon.client(CM_VER)
 699                     .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF);
 700             if (acf.get(TIMEOUT)) {
 701                 // Have to wait for JDK 1.7 source...
 702                 //switch(artifact.getType()) {
 703                 if (acf.value.getArtifact()==null || acf.value.getArtifact().isEmpty()) {
 704                     AAFSSO.cons.printf("No Artifacts found for %s on %s ", mechID, machine);
 705                 } else {
 706                     String id = aafcon.defID();
 707                     boolean allowed;
 708                     for (Artifact a : acf.value.getArtifact()) {
 709                         allowed = id!=null && (id.equals(a.getSponsor()) ||
 710                                 (id.equals(a.getMechid())
 711                                         && aafcon.securityInfo().defSS.getClass().isAssignableFrom(HBasicAuthSS.class)));
 712                         if (!allowed) {
 713                             Future<String> pf = aafcon.client(CM_VER).read("/cert/may/" +
 714                                     a.getNs()+"|certman|"+a.getCa()+"|showpass","*/*");
 715                             if (pf.get(TIMEOUT)) {
 716                                 allowed = true;
 717                             } else {
 718                                 trans.error().log(errMsg.toMsg(pf));
 719                             }
 720                         }
 721                         if (allowed) {
 722                             File dir = new File(a.getDir());
 723                             Properties props = new Properties();
 724                             FileInputStream fis = new FileInputStream(new File(dir,a.getNs()+".cred.props"));
 725                             try {
 726                                 props.load(fis);
 727                                 File chalFile = new File(dir,a.getNs()+".chal");
 728                                 if(chalFile.exists()) {
 729                                     fis.close();
 730                                         fis = new FileInputStream(chalFile);
 731                                         props.load(fis);
 732                                 }
 733                             } finally {
 734                                 fis.close();
 735                             }
 736
 737                             File f = new File(dir,a.getNs()+".keyfile");
 738                             if (f.exists()) {
 739                                 Symm symm = ArtifactDir.getSymm(f);
 740
 741                                 for (Iterator<Entry<Object,Object>> iter = props.entrySet().iterator(); iter.hasNext();) {
 742                                     Entry<Object,Object> en = iter.next();
 743                                     if (en.getValue().toString().startsWith("enc:")) {
 744                                         System.out.printf("%s=%s\n", en.getKey(), symm.depass(en.getValue().toString()));
 745                                     }
 746                                 }
 747                             } else {
 748                                 trans.error().printf("%s.keyfile must exist to read passwords for %s on %s",
 749                                         f.getAbsolutePath(),a.getMechid(), a.getMachine());
 750                             }
 751                         }
 752                     }
 753                 }
 754             } else {
 755                 trans.error().log(errMsg.toMsg(acf));
 756             }
 757         } finally {
 758             tt.done();
 759         }
 760
 761     }
 762
 763     private static void keypairGen(final Trans trans, final PropAccess access, final Deque<String> cmds) throws IOException {
 764         final String fqi = fqi(cmds);
 765         final String ns = FQI.reverseDomain(fqi);
 766         File dir = new File(access.getProperty(Config.CADI_ETCDIR,".")); // default to current Directory
 767         File f = new File(dir,ns+".key");
 768
 769         if (f.exists()) {
 770             String line = AAFSSO.cons.readLine("%s exists. Overwrite? (y/n): ", f.getCanonicalPath());
 771             if (!"Y".equalsIgnoreCase(line)) {
 772                 System.out.println("Canceling...");
 773                 return;
 774             }
 775         }
 776
 777         KeyPair kp = Factory.generateKeyPair(trans);
 778         ArtifactDir.write(f, Chmod.to400, Factory.toString(trans, kp.getPrivate()));
 779         System.out.printf("Wrote %s\n", f.getCanonicalFile());
 780
 781         f=new File(dir,ns+".pubkey");
 782         ArtifactDir.write(f, Chmod.to644, Factory.toString(trans, kp.getPublic()));
 783         System.out.printf("Wrote %s\n", f.getCanonicalFile());
 784     }
 785
 786     private static void config(Trans trans, PropAccess propAccess, String[] args, Deque<String> cmds) throws Exception {
 787         TimeTaken tt = trans.start("Get Configuration", Env.REMOTE);
 788         try {
 789                 final String fqi = fqi(cmds);
 790                 Artifact arti = new Artifact();
 791                 arti.setDir(propAccess.getProperty(Config.CADI_ETCDIR, "."));
 792                 arti.setNs(FQI.reverseDomain(fqi));
 793             PropHolder loc = PropHolder.get(arti, "location.props");
 794             PropHolder cred = PropHolder.get(arti,"cred.props");
 795             PropHolder app= PropHolder.get(arti,"props");
 796             for(String c : args) {
 797                 int idx = c.indexOf('=');
 798                 if(idx>0) {
 799                         app.add(c.substring(0,idx), c.substring(idx+1));
 800                 }
 801             }
 802             app.add(Config.CADI_PROP_FILES, loc.getPath()+':'+cred.getPath());
 803
 804             for (String tag : LOC_TAGS) {
 805                 loc.add(tag, getProperty(propAccess, trans, false, tag, "%s: ",tag));
 806             }
 807
 808             cred.add(Config.CADI_KEYFILE, cred.getKeyPath());
 809             final String ssoAppID = propAccess.getProperty(Config.AAF_APPID);
 810             if(fqi!=null && fqi.equals(ssoAppID)) {
 811                 cred.addEnc(Config.AAF_APPPASS, propAccess, null);
 812             // only Ask for Password when starting scratch
 813             } else if(propAccess.getProperty(Config.CADI_PROP_FILES)==null) {
 814                 char[] pwd = AAFSSO.cons.readPassword("Password for %s: ", fqi);
 815                 if(pwd.length>0) {
 816                         cred.addEnc(Config.AAF_APPPASS, new String(pwd));
 817                 }
 818             }
 819
 820             // load all properties that are already setup.
 821             Map<String, String> aaf_urls = loadURLs(propAccess);
 822             for(Entry<String, String> es : aaf_urls.entrySet()) {
 823                 app.add(es.getKey(), es.getValue());
 824             }
 825
 826             app.add(Config.AAF_LOCATE_URL, propAccess, null);
 827             app.add(Config.AAF_ENV,propAccess, "DEV");
 828             String release = propAccess.getProperty(Config.AAF_RELEASE);
 829             if(release!=null) {
 830                 app.add(Config.AAF_RELEASE, release);
 831             }
 832             for(Entry<Object, Object> aaf_loc_prop : propAccess.getProperties().entrySet()) {
 833                 String key = aaf_loc_prop.getKey().toString();
 834                 if(key.startsWith("aaf_locator")) {
 835                         app.add(key, aaf_loc_prop.getValue().toString());
 836                 }
 837             }
 838
 839             app.add(Config.AAF_APPID, fqi);
 840
 841             String cts = propAccess.getProperty(Config.CADI_TRUSTSTORE);
 842             System.out.println("Passed in Truststore is " + cts);
 843             if (cts!=null) {
 844                 File origTruststore = new File(cts);
 845                 File newTruststore = new File(app.getDir(),origTruststore.getName());
 846                 if(!newTruststore.exists()) {
 847                         if (!origTruststore.exists()) {
 848                             // Try same directory as cadi_prop_files
 849                             String cpf = propAccess.getProperty(Config.CADI_PROP_FILES);
 850                             if (cpf!=null) {
 851                                 for (String f : Split.split(File.pathSeparatorChar, cpf)) {
 852                                     File fcpf = new File(f);
 853                                     if (fcpf.exists()) {
 854                                         int lastSep = cts.lastIndexOf(File.pathSeparator);
 855                                         origTruststore = new File(fcpf.getParentFile(),lastSep>=0?cts.substring(lastSep):cts);
 856                                         if (origTruststore.exists()) {
 857                                             break;
 858                                         }
 859                                     }
 860                                 }
 861                                 if (!origTruststore.exists()) {
 862                                     throw new CadiException(cts + " does not exist");
 863                                 }
 864                             }
 865
 866                         }
 867                         if (!newTruststore.exists() && origTruststore.exists()) {
 868                             Files.copy(origTruststore.toPath(), newTruststore.toPath());
 869                         }
 870                 }
 871
 872                 System.out.println("New Truststore is " + newTruststore);
 873                 cred.add(Config.CADI_TRUSTSTORE, newTruststore.getCanonicalPath());
 874                 cred.add(Config.CADI_TRUSTSTORE_PASSWORD, "changeit" /* Java default */);
 875
 876                 String cpf = propAccess.getProperty(Config.CADI_PROP_FILES);
 877                 if (cpf!=null){
 878                         String[] propFiles = Split.splitTrim(File.pathSeparatorChar, cpf);
 879                     for (int pfi = propFiles.length-1;pfi>=0;--pfi) {
 880                         String f = propFiles[pfi];
 881                         System.out.format("Reading %s\n",f);
 882                         FileInputStream fis = new FileInputStream(f);
 883                         try {
 884                             Properties props = new Properties();
 885                             props.load(fis);
 886                             for (Entry<Object, Object> prop : props.entrySet()) {
 887                                 boolean lower = true;
 888                                 String key = prop.getKey().toString();
 889                                 if(LOC_TAGS.contains(key)) {
 890                                         break;
 891                                 }
 892                                 for(int i=0;lower && i<key.length();++i) {
 893                                         if(Character.isUpperCase(key.charAt(i))) {
 894                                                 lower = false;
 895                                         }
 896                                 }
 897                                 if(lower) {
 898                                         PropHolder ph = CRED_TAGS.contains(key)?cred:app;
 899                                         if(key.endsWith("_password")) {
 900                                                 ph.addEnc(key, prop.getValue().toString());
 901                                         } else {
 902                                                 ph.add(key, prop.getValue().toString());
 903                                         }
 904                                 }
 905                             }
 906                         } finally {
 907                             fis.close();
 908                         }
 909                     }
 910                 } else {
 911                     aafcon = aafcon(propAccess);
 912                     if (aafcon!=null) { // get Properties from Remote AAF
 913                         final String locator = getProperty(propAccess,aafcon.env,false,Config.AAF_LOCATE_URL,"AAF Locator URL: ");
 914
 915                         Future<Configuration> acf = aafcon.client(new SingleEndpointLocator(locator))
 916                                 .read("/configure/"+fqi+"/aaf", configDF);
 917                         if (acf.get(TIMEOUT)) {
 918                             for (Props props : acf.value.getProps()) {
 919                                 PropHolder ph = CRED_TAGS.contains(props.getTag())?cred:app;
 920                                 if(props.getTag().endsWith("_password")) {
 921                                         ph.addEnc(props.getTag(), props.getValue());
 922                                 } else {
 923                                         ph.add(props.getTag(), props.getValue());
 924                                 }
 925                             }
 926                         } else if (acf.code()==401){
 927                             trans.error().log("Bad Password sent to AAF");
 928                         } else if (acf.code()==404){
 929                             trans.error().log("This version of AAF does not support remote Properties");
 930                         } else {
 931                             trans.error().log(errMsg.toMsg(acf));
 932                         }
 933                     }
 934                 }
 935             }
 936
 937             PropHolder.writeAll();
 938         } finally {
 939             tt.done();
 940         }
 941     }
 942
 943
 944     private static void validate(final PropAccess pa) throws LocatorException, CadiException, APIException {
 945         System.out.println("Validating Configuration...");
 946         final AAFCon<?> aafcon = new AAFConHttp(pa,Config.AAF_URL,new SecurityInfoC<HttpURLConnection>(pa));
 947         aafcon.best(new Retryable<Void>() {
 948             @Override
 949             public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException {
 950                 Future<Perms> fc = client.read("/authz/perms/user/"+aafcon.defID(),permDF);
 951                 if (fc.get(aafcon.timeout)) {
 952                     System.out.print("Success connecting to ");
 953                     System.out.println(client.getURI());
 954                     System.out.print("   Permissions for ");
 955                     System.out.println(aafcon.defID());
 956                     for (Perm p : fc.value.getPerm()) {
 957                         System.out.print('\t');
 958                         System.out.print(p.getType());
 959                         System.out.print('|');
 960                         System.out.print(p.getInstance());
 961                         System.out.print('|');
 962                         System.out.println(p.getAction());
 963                     }
 964                 } else {
 965                     System.err.println("Error: " + fc.code() + ' ' + fc.body());
 966                 }
 967                 return null;
 968             }
 969         });
 970     }
 971
 972     /**
 973      * Check returns Error Codes, so that Scripts can know what to do
 974      *
 975      *   0 - Check Complete, nothing to do
 976      *   1 - General Error
 977      *   2 - Error for specific Artifact - read check.msg
 978      *   10 - Certificate Updated - check.msg is email content
 979      *
 980      * @param trans
 981      * @param aafcon
 982      * @param cmds
 983      * @return
 984      * @throws Exception
 985      */
 986     private static int check(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 987         int exitCode=1;
 988         String mechID = fqi(cmds);
 989         String machine = machine(cmds);
 990
 991         TimeTaken tt = trans.start("Check Certificate", Env.REMOTE);
 992         try {
 993
 994             Future<Artifacts> acf = aafcon.client(CM_VER)
 995                     .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF);
 996             if (acf.get(TIMEOUT)) {
 997                 // Have to wait for JDK 1.7 source...
 998                 //switch(artifact.getType()) {
 999                 if (acf.value.getArtifact()==null || acf.value.getArtifact().isEmpty()) {
1000                     AAFSSO.cons.printf("No Artifacts found for %s on %s", mechID, machine);
1001                 } else {
1002                     String id = aafcon.defID();
1003                     GregorianCalendar now = new GregorianCalendar();
1004                     for (Artifact a : acf.value.getArtifact()) {
1005                         if (id.equals(a.getMechid())) {
1006                             File dir = new File(a.getDir());
1007                             Properties props = new Properties();
1008                             FileInputStream fis = new FileInputStream(new File(dir,a.getNs()+".props"));
1009                             try {
1010                                 props.load(fis);
1011                             } finally {
1012                                 fis.close();
1013                             }
1014
1015                             String prop;
1016                             File f;
1017
1018                             if ((prop=trans.getProperty(Config.CADI_KEYFILE))==null ||
1019                                 !(f=new File(prop)).exists()) {
1020                                     trans.error().printf("Keyfile must exist to check Certificates for %s on %s",
1021                                         a.getMechid(), a.getMachine());
1022                             } else {
1023                                 String ksf = trans.getProperty(Config.CADI_KEYSTORE);
1024                                 String ksps = trans.getProperty(Config.CADI_KEYSTORE_PASSWORD);
1025                                 if (ksf==null || ksps == null) {
1026                                     trans.error().printf("Properties %s and %s must exist to check Certificates for %s on %s",
1027                                             Config.CADI_KEYSTORE, Config.CADI_KEYSTORE_PASSWORD,a.getMechid(), a.getMachine());
1028                                 } else {
1029                                     Symm symm = ArtifactDir.getSymm(f);
1030
1031                                     KeyStore ks = KeyStore.getInstance("JKS");
1032
1033                                     fis = new FileInputStream(ksf);
1034                                     try {
1035                                         ks.load(fis,symm.depass(ksps).toCharArray());
1036                                     } finally {
1037                                         fis.close();
1038                                     }
1039                                     X509Certificate cert = (X509Certificate)ks.getCertificate(mechID);
1040                                     String msg = null;
1041
1042                                     if (cert==null) {
1043                                         msg = String.format("X509Certificate does not exist for %s on %s in %s",
1044                                                 a.getMechid(), a.getMachine(), ksf);
1045                                         trans.error().log(msg);
1046                                         exitCode = 2;
1047                                     } else {
1048                                         GregorianCalendar renew = new GregorianCalendar();
1049                                         renew.setTime(cert.getNotAfter());
1050                                         renew.add(GregorianCalendar.DAY_OF_MONTH,-1*a.getRenewDays());
1051                                         if (renew.after(now)) {
1052                                             msg = String.format("X509Certificate for %s on %s has been checked on %s. It expires on %s; it will not be renewed until %s.\n",
1053                                                     a.getMechid(), a.getMachine(),Chrono.dateOnlyStamp(now),cert.getNotAfter(),Chrono.dateOnlyStamp(renew));
1054                                             trans.info().log(msg);
1055                                             exitCode = 0; // OK
1056                                         } else {
1057                                             trans.info().printf("X509Certificate for %s on %s expiration, %s, needs Renewal.\n",
1058                                                     a.getMechid(), a.getMachine(),cert.getNotAfter());
1059                                             cmds.offerLast(mechID);
1060                                             cmds.offerLast(machine);
1061                                             if (placeCerts(trans,aafcon,cmds)) {
1062                                                 msg = String.format("X509Certificate for %s on %s has been renewed. Ensure services using are refreshed.\n",
1063                                                         a.getMechid(), a.getMachine());
1064                                                 exitCode = 10; // Refreshed
1065                                             } else {
1066                                                 msg = String.format("X509Certificate for %s on %s attempted renewal, but failed. Immediate Investigation is required!\n",
1067                                                         a.getMechid(), a.getMachine());
1068                                                 exitCode = 1; // Error Renewing
1069                                             }
1070                                         }
1071                                     }
1072                                     if (msg!=null) {
1073                                         FileOutputStream fos = new FileOutputStream(a.getDir()+'/'+a.getNs()+".msg");
1074                                         try {
1075                                             fos.write(msg.getBytes());
1076                                         } finally {
1077                                             fos.close();
1078                                         }
1079                                     }
1080                                 }
1081
1082                             }
1083                         }
1084                     }
1085                 }
1086             } else {
1087                 trans.error().log(errMsg.toMsg(acf));
1088                 exitCode=1;
1089             }
1090         } finally {
1091             tt.done();
1092         }
1093         return exitCode;
1094     }
1095
1096 }
1097
1098
1099
1100