cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/Agent.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.cadi.configure;
  23
  24 import java.io.File;
  25 import java.io.FileInputStream;
  26 import java.io.FileOutputStream;
  27 import java.io.IOException;
  28 import java.io.PrintStream;
  29 import java.net.ConnectException;
  30 import java.net.HttpURLConnection;
  31 import java.net.InetAddress;
  32 import java.net.UnknownHostException;
  33 import java.nio.file.Files;
  34 import java.security.KeyPair;
  35 import java.security.KeyStore;
  36 import java.security.cert.X509Certificate;
  37 import java.util.ArrayDeque;
  38 import java.util.Arrays;
  39 import java.util.Date;
  40 import java.util.Deque;
  41 import java.util.GregorianCalendar;
  42 import java.util.HashMap;
  43 import java.util.Iterator;
  44 import java.util.List;
  45 import java.util.Map;
  46 import java.util.Map.Entry;
  47 import java.util.Properties;
  48 import java.util.TreeMap;
  49
  50 import org.onap.aaf.cadi.CadiException;
  51 import org.onap.aaf.cadi.CmdLine;
  52 import org.onap.aaf.cadi.LocatorException;
  53 import org.onap.aaf.cadi.PropAccess;
  54 import org.onap.aaf.cadi.Symm;
  55 import org.onap.aaf.cadi.aaf.Defaults;
  56 import org.onap.aaf.cadi.aaf.client.ErrMessage;
  57 import org.onap.aaf.cadi.aaf.v2_0.AAFCon;
  58 import org.onap.aaf.cadi.aaf.v2_0.AAFConHttp;
  59 import org.onap.aaf.cadi.client.Future;
  60 import org.onap.aaf.cadi.client.Rcli;
  61 import org.onap.aaf.cadi.client.Retryable;
  62 import org.onap.aaf.cadi.config.Config;
  63 import org.onap.aaf.cadi.config.SecurityInfoC;
  64 import org.onap.aaf.cadi.http.HBasicAuthSS;
  65 import org.onap.aaf.cadi.locator.SingleEndpointLocator;
  66 import org.onap.aaf.cadi.sso.AAFSSO;
  67 import org.onap.aaf.cadi.util.Chmod;
  68 import org.onap.aaf.cadi.util.FQI;
  69 import org.onap.aaf.misc.env.APIException;
  70 import org.onap.aaf.misc.env.Data.TYPE;
  71 import org.onap.aaf.misc.env.Env;
  72 import org.onap.aaf.misc.env.TimeTaken;
  73 import org.onap.aaf.misc.env.Trans;
  74 import org.onap.aaf.misc.env.util.Chrono;
  75 import org.onap.aaf.misc.env.util.Split;
  76 import org.onap.aaf.misc.rosetta.env.RosettaDF;
  77 import org.onap.aaf.misc.rosetta.env.RosettaEnv;
  78
  79 import aaf.v2_0.Perm;
  80 import aaf.v2_0.Perms;
  81 import certman.v1_0.Artifacts;
  82 import certman.v1_0.Artifacts.Artifact;
  83 import certman.v1_0.CertInfo;
  84 import certman.v1_0.CertificateRequest;
  85 import locate.v1_1.Configuration;
  86 import locate.v1_1.Configuration.Props;
  87
  88 public class Agent {
  89     private static final String HASHES = "################################################################";
  90     private static final String PRINT = "print";
  91     private static final String FILE = "file";
  92     public static final String PKCS12 = "pkcs12";
  93     public static final String JKS = "jks";
  94     private static final String SCRIPT="script";
  95
  96     private static final String CM_VER = "1.0";
  97     public static final int PASS_SIZE = 24;
  98     private static int TIMEOUT;
  99
 100     private static RosettaDF<CertificateRequest> reqDF;
 101     private static RosettaDF<CertInfo> certDF;
 102     private static RosettaDF<Artifacts> artifactsDF;
 103     private static RosettaDF<Configuration> configDF;
 104     private static RosettaDF<Perms> permDF;
 105     private static ErrMessage errMsg;
 106     private static Map<String,PlaceArtifact> placeArtifact;
 107     private static RosettaEnv env;
 108
 109     private static boolean doExit;
 110     private static AAFCon<?> aafcon;
 111
 112     public static void main(String[] args) {
 113         int exitCode = 0;
 114         doExit = true;
 115         if (args.length>0 && "cadi".equals(args[0])) {
 116             String[] newArgs = new String[args.length-1];
 117             System.arraycopy(args, 1, newArgs, 0, newArgs.length);
 118             if (newArgs.length==0) {
 119                 System.out.println(HASHES);
 120                 System.out.println("Note: Cadi CmdLine is a separate component.  When running with\n\t"
 121                         + "Agent, always preface with \"cadi\",\n\tex: cadi keygen [<keyfile>]");
 122                 System.out.println(HASHES);
 123             }
 124             CmdLine.main(newArgs);
 125         } else {
 126             try {
 127                 AAFSSO aafsso=null;
 128                 PropAccess access;
 129
 130                 if (args.length>1 && args[0].equals("validate") ) {
 131                     int idx = args[1].indexOf('=');
 132                     aafsso = null;
 133                     access = new PropAccess(
 134                                 (idx<0?Config.CADI_PROP_FILES:args[1].substring(0, idx))+
 135                                 '='+
 136                                 (idx<0?args[1]:args[1].substring(idx+1)));
 137                 } else {
 138                     aafsso= new AAFSSO(args, new AAFSSO.ProcessArgs() {
 139                         @Override
 140                         public Properties process(String[] args, Properties props) {
 141                             if (args.length>1) {
 142                                 if (!args[0].equals("keypairgen")) {
 143                                     props.put("aaf_id", args[1]);
 144                                 }
 145                             }
 146                             return props;
 147                         }
 148                     });
 149                     access = aafsso.access();
 150                 }
 151
 152                 if (aafsso!=null && aafsso.loginOnly()) {
 153                     aafsso.setLogDefault();
 154                     aafsso.writeFiles();
 155                     System.out.println("AAF SSO information created in ~/.aaf");
 156                 } else {
 157                     env = new RosettaEnv(access.getProperties());
 158                     Deque<String> cmds = new ArrayDeque<String>();
 159                     for (String p : args) {
 160                         if ("-noexit".equalsIgnoreCase(p)) {
 161                             doExit = false;
 162                         } else if (p.indexOf('=') < 0) {
 163                             cmds.add(p);
 164                         }
 165                     }
 166
 167                     if (cmds.size()==0) {
 168                         if (aafsso!=null) {
 169                             aafsso.setLogDefault();
 170                         }
 171                         // NOTE: CHANGE IN CMDS should be reflected in AAFSSO constructor, to get FQI->aaf-id or not
 172                         System.out.println("Usage: java -jar <cadi-aaf-*-full.jar> cmd [<tag=value>]*");
 173                         System.out.println("   create     <FQI> [<machine>]");
 174                         System.out.println("   read       <FQI> [<machine>]");
 175                         System.out.println("   update     <FQI> [<machine>]");
 176                         System.out.println("   delete     <FQI> [<machine>]");
 177                         System.out.println("   copy       <FQI> <machine> <newmachine>[,<newmachine>]*");
 178                         System.out.println("   place      <FQI> [<machine>]");
 179                         System.out.println("   showpass   <FQI> [<machine>]");
 180                         System.out.println("   check      <FQI> [<machine>]");
 181                         System.out.println("   keypairgen <FQI>");
 182                         System.out.println("   config     <FQI>");
 183                         System.out.println("   validate   <NS>.props>");
 184                         System.out.println("   --- Additional Tool Access ---");
 185                         System.out.println("     ** Type with no params for Tool Help");
 186                         System.out.println("     ** If using with Agent, preface with \"cadi\"");
 187                         System.out.println("   cadi <cadi tool params, see -?>");
 188
 189                         if (doExit) {
 190                             System.exit(1);
 191                         }
 192                     }
 193
 194                     TIMEOUT = Integer.parseInt(env.getProperty(Config.AAF_CONN_TIMEOUT, "5000"));
 195
 196                     reqDF = env.newDataFactory(CertificateRequest.class);
 197                     artifactsDF = env.newDataFactory(Artifacts.class);
 198                     certDF = env.newDataFactory(CertInfo.class);
 199                     configDF = env.newDataFactory(Configuration.class);
 200                     permDF = env.newDataFactory(Perms.class);
 201                     errMsg = new ErrMessage(env);
 202
 203                     placeArtifact = new HashMap<>();
 204                     placeArtifact.put(JKS, new PlaceArtifactInKeystore(JKS));
 205                     placeArtifact.put(PKCS12, new PlaceArtifactInKeystore(PKCS12));
 206                     placeArtifact.put(FILE, new PlaceArtifactInFiles());
 207                     placeArtifact.put(PRINT, new PlaceArtifactOnStream(System.out));
 208                     placeArtifact.put(SCRIPT, new PlaceArtifactScripts());
 209
 210                     Trans trans = env.newTrans();
 211                     String token;
 212                     if ((token=access.getProperty("oauth_token"))!=null) {
 213                         trans.setProperty("oauth_token", token);
 214                     }
 215                     try {
 216                         if (aafsso!=null) {
 217                         // show Std out again
 218                             aafsso.setLogDefault();
 219                             aafsso.setStdErrDefault();
 220
 221                             // if CM_URL can be obtained, add to sso.props, if written
 222                             String cm_url = getProperty(access,env,false, Config.CM_URL,Config.CM_URL+": ");
 223                             if (cm_url!=null) {
 224                                 aafsso.addProp(Config.CM_URL, cm_url);
 225                             }
 226                             aafsso.writeFiles();
 227                         }
 228
 229
 230
 231                         String cmd = cmds.removeFirst();
 232                         switch(cmd) {
 233                             case "place":
 234                                 placeCerts(trans,aafcon(access),cmds);
 235                                 break;
 236                             case "create":
 237                                 createArtifact(trans, aafcon(access),cmds);
 238                                 break;
 239                             case "read":
 240                                 readArtifact(trans, aafcon(access), cmds);
 241                                 break;
 242                             case "copy":
 243                                 copyArtifact(trans, aafcon(access), cmds);
 244                                 break;
 245                             case "update":
 246                                 updateArtifact(trans, aafcon(access), cmds);
 247                                 break;
 248                             case "delete":
 249                                 deleteArtifact(trans, aafcon(access), cmds);
 250                                 break;
 251                             case "showpass":
 252                                 showPass(trans, aafcon(access), cmds);
 253                                 break;
 254                             case "keypairgen":
 255                                 keypairGen(trans, access, cmds);
 256                                 break;
 257                             case "config":
 258                                 if (access.getProperty(Config.CADI_PROP_FILES)!=null) {
 259                                     // Get Properties from initialization Prop Files
 260                                     config(trans,access,null,cmds);
 261                                 } else {
 262                                     // Get Properties from existing AAF Instance
 263                                     config(trans,access,aafcon(access),cmds);
 264                                 }
 265                                 break;
 266                             case "validate":
 267                                 validate(access);
 268                                 break;
 269                             case "check":
 270                                 try {
 271                                     exitCode = check(trans,aafcon(access),cmds);
 272                                 } catch (Exception e) {
 273                                     exitCode = 1;
 274                                     throw e;
 275                                 }
 276                                 break;
 277                             default:
 278                                 AAFSSO.cons.printf("Unknown command \"%s\"\n", cmd);
 279                         }
 280                     } finally {
 281                         StringBuilder sb = new StringBuilder();
 282                         trans.auditTrail(4, sb, Trans.REMOTE);
 283                         if (sb.length()>0) {
 284                             trans.info().log("Trans Info\n",sb);
 285                         }
 286                     }
 287                     if (aafsso!=null) {
 288                         aafsso.close();
 289                     }
 290                 }
 291             } catch (Exception e) {
 292                 e.printStackTrace();
 293             }
 294         }
 295         if (exitCode != 0 && doExit) {
 296             System.exit(exitCode);
 297         }
 298     }
 299
 300     private static synchronized AAFCon<?> aafcon(PropAccess access) throws APIException, CadiException, LocatorException {
 301         if (aafcon==null) {
 302             aafcon = new AAFConHttp(access,Config.CM_URL);
 303         }
 304         return aafcon;
 305     }
 306
 307     private static String getProperty(PropAccess pa, Env env, boolean secure, String tag, String prompt, Object ... def) {
 308         String value;
 309         if ((value=pa.getProperty(tag))==null) {
 310             if (secure) {
 311                 value = new String(AAFSSO.cons.readPassword(prompt, def));
 312             } else {
 313                 value = AAFSSO.cons.readLine(prompt,def).trim();
 314             }
 315             if (value!=null) {
 316                 if (value.length()>0) {
 317                     pa.setProperty(tag,value);
 318                     env.setProperty(tag,value);
 319                 } else if (def.length==1) {
 320                     value=def[0].toString();
 321                     pa.setProperty(tag,value);
 322                     env.setProperty(tag,value);
 323                 }
 324             }
 325         }
 326         return value;
 327     }
 328
 329     private static String fqi(Deque<String> cmds) {
 330         if (cmds.size()<1) {
 331             String alias = env.getProperty(Config.CADI_ALIAS);
 332             return alias!=null?alias:AAFSSO.cons.readLine("AppID: ");
 333         }
 334         return cmds.removeFirst();
 335     }
 336
 337     private static String machine(Deque<String> cmds) throws UnknownHostException {
 338         if (cmds.size()>0) {
 339             return cmds.removeFirst();
 340         } else {
 341             String mach = env.getProperty(Config.HOSTNAME);
 342             return mach!=null?mach:InetAddress.getLocalHost().getHostName();
 343         }
 344     }
 345
 346     private static String[] machines(Deque<String> cmds)  {
 347         String machines;
 348         if (cmds.size()>0) {
 349             machines = cmds.removeFirst();
 350         } else {
 351             machines = AAFSSO.cons.readLine("Machines (sep by ','): ");
 352         }
 353         return Split.split(',', machines);
 354     }
 355
 356     private static void createArtifact(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 357         final String mechID = fqi(cmds);
 358         final String machine = machine(cmds);
 359
 360         Artifacts artifacts = new Artifacts();
 361         Artifact arti = new Artifact();
 362         artifacts.getArtifact().add(arti);
 363         arti.setMechid(mechID!=null?mechID:AAFSSO.cons.readLine("AppID: "));
 364         arti.setMachine(machine!=null?machine:AAFSSO.cons.readLine("Machine (%s): ",InetAddress.getLocalHost().getHostName()));
 365         arti.setCa(AAFSSO.cons.readLine("CA: (%s): ","aaf"));
 366
 367         String resp = AAFSSO.cons.readLine("Types [file,pkcs12,jks,script] (%s): ", PKCS12);
 368         for (String s : Split.splitTrim(',', resp)) {
 369             arti.getType().add(s);
 370         }
 371         // Always do Script
 372         if (!resp.contains(SCRIPT)) {
 373             arti.getType().add(SCRIPT);
 374         }
 375
 376         // Note: Sponsor is set on Creation by CM
 377         String configRootName = FQI.reverseDomain(arti.getMechid());
 378         arti.setNs(AAFSSO.cons.readLine("Namespace (%s): ",configRootName));
 379         arti.setDir(AAFSSO.cons.readLine("Directory (%s): ", System.getProperty("user.dir")));
 380         arti.setOsUser(AAFSSO.cons.readLine("OS User (%s): ", System.getProperty("user.name")));
 381         arti.setRenewDays(Integer.parseInt(AAFSSO.cons.readLine("Renewal Days (%s):", "30")));
 382         arti.setNotification(toNotification(AAFSSO.cons.readLine("Notification (mailto owner):", "")));
 383
 384         TimeTaken tt = trans.start("Create Artifact", Env.REMOTE);
 385         try {
 386             Future<Artifacts> future = aafcon.client(CM_VER).create("/cert/artifacts", artifactsDF, artifacts);
 387             if (future.get(TIMEOUT)) {
 388                 trans.info().printf("Call to AAF Certman successful %s, %s",arti.getMechid(), arti.getMachine());
 389             } else {
 390                 trans.error().printf("Call to AAF Certman failed, %s",
 391                     errMsg.toMsg(future));
 392             }
 393         } finally {
 394             tt.done();
 395         }
 396     }
 397
 398     private static String toNotification(String notification) {
 399         if (notification==null) {
 400             notification="";
 401         } else if (notification.length()>0) {
 402             if (notification.indexOf(':')<0) {
 403                 notification = "mailto:" + notification;
 404             }
 405         }
 406         return notification;
 407     }
 408
 409
 410     private static void readArtifact(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 411         String mechID = fqi(cmds);
 412         String machine = machine(cmds);
 413
 414         TimeTaken tt = trans.start("Read Artifact", Env.SUB);
 415         try {
 416             Future<Artifacts> future = aafcon.client(CM_VER)
 417                     .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF,"Authorization","Bearer " + trans.getProperty("oauth_token"));
 418
 419             if (future.get(TIMEOUT)) {
 420                 boolean printed = false;
 421                 for (Artifact a : future.value.getArtifact()) {
 422                     AAFSSO.cons.printf("AppID:          %s\n",a.getMechid());
 423                     AAFSSO.cons.printf("  Sponsor:       %s\n",a.getSponsor());
 424                     AAFSSO.cons.printf("Machine:         %s\n",a.getMachine());
 425                     AAFSSO.cons.printf("CA:              %s\n",a.getCa());
 426                     StringBuilder sb = new StringBuilder();
 427                     boolean first = true;
 428                     for (String t : a.getType()) {
 429                         if (first) {first=false;}
 430                         else{sb.append(',');}
 431                         sb.append(t);
 432                     }
 433                     AAFSSO.cons.printf("Types:           %s\n",sb);
 434                     AAFSSO.cons.printf("Namespace:       %s\n",a.getNs());
 435                     AAFSSO.cons.printf("Directory:       %s\n",a.getDir());
 436                     AAFSSO.cons.printf("O/S User:        %s\n",a.getOsUser());
 437                     AAFSSO.cons.printf("Renew Days:      %d\n",a.getRenewDays());
 438                     AAFSSO.cons.printf("Notification     %s\n",a.getNotification());
 439                     printed = true;
 440                 }
 441                 if (!printed) {
 442                     AAFSSO.cons.printf("Artifact for %s %s does not exist\n", mechID, machine);
 443                 }
 444             } else {
 445                 trans.error().log(errMsg.toMsg(future));
 446             }
 447         } finally {
 448             tt.done();
 449         }
 450     }
 451
 452     private static void copyArtifact(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 453         String mechID = fqi(cmds);
 454         String machine = machine(cmds);
 455         String[] newmachs = machines(cmds);
 456         if (machine==null || newmachs == null) {
 457             trans.error().log("No machines listed to copy to");
 458         } else {
 459             TimeTaken tt = trans.start("Copy Artifact", Env.REMOTE);
 460             try {
 461                 Future<Artifacts> future = aafcon.client(CM_VER)
 462                         .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF);
 463
 464                 if (future.get(TIMEOUT)) {
 465                     boolean printed = false;
 466                     for (Artifact a : future.value.getArtifact()) {
 467                         for (String m : newmachs) {
 468                             a.setMachine(m);
 469                             Future<Artifacts> fup = aafcon.client(CM_VER).update("/cert/artifacts", artifactsDF, future.value);
 470                             if (fup.get(TIMEOUT)) {
 471                                 trans.info().printf("Copy of %s %s successful to %s",mechID,machine,m);
 472                             } else {
 473                                 trans.error().printf("Call to AAF Certman failed, %s",
 474                                     errMsg.toMsg(fup));
 475                             }
 476
 477                             printed = true;
 478                         }
 479                     }
 480                     if (!printed) {
 481                         AAFSSO.cons.printf("Artifact for %s %s does not exist", mechID, machine);
 482                     }
 483                 } else {
 484                     trans.error().log(errMsg.toMsg(future));
 485                 }
 486             } finally {
 487                 tt.done();
 488             }
 489         }
 490     }
 491
 492     private static void updateArtifact(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 493         String mechID = fqi(cmds);
 494         String machine = machine(cmds);
 495
 496         TimeTaken tt = trans.start("Update Artifact", Env.REMOTE);
 497         try {
 498             Future<Artifacts> fread = aafcon.client(CM_VER)
 499                     .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF);
 500
 501             if (fread.get(TIMEOUT)) {
 502                 Artifacts artifacts = new Artifacts();
 503                 for (Artifact a : fread.value.getArtifact()) {
 504                     Artifact arti = new Artifact();
 505                     artifacts.getArtifact().add(arti);
 506
 507                     AAFSSO.cons.printf("For %s on %s\n", a.getMechid(),a.getMachine());
 508                     arti.setMechid(a.getMechid());
 509                     arti.setMachine(a.getMachine());
 510                     arti.setCa(AAFSSO.cons.readLine("CA: (%s): ",a.getCa()));
 511                     StringBuilder sb = new StringBuilder();
 512                     boolean first = true;
 513                     for (String t : a.getType()) {
 514                         if (first) {first=false;}
 515                         else{sb.append(',');}
 516                         sb.append(t);
 517                     }
 518
 519                     String resp = AAFSSO.cons.readLine("Types [file,jks,pkcs12] (%s): ", sb);
 520                     for (String s : Split.splitTrim(',', resp)) {
 521                         arti.getType().add(s);
 522                     }
 523                     // Always do Script
 524                     if (!resp.contains(SCRIPT)) {
 525                         arti.getType().add(SCRIPT);
 526                     }
 527
 528                     // Note: Sponsor is set on Creation by CM
 529                     arti.setNs(AAFSSO.cons.readLine("Namespace (%s): ",a.getNs()));
 530                     arti.setDir(AAFSSO.cons.readLine("Directory (%s): ", a.getDir()));
 531                     arti.setOsUser(AAFSSO.cons.readLine("OS User (%s): ", a.getOsUser()));
 532                     arti.setRenewDays(Integer.parseInt(AAFSSO.cons.readLine("Renew Days (%s):", a.getRenewDays())));
 533                     arti.setNotification(toNotification(AAFSSO.cons.readLine("Notification (%s):", a.getNotification())));
 534
 535                 }
 536                 if (artifacts.getArtifact().size()==0) {
 537                     AAFSSO.cons.printf("Artifact for %s %s does not exist", mechID, machine);
 538                 } else {
 539                     Future<Artifacts> fup = aafcon.client(CM_VER).update("/cert/artifacts", artifactsDF, artifacts);
 540                     if (fup.get(TIMEOUT)) {
 541                         trans.info().printf("Call to AAF Certman successful %s, %s",mechID,machine);
 542                     } else {
 543                         trans.error().printf("Call to AAF Certman failed, %s",
 544                             errMsg.toMsg(fup));
 545                     }
 546                 }
 547             } else {
 548                 trans.error().printf("Call to AAF Certman failed, %s %s, %s",
 549                         errMsg.toMsg(fread),mechID,machine);
 550             }
 551         } finally {
 552             tt.done();
 553         }
 554     }
 555
 556     private static void deleteArtifact(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 557         String mechid = fqi(cmds);
 558         String machine = machine(cmds);
 559
 560         TimeTaken tt = trans.start("Delete Artifact", Env.REMOTE);
 561         try {
 562             Future<Void> future = aafcon.client(CM_VER)
 563                     .delete("/cert/artifacts/"+mechid+"/"+machine,"application/json" );
 564
 565             if (future.get(TIMEOUT)) {
 566                 trans.info().printf("Call to AAF Certman successful %s, %s",mechid,machine);
 567             } else {
 568                 trans.error().printf("Call to AAF Certman failed, %s %s, %s",
 569                     errMsg.toMsg(future),mechid,machine);
 570             }
 571         } finally {
 572             tt.done();
 573         }
 574     }
 575
 576
 577
 578     private static boolean placeCerts(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 579         boolean rv = false;
 580         String mechID = fqi(cmds);
 581         String machine = machine(cmds);
 582         String[] fqdns = Split.split(':', machine);
 583         String key;
 584         if (fqdns.length>1) {
 585             key = fqdns[0];
 586             machine = fqdns[1];
 587         } else {
 588             key = machine;
 589         }
 590
 591         TimeTaken tt = trans.start("Place Artifact", Env.REMOTE);
 592         try {
 593             Future<Artifacts> acf = aafcon.client(CM_VER)
 594                     .read("/cert/artifacts/"+mechID+'/'+key, artifactsDF);
 595             if (acf.get(TIMEOUT)) {
 596                 if (acf.value.getArtifact()==null || acf.value.getArtifact().isEmpty()) {
 597                     AAFSSO.cons.printf("===> There are no artifacts for %s on machine '%s'\n", mechID, key);
 598                 } else {
 599                     for (Artifact a : acf.value.getArtifact()) {
 600                         String osID = System.getProperty("user.name");
 601                         if (a.getOsUser().equals(osID)) {
 602                             CertificateRequest cr = new CertificateRequest();
 603                             cr.setMechid(a.getMechid());
 604                             cr.setSponsor(a.getSponsor());
 605                             for (int i=0;i<fqdns.length;++i) {
 606                                 cr.getFqdns().add(fqdns[i]);
 607                             }
 608                             Future<String> f = aafcon.client(CM_VER)
 609                                     .updateRespondString("/cert/" + a.getCa()+"?withTrust",reqDF, cr);
 610                             if (f.get(TIMEOUT)) {
 611                                 CertInfo capi = certDF.newData().in(TYPE.JSON).load(f.body()).asObject();
 612                                 for (String type : a.getType()) {
 613                                     PlaceArtifact pa = placeArtifact.get(type);
 614                                     if (pa!=null) {
 615                                         if (rv = pa.place(trans, capi, a,machine)) {
 616                                             notifyPlaced(a,rv);
 617                                         }
 618                                     }
 619                                 }
 620                                 // Cover for the above multiple pass possibilities with some static Data, then clear per Artifact
 621                             } else {
 622                                 trans.error().log(errMsg.toMsg(f));
 623                             }
 624                         } else {
 625                             trans.error().log("You must be OS User \"" + a.getOsUser() +"\" to place Certificates on this box");
 626                         }
 627                     }
 628                 }
 629             } else {
 630                 trans.error().log(errMsg.toMsg(acf));
 631             }
 632         } finally {
 633             tt.done();
 634         }
 635         return rv;
 636     }
 637
 638     private static void notifyPlaced(Artifact a, boolean rv) {
 639     }
 640
 641     private static void showPass(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 642         String mechID = fqi(cmds);
 643         String machine = machine(cmds);
 644
 645         TimeTaken tt = trans.start("Show Password", Env.REMOTE);
 646         try {
 647             Future<Artifacts> acf = aafcon.client(CM_VER)
 648                     .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF);
 649             if (acf.get(TIMEOUT)) {
 650                 // Have to wait for JDK 1.7 source...
 651                 //switch(artifact.getType()) {
 652                 if (acf.value.getArtifact()==null || acf.value.getArtifact().isEmpty()) {
 653                     AAFSSO.cons.printf("No Artifacts found for %s on %s ", mechID, machine);
 654                 } else {
 655                     String id = aafcon.defID();
 656                     boolean allowed;
 657                     for (Artifact a : acf.value.getArtifact()) {
 658                         allowed = id!=null && (id.equals(a.getSponsor()) ||
 659                                 (id.equals(a.getMechid())
 660                                         && aafcon.securityInfo().defSS.getClass().isAssignableFrom(HBasicAuthSS.class)));
 661                         if (!allowed) {
 662                             Future<String> pf = aafcon.client(CM_VER).read("/cert/may/" +
 663                                     a.getNs()+"|certman|"+a.getCa()+"|showpass","*/*");
 664                             if (pf.get(TIMEOUT)) {
 665                                 allowed = true;
 666                             } else {
 667                                 trans.error().log(errMsg.toMsg(pf));
 668                             }
 669                         }
 670                         if (allowed) {
 671                             File dir = new File(a.getDir());
 672                             Properties props = new Properties();
 673                             FileInputStream fis = new FileInputStream(new File(dir,a.getNs()+".cred.props"));
 674                             try {
 675                                 props.load(fis);
 676                                 fis.close();
 677                                 fis = new FileInputStream(new File(dir,a.getNs()+".chal"));
 678                                 props.load(fis);
 679                             } finally {
 680                                 fis.close();
 681                             }
 682
 683                             File f = new File(dir,a.getNs()+".keyfile");
 684                             if (f.exists()) {
 685                                 Symm symm = Symm.obtain(f);
 686
 687                                 for (Iterator<Entry<Object,Object>> iter = props.entrySet().iterator(); iter.hasNext();) {
 688                                     Entry<Object,Object> en = iter.next();
 689                                     if (en.getValue().toString().startsWith("enc:")) {
 690                                         System.out.printf("%s=%s\n", en.getKey(), symm.depass(en.getValue().toString()));
 691                                     }
 692                                 }
 693                             } else {
 694                                 trans.error().printf("%s.keyfile must exist to read passwords for %s on %s",
 695                                         f.getAbsolutePath(),a.getMechid(), a.getMachine());
 696                             }
 697                         }
 698                     }
 699                 }
 700             } else {
 701                 trans.error().log(errMsg.toMsg(acf));
 702             }
 703         } finally {
 704             tt.done();
 705         }
 706
 707     }
 708
 709     private static void keypairGen(final Trans trans, final PropAccess access, final Deque<String> cmds) throws IOException {
 710         final String fqi = fqi(cmds);
 711         final String ns = FQI.reverseDomain(fqi);
 712         File dir = new File(access.getProperty(Config.CADI_ETCDIR,".")); // default to current Directory
 713         File f = new File(dir,ns+".key");
 714
 715         if (f.exists()) {
 716             String line = AAFSSO.cons.readLine("%s exists. Overwrite? (y/n): ", f.getCanonicalPath());
 717             if (!"Y".equalsIgnoreCase(line)) {
 718                 System.out.println("Canceling...");
 719                 return;
 720             }
 721         }
 722
 723         KeyPair kp = Factory.generateKeyPair(trans);
 724         ArtifactDir.write(f, Chmod.to400, Factory.toString(trans, kp.getPrivate()));
 725         System.out.printf("Wrote %s\n", f.getCanonicalFile());
 726
 727         f=new File(dir,ns+".pubkey");
 728         ArtifactDir.write(f, Chmod.to644, Factory.toString(trans, kp.getPublic()));
 729         System.out.printf("Wrote %s\n", f.getCanonicalFile());
 730     }
 731
 732     private static void config(Trans trans, PropAccess pa, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 733         final String fqi = fqi(cmds);
 734         final String rootFile = FQI.reverseDomain(fqi);
 735         final File dir = new File(pa.getProperty(Config.CADI_ETCDIR, "."));
 736         if (dir.exists()) {
 737             System.out.println("Writing to " + dir.getCanonicalFile());
 738         } else if (dir.mkdirs()) {
 739             System.out.println("Created directory " + dir.getCanonicalFile());
 740         } else {
 741             System.err.println("Unable to create or write to " + dir.getCanonicalPath());
 742             return;
 743         }
 744
 745         TimeTaken tt = trans.start("Get Configuration", Env.REMOTE);
 746         try {
 747             boolean ok=false;
 748             File fProps = File.createTempFile(rootFile, ".tmp",dir);
 749             File fSecureTempProps = File.createTempFile(rootFile, ".cred.tmp",dir);
 750             File fSecureProps = new File(dir,rootFile+".cred.props");
 751             PrintStream psProps;
 752
 753             File fLocProps = new File(dir,rootFile + ".location.props");
 754             if (!fLocProps.exists()) {
 755                 psProps = new PrintStream(new FileOutputStream(fLocProps));
 756                 try {
 757                     psProps.println(HASHES);
 758                     psProps.print("# Configuration File generated on ");
 759                     psProps.println(new Date().toString());
 760                     psProps.println(HASHES);
 761                     for (String tag : LOC_TAGS) {
 762                         psProps.print(tag);
 763                         psProps.print('=');
 764                         psProps.println(getProperty(pa, trans, false, tag, "%s: ",tag));
 765                     }
 766                 } finally {
 767                     psProps.close();
 768                 }
 769             }
 770
 771             psProps = new PrintStream(new FileOutputStream(fProps));
 772             try {
 773                 PrintStream psCredProps = new PrintStream(new FileOutputStream(fSecureTempProps));
 774                 try {
 775                     psCredProps.println(HASHES);
 776                     psCredProps.print("# Configuration File generated on ");
 777                     psCredProps.println(new Date().toString());
 778                     psCredProps.println(HASHES);
 779
 780                     psProps.println(HASHES);
 781                     psProps.print("# Configuration File generated on ");
 782                     psProps.println(new Date().toString());
 783                     psProps.println(HASHES);
 784
 785                     psProps.print(Config.CADI_PROP_FILES);
 786                     psProps.print('=');
 787                     psProps.print(fSecureProps.getCanonicalPath());
 788                     psProps.print(File.pathSeparatorChar);
 789                     psProps.println(fLocProps.getCanonicalPath());
 790
 791                     File fkf = new File(dir,rootFile+".keyfile");
 792                     if (!fkf.exists()) {
 793                         CmdLine.main(new String[] {"keygen",fkf.toString()});
 794                     }
 795                     Symm filesymm = Symm.obtain(fkf);
 796                     Map<String,String> normal = new TreeMap<>();
 797                     Map<String,String> creds = new TreeMap<>();
 798
 799                     directedPut(pa, filesymm, normal,creds, Config.CADI_KEYFILE, fkf.getCanonicalPath());
 800                     directedPut(pa, filesymm, normal,creds, Config.AAF_APPID,fqi);
 801                     directedPut(pa, filesymm, normal,creds, Config.AAF_APPPASS,null);
 802                     directedPut(pa, filesymm, normal,creds, Config.AAF_URL, Defaults.AAF_URL);
 803
 804
 805                     String cts = pa.getProperty(Config.CADI_TRUSTSTORE);
 806                     if (cts!=null) {
 807                         File origTruststore = new File(cts);
 808                         if (!origTruststore.exists()) {
 809                             // Try same directory as cadi_prop_files
 810                             String cpf = pa.getProperty(Config.CADI_PROP_FILES);
 811                             if (cpf!=null) {
 812                                 for (String f : Split.split(File.pathSeparatorChar, cpf)) {
 813                                     File fcpf = new File(f);
 814                                     if (fcpf.exists()) {
 815                                         int lastSep = cts.lastIndexOf(File.pathSeparator);
 816                                         origTruststore = new File(fcpf.getParentFile(),lastSep>=0?cts.substring(lastSep):cts);
 817                                         if (origTruststore.exists()) {
 818                                             break;
 819                                         }
 820                                     }
 821                                 }
 822                                 if (!origTruststore.exists()) {
 823                                     throw new CadiException(cts + " does not exist");
 824                                 }
 825                             }
 826
 827                         }
 828                         File newTruststore = new File(dir,origTruststore.getName());
 829                         if (!newTruststore.exists()) {
 830                             Files.copy(origTruststore.toPath(), newTruststore.toPath());
 831                         }
 832
 833                         directedPut(pa, filesymm, normal,creds, Config.CADI_TRUSTSTORE,newTruststore.getCanonicalPath());
 834                         directedPut(pa, filesymm, normal,creds, Config.CADI_TRUSTSTORE_PASSWORD,null);
 835                     }
 836
 837                     if (aafcon!=null) { // get Properties from Remote AAF
 838                         final String locator = getProperty(pa,aafcon.env,false,Config.AAF_LOCATE_URL,"AAF Locator URL: ");
 839
 840                         Future<Configuration> acf = aafcon.client(new SingleEndpointLocator(locator))
 841                                 .read("/configure/"+fqi+"/aaf", configDF);
 842                         if (acf.get(TIMEOUT)) {
 843                             for (Props props : acf.value.getProps()) {
 844                                 directedPut(pa, filesymm, normal,creds, props.getTag(),props.getValue());
 845                             }
 846                             ok = true;
 847                         } else if (acf.code()==401){
 848                             trans.error().log("Bad Password sent to AAF");
 849                         } else {
 850                             trans.error().log(errMsg.toMsg(acf));
 851                         }
 852                     } else {
 853                         String cpf = pa.getProperty(Config.CADI_PROP_FILES);
 854                         if (cpf!=null){
 855                             for (String f : Split.split(File.pathSeparatorChar, cpf)) {
 856                                 System.out.format("Reading %s\n",f);
 857                                 FileInputStream fis = new FileInputStream(f);
 858                                 try {
 859                                     Properties props = new Properties();
 860                                     props.load(fis);
 861                                     for (Entry<Object, Object> prop : props.entrySet()) {
 862                                         directedPut(pa, filesymm, normal,creds, prop.getKey().toString(),prop.getValue().toString());
 863                                     }
 864                                 } finally {
 865                                     fis.close();
 866                                 }
 867                             }
 868                         }
 869                         ok = true;
 870                     }
 871                     if (ok) {
 872                         for (Entry<String, String> es : normal.entrySet()) {
 873                             psProps.print(es.getKey());
 874                             psProps.print('=');
 875                             psProps.println(es.getValue());
 876                         }
 877
 878                         for (Entry<String, String> es : creds.entrySet()) {
 879                             psCredProps.print(es.getKey());
 880                             psCredProps.print('=');
 881                             psCredProps.println(es.getValue());
 882                         }
 883
 884                         File newFile = new File(dir,rootFile+".props");
 885                         if (newFile.exists()) {
 886                             File backup = new File(dir,rootFile+".props.backup");
 887                             newFile.renameTo(backup);
 888                             System.out.println("Backed up to " + backup.getCanonicalPath());
 889                         }
 890                         fProps.renameTo(newFile);
 891                         System.out.println("Created " + newFile.getCanonicalPath());
 892                         fProps = newFile;
 893
 894                         if (fSecureProps.exists()) {
 895                             File backup = new File(dir,fSecureProps.getName()+".backup");
 896                             fSecureProps.renameTo(backup);
 897                             System.out.println("Backed up to " + backup.getCanonicalPath());
 898                         }
 899                         fSecureTempProps.renameTo(fSecureProps);
 900                         System.out.println("Created " + fSecureProps.getCanonicalPath());
 901                         fProps = newFile;
 902                     } else {
 903                         fProps.delete();
 904                         fSecureTempProps.delete();
 905                     }
 906                 } finally {
 907                     psCredProps.close();
 908                 }
 909             } finally {
 910                 psProps.close();
 911             }
 912         } finally {
 913             tt.done();
 914         }
 915     }
 916
 917     private static List<String> CRED_TAGS = Arrays.asList(new String[] {
 918             Config.CADI_KEYFILE,
 919             Config.AAF_APPID, Config.AAF_APPPASS,
 920             Config.CADI_KEYSTORE, Config.CADI_KEYSTORE_PASSWORD, Config.CADI_KEY_PASSWORD,
 921             Config.CADI_TRUSTSTORE,Config.CADI_TRUSTSTORE_PASSWORD,
 922             Config.CADI_ALIAS, Config.CADI_X509_ISSUERS
 923             });
 924
 925     private static List<String> LOC_TAGS = Arrays.asList(new String[] {Config.CADI_LATITUDE, Config.CADI_LONGITUDE});
 926
 927     private static void directedPut(final PropAccess orig, final Symm symm, final Map<String,String> main, final Map<String,String> secured, final String tag, final String value) throws IOException {
 928         if (!LOC_TAGS.contains(tag)) { // Location already covered
 929             String val = value==null?orig.getProperty(tag):value;
 930             if (tag.endsWith("_password")) {
 931                 if (val.length()>4) {
 932                     if (val.startsWith("enc:")) {
 933                         val = orig.decrypt(val, true);
 934                     }
 935                     val = "enc:" + symm.enpass(val);
 936                 }
 937             }
 938             if (CRED_TAGS.contains(tag)) {
 939                 secured.put(tag, val);
 940             } else {
 941                 main.put(tag, val);
 942             }
 943         }
 944     }
 945
 946     private static void validate(final PropAccess pa) throws LocatorException, CadiException, APIException {
 947         System.out.println("Validating Configuration...");
 948         final AAFCon<?> aafcon = new AAFConHttp(pa,Config.AAF_URL,new SecurityInfoC<HttpURLConnection>(pa));
 949         aafcon.best(new Retryable<Void>() {
 950             @Override
 951             public Void code(Rcli<?> client) throws CadiException, ConnectException, APIException {
 952                 Future<Perms> fc = client.read("/authz/perms/user/"+aafcon.defID(),permDF);
 953                 if (fc.get(aafcon.timeout)) {
 954                     System.out.print("Success connecting to ");
 955                     System.out.println(client.getURI());
 956                     System.out.print("   Permissions for ");
 957                     System.out.println(aafcon.defID());
 958                     for (Perm p : fc.value.getPerm()) {
 959                         System.out.print('\t');
 960                         System.out.print(p.getType());
 961                         System.out.print('|');
 962                         System.out.print(p.getInstance());
 963                         System.out.print('|');
 964                         System.out.println(p.getAction());
 965                     }
 966                 } else {
 967                     System.err.println("Error: " + fc.code() + ' ' + fc.body());
 968                 }
 969                 return null;
 970             }
 971         });
 972     }
 973
 974     /**
 975      * Check returns Error Codes, so that Scripts can know what to do
 976      *
 977      *   0 - Check Complete, nothing to do
 978      *   1 - General Error
 979      *   2 - Error for specific Artifact - read check.msg
 980      *   10 - Certificate Updated - check.msg is email content
 981      *
 982      * @param trans
 983      * @param aafcon
 984      * @param cmds
 985      * @return
 986      * @throws Exception
 987      */
 988     private static int check(Trans trans, AAFCon<?> aafcon, Deque<String> cmds) throws Exception {
 989         int exitCode=1;
 990         String mechID = fqi(cmds);
 991         String machine = machine(cmds);
 992
 993         TimeTaken tt = trans.start("Check Certificate", Env.REMOTE);
 994         try {
 995
 996             Future<Artifacts> acf = aafcon.client(CM_VER)
 997                     .read("/cert/artifacts/"+mechID+'/'+machine, artifactsDF);
 998             if (acf.get(TIMEOUT)) {
 999                 // Have to wait for JDK 1.7 source...
1000                 //switch(artifact.getType()) {
1001                 if (acf.value.getArtifact()==null || acf.value.getArtifact().isEmpty()) {
1002                     AAFSSO.cons.printf("No Artifacts found for %s on %s", mechID, machine);
1003                 } else {
1004                     String id = aafcon.defID();
1005                     GregorianCalendar now = new GregorianCalendar();
1006                     for (Artifact a : acf.value.getArtifact()) {
1007                         if (id.equals(a.getMechid())) {
1008                             File dir = new File(a.getDir());
1009                             Properties props = new Properties();
1010                             FileInputStream fis = new FileInputStream(new File(dir,a.getNs()+".props"));
1011                             try {
1012                                 props.load(fis);
1013                             } finally {
1014                                 fis.close();
1015                             }
1016
1017                             String prop;
1018                             File f;
1019
1020                             if ((prop=trans.getProperty(Config.CADI_KEYFILE))==null ||
1021                                 !(f=new File(prop)).exists()) {
1022                                     trans.error().printf("Keyfile must exist to check Certificates for %s on %s",
1023                                         a.getMechid(), a.getMachine());
1024                             } else {
1025                                 String ksf = trans.getProperty(Config.CADI_KEYSTORE);
1026                                 String ksps = trans.getProperty(Config.CADI_KEYSTORE_PASSWORD);
1027                                 if (ksf==null || ksps == null) {
1028                                     trans.error().printf("Properties %s and %s must exist to check Certificates for %s on %s",
1029                                             Config.CADI_KEYSTORE, Config.CADI_KEYSTORE_PASSWORD,a.getMechid(), a.getMachine());
1030                                 } else {
1031                                     KeyStore ks = KeyStore.getInstance("JKS");
1032                                     Symm symm = Symm.obtain(f);
1033
1034                                     fis = new FileInputStream(ksf);
1035                                     try {
1036                                         ks.load(fis,symm.depass(ksps).toCharArray());
1037                                     } finally {
1038                                         fis.close();
1039                                     }
1040                                     X509Certificate cert = (X509Certificate)ks.getCertificate(mechID);
1041                                     String msg = null;
1042
1043                                     if (cert==null) {
1044                                         msg = String.format("X509Certificate does not exist for %s on %s in %s",
1045                                                 a.getMechid(), a.getMachine(), ksf);
1046                                         trans.error().log(msg);
1047                                         exitCode = 2;
1048                                     } else {
1049                                         GregorianCalendar renew = new GregorianCalendar();
1050                                         renew.setTime(cert.getNotAfter());
1051                                         renew.add(GregorianCalendar.DAY_OF_MONTH,-1*a.getRenewDays());
1052                                         if (renew.after(now)) {
1053                                             msg = String.format("X509Certificate for %s on %s has been checked on %s. It expires on %s; it will not be renewed until %s.\n",
1054                                                     a.getMechid(), a.getMachine(),Chrono.dateOnlyStamp(now),cert.getNotAfter(),Chrono.dateOnlyStamp(renew));
1055                                             trans.info().log(msg);
1056                                             exitCode = 0; // OK
1057                                         } else {
1058                                             trans.info().printf("X509Certificate for %s on %s expiration, %s, needs Renewal.\n",
1059                                                     a.getMechid(), a.getMachine(),cert.getNotAfter());
1060                                             cmds.offerLast(mechID);
1061                                             cmds.offerLast(machine);
1062                                             if (placeCerts(trans,aafcon,cmds)) {
1063                                                 msg = String.format("X509Certificate for %s on %s has been renewed. Ensure services using are refreshed.\n",
1064                                                         a.getMechid(), a.getMachine());
1065                                                 exitCode = 10; // Refreshed
1066                                             } else {
1067                                                 msg = String.format("X509Certificate for %s on %s attempted renewal, but failed. Immediate Investigation is required!\n",
1068                                                         a.getMechid(), a.getMachine());
1069                                                 exitCode = 1; // Error Renewing
1070                                             }
1071                                         }
1072                                     }
1073                                     if (msg!=null) {
1074                                         FileOutputStream fos = new FileOutputStream(a.getDir()+'/'+a.getNs()+".msg");
1075                                         try {
1076                                             fos.write(msg.getBytes());
1077                                         } finally {
1078                                             fos.close();
1079                                         }
1080                                     }
1081                                 }
1082
1083                             }
1084                         }
1085                     }
1086                 }
1087             } else {
1088                 trans.error().log(errMsg.toMsg(acf));
1089                 exitCode=1;
1090             }
1091         } finally {
1092             tt.done();
1093         }
1094         return exitCode;
1095     }
1096
1097 }
1098
1099
1100
1101