OpenNebula

# -------------------------------------------------------------------------- #

# Copyright 2002-2012, OpenNebula Project Leads (OpenNebula.org)             #

#                                                                            #

# Licensed under the Apache License, Version 2.0 (the "License"); you may    #

# not use this file except in compliance with the License. You may obtain    #

# a copy of the License at                                                   #

#                                                                            #

# http://www.apache.org/licenses/LICENSE-2.0                                 #

#                                                                            #

# Unless required by applicable law or agreed to in writing, software        #

# distributed under the License is distributed on an "AS IS" BASIS,          #

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.   #

# See the License for the specific language governing permissions and        #

# limitations under the License.                                             #

#--------------------------------------------------------------------------- #

require 'openssl'

require 'base64'

require 'fileutils'

require 'yaml'

# X509 authentication class. It can be used as a driver for auth_mad

# as auth method is defined. It also holds some helper methods to be used

# by oneauth command

class X509Auth

    ###########################################################################

    #Constants with paths to relevant files and defaults

    ###########################################################################

    if !ENV["ONE_LOCATION"]

        ETC_LOCATION      = "/etc/one"

    else

        ETC_LOCATION      = ENV["ONE_LOCATION"] + "/etc"

    end

    LOGIN_PATH = ENV['HOME']+'/.one/one_x509'

    X509_AUTH_CONF_PATH = ETC_LOCATION + "/auth/x509_auth.conf"

    X509_DEFAULTS = {

        :ca_dir   => ETC_LOCATION + "/auth/certificates"

    }

    ###########################################################################

    # Initialize x509Auth object

    #

    # @param [Hash] default options for path

    # @option options [String] :certs_pem

    #         cert chain array in colon-separated pem format

    # @option options [String] :key_pem

    #         key in pem format

    # @option options [String] :ca_dir

    #         directory of trusted CA's. Needed for auth method, not for login.

    def initialize(options={})

        @options ||= X509_DEFAULTS

        @options.merge!(options)

        load_options(X509_AUTH_CONF_PATH)

        @cert_chain = @options[:certs_pem].collect do |cert_pem|

            OpenSSL::X509::Certificate.new(cert_pem)

        end

        if @options[:key_pem]

            @key  = OpenSSL::PKey::RSA.new(@options[:key_pem])

        end

    end

    ###########################################################################

    # Client side

    ###########################################################################

    # Creates the login file for x509 authentication at ~/.one/one_x509.

    # By default it is valid as long as the certificate is valid. It can

    # be changed to any number of seconds with expire parameter (sec.)

    def login(user, expire=0)

        write_login(login_token(user,expire))

    end

    # Returns a valid password string to create a user using this auth driver.

    # In this case the dn of the user certificate.

    def password

        @cert_chain[0].subject.to_s.delete("\s")

    end

    # Generates a login token in the form:

    # user_name:x509:user_name:time_expires:cert_chain

    #   - user_name:time_expires is encrypted with the user certificate

    #   - user_name:time_expires:cert_chain is base64 encoded

    def login_token(user, expire)

        if expire != 0

            expires = Time.now.to_i + expire.to_i

        else

            expires = @cert_chain[0].not_after.to_i

        end

        text_to_sign = "#{user}:#{expires}"

        signed_text  = encrypt(text_to_sign)

        certs_pem = @cert_chain.collect{|cert| cert.to_pem}.join(":")

        token     = "#{signed_text}:#{certs_pem}"

        token64   = Base64::encode64(token).strip.delete("\n")

        login_out = "#{user}:#{token64}"

        login_out

    end

    ###########################################################################

    # Server side

    ###########################################################################

    # auth method for auth_mad

    def authenticate(user, pass, signed_text)

        begin

            # Decryption demonstrates that the user posessed the private key.

            _user, expires = decrypt(signed_text).split(':')

            return "User name missmatch" if user != _user

            return "x509 proxy expired"  if Time.now.to_i >= expires.to_i

            # Some DN in the chain must match a DN in the password

            dn_ok = @cert_chain.each do |cert|

                if pass.split('|').include?(cert.subject.to_s.delete("\s"))

                    break true

                end

            end

            unless dn_ok == true

                return "Certificate subject missmatch"

            end

            validate

            return true

        rescue => e

            return e.message

        end

    end

private

    # Writes a login_txt to the login file as defined in LOGIN_PATH

    # constant

    def write_login(login_txt)

        # Inits login file path and creates ~/.one directory if needed

        # Set instance variables

        login_dir = File.dirname(LOGIN_PATH)

        begin

            FileUtils.mkdir_p(login_dir)

        rescue Errno::EEXIST

        end

        file = File.open(LOGIN_PATH, "w")

        file.write(login_txt)

        file.close

        File.chmod(0600,LOGIN_PATH)

    end

    # Load class options form a configuration file (yaml syntax)

    def load_options(conf_file)

        if File.readable?(conf_file)

            conf_txt = File.read(conf_file)

            conf_opt = YAML::load(conf_txt)

            @options.merge!(conf_opt) if conf_opt != false

        end

    end

    ###########################################################################

    #                       Methods to encrpyt/decrypt keys

    ###########################################################################

    # Encrypts data with the private key of the user and returns

    # base 64 encoded output in a single line

    def encrypt(data)

        return nil if !@key

        Base64::encode64(@key.private_encrypt(data)).delete("\n").strip

    end

    # Decrypts base 64 encoded data with pub_key (public key)

    def decrypt(data)

        @cert_chain[0].public_key.public_decrypt(Base64::decode64(data))

    end

    ###########################################################################

    # Validate the user certificate

    ###########################################################################

    def validate

        now    = Time.now

        failed = "Could not validate user credentials: "

        # Check start time and end time of certificates

        @cert_chain.each do |cert|

            if cert.not_before > now || cert.not_after < now

                raise failed +  "Certificate not valid. Current time is " +

                  now.localtime.to_s + "."

            end

        end

        begin

            # Validate the proxy certifcates

            signee = @cert_chain[0]

## FC-Start

          fc_ca_hash = signee.issuer.hash.to_s(16)

          fc_ca_path = @options[:ca_dir] + '/' + fc_ca_hash + '.0'

          fc_ca_cert = OpenSSL::X509::Certificate.new( File.read(fc_ca_path) )

          fc_rl_path = @options[:ca_dir] + '/' + fc_ca_hash + '.r0'

          fc_rl_cert = OpenSSL::X509::CRL.new(         File.read(fc_rl_path) )

          ## First verify the CRL itself with its signer(DOEGrids.pem)

          unless fc_rl_cert.verify( fc_ca_cert.public_key ) then

            raise failed + "CRL is not verified by its Signer"

          end

          fcarray = fc_rl_cert.revoked ## Extract the list of revoked certificates from the CRL

          ## Loop over the list and compare with the target personal certificate

          fcarray.each do |e| 

          if e.serial.eql?(signee.serial) then #  if e.serial == hkcert.serial then

#            puts "A = e.serial and B = signee.serial"

            raise failed + "#{signee.subject.to_s} is found in the CRL, i.e. it is revoked"

          end

        end

## FC-End

            @cert_chain[1..-1].each do |cert|

                if !((signee.issuer.to_s == cert.subject.to_s) &&

                     (signee.verify(cert.public_key)))

                    raise  failed + signee.subject.to_s + " with issuer " +

                           signee.issuer.to_s + " was not verified by " +

                           cert.subject.to_s + "."

                end

                signee = cert

            end

            # Validate the End Entity certificate

            if !@options[:ca_dir]

                raise failed + "No certifcate authority directory was specified."

            end

            begin

                ca_hash = signee.issuer.hash.to_s(16)

                ca_path = @options[:ca_dir] + '/' + ca_hash + '.0'

                ca_cert = OpenSSL::X509::Certificate.new(File.read(ca_path))

                if !((signee.issuer.to_s == ca_cert.subject.to_s) &&

                     (signee.verify(ca_cert.public_key)))

                    raise  failed + signee.subject.to_s + " with issuer " +

                           signee.issuer.to_s + " was not verified by " +

                           ca_cert.subject.to_s + "."

                end

                signee = ca_cert

            end while ca_cert.subject.to_s != ca_cert.issuer.to_s

        rescue

            raise

        end

    end

end