irmaconfig.go 42.7 KB
Newer Older
1
package irma
2
3

import (
4
	"crypto/rsa"
5
6
7
8
9
	"encoding/base64"
	"encoding/xml"
	"io/ioutil"
	"os"
	"path/filepath"
10
	"reflect"
11
	"regexp"
12
	"strconv"
13
	"time"
14

15
16
	"crypto/sha256"

17
18
19
20
	"fmt"

	"strings"

21
22
23
24
25
26
27
28
29
30
	"sort"

	"bytes"

	"encoding/hex"

	"crypto/ecdsa"
	"crypto/x509"
	"encoding/asn1"
	"encoding/pem"
31
	gobig "math/big"
32

33
	"github.com/dgrijalva/jwt-go"
34
	"github.com/go-errors/errors"
Sietse Ringers's avatar
Sietse Ringers committed
35
	"github.com/jasonlvhit/gocron"
36
37
	"github.com/privacybydesign/gabi"
	"github.com/privacybydesign/gabi/big"
38
	"github.com/privacybydesign/irmago/internal/fs"
39
40
)

41
// Configuration keeps track of scheme managers, issuers, credential types and public keys,
42
// dezerializing them from an irma_configuration folder, and downloads and saves new ones on demand.
43
type Configuration struct {
44
45
46
	SchemeManagers  map[SchemeManagerIdentifier]*SchemeManager
	Issuers         map[IssuerIdentifier]*Issuer
	CredentialTypes map[CredentialTypeIdentifier]*CredentialType
47
	AttributeTypes  map[AttributeTypeIdentifier]*AttributeType
48

Sietse Ringers's avatar
Sietse Ringers committed
49
50
51
	// Path to the irma_configuration folder that this instance represents
	Path string

52
53
54
	// DisabledSchemeManagers keeps track of scheme managers that did not parse  succesfully
	// (i.e., invalid signature, parsing error), and the problem that occurred when parsing them
	DisabledSchemeManagers map[SchemeManagerIdentifier]*SchemeManagerError
55

56
57
	Warnings []string

58
	kssPublicKeys map[SchemeManagerIdentifier]map[int]*rsa.PublicKey
59
	publicKeys    map[IssuerIdentifier]map[int]*gabi.PublicKey
60
	privateKeys   map[IssuerIdentifier]*gabi.PrivateKey
61
	reverseHashes map[string]CredentialTypeIdentifier
62
	initialized   bool
63
	assets        string
64
	readOnly      bool
Sietse Ringers's avatar
Sietse Ringers committed
65
	cronchan      chan bool
66
67
}

Sietse Ringers's avatar
Sietse Ringers committed
68
69
// ConfigurationFileHash encodes the SHA256 hash of an authenticated
// file under a scheme manager within the configuration folder.
70
71
type ConfigurationFileHash []byte

Sietse Ringers's avatar
Sietse Ringers committed
72
73
// SchemeManagerIndex is a (signed) list of files under a scheme manager
// along with their SHA266 hash
74
75
type SchemeManagerIndex map[string]ConfigurationFileHash

76
77
type SchemeManagerStatus string

78
79
type SchemeManagerError struct {
	Manager SchemeManagerIdentifier
80
	Status  SchemeManagerStatus
81
82
83
	Err     error
}

84
85
86
87
88
89
90
const (
	SchemeManagerStatusValid               = SchemeManagerStatus("Valid")
	SchemeManagerStatusUnprocessed         = SchemeManagerStatus("Unprocessed")
	SchemeManagerStatusInvalidIndex        = SchemeManagerStatus("InvalidIndex")
	SchemeManagerStatusInvalidSignature    = SchemeManagerStatus("InvalidSignature")
	SchemeManagerStatusParsingError        = SchemeManagerStatus("ParsingError")
	SchemeManagerStatusContentParsingError = SchemeManagerStatus("ContentParsingError")
91

92
93
	pubkeyPattern  = "%s/%s/%s/PublicKeys/*.xml"
	privkeyPattern = "%s/%s/%s/PrivateKeys/*.xml"
94
95
)

96
97
98
99
func (sme SchemeManagerError) Error() string {
	return fmt.Sprintf("Error parsing scheme manager %s: %s", sme.Manager.Name(), sme.Err.Error())
}

100
// newConfiguration returns a new configuration. After this
101
// ParseFolder() should be called to parse the specified path.
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
func NewConfiguration(path string) (*Configuration, error) {
	return newConfiguration(path, "")
}

func NewConfigurationReadOnly(path string) (*Configuration, error) {
	conf, err := newConfiguration(path, "")
	if err != nil {
		return nil, err
	}
	conf.readOnly = true
	return conf, nil
}

func NewConfigurationFromAssets(path, assets string) (*Configuration, error) {
	return newConfiguration(path, assets)
}

func newConfiguration(path string, assets string) (conf *Configuration, err error) {
120
	conf = &Configuration{
Sietse Ringers's avatar
Sietse Ringers committed
121
		Path:   path,
122
		assets: assets,
123
	}
124

125
126
127
128
	if conf.assets != "" { // If an assets folder is specified, then it must exist
		if err = fs.AssertPathExists(conf.assets); err != nil {
			return nil, errors.WrapPrefix(err, "Nonexistent assets folder specified", 0)
		}
129
	}
130
	if err = fs.EnsureDirectoryExists(conf.Path); err != nil {
131
132
		return nil, err
	}
133

134
135
136
	// Init all maps
	conf.clear()

137
138
139
	return
}

140
func (conf *Configuration) clear() {
141
142
143
	conf.SchemeManagers = make(map[SchemeManagerIdentifier]*SchemeManager)
	conf.Issuers = make(map[IssuerIdentifier]*Issuer)
	conf.CredentialTypes = make(map[CredentialTypeIdentifier]*CredentialType)
144
	conf.AttributeTypes = make(map[AttributeTypeIdentifier]*AttributeType)
145
	conf.DisabledSchemeManagers = make(map[SchemeManagerIdentifier]*SchemeManagerError)
146
	conf.kssPublicKeys = make(map[SchemeManagerIdentifier]map[int]*rsa.PublicKey)
147
	conf.publicKeys = make(map[IssuerIdentifier]map[int]*gabi.PublicKey)
148
	conf.privateKeys = make(map[IssuerIdentifier]*gabi.PrivateKey)
149
	conf.reverseHashes = make(map[string]CredentialTypeIdentifier)
150
151
152
153
154
155
156
}

// ParseFolder populates the current Configuration by parsing the storage path,
// listing the containing scheme managers, issuers and credential types.
func (conf *Configuration) ParseFolder() (err error) {
	// Init all maps
	conf.clear()
157

158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
	// Copy any new or updated scheme managers out of the assets into storage
	if conf.assets != "" {
		err = iterateSubfolders(conf.assets, func(dir string) error {
			scheme := NewSchemeManagerIdentifier(filepath.Base(dir))
			uptodate, err := conf.isUpToDate(scheme)
			if err != nil {
				return err
			}
			if !uptodate {
				_, err = conf.CopyManagerFromAssets(scheme)
			}
			return err
		})
		if err != nil {
			return err
		}
	}

	// Parse scheme managers in storage
177
	var mgrerr *SchemeManagerError
Sietse Ringers's avatar
Sietse Ringers committed
178
	err = iterateSubfolders(conf.Path, func(dir string) error {
179
180
		manager := NewSchemeManager(filepath.Base(dir))
		err := conf.ParseSchemeManagerFolder(dir, manager)
181
182
		if err == nil {
			return nil // OK, do next scheme manager folder
183
		}
184
185
186
187
		// If there is an error, and it is of type SchemeManagerError, return nil
		// so as to continue parsing other managers.
		var ok bool
		if mgrerr, ok = err.(*SchemeManagerError); ok {
188
			conf.DisabledSchemeManagers[manager.Identifier()] = mgrerr
189
			return nil
190
		}
191
		return err // Not a SchemeManagerError? return it & halt parsing now
192
193
	})
	if err != nil {
194
		return
195
	}
196
	conf.initialized = true
197
198
199
	if mgrerr != nil {
		return mgrerr
	}
200
	return
201
202
}

203
204
205
206
207
208
209
// ParseOrRestoreFolder parses the irma_configuration folder, and when possible attempts to restore
// any broken scheme managers from their remote.
// Any error encountered during parsing is considered recoverable only if it is of type *SchemeManagerError;
// In this case the scheme in which it occured is downloaded from its remote and re-parsed.
// If any other error is encountered at any time, it is returned immediately.
// If no error is returned, parsing and possibly restoring has been succesfull, and there should be no
// disabled scheme managers.
210
211
func (conf *Configuration) ParseOrRestoreFolder() error {
	err := conf.ParseFolder()
212
213
214
	// Only in case of a *SchemeManagerError might we be able to recover
	if _, isSchemeMgrErr := err.(*SchemeManagerError); !isSchemeMgrErr {
		return err
215
	}
216
217
218
	if err != nil && (conf.assets == "" || conf.readOnly) {
		return err
	}
219
220

	for id := range conf.DisabledSchemeManagers {
221
222
223
224
225
226
227
228
229
		if err = conf.ReinstallSchemeManager(conf.SchemeManagers[id]); err == nil {
			continue
		}
		if _, err = conf.CopyManagerFromAssets(id); err != nil {
			return err // File system error, too serious, bail out now
		}
		name := id.String()
		if err = conf.ParseSchemeManagerFolder(filepath.Join(conf.Path, name), NewSchemeManager(name)); err == nil {
			delete(conf.DisabledSchemeManagers, id)
230
		}
231
	}
232

233
234
235
	return err
}

236
// ParseSchemeManagerFolder parses the entire tree of the specified scheme manager
237
// If err != nil then a problem occured
238
func (conf *Configuration) ParseSchemeManagerFolder(dir string, manager *SchemeManager) (err error) {
239
240
241
242
243
244
245
	// From this point, keep it in our map even if it has an error. The user must check either:
	// - manager.Status == SchemeManagerStatusValid, aka "VALID"
	// - or equivalently, manager.Valid == true
	// before using any scheme manager for anything, and handle accordingly
	conf.SchemeManagers[manager.Identifier()] = manager

	// Ensure we return a SchemeManagerError when any error occurs
246
247
	defer func() {
		if err != nil {
248
249
250
251
252
			err = &SchemeManagerError{
				Manager: manager.Identifier(),
				Err:     err,
				Status:  manager.Status,
			}
253
254
255
		}
	}()

256
257
	// Verify signature and read scheme manager description
	if err = conf.VerifySignature(manager.Identifier()); err != nil {
258
259
		return
	}
260
	if manager.index, err = conf.parseIndex(filepath.Base(dir), manager); err != nil {
261
262
		manager.Status = SchemeManagerStatusInvalidIndex
		return
263
	}
264
265
266
267
268
	exists, err := conf.pathToDescription(manager, dir+"/description.xml", manager)
	if !exists {
		manager.Status = SchemeManagerStatusParsingError
		return errors.New("Scheme manager description not found")
	}
269
270
271
	if err != nil {
		manager.Status = SchemeManagerStatusParsingError
		return
272
	}
273
274
	if err = conf.checkScheme(manager, dir); err != nil {
		return
275
	}
276
277
278
279
280
281
282

	// Verify that all other files are validly signed
	err = conf.VerifySchemeManager(manager)
	if err != nil {
		manager.Status = SchemeManagerStatusInvalidSignature
		return
	}
283

284
	// Read timestamp indicating time of last modification
285
286
287
	ts, exists, err := readTimestamp(dir + "/timestamp")
	if err != nil || !exists {
		return errors.WrapPrefix(err, "Could not read scheme manager timestamp", 0)
288
	}
289
	manager.Timestamp = *ts
290

291
	// Parse contained issuers and credential types
292
	err = conf.parseIssuerFolders(manager, dir)
293
294
295
296
297
298
	if err != nil {
		manager.Status = SchemeManagerStatusContentParsingError
		return
	}
	manager.Status = SchemeManagerStatusValid
	manager.Valid = true
299
300
301
	return
}

302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
// relativePath returns, given a outer path that contains the inner path,
// the relative path between outer an inner, which is such that
// outer/returnvalue refers to inner.
func relativePath(outer string, inner string) (string, error) {
	// Take Abs() of both paths to ensure that we don't fail on e.g.
	// outer = "./foo" and inner = "foo/bar"
	outerAbs, err := filepath.Abs(outer)
	if err != nil {
		return "", err
	}
	innerAbs, err := filepath.Abs(inner)
	if err != nil {
		return "", err
	}
	if !strings.HasPrefix(innerAbs, outerAbs) {
		return "", errors.New("inner path is not contained in outer path")
	}

	return innerAbs[len(outerAbs)+1:], nil
321
322
}

323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
// PrivateKey returns the specified private key, or nil if not present in the Configuration.
func (conf *Configuration) PrivateKey(id IssuerIdentifier) (*gabi.PrivateKey, error) {
	if sk := conf.privateKeys[id]; sk != nil {
		return sk, nil
	}

	path := fmt.Sprintf(privkeyPattern, conf.Path, id.SchemeManagerIdentifier().Name(), id.Name())
	files, err := filepath.Glob(path)
	if err != nil {
		return nil, err
	}
	if len(files) == 0 {
		return nil, nil
	}

	// List private keys and get highest counter
	counters := make([]int, 0, len(files))
	for _, file := range files {
		filename := filepath.Base(file)
		count := filename[:len(filename)-4]
		i, err := strconv.Atoi(count)
		if err != nil {
			return nil, err
		}
		counters = append(counters, i)
	}
	sort.Ints(counters)
	counter := counters[len(counters)-1]

	// Read private key
	file := strings.Replace(path, "*", strconv.Itoa(counter), 1)
	sk, err := gabi.NewPrivateKeyFromFile(file)
	if err != nil {
		return nil, err
	}
	if int(sk.Counter) != counter {
		return nil, errors.Errorf("Private key %s of issuer %s has wrong <Counter>", file, id.String())
	}
	conf.privateKeys[id] = sk

	return sk, nil
}

366
367
// PublicKey returns the specified public key, or nil if not present in the Configuration.
func (conf *Configuration) PublicKey(id IssuerIdentifier, counter int) (*gabi.PublicKey, error) {
368
369
370
371
372
373
374
375
376
377
378
	var haveIssuer, haveKey bool
	var err error
	_, haveIssuer = conf.publicKeys[id]
	if haveIssuer {
		_, haveKey = conf.publicKeys[id][counter]
	}

	// If we have not seen this issuer or key before in conf.publicKeys,
	// try to parse the public key folder; new keys might have been put there since we last parsed it
	if !haveIssuer || !haveKey {
		if err = conf.parseKeysFolder(id); err != nil {
379
			return nil, err
380
381
		}
	}
382
	return conf.publicKeys[id][counter], nil
383
384
}

385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
// KeyshareServerKeyFunc returns a function that returns the public key with which to verify a keyshare server JWT,
// suitable for passing to jwt.Parse() and jwt.ParseWithClaims().
func (conf *Configuration) KeyshareServerKeyFunc(scheme SchemeManagerIdentifier) func(t *jwt.Token) (interface{}, error) {
	return func(t *jwt.Token) (i interface{}, e error) {
		var kid int
		if kidstr, ok := t.Header["kid"].(string); ok {
			var err error
			if kid, err = strconv.Atoi(kidstr); err != nil {
				return nil, err
			}
		}
		return conf.KeyshareServerPublicKey(scheme, kid)
	}
}

// KeyshareServerPublicKey returns the i'th public key of the specified scheme.
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
func (conf *Configuration) KeyshareServerPublicKey(scheme SchemeManagerIdentifier, i int) (*rsa.PublicKey, error) {
	if _, contains := conf.kssPublicKeys[scheme]; !contains {
		conf.kssPublicKeys[scheme] = make(map[int]*rsa.PublicKey)
	}
	if _, contains := conf.kssPublicKeys[scheme][i]; !contains {
		pkbts, err := ioutil.ReadFile(filepath.Join(conf.Path, scheme.Name(), fmt.Sprintf("kss-%d.pem", i)))
		if err != nil {
			return nil, err
		}
		pkblk, _ := pem.Decode(pkbts)
		genericPk, err := x509.ParsePKIXPublicKey(pkblk.Bytes)
		if err != nil {
			return nil, err
		}
		pk, ok := genericPk.(*rsa.PublicKey)
		if !ok {
			return nil, errors.New("Invalid keyshare server public key")
		}
		conf.kssPublicKeys[scheme][i] = pk
	}
	return conf.kssPublicKeys[scheme][i], nil
}

424
func (conf *Configuration) addReverseHash(credid CredentialTypeIdentifier) {
425
	hash := sha256.Sum256([]byte(credid.String()))
426
	conf.reverseHashes[base64.StdEncoding.EncodeToString(hash[:16])] = credid
427
428
}

429
430
431
func (conf *Configuration) hashToCredentialType(hash []byte) *CredentialType {
	if str, exists := conf.reverseHashes[base64.StdEncoding.EncodeToString(hash)]; exists {
		return conf.CredentialTypes[str]
432
433
434
435
	}
	return nil
}

436
// IsInitialized indicates whether this instance has successfully been initialized.
437
438
func (conf *Configuration) IsInitialized() bool {
	return conf.initialized
439
440
}

441
442
443
444
445
446
447
448
449
// Prune removes any invalid scheme managers and everything they own from this Configuration
func (conf *Configuration) Prune() {
	for _, manager := range conf.SchemeManagers {
		if !manager.Valid {
			_ = conf.RemoveSchemeManager(manager.Identifier(), false) // does not return errors
		}
	}
}

450
func (conf *Configuration) parseIssuerFolders(manager *SchemeManager, path string) error {
451
452
	return iterateSubfolders(path, func(dir string) error {
		issuer := &Issuer{}
453
		exists, err := conf.pathToDescription(manager, dir+"/description.xml", issuer)
454
455
456
		if err != nil {
			return err
		}
457
458
		if !exists {
			return nil
459
		}
460
461
462
		if issuer.XMLVersion < 4 {
			return errors.New("Unsupported issuer description")
		}
463

464
		if err = conf.checkIssuer(manager, issuer, dir); err != nil {
465
466
467
			return err
		}

468
		conf.Issuers[issuer.Identifier()] = issuer
469
		issuer.Valid = conf.SchemeManagers[issuer.SchemeManagerIdentifier()].Valid
470
		return conf.parseCredentialsFolder(manager, issuer, dir+"/Issues/")
471
472
473
	})
}

474
475
476
func (conf *Configuration) DeleteSchemeManager(id SchemeManagerIdentifier) error {
	delete(conf.SchemeManagers, id)
	delete(conf.DisabledSchemeManagers, id)
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
	name := id.String()
	for iss := range conf.Issuers {
		if iss.Root() == name {
			delete(conf.Issuers, iss)
		}
	}
	for iss := range conf.publicKeys {
		if iss.Root() == name {
			delete(conf.publicKeys, iss)
		}
	}
	for cred := range conf.CredentialTypes {
		if cred.Root() == name {
			delete(conf.CredentialTypes, cred)
		}
	}
493
494
495
496
	if !conf.readOnly {
		return os.RemoveAll(filepath.Join(conf.Path, id.Name()))
	}
	return nil
497
498
}

499
// parse $schememanager/$issuer/PublicKeys/$i.xml for $i = 1, ...
500
501
func (conf *Configuration) parseKeysFolder(issuerid IssuerIdentifier) error {
	manager := conf.SchemeManagers[issuerid.SchemeManagerIdentifier()]
502
	conf.publicKeys[issuerid] = map[int]*gabi.PublicKey{}
503
	path := fmt.Sprintf(pubkeyPattern, conf.Path, issuerid.SchemeManagerIdentifier().Name(), issuerid.Name())
504
505
506
507
508
509
510
511
512
513
	files, err := filepath.Glob(path)
	if err != nil {
		return err
	}

	for _, file := range files {
		filename := filepath.Base(file)
		count := filename[:len(filename)-4]
		i, err := strconv.Atoi(count)
		if err != nil {
514
			return err
515
		}
516
517
518
519
520
		relativepath, err := relativePath(conf.Path, file)
		if err != nil {
			return err
		}
		bts, found, err := conf.ReadAuthenticatedFile(manager, relativepath)
521
		if err != nil || !found {
522
523
524
			return err
		}
		pk, err := gabi.NewPublicKeyFromBytes(bts)
525
526
527
		if err != nil {
			return err
		}
528
529
530
		if int(pk.Counter) != i {
			return errors.Errorf("Public key %s of issuer %s has wrong <Counter>", file, issuerid.String())
		}
531
		pk.Issuer = issuerid.String()
532
		conf.publicKeys[issuerid][i] = pk
533
	}
534

535
536
537
	return nil
}

538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
func (conf *Configuration) PublicKeyIndices(issuerid IssuerIdentifier) (i []int, err error) {
	return conf.matchKeyPattern(issuerid, pubkeyPattern)
}

func (conf *Configuration) matchKeyPattern(issuerid IssuerIdentifier, pattern string) (i []int, err error) {
	pkpath := fmt.Sprintf(pattern, conf.Path, issuerid.SchemeManagerIdentifier().Name(), issuerid.Name())
	files, err := filepath.Glob(pkpath)
	if err != nil {
		return
	}
	for _, file := range files {
		var count int
		base := filepath.Base(file)
		if count, err = strconv.Atoi(base[:len(base)-4]); err != nil {
			return
		}
		i = append(i, count)
	}
	sort.Ints(i)
	return
}

560
// parse $schememanager/$issuer/Issues/*/description.xml
561
562
563
func (conf *Configuration) parseCredentialsFolder(manager *SchemeManager, issuer *Issuer, path string) error {
	var foundcred bool
	err := iterateSubfolders(path, func(dir string) error {
564
		cred := &CredentialType{}
565
		exists, err := conf.pathToDescription(manager, dir+"/description.xml", cred)
566
567
568
		if err != nil {
			return err
		}
569
570
571
		if !exists {
			return nil
		}
572
		if err = conf.checkCredentialType(manager, issuer, cred, dir); err != nil {
573
574
575
576
			return err
		}
		foundcred = true
		cred.Valid = conf.SchemeManagers[cred.SchemeManagerIdentifier()].Valid
577
		credid := cred.Identifier()
578
579
		conf.CredentialTypes[credid] = cred
		conf.addReverseHash(credid)
580
		for index, attr := range cred.AttributeTypes {
581
582
583
584
			attr.Index = index
			attr.SchemeManagerID = cred.SchemeManagerID
			attr.IssuerID = cred.IssuerID
			attr.CredentialTypeID = cred.ID
585
			conf.AttributeTypes[attr.GetAttributeTypeIdentifier()] = attr
586
		}
587
588
		return nil
	})
589
590
591
592
593
594
	if !foundcred {
		conf.Warnings = append(conf.Warnings, fmt.Sprintf("Issuer %s has no credential types", issuer.Identifier().String()))
	}
	return err
}

595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
// iterateSubfolders iterates over the subfolders of the specified path,
// calling the specified handler each time. If anything goes wrong, or
// if the caller returns a non-nil error, an error is immediately returned.
func iterateSubfolders(path string, handler func(string) error) error {
	dirs, err := filepath.Glob(path + "/*")
	if err != nil {
		return err
	}

	for _, dir := range dirs {
		stat, err := os.Stat(dir)
		if err != nil {
			return err
		}
		if !stat.IsDir() {
			continue
		}
612
613
614
		if strings.HasSuffix(dir, "/.git") {
			continue
		}
615
616
617
618
619
620
621
622
623
		err = handler(dir)
		if err != nil {
			return err
		}
	}

	return nil
}

624
func (conf *Configuration) pathToDescription(manager *SchemeManager, path string, description interface{}) (bool, error) {
625
626
627
628
	if _, err := os.Stat(path); err != nil {
		return false, nil
	}

629
630
631
632
633
	relativepath, err := relativePath(conf.Path, path)
	if err != nil {
		return false, err
	}
	bts, found, err := conf.ReadAuthenticatedFile(manager, relativepath)
634
635
636
	if !found {
		return false, nil
	}
637
638
639
640
	if err != nil {
		return true, err
	}

641
	err = xml.Unmarshal(bts, description)
642
643
644
645
646
647
	if err != nil {
		return true, err
	}

	return true, nil
}
648

649
650
651
652
653
// Contains checks if the configuration contains the specified credential type.
func (conf *Configuration) Contains(cred CredentialTypeIdentifier) bool {
	return conf.SchemeManagers[cred.IssuerIdentifier().SchemeManagerIdentifier()] != nil &&
		conf.Issuers[cred.IssuerIdentifier()] != nil &&
		conf.CredentialTypes[cred] != nil
654
}
655

656
func (conf *Configuration) isUpToDate(scheme SchemeManagerIdentifier) (bool, error) {
657
	if conf.assets == "" || conf.readOnly {
658
659
		return true, nil
	}
660
661
662
663
	name := scheme.String()
	newTime, exists, err := readTimestamp(filepath.Join(conf.assets, name, "timestamp"))
	if err != nil || !exists {
		return true, errors.WrapPrefix(err, "Could not read asset timestamp of scheme "+name, 0)
664
	}
665
666
667
668
	// The storage version of the manager does not need to have a timestamp. If it does not, it is outdated.
	oldTime, exists, err := readTimestamp(filepath.Join(conf.Path, name, "timestamp"))
	if err != nil {
		return true, err
669
	}
670
	return exists && !newTime.After(*oldTime), nil
671
672
}

673
func (conf *Configuration) CopyManagerFromAssets(scheme SchemeManagerIdentifier) (bool, error) {
674
	if conf.assets == "" || conf.readOnly {
675
		return false, nil
676
	}
677
678
679
680
681
	// Remove old version; we want an exact copy of the assets version
	// not a merge of the assets version and the storage version
	name := scheme.String()
	if err := os.RemoveAll(filepath.Join(conf.Path, name)); err != nil {
		return false, err
682
	}
683
684
685
	return true, fs.CopyDirectory(
		filepath.Join(conf.assets, name),
		filepath.Join(conf.Path, name),
686
687
688
	)
}

689
690
// DownloadSchemeManager downloads and returns a scheme manager description.xml file
// from the specified URL.
691
func DownloadSchemeManager(url string) (*SchemeManager, error) {
692
693
694
695
696
697
698
699
700
	if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") {
		url = "https://" + url
	}
	if url[len(url)-1] == '/' {
		url = url[:len(url)-1]
	}
	if strings.HasSuffix(url, "/description.xml") {
		url = url[:len(url)-len("/description.xml")]
	}
701
	b, err := NewHTTPTransport(url).GetBytes("description.xml")
702
703
704
	if err != nil {
		return nil, err
	}
705
	manager := NewSchemeManager("")
706
707
708
709
710
711
712
713
	if err = xml.Unmarshal(b, manager); err != nil {
		return nil, err
	}

	manager.URL = url // TODO?
	return manager, nil
}

Sietse Ringers's avatar
Sietse Ringers committed
714
715
// RemoveSchemeManager removes the specified scheme manager and all associated issuers,
// public keys and credential types from this Configuration.
716
func (conf *Configuration) RemoveSchemeManager(id SchemeManagerIdentifier, fromStorage bool) error {
717
	// Remove everything falling under the manager's responsibility
718
	for credid := range conf.CredentialTypes {
719
		if credid.IssuerIdentifier().SchemeManagerIdentifier() == id {
720
			delete(conf.CredentialTypes, credid)
721
722
		}
	}
723
	for issid := range conf.Issuers {
724
		if issid.SchemeManagerIdentifier() == id {
725
			delete(conf.Issuers, issid)
726
727
		}
	}
728
	for issid := range conf.publicKeys {
729
		if issid.SchemeManagerIdentifier() == id {
730
			delete(conf.publicKeys, issid)
731
732
		}
	}
733
	delete(conf.SchemeManagers, id)
734

735
	if fromStorage || !conf.readOnly {
Sietse Ringers's avatar
Sietse Ringers committed
736
		return os.RemoveAll(fmt.Sprintf("%s/%s", conf.Path, id.String()))
737
738
	}
	return nil
739
740
}

741
func (conf *Configuration) ReinstallSchemeManager(manager *SchemeManager) (err error) {
742
743
744
745
	if conf.readOnly {
		return errors.New("cannot install scheme into a read-only configuration")
	}

746
747
748
749
750
751
752
753
754
	// Check if downloading stuff from the remote works before we uninstall the specified manager:
	// If we can't download anything we should keep the broken version
	manager, err = DownloadSchemeManager(manager.URL)
	if err != nil {
		return
	}
	if err = conf.DeleteSchemeManager(manager.Identifier()); err != nil {
		return
	}
755
	err = conf.InstallSchemeManager(manager, nil)
756
757
758
	return
}

759
// InstallSchemeManager downloads and adds the specified scheme manager to this Configuration,
Sietse Ringers's avatar
Sietse Ringers committed
760
// provided its signature is valid.
761
func (conf *Configuration) InstallSchemeManager(manager *SchemeManager, publickey []byte) error {
762
763
764
765
	if conf.readOnly {
		return errors.New("cannot install scheme into a read-only configuration")
	}

766
	name := manager.ID
767
	if err := fs.EnsureDirectoryExists(filepath.Join(conf.Path, name)); err != nil {
768
769
		return err
	}
770
771

	t := NewHTTPTransport(manager.URL)
Sietse Ringers's avatar
Sietse Ringers committed
772
	path := fmt.Sprintf("%s/%s", conf.Path, name)
773
774
775
	if err := t.GetFile("description.xml", path+"/description.xml"); err != nil {
		return err
	}
776
777
778
779
780
781
782
783
	if publickey != nil {
		if err := fs.SaveFile(path+"/pk.pem", publickey); err != nil {
			return err
		}
	} else {
		if err := t.GetFile("pk.pem", path+"/pk.pem"); err != nil {
			return err
		}
784
	}
785
	if err := conf.DownloadSchemeManagerSignature(manager); err != nil {
786
787
		return err
	}
788
789
790
791
	conf.SchemeManagers[manager.Identifier()] = manager
	if err := conf.UpdateSchemeManager(manager.Identifier(), nil); err != nil {
		return err
	}
792

793
	return conf.ParseSchemeManagerFolder(filepath.Join(conf.Path, name), manager)
794
795
796
797
798
}

// DownloadSchemeManagerSignature downloads, stores and verifies the latest version
// of the index file and signature of the specified manager.
func (conf *Configuration) DownloadSchemeManagerSignature(manager *SchemeManager) (err error) {
799
800
801
802
	if conf.readOnly {
		return errors.New("cannot download into a read-only configuration")
	}

803
	t := NewHTTPTransport(manager.URL)
Sietse Ringers's avatar
Sietse Ringers committed
804
	path := fmt.Sprintf("%s/%s", conf.Path, manager.ID)
805
806
807
808
	index := filepath.Join(path, "index")
	sig := filepath.Join(path, "index.sig")

	if err = t.GetFile("index", index); err != nil {
809
		return
810
811
	}
	if err = t.GetFile("index.sig", sig); err != nil {
812
		return
813
	}
814
	err = conf.VerifySignature(manager.Identifier())
815
	return
816
}
817

Sietse Ringers's avatar
Sietse Ringers committed
818
819
820
// Download downloads the issuers, credential types and public keys specified in set
// if the current Configuration does not already have them,  and checks their authenticity
// using the scheme manager index.
821
func (conf *Configuration) Download(session SessionRequest) (downloaded *IrmaIdentifierSet, err error) {
822
823
824
	if conf.readOnly {
		return nil, errors.New("cannot download into a read-only configuration")
	}
825
	managers := make(map[string]struct{}) // Managers that we must update
826
	downloaded = &IrmaIdentifierSet{
827
828
829
830
		SchemeManagers:  map[SchemeManagerIdentifier]struct{}{},
		Issuers:         map[IssuerIdentifier]struct{}{},
		CredentialTypes: map[CredentialTypeIdentifier]struct{}{},
	}
831

832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
	// Calculate which scheme managers must be updated
	if err = conf.checkIssuers(session.Identifiers(), managers); err != nil {
		return
	}
	if err = conf.checkCredentialTypes(session, managers); err != nil {
		return
	}

	// Update the scheme managers found above and parse them, if necessary
	for id := range managers {
		if err = conf.UpdateSchemeManager(NewSchemeManagerIdentifier(id), downloaded); err != nil {
			return
		}
	}
	if !downloaded.Empty() {
		return downloaded, conf.ParseFolder()
	}
	return
}

852
func (conf *Configuration) checkCredentialTypes(session SessionRequest, managers map[string]struct{}) error {
853
854
855
856
857
858
859
860
	var disjunctions AttributeDisjunctionList
	var typ *CredentialType
	var contains bool

	switch s := session.(type) {
	case *IssuanceRequest:
		for _, credreq := range s.Credentials {
			// First check if we have this credential type
861
			typ, contains = conf.CredentialTypes[credreq.CredentialTypeID]
862
863
864
865
866
867
868
869
870
871
			if !contains {
				managers[credreq.CredentialTypeID.Root()] = struct{}{}
				continue
			}
			newAttrs := make(map[string]string)
			for k, v := range credreq.Attributes {
				newAttrs[k] = v
			}
			// For each of the attributes in the credentialtype, see if it is present; if so remove it from newAttrs
			// If not, check that it is optional; if not the credentialtype must be updated
872
			for _, attrtyp := range typ.AttributeTypes {
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
				_, contains = newAttrs[attrtyp.ID]
				if !contains && !attrtyp.IsOptional() {
					managers[credreq.CredentialTypeID.Root()] = struct{}{}
					break
				}
				delete(newAttrs, attrtyp.ID)
			}
			// If there is anything left in newAttrs, then these are attributes that are not in the credentialtype
			if len(newAttrs) > 0 {
				managers[credreq.CredentialTypeID.Root()] = struct{}{}
			}
		}
		disjunctions = s.Disclose
	case *DisclosureRequest:
		disjunctions = s.Content
	case *SignatureRequest:
		disjunctions = s.Content
	}

	for _, disjunction := range disjunctions {
		for _, attrid := range disjunction.Attributes {
			credid := attrid.CredentialTypeIdentifier()
			if typ, contains = conf.CredentialTypes[credid]; !contains {
				managers[credid.Root()] = struct{}{}
897
				continue
898
			}
Sietse Ringers's avatar
Sietse Ringers committed
899
			if !attrid.IsCredential() && !typ.ContainsAttribute(attrid) {
900
901
902
903
904
905
906
907
908
				managers[credid.Root()] = struct{}{}
			}
		}
	}

	return nil
}

func (conf *Configuration) checkIssuers(set *IrmaIdentifierSet, managers map[string]struct{}) error {
909
	for issid := range set.Issuers {
910
		if _, contains := conf.Issuers[issid]; !contains {
911
			managers[issid.Root()] = struct{}{}
912
		}
Sietse Ringers's avatar
Sietse Ringers committed
913
	}
914
915
916
	for issid, keyids := range set.PublicKeys {
		for _, keyid := range keyids {
			pk, err := conf.PublicKey(issid, keyid)
Sietse Ringers's avatar
Sietse Ringers committed
917
			if err != nil {
918
				return err
Sietse Ringers's avatar
Sietse Ringers committed
919
920
			}
			if pk == nil {
921
				managers[issid.Root()] = struct{}{}
922
923
924
			}
		}
	}
925
	return nil
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
}

func (i SchemeManagerIndex) String() string {
	var paths []string
	var b bytes.Buffer

	for path := range i {
		paths = append(paths, path)
	}
	sort.Strings(paths)

	for _, path := range paths {
		b.WriteString(hex.EncodeToString(i[path]))
		b.WriteString(" ")
		b.WriteString(path)
		b.WriteString("\n")
	}

	return b.String()
}

Sietse Ringers's avatar
Sietse Ringers committed
947
// FromString populates this index by parsing the specified string.
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
func (i SchemeManagerIndex) FromString(s string) error {
	for j, line := range strings.Split(s, "\n") {
		if len(line) == 0 {
			continue
		}
		parts := strings.Split(line, " ")
		if len(parts) != 2 {
			return errors.Errorf("Scheme manager index line %d has incorrect amount of parts", j)
		}
		hash, err := hex.DecodeString(parts[0])
		if err != nil {
			return err
		}
		i[parts[1]] = hash
	}

	return nil
}

967
// parseIndex parses the index file of the specified manager.
968
func (conf *Configuration) parseIndex(name string, manager *SchemeManager) (SchemeManagerIndex, error) {
Sietse Ringers's avatar
Sietse Ringers committed
969
	path := filepath.Join(conf.Path, name, "index")
Sietse Ringers's avatar
Sietse Ringers committed
970
	if err := fs.AssertPathExists(path); err != nil {
971
		return nil, fmt.Errorf("Missing scheme manager index file; tried %s", path)
972
	}
Sietse Ringers's avatar
Sietse Ringers committed
973
	indexbts, err := ioutil.ReadFile(path)
974
	if err != nil {
975
		return nil, err
976
	}
977
978
	index := SchemeManagerIndex(make(map[string]ConfigurationFileHash))
	return index, index.FromString(string(indexbts))
979
980
}

981
func (conf *Configuration) VerifySchemeManager(manager *SchemeManager) error {
982
	err := conf.VerifySignature(manager.Identifier())
983
984
985
986
	if err != nil {
		return err
	}

987
	var exists bool
988
	for file := range manager.index {
989
		exists, err = fs.PathExists(filepath.Join(conf.Path, file))
990
991
992
993
994
995
		if err != nil {
			return err
		}
		if !exists {
			continue
		}
996
		// Don't care about the actual bytes
997
		if _, _, err = conf.ReadAuthenticatedFile(manager, file); err != nil {
998
999
1000
1001
1002
1003
1004
			return err
		}
	}

	return nil
}

1005
1006
1007
// ReadAuthenticatedFile reads the file at the specified path
// and verifies its authenticity by checking that the file hash
// is present in the (signed) scheme manager index file.
1008
func (conf *Configuration) ReadAuthenticatedFile(manager *SchemeManager, path string) ([]byte, bool, error) {
1009
	signedHash, ok := manager.index[filepath.ToSlash(path)]
1010
	if !ok {
1011
		return nil, false, nil
1012
1013
	}

Sietse Ringers's avatar
Sietse Ringers committed
1014
	bts, err := ioutil.ReadFile(filepath.Join(conf.Path, path))
1015
	if err != nil {
1016
		return nil, true, err
1017
1018
1019
1020
	}
	computedHash := sha256.Sum256(bts)

	if !bytes.Equal(computedHash[:], signedHash) {
1021
		return nil, true, errors.Errorf("Hash of %s does not match scheme manager index", path)
1022
	}
1023
	return bts, true, nil
1024
1025
1026
1027
1028
}

// VerifySignature verifies the signature on the scheme manager index file
// (which contains the SHA256 hashes of all files under this scheme manager,
// which are used for verifying file authenticity).
1029
func (conf *Configuration) VerifySignature(id SchemeManagerIdentifier) (err error) {
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
	defer func() {
		if r := recover(); r != nil {
			if e, ok := r.(error); ok {
				err = errors.Errorf("Scheme manager index signature failed to verify: %s", e.Error())
			} else {
				err = errors.New("Scheme manager index signature failed to verify")
			}
		}
	}()

Sietse Ringers's avatar
Sietse Ringers committed
1040
	dir := filepath.Join(conf.Path, id.String())
1041
	if err := fs.AssertPathExists(dir+"/index", dir+"/index.sig", dir+"/pk.pem"); err != nil {
1042
		return errors.New("Missing scheme manager index file, signature, or public key")
1043
1044
1045
1046
1047
	}

	// Read and hash index file
	indexbts, err := ioutil.ReadFile(dir + "/index")
	if err != nil {
1048
		return err
1049
1050
1051
1052
1053
1054
	}
	indexhash := sha256.Sum256(indexbts)

	// Read and parse scheme manager public key
	pkbts, err := ioutil.ReadFile(dir + "/pk.pem")
	if err != nil {
1055
		return err
1056
	}
1057
	pk, err := ParsePemEcdsaPublicKey(pkbts)
1058
	if err != nil {
1059
		return err
1060
1061
1062
1063
1064
	}

	// Read and parse signature
	sig, err := ioutil.ReadFile(dir + "/index.sig")
	if err != nil {
1065
		return err
1066
	}
1067
	ints := make([]*gobig.Int, 0, 2)
1068
1069
1070
	_, err = asn1.Unmarshal(sig, &ints)

	// Verify signature
1071
1072
1073
1074
	if !ecdsa.Verify(pk, indexhash[:], ints[0], ints[1]) {
		return errors.New("Scheme manager signature was invalid")
	}
	return nil
1075
}
1076

1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
func ParsePemEcdsaPublicKey(pkbts []byte) (*ecdsa.PublicKey, error) {
	pkblk, _ := pem.Decode(pkbts)
	genericPk, err := x509.ParsePKIXPublicKey(pkblk.Bytes)
	if err != nil {
		return nil, err
	}
	pk, ok := genericPk.(*ecdsa.PublicKey)
	if !ok {
		return nil, errors.New("Invalid scheme manager public key")
	}
	return pk, nil
}

1090
1091
1092
func (hash ConfigurationFileHash) String() string {
	return hex.EncodeToString(hash)
}
1093