irmaconfig.go 45.3 KB
Newer Older
1
package irma
2
3

import (
4
	"crypto/rsa"
5
6
7
8
9
	"encoding/base64"
	"encoding/xml"
	"io/ioutil"
	"os"
	"path/filepath"
10
	"reflect"
11
	"regexp"
12
	"strconv"
13
	"time"
14

15
16
	"crypto/sha256"

17
18
19
20
	"fmt"

	"strings"

21
22
23
24
25
26
27
28
29
30
	"sort"

	"bytes"

	"encoding/hex"

	"crypto/ecdsa"
	"crypto/x509"
	"encoding/asn1"
	"encoding/pem"
31
	gobig "math/big"
32

33
	"github.com/dgrijalva/jwt-go"
34
	"github.com/go-errors/errors"
Sietse Ringers's avatar
Sietse Ringers committed
35
	"github.com/jasonlvhit/gocron"
36
37
	"github.com/privacybydesign/gabi"
	"github.com/privacybydesign/gabi/big"
38
	"github.com/privacybydesign/irmago/internal/fs"
39
40
)

41
// Configuration keeps track of scheme managers, issuers, credential types and public keys,
42
// dezerializing them from an irma_configuration folder, and downloads and saves new ones on demand.
43
type Configuration struct {
44
45
46
	SchemeManagers  map[SchemeManagerIdentifier]*SchemeManager
	Issuers         map[IssuerIdentifier]*Issuer
	CredentialTypes map[CredentialTypeIdentifier]*CredentialType
47
	AttributeTypes  map[AttributeTypeIdentifier]*AttributeType
48

Sietse Ringers's avatar
Sietse Ringers committed
49
50
51
	// Path to the irma_configuration folder that this instance represents
	Path string

52
53
54
	// DisabledSchemeManagers keeps track of scheme managers that did not parse  succesfully
	// (i.e., invalid signature, parsing error), and the problem that occurred when parsing them
	DisabledSchemeManagers map[SchemeManagerIdentifier]*SchemeManagerError
55

56
57
	Warnings []string

58
	kssPublicKeys map[SchemeManagerIdentifier]map[int]*rsa.PublicKey
59
	publicKeys    map[IssuerIdentifier]map[int]*gabi.PublicKey
60
	privateKeys   map[IssuerIdentifier]*gabi.PrivateKey
61
	reverseHashes map[string]CredentialTypeIdentifier
62
	initialized   bool
63
	assets        string
64
	readOnly      bool
Sietse Ringers's avatar
Sietse Ringers committed
65
	cronchan      chan bool
66
	scheduler     *gocron.Scheduler
67
68
}

Sietse Ringers's avatar
Sietse Ringers committed
69
70
// ConfigurationFileHash encodes the SHA256 hash of an authenticated
// file under a scheme manager within the configuration folder.
71
72
type ConfigurationFileHash []byte

Sietse Ringers's avatar
Sietse Ringers committed
73
74
// SchemeManagerIndex is a (signed) list of files under a scheme manager
// along with their SHA266 hash
75
76
type SchemeManagerIndex map[string]ConfigurationFileHash

77
78
type SchemeManagerStatus string

79
80
type SchemeManagerError struct {
	Manager SchemeManagerIdentifier
81
	Status  SchemeManagerStatus
82
83
84
	Err     error
}

85
86
87
88
89
90
91
const (
	SchemeManagerStatusValid               = SchemeManagerStatus("Valid")
	SchemeManagerStatusUnprocessed         = SchemeManagerStatus("Unprocessed")
	SchemeManagerStatusInvalidIndex        = SchemeManagerStatus("InvalidIndex")
	SchemeManagerStatusInvalidSignature    = SchemeManagerStatus("InvalidSignature")
	SchemeManagerStatusParsingError        = SchemeManagerStatus("ParsingError")
	SchemeManagerStatusContentParsingError = SchemeManagerStatus("ContentParsingError")
92

93
94
	pubkeyPattern  = "%s/%s/%s/PublicKeys/*.xml"
	privkeyPattern = "%s/%s/%s/PrivateKeys/*.xml"
95
96
)

97
98
99
100
func (sme SchemeManagerError) Error() string {
	return fmt.Sprintf("Error parsing scheme manager %s: %s", sme.Manager.Name(), sme.Err.Error())
}

101
// NewConfiguration returns a new configuration. After this
102
// ParseFolder() should be called to parse the specified path.
103
104
105
106
func NewConfiguration(path string) (*Configuration, error) {
	return newConfiguration(path, "")
}

107
108
// NewConfigurationReadOnly returns a new configuration whose representation on disk
// is never altered. ParseFolder() should be called to parse the specified path.
109
110
111
112
113
114
115
116
117
func NewConfigurationReadOnly(path string) (*Configuration, error) {
	conf, err := newConfiguration(path, "")
	if err != nil {
		return nil, err
	}
	conf.readOnly = true
	return conf, nil
}

118
119
// NewConfigurationFromAssets returns a new configuration, copying the schemes out of the assets folder to path.
// ParseFolder() should be called to parse the specified path.
120
121
122
123
124
func NewConfigurationFromAssets(path, assets string) (*Configuration, error) {
	return newConfiguration(path, assets)
}

func newConfiguration(path string, assets string) (conf *Configuration, err error) {
125
	conf = &Configuration{
Sietse Ringers's avatar
Sietse Ringers committed
126
		Path:   path,
127
		assets: assets,
128
	}
129

130
131
132
133
	if conf.assets != "" { // If an assets folder is specified, then it must exist
		if err = fs.AssertPathExists(conf.assets); err != nil {
			return nil, errors.WrapPrefix(err, "Nonexistent assets folder specified", 0)
		}
134
	}
135
	if err = fs.EnsureDirectoryExists(conf.Path); err != nil {
136
137
		return nil, err
	}
138

139
140
141
	// Init all maps
	conf.clear()

142
143
144
	return
}

145
func (conf *Configuration) clear() {
146
147
148
	conf.SchemeManagers = make(map[SchemeManagerIdentifier]*SchemeManager)
	conf.Issuers = make(map[IssuerIdentifier]*Issuer)
	conf.CredentialTypes = make(map[CredentialTypeIdentifier]*CredentialType)
149
	conf.AttributeTypes = make(map[AttributeTypeIdentifier]*AttributeType)
150
	conf.DisabledSchemeManagers = make(map[SchemeManagerIdentifier]*SchemeManagerError)
151
	conf.kssPublicKeys = make(map[SchemeManagerIdentifier]map[int]*rsa.PublicKey)
152
	conf.publicKeys = make(map[IssuerIdentifier]map[int]*gabi.PublicKey)
153
	conf.privateKeys = make(map[IssuerIdentifier]*gabi.PrivateKey)
154
	conf.reverseHashes = make(map[string]CredentialTypeIdentifier)
155
156
157
158
159
160
161
}

// ParseFolder populates the current Configuration by parsing the storage path,
// listing the containing scheme managers, issuers and credential types.
func (conf *Configuration) ParseFolder() (err error) {
	// Init all maps
	conf.clear()
162

163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
	// Copy any new or updated scheme managers out of the assets into storage
	if conf.assets != "" {
		err = iterateSubfolders(conf.assets, func(dir string) error {
			scheme := NewSchemeManagerIdentifier(filepath.Base(dir))
			uptodate, err := conf.isUpToDate(scheme)
			if err != nil {
				return err
			}
			if !uptodate {
				_, err = conf.CopyManagerFromAssets(scheme)
			}
			return err
		})
		if err != nil {
			return err
		}
	}

	// Parse scheme managers in storage
182
	var mgrerr *SchemeManagerError
Sietse Ringers's avatar
Sietse Ringers committed
183
	err = iterateSubfolders(conf.Path, func(dir string) error {
184
185
		manager := NewSchemeManager(filepath.Base(dir))
		err := conf.ParseSchemeManagerFolder(dir, manager)
186
187
		if err == nil {
			return nil // OK, do next scheme manager folder
188
		}
189
190
191
192
		// If there is an error, and it is of type SchemeManagerError, return nil
		// so as to continue parsing other managers.
		var ok bool
		if mgrerr, ok = err.(*SchemeManagerError); ok {
193
			conf.DisabledSchemeManagers[manager.Identifier()] = mgrerr
194
			return nil
195
		}
196
		return err // Not a SchemeManagerError? return it & halt parsing now
197
198
	})
	if err != nil {
199
		return
200
	}
201
	conf.initialized = true
202
203
204
	if mgrerr != nil {
		return mgrerr
	}
205
	return
206
207
}

208
209
210
211
212
213
214
// ParseOrRestoreFolder parses the irma_configuration folder, and when possible attempts to restore
// any broken scheme managers from their remote.
// Any error encountered during parsing is considered recoverable only if it is of type *SchemeManagerError;
// In this case the scheme in which it occured is downloaded from its remote and re-parsed.
// If any other error is encountered at any time, it is returned immediately.
// If no error is returned, parsing and possibly restoring has been succesfull, and there should be no
// disabled scheme managers.
215
216
func (conf *Configuration) ParseOrRestoreFolder() error {
	err := conf.ParseFolder()
217
218
219
	// Only in case of a *SchemeManagerError might we be able to recover
	if _, isSchemeMgrErr := err.(*SchemeManagerError); !isSchemeMgrErr {
		return err
220
	}
221
222
223
	if err != nil && (conf.assets == "" || conf.readOnly) {
		return err
	}
224
225

	for id := range conf.DisabledSchemeManagers {
226
227
228
229
230
231
232
233
234
		if err = conf.ReinstallSchemeManager(conf.SchemeManagers[id]); err == nil {
			continue
		}
		if _, err = conf.CopyManagerFromAssets(id); err != nil {
			return err // File system error, too serious, bail out now
		}
		name := id.String()
		if err = conf.ParseSchemeManagerFolder(filepath.Join(conf.Path, name), NewSchemeManager(name)); err == nil {
			delete(conf.DisabledSchemeManagers, id)
235
		}
236
	}
237

238
239
240
	return err
}

241
// ParseSchemeManagerFolder parses the entire tree of the specified scheme manager
242
// If err != nil then a problem occured
243
func (conf *Configuration) ParseSchemeManagerFolder(dir string, manager *SchemeManager) (err error) {
244
245
246
247
248
249
250
	// From this point, keep it in our map even if it has an error. The user must check either:
	// - manager.Status == SchemeManagerStatusValid, aka "VALID"
	// - or equivalently, manager.Valid == true
	// before using any scheme manager for anything, and handle accordingly
	conf.SchemeManagers[manager.Identifier()] = manager

	// Ensure we return a SchemeManagerError when any error occurs
251
252
	defer func() {
		if err != nil {
253
254
255
256
257
			err = &SchemeManagerError{
				Manager: manager.Identifier(),
				Err:     err,
				Status:  manager.Status,
			}
258
259
260
		}
	}()

261
262
	// Verify signature and read scheme manager description
	if err = conf.VerifySignature(manager.Identifier()); err != nil {
263
264
		return
	}
265
	if manager.index, err = conf.parseIndex(filepath.Base(dir), manager); err != nil {
266
267
		manager.Status = SchemeManagerStatusInvalidIndex
		return
268
	}
269
	exists, err := conf.pathToDescription(manager, dir+"/description.xml", manager)
270
271
272
	if err != nil {
		manager.Status = SchemeManagerStatusParsingError
		return
273
	}
274
275
276
277
	if !exists {
		manager.Status = SchemeManagerStatusParsingError
		return errors.New("Scheme manager description not found")
	}
278
279
	if err = conf.checkScheme(manager, dir); err != nil {
		return
280
	}
281
282
283
284
285
286
287

	// Verify that all other files are validly signed
	err = conf.VerifySchemeManager(manager)
	if err != nil {
		manager.Status = SchemeManagerStatusInvalidSignature
		return
	}
288

289
	// Read timestamp indicating time of last modification
290
291
292
	ts, exists, err := readTimestamp(dir + "/timestamp")
	if err != nil || !exists {
		return errors.WrapPrefix(err, "Could not read scheme manager timestamp", 0)
293
	}
294
	manager.Timestamp = *ts
295

296
	// Parse contained issuers and credential types
297
	err = conf.parseIssuerFolders(manager, dir)
298
299
300
301
302
303
	if err != nil {
		manager.Status = SchemeManagerStatusContentParsingError
		return
	}
	manager.Status = SchemeManagerStatusValid
	manager.Valid = true
304
305
306
	return
}

307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
// relativePath returns, given a outer path that contains the inner path,
// the relative path between outer an inner, which is such that
// outer/returnvalue refers to inner.
func relativePath(outer string, inner string) (string, error) {
	// Take Abs() of both paths to ensure that we don't fail on e.g.
	// outer = "./foo" and inner = "foo/bar"
	outerAbs, err := filepath.Abs(outer)
	if err != nil {
		return "", err
	}
	innerAbs, err := filepath.Abs(inner)
	if err != nil {
		return "", err
	}
	if !strings.HasPrefix(innerAbs, outerAbs) {
		return "", errors.New("inner path is not contained in outer path")
	}

	return innerAbs[len(outerAbs)+1:], nil
326
327
}

328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
// PrivateKey returns the specified private key, or nil if not present in the Configuration.
func (conf *Configuration) PrivateKey(id IssuerIdentifier) (*gabi.PrivateKey, error) {
	if sk := conf.privateKeys[id]; sk != nil {
		return sk, nil
	}

	path := fmt.Sprintf(privkeyPattern, conf.Path, id.SchemeManagerIdentifier().Name(), id.Name())
	files, err := filepath.Glob(path)
	if err != nil {
		return nil, err
	}
	if len(files) == 0 {
		return nil, nil
	}

	// List private keys and get highest counter
	counters := make([]int, 0, len(files))
	for _, file := range files {
		filename := filepath.Base(file)
		count := filename[:len(filename)-4]
		i, err := strconv.Atoi(count)
		if err != nil {
			return nil, err
		}
		counters = append(counters, i)
	}
	sort.Ints(counters)
	counter := counters[len(counters)-1]

	// Read private key
	file := strings.Replace(path, "*", strconv.Itoa(counter), 1)
	sk, err := gabi.NewPrivateKeyFromFile(file)
	if err != nil {
		return nil, err
	}
	if int(sk.Counter) != counter {
		return nil, errors.Errorf("Private key %s of issuer %s has wrong <Counter>", file, id.String())
	}
	conf.privateKeys[id] = sk

	return sk, nil
}

371
372
// PublicKey returns the specified public key, or nil if not present in the Configuration.
func (conf *Configuration) PublicKey(id IssuerIdentifier, counter int) (*gabi.PublicKey, error) {
373
374
375
376
377
378
379
380
381
382
383
	var haveIssuer, haveKey bool
	var err error
	_, haveIssuer = conf.publicKeys[id]
	if haveIssuer {
		_, haveKey = conf.publicKeys[id][counter]
	}

	// If we have not seen this issuer or key before in conf.publicKeys,
	// try to parse the public key folder; new keys might have been put there since we last parsed it
	if !haveIssuer || !haveKey {
		if err = conf.parseKeysFolder(id); err != nil {
384
			return nil, err
385
386
		}
	}
387
	return conf.publicKeys[id][counter], nil
388
389
}

390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
// KeyshareServerKeyFunc returns a function that returns the public key with which to verify a keyshare server JWT,
// suitable for passing to jwt.Parse() and jwt.ParseWithClaims().
func (conf *Configuration) KeyshareServerKeyFunc(scheme SchemeManagerIdentifier) func(t *jwt.Token) (interface{}, error) {
	return func(t *jwt.Token) (i interface{}, e error) {
		var kid int
		if kidstr, ok := t.Header["kid"].(string); ok {
			var err error
			if kid, err = strconv.Atoi(kidstr); err != nil {
				return nil, err
			}
		}
		return conf.KeyshareServerPublicKey(scheme, kid)
	}
}

// KeyshareServerPublicKey returns the i'th public key of the specified scheme.
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
func (conf *Configuration) KeyshareServerPublicKey(scheme SchemeManagerIdentifier, i int) (*rsa.PublicKey, error) {
	if _, contains := conf.kssPublicKeys[scheme]; !contains {
		conf.kssPublicKeys[scheme] = make(map[int]*rsa.PublicKey)
	}
	if _, contains := conf.kssPublicKeys[scheme][i]; !contains {
		pkbts, err := ioutil.ReadFile(filepath.Join(conf.Path, scheme.Name(), fmt.Sprintf("kss-%d.pem", i)))
		if err != nil {
			return nil, err
		}
		pkblk, _ := pem.Decode(pkbts)
		genericPk, err := x509.ParsePKIXPublicKey(pkblk.Bytes)
		if err != nil {
			return nil, err
		}
		pk, ok := genericPk.(*rsa.PublicKey)
		if !ok {
			return nil, errors.New("Invalid keyshare server public key")
		}
		conf.kssPublicKeys[scheme][i] = pk
	}
	return conf.kssPublicKeys[scheme][i], nil
}

429
func (conf *Configuration) addReverseHash(credid CredentialTypeIdentifier) {
430
	hash := sha256.Sum256([]byte(credid.String()))
431
	conf.reverseHashes[base64.StdEncoding.EncodeToString(hash[:16])] = credid
432
433
}

434
435
436
func (conf *Configuration) hashToCredentialType(hash []byte) *CredentialType {
	if str, exists := conf.reverseHashes[base64.StdEncoding.EncodeToString(hash)]; exists {
		return conf.CredentialTypes[str]
437
438
439
440
	}
	return nil
}

441
// IsInitialized indicates whether this instance has successfully been initialized.
442
443
func (conf *Configuration) IsInitialized() bool {
	return conf.initialized
444
445
}

446
447
448
449
450
451
452
453
454
// Prune removes any invalid scheme managers and everything they own from this Configuration
func (conf *Configuration) Prune() {
	for _, manager := range conf.SchemeManagers {
		if !manager.Valid {
			_ = conf.RemoveSchemeManager(manager.Identifier(), false) // does not return errors
		}
	}
}

455
func (conf *Configuration) parseIssuerFolders(manager *SchemeManager, path string) error {
456
457
	return iterateSubfolders(path, func(dir string) error {
		issuer := &Issuer{}
458
		exists, err := conf.pathToDescription(manager, dir+"/description.xml", issuer)
459
460
461
		if err != nil {
			return err
		}
462
463
		if !exists {
			return nil
464
		}
465
466
467
		if issuer.XMLVersion < 4 {
			return errors.New("Unsupported issuer description")
		}
468

469
		if err = conf.checkIssuer(manager, issuer, dir); err != nil {
470
471
472
			return err
		}

473
		conf.Issuers[issuer.Identifier()] = issuer
474
		issuer.Valid = conf.SchemeManagers[issuer.SchemeManagerIdentifier()].Valid
475
		return conf.parseCredentialsFolder(manager, issuer, dir+"/Issues/")
476
477
478
	})
}

479
480
481
func (conf *Configuration) DeleteSchemeManager(id SchemeManagerIdentifier) error {
	delete(conf.SchemeManagers, id)
	delete(conf.DisabledSchemeManagers, id)
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
	name := id.String()
	for iss := range conf.Issuers {
		if iss.Root() == name {
			delete(conf.Issuers, iss)
		}
	}
	for iss := range conf.publicKeys {
		if iss.Root() == name {
			delete(conf.publicKeys, iss)
		}
	}
	for cred := range conf.CredentialTypes {
		if cred.Root() == name {
			delete(conf.CredentialTypes, cred)
		}
	}
498
499
500
501
	if !conf.readOnly {
		return os.RemoveAll(filepath.Join(conf.Path, id.Name()))
	}
	return nil
502
503
}

504
// parse $schememanager/$issuer/PublicKeys/$i.xml for $i = 1, ...
505
506
func (conf *Configuration) parseKeysFolder(issuerid IssuerIdentifier) error {
	manager := conf.SchemeManagers[issuerid.SchemeManagerIdentifier()]
507
	conf.publicKeys[issuerid] = map[int]*gabi.PublicKey{}
508
	path := fmt.Sprintf(pubkeyPattern, conf.Path, issuerid.SchemeManagerIdentifier().Name(), issuerid.Name())
509
510
511
512
513
514
515
516
517
518
	files, err := filepath.Glob(path)
	if err != nil {
		return err
	}

	for _, file := range files {
		filename := filepath.Base(file)
		count := filename[:len(filename)-4]
		i, err := strconv.Atoi(count)
		if err != nil {
519
			return err
520
		}
521
522
523
524
525
		relativepath, err := relativePath(conf.Path, file)
		if err != nil {
			return err
		}
		bts, found, err := conf.ReadAuthenticatedFile(manager, relativepath)
526
		if err != nil || !found {
527
528
529
			return err
		}
		pk, err := gabi.NewPublicKeyFromBytes(bts)
530
531
532
		if err != nil {
			return err
		}
533
534
535
		if int(pk.Counter) != i {
			return errors.Errorf("Public key %s of issuer %s has wrong <Counter>", file, issuerid.String())
		}
536
		pk.Issuer = issuerid.String()
537
		conf.publicKeys[issuerid][i] = pk
538
	}
539

540
541
542
	return nil
}

543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
func (conf *Configuration) PublicKeyIndices(issuerid IssuerIdentifier) (i []int, err error) {
	return conf.matchKeyPattern(issuerid, pubkeyPattern)
}

func (conf *Configuration) matchKeyPattern(issuerid IssuerIdentifier, pattern string) (i []int, err error) {
	pkpath := fmt.Sprintf(pattern, conf.Path, issuerid.SchemeManagerIdentifier().Name(), issuerid.Name())
	files, err := filepath.Glob(pkpath)
	if err != nil {
		return
	}
	for _, file := range files {
		var count int
		base := filepath.Base(file)
		if count, err = strconv.Atoi(base[:len(base)-4]); err != nil {
			return
		}
		i = append(i, count)
	}
	sort.Ints(i)
	return
}

565
// parse $schememanager/$issuer/Issues/*/description.xml
566
567
568
func (conf *Configuration) parseCredentialsFolder(manager *SchemeManager, issuer *Issuer, path string) error {
	var foundcred bool
	err := iterateSubfolders(path, func(dir string) error {
569
		cred := &CredentialType{}
570
		exists, err := conf.pathToDescription(manager, dir+"/description.xml", cred)
571
572
573
		if err != nil {
			return err
		}
574
575
576
		if !exists {
			return nil
		}
577
		if err = conf.checkCredentialType(manager, issuer, cred, dir); err != nil {
578
579
580
581
			return err
		}
		foundcred = true
		cred.Valid = conf.SchemeManagers[cred.SchemeManagerIdentifier()].Valid
582
		credid := cred.Identifier()
583
584
		conf.CredentialTypes[credid] = cred
		conf.addReverseHash(credid)
585
		for index, attr := range cred.AttributeTypes {
586
587
588
589
			attr.Index = index
			attr.SchemeManagerID = cred.SchemeManagerID
			attr.IssuerID = cred.IssuerID
			attr.CredentialTypeID = cred.ID
590
			conf.AttributeTypes[attr.GetAttributeTypeIdentifier()] = attr
591
		}
592
593
		return nil
	})
594
595
596
597
598
599
	if !foundcred {
		conf.Warnings = append(conf.Warnings, fmt.Sprintf("Issuer %s has no credential types", issuer.Identifier().String()))
	}
	return err
}

600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
// iterateSubfolders iterates over the subfolders of the specified path,
// calling the specified handler each time. If anything goes wrong, or
// if the caller returns a non-nil error, an error is immediately returned.
func iterateSubfolders(path string, handler func(string) error) error {
	dirs, err := filepath.Glob(path + "/*")
	if err != nil {
		return err
	}

	for _, dir := range dirs {
		stat, err := os.Stat(dir)
		if err != nil {
			return err
		}
		if !stat.IsDir() {
			continue
		}
617
618
619
		if strings.HasSuffix(dir, "/.git") {
			continue
		}
620
621
622
623
624
625
626
627
628
		err = handler(dir)
		if err != nil {
			return err
		}
	}

	return nil
}

629
func (conf *Configuration) pathToDescription(manager *SchemeManager, path string, description interface{}) (bool, error) {
630
631
632
633
	if _, err := os.Stat(path); err != nil {
		return false, nil
	}

634
635
636
637
638
	relativepath, err := relativePath(conf.Path, path)
	if err != nil {
		return false, err
	}
	bts, found, err := conf.ReadAuthenticatedFile(manager, relativepath)
639
	if !found {
640
641
642
643
644
		for p := range manager.index {
			expectedName := p[0:strings.Index(p, "/")]
			return false, errors.Errorf("Folder must be called %s, not %s", expectedName, manager.ID)
		}
		return false, errors.New("")
645
	}
646
647
648
649
	if err != nil {
		return true, err
	}

650
	err = xml.Unmarshal(bts, description)
651
652
653
654
655
656
	if err != nil {
		return true, err
	}

	return true, nil
}
657

658
659
660
661
662
// Contains checks if the configuration contains the specified credential type.
func (conf *Configuration) Contains(cred CredentialTypeIdentifier) bool {
	return conf.SchemeManagers[cred.IssuerIdentifier().SchemeManagerIdentifier()] != nil &&
		conf.Issuers[cred.IssuerIdentifier()] != nil &&
		conf.CredentialTypes[cred] != nil
663
}
664

665
func (conf *Configuration) isUpToDate(scheme SchemeManagerIdentifier) (bool, error) {
666
	if conf.assets == "" || conf.readOnly {
667
668
		return true, nil
	}
669
670
671
672
	name := scheme.String()
	newTime, exists, err := readTimestamp(filepath.Join(conf.assets, name, "timestamp"))
	if err != nil || !exists {
		return true, errors.WrapPrefix(err, "Could not read asset timestamp of scheme "+name, 0)
673
	}
674
675
676
677
	// The storage version of the manager does not need to have a timestamp. If it does not, it is outdated.
	oldTime, exists, err := readTimestamp(filepath.Join(conf.Path, name, "timestamp"))
	if err != nil {
		return true, err
678
	}
679
	return exists && !newTime.After(*oldTime), nil
680
681
}

682
func (conf *Configuration) CopyManagerFromAssets(scheme SchemeManagerIdentifier) (bool, error) {
683
	if conf.assets == "" || conf.readOnly {
684
		return false, nil
685
	}
686
687
688
689
690
	// Remove old version; we want an exact copy of the assets version
	// not a merge of the assets version and the storage version
	name := scheme.String()
	if err := os.RemoveAll(filepath.Join(conf.Path, name)); err != nil {
		return false, err
691
	}
692
693
694
	return true, fs.CopyDirectory(
		filepath.Join(conf.assets, name),
		filepath.Join(conf.Path, name),
695
696
697
	)
}

698
699
// DownloadSchemeManager downloads and returns a scheme manager description.xml file
// from the specified URL.
700
func DownloadSchemeManager(url string) (*SchemeManager, error) {
701
702
703
704
705
706
707
708
709
	if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") {
		url = "https://" + url
	}
	if url[len(url)-1] == '/' {
		url = url[:len(url)-1]
	}
	if strings.HasSuffix(url, "/description.xml") {
		url = url[:len(url)-len("/description.xml")]
	}
710
	b, err := NewHTTPTransport(url).GetBytes("description.xml")
711
712
713
	if err != nil {
		return nil, err
	}
714
	manager := NewSchemeManager("")
715
716
717
718
719
720
721
722
	if err = xml.Unmarshal(b, manager); err != nil {
		return nil, err
	}

	manager.URL = url // TODO?
	return manager, nil
}

Sietse Ringers's avatar
Sietse Ringers committed
723
724
// RemoveSchemeManager removes the specified scheme manager and all associated issuers,
// public keys and credential types from this Configuration.
725
func (conf *Configuration) RemoveSchemeManager(id SchemeManagerIdentifier, fromStorage bool) error {
726
	// Remove everything falling under the manager's responsibility
727
	for credid := range conf.CredentialTypes {
728
		if credid.IssuerIdentifier().SchemeManagerIdentifier() == id {
729
			delete(conf.CredentialTypes, credid)
730
731
		}
	}
732
	for issid := range conf.Issuers {
733
		if issid.SchemeManagerIdentifier() == id {
734
			delete(conf.Issuers, issid)
735
736
		}
	}
737
	for issid := range conf.publicKeys {
738
		if issid.SchemeManagerIdentifier() == id {
739
			delete(conf.publicKeys, issid)
740
741
		}
	}
742
	delete(conf.SchemeManagers, id)
743

744
	if fromStorage || !conf.readOnly {
Sietse Ringers's avatar
Sietse Ringers committed
745
		return os.RemoveAll(fmt.Sprintf("%s/%s", conf.Path, id.String()))
746
747
	}
	return nil
748
749
}

750
func (conf *Configuration) ReinstallSchemeManager(manager *SchemeManager) (err error) {
751
752
753
754
	if conf.readOnly {
		return errors.New("cannot install scheme into a read-only configuration")
	}

755
756
757
758
759
760
761
762
763
	// Check if downloading stuff from the remote works before we uninstall the specified manager:
	// If we can't download anything we should keep the broken version
	manager, err = DownloadSchemeManager(manager.URL)
	if err != nil {
		return
	}
	if err = conf.DeleteSchemeManager(manager.Identifier()); err != nil {
		return
	}
764
	err = conf.InstallSchemeManager(manager, nil)
765
766
767
	return
}

768
// InstallSchemeManager downloads and adds the specified scheme manager to this Configuration,
Sietse Ringers's avatar
Sietse Ringers committed
769
// provided its signature is valid.
770
func (conf *Configuration) InstallSchemeManager(manager *SchemeManager, publickey []byte) error {
771
772
773
774
	if conf.readOnly {
		return errors.New("cannot install scheme into a read-only configuration")
	}

775
	name := manager.ID
776
	if err := fs.EnsureDirectoryExists(filepath.Join(conf.Path, name)); err != nil {
777
778
		return err
	}
779
780

	t := NewHTTPTransport(manager.URL)
Sietse Ringers's avatar
Sietse Ringers committed
781
	path := fmt.Sprintf("%s/%s", conf.Path, name)
782
783
784
	if err := t.GetFile("description.xml", path+"/description.xml"); err != nil {
		return err
	}
785
786
787
788
789
790
791
792
	if publickey != nil {
		if err := fs.SaveFile(path+"/pk.pem", publickey); err != nil {
			return err
		}
	} else {
		if err := t.GetFile("pk.pem", path+"/pk.pem"); err != nil {
			return err
		}
793
	}
794
	if err := conf.DownloadSchemeManagerSignature(manager); err != nil {
795
796
		return err
	}
797
798
799
800
	conf.SchemeManagers[manager.Identifier()] = manager
	if err := conf.UpdateSchemeManager(manager.Identifier(), nil); err != nil {
		return err
	}
801

802
	return conf.ParseSchemeManagerFolder(filepath.Join(conf.Path, name), manager)
803
804
805
806
807
}

// DownloadSchemeManagerSignature downloads, stores and verifies the latest version
// of the index file and signature of the specified manager.
func (conf *Configuration) DownloadSchemeManagerSignature(manager *SchemeManager) (err error) {
808
809
810
811
	if conf.readOnly {
		return errors.New("cannot download into a read-only configuration")
	}

812
	t := NewHTTPTransport(manager.URL)
Sietse Ringers's avatar
Sietse Ringers committed
813
	path := fmt.Sprintf("%s/%s", conf.Path, manager.ID)
814
815
816
817
	index := filepath.Join(path, "index")
	sig := filepath.Join(path, "index.sig")

	if err = t.GetFile("index", index); err != nil {
818
		return
819
820
	}
	if err = t.GetFile("index.sig", sig); err != nil {
821
		return
822
	}
823
	err = conf.VerifySignature(manager.Identifier())
824
	return
825
}
826

Sietse Ringers's avatar
Sietse Ringers committed
827
828
829
// Download downloads the issuers, credential types and public keys specified in set
// if the current Configuration does not already have them,  and checks their authenticity
// using the scheme manager index.
830
func (conf *Configuration) Download(session SessionRequest) (downloaded *IrmaIdentifierSet, err error) {
831
832
833
	if conf.readOnly {
		return nil, errors.New("cannot download into a read-only configuration")
	}
834
	managers := make(map[string]struct{}) // Managers that we must update
835
	downloaded = &IrmaIdentifierSet{
836
837
838
839
		SchemeManagers:  map[SchemeManagerIdentifier]struct{}{},
		Issuers:         map[IssuerIdentifier]struct{}{},
		CredentialTypes: map[CredentialTypeIdentifier]struct{}{},
	}
840

841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
	// Calculate which scheme managers must be updated
	if err = conf.checkIssuers(session.Identifiers(), managers); err != nil {
		return
	}
	if err = conf.checkCredentialTypes(session, managers); err != nil {
		return
	}

	// Update the scheme managers found above and parse them, if necessary
	for id := range managers {
		if err = conf.UpdateSchemeManager(NewSchemeManagerIdentifier(id), downloaded); err != nil {
			return
		}
	}
	if !downloaded.Empty() {
		return downloaded, conf.ParseFolder()
	}
	return
}

861
func (conf *Configuration) checkCredentialTypes(session SessionRequest, managers map[string]struct{}) error {
862
863
864
865
866
867
868
869
	var disjunctions AttributeDisjunctionList
	var typ *CredentialType
	var contains bool

	switch s := session.(type) {
	case *IssuanceRequest:
		for _, credreq := range s.Credentials {
			// First check if we have this credential type
870
			typ, contains = conf.CredentialTypes[credreq.CredentialTypeID]
871
872
873
874
875
876
877
878
879
880
			if !contains {
				managers[credreq.CredentialTypeID.Root()] = struct{}{}
				continue
			}
			newAttrs := make(map[string]string)
			for k, v := range credreq.Attributes {
				newAttrs[k] = v
			}
			// For each of the attributes in the credentialtype, see if it is present; if so remove it from newAttrs
			// If not, check that it is optional; if not the credentialtype must be updated
881
			for _, attrtyp := range typ.AttributeTypes {
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
				_, contains = newAttrs[attrtyp.ID]
				if !contains && !attrtyp.IsOptional() {
					managers[credreq.CredentialTypeID.Root()] = struct{}{}
					break
				}
				delete(newAttrs, attrtyp.ID)
			}
			// If there is anything left in newAttrs, then these are attributes that are not in the credentialtype
			if len(newAttrs) > 0 {
				managers[credreq.CredentialTypeID.Root()] = struct{}{}
			}
		}
		disjunctions = s.Disclose
	case *DisclosureRequest:
		disjunctions = s.Content
	case *SignatureRequest:
		disjunctions = s.Content
	}

	for _, disjunction := range disjunctions {
		for _, attrid := range disjunction.Attributes {
			credid := attrid.CredentialTypeIdentifier()
			if typ, contains = conf.CredentialTypes[credid]; !contains {
				managers[credid.Root()] = struct{}{}
906
				continue
907
			}
Sietse Ringers's avatar
Sietse Ringers committed
908
			if !attrid.IsCredential() && !typ.ContainsAttribute(attrid) {
909
910
911
912
913
914
915
916
917
				managers[credid.Root()] = struct{}{}
			}
		}
	}

	return nil
}

func (conf *Configuration) checkIssuers(set *IrmaIdentifierSet, managers map[string]struct{}) error {
918
	for issid := range set.Issuers {
919
		if _, contains := conf.Issuers[issid]; !contains {
920
			managers[issid.Root()] = struct{}{}
921
		}
Sietse Ringers's avatar
Sietse Ringers committed
922
	}
923
924
925
	for issid, keyids := range set.PublicKeys {
		for _, keyid := range keyids {
			pk, err := conf.PublicKey(issid, keyid)
Sietse Ringers's avatar
Sietse Ringers committed
926
			if err != nil {
927
				return err
Sietse Ringers's avatar
Sietse Ringers committed
928
929
			}
			if pk == nil {
930
				managers[issid.Root()] = struct{}{}
931
932
933
			}
		}
	}
934
	return nil
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
}

func (i SchemeManagerIndex) String() string {
	var paths []string
	var b bytes.Buffer

	for path := range i {
		paths = append(paths, path)
	}
	sort.Strings(paths)

	for _, path := range paths {
		b.WriteString(hex.EncodeToString(i[path]))
		b.WriteString(" ")
		b.WriteString(path)
		b.WriteString("\n")
	}

	return b.String()
}

Sietse Ringers's avatar
Sietse Ringers committed
956
// FromString populates this index by parsing the specified string.
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
func (i SchemeManagerIndex) FromString(s string) error {
	for j, line := range strings.Split(s, "\n") {
		if len(line) == 0 {
			continue
		}
		parts := strings.Split(line, " ")
		if len(parts) != 2 {
			return errors.Errorf("Scheme manager index line %d has incorrect amount of parts", j)
		}
		hash, err := hex.DecodeString(parts[0])
		if err != nil {
			return err
		}
		i[parts[1]] = hash
	}

	return nil
}

976
// parseIndex parses the index file of the specified manager.
977
func (conf *Configuration) parseIndex(name string, manager *SchemeManager) (SchemeManagerIndex, error) {
Sietse Ringers's avatar
Sietse Ringers committed
978
	path := filepath.Join(conf.Path, name, "index")
Sietse Ringers's avatar
Sietse Ringers committed
979
	if err := fs.AssertPathExists(path); err != nil {
980
		return nil, fmt.Errorf("Missing scheme manager index file; tried %s", path)
981
	}
Sietse Ringers's avatar
Sietse Ringers committed
982
	indexbts, err := ioutil.ReadFile(path)
983
	if err != nil {
984
		return nil, err
985
	}
986
	index := SchemeManagerIndex(make(map[string]ConfigurationFileHash))
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
	if err = index.FromString(string(indexbts)); err != nil {
		return nil, err
	}

	return index, conf.checkUnsignedFiles(name, index)
}

func (conf *Configuration) checkUnsignedFiles(name string, index SchemeManagerIndex) error {
	return filepath.Walk(filepath.Join(conf.Path, name), func(path string, info os.FileInfo, err error) error {
		relpath, err := relativePath(conf.Path, path)
		if err != nil {
			return err
		}
		for _, ex := range sigExceptions {
			if ex.MatchString(relpath) {
				return nil
			}
		}

		if info.IsDir() {
			if !dirInScheme(index, relpath) {
				conf.Warnings = append(conf.Warnings, "Ignored dir: "+relpath)
			}
		} else {
			if _, ok := index[relpath]; !ok {
				conf.Warnings = append(conf.Warnings, "Ignored file: "+relpath)
			}
		}

		return nil
	})
}

func dirInScheme(index SchemeManagerIndex, dir string) bool {
	for indexpath := range index {
		if strings.HasPrefix(indexpath, dir) {
			return true
		}
	}
	return false
}

// These files never occur in a scheme's index
var sigExceptions = []*regexp.Regexp{
	regexp.MustCompile(`/.git(/.*)?`),
	regexp.MustCompile(`^.*?/pk\.pem$`),
	regexp.MustCompile(`^.*?/sk\.pem$`),
	regexp.MustCompile(`^.*?/index`),
	regexp.MustCompile(`^.*?/index\.sig`),
	regexp.MustCompile(`^.*?/AUTHORS$`),
	regexp.MustCompile(`^.*?/LICENSE$`),
	regexp.MustCompile(`^.*?/README\.md$`),
	regexp.MustCompile(`^.*?/.*?/PrivateKeys$`),
	regexp.MustCompile(`^.*?/.*?/PrivateKeys/\d+.xml$`),
	regexp.MustCompile(`\.DS_Store$`),
1042
1043
}

1044
func (conf *Configuration) VerifySchemeManager(manager *SchemeManager) error {
1045
	err := conf.VerifySignature(manager.Identifier())
1046
1047
1048
1049
	if err != nil {
		return err
	}

1050
	var exists bool
1051
	for file := range manager.index {
1052
		exists, err = fs.PathExists(filepath.Join(conf.Path, file))
1053
1054
1055
1056
1057
1058
		if err != nil {
			return err
		}
		if !exists {
			continue
		}
1059
		// Don't care about the actual bytes
1060
		if _, _, err = conf.ReadAuthenticatedFile(manager, file); err != nil {
1061
1062
1063
1064
1065
1066
1067
			return err
		}
	}

	return nil
}

1068
1069
1070
// ReadAuthenticatedFile reads the file at the specified path
// and verifies its authenticity by checking that the file hash
// is present in the (signed) scheme manager index file.
1071
func (conf *Configuration) ReadAuthenticatedFile(manager *SchemeManager, path string) ([]byte, bool, error) {
1072
	signedHash, ok := manager.index[filepath.ToSlash(path)]
1073
	if !ok {
1074
		return nil, false, nil
1075
1076
	}

Sietse Ringers's avatar
Sietse Ringers committed
1077
	bts, err := ioutil.ReadFile(filepath.Join(conf.Path, path))
1078
	if err != nil {
1079
		return nil, true, err
1080
1081
1082
1083
	}
	computedHash := sha256.Sum256(bts)

	if !bytes.Equal(computedHash[:], signedHash) {
1084
		return nil, true, errors.Errorf("Hash of %s does not match scheme manager index", path)
1085
	}
1086
	return bts, true, nil
1087
1088
1089
1090
1091
}

// VerifySignature verifies the signature on the scheme manager index file
// (which contains the SHA256 hashes of all files under this scheme manager,
// which are used for verifying file authenticity).
1092
func (conf *Configuration) VerifySignature(id SchemeManagerIdentifier) (err error) {
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
	defer func() {
		if r := recover(); r != nil {
			if e, ok := r.(error); ok {
				err = errors.Errorf("Scheme manager index signature failed to verify: %s", e.Error())
			} else {
				err = errors.New("Scheme manager index signature failed to verify")
			}
		}
	}()

Sietse Ringers's avatar
Sietse Ringers committed
1103
	dir := filepath.Join(conf.Path, id.String())
1104
	if err := fs.AssertPathExists(dir+"/index", dir+"/index.sig", dir+"/pk.pem"); err != nil {
1105
		return errors.New("Missing scheme manager index file, signature, or public key")
1106
1107
1108
1109
1110
	}

	// Read and hash index file
	indexbts, err := ioutil.ReadFile(dir + "/index")
	if err != nil {
1111
		return err
1112
1113
1114
1115
1116
1117
	}
	indexhash := sha256.Sum256(indexbts)

	// Read and parse scheme manager public key
	pkbts, err := ioutil.ReadFile(dir + "/pk.pem")
	if err != nil {