CredentialsManager.cc

// -*- mode: c++; c-basic-offset:4 -*-
 
// This file is part of the BES
 
// Copyright (c) 2020 OPeNDAP, Inc.
// Author: Nathan Potter<ndp@opendap.org>
//
// This library is free software; you can redistribute it and/or
// modify it under the terms of the GNU Lesser General Public
// License as published by the Free Software Foundation; either
// version 2.1 of the License, or (at your option) any later version.
//
// This library is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
// Lesser General Public License for more details.
//
// You should have received a copy of the GNU Lesser General Public
// License along with this library; if not, write to the Free Software
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
//
// You can contact OPeNDAP, Inc. at PO Box 112, Saunderstown, RI. 02874-0112.
// Created by ndp on 12/11/19.
//
 
#include "config.h"
 
#include <cstdlib>
#include <cstring>
#include <iomanip>
#include <sstream>
#include <locale>
#include <string>
#include <sys/stat.h>
 
#include "AllowedHosts.h"
#include "TheBESKeys.h"
#include "kvp_utils.h"
#include "BESInternalError.h"
#include "BESDebug.h"
#include "CurlUtils.h"
#include "HttpNames.h"
 
#include "CredentialsManager.h"
#include "NgapS3Credentials.h"
#include "DmrppNames.h"
 
using namespace std;
 
#define prolog std::string("CredentialsManager::").append(__func__).append("() - ")
 
// Class vocabulary
const char *CredentialsManager::ENV_ID_KEY     = "CMAC_ID";
const char *CredentialsManager::ENV_ACCESS_KEY = "CMAC_ACCESS_KEY";
const char *CredentialsManager::ENV_REGION_KEY = "CMAC_REGION";
const char *CredentialsManager::ENV_BUCKET_KEY = "CMAC_BUCKET";
const char *CredentialsManager::ENV_URL_KEY    = "CMAC_URL";
 
const char *CredentialsManager::USE_ENV_CREDS_KEY_VALUE = "ENV_CREDS";
 
CredentialsManager *CredentialsManager::theMngr = nullptr;
 
static std::once_flag d_cmac_init_once;
 
 
// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
//
// Helper Functions
//
std::string get_env_value(const string &key){
    string value;
    const char *cstr = getenv(key.c_str());
    if(cstr){
        value.assign(cstr);
        BESDEBUG(CREDS, prolog << "From system environment - " << key << ": " << value << endl);
    }
    else {
        value.clear();
    }
    return value;
}
 
// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
//
// class CredentialsManager
//
 
CredentialsManager *CredentialsManager::theCM(){
 
    std::call_once(d_cmac_init_once,CredentialsManager::initialize_instance);
    return theMngr;
}
 
void CredentialsManager::initialize_instance()
{
    theMngr = new CredentialsManager;
#ifdef HAVE_ATEXIT
    atexit(delete_instance);
#endif
 
}
 
CredentialsManager::CredentialsManager(): ngaps3CredentialsLoaded(false){
    // d_netrc_filename = curl::get_netrc_filename();
}
 
 
CredentialsManager::~CredentialsManager() {
    for (std::map<std::string, AccessCredentials *>::iterator it = creds.begin(); it != creds.end(); ++it) {
        delete it->second;
    }
    creds.clear();
}
 
 
void CredentialsManager::delete_instance()
{
    delete theMngr;
    theMngr = 0;
}
 
 
void
CredentialsManager::add(const std::string &key, AccessCredentials *ac){
    // This lock is a RAII implementation. It will block until the mutex is
    // available and the lock will be released when the instance is destroyed.
    std::lock_guard<std::recursive_mutex> lock_me(d_lock_mutex);
 
    creds.insert(std::pair<std::string,AccessCredentials *>(key, ac));
    BESDEBUG(CREDS, prolog << "Added AccessCredentials to CredentialsManager. credentials: " << endl <<  ac->to_json() << endl);
}
 
AccessCredentials*
CredentialsManager::get(shared_ptr<http::url> &url){
    // This lock is a RAII implementation. It will block until the mutex is
    // available and the lock will be released when the instance is destroyed.
    std::lock_guard<std::recursive_mutex> lock_me(d_lock_mutex);
 
    AccessCredentials *best_match = NULL;
    std::string best_key("");
 
    if(url->protocol() == HTTP_PROTOCOL || url->protocol() == HTTPS_PROTOCOL) {
        for (std::map<std::string, AccessCredentials *>::iterator it = creds.begin(); it != creds.end(); ++it) {
            std::string key = it->first;
            if (url->str().rfind(key, 0) == 0) {
                // url starts with key
                if (key.length() > best_key.length()) {
                    best_key = key;
                    best_match = it->second;
                }
            }
        }
    }
    return best_match;
}
 
bool file_exists(const string &filename) {
    struct stat buffer;
    return (stat (filename.c_str(), &buffer) == 0);
}
 
bool file_is_secured(const string &filename) {
    struct stat st;
    if (stat(filename.c_str(), &st) != 0) {
        string err;
        err.append("file_is_secured() Unable to access file ");
        err.append(filename).append("  strerror: ").append(strerror(errno));
        throw BESInternalError(err, __FILE__, __LINE__);
    }
 
    mode_t perm = st.st_mode;
    bool status;
    status = (perm & S_IRUSR) && !(
            // (perm & S_IWUSR) || // We don't need to enforce user no write
            (perm & S_IXUSR) ||
            (perm & S_IRGRP) ||
            (perm & S_IWGRP) ||
            (perm & S_IXGRP) ||
            (perm & S_IROTH) ||
            (perm & S_IWOTH) ||
            (perm & S_IXOTH));
    BESDEBUG(CREDS, prolog << "file_is_secured() " << filename << " secured: " << (status ? "true" : "false") << endl);
    return status;
}
 
void CredentialsManager::load_credentials( ) {
 
    // This lock is a RAII implementation. It will block until the mutex is
    // available and the lock will be released when the instance is destroyed.
    std::lock_guard<std::recursive_mutex> lock_me(d_lock_mutex);
 
    bool found_key = true;
    AccessCredentials *accessCredentials;
    map<string, AccessCredentials *> credential_sets;
 
    string config_file;
    TheBESKeys::TheKeys()->get_value(CATALOG_MANAGER_CREDENTIALS, config_file, found_key);
    if(!found_key){
        BESDEBUG(CREDS, prolog << "The BES key " << CATALOG_MANAGER_CREDENTIALS
        << " was not found in the BES configuration tree. No AccessCredentials were loaded" << endl);
        return;
    }
 
    // Does the configuration indicate that credentials will be submitted via the runtime environment?
    if(config_file == string(CredentialsManager::USE_ENV_CREDS_KEY_VALUE)){
        // Apparently so...
        accessCredentials = theCM()->load_credentials_from_env();
        if(accessCredentials){
            // So if we have them, we add them to theCM() and then return without processing the configuration.
            string url = accessCredentials->get(AccessCredentials::URL_KEY);
            theCM()->add(url,accessCredentials);
        }
        // Environment injected credentials override all other configuration credentials.
        // Since the value of CATALOG_MANAGER_CREDENTIALS is  ENV_CREDS_VALUE there is no
        // Configuration file identified, so wether or not valid credentials information was
        // found in the ENV we simply return.
        return;
    }
 
    load_ngap_s3_credentials();
 
    if(!file_exists(config_file)){
        BESDEBUG(CREDS, prolog << "The file specified by the BES key " << CATALOG_MANAGER_CREDENTIALS
        << " does not exist. No Access Credentials were loaded." << endl);
        return;
    }
 
    if (!file_is_secured(config_file)) {
        string err;
        err.append("CredentialsManager config file ");
        err.append(config_file);
        err.append(" is not secured! ");
        err.append("Set the access permissions to -rw------- (600) and try again.");
        throw BESInternalError(err, __FILE__, __LINE__);
    }
    BESDEBUG(CREDS, prolog << "The config file '" << config_file << "' is secured." << endl);
 
    map <string, vector<string>> keystore;
 
    kvp::load_keys(config_file, keystore);
 
    for(map <string, vector<string>>::iterator it=keystore.begin(); it!=keystore.end(); it++) {
        string creds_name = it->first;
        vector<string> &credentials_entries = it->second;
        map<string, AccessCredentials *>::iterator mit;
        mit = credential_sets.find(creds_name);
        if (mit != credential_sets.end()) {  // New?
            // Nope.
            accessCredentials = mit->second;
        } else {
            // Make new one
            accessCredentials = new AccessCredentials(creds_name);
            credential_sets.insert(pair<string, AccessCredentials *>(creds_name, accessCredentials));
        }
        for (vector<string>::iterator jt = credentials_entries.begin(); jt != credentials_entries.end(); jt++) {
            string credentials_entry = *jt;
            int index = credentials_entry.find(":");
            if (index > 0) {
                string key_name = credentials_entry.substr(0, index);
                string value = credentials_entry.substr(index + 1);
                BESDEBUG(CREDS, prolog << creds_name << ":" << key_name << "=" << value << endl);
                accessCredentials->add(key_name, value);
            }
        }
    }
    BESDEBUG(CREDS, prolog << "Loaded " << credential_sets.size()  << " AccessCredentials" << endl);
    vector<AccessCredentials *> bad_creds;
    map<string,AccessCredentials *>::iterator acit;
 
    for (acit = credential_sets.begin(); acit != credential_sets.end(); acit++) {
        accessCredentials = acit->second;
        string url = accessCredentials->get(AccessCredentials::URL_KEY);
        if(url.length()){
            theCM()->add(url,accessCredentials);
        }
        else {
            bad_creds.push_back(acit->second);
        }
    }
    if(bad_creds.size()){
        stringstream ss;
        vector<AccessCredentials * >::iterator bc;
 
        ss << "Encountered " << bad_creds.size() <<  " AccessCredentials "
           << " definitions missing an associated URL. offenders: ";
 
        for (bc = bad_creds.begin(); bc != bad_creds.end(); bc++) {
            ss << (*bc)->name() << "  ";
            credential_sets.erase((*bc)->name());
            delete *bc;
        }
        throw BESInternalError( ss.str(), __FILE__, __LINE__);
    }
    BESDEBUG(CREDS, prolog << "Successfully ingested " << theCM()->size()  << " AccessCredentials" << endl);
 
}
 
 
AccessCredentials *CredentialsManager::load_credentials_from_env( ) {
 
    // This lock is a RAII implementation. It will block until the mutex is
    // available and the lock will be released when the instance is destroyed.
    std::lock_guard<std::recursive_mutex> lock_me(d_lock_mutex);
 
    AccessCredentials *ac = nullptr;
    string env_url, env_id, env_access_key, env_region, env_bucket;
 
    // If we are in developer mode then we compile this section which
    // allows us to inject credentials via the system environment
 
    env_id.assign(        get_env_value(CredentialsManager::ENV_ID_KEY));
    env_access_key.assign(get_env_value(CredentialsManager::ENV_ACCESS_KEY));
    env_region.assign(    get_env_value(CredentialsManager::ENV_REGION_KEY));
    //env_bucket.assign(    get_env_value(CredentialsManager::ENV_BUCKET_KEY));
    env_url.assign(       get_env_value(CredentialsManager::ENV_URL_KEY));
 
    if(env_url.length() &&
            env_id.length() &&
            env_access_key.length() &&
            // env_bucket.length() &&
            env_region.length() ){
        ac = new AccessCredentials();
        ac->add(AccessCredentials::URL_KEY, env_url);
        ac->add(AccessCredentials::ID_KEY, env_id);
        ac->add(AccessCredentials::KEY_KEY, env_access_key);
        ac->add(AccessCredentials::REGION_KEY, env_region);
       // ac->add(AccessCredentials::BUCKET_KEY, env_bucket);
    }
    return ac;
}
 
 
std::string NGAP_S3_BASE_DEFAULT="https://";
void  CredentialsManager::load_ngap_s3_credentials( ){
    // This lock is a RAII implementation. It will block until the mutex is
    // available and the lock will be released when the instance is destroyed.
    std::lock_guard<std::recursive_mutex> lock_me(d_lock_mutex);
 
    string s3_distribution_endpoint_url;
    bool found;
    TheBESKeys::TheKeys()->get_value(NgapS3Credentials::BES_CONF_S3_ENDPOINT_KEY,s3_distribution_endpoint_url,found);
    if(found) {
        string value;
 
        long refresh_margin = 600;
        TheBESKeys::TheKeys()->get_value(NgapS3Credentials::BES_CONF_REFRESH_KEY, value, found);
        if (found) {
            refresh_margin = strtol(value.c_str(), 0, 10);
        }
 
        string s3_base_url = NGAP_S3_BASE_DEFAULT;
        TheBESKeys::TheKeys()->get_value(NgapS3Credentials::BES_CONF_URL_BASE, value, found);
        if (found) {
            s3_base_url = value;
        }
 
        NgapS3Credentials *nsc = new NgapS3Credentials(s3_distribution_endpoint_url, refresh_margin);
        nsc->add(NgapS3Credentials::URL_KEY, s3_base_url);
        nsc->name("NgapS3Credentials");
 
        CredentialsManager::theCM()->add(s3_base_url,nsc);
        CredentialsManager::theCM()->ngaps3CredentialsLoaded = true;
 
    }
    else {
        BESDEBUG(CREDS,prolog << "WARNING: The BES configuration did not contain an instance of " <<
                NgapS3Credentials::BES_CONF_S3_ENDPOINT_KEY <<
                " NGAP S3 Credentials NOT loaded." << endl);
    }
}