/
irmaconfig.go
1521 lines (1360 loc) · 47.1 KB
/
irmaconfig.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
package irma
import (
"crypto/rsa"
"encoding/base64"
"encoding/xml"
"io/ioutil"
"os"
"path/filepath"
"reflect"
"regexp"
"strconv"
"time"
"crypto/sha256"
"fmt"
"strings"
"sort"
"bytes"
"encoding/hex"
"crypto/ecdsa"
"crypto/x509"
"encoding/asn1"
"encoding/pem"
gobig "math/big"
"github.com/dgrijalva/jwt-go"
"github.com/go-errors/errors"
"github.com/jasonlvhit/gocron"
"github.com/privacybydesign/gabi"
"github.com/privacybydesign/gabi/big"
"github.com/privacybydesign/irmago/internal/fs"
)
// Configuration keeps track of scheme managers, issuers, credential types and public keys,
// dezerializing them from an irma_configuration folder, and downloads and saves new ones on demand.
type Configuration struct {
SchemeManagers map[SchemeManagerIdentifier]*SchemeManager
Issuers map[IssuerIdentifier]*Issuer
CredentialTypes map[CredentialTypeIdentifier]*CredentialType
AttributeTypes map[AttributeTypeIdentifier]*AttributeType
// Path to the irma_configuration folder that this instance represents
Path string
// DisabledSchemeManagers keeps track of scheme managers that did not parse succesfully
// (i.e., invalid signature, parsing error), and the problem that occurred when parsing them
DisabledSchemeManagers map[SchemeManagerIdentifier]*SchemeManagerError
Warnings []string
kssPublicKeys map[SchemeManagerIdentifier]map[int]*rsa.PublicKey
publicKeys map[IssuerIdentifier]map[int]*gabi.PublicKey
privateKeys map[IssuerIdentifier]*gabi.PrivateKey
reverseHashes map[string]CredentialTypeIdentifier
initialized bool
assets string
readOnly bool
cronchan chan bool
scheduler *gocron.Scheduler
}
// ConfigurationFileHash encodes the SHA256 hash of an authenticated
// file under a scheme manager within the configuration folder.
type ConfigurationFileHash []byte
// SchemeManagerIndex is a (signed) list of files under a scheme manager
// along with their SHA266 hash
type SchemeManagerIndex map[string]ConfigurationFileHash
type SchemeManagerStatus string
type SchemeManagerError struct {
Manager SchemeManagerIdentifier
Status SchemeManagerStatus
Err error
}
type UnknownIdentifierError struct {
ErrorType
Missing *IrmaIdentifierSet
}
const (
SchemeManagerStatusValid = SchemeManagerStatus("Valid")
SchemeManagerStatusUnprocessed = SchemeManagerStatus("Unprocessed")
SchemeManagerStatusInvalidIndex = SchemeManagerStatus("InvalidIndex")
SchemeManagerStatusInvalidSignature = SchemeManagerStatus("InvalidSignature")
SchemeManagerStatusParsingError = SchemeManagerStatus("ParsingError")
SchemeManagerStatusContentParsingError = SchemeManagerStatus("ContentParsingError")
pubkeyPattern = "%s/%s/%s/PublicKeys/*.xml"
privkeyPattern = "%s/%s/%s/PrivateKeys/*.xml"
)
func (sme SchemeManagerError) Error() string {
return fmt.Sprintf("Error parsing scheme manager %s: %s", sme.Manager.Name(), sme.Err.Error())
}
// NewConfiguration returns a new configuration. After this
// ParseFolder() should be called to parse the specified path.
func NewConfiguration(path string) (*Configuration, error) {
return newConfiguration(path, "")
}
// NewConfigurationReadOnly returns a new configuration whose representation on disk
// is never altered. ParseFolder() should be called to parse the specified path.
func NewConfigurationReadOnly(path string) (*Configuration, error) {
conf, err := newConfiguration(path, "")
if err != nil {
return nil, err
}
conf.readOnly = true
return conf, nil
}
// NewConfigurationFromAssets returns a new configuration, copying the schemes out of the assets folder to path.
// ParseFolder() should be called to parse the specified path.
func NewConfigurationFromAssets(path, assets string) (*Configuration, error) {
return newConfiguration(path, assets)
}
func newConfiguration(path string, assets string) (conf *Configuration, err error) {
conf = &Configuration{
Path: path,
assets: assets,
}
if conf.assets != "" { // If an assets folder is specified, then it must exist
if err = fs.AssertPathExists(conf.assets); err != nil {
return nil, errors.WrapPrefix(err, "Nonexistent assets folder specified", 0)
}
}
if err = fs.EnsureDirectoryExists(conf.Path); err != nil {
return nil, err
}
// Init all maps
conf.clear()
return
}
func (conf *Configuration) clear() {
conf.SchemeManagers = make(map[SchemeManagerIdentifier]*SchemeManager)
conf.Issuers = make(map[IssuerIdentifier]*Issuer)
conf.CredentialTypes = make(map[CredentialTypeIdentifier]*CredentialType)
conf.AttributeTypes = make(map[AttributeTypeIdentifier]*AttributeType)
conf.DisabledSchemeManagers = make(map[SchemeManagerIdentifier]*SchemeManagerError)
conf.kssPublicKeys = make(map[SchemeManagerIdentifier]map[int]*rsa.PublicKey)
conf.publicKeys = make(map[IssuerIdentifier]map[int]*gabi.PublicKey)
conf.privateKeys = make(map[IssuerIdentifier]*gabi.PrivateKey)
conf.reverseHashes = make(map[string]CredentialTypeIdentifier)
}
// ParseFolder populates the current Configuration by parsing the storage path,
// listing the containing scheme managers, issuers and credential types.
func (conf *Configuration) ParseFolder() (err error) {
// Init all maps
conf.clear()
// Copy any new or updated scheme managers out of the assets into storage
if conf.assets != "" {
err = iterateSubfolders(conf.assets, func(dir string, _ os.FileInfo) error {
scheme := NewSchemeManagerIdentifier(filepath.Base(dir))
uptodate, err := conf.isUpToDate(scheme)
if err != nil {
return err
}
if !uptodate {
_, err = conf.CopyManagerFromAssets(scheme)
}
return err
})
if err != nil {
return err
}
}
// Parse scheme managers in storage
var mgrerr *SchemeManagerError
err = iterateSubfolders(conf.Path, func(dir string, _ os.FileInfo) error {
manager := NewSchemeManager(filepath.Base(dir))
err := conf.ParseSchemeManagerFolder(dir, manager)
if err == nil {
return nil // OK, do next scheme manager folder
}
// If there is an error, and it is of type SchemeManagerError, return nil
// so as to continue parsing other managers.
var ok bool
if mgrerr, ok = err.(*SchemeManagerError); ok {
conf.DisabledSchemeManagers[manager.Identifier()] = mgrerr
return nil
}
return err // Not a SchemeManagerError? return it & halt parsing now
})
if err != nil {
return
}
conf.initialized = true
if mgrerr != nil {
return mgrerr
}
return
}
// ParseOrRestoreFolder parses the irma_configuration folder, and when possible attempts to restore
// any broken scheme managers from their remote.
// Any error encountered during parsing is considered recoverable only if it is of type *SchemeManagerError;
// In this case the scheme in which it occured is downloaded from its remote and re-parsed.
// If any other error is encountered at any time, it is returned immediately.
// If no error is returned, parsing and possibly restoring has been succesfull, and there should be no
// disabled scheme managers.
func (conf *Configuration) ParseOrRestoreFolder() error {
err := conf.ParseFolder()
// Only in case of a *SchemeManagerError might we be able to recover
if _, isSchemeMgrErr := err.(*SchemeManagerError); !isSchemeMgrErr {
return err
}
if err != nil && (conf.assets == "" || conf.readOnly) {
return err
}
for id := range conf.DisabledSchemeManagers {
if err = conf.ReinstallSchemeManager(conf.SchemeManagers[id]); err == nil {
continue
}
if _, err = conf.CopyManagerFromAssets(id); err != nil {
return err // File system error, too serious, bail out now
}
name := id.String()
if err = conf.ParseSchemeManagerFolder(filepath.Join(conf.Path, name), NewSchemeManager(name)); err == nil {
delete(conf.DisabledSchemeManagers, id)
}
}
return err
}
// ParseSchemeManagerFolder parses the entire tree of the specified scheme manager
// If err != nil then a problem occured
func (conf *Configuration) ParseSchemeManagerFolder(dir string, manager *SchemeManager) (err error) {
// From this point, keep it in our map even if it has an error. The user must check either:
// - manager.Status == SchemeManagerStatusValid, aka "VALID"
// - or equivalently, manager.Valid == true
// before using any scheme manager for anything, and handle accordingly
conf.SchemeManagers[manager.Identifier()] = manager
// Ensure we return a SchemeManagerError when any error occurs
defer func() {
if err != nil {
err = &SchemeManagerError{
Manager: manager.Identifier(),
Err: err,
Status: manager.Status,
}
}
}()
// Verify signature and read scheme manager description
if err = conf.VerifySignature(manager.Identifier()); err != nil {
return
}
if manager.index, err = conf.parseIndex(filepath.Base(dir), manager); err != nil {
manager.Status = SchemeManagerStatusInvalidIndex
return
}
exists, err := conf.pathToDescription(manager, dir+"/description.xml", manager)
if err != nil {
manager.Status = SchemeManagerStatusParsingError
return
}
if !exists {
manager.Status = SchemeManagerStatusParsingError
return errors.New("Scheme manager description not found")
}
if err = conf.validateScheme(manager, dir); err != nil {
return
}
// Verify that all other files are validly signed
err = conf.VerifySchemeManager(manager)
if err != nil {
manager.Status = SchemeManagerStatusInvalidSignature
return
}
// Read timestamp indicating time of last modification
ts, exists, err := readTimestamp(dir + "/timestamp")
if err != nil || !exists {
return errors.WrapPrefix(err, "Could not read scheme manager timestamp", 0)
}
manager.Timestamp = *ts
// Parse contained issuers and credential types
err = conf.parseIssuerFolders(manager, dir)
if err != nil {
manager.Status = SchemeManagerStatusContentParsingError
return
}
manager.Status = SchemeManagerStatusValid
manager.Valid = true
return
}
// PrivateKey returns the specified private key, or nil if not present in the Configuration.
func (conf *Configuration) PrivateKey(id IssuerIdentifier) (*gabi.PrivateKey, error) {
if sk := conf.privateKeys[id]; sk != nil {
return sk, nil
}
path := fmt.Sprintf(privkeyPattern, conf.Path, id.SchemeManagerIdentifier().Name(), id.Name())
files, err := filepath.Glob(path)
if err != nil {
return nil, err
}
if len(files) == 0 {
return nil, nil
}
// List private keys and get highest counter
counters := make([]int, 0, len(files))
for _, file := range files {
filename := filepath.Base(file)
count := filename[:len(filename)-4]
i, err := strconv.Atoi(count)
if err != nil {
return nil, err
}
counters = append(counters, i)
}
sort.Ints(counters)
counter := counters[len(counters)-1]
// Read private key
file := strings.Replace(path, "*", strconv.Itoa(counter), 1)
sk, err := gabi.NewPrivateKeyFromFile(file)
if err != nil {
return nil, err
}
if int(sk.Counter) != counter {
return nil, errors.Errorf("Private key %s of issuer %s has wrong <Counter>", file, id.String())
}
conf.privateKeys[id] = sk
return sk, nil
}
// PublicKey returns the specified public key, or nil if not present in the Configuration.
func (conf *Configuration) PublicKey(id IssuerIdentifier, counter int) (*gabi.PublicKey, error) {
var haveIssuer, haveKey bool
var err error
_, haveIssuer = conf.publicKeys[id]
if haveIssuer {
_, haveKey = conf.publicKeys[id][counter]
}
// If we have not seen this issuer or key before in conf.publicKeys,
// try to parse the public key folder; new keys might have been put there since we last parsed it
if !haveIssuer || !haveKey {
if err = conf.parseKeysFolder(id); err != nil {
return nil, err
}
}
return conf.publicKeys[id][counter], nil
}
// KeyshareServerKeyFunc returns a function that returns the public key with which to verify a keyshare server JWT,
// suitable for passing to jwt.Parse() and jwt.ParseWithClaims().
func (conf *Configuration) KeyshareServerKeyFunc(scheme SchemeManagerIdentifier) func(t *jwt.Token) (interface{}, error) {
return func(t *jwt.Token) (i interface{}, e error) {
var kid int
if kidstr, ok := t.Header["kid"].(string); ok {
var err error
if kid, err = strconv.Atoi(kidstr); err != nil {
return nil, err
}
}
return conf.KeyshareServerPublicKey(scheme, kid)
}
}
// KeyshareServerPublicKey returns the i'th public key of the specified scheme.
func (conf *Configuration) KeyshareServerPublicKey(scheme SchemeManagerIdentifier, i int) (*rsa.PublicKey, error) {
if _, contains := conf.kssPublicKeys[scheme]; !contains {
conf.kssPublicKeys[scheme] = make(map[int]*rsa.PublicKey)
}
if _, contains := conf.kssPublicKeys[scheme][i]; !contains {
pkbts, err := ioutil.ReadFile(filepath.Join(conf.Path, scheme.Name(), fmt.Sprintf("kss-%d.pem", i)))
if err != nil {
return nil, err
}
pkblk, _ := pem.Decode(pkbts)
genericPk, err := x509.ParsePKIXPublicKey(pkblk.Bytes)
if err != nil {
return nil, err
}
pk, ok := genericPk.(*rsa.PublicKey)
if !ok {
return nil, errors.New("Invalid keyshare server public key")
}
conf.kssPublicKeys[scheme][i] = pk
}
return conf.kssPublicKeys[scheme][i], nil
}
func (conf *Configuration) addReverseHash(credid CredentialTypeIdentifier) {
hash := sha256.Sum256([]byte(credid.String()))
conf.reverseHashes[base64.StdEncoding.EncodeToString(hash[:16])] = credid
}
func (conf *Configuration) hashToCredentialType(hash []byte) *CredentialType {
if str, exists := conf.reverseHashes[base64.StdEncoding.EncodeToString(hash)]; exists {
return conf.CredentialTypes[str]
}
return nil
}
// IsInitialized indicates whether this instance has successfully been initialized.
func (conf *Configuration) IsInitialized() bool {
return conf.initialized
}
// Prune removes any invalid scheme managers and everything they own from this Configuration
func (conf *Configuration) Prune() {
for _, manager := range conf.SchemeManagers {
if !manager.Valid {
_ = conf.RemoveSchemeManager(manager.Identifier(), false) // does not return errors
}
}
}
func (conf *Configuration) parseIssuerFolders(manager *SchemeManager, path string) error {
return iterateSubfolders(path, func(dir string, _ os.FileInfo) error {
issuer := &Issuer{}
exists, err := conf.pathToDescription(manager, dir+"/description.xml", issuer)
if err != nil {
return err
}
if !exists {
return nil
}
if issuer.XMLVersion < 4 {
return errors.New("Unsupported issuer description")
}
if err = conf.validateIssuer(manager, issuer, dir); err != nil {
return err
}
conf.Issuers[issuer.Identifier()] = issuer
issuer.Valid = conf.SchemeManagers[issuer.SchemeManagerIdentifier()].Valid
return conf.parseCredentialsFolder(manager, issuer, dir+"/Issues/")
})
}
func (conf *Configuration) DeleteSchemeManager(id SchemeManagerIdentifier) error {
delete(conf.SchemeManagers, id)
delete(conf.DisabledSchemeManagers, id)
name := id.String()
for iss := range conf.Issuers {
if iss.Root() == name {
delete(conf.Issuers, iss)
}
}
for iss := range conf.publicKeys {
if iss.Root() == name {
delete(conf.publicKeys, iss)
}
}
for cred := range conf.CredentialTypes {
if cred.Root() == name {
delete(conf.CredentialTypes, cred)
}
}
if !conf.readOnly {
return os.RemoveAll(filepath.Join(conf.Path, id.Name()))
}
return nil
}
// parse $schememanager/$issuer/PublicKeys/$i.xml for $i = 1, ...
func (conf *Configuration) parseKeysFolder(issuerid IssuerIdentifier) error {
manager := conf.SchemeManagers[issuerid.SchemeManagerIdentifier()]
conf.publicKeys[issuerid] = map[int]*gabi.PublicKey{}
path := fmt.Sprintf(pubkeyPattern, conf.Path, issuerid.SchemeManagerIdentifier().Name(), issuerid.Name())
files, err := filepath.Glob(path)
if err != nil {
return err
}
for _, file := range files {
filename := filepath.Base(file)
count := filename[:len(filename)-4]
i, err := strconv.Atoi(count)
if err != nil {
return err
}
relativepath, err := filepath.Rel(conf.Path, file)
if err != nil {
return err
}
bts, found, err := conf.ReadAuthenticatedFile(manager, relativepath)
if err != nil || !found {
return err
}
pk, err := gabi.NewPublicKeyFromBytes(bts)
if err != nil {
return err
}
if int(pk.Counter) != i {
return errors.Errorf("Public key %s of issuer %s has wrong <Counter>", file, issuerid.String())
}
pk.Issuer = issuerid.String()
conf.publicKeys[issuerid][i] = pk
}
return nil
}
func (conf *Configuration) PublicKeyIndices(issuerid IssuerIdentifier) (i []int, err error) {
return conf.matchKeyPattern(issuerid, pubkeyPattern)
}
func (conf *Configuration) matchKeyPattern(issuerid IssuerIdentifier, pattern string) (i []int, err error) {
pkpath := fmt.Sprintf(pattern, conf.Path, issuerid.SchemeManagerIdentifier().Name(), issuerid.Name())
files, err := filepath.Glob(pkpath)
if err != nil {
return
}
for _, file := range files {
var count int
base := filepath.Base(file)
if count, err = strconv.Atoi(base[:len(base)-4]); err != nil {
return
}
i = append(i, count)
}
sort.Ints(i)
return
}
// parse $schememanager/$issuer/Issues/*/description.xml
func (conf *Configuration) parseCredentialsFolder(manager *SchemeManager, issuer *Issuer, path string) error {
var foundcred bool
err := iterateSubfolders(path, func(dir string, _ os.FileInfo) error {
cred := &CredentialType{}
exists, err := conf.pathToDescription(manager, dir+"/description.xml", cred)
if err != nil {
return err
}
if !exists {
return nil
}
if err = conf.validateCredentialType(manager, issuer, cred, dir); err != nil {
return err
}
foundcred = true
cred.Valid = conf.SchemeManagers[cred.SchemeManagerIdentifier()].Valid
credid := cred.Identifier()
conf.CredentialTypes[credid] = cred
conf.addReverseHash(credid)
for index, attr := range cred.AttributeTypes {
attr.Index = index
attr.SchemeManagerID = cred.SchemeManagerID
attr.IssuerID = cred.IssuerID
attr.CredentialTypeID = cred.ID
conf.AttributeTypes[attr.GetAttributeTypeIdentifier()] = attr
}
return nil
})
if !foundcred {
conf.Warnings = append(conf.Warnings, fmt.Sprintf("Issuer %s has no credential types", issuer.Identifier().String()))
}
return err
}
// iterateSubfolders iterates over the subfolders of the specified path,
// calling the specified handler each time. If anything goes wrong, or
// if the caller returns a non-nil error, an error is immediately returned.
func iterateSubfolders(path string, handler func(string, os.FileInfo) error) error {
return iterateFiles(path, true, handler)
}
func iterateFiles(path string, onlyDirs bool, handler func(string, os.FileInfo) error) error {
files, err := filepath.Glob(filepath.Join(path, "*"))
if err != nil {
return err
}
for _, file := range files {
stat, err := os.Stat(file)
if err != nil {
return err
}
if onlyDirs && !stat.IsDir() {
continue
}
if filepath.Base(file) == ".git" {
continue
}
err = handler(file, stat)
if err != nil {
return err
}
}
return nil
}
// walkDir recursively walks the file tree rooted at path, following symlinks (unlike filepath.Walk).
// Avoiding loops is the responsibility of the caller.
func walkDir(path string, handler func(string, os.FileInfo) error) error {
return iterateFiles(path, false, func(p string, info os.FileInfo) error {
if info.IsDir() {
if err := handler(p, info); err != nil {
return err
}
return walkDir(p, handler)
}
return handler(p, info)
})
}
func (conf *Configuration) pathToDescription(manager *SchemeManager, path string, description interface{}) (bool, error) {
if _, err := os.Stat(path); err != nil {
return false, nil
}
relativepath, err := filepath.Rel(conf.Path, path)
if err != nil {
return false, err
}
bts, found, err := conf.ReadAuthenticatedFile(manager, relativepath)
if !found {
if manager.index.Scheme() != manager.Identifier() {
return false, errors.Errorf("Folder must be called %s, not %s", manager.index.Scheme(), manager.ID)
}
return false, errors.Errorf("File %s not present in scheme index", relativepath)
}
if err != nil {
return true, err
}
err = xml.Unmarshal(bts, description)
if err != nil {
return true, err
}
return true, nil
}
// ContainsCredentialType checks if the configuration contains the specified credential type.
func (conf *Configuration) ContainsCredentialType(cred CredentialTypeIdentifier) bool {
return conf.SchemeManagers[cred.IssuerIdentifier().SchemeManagerIdentifier()] != nil &&
conf.Issuers[cred.IssuerIdentifier()] != nil &&
conf.CredentialTypes[cred] != nil
}
func (conf *Configuration) ContainsAttributeType(attr AttributeTypeIdentifier) bool {
_, contains := conf.AttributeTypes[attr]
return contains && conf.ContainsCredentialType(attr.CredentialTypeIdentifier())
}
func (conf *Configuration) isUpToDate(scheme SchemeManagerIdentifier) (bool, error) {
if conf.assets == "" || conf.readOnly {
return true, nil
}
name := scheme.String()
newTime, exists, err := readTimestamp(filepath.Join(conf.assets, name, "timestamp"))
if err != nil || !exists {
return true, errors.WrapPrefix(err, "Could not read asset timestamp of scheme "+name, 0)
}
// The storage version of the manager does not need to have a timestamp. If it does not, it is outdated.
oldTime, exists, err := readTimestamp(filepath.Join(conf.Path, name, "timestamp"))
if err != nil {
return true, err
}
return exists && !newTime.After(*oldTime), nil
}
func (conf *Configuration) CopyManagerFromAssets(scheme SchemeManagerIdentifier) (bool, error) {
if conf.assets == "" || conf.readOnly {
return false, nil
}
// Remove old version; we want an exact copy of the assets version
// not a merge of the assets version and the storage version
name := scheme.String()
if err := os.RemoveAll(filepath.Join(conf.Path, name)); err != nil {
return false, err
}
return true, fs.CopyDirectory(
filepath.Join(conf.assets, name),
filepath.Join(conf.Path, name),
)
}
// DownloadSchemeManager downloads and returns a scheme manager description.xml file
// from the specified URL.
func DownloadSchemeManager(url string) (*SchemeManager, error) {
if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") {
url = "https://" + url
}
if url[len(url)-1] == '/' {
url = url[:len(url)-1]
}
if strings.HasSuffix(url, "/description.xml") {
url = url[:len(url)-len("/description.xml")]
}
b, err := NewHTTPTransport(url).GetBytes("description.xml")
if err != nil {
return nil, err
}
manager := NewSchemeManager("")
if err = xml.Unmarshal(b, manager); err != nil {
return nil, err
}
manager.URL = url // TODO?
return manager, nil
}
// RemoveSchemeManager removes the specified scheme manager and all associated issuers,
// public keys and credential types from this Configuration.
func (conf *Configuration) RemoveSchemeManager(id SchemeManagerIdentifier, fromStorage bool) error {
// Remove everything falling under the manager's responsibility
for credid := range conf.CredentialTypes {
if credid.IssuerIdentifier().SchemeManagerIdentifier() == id {
delete(conf.CredentialTypes, credid)
}
}
for issid := range conf.Issuers {
if issid.SchemeManagerIdentifier() == id {
delete(conf.Issuers, issid)
}
}
for issid := range conf.publicKeys {
if issid.SchemeManagerIdentifier() == id {
delete(conf.publicKeys, issid)
}
}
delete(conf.SchemeManagers, id)
if fromStorage || !conf.readOnly {
return os.RemoveAll(fmt.Sprintf("%s/%s", conf.Path, id.String()))
}
return nil
}
func (conf *Configuration) ReinstallSchemeManager(manager *SchemeManager) (err error) {
if conf.readOnly {
return errors.New("cannot install scheme into a read-only configuration")
}
// Check if downloading stuff from the remote works before we uninstall the specified manager:
// If we can't download anything we should keep the broken version
manager, err = DownloadSchemeManager(manager.URL)
if err != nil {
return
}
if err = conf.DeleteSchemeManager(manager.Identifier()); err != nil {
return
}
err = conf.InstallSchemeManager(manager, nil)
return
}
// InstallSchemeManager downloads and adds the specified scheme manager to this Configuration,
// provided its signature is valid.
func (conf *Configuration) InstallSchemeManager(manager *SchemeManager, publickey []byte) error {
if conf.readOnly {
return errors.New("cannot install scheme into a read-only configuration")
}
name := manager.ID
if err := fs.EnsureDirectoryExists(filepath.Join(conf.Path, name)); err != nil {
return err
}
t := NewHTTPTransport(manager.URL)
path := fmt.Sprintf("%s/%s", conf.Path, name)
if err := t.GetFile("description.xml", path+"/description.xml"); err != nil {
return err
}
if publickey != nil {
if err := fs.SaveFile(path+"/pk.pem", publickey); err != nil {
return err
}
} else {
if err := t.GetFile("pk.pem", path+"/pk.pem"); err != nil {
return err
}
}
if err := conf.DownloadSchemeManagerSignature(manager); err != nil {
return err
}
conf.SchemeManagers[manager.Identifier()] = manager
if err := conf.UpdateSchemeManager(manager.Identifier(), nil); err != nil {
return err
}
return conf.ParseSchemeManagerFolder(filepath.Join(conf.Path, name), manager)
}
// DownloadSchemeManagerSignature downloads, stores and verifies the latest version
// of the index file and signature of the specified manager.
func (conf *Configuration) DownloadSchemeManagerSignature(manager *SchemeManager) (err error) {
if conf.readOnly {
return errors.New("cannot download into a read-only configuration")
}
t := NewHTTPTransport(manager.URL)
path := fmt.Sprintf("%s/%s", conf.Path, manager.ID)
index := filepath.Join(path, "index")
sig := filepath.Join(path, "index.sig")
if err = t.GetFile("index", index); err != nil {
return
}
if err = t.GetFile("index.sig", sig); err != nil {
return
}
err = conf.VerifySignature(manager.Identifier())
return
}
func (e *UnknownIdentifierError) Error() string {
return "unknown identifiers: " + e.Missing.String()
}
// Download downloads the issuers, credential types and public keys specified in set
// if the current Configuration does not already have them, and checks their authenticity
// using the scheme manager index.
func (conf *Configuration) Download(session SessionRequest) (downloaded *IrmaIdentifierSet, err error) {
if conf.readOnly {
return nil, errors.New("cannot download into a read-only configuration")
}
missing, err := conf.checkIdentifiers(session)
if err != nil {
return nil, err
}
if len(missing.SchemeManagers) > 0 {
return nil, &UnknownIdentifierError{ErrorUnknownSchemeManager, missing}
}
// Update the scheme found above and parse them, if necessary
downloaded = newIrmaIdentifierSet()
for id := range missing.allSchemes() {
if err = conf.UpdateSchemeManager(id, downloaded); err != nil {
return
}
}
if !downloaded.Empty() {
if err = conf.ParseFolder(); err != nil {
return nil, err
}
}
// Check again if all identifiers are known in the Configuration
if missing, err = conf.checkIdentifiers(session); err != nil {
return nil, err
}
if !missing.Empty() {
return nil, &UnknownIdentifierError{ErrorUnknownIdentifier, missing}
}
return
}
func (conf *Configuration) checkCredentialTypes(session SessionRequest, missing *IrmaIdentifierSet) {
var typ *CredentialType
var contains bool
switch s := session.(type) {
case *IssuanceRequest:
for _, credreq := range s.Credentials {
// First check if we have this credential type
typ, contains = conf.CredentialTypes[credreq.CredentialTypeID]
if !contains {
missing.CredentialTypes[credreq.CredentialTypeID] = struct{}{}
continue
}
newAttrs := make(map[string]string)
for k, v := range credreq.Attributes {
newAttrs[k] = v
}
// For each of the attributes in the credentialtype, see if it is present; if so remove it from newAttrs
// If not, check that it is optional; if not the credentialtype must be updated
for _, attrtyp := range typ.AttributeTypes {
_, contains = newAttrs[attrtyp.ID]
if !contains && !attrtyp.IsOptional() {
missing.CredentialTypes[credreq.CredentialTypeID] = struct{}{}
break
}
delete(newAttrs, attrtyp.ID)
}
// If there is anything left in newAttrs, then these are attributes that are not in the credentialtype
if len(newAttrs) > 0 {
missing.CredentialTypes[credreq.CredentialTypeID] = struct{}{}
}
}
}
_ = session.Disclosure().Disclose.Iterate(func(attr *AttributeRequest) error {
credid := attr.Type.CredentialTypeIdentifier()
if typ, contains = conf.CredentialTypes[credid]; !contains {
missing.CredentialTypes[credid] = struct{}{}
return nil
}
if !attr.Type.IsCredential() && !typ.ContainsAttribute(attr.Type) {
missing.CredentialTypes[credid] = struct{}{}
}
return nil
})
return
}
func (conf *Configuration) checkIdentifiers(session SessionRequest) (*IrmaIdentifierSet, error) {
missing := newIrmaIdentifierSet()
conf.checkSchemes(session, missing)
if err := conf.checkIssuers(session.Identifiers(), missing); err != nil {
return nil, err
}
conf.checkCredentialTypes(session, missing)
return missing, nil
}
// CheckSchemes verifies that all schemes occuring in the specified session request occur in this
// instance.
func (conf *Configuration) checkSchemes(session SessionRequest, missing *IrmaIdentifierSet) {
for id := range session.Identifiers().SchemeManagers {
scheme, contains := conf.SchemeManagers[id]
if !contains || !scheme.Valid {
missing.SchemeManagers[id] = struct{}{}
}
}
}
func (conf *Configuration) checkIssuers(set *IrmaIdentifierSet, missing *IrmaIdentifierSet) error {
for issid := range set.Issuers {
if _, contains := conf.Issuers[issid]; !contains {
missing.Issuers[issid] = struct{}{}
}
}
for issid, keyids := range set.PublicKeys {
for _, keyid := range keyids {
pk, err := conf.PublicKey(issid, keyid)
if err != nil {
return err
}
if pk == nil {
missing.PublicKeys[issid] = append(missing.PublicKeys[issid], keyid)
}
}
}
return nil
}
func (i SchemeManagerIndex) String() string {
var paths []string
var b bytes.Buffer
for path := range i {
paths = append(paths, path)
}
sort.Strings(paths)
for _, path := range paths {
b.WriteString(hex.EncodeToString(i[path]))
b.WriteString(" ")
b.WriteString(path)
b.WriteString("\n")
}
return b.String()
}
// FromString populates this index by parsing the specified string.
func (i SchemeManagerIndex) FromString(s string) error {
for j, line := range strings.Split(s, "\n") {
if len(line) == 0 {
continue
}
parts := strings.Split(line, " ")
if len(parts) != 2 {
return errors.Errorf("Scheme manager index line %d has incorrect amount of parts", j)
}
hash, err := hex.DecodeString(parts[0])
if err != nil {
return err
}