X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=src%2Fmoonshot-id.vala;h=522a820dcfe08de5f5461df239d6430a3a40562d;hb=1eeb1e05fcb7a5eb9e561815dd461d89d956bcba;hp=dbc75da3dcdf5be83554fbb9c2b64c712604feeb;hpb=a03dffb433eb1138a85ffd782affa55399b559b6;p=moonshot-ui.git diff --git a/src/moonshot-id.vala b/src/moonshot-id.vala index dbc75da..522a820 100644 --- a/src/moonshot-id.vala +++ b/src/moonshot-id.vala @@ -1,36 +1,419 @@ +/* + * Copyright (c) 2011-2016, JANET(UK) + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of JANET(UK) nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. +*/ + +using Gee; + +extern char* get_cert_valid_before(uchar* inbuf, int inlen, char* outbuf, int outlen); + + +// A TrustAnchor object can be imported or installed via the API, but cannot +// be modified by the user, other than being cleared. Hence the fields are read-only. public class TrustAnchor : Object { - public string ca_cert {get; set; default = null;} - public string subject {get; set; default = null;} - public string subject_alt {get; set; default = null;} - public string server_cert {get; set; default = null;} + private static const string CERT_HEADER = "-----BEGIN CERTIFICATE-----"; + private static const string CERT_FOOTER = "-----END CERTIFICATE-----"; + + public enum TrustAnchorType { + CA_CERT, + SERVER_CERT + } + + private string _ca_cert = ""; + private string _subject = ""; + private string _subject_alt = ""; + private string _server_cert = ""; + private string _datetime_added = ""; + public bool user_verified = false; + + private static string fixup (string s) { + return (s == null ? "" : s.strip()); + } + + public TrustAnchor(string ca_cert, string server_cert, string subject, string subject_alt, bool user_verified) { + _ca_cert = fixup(ca_cert); + _server_cert = fixup(server_cert); + _subject = fixup(subject); + _subject_alt = fixup(subject_alt); + this.user_verified = user_verified; + + // If we're reading from store, this will be overridden (see set_datetime_added) + _datetime_added = ""; + } + + public TrustAnchor.empty() { + } + + + public string ca_cert { + get { + return _ca_cert; + } + } + + public string subject { + get { + return _subject; + } + } + + public string subject_alt { + get { + return _subject_alt; + } + } + + + public string server_cert { + get { + return _server_cert; + } + } + + public string datetime_added { + get { + return _datetime_added; + } + } + + public bool is_empty() { + return ca_cert == "" && subject == "" && subject_alt == "" && server_cert == ""; + } + + public TrustAnchorType get_anchor_type() { + return server_cert == "" ? TrustAnchorType.CA_CERT : TrustAnchorType.SERVER_CERT; + } + + internal void set_datetime_added(string datetime) { + _datetime_added = fixup(datetime); + } + + internal static string format_datetime_now() { + DateTime now = new DateTime.now_utc(); + string dt = now.format("%b %d %T %Y %Z"); + return dt; + } + + public int Compare(TrustAnchor other) + { + if (this.ca_cert != other.ca_cert) { + // IdCard.logger.trace("TrustAnchor.Compare: this.ca_cert='%s'; other.ca_cert='%s'".printf(this.ca_cert, other.ca_cert)); + return 1; + } + if (this.subject != other.subject) { + // IdCard.logger.trace("TrustAnchor.Compare: this.subject='%s'; other.subject='%s'".printf(this.subject, other.subject)); + return 1; + } + if (this.subject_alt != other.subject_alt) { + // IdCard.logger.trace("TrustAnchor.Compare: this.subject_alt='%s'; other.subject_alt='%s'".printf(this.subject_alt, other.subject_alt)); + return 1; + } + if (this.server_cert != other.server_cert) { + // IdCard.logger.trace("TrustAnchor.Compare: this.server_cert=%s'; other.server_cert='%s'".printf(this.server_cert, other.server_cert)); + return 1; + } + + // Do not compare the user_verified and datetime_added fields; they are not essential. + + return 0; + } + + public string? get_expiration_date(out string? err_out=null) + { + if (this.ca_cert == "") { + if (&err_out != null) { + err_out = "Trust anchor does not have a ca_certificate"; + return null; + } + } + + string cert = this.ca_cert; + cert.chomp(); + + uchar[] binary = Base64.decode(cert); + IdCard.logger.trace("get_expiration_date: encoded length=%d; decoded length=%d".printf(cert.length, binary.length)); + + char buf[64]; + string err = (string) get_cert_valid_before(binary, binary.length, buf, 64); + if (err != "") { + IdCard.logger.error(@"get_expiration_date: get_cert_valid_before returned '$err'"); + if (&err_out != null) { + err_out = err; + } + return null; + } + + string date = (string) buf; + IdCard.logger.trace(@"get_expiration_date: get_cert_valid_before returned '$date'"); + + return date; + } } + public struct Rule { - public string pattern; - public string always_confirm; + public string pattern; + public string always_confirm; + public int Compare(Rule other) { + if (this.pattern != other.pattern) + return 1; + if (this.always_confirm != other.always_confirm) + return 1; + return 0; + } } public class IdCard : Object { - private string _nai; - - public string display_name { get; set; default = null; } - - public string username { get; set; default = null; } - public string password { get; set; default = null; } + internal static MoonshotLogger logger = get_logger("IdCard"); + + public const string NO_IDENTITY = "No Identity"; + + private string _username = ""; + private string _issuer = ""; - public string issuer { get; set; default = null; } + public string display_name { get; set; default = ""; } - public Rule[] rules {get; set; default = {};} - public string[] services { get; set; default = {}; } + public string username { + public get { + return _username; + } + public set { + _username = value; + update_nai(); + } + } + + public string issuer { + public get { + return _issuer; + } + public set { + _issuer = value; + update_nai(); + } + } + + private void update_nai() { + _nai = username + "@" + issuer; + } + +#if GNOME_KEYRING + private unowned string _password; + public string password { + get { + return (_password!=null) ? _password : ""; + } + set { + if (_password != null) { + GnomeKeyring.memory_free((void *)_password); + _password = null; + } + if (value != null) + _password = GnomeKeyring.memory_strdup(value); + } + } +#else + public string password { get; set; default = null; } +#endif + + private Rule[] _rules = new Rule[0]; + public Rule[] rules { + get {return _rules;} + internal set {_rules = value ?? new Rule[0] ;} + } + private ArrayList _services = new ArrayList(); - public TrustAnchor trust_anchor { get; set; default = new TrustAnchor (); } + internal ArrayList services { + get {return _services;} + } + + // Returns the list of services as a string, using the given separator. + internal string get_services_string(string sep) { + if (_services.is_empty) { + return ""; + } + + // ArrayList.to_array() seems to be unreliable -- it causes segfaults + // semi-randomly. (Possibly because it returns an unowned ref?) + // return string.joinv(sep, _services.to_array()); + // + // This problem may be related to the one noted elsewhere as the + // "Centos vala array property bug". + + string[] svcs = new string[_services.size]; + for (int i = 0; i < _services.size; i++) { + svcs[i] = _services[i]; + } + + return string.joinv(sep, svcs); + } + + internal void update_services(string[] services) { + _services.clear(); + + // Doesn't exist in older versions of libgee: + // _services.add_all_array(services); + + if (services != null) { + foreach (string s in services) { + _services.add(s); + } + } + } + + internal void update_services_from_list(ArrayList services) { + if (services == this._services) { + // Don't try to update from self. + return; + } + + _services.clear(); + + if (services != null) { + _services.add_all(services); + } + } + + + public bool temporary {get; set; default = false; } + + private TrustAnchor _trust_anchor = new TrustAnchor.empty(); + public TrustAnchor trust_anchor { + get { + return _trust_anchor; + } + } + + // For use by storage implementations. + internal void set_trust_anchor_from_store(TrustAnchor ta) { + _trust_anchor = ta; + } + + internal void clear_trust_anchor() { + _trust_anchor = new TrustAnchor.empty(); + } - public Gdk.Pixbuf pixbuf { get; set; default = null; } + public string nai { public get; private set;} + + public bool store_password { get; set; default = false; } + + public bool is_no_identity() + { + return (display_name == NO_IDENTITY); + } + + public enum DiffFlags { + DISPLAY_NAME, + USERNAME, + PASSWORD, + ISSUER, + RULES, + SERVICES, + TRUST_ANCHOR; + } + + public int Compare(IdCard other) + { + int diff = 0; + if (this.display_name != other.display_name) + diff |= 1 << DiffFlags.DISPLAY_NAME; + + if (this.username != other.username) + diff |= 1 << DiffFlags.USERNAME; + + if (this.password != other.password) + diff |= 1 << DiffFlags.PASSWORD; + + if (this.issuer != other.issuer) + diff |= 1 << DiffFlags.ISSUER; + + if (CompareRules(this.rules, other.rules)!=0) + diff |= 1 << DiffFlags.RULES; + + if (CompareStringArrayList(this._services, other._services)!=0) + diff |= 1 << DiffFlags.SERVICES; + + if (this.trust_anchor.Compare(other.trust_anchor)!=0) + diff |= 1 << DiffFlags.TRUST_ANCHOR; + + // stdout.printf("Diff Flags: %x\n", diff); + if (this.display_name == other.display_name && diff != 0) { + logger.trace("Compare: Two IDs with display_name '%s', but diff_flags=%0x".printf(this.display_name, diff)); + } + return diff; + } + + public static IdCard NewNoIdentity() + { + IdCard card = new IdCard(); + card.display_name = NO_IDENTITY; + return card; + } + + ~IdCard() { + password = null; + } + + internal void add_rule(Rule rule) { + _rules += rule; + } +} + +public int CompareRules(Rule[] a, Rule[] b) +{ + if (a.length != b.length) { + return 1; + } + + for (int i = 0; i < a.length; i++) { + if (a[i].Compare(b[i]) != 0) { + return 1; + } + } + return 0; +} + +public int CompareStringArrayList(ArrayList a, ArrayList b) +{ + if (a.size != b.size) { + return 1; + } - //TODO: Set the getter and remove the setter/default - public unowned string nai { get { _nai = username + "@" + password; return _nai;}} + for (int i = 0; i < a.size; i++) { + if (a[i] != b[i]) { + return 1; + } + } + return 0; }