+ +

/*
+ * Copyright 2018 Intel Corporation, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package auth
+
+import (
+        "bytes"
+        "crypto/tls"
+        "crypto/x509"
+        "encoding/base64"
+        "golang.org/x/crypto/openpgp"
+        "golang.org/x/crypto/openpgp/packet"
+        "io/ioutil"
+
+        smslogger "sms/log"
+)
+
+var tlsConfig *tls.Config
+
+// GetTLSConfig initializes a tlsConfig using the CA's certificate
+// This config is then used to enable the server for mutual TLS
+func GetTLSConfig(caCertFile string) (*tls.Config, error) {
+        // Initialize tlsConfig once
+        if tlsConfig == nil {
+                caCert, err := ioutil.ReadFile(caCertFile)
+
+                if err != nil {
+                        return nil, err
+                }
+
+                caCertPool := x509.NewCertPool()
+                caCertPool.AppendCertsFromPEM(caCert)
+
+                tlsConfig = &tls.Config{
+                        ClientAuth: tls.RequireAndVerifyClientCert,
+                        ClientCAs:  caCertPool,
+                        MinVersion: tls.VersionTLS12,
+                }
+                tlsConfig.BuildNameToCertificate()
+        }
+        return tlsConfig, nil
+}
+
+// GeneratePGPKeyPair produces a PGP key pair and returns
+// two things:
+// A base64 encoded form of the public part of the entity
+// A base64 encoded form of the private key
+func GeneratePGPKeyPair() (string, string, error) {
+        var entity *openpgp.Entity
+        entity, err := openpgp.NewEntity("aaf.sms.init", "PGP Key for unsealing", "", nil)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return "", "", err
+        }
+
+        // Sign the identity in the entity
+        for _, id := range entity.Identities {
+                err = id.SelfSignature.SignUserId(id.UserId.Id, entity.PrimaryKey, entity.PrivateKey, nil)
+                if err != nil {
+                        smslogger.WriteError(err.Error())
+                        return "", "", err
+                }
+        }
+
+        // Sign the subkey in the entity
+        for _, subkey := range entity.Subkeys {
+                err := subkey.Sig.SignKey(subkey.PublicKey, entity.PrivateKey, nil)
+                if err != nil {
+                        smslogger.WriteError(err.Error())
+                        return "", "", err
+                }
+        }
+
+        buffer := new(bytes.Buffer)
+        entity.Serialize(buffer)
+        pbkey := base64.StdEncoding.EncodeToString(buffer.Bytes())
+
+        buffer.Reset()
+        entity.SerializePrivate(buffer, nil)
+        prkey := base64.StdEncoding.EncodeToString(buffer.Bytes())
+
+        return pbkey, prkey, nil
+}
+
+// DecryptPGPBytes decrypts a PGP encoded input string and returns
+// a base64 representation of the decoded string
+func DecryptPGPBytes(data string, prKey string) (string, error) {
+        // Convert private key to bytes from base64
+        prKeyBytes, err := base64.StdEncoding.DecodeString(prKey)
+        if err != nil {
+                smslogger.WriteError("Error Decoding base64 private key: " + err.Error())
+                return "", err
+        }
+
+        dataBytes, err := base64.StdEncoding.DecodeString(data)
+        if err != nil {
+                smslogger.WriteError("Error Decoding base64 data: " + err.Error())
+                return "", err
+        }
+
+        prEntity, err := openpgp.ReadEntity(packet.NewReader(bytes.NewBuffer(prKeyBytes)))
+        if err != nil {
+                smslogger.WriteError("Error reading entity from PGP key: " + err.Error())
+                return "", err
+        }
+
+        prEntityList := &openpgp.EntityList{prEntity}
+        message, err := openpgp.ReadMessage(bytes.NewBuffer(dataBytes), prEntityList, nil, nil)
+        if err != nil {
+                smslogger.WriteError("Error Decrypting message: " + err.Error())
+                return "", err
+        }
+
+        var retBuf bytes.Buffer
+        retBuf.ReadFrom(message.UnverifiedBody)
+
+        return retBuf.String(), nil
+}
+

+ +

/*
+ * Copyright 2018 Intel Corporation, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package backend
+
+import (
+        smsconfig "sms/config"
+        smslogger "sms/log"
+)
+
+// SecretDomain is where Secrets are stored.
+// A single domain can have any number of secrets
+type SecretDomain struct {
+        UUID string `json:"uuid"`
+        Name string `json:"name"`
+}
+
+// Secret is the struct that defines the structure of a secret
+// It consists of a name and map containing key value pairs
+type Secret struct {
+        Name   string                 `json:"name"`
+        Values map[string]interface{} `json:"values"`
+}
+
+// SecretBackend interface that will be implemented for various secret backends
+type SecretBackend interface {
+        Init() error
+        GetStatus() (bool, error)
+        Unseal(shard string) error
+
+        GetSecret(dom string, sec string) (Secret, error)
+        ListSecret(dom string) ([]string, error)
+
+        CreateSecretDomain(name string) (SecretDomain, error)
+        CreateSecret(dom string, sec Secret) error
+
+        DeleteSecretDomain(name string) error
+        DeleteSecret(dom string, name string) error
+}
+
+// InitSecretBackend returns an interface implementation
+func InitSecretBackend() (SecretBackend, error) {
+        backendImpl := &Vault{
+                vaultAddress: smsconfig.SMSConfig.VaultAddress,
+                vaultToken:   smsconfig.SMSConfig.VaultToken,
+        }
+
+        err := backendImpl.Init()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return nil, err
+        }
+
+        return backendImpl, nil
+}
+
+// LoginBackend Interface that will be implemented for various login backends
+type LoginBackend interface {
+}
+

+ +

/*
+ * Copyright 2018 Intel Corporation, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package backend
+
+import (
+        uuid "github.com/hashicorp/go-uuid"
+        vaultapi "github.com/hashicorp/vault/api"
+        smsauth "sms/auth"
+        smslogger "sms/log"
+
+        "errors"
+        "fmt"
+        "strings"
+        "sync"
+        "time"
+)
+
+// Vault is the main Struct used in Backend to initialize the struct
+type Vault struct {
+        sync.Mutex
+        engineType        string
+        initRoleDone      bool
+        policyName        string
+        roleID            string
+        secretID          string
+        vaultAddress      string
+        vaultClient       *vaultapi.Client
+        vaultMount        string
+        vaultTempTokenTTL time.Time
+        vaultToken        string
+        unsealShards      []string
+        rootToken         string
+        pgpPub            string
+        pgpPr             string
+}
+
+// Init will initialize the vault connection
+// It will also create the initial policy if it does not exist
+// TODO: Check to see if we need to wait for vault to be running
+func (v *Vault) Init() error {
+        vaultCFG := vaultapi.DefaultConfig()
+        vaultCFG.Address = v.vaultAddress
+        client, err := vaultapi.NewClient(vaultCFG)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Unable to create new vault client")
+        }
+
+        v.engineType = "kv"
+        v.initRoleDone = false
+        v.policyName = "smsvaultpolicy"
+        v.vaultClient = client
+        v.vaultMount = "sms"
+
+        err = v.initRole()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                smslogger.WriteInfo("InitRole will try again later")
+        }
+
+        return nil
+}
+
+// GetStatus returns the current seal status of vault
+func (v *Vault) GetStatus() (bool, error) {
+        sys := v.vaultClient.Sys()
+        sealStatus, err := sys.SealStatus()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return false, errors.New("Error getting status")
+        }
+
+        return sealStatus.Sealed, nil
+}
+
+// Unseal is a passthrough API that allows any
+// unseal or initialization processes for the backend
+func (v *Vault) Unseal(shard string) error {
+        sys := v.vaultClient.Sys()
+        _, err := sys.Unseal(shard)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Unable to execute unseal operation with specified shard")
+        }
+
+        return nil
+}
+
+// GetSecret returns a secret mounted on a particular domain name
+// The secret itself is referenced via its name which translates to
+// a mount path in vault
+func (v *Vault) GetSecret(dom string, name string) (Secret, error) {
+        err := v.checkToken()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return Secret{}, errors.New("Token check failed")
+        }
+
+        dom = v.vaultMount + "/" + dom
+
+        sec, err := v.vaultClient.Logical().Read(dom + "/" + name)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return Secret{}, errors.New("Unable to read Secret at provided path")
+        }
+
+        // sec and err are nil in the case where a path does not exist
+        if sec == nil {
+                smslogger.WriteWarn("Vault read was empty. Invalid Path")
+                return Secret{}, errors.New("Secret not found at the provided path")
+        }
+
+        return Secret{Name: name, Values: sec.Data}, nil
+}
+
+// ListSecret returns a list of secret names on a particular domain
+// The values of the secret are not returned
+func (v *Vault) ListSecret(dom string) ([]string, error) {
+        err := v.checkToken()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return nil, errors.New("Token check failed")
+        }
+
+        dom = v.vaultMount + "/" + dom
+
+        sec, err := v.vaultClient.Logical().List(dom)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return nil, errors.New("Unable to read Secret at provided path")
+        }
+
+        // sec and err are nil in the case where a path does not exist
+        if sec == nil {
+                smslogger.WriteWarn("Vaultclient returned empty data")
+                return nil, errors.New("Secret not found at the provided path")
+        }
+
+        val, ok := sec.Data["keys"].([]interface{})
+        if !ok {
+                smslogger.WriteError("Secret not found at the provided path")
+                return nil, errors.New("Secret not found at the provided path")
+        }
+
+        retval := make([]string, len(val))
+        for i, v := range val {
+                retval[i] = fmt.Sprint(v)
+        }
+
+        return retval, nil
+}
+
+// CreateSecretDomain mounts the kv backend on a path with the given name
+func (v *Vault) CreateSecretDomain(name string) (SecretDomain, error) {
+        // Check if token is still valid
+        err := v.checkToken()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return SecretDomain{}, errors.New("Token Check failed")
+        }
+
+        name = strings.TrimSpace(name)
+        mountPath := v.vaultMount + "/" + name
+        mountInput := &vaultapi.MountInput{
+                Type:        v.engineType,
+                Description: "Mount point for domain: " + name,
+                Local:       false,
+                SealWrap:    false,
+                Config:      vaultapi.MountConfigInput{},
+        }
+
+        err = v.vaultClient.Sys().Mount(mountPath, mountInput)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return SecretDomain{}, errors.New("Unable to create Secret Domain")
+        }
+
+        uuid, _ := uuid.GenerateUUID()
+        return SecretDomain{uuid, name}, nil
+}
+
+// CreateSecret creates a secret mounted on a particular domain name
+// The secret itself is mounted on a path specified by name
+func (v *Vault) CreateSecret(dom string, sec Secret) error {
+        err := v.checkToken()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Token check failed")
+        }
+
+        dom = v.vaultMount + "/" + dom
+
+        // Vault return is empty on successful write
+        // TODO: Check if values is not empty
+        _, err = v.vaultClient.Logical().Write(dom+"/"+sec.Name, sec.Values)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Unable to create Secret at provided path")
+        }
+
+        return nil
+}
+
+// DeleteSecretDomain deletes a secret domain which translates to
+// an unmount operation on the given path in Vault
+func (v *Vault) DeleteSecretDomain(name string) error {
+        err := v.checkToken()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Token Check Failed")
+        }
+
+        name = strings.TrimSpace(name)
+        mountPath := v.vaultMount + "/" + name
+
+        err = v.vaultClient.Sys().Unmount(mountPath)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Unable to delete domain specified")
+        }
+
+        return nil
+}
+
+// DeleteSecret deletes a secret mounted on the path provided
+func (v *Vault) DeleteSecret(dom string, name string) error {
+        err := v.checkToken()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Token check failed")
+        }
+
+        dom = v.vaultMount + "/" + dom
+
+        // Vault return is empty on successful delete
+        _, err = v.vaultClient.Logical().Delete(dom + "/" + name)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Unable to delete Secret at provided path")
+        }
+
+        return nil
+}
+
+// initRole is called only once during the service bring up
+func (v *Vault) initRole() error {
+        // Use the root token once here
+        v.vaultClient.SetToken(v.vaultToken)
+        defer v.vaultClient.ClearToken()
+
+        rules := `path "sms/*" { capabilities = ["create", "read", "update", "delete", "list"] }
+                        path "sys/mounts/sms*" { capabilities = ["update","delete","create"] }`
+        err := v.vaultClient.Sys().PutPolicy(v.policyName, rules)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Unable to create policy for approle creation")
+        }
+
+        rName := v.vaultMount + "-role"
+        data := map[string]interface{}{
+                "token_ttl": "60m",
+                "policies":  [2]string{"default", v.policyName},
+        }
+
+        //Check if applrole is mounted
+        authMounts, err := v.vaultClient.Sys().ListAuth()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Unable to get mounted auth backends")
+        }
+
+        approleMounted := false
+        for k, v := range authMounts {
+                if v.Type == "approle" && k == "approle/" {
+                        approleMounted = true
+                        break
+                }
+        }
+
+        // Mount approle in case its not already mounted
+        if !approleMounted {
+                v.vaultClient.Sys().EnableAuth("approle", "approle", "")
+        }
+
+        // Create a role-id
+        v.vaultClient.Logical().Write("auth/approle/role/"+rName, data)
+        sec, err := v.vaultClient.Logical().Read("auth/approle/role/" + rName + "/role-id")
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Unable to create role ID for approle")
+        }
+        v.roleID = sec.Data["role_id"].(string)
+
+        // Create a secret-id to go with it
+        sec, err = v.vaultClient.Logical().Write("auth/approle/role/"+rName+"/secret-id",
+                map[string]interface{}{})
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Unable to create secret ID for role")
+        }
+
+        v.secretID = sec.Data["secret_id"].(string)
+        v.initRoleDone = true
+        return nil
+}
+
+// Function checkToken() gets called multiple times to create
+// temporary tokens
+func (v *Vault) checkToken() error {
+        v.Lock()
+        defer v.Unlock()
+
+        // Init Role if it is not yet done
+        // Role needs to be created before token can be created
+        if v.initRoleDone == false {
+                err := v.initRole()
+                if err != nil {
+                        smslogger.WriteError(err.Error())
+                        return errors.New("Unable to initRole in checkToken")
+                }
+        }
+
+        // Return immediately if token still has life
+        if v.vaultClient.Token() != "" &&
+                time.Since(v.vaultTempTokenTTL) < time.Minute*50 {
+                return nil
+        }
+
+        // Create a temporary token using our roleID and secretID
+        out, err := v.vaultClient.Logical().Write("auth/approle/login",
+                map[string]interface{}{"role_id": v.roleID, "secret_id": v.secretID})
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("Unable to create Temporary Token for Role")
+        }
+
+        tok, err := out.TokenID()
+
+        v.vaultTempTokenTTL = time.Now()
+        v.vaultClient.SetToken(tok)
+        return nil
+}
+
+// vaultInit() is used to initialize the vault in cases where it is not
+// initialized. This happens once during intial bring up.
+func (v *Vault) initializeVault() error {
+        initReq := &vaultapi.InitRequest{
+                SecretShares:    5,
+                SecretThreshold: 3,
+        }
+
+        pbkey, prkey, err := smsauth.GeneratePGPKeyPair()
+        if err != nil {
+                smslogger.WriteError("Error Generating PGP Keys. Vault Init will not use encryption!")
+        } else {
+                initReq.PGPKeys = []string{pbkey, pbkey, pbkey, pbkey, pbkey}
+                initReq.RootTokenPGPKey = pbkey
+                v.pgpPub = pbkey
+                v.pgpPr = prkey
+        }
+
+        resp, err := v.vaultClient.Sys().Init(initReq)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                return errors.New("FATAL: Unable to initialize Vault")
+        }
+
+        if resp != nil {
+                v.unsealShards = resp.KeysB64
+                v.rootToken = resp.RootToken
+                return nil
+        }
+
+        return errors.New("FATAL: Init response was empty")
+}
+

+ +

/*
+ * Copyright 2018 Intel Corporation, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package config
+
+import (
+        "encoding/json"
+        "os"
+)
+
+// SMSConfiguration loads up all the values that are used to configure
+// backend implementations
+// TODO: Review these and see if they can be created/discovered dynamically
+type SMSConfiguration struct {
+        CAFile     string `json:"cafile"`
+        ServerCert string `json:"servercert"`
+        ServerKey  string `json:"serverkey"`
+
+        VaultAddress string `json:"vaultaddress"`
+        VaultToken   string `json:"vaulttoken"`
+}
+
+// SMSConfig is the structure that stores the configuration
+var SMSConfig *SMSConfiguration
+
+// ReadConfigFile reads the specified smsConfig file to setup some env variables
+func ReadConfigFile(file string) (*SMSConfiguration, error) {
+        if SMSConfig == nil {
+                f, err := os.Open(file)
+                if err != nil {
+                        return nil, err
+                }
+                defer f.Close()
+
+                SMSConfig = &SMSConfiguration{}
+                decoder := json.NewDecoder(f)
+                err = decoder.Decode(SMSConfig)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        return SMSConfig, nil
+}
+

+ +

/*
+ * Copyright 2018 Intel Corporation, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package handler
+
+import (
+        "encoding/json"
+        "github.com/gorilla/mux"
+        "net/http"
+
+        smsbackend "sms/backend"
+        smslogger "sms/log"
+)
+
+// handler stores two interface implementations that implement
+// the backend functionality
+type handler struct {
+        secretBackend smsbackend.SecretBackend
+        loginBackend  smsbackend.LoginBackend
+}
+
+// createSecretDomainHandler creates a secret domain with a name provided
+func (h handler) createSecretDomainHandler(w http.ResponseWriter, r *http.Request) {
+        var d smsbackend.SecretDomain
+
+        err := json.NewDecoder(r.Body).Decode(&d)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusBadRequest)
+                return
+        }
+
+        dom, err := h.secretBackend.CreateSecretDomain(d.Name)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+
+        jdata, err := json.Marshal(dom)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+
+        w.Header().Set("Content-Type", "application/json")
+        w.WriteHeader(http.StatusCreated)
+        w.Write(jdata)
+}
+
+// deleteSecretDomainHandler deletes a secret domain with the name provided
+func (h handler) deleteSecretDomainHandler(w http.ResponseWriter, r *http.Request) {
+        vars := mux.Vars(r)
+        domName := vars["domName"]
+
+        err := h.secretBackend.DeleteSecretDomain(domName)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+
+        w.WriteHeader(http.StatusNoContent)
+}
+
+// createSecretHandler handles creation of secrets on a given domain name
+func (h handler) createSecretHandler(w http.ResponseWriter, r *http.Request) {
+        // Get domain name from URL
+        vars := mux.Vars(r)
+        domName := vars["domName"]
+
+        // Get secrets to be stored from body
+        var b smsbackend.Secret
+        err := json.NewDecoder(r.Body).Decode(&b)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusBadRequest)
+                return
+        }
+
+        err = h.secretBackend.CreateSecret(domName, b)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+
+        w.WriteHeader(http.StatusCreated)
+}
+
+// getSecretHandler handles reading a secret by given domain name and secret name
+func (h handler) getSecretHandler(w http.ResponseWriter, r *http.Request) {
+        vars := mux.Vars(r)
+        domName := vars["domName"]
+        secName := vars["secretName"]
+
+        sec, err := h.secretBackend.GetSecret(domName, secName)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+
+        jdata, err := json.Marshal(sec)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+
+        w.Header().Set("Content-Type", "application/json")
+        w.Write(jdata)
+}
+
+// listSecretHandler handles listing all secrets under a particular domain name
+func (h handler) listSecretHandler(w http.ResponseWriter, r *http.Request) {
+        vars := mux.Vars(r)
+        domName := vars["domName"]
+
+        secList, err := h.secretBackend.ListSecret(domName)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+
+        // Creating an anonymous struct to store the returned list of data
+        var retStruct = struct {
+                SecretNames []string `json:"secretnames"`
+        }{
+                secList,
+        }
+
+        jdata, err := json.Marshal(retStruct)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+
+        w.Header().Set("Content-Type", "application/json")
+        w.Write(jdata)
+}
+
+// deleteSecretHandler handles deleting a secret by given domain name and secret name
+func (h handler) deleteSecretHandler(w http.ResponseWriter, r *http.Request) {
+        vars := mux.Vars(r)
+        domName := vars["domName"]
+        secName := vars["secretName"]
+
+        err := h.secretBackend.DeleteSecret(domName, secName)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+}
+
+// struct that tracks various status items for SMS and backend
+type backendStatus struct {
+        Seal bool `json:"sealstatus"`
+}
+
+// statusHandler returns information related to SMS and SMS backend services
+func (h handler) statusHandler(w http.ResponseWriter, r *http.Request) {
+        s, err := h.secretBackend.GetStatus()
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+
+        status := backendStatus{Seal: s}
+        jdata, err := json.Marshal(status)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+
+        w.Header().Set("Content-Type", "application/json")
+        w.Write(jdata)
+}
+
+// loginHandler handles login via password and username
+func (h handler) loginHandler(w http.ResponseWriter, r *http.Request) {
+
+}
+
+// unsealHandler is a pass through that sends requests from quorum client
+// to the backend.
+func (h handler) unsealHandler(w http.ResponseWriter, r *http.Request) {
+        // Get shards to be used for unseal
+        type unsealStruct struct {
+                UnsealShard string `json:"unsealshard"`
+        }
+
+        var inp unsealStruct
+        decoder := json.NewDecoder(r.Body)
+        decoder.DisallowUnknownFields()
+        err := decoder.Decode(&inp)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, "Bad input JSON", http.StatusBadRequest)
+                return
+        }
+
+        err = h.secretBackend.Unseal(inp.UnsealShard)
+        if err != nil {
+                smslogger.WriteError(err.Error())
+                http.Error(w, err.Error(), http.StatusInternalServerError)
+                return
+        }
+}
+
+// CreateRouter returns an http.Handler for the registered URLs
+// Takes an interface implementation as input
+func CreateRouter(b smsbackend.SecretBackend) http.Handler {
+        h := handler{secretBackend: b}
+
+        // Create a new mux to handle URL endpoints
+        router := mux.NewRouter()
+
+        router.HandleFunc("/v1/sms/login", h.loginHandler).Methods("POST")
+
+        // Initialization APIs which will be used by quorum client
+        // to unseal and to provide root token to sms service
+        router.HandleFunc("/v1/sms/status", h.statusHandler).Methods("GET")
+        router.HandleFunc("/v1/sms/unseal", h.unsealHandler).Methods("POST")
+
+        router.HandleFunc("/v1/sms/domain", h.createSecretDomainHandler).Methods("POST")
+        router.HandleFunc("/v1/sms/domain/{domName}", h.deleteSecretDomainHandler).Methods("DELETE")
+
+        router.HandleFunc("/v1/sms/domain/{domName}/secret", h.createSecretHandler).Methods("POST")
+        router.HandleFunc("/v1/sms/domain/{domName}/secret", h.listSecretHandler).Methods("GET")
+        router.HandleFunc("/v1/sms/domain/{domName}/secret/{secretName}", h.getSecretHandler).Methods("GET")
+        router.HandleFunc("/v1/sms/domain/{domName}/secret/{secretName}", h.deleteSecretHandler).Methods("DELETE")
+
+        return router
+}
+

+ +

/*
+ * Copyright 2018 Intel Corporation, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package log
+
+import (
+        "log"
+        "os"
+)
+
+var errLogger *log.Logger
+var warnLogger *log.Logger
+var infoLogger *log.Logger
+
+// Init will be called by sms.go before any other packages use it
+func Init(filePath string) {
+        f, err := os.Create(filePath)
+        if err != nil {
+                log.Println("Unable to create a log file")
+                log.Println(err)
+                errLogger = log.New(os.Stderr, "ERROR: ", log.Lshortfile|log.LstdFlags)
+                warnLogger = log.New(os.Stdout, "WARNING: ", log.Lshortfile|log.LstdFlags)
+                infoLogger = log.New(os.Stdout, "INFO: ", log.Lshortfile|log.LstdFlags)
+        } else {
+                errLogger = log.New(f, "ERROR: ", log.Lshortfile|log.LstdFlags)
+                warnLogger = log.New(f, "WARNING: ", log.Lshortfile|log.LstdFlags)
+                infoLogger = log.New(f, "INFO: ", log.Lshortfile|log.LstdFlags)
+        }
+}
+
+// WriteError writes output to the writer we have
+// defined durint its creation with ERROR prefix
+func WriteError(msg string) {
+        if errLogger != nil {
+                errLogger.Println(msg)
+        }
+}
+
+// WriteWarn writes output to the writer we have
+// defined durint its creation with WARNING prefix
+func WriteWarn(msg string) {
+        if warnLogger != nil {
+                warnLogger.Println(msg)
+        }
+}
+
+// WriteInfo writes output to the writer we have
+// defined durint its creation with INFO prefix
+func WriteInfo(msg string) {
+        if infoLogger != nil {
+                infoLogger.Println(msg)
+        }
+}
+

+ +

/*
+ * Copyright 2018 Intel Corporation, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package main
+
+import (
+        "context"
+        "log"
+        "net/http"
+        "os"
+        "os/signal"
+
+        smsauth "sms/auth"
+        smsbackend "sms/backend"
+        smsconfig "sms/config"
+        smshandler "sms/handler"
+        smslogger "sms/log"
+)
+
+func main() {
+        // Initialize logger
+        smslogger.Init("sms.log")
+
+        // Read Configuration File
+        smsConf, err := smsconfig.ReadConfigFile("smsconfig.json")
+        if err != nil {
+                log.Fatal(err)
+        }
+
+        backendImpl, err := smsbackend.InitSecretBackend()
+        if err != nil {
+                log.Fatal(err)
+        }
+
+        httpRouter := smshandler.CreateRouter(backendImpl)
+
+        // TODO: Use CA certificate from AAF
+        tlsConfig, err := smsauth.GetTLSConfig(smsConf.CAFile)
+        if err != nil {
+                log.Fatal(err)
+        }
+
+        httpServer := &http.Server{
+                Handler:   httpRouter,
+                Addr:      ":10443",
+                TLSConfig: tlsConfig,
+        }
+
+        // Listener for SIGINT so that it returns cleanly
+        connectionsClose := make(chan struct{})
+        go func() {
+                c := make(chan os.Signal, 1)
+                signal.Notify(c, os.Interrupt)
+                <-c
+                httpServer.Shutdown(context.Background())
+                close(connectionsClose)
+        }()
+
+        err = httpServer.ListenAndServeTLS(smsConf.ServerCert, smsConf.ServerKey)
+        if err != nil && err != http.ErrServerClosed {
+                log.Fatal(err)
+        }
+
+        <-connectionsClose
+}
+

+ +