Statistics
| Branch: | Tag: | Revision:

root / src / Ganeti / Confd / Utils.hs @ 11e90588

History | View | Annotate | Download (3.2 kB)

1
{-| Implementation of the Ganeti confd utilities.
2

    
3
This holds a few utility functions that could be useful in both
4
clients and servers.
5

    
6
-}
7

    
8
{-
9

    
10
Copyright (C) 2011, 2012 Google Inc.
11

    
12
This program is free software; you can redistribute it and/or modify
13
it under the terms of the GNU General Public License as published by
14
the Free Software Foundation; either version 2 of the License, or
15
(at your option) any later version.
16

    
17
This program is distributed in the hope that it will be useful, but
18
WITHOUT ANY WARRANTY; without even the implied warranty of
19
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
20
General Public License for more details.
21

    
22
You should have received a copy of the GNU General Public License
23
along with this program; if not, write to the Free Software
24
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
25
02110-1301, USA.
26

    
27
-}
28

    
29
module Ganeti.Confd.Utils
30
  ( getClusterHmac
31
  , parseSignedMessage
32
  , parseRequest
33
  , parseReply
34
  , signMessage
35
  , getCurrentTime
36
  ) where
37

    
38
import qualified Data.ByteString as B
39
import qualified Text.JSON as J
40

    
41
import Ganeti.BasicTypes
42
import Ganeti.Confd.Types
43
import Ganeti.Hash
44
import qualified Ganeti.Constants as C
45
import qualified Ganeti.Path as Path
46
import Ganeti.JSON
47
import Ganeti.Utils
48

    
49
-- | Type-adjusted max clock skew constant.
50
maxClockSkew :: Integer
51
maxClockSkew = fromIntegral C.confdMaxClockSkew
52

    
53
-- | Returns the HMAC key.
54
getClusterHmac :: IO HashKey
55
getClusterHmac = Path.confdHmacKey >>= fmap B.unpack . B.readFile
56

    
57
-- | Parses a signed message.
58
parseSignedMessage :: (J.JSON a) => HashKey -> String
59
                   -> Result (String, String, a)
60
parseSignedMessage key str = do
61
  (SignedMessage hmac msg salt) <- fromJResult "parsing signed message"
62
    $ J.decode str
63
  parsedMsg <- if verifyMac key (Just salt) msg hmac
64
           then fromJResult "parsing message" $ J.decode msg
65
           else Bad "HMAC verification failed"
66
  return (salt, msg, parsedMsg)
67

    
68
-- | Message parsing. This can either result in a good, valid request
69
-- message, or fail in the Result monad.
70
parseRequest :: HashKey -> String -> Integer
71
             -> Result (String, ConfdRequest)
72
parseRequest hmac msg curtime = do
73
  (salt, origmsg, request) <- parseSignedMessage hmac msg
74
  ts <- tryRead "Parsing timestamp" salt::Result Integer
75
  if abs (ts - curtime) > maxClockSkew
76
    then fail "Too old/too new timestamp or clock skew"
77
    else return (origmsg, request)
78

    
79
-- | Message parsing. This can either result in a good, valid reply
80
-- message, or fail in the Result monad.
81
-- It also checks that the salt in the message corresponds to the one
82
-- that is expected
83
parseReply :: HashKey -> String -> String -> Result (String, ConfdReply)
84
parseReply hmac msg expSalt = do
85
  (salt, origmsg, reply) <- parseSignedMessage hmac msg
86
  if salt /= expSalt
87
    then fail "The received salt differs from the expected salt"
88
    else return (origmsg, reply)
89

    
90
-- | Signs a message with a given key and salt.
91
signMessage :: HashKey -> String -> String -> SignedMessage
92
signMessage key salt msg =
93
  SignedMessage { signedMsgMsg  = msg
94
                , signedMsgSalt = salt
95
                , signedMsgHmac = hmac
96
                }
97
    where hmac = computeMac key (Just salt) msg