diaspora-vines 0.1.2

data/lib/vines/storage/local.rb

@@ -0,0 +1,139 @@
+# encoding: UTF-8
+
+module Vines
+  class Storage
+
+    # A storage implementation that persists data to YAML files on the
+    # local file system.
+    class Local < Storage
+      register :fs
+
+      def initialize(&block)
+        @dir = nil
+        instance_eval(&block)
+        unless @dir && File.directory?(@dir) && File.writable?(@dir)
+          raise 'Must provide a writable storage directory'
+        end
+
+        %w[user vcard fragment].each do |sub|
+          sub = File.expand_path(sub, @dir)
+          Dir.mkdir(sub, 0700) unless File.exists?(sub)
+        end
+      end
+
+      def dir(dir=nil)
+        dir ? @dir = File.expand_path(dir) : @dir
+      end
+
+      def find_user(jid)
+        jid = JID.new(jid).bare.to_s
+        file = "user/#{jid}" unless jid.empty?
+        record = YAML.load(read(file)) rescue nil
+        return User.new(jid: jid).tap do |user|
+          user.name, user.password = record.values_at('name', 'password')
+          (record['roster'] || {}).each_pair do |jid, props|
+            user.roster << Contact.new(
+              jid: jid,
+              name: props['name'],
+              subscription: props['subscription'],
+              ask: props['ask'],
+              groups: props['groups'] || [])
+          end
+        end if record
+      end
+
+      def save_user(user)
+        record = {'name' => user.name, 'password' => user.password, 'roster' => {}}
+        user.roster.each do |contact|
+          record['roster'][contact.jid.bare.to_s] = contact.to_h
+        end
+        save("user/#{user.jid.bare}", YAML.dump(record))
+      end
+
+      def find_vcard(jid)
+        jid = JID.new(jid).bare.to_s
+        return if jid.empty?
+        file = "vcard/#{jid}"
+        Nokogiri::XML(read(file)).root rescue nil
+      end
+
+      def save_vcard(jid, card)
+        jid = JID.new(jid).bare.to_s
+        return if jid.empty?
+        save("vcard/#{jid}", card.to_xml)
+      end
+
+      def find_fragment(jid, node)
+        jid = JID.new(jid).bare.to_s
+        return if jid.empty?
+        file = 'fragment/%s' % fragment_id(jid, node)
+        Nokogiri::XML(read(file)).root rescue nil
+      end
+
+      def save_fragment(jid, node)
+        jid = JID.new(jid).bare.to_s
+        return if jid.empty?
+        file = 'fragment/%s' % fragment_id(jid, node)
+        save(file, node.to_xml)
+      end
+
+      private
+
+      # Resolves a relative file name into an absolute path inside the
+      # storage directory.
+      #
+      # file - A fully-qualified or relative file name String.
+      #
+      # Returns the fully-qualified file path String.
+      #
+      # Raises RuntimeError if the resolved path is outside of the storage
+      # directory. This prevents directory path traversals with maliciously
+      # crafted JIDs.
+      def absolute_path(file)
+        File.expand_path(file, @dir).tap do |absolute|
+          parent = File.dirname(File.dirname(absolute))
+          raise 'path traversal' unless parent == @dir
+        end
+      end
+
+      # Read the file from the filesystem and return its contents as a String.
+      # All files are assumed to be encoded as UTF-8.
+      #
+      # file - A fully-qualified or relative file name String.
+      #
+      # Returns the file content as a UTF-8 encoded String.
+      def read(file)
+        file = absolute_path(file)
+        File.read(file, encoding: 'utf-8')
+      end
+
+      # Write the content to the file. Make sure to consistently encode files
+      # we read and write as UTF-8.
+      #
+      # file    - A fully-qualified or relative file name String.
+      # content - The String to write.
+      #
+      # Returns nothing.
+      def save(file, content)
+        file = absolute_path(file)
+        File.open(file, 'w:utf-8') {|f| f.write(content) }
+        File.chmod(0600, file)
+      end
+
+      # Generates a unique file id for the user's private XML fragment.
+      #
+      # Private XML fragment storage needs to uniquely identify fragment files
+      # on disk. We combine the user's JID with a SHA-1 hash of the element's
+      # name and namespace to avoid special characters in the file name.
+      #
+      # jid  - A bare JID identifying the user who owns this fragment.
+      # node - A Nokogiri::XML::Node for the XML to be stored.
+      #
+      # Returns an id String suitable for use in a file name.
+      def fragment_id(jid, node)
+        id = Digest::SHA1.hexdigest("#{node.name}:#{node.namespace.href}")
+        "#{jid}-#{id}"
+      end
+    end
+  end
+end

data/lib/vines/storage/null.rb

@@ -0,0 +1,39 @@
+# encoding: UTF-8
+
+module Vines
+  class Storage
+    # A storage implementation that does not persist data to any form of storage.
+    # When looking up the storage object for a domain, it's easier to treat a
+    # missing domain with a Null storage than checking for nil.
+    #
+    # For example, presence subscription stanzas sent to a pubsub subdomain
+    # have no storage. Rather than checking for nil storage or pubsub addresses,
+    # it's easier to treat stanzas to pubsub domains as Null storage that never
+    # finds or saves users and their rosters.
+    class Null < Storage
+      def find_user(jid)
+        nil
+      end
+
+      def save_user(user)
+        # do nothing
+      end
+
+      def find_vcard(jid)
+        nil
+      end
+
+      def save_vcard(jid, card)
+        # do nothing
+      end
+
+      def find_fragment(jid, node)
+        nil
+      end
+
+      def save_fragment(jid, node)
+        # do nothing
+      end
+    end
+  end
+end

data/lib/vines/storage/sql.rb

@@ -0,0 +1,138 @@
+require 'active_record'
+
+module Vines
+  class Storage
+    class Sql < Storage
+      register :sql
+
+      class Person < ActiveRecord::Base; end
+      class Contact < ActiveRecord::Base
+        belongs_to :user
+        belongs_to :person
+      end
+
+      class User < ActiveRecord::Base
+        has_many :contacts#, through: :user_id
+        has_many :contact_people, :through => :contacts, :source => :person
+        has_one :person, :foreign_key => :owner_id
+      end
+
+      # Wrap the method with ActiveRecord connection pool logic, so we properly
+      # return connections to the pool when we're finished with them. This also
+      # defers the original method by pushing it onto the EM thread pool because
+      # ActiveRecord uses blocking IO.
+      def self.with_connection(method, args={})
+        deferrable = args.key?(:defer) ? args[:defer] : true
+        old = instance_method(method)
+        define_method method do |*args|
+          ActiveRecord::Base.connection_pool.with_connection do
+            old.bind(self).call(*args)
+          end
+        end
+        defer(method) if deferrable
+      end
+
+      def initialize(&block)
+        raise "You configured diaspora-sql adapter without Diaspora" unless defined? AppConfig
+        @config = {
+          :adapter => AppConfig.adapter.to_s,
+          :database => AppConfig.database.to_s,
+          :host => AppConfig.host.to_s,
+          :port => AppConfig.port.to_i,
+          :username => AppConfig.username.to_s,
+          :password => AppConfig.password.to_s
+        }
+
+        required = [:adapter, :database]
+        required << [:host, :port] unless @config[:adapter] == 'sqlite3'
+        required.flatten.each {|key| raise "Must provide #{key}" unless @config[key] }
+        [:username, :password].each {|key| @config.delete(key) if empty?(@config[key]) }
+        establish_connection
+      end
+
+      def find_user(jid)
+        jid = JID.new(jid).bare.to_s
+        return if jid.empty?
+        xuser = user_by_jid(jid)
+        return Vines::User.new(jid: jid).tap do |user|
+          user.name, user.password = xuser.username, xuser.authentication_token
+
+          xuser.contacts.each do |contact|
+            handle = contact.person.diaspora_handle
+            ask = 'none'
+            subscription = 'none'
+
+            if contact.sharing && contact.receiving
+              subscription = 'both'
+            elsif contact.sharing && !contact.receiving
+              ask = 'suscribe'
+              subscription = 'from'
+            elsif !contact.sharing && contact.receiving
+              subscription = 'to'
+            else
+              ask = 'suscribe'
+            end
+            # finally build the roster entry
+            user.roster << Vines::Contact.new(
+              jid: handle,
+              name: handle.gsub(/\@.*?$/, ''),
+              subscription: subscription,
+              ask: ask
+            ) if handle
+          end
+        end if xuser
+      end
+      with_connection :find_user
+
+      def authenticate(username, password)
+        user = find_user(username)
+
+        dbhash = BCrypt::Password.new(user.password) rescue nil
+        hash = BCrypt::Engine.hash_secret("#{password}#{Config.instance.pepper}", dbhash.salt) rescue nil
+
+        userAuth = ((hash && dbhash) && hash == dbhash)
+        tokenAuth = ((password && user.password) && password == user.password)
+        (tokenAuth || userAuth)? user : nil
+      end
+
+      def save_user(user)
+        # do nothing
+        #log.error("You cannot save a user via XMPP server!")
+      end
+      with_connection :save_user
+
+      def find_vcard(jid)
+        # do nothing
+        nil
+      end
+      with_connection :find_vcard
+
+      def save_vcard(jid, card)
+        # do nothing
+      end
+      with_connection :save_vcard
+
+      def find_fragment(jid, node)
+        # do nothing
+        nil
+      end
+      with_connection :find_fragment
+
+      def save_fragment(jid, node)
+        # do nothing
+      end
+      with_connection :save_fragment
+
+      private
+        def establish_connection
+          ActiveRecord::Base.logger = Logger.new('/dev/null')
+          ActiveRecord::Base.establish_connection(@config)
+        end
+
+        def user_by_jid(jid)
+          name = JID.new(jid).node
+          Sql::User.find_by_username(name)
+        end
+    end
+  end
+end

data/lib/vines/storage.rb

@@ -0,0 +1,239 @@
+# encoding: UTF-8
+
+module Vines
+  class Storage
+    include Vines::Log
+
+    attr_accessor :ldap
+
+    @@nicks = {}
+
+    # Register a nickname that can be used in the config file to specify this
+    # storage implementation.
+    def self.register(name)
+      @@nicks[name.to_sym] = self
+    end
+
+    def self.from_name(name, &block)
+      klass = @@nicks[name.to_sym]
+      raise "#{name} storage class not found" unless klass
+      klass.new(&block)
+    end
+
+    # Wrap a blocking IO method in a new method that pushes the original method
+    # onto EventMachine's thread pool using EM#defer. Storage classes implemented
+    # with blocking IO don't need to worry about threading or blocking the
+    # EventMachine reactor thread if they wrap their methods with this one.
+    #
+    # For example:
+    # def find_user(jid)
+    #   some_blocking_lookup(jid)
+    # end
+    # defer :find_user
+    #
+    # Storage classes that use asynchronous IO (through an EventMachine
+    # enabled library like em-http-request or em-redis) don't need any special
+    # consideration and must not use this method.
+    def self.defer(method)
+      old = instance_method(method)
+      define_method method do |*args|
+        fiber = Fiber.current
+        op = operation { old.bind(self).call(*args) }
+        cb = proc {|result| fiber.resume(result) }
+        EM.defer(op, cb)
+        Fiber.yield
+      end
+    end
+
+    # Wrap an authenticate method with a new method that uses LDAP if it's
+    # enabled in the config file. If LDAP is not enabled, invoke the original
+    # authenticate method as usual. This allows storage classes to implement
+    # their native authentication logic and not worry about handling LDAP.
+    #
+    # For example:
+    # def authenticate(username, password)
+    #   some_user_lookup_by_password(username, password)
+    # end
+    # wrap_ldap :authenticate
+    def self.wrap_ldap(method)
+      old = instance_method(method)
+      define_method method do |*args|
+        ldap? ? authenticate_with_ldap(*args) : old.bind(self).call(*args)
+      end
+    end
+
+    # Wrap a method with Fiber yield and resume logic. The method must yield
+    # its result to a block. This makes it easier to write asynchronous
+    # implementations of +authenticate+, +find_user+, and +save_user+ that
+    # block and return a result rather than yielding.
+    #
+    # For example:
+    # def find_user(jid)
+    #   http = EM::HttpRequest.new(url).get
+    #   http.callback { yield build_user_from_http_response(http) }
+    # end
+    # fiber :find_user
+    #
+    # Because +find_user+ has been wrapped in Fiber logic, we can call it
+    # synchronously even though it uses asynchronous EventMachine calls.
+    #
+    # user = storage.find_user('alice@wonderland.lit')
+    # puts user.nil?
+    def self.fiber(method)
+      old = instance_method(method)
+      define_method method do |*args|
+        fiber, yielding = Fiber.current, true
+        old.bind(self).call(*args) do |user|
+          fiber.resume(user) rescue yielding = false
+        end
+        Fiber.yield if yielding
+      end
+    end
+
+    # Return +true+ if users are authenticated against an LDAP directory.
+    def ldap?
+      !!ldap
+    end
+
+    # Validate the username and password pair and return a +Vines::User+ object
+    # on success. Return +nil+ on failure.
+    #
+    # For example:
+    # user = storage.authenticate('alice@wonderland.lit', 'secr3t')
+    # puts user.nil?
+    #
+    # This default implementation validates the password against a bcrypt hash
+    # of the password stored in the database. Sub-classes not using bcrypt
+    # passwords must override this method.
+    def authenticate(username, password)
+      user = find_user(username)
+      hash = BCrypt::Password.new(user.password) rescue nil
+      (hash && hash == password) ? user : nil
+    end
+    wrap_ldap :authenticate
+
+    # Return the +Vines::User+ associated with the JID. Return +nil+ if the user
+    # could not be found. JID may be +nil+, a +String+, or a +Vines::JID+
+    # object. It may be a bare JID or a full JID. Implementations of this method
+    # must convert the JID to a bare JID before searching for the user in the
+    # database.
+    #
+    # user = storage.find_user('alice@wonderland.lit')
+    # puts user.nil?
+    def find_user(jid)
+      raise 'subclass must implement'
+    end
+
+    # Persist the +Vines::User+ object to the database and return when the save
+    # is complete.
+    #
+    # alice = Vines::User.new(:jid => 'alice@wonderland.lit')
+    # storage.save_user(alice)
+    # puts 'saved'
+    def save_user(user)
+      raise 'subclass must implement'
+    end
+
+    # Return the Nokogiri::XML::Node for the vcard stored for this JID. Return
+    # nil if the vcard could not be found. JID may be +nil+, a +String+, or a
+    # +Vines::JID+ object. It may be a bare JID or a full JID. Implementations
+    # of this method must convert the JID to a bare JID before searching for the
+    # vcard in the database.
+    #
+    # card = storage.find_vcard('alice@wonderland.lit')
+    # puts card.nil?
+    def find_vcard(jid)
+      raise 'subclass must implement'
+    end
+
+    # Save the vcard to the database and return when the save is complete. JID
+    # may be a +String+ or a +Vines::JID+ object.  It may be a bare JID or a
+    # full JID. Implementations of this method must convert the JID to a bare
+    # JID before saving the vcard. Card is a +Nokogiri::XML::Node+ object.
+    #
+    # card = Nokogiri::XML('<vCard>...</vCard>').root
+    # storage.save_vcard('alice@wonderland.lit', card)
+    # puts 'saved'
+    def save_vcard(jid, card)
+      raise 'subclass must implement'
+    end
+
+    # Return the Nokogiri::XML::Node for the XML fragment stored for this JID.
+    # Return nil if the fragment could not be found. JID may be +nil+, a
+    # +String+, or a +Vines::JID+ object. It may be a bare JID or a full JID.
+    # Implementations of this method must convert the JID to a bare JID before
+    # searching for the fragment in the database.
+    #
+    # Private XML storage uniquely identifies fragments by JID, root element name,
+    # and root element namespace.
+    #
+    # root = Nokogiri::XML('<custom xmlns="urn:custom:ns"/>').root
+    # fragment = storage.find_fragment('alice@wonderland.lit', root)
+    # puts fragment.nil?
+    def find_fragment(jid, node)
+      raise 'subclass must implement'
+    end
+
+    # Save the XML fragment to the database and return when the save is complete.
+    # JID may be a +String+ or a +Vines::JID+ object.  It may be a bare JID or a
+    # full JID. Implementations of this method must convert the JID to a bare
+    # JID before saving the fragment. Fragment is a +Nokogiri::XML::Node+ object.
+    #
+    # fragment = Nokogiri::XML('<custom xmlns="urn:custom:ns">some data</custom>').root
+    # storage.save_fragment('alice@wonderland.lit', fragment)
+    # puts 'saved'
+    def save_fragment(jid, fragment)
+      raise 'subclass must implement'
+    end
+
+    private
+
+    # Return true if any of the arguments are nil or empty strings.
+    # For example:
+    # username, password = 'alice@wonderland.lit', ''
+    # empty?(username, password) #=> true
+    def empty?(*args)
+      args.flatten.any? {|arg| (arg || '').strip.empty? }
+    end
+
+    # Return a +proc+ suitable for running on the +EM.defer+ thread pool that traps
+    # and logs any errors thrown by the provided block.
+    def operation
+      proc do
+        begin
+          yield
+        rescue => e
+          log.error("Thread pool operation failed: #{e.message}")
+          nil
+        end
+      end
+    end
+
+    # Return a +Vines::User+ object if we are able to bind to the LDAP server
+    # using the username and password. Return +nil+ if authentication failed. If
+    # authentication succeeds, but the user is not yet stored in our database,
+    # save the user to the database.
+    def authenticate_with_ldap(username, password, &block)
+      op = operation { ldap.authenticate(username, password) }
+      cb = proc {|user| save_ldap_user(user, &block) }
+      EM.defer(op, cb)
+    end
+    fiber :authenticate_with_ldap
+
+    # Save missing users to the storage database after they're authenticated with
+    # LDAP. This allows admins to define users once in LDAP and have them sync
+    # to the chat database the first time they successfully sign in.
+    def save_ldap_user(user, &block)
+      Fiber.new do
+        if user.nil?
+          block.call
+        elsif found = find_user(user.jid)
+          block.call(found)
+        else
+          save_user(user)
+          block.call(user)
+        end
+      end.resume
+    end
+  end
+end

data/lib/vines/store.rb

@@ -0,0 +1,110 @@
+# encoding: UTF-8
+
+module Vines
+
+  # An X509 certificate store that validates certificate trust chains.
+  # This uses the conf/certs/*.crt files as the list of trusted root
+  # CA certificates.
+  class Store
+    include Vines::Log
+
+    @@sources = nil
+
+    # Create a certificate store to read certificate files from the given
+    # directory.
+    def initialize(dir)
+      @dir = File.expand_path(dir)
+      @store = OpenSSL::X509::Store.new
+      certs.each {|c|
+        begin
+          @store.add_cert(c)
+        rescue
+          # do nothing cert is already known
+          log.warn("WARNING! There are duplicate certificates")
+        end
+      }
+    end
+
+    # Return true if the certificate is signed by a CA certificate in the
+    # store. If the certificate can be trusted, it's added to the store so
+    # it can be used to trust other certs.
+    def trusted?(pem)
+      if cert = OpenSSL::X509::Certificate.new(pem) rescue nil
+        @store.verify(cert).tap do |trusted|
+          @store.add_cert(cert) if trusted rescue nil
+        end
+      end
+    end
+
+    # Return true if the domain name matches one of the names in the
+    # certificate. In other words, is the certificate provided to us really
+    # for the domain to which we think we're connected?
+    def domain?(pem, domain)
+      if cert = OpenSSL::X509::Certificate.new(pem) rescue nil
+        OpenSSL::SSL.verify_certificate_identity(cert, domain) rescue false
+      end
+    end
+
+    # Return the trusted root CA certificates installed in conf/certs. These
+    # certificates are used to start the trust chain needed to validate certs
+    # we receive from clients and servers.
+    def certs
+      unless @@sources
+        pattern = /-{5}BEGIN CERTIFICATE-{5}\n.*?-{5}END CERTIFICATE-{5}\n/m
+        files = Dir[File.join(@dir, '*.crt')]
+        files << AppConfig.environment.certificate_authorities if defined?(AppConfig)
+        pairs = files.map do |name|
+          File.open(name, "r:UTF-8") do |f|
+            pems = f.read.scan(pattern)
+            certs = pems.map {|pem| OpenSSL::X509::Certificate.new(pem) }
+            certs.reject! {|cert| cert.not_after < Time.now }
+            [name, certs]
+          end
+        end
+        @@sources = Hash[pairs]
+      end
+      @@sources.values.flatten
+    end
+
+    # Returns a pair of file names containing the public key certificate
+    # and matching private key for the given domain. This supports using
+    # wildcard certificate files to serve several subdomains.
+    #
+    # Finding the certificate and private key file for a domain follows these steps:
+    # - look for <domain>.crt and <domain>.key files in the conf/certs directory.
+    #   if found, return those file names, else
+    # - inspect all conf/certs/*.crt files for certificates that contain the
+    #   domain name either as the subject common name (CN) or as a DNS
+    #   subjectAltName. The corresponding private key must be in a file of the
+    #   same name as the certificate's, but with a .key extension.
+    #
+    # So in the simplest configuration, the tea.wonderland.lit encryption files would
+    # be named conf/certs/tea.wonderland.lit.crt and conf/certs/tea.wonderland.lit.key.
+    #
+    # However, in the case of a wildcard certificate for *.wonderland.lit, the
+    # files would be conf/certs/wonderland.lit.crt and conf/certs/wonderland.lit.key.
+    # These same two files would be returned for the subdomains of tea.wonderland.lit,
+    # crumpets.wonderland.lit, etc.
+    def files_for_domain(domain)
+      crt = File.expand_path("#{domain}.crt", @dir)
+      key = File.expand_path("#{domain}.key", @dir)
+      # diaspora keys will be prioritized
+      if defined?(AppConfig)
+        crt = AppConfig.server.chat.certificate 
+        key = AppConfig.server.chat.key
+      end
+      return [crt, key] if File.exists?(crt) && File.exists?(key)
+
+      # might be a wildcard cert file
+      @@sources.each do |file, certs|
+        certs.each do |cert|
+          if OpenSSL::SSL.verify_certificate_identity(cert, domain)
+            key = file.chomp(File.extname(file)) + '.key'
+            return [file, key] if File.exists?(file) && File.exists?(key)
+          end
+        end
+      end
+      nil
+    end
+  end
+end