| // The following enables go generate to generate the doc.go file. |
| // Things to look out for: |
| // 1) go:generate evaluates double-quoted strings into a single argument. |
| // 2) go:generate performs $NAME expansion, so the bash cmd can't contain '$'. |
| // 3) We generate into a *.tmp file first, otherwise "go run" will pick up the |
| // initially empty *.go file, and fail. |
| // 4) Since "go run" ignores build directives, we must manually filter out |
| // main_*.go for different platforms. |
| // |
| //go:generate bash -c "{ echo -e '// This file was auto-generated via go generate.\n// DO NOT UPDATE MANUALLY\n\n/*' && veyron go run `echo *.go | tr ' ' '\n' | grep -v main_darwin.go` help -style=godoc ... && echo -e '*/\npackage main'; } > ./doc.go.tmp && mv ./doc.go.tmp ./doc.go" |
| |
| package main |
| |
| import ( |
| "bytes" |
| "fmt" |
| "io" |
| "os" |
| "os/user" |
| "time" |
| |
| "veyron.io/veyron/veyron/lib/cmdline" |
| "veyron.io/veyron/veyron/services/identity" |
| "veyron.io/veyron/veyron/services/identity/util" |
| |
| "veyron.io/veyron/veyron2" |
| "veyron.io/veyron/veyron2/rt" |
| "veyron.io/veyron/veyron2/security" |
| "veyron.io/veyron/veyron2/vdl/vdlutil" |
| "veyron.io/veyron/veyron2/vlog" |
| ) |
| |
| var ( |
| // Flags for the "bless" command |
| flagBlessWith string |
| flagBlessFor time.Duration |
| |
| // Flags for the "seekblessing" command |
| flagSeekBlessingFor string |
| flagSeekBlessingOAuthClientID string |
| flagSeekBlessingFrom string |
| |
| cmdPrint = &cmdline.Command{ |
| Name: "print", |
| Short: "Print out information about the provided identity", |
| Long: ` |
| Print dumps out information about the identity encoded in the provided file, |
| or if no filename is provided, then the identity that would be used by binaries |
| started in the same environment. |
| `, |
| ArgsName: "[<file>]", |
| ArgsLong: ` |
| <file> is the path to a file containing a base64-encoded, VOM encoded identity, |
| typically obtained from this tool. - is used for STDIN and an empty string |
| implies the identity encoded in the environment. |
| `, |
| Run: func(cmd *cmdline.Command, args []string) error { |
| if len(args) > 1 { |
| return fmt.Errorf("require at most one argument, <file>, provided %d", len(args)) |
| } |
| id := rt.R().Identity() |
| if len(args) == 1 { |
| if err := decode(args[0], &id); err != nil { |
| return err |
| } |
| } |
| fmt.Println("Name : ", id.PublicID()) |
| fmt.Printf("Go Type : %T\n", id) |
| fmt.Printf("PublicKey: %v\n", id.PublicID().PublicKey()) |
| fmt.Println("Any caveats in the identity are not printed") |
| return nil |
| }, |
| } |
| |
| cmdGenerate = &cmdline.Command{ |
| Name: "generate", |
| Short: "Generate an identity with a newly minted private key", |
| Long: ` |
| Generate a new private key and create an identity that binds <name> to |
| this key. |
| |
| Since the generated identity has a newly minted key, it will be typically |
| unusable at other veyron services as those services have placed no trust |
| in this key. In such cases, you likely want to seek a blessing for this |
| generated identity using the 'bless' command. |
| `, |
| ArgsName: "[<name>]", |
| ArgsLong: ` |
| <name> is the name to bind the newly minted private key to. If not specified, |
| a name will be generated based on the hostname of the machine and the name of |
| the user running this command. |
| `, |
| Run: func(cmd *cmdline.Command, args []string) error { |
| r := rt.R() |
| var name string |
| switch len(args) { |
| case 0: |
| name = defaultIdentityName() |
| case 1: |
| name = args[0] |
| default: |
| return fmt.Errorf("require at most one argument, provided %d", len(args)) |
| } |
| id, err := r.NewIdentity(name) |
| if err != nil { |
| return fmt.Errorf("NewIdentity(%q) failed: %v", name, err) |
| } |
| output, err := util.Base64VomEncode(id) |
| if err != nil { |
| return fmt.Errorf("failed to encode identity: %v", err) |
| } |
| fmt.Println(output) |
| return nil |
| }, |
| } |
| |
| cmdBless = &cmdline.Command{ |
| Name: "bless", |
| Short: "Bless another identity with your own", |
| Long: ` |
| Bless uses the identity of the tool (either from an environment variable or |
| explicitly specified using --with) to bless another identity encoded in a |
| file (or STDIN). No caveats are applied to this blessing other than expiration, |
| which is specified with --for. |
| |
| The output consists of a base64-vom encoded security.PrivateID or security.PublicID, |
| depending on what was provided as input. |
| |
| For example, if the tool has an identity veyron/user/device, then |
| bless /tmp/blessee batman |
| will generate a blessing with the name veyron/user/device/batman |
| |
| The identity of the tool can be specified with the --with flag: |
| bless --with /tmp/id /tmp/blessee batman |
| `, |
| ArgsName: "<file> <name>", |
| ArgsLong: ` |
| <file> is the name of the file containing a base64-vom encoded security.PublicID |
| or security.PrivateID |
| |
| <name> is the name to use for the blessing. |
| `, |
| Run: func(cmd *cmdline.Command, args []string) error { |
| if len(args) != 2 { |
| return fmt.Errorf("expected exactly two arguments (<file> and <name>), got %d", len(args)) |
| } |
| blesser := rt.R().Identity() |
| if len(flagBlessWith) > 0 { |
| if err := decode(flagBlessWith, &blesser); err != nil { |
| return err |
| } |
| } |
| name := args[1] |
| var blessee security.PublicID |
| var private security.PrivateID |
| encoded, err := read(args[0]) |
| if err != nil { |
| return err |
| } |
| if util.Base64VomDecode(encoded, &blessee); err != nil || blessee == nil { |
| if err := util.Base64VomDecode(encoded, &private); err != nil || private == nil { |
| return fmt.Errorf("failed to extract security.PublicID or security.PrivateID: (%v, %v)", private, err) |
| } |
| blessee = private.PublicID() |
| } |
| blessed, err := blesser.Bless(blessee, name, flagBlessFor, nil) |
| if err != nil { |
| return err |
| } |
| var object interface{} = blessed |
| if private != nil { |
| object, err = private.Derive(blessed) |
| if err != nil { |
| return err |
| } |
| } |
| output, err := util.Base64VomEncode(object) |
| if err != nil { |
| return err |
| } |
| fmt.Println(output) |
| return nil |
| }, |
| } |
| |
| cmdSeekBlessing = &cmdline.Command{ |
| Name: "seekblessing", |
| Short: "Seek a blessing from the default veyron identity provider", |
| Long: ` |
| Seeks a blessing from a default, hardcoded Veyron identity provider which |
| requires the caller to first authenticate with Google using OAuth. Simply |
| run the command to see what happens. |
| |
| The blessing is sought for the identity that this tool is using. An alternative |
| can be provided with the --for flag. |
| `, |
| Run: func(cmd *cmdline.Command, args []string) error { |
| r := rt.R() |
| id := r.Identity() |
| |
| if len(flagSeekBlessingFor) > 0 { |
| if err := decode(flagSeekBlessingFor, &id); err != nil { |
| return err |
| } |
| var err error |
| if r, err = rt.New(veyron2.RuntimeID(id)); err != nil { |
| return err |
| } |
| } |
| |
| blessedChan := make(chan string) |
| defer close(blessedChan) |
| macaroonChan, err := getMacaroonForBlessRPC(flagSeekBlessingFrom, blessedChan) |
| if err != nil { |
| return fmt.Errorf("failed to get authorization code from Google: %v", err) |
| } |
| macaroon := <-macaroonChan |
| service := <-macaroonChan |
| |
| ctx, cancel := r.NewContext().WithTimeout(time.Minute) |
| defer cancel() |
| |
| wait := time.Second |
| const maxWait = 20 * time.Second |
| var reply vdlutil.Any |
| for { |
| blesser, err := identity.BindMacaroonBlesser(service, r.Client()) |
| if err == nil { |
| reply, err = blesser.Bless(ctx, macaroon) |
| } |
| if err != nil { |
| vlog.Infof("Failed to get blessing from %q: %v, will try again in %v", service, err, wait) |
| time.Sleep(wait) |
| if wait = wait + 2*time.Second; wait > maxWait { |
| wait = maxWait |
| } |
| continue |
| } |
| blessed, ok := reply.(security.PublicID) |
| if !ok { |
| return fmt.Errorf("received %T, want security.PublicID", reply) |
| } |
| if id, err = id.Derive(blessed); err != nil { |
| return fmt.Errorf("received incompatible blessing from %q: %v", service, err) |
| } |
| output, err := util.Base64VomEncode(id) |
| if err != nil { |
| return fmt.Errorf("failed to encode blessing: %v", err) |
| } |
| fmt.Println(output) |
| blessedChan <- fmt.Sprint(blessed) |
| // Wait for getTokenForBlessRPC to clean up: |
| <-macaroonChan |
| return nil |
| } |
| }, |
| } |
| ) |
| |
| func main() { |
| rt.Init() |
| cmdBless.Flags.StringVar(&flagBlessWith, "with", "", "Path to file containing identity to bless with (or - for STDIN)") |
| cmdBless.Flags.DurationVar(&flagBlessFor, "for", 365*24*time.Hour, "Expiry time of blessing (defaults to 1 year)") |
| cmdSeekBlessing.Flags.StringVar(&flagSeekBlessingFor, "for", "", "Path to file containing identity to bless (or - for STDIN)") |
| cmdSeekBlessing.Flags.StringVar(&flagSeekBlessingFrom, "from", "https://proxy.envyor.com:8125/google", "URL to use to begin the seek blessings process") |
| |
| (&cmdline.Command{ |
| Name: "identity", |
| Short: "Create and manage veyron identities", |
| Long: ` |
| The identity tool helps create and manage keys and blessings that are used for |
| identification in veyron. |
| `, |
| Children: []*cmdline.Command{cmdPrint, cmdGenerate, cmdBless, cmdSeekBlessing}, |
| }).Main() |
| } |
| |
| func read(fname string) (string, error) { |
| if len(fname) == 0 { |
| return "", nil |
| } |
| f := os.Stdin |
| if fname != "-" { |
| var err error |
| if f, err = os.Open(fname); err != nil { |
| return "", fmt.Errorf("failed to open %q: %v", fname, err) |
| } |
| } |
| defer f.Close() |
| var buf bytes.Buffer |
| if _, err := io.Copy(&buf, f); err != nil { |
| return "", fmt.Errorf("failed to read %q: %v", fname, err) |
| } |
| return buf.String(), nil |
| } |
| |
| func decode(fname string, val interface{}) error { |
| str, err := read(fname) |
| if err != nil { |
| return err |
| } |
| if err := util.Base64VomDecode(str, val); err != nil || val == nil { |
| return fmt.Errorf("failed to decode %q: %v", fname, err) |
| } |
| return nil |
| } |
| |
| func defaultIdentityName() string { |
| var name string |
| if user, _ := user.Current(); user != nil && len(user.Username) > 0 { |
| name = user.Username |
| } else { |
| name = "anonymous" |
| } |
| if host, _ := os.Hostname(); len(host) > 0 { |
| name = name + "@" + host |
| } |
| return name |
| } |
