--- loncom/Lond.pm	2018/12/10 18:56:18	1.13
+++ loncom/Lond.pm	2023/05/22 21:10:56	1.22
@@ -1,6 +1,6 @@
 # The LearningOnline Network
 #
-# $Id: Lond.pm,v 1.13 2018/12/10 18:56:18 raeburn Exp $
+# $Id: Lond.pm,v 1.22 2023/05/22 21:10:56 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -37,8 +37,15 @@ use lib '/home/httpd/lib/perl/';
 use LONCAPA;
 use Apache::lonnet;
 use GDBM_File;
+use MIME::Base64;
 use Crypt::OpenSSL::X509;
+use Crypt::X509::CRL;
 use Crypt::PKCS10;
+use Net::OAuth;
+use Crypt::CBC;
+use Net::OAuth;
+use Digest::SHA;
+use Digest::MD5 qw(md5_hex);
 
 sub dump_with_regexp {
     my ( $tail, $clientversion ) = @_;
@@ -240,10 +247,10 @@ sub check_homecourses {
                     }
                 }
                 unless (&untie_domain_hash($hashref)) {
-                    &logthis("Failed to untie tied hash for nohist_courseids.db for $domain");
+                    &Apache::lonnet::logthis("Failed to untie tied hash for nohist_courseids.db for $domain");
                 }
             } else {
-                &logthis("Failed to tie hash for nohist_courseids.db for $domain");
+                &Apache::lonnet::logthis("Failed to tie hash for nohist_courseids.db for $domain");
             }
         }
         foreach my $hashid (keys(%recent)) {
@@ -315,9 +322,9 @@ sub get_courseinfo_hash {
     };
     if ($@) {
         if ($@ eq "timeout\n") {
-            &logthis("<font color='blue'>WARNING courseiddump for $cnum:$cdom from $home timedout</font>");
+            &Apache::lonnet::logthis("<font color='blue'>WARNING courseiddump for $cnum:$cdom from $home timedout</font>");
         } else {
-            &logthis("<font color='yellow'>WARNING unexpected error during eval of call for courseiddump from $home</font>");
+            &Apache::lonnet::logthis("<font color='yellow'>WARNING unexpected error during eval of call for courseiddump from $home</font>");
         }
     } else {
         if (ref($info{$cdom.'_'.$cnum}) eq 'HASH') {
@@ -803,10 +810,10 @@ sub is_course {
             }
             &Apache::lonnet::do_cache_new('iscourse',$hashid,$iscourse,3600);
             unless (&untie_domain_hash($hashref)) {
-                &logthis("Failed to untie tied hash for nohist_courseids.db for $cdom");
+                &Apache::lonnet::logthis("Failed to untie tied hash for nohist_courseids.db for $cdom");
             }
         } else {
-            &logthis("Failed to tie hash for nohist_courseids.db for $cdom");
+            &Apache::lonnet::logthis("Failed to tie hash for nohist_courseids.db for $cdom");
         }
     }
     return $iscourse;
@@ -819,19 +826,77 @@ sub server_certs {
                      host     => 'lonnetCertificate',
                      hostname => 'lonnetHostnameCertificate',
                      ca       => 'lonnetCertificateAuthority',
+                     crl      => 'lonnetCertRevocationList',
                    );
-    my (%md5hash,%expected_cn,%expired,%revoked,%wrongcn,%info,$crlfile);
+    my (%md5hash,%expected_cn,%expired,%revoked,%wrongcn,%info,$crlfile,$cafile,
+        %rvkcerts,$numrvk);
+    %info = (
+                key => {},
+                ca  => {},
+                host => {},
+                hostname => {},
+                crl => {},
+            );
+    my @ordered = ('crl','key','ca','host','hostname');
     if (ref($perlvar) eq 'HASH') {
         $expected_cn{'host'} = $Apache::lonnet::serverhomeIDs{$hostname};
         $expected_cn{'hostname'} = 'internal-'.$hostname;
         my $certsdir = $perlvar->{'lonCertificateDirectory'};
         if (-d $certsdir) {
-            $crlfile = $certsdir.'/'.$perlvar->{'lonnetCertRevocationList'};
-            foreach my $key (keys(%pemfiles)) {
+            $crlfile = $certsdir.'/'.$perlvar->{$pemfiles{'crl'}};
+            $cafile = $certsdir.'/'.$perlvar->{$pemfiles{'ca'}};
+            foreach my $key (@ordered) {
                 if ($perlvar->{$pemfiles{$key}}) {
                     my $file = $certsdir.'/'.$perlvar->{$pemfiles{$key}};
                     if (-e $file) {
-                        if ($key eq 'key') {
+                        if ($key eq 'crl') {
+                             if ((-e $crlfile) && (-e $cafile)) {
+                                 if (open(PIPE,"openssl crl -in $crlfile -inform pem -CAfile $cafile -noout 2>&1 |")) {
+                                     my $crlstatus = <PIPE>;
+                                     close(PIPE);
+                                     chomp($crlstatus);
+                                     if ($crlstatus =~ /OK/) {
+                                         $info{$key}{'status'} = 'ok';
+                                         $info{$key}{'details'} = 'CRL valid for CA';
+                                     }
+                                 }
+                             }
+                             if (open(my $fh,'<',$crlfile)) {
+                                 my $pem_crl = '';
+                                 while (my $line=<$fh>) {
+                                     chomp($line);
+                                     next if ($line eq '-----BEGIN X509 CRL-----');
+                                     next if ($line eq '-----END X509 CRL-----');
+                                     $pem_crl .= $line;
+                                 }
+                                 close($fh);
+                                 my $der_crl = MIME::Base64::decode_base64($pem_crl);
+                                 if ($der_crl ne '') {
+                                     my $decoded = Crypt::X509::CRL->new( crl => $der_crl );
+                                     if ($decoded->error) {
+                                         $info{$key}{'status'} = 'error';
+                                     } elsif (ref($decoded)) {
+                                         $info{$key}{'start'} = $decoded->this_update;
+                                         $info{$key}{'end'} = $decoded->next_update;
+                                         $info{$key}{'alg'} = $decoded->SigEncAlg.' '.$decoded->SigHashAlg;
+                                         $info{$key}{'cn'} = $decoded->issuer_cn;
+                                         $info{$key}{'email'} = $decoded->issuer_email;
+                                         $info{$key}{'size'} = $decoded->signature_length;
+                                         my $rlref = $decoded->revocation_list;
+                                         if (ref($rlref) eq 'HASH') {
+                                             foreach my $key (keys(%{$rlref})) {
+                                                 my $hkey = sprintf("%X",$key);
+                                                 $rvkcerts{$hkey} = 1;
+                                             }
+                                             $numrvk = scalar(keys(%{$rlref}));
+                                             if ($numrvk) {
+                                                 $info{$key}{'details'} .= " ($numrvk revoked)"; 
+                                             }
+                                         }
+                                     }
+                                 }
+                            }
+                        } elsif ($key eq 'key') {
                             if (open(PIPE,"openssl rsa -noout -in $file -check |")) {
                                 my $check = <PIPE>;
                                 close(PIPE);
@@ -876,7 +941,8 @@ sub server_certs {
                             $info{$key}{'alg'} = $x509->sig_alg_name();
                             $info{$key}{'size'} = $x509->bit_length();
                             $info{$key}{'email'} = $x509->email();
-                            $info{$key}{'serial'} = $x509->serial();
+                            $info{$key}{'serial'} = uc($x509->serial());
+                            $info{$key}{'issuerhash'} = $x509->issuer_hash();
                             if ($x509->checkend(0)) {
                                 $expired{$key} = 1;
                             }
@@ -884,15 +950,9 @@ sub server_certs {
                                 if ($info{$key}{'cn'} ne $expected_cn{$key}) {
                                     $wrongcn{$key} = 1;
                                 }
-                                if ((-e $crlfile) && ($info{$key}{'serial'} =~ /^\w+$/)) {
-                                    my $serial = $info{$key}{'serial'};
-                                    if (open(PIPE,"openssl crl -inform PEM -text -in $crlfile | grep $serial |")) {
-                                        my $result = <PIPE>;
-                                        close(PIPE);
-                                        chomp($result);
-                                        if ($result ne '') {
-                                            $revoked{$key} = 1;
-                                        }
+                                if (($numrvk) && ($info{$key}{'serial'})) {
+                                    if ($rvkcerts{$info{$key}{'serial'}}) {
+                                        $revoked{$key} = 1;
                                     }
                                 }
                             }
@@ -939,6 +999,9 @@ sub server_certs {
                     $info{$key}{'status'} = 'expired';
                 } elsif ($wrongcn{$key}) {
                     $info{$key}{'status'} = 'wrongcn';
+                } elsif ((exists($info{'ca'}{'issuerhash'})) &&
+                         ($info{'ca'}{'issuerhash'} ne $info{$key}{'issuerhash'})) {
+                    $info{$key}{'status'} = 'mismatch';
                 } else {
                     $info{$key}{'status'} = 'ok';
                 }
@@ -966,6 +1029,350 @@ sub server_certs {
     return $result;
 }
 
+sub get_dom {
+    my ($userinput) = @_;
+    my ($cmd,$udom,$namespace,$what) =split(/:/,$userinput,4); 
+    my $hashref = &tie_domain_hash($udom,$namespace,&GDBM_READER()) or
+        return "error: ".($!+0)." tie(GDBM) Failed while attempting $cmd";
+    my $qresult='';
+    if (ref($hashref)) {
+        chomp($what);
+        my @queries=split(/\&/,$what);
+        for (my $i=0;$i<=$#queries;$i++) {
+            $qresult.="$hashref->{$queries[$i]}&";
+        }
+        $qresult=~s/\&$//;
+    }
+    &untie_user_hash($hashref) or
+        return "error: ".($!+0)." untie(GDBM) Failed while attempting $cmd";
+    return $qresult;
+}
+
+sub store_dom {
+    my ($userinput) = @_;
+    my ($cmd,$dom,$namespace,$rid,$what) =split(/:/,$userinput);
+    my $hashref  = &tie_domain_hash($dom,$namespace,&GDBM_WRCREAT(),"S","$rid:$what") or
+        return "error: ".($!+0)." tie(GDBM) Failed while attempting $cmd";
+    $hashref->{"version:$rid"}++;
+    my $version=$hashref->{"version:$rid"};
+    my $allkeys='';
+    my @pairs=split(/\&/,$what);
+    foreach my $pair (@pairs) {
+        my ($key,$value)=split(/=/,$pair);
+        $allkeys.=$key.':';
+        $hashref->{"$version:$rid:$key"}=$value;
+    }
+    my $now = time;
+    $hashref->{"$version:$rid:timestamp"}=$now;
+    $allkeys.='timestamp';
+    $hashref->{"$version:keys:$rid"}=$allkeys;
+    &untie_user_hash($hashref) or
+        return "error: ".($!+0)." untie(GDBM) Failed while attempting $cmd";
+    return 'ok';
+}
+
+sub restore_dom {
+    my ($userinput) = @_;
+    my ($cmd,$dom,$namespace,$rid) = split(/:/,$userinput);
+    my $hashref = &tie_domain_hash($dom,$namespace,&GDBM_READER()) or
+        return "error: ".($!+0)." tie(GDBM) Failed while attempting $cmd";
+    my $qresult='';
+    if (ref($hashref)) {
+        chomp($rid);
+        my $version=$hashref->{"version:$rid"};
+        $qresult.="version=$version&";
+        my $scope;
+        for ($scope=1;$scope<=$version;$scope++) {
+            my $vkeys=$hashref->{"$scope:keys:$rid"};
+            my @keys=split(/:/,$vkeys);
+            my $key;
+            $qresult.="$scope:keys=$vkeys&";
+            foreach $key (@keys) {
+                $qresult.="$scope:$key=".$hashref->{"$scope:$rid:$key"}."&";
+            }
+        }
+        $qresult=~s/\&$//;
+    }
+    &untie_user_hash($hashref) or
+        return "error: ".($!+0)." untie(GDBM) Failed while attempting $cmd";
+    return $qresult;
+}
+
+sub crslti_itemid {
+    my ($cdom,$cnum,$url,$method,$params,$loncaparev) = @_;
+    unless (ref($params) eq 'HASH') {
+        return;
+    }
+    if (($cdom eq '') || ($cnum eq '')) {
+        return;
+    }
+    my ($itemid,$consumer_key,$secret);
+
+    if (exists($params->{'oauth_callback'})) {
+        $Net::OAuth::PROTOCOL_VERSION = Net::OAuth::PROTOCOL_VERSION_1_0A;
+    } else {
+        $Net::OAuth::PROTOCOL_VERSION = Net::OAuth::PROTOCOL_VERSION_1_0;
+    }
+
+    my $consumer_key = $params->{'oauth_consumer_key'};
+    return if ($consumer_key eq '');
+
+    my (%crslti,%crslti_by_key);
+    my $hashid=$cdom.'_'.$cnum;
+    my ($result,$cached)=&Apache::lonnet::is_cached_new('courseltienc',$hashid);
+    if (defined($cached)) {
+        if (ref($result) eq 'HASH') {
+            %crslti = %{$result};
+        }
+    } else {
+        my $reply = &dump_with_regexp(join(":",($cdom,$cnum,'nohist_ltienc','','')),$loncaparev);
+        %crslti = %{&Apache::lonnet::unserialize($reply)};
+        my $cachetime = 24*60*60;
+        &Apache::lonnet::do_cache_new('courseltienc',$hashid,\%crslti,$cachetime);
+    }
+
+    return if (!keys(%crslti));
+
+    foreach my $id (keys(%crslti)) {
+        if (ref($crslti{$id}) eq 'HASH') {
+            my $key = $crslti{$id}{'key'};
+            if (($key ne '') && ($crslti{$id}{'secret'} ne '')) {
+                push(@{$crslti_by_key{$key}},$id);
+            }
+        }
+    }
+
+    return if (!keys(%crslti_by_key));
+
+    my %courselti = &Apache::lonnet::get_course_lti($cnum,$cdom,'provider');
+
+    if (ref($crslti_by_key{$consumer_key}) eq 'ARRAY') {
+        foreach my $id (@{$crslti_by_key{$consumer_key}}) {
+            my $secret = $crslti{$id}{'secret'};
+            if (ref($courselti{$id}) eq 'HASH') {
+                if ((exists($courselti{$id}{'cipher'})) &&
+                    ($courselti{$id}{'cipher'} =~ /^\d+$/)) {
+                    my $keynum = $courselti{$id}{'cipher'};
+                    my $privkey = &get_dom("getdom:$cdom:private:$keynum:lti:key");
+                    if ($privkey ne '') {
+                        my $cipher = new Crypt::CBC($privkey);
+                        $secret = $cipher->decrypt_hex($secret);
+                    }
+                }
+            }
+            my $request = Net::OAuth->request('request token')->from_hash($params,
+                                              request_url => $url,
+                                              request_method => $method,
+                                              consumer_secret => $secret,);
+            if ($request->verify()) {
+                $itemid = $id;
+                last;
+            }
+        }
+    }
+    return $itemid;
+}
+
+sub domlti_itemid {
+    my ($dom,$context,$url,$method,$params,$loncaparev) = @_;
+    unless (ref($params) eq 'HASH') {
+        return;
+    }
+    if ($dom eq '') {
+        return;
+    }
+    my ($itemid,$consumer_key,$secret);
+
+    if (exists($params->{'oauth_callback'})) {
+        $Net::OAuth::PROTOCOL_VERSION = Net::OAuth::PROTOCOL_VERSION_1_0A;
+    } else {
+        $Net::OAuth::PROTOCOL_VERSION = Net::OAuth::PROTOCOL_VERSION_1_0;
+    }
+
+    my $consumer_key = $params->{'oauth_consumer_key'};
+    return if ($consumer_key eq '');
+
+    my ($name,$cachename);
+    if ($context eq 'linkprot') {
+        $name = $context;
+    } else {
+        $name = 'lti';
+    }
+    $cachename = $name.'enc';
+    my %ltienc;
+    my ($encresult,$enccached)=&Apache::lonnet::is_cached_new($cachename,$dom);
+    if (defined($enccached)) {
+        if (ref($encresult) eq 'HASH') {
+            %ltienc = %{$encresult};
+        }
+    } else {
+        my $reply = &get_dom("getdom:$dom:encconfig:$name");
+        my $ltiencref = &Apache::lonnet::thaw_unescape($reply);
+        if (ref($ltiencref) eq 'HASH') {
+            %ltienc = %{$ltiencref};
+        }
+        my $cachetime = 24*60*60;
+        &Apache::lonnet::do_cache_new($cachename,$dom,\%ltienc,$cachetime);
+    }
+
+    return if (!keys(%ltienc));
+
+    my %lti_by_key;
+    foreach my $id (keys(%ltienc)) {
+        if (ref($ltienc{$id}) eq 'HASH') {
+            my $key = $ltienc{$id}{'key'};
+            if (($key ne '') && ($ltienc{$id}{'secret'} ne '')) {
+                push(@{$lti_by_key{$key}},$id);
+            }
+        }
+    }
+    return if (!keys(%lti_by_key));
+
+    my %lti = &Apache::lonnet::get_domain_lti($dom,$context);
+
+    if (ref($lti_by_key{$consumer_key}) eq 'ARRAY') {
+        foreach my $id (@{$lti_by_key{$consumer_key}}) {
+            my $secret = $ltienc{$id}{'secret'};
+            if (ref($lti{$id}) eq 'HASH') {
+                if ((exists($lti{$id}{'cipher'})) &&
+                    ($lti{$id}{'cipher'} =~ /^\d+$/)) {
+                    my $keynum = $lti{$id}{'cipher'};
+                    my $privkey = &get_dom("getdom:$dom:private:$keynum:lti:key");
+                    if ($privkey ne '') {
+                        my $cipher = new Crypt::CBC($privkey);
+                        $secret = $cipher->decrypt_hex($secret);
+                    }
+                }
+            }
+            my $request = Net::OAuth->request('request token')->from_hash($params,
+                                              request_url => $url,
+                                              request_method => $method,
+                                              consumer_secret => $secret,);
+            if ($request->verify()) {
+                $itemid = $id;
+                last;
+            }
+        }
+    }
+    return $itemid;
+}
+
+sub sign_params {
+    my ($cdom,$cnum,$crstool,$url,$idx,$keynum,$post,$loncaparev,$paramsref,$inforef) = @_;
+    return unless (ref($paramsref) eq 'HASH');
+    my ($sigmethod,$type,$callback);
+    if (ref($inforef) eq 'HASH') {
+        if (exists($inforef->{'method'})) {
+            $sigmethod = $inforef->{'method'};
+        }
+        if (exists($inforef->{'cb'})) {
+            $callback = $inforef->{'cb'};
+        }
+        if (exists($inforef->{'type'})) {
+            $type = $inforef->{'type'};
+        }
+    }
+    my ($cachename,$hashid,$key,$secret,%ltitoolsenc);
+    if ($crstool) {
+        $cachename = 'crsltitoolsenc';
+        $hashid = $cdom.'_'.$cnum;
+    } else {
+        $cachename = 'ltitoolsenc';
+        $hashid = $cdom;
+    }
+    my ($encresult,$enccached)=&Apache::lonnet::is_cached_new($cachename,$hashid);
+    if (defined($enccached)) {
+        if (ref($encresult) eq 'HASH') {
+            %ltitoolsenc = %{$encresult};
+        }
+    } else {
+        if ($crstool) {
+            my $reply = &dump_with_regexp(join(":",($cdom,$cnum,'nohist_toolsenc','','')),$loncaparev);
+            %ltitoolsenc = %{&Apache::lonnet::unserialize($reply)};
+        } else {
+            my $reply = &get_dom("getdom:$cdom:encconfig:ltitools");
+            my $ltitoolsencref = &Apache::lonnet::thaw_unescape($reply);
+            if (ref($ltitoolsencref) eq 'HASH') {
+                %ltitoolsenc = %{$ltitoolsencref};
+            }
+        }
+        my $cachetime = 24*60*60;
+        &Apache::lonnet::do_cache_new($cachename,$hashid,\%ltitoolsenc,$cachetime);
+    }
+    if (!keys(%ltitoolsenc)) {
+         return;
+    } elsif (exists($ltitoolsenc{$idx})) {
+        if (ref($ltitoolsenc{$idx}) eq 'HASH') {
+            if (exists($ltitoolsenc{$idx}{'key'})) {
+                $key = $ltitoolsenc{$idx}{'key'};
+            }
+            if (exists($ltitoolsenc{$idx}{'secret'})) {
+                $secret = $ltitoolsenc{$idx}{'secret'};
+                my $privhost;
+                if ($keynum =~ /^\d+$/) {
+                    if ($crstool) {
+                        my $primary = &Apache::lonnet::domain($cdom,'primary');
+                        my @ids = &Apache::lonnet::current_machine_ids();
+                        unless (grep(/^\Q$primary\E$/,@ids)) {
+                            $privhost = $primary;
+                            my ($result,$plainsecret) = &decrypt_secret($privhost,$secret,$keynum,'ltitools');
+                            if ($result eq 'ok') {
+                                $secret = $plainsecret;
+                            } else {
+                                undef($secret);
+                            }
+                        }
+                    }
+                    unless ($privhost) {
+                        my $privkey = &get_dom("getdom:$cdom:private:$keynum:ltitools:key");
+                        if (($privkey ne '') && ($secret ne '')) {
+                            my $cipher = new Crypt::CBC($privkey);
+                            $secret = $cipher->decrypt_hex($secret);
+                        } else {
+                            undef($secret);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return if (($key eq '') || ($secret eq ''));
+    if ($sigmethod eq '') {
+        $sigmethod = 'HMAC-SHA1';
+    }
+    if ($type eq '') {
+        $type = 'request token';
+    }
+    if ($callback eq '') {
+        $callback = 'about:blank',
+    }
+    srand( time() ^ ($$ + ($$ << 15))  ); # Seed rand.
+    my $nonce = Digest::SHA::sha1_hex(sprintf("%06x%06x",rand(0xfffff0),rand(0xfffff0)));
+    my $request = Net::OAuth->request($type)->new(
+            consumer_key => $key,
+            consumer_secret => $secret,
+            request_url => $url,
+            request_method => 'POST',
+            signature_method => $sigmethod,
+            timestamp => time,
+            nonce => $nonce,
+            callback => $callback,
+            extra_params => $paramsref,
+            version      => '1.0',
+            );
+    $request->sign();
+    if ($post) {
+        return $request->to_post_body();
+    } else {
+        return $request->to_hash();
+    }
+}
+
+sub decrypt_secret {
+    my ($privhost,$secret,$keynum,$type) = @_;
+    return;
+}
+
 1;
 
 __END__
@@ -1088,7 +1495,18 @@ courseID -- for the course for which the
 The contents of the inner hash, for that single item in the outer hash
 are returned (and cached in memcache for 10 minutes).
 
+=item get_dom ( $userinput )
 
+get_dom() will retrieve domain configuration information from a GDBM file
+in /home/httpd/lonUsers/$dom on the primary library server in a domain.
+The single argument passed is the string: $cmd:$udom:$namespace:$what
+where $cmd is the command historically passed to lond - i.e., getdom
+or egetdom, $udom is the domain, $namespace is the name of the GDBM file
+(encconfig or configuration), and $what is a string containing names of 
+items to retrieve from the db file (each item name is escaped and separated
+from the next item name with an ampersand). The return value is either:
+error: followed by an error message, or a string containing the value (escaped)
+for each item, again separated from the next item with an ampersand.
 
 =back