Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A Class that implements replication for metacat

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Chad Berkley

 *

 *   '$Author: daigle $'

 *     '$Date: 2009-03-25 13:41:15 -0800 (Wed, 25 Mar 2009) $'

 * '$Revision: 4861 $'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat.replication;

import java.io.ByteArrayInputStream;

import java.io.FileInputStream;

import java.io.FileNotFoundException;

import java.io.IOException;

import java.io.InputStream;

import java.io.OutputStream;

import java.io.PrintWriter;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.NoSuchAlgorithmException;

import java.security.cert.Certificate;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import java.util.Enumeration;

import java.util.Hashtable;

import javax.servlet.ServletConfig;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

import org.apache.commons.io.IOUtils;

import org.apache.log4j.Logger;

import org.dataone.client.auth.CertificateManager;

import edu.ucsb.nceas.metacat.properties.PropertyService;

import edu.ucsb.nceas.metacat.service.ServiceService;

import edu.ucsb.nceas.metacat.service.SessionService;

import edu.ucsb.nceas.metacat.shared.MetacatUtilException;

import edu.ucsb.nceas.metacat.shared.ServiceException;

import edu.ucsb.nceas.metacat.util.AuthUtil;

import edu.ucsb.nceas.metacat.util.SessionData;

import edu.ucsb.nceas.utilities.PropertyNotFoundException;

public class ReplicationServlet extends HttpServlet {

	private static final long serialVersionUID = -2898600143193513155L;

	private static Logger logReplication = Logger.getLogger("ReplicationLogging");

	private static Logger logMetacat = Logger.getLogger(ReplicationServlet.class);

	/**

	 * Initialize the servlet by creating appropriate database connections

	 */

	public void init(ServletConfig config) throws ServletException {

		try {

			// Register preliminary services

			ServiceService.registerService("ReplicationService", ReplicationService

					.getInstance());

		} catch (ServiceException se) {

			String errorMessage = "ReplicationServlet.init - Service problem while intializing Replication Servlet: "

					+ se.getMessage();

			logMetacat.error("ReplicationServlet.init - " + ReplicationService.METACAT_REPL_ERROR_MSG);                         

			logReplication.error(errorMessage);

			throw new ServletException(errorMessage);

		} 

	}

	public void destroy() {

		//ServiceService.

	}

	public void doGet(HttpServletRequest request, HttpServletResponse response)

			throws ServletException, IOException {

		// Process the data and send back the response

		handleGetOrPost(request, response);

	}

	public void doPost(HttpServletRequest request, HttpServletResponse response)

			throws ServletException, IOException {

		// Process the data and send back the response

		handleGetOrPost(request, response);

	}

	private void handleGetOrPost(HttpServletRequest request, HttpServletResponse response)

			throws ServletException, IOException {

		PrintWriter out = null;

		Hashtable<String, String[]> params = new Hashtable<String, String[]>();

		Enumeration<String> paramlist = request.getParameterNames();

		while (paramlist.hasMoreElements()) {

			String name = (String) paramlist.nextElement();

			String[] value = request.getParameterValues(name);

			params.put(name, value);

		}

		String action = "";

		if (!params.isEmpty() && params.get("action") != null) {

			action = ((String[]) params.get("action"))[0];

		}

		String server = null;

		try {

			// check if the server is included in the list of replicated servers

			if (!action.equals("servercontrol") && !action.equals("stop")

					&& !action.equals("start") && !action.equals("getall")) {

				// verify the client certificate on the request

				boolean isValid = false;

				String msg = "Client certificate is invalid";

				try {

					isValid = hasValidCertificate(request);

				} catch (Exception e) {

					msg = "Could not verify client certificate: " + e.getMessage();

					logMetacat.error(msg, e);

					logReplication.error(msg, e);

				}

				if (!isValid) {

					// send message to response

					out = response.getWriter();

					out.print("<error>");

					out.print(msg);

					out.print("</error>");

					out.close();

					return;

				}

				server = ((String[]) params.get("server"))[0];

				if (ReplicationService.getServerCodeForServerName(server) == 0) {

					logReplication.debug("ReplicationServlet.handleGetOrPost - Action \"" + action + "\" rejected for server: "

							+ server);

					return;

				} else {

					logReplication.debug("ReplicationServlet.handleGetOrPost - Action \"" + action + "\" accepted for server: "

							+ server);

				}

			} else {

				// start, stop, getall and servercontrol need to check if user is administor

				HttpSession sess = request.getSession(true);

				SessionData sessionData = null;

				String sess_id = "";

				String username = "";

				String[] groupnames = { "" };

				if (params.containsKey("sessionid")) {

					sess_id = ((String[]) params.get("sessionid"))[0];

					logReplication.info("ReplicationServlet.handleGetOrPost - in has sessionid " + sess_id);

					if (SessionService.getInstance().isSessionRegistered(sess_id)) {

						logReplication.info("ReplicationServlet.handleGetOrPost - find the id " + sess_id + " in hash table");

						sessionData = SessionService.getInstance().getRegisteredSession(sess_id);

					}

				}

				if (sessionData == null) {

					sessionData = new SessionData(sess.getId(), 

							(String) sess.getAttribute("username"), 

							(String[]) sess.getAttribute("groups"),

							(String) sess.getAttribute("password"), 

							(String) sess.getAttribute("name"));

				}

				username = sessionData.getUserName();

				logReplication.warn("ReplicationServlet.handleGetOrPost - The user name from session is: " + username);

				groupnames = sessionData.getGroupNames();

				if (!AuthUtil.isAdministrator(username, groupnames)) {

					out = response.getWriter();

					out.print("<error>");

					out.print("The user \"" + username

							+ "\" is not authorized for this action.");

					out.print("</error>");

					out.close();

					logReplication.warn("ReplicationServlet.handleGetOrPost - The user \"" + username

							+ "\" is not authorized for this action: " + action);

					return;

				}

			}// else

			if (action.equals("readdata")) {

				OutputStream outStream = response.getOutputStream();

				//to get the data file.

				ReplicationService.handleGetDataFileRequest(outStream, params, response);

				outStream.close();

			} else if (action.equals("forcereplicatedatafile")) {

				//read a specific docid from remote host, and store it into local host

				ReplicationService.handleForceReplicateDataFileRequest(params, request);

			} else if (action.equals("stop")) {

				// stop the replication server

				ReplicationService.getInstance().stopReplication();

				out = response.getWriter();

				out.println("Replication Handler Stopped");

			} else if (action.equals("start")) {

				ReplicationService.getInstance().startReplication(params);

				out = response.getWriter();

				out.println("Replication Handler Started");

			} else if (action.equals("getall")) {

				ReplicationService.getInstance().runOnce();

				response.setContentType("text/html");

				out = response.getWriter();

				out.println("<html><body>\"Get All\" Done</body></html>");

			} else if (action.equals("forcereplicate")) {

				// read a specific docid from remote host, and store it into

				// local host

				ReplicationService.handleForceReplicateRequest(params, response,

						request);

			} else if (action.equals("forcereplicatesystemmetadata")) {

				ReplicationService.handleForceReplicateSystemMetadataRequest(params, response,

						request);

			} else if (action.equals("forcereplicatedelete")) {

				// read a specific docid from remote host, and store it into

				// local host

				ReplicationService.handleForceReplicateDeleteRequest(params,

						response, request);

			} else if (action.equals("update")) {

				// request an update list from the server

				ReplicationService.handleUpdateRequest(params, response);

			} else if (action.equals("read")) {

				// request a specific document from the server

				// note that this could be replaced by a call to metacatServlet

				// handleGetDocumentAction().

				ReplicationService.handleGetDocumentRequest(params, response);				

			} else if (action.equals("getlock")) {

				ReplicationService.handleGetLockRequest(params, response);

			} else if (action.equals("getdocumentinfo")) {

				ReplicationService.handleGetDocumentInfoRequest(params, response);

			} else if (action.equals("getsystemmetadata")) {

				ReplicationService.handleGetSystemMetadataRequest(params, response);

			} else if (action.equals("gettime")) {

				ReplicationService.handleGetTimeRequest(params, response);

			} else if (action.equals("getcatalog")) {

				ReplicationService.handleGetCatalogRequest(params, response, true);

			} else if (action.equals("servercontrol")) {

				ReplicationService.handleServerControlRequest(params, response);

			} else if (action.equals("test")) {

				response.setContentType("text/html");

				out = response.getWriter();

				out.println("<html><body>Test successfully</body></html>");

			}

		} catch (ServiceException e) {

			logMetacat.error("ReplicationServlet.handleGetOrPost - " + ReplicationService.METACAT_REPL_ERROR_MSG);                         

			logReplication.error("ReplicationServlet.handleGetOrPost - Error in ReplicationServlet.handleGetOrPost: " + e.getMessage());

		} catch (MetacatUtilException mue) {

			logMetacat.error("ReplicationServlet.handleGetOrPost - " + ReplicationService.METACAT_REPL_ERROR_MSG);                         

			logReplication.error("ReplicationServlet.handleGetOrPost - Metacat utility error in ReplicationServlet.handleGetOrPost: "

							+ mue.getMessage());

		} finally {

			if (out != null) {

				out.close();

			}

		}

	}

	private boolean hasValidCertificate(HttpServletRequest request) throws KeyStoreException, PropertyNotFoundException, NoSuchAlgorithmException, CertificateException, IOException {

		// get the certificate from the request

		X509Certificate certificate = CertificateManager.getInstance().getCertificate(request);

		if (certificate != null) {

			String givenSubject = CertificateManager.getInstance().getSubjectDN(certificate);

			logMetacat.debug("Given certificate subject: " + givenSubject);

			// load the keystore

			KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());

			InputStream is = new FileInputStream(PropertyService.getProperty("replication.keystore.file"));

			String password = PropertyService.getProperty("replication.keystore.password");

			keyStore.load(is, password.toCharArray());

			// this is expensive

			Enumeration<String> aliases = keyStore.aliases();

			while (aliases.hasMoreElements()) {

				// check that it contains our client's entry

				String alias = aliases.nextElement();

				logMetacat.debug("checking keyStore alias: " + alias);

				Certificate entryCertificate = keyStore.getCertificate(alias);

				if (entryCertificate instanceof X509Certificate) {

					// check the subject matches

					String entrySubject = CertificateManager.getInstance().getSubjectDN((X509Certificate) entryCertificate);

					logMetacat.debug("Entry certificate subject: " + entrySubject);

					if (entrySubject.equals(givenSubject)) {

						try {

							certificate.verify(entryCertificate.getPublicKey());

						} catch (Exception e) {

							logMetacat.warn("Certificate not verifiable: " + e.getMessage(), e);

							continue;

						}

						// if we pass verification, we did it!

						return true;

					}

				}	

			}

		}

 		return false;

	}

}