cacert-gosignerclient/internal/handler/handler.go

/*
Copyright CAcert Inc.
SPDX-License-Identifier: Apache-2.0

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package handler

import (
	"context"
	"errors"
	"fmt"
	"time"

	"github.com/shamaton/msgpackgen/msgpack"
	"github.com/sirupsen/logrus"

	"git.cacert.org/cacert-gosignerclient/internal/client"

	"git.cacert.org/cacert-gosigner/pkg/messages"

	"git.cacert.org/cacert-gosigner/pkg/protocol"
	"git.cacert.org/cacert-gosignerclient/internal/config"
)

type SignerClientHandler struct {
	logger         *logrus.Logger
	config         *config.ClientConfig
	clientCallback chan<- any
}

var errInputClosed = errors.New("input channel has been closed")

func (s *SignerClientHandler) Send(ctx context.Context, command *protocol.Command, out chan<- []byte) error {
	var (
		frame []byte
		err   error
	)

	frame, err = msgpack.Marshal(command.Announce)
	if err != nil {
		return fmt.Errorf("could not marshal command annoucement: %w", err)
	}

	s.logger.WithField("announcement", command.Announce).Debug("write command announcement")

	s.logger.Trace("writing command announcement")

	select {
	case <-ctx.Done():
		return nil
	case out <- frame:
		break
	}

	frame, err = msgpack.Marshal(command.Command)
	if err != nil {
		return fmt.Errorf("could not marshal command data: %w", err)
	}

	s.logger.WithField("command", command.Command).Debug("write command data")

	select {
	case <-ctx.Done():
		return nil
	case out <- frame:
		return nil
	}
}

func (s *SignerClientHandler) ResponseAnnounce(ctx context.Context, in <-chan []byte) (*protocol.Response, error) {
	response := &protocol.Response{}

	var announce messages.ResponseAnnounce

	select {
	case <-ctx.Done():
		return nil, nil
	case frame, ok := <-in:
		if !ok {
			return nil, errInputClosed
		}

		if err := msgpack.Unmarshal(frame, &announce); err != nil {
			return nil, fmt.Errorf("could not unmarshal response announcement: %w", err)
		}

		response.Announce = &announce

		s.logger.WithField("announcement", response.Announce).Debug("received response announcement")

		return response, nil
	case <-time.After(s.config.ResponseAnnounceTimeout):
		return nil, protocol.ErrResponseAnnounceTimeoutExpired
	}
}

func (s *SignerClientHandler) ResponseData(ctx context.Context, in <-chan []byte, response *protocol.Response) error {
	select {
	case <-ctx.Done():
		return nil
	case frame := <-in:
		err := handleIncomingFrame(response, frame)
		if err != nil {
			return err
		}
	case <-time.After(s.config.ResponseDataTimeout):
		return protocol.ErrResponseDataTimeoutExpired
	}

	return nil
}

func handleIncomingFrame(response *protocol.Response, frame []byte) error {
	switch response.Announce.Code {
	case messages.RespHealth:
		var resp messages.HealthResponse
		if err := msgpack.Unmarshal(frame, &resp); err != nil {
			return fmt.Errorf("could not unmarshal health response data: %w", err)
		}

		response.Response = &resp
	case messages.RespCAInfo:
		var resp messages.CAInfoResponse
		if err := msgpack.Unmarshal(frame, &resp); err != nil {
			return fmt.Errorf("could not unmarshal CA info response data: %w", err)
		}

		response.Response = &resp
	case messages.RespFetchCRL:
		var resp messages.FetchCRLResponse
		if err := msgpack.Unmarshal(frame, &resp); err != nil {
			return fmt.Errorf("could not unmarshal fetch CRL response data: %w", err)
		}

		response.Response = &resp
	case messages.RespSignCertificate:
		var resp messages.SignCertificateResponse
		if err := msgpack.Unmarshal(frame, &resp); err != nil {
			return fmt.Errorf("could not unmarshal sign certificate response data: %w", err)
		}

		response.Response = &resp
	case messages.RespSignOpenPGP:
		var resp messages.SignOpenPGPResponse
		if err := msgpack.Unmarshal(frame, &resp); err != nil {
			return fmt.Errorf("could not unmarshal sign OpenPGP response data: %w", err)
		}

		response.Response = &resp
	case messages.RespError:
		var resp messages.ErrorResponse
		if err := msgpack.Unmarshal(frame, &resp); err != nil {
			return fmt.Errorf("could not unmarshal error response data: %w", err)
		}

		response.Response = &resp
	default:
		return fmt.Errorf("unhandled response code %s", response.Announce.Code)
	}

	return nil
}

func (s *SignerClientHandler) HandleResponse(ctx context.Context, response *protocol.Response) error {
	s.logger.WithField("response", response.Announce).Info("handled response")
	s.logger.WithField("response", response).Debug("full response")

	switch r := response.Response.(type) {
	case *messages.HealthResponse:
		s.handleHealthResponse(ctx, r)
	default:
		s.logger.WithField("response", response).Tracef(
			"delegate response handling of type %T", response.Response,
		)
		s.handleGenericResponse(ctx, response)
	}

	return nil
}

func (s *SignerClientHandler) handleHealthResponse(ctx context.Context, r *messages.HealthResponse) {
	signerInfo := client.SignerInfo{}

	signerInfo.SignerHealth = r.Healthy
	signerInfo.SignerVersion = r.Version

	if !r.Healthy {
		// it might be a good idea to notify monitoring if the signer is not OK
		s.logger.Error("signer is not healthy")
	}

	for _, item := range r.Info {
		if !item.Healthy {
			s.logger.WithField("component", item.Source).Error("signer component is not healthy")
		}

		switch item.Source {
		case "HSM":
			signerInfo.CACertificates = make([]string, 0)

			for certName, status := range item.MoreInfo {
				if status == string(messages.CertStatusOk) {
					signerInfo.CACertificates = append(signerInfo.CACertificates, certName)

					continue
				}

				s.logger.WithFields(map[string]interface{}{
					"certificate": certName,
					"status":      status,
				}).Warn("certificate has issues")
			}
		default:
			s.logger.WithField("source", item.Source).Warn("unhandled health source")
		}
	}

	select {
	case <-ctx.Done():
		return
	case s.clientCallback <- signerInfo:
		break
	}
}

func (s *SignerClientHandler) handleGenericResponse(ctx context.Context, response *protocol.Response) {
	select {
	case <-ctx.Done():
		return
	case s.clientCallback <- response:
		break
	}
}

func New(
	config *config.ClientConfig,
	logger *logrus.Logger,
	clientCallback chan any,
) (protocol.ClientHandler, error) {
	return &SignerClientHandler{
		logger:         logger,
		config:         config,
		clientCallback: clientCallback,
	}, nil
}