swaroop: store whole signer/decryption chains and private keys encrypted by machine...
[dcpomatic.git] / src / lib / config.cc
index ede0b1059d4284ff5d1ff274fa9f2bfe0cc3eab9..04cf6dd9b5cfa12ae124bb9b1a44113964dd4263 100644 (file)
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2012-2018 Carl Hetherington <cth@carlh.net>
+    Copyright (C) 2012-2019 Carl Hetherington <cth@carlh.net>
 
     This file is part of DCP-o-matic.
 
@@ -32,6 +32,7 @@
 #include "film.h"
 #include "dkdm_wrapper.h"
 #include "compose.hpp"
+#include "crypto.h"
 #include <dcp/raw_convert.h>
 #include <dcp/name_format.h>
 #include <dcp/certificate_chain.h>
@@ -61,6 +62,7 @@ using boost::shared_ptr;
 using boost::optional;
 using boost::dynamic_pointer_cast;
 using boost::algorithm::trim;
+using boost::shared_array;
 using dcp::raw_convert;
 
 Config* Config::_instance = 0;
@@ -167,7 +169,8 @@ Config::set_defaults ()
        _image_display = 0;
        _respect_kdm_validity_periods = true;
        _player_log_file = boost::none;
-       _player_dcp_directory = boost::none;
+       _player_content_directory = boost::none;
+       _player_playlist_directory = boost::none;
        _player_kdm_directory = boost::none;
 #ifdef DCPOMATIC_VARIANT_SWAROOP
        _player_background_image = boost::none;
@@ -175,7 +178,9 @@ Config::set_defaults ()
        _player_watermark_theatre = "";
        _player_watermark_period = 1;
        _player_watermark_duration = 50;
-       _allow_spl_editing = true;
+       _player_lock_file = boost::none;
+       _signer_chain_path = "signer";
+       _decryption_chain_path = "decryption";
 #endif
 
        _allowed_dcp_frame_rates.clear ();
@@ -232,7 +237,7 @@ void
 Config::read ()
 try
 {
-#ifdef DCPOMATIC_VARIANT_SWAROOP
+#if defined(DCPOMATIC_VARIANT_SWAROOP) && defined(DCPOMATIC_LINUX)
        if (geteuid() == 0) {
                /* Take ownership of the config file if we're root */
                chown (config_file().string().c_str(), 0, 0);
@@ -391,6 +396,21 @@ try
        }
 
        cxml::NodePtr signer = f.optional_node_child ("Signer");
+#ifdef DCPOMATIC_VARIANT_SWAROOP
+       if (signer && signer->node_children().size() == 1) {
+               /* The content of <Signer> is a path to a file; if it's relative it's in the same
+                  directory as .config. */
+               _signer_chain_path = signer->content();
+               if (_signer_chain_path.is_relative()) {
+                       _signer_chain = read_swaroop_chain (path(_signer_chain_path.string()));
+               } else {
+                       _signer_chain = read_swaroop_chain (_signer_chain_path);
+               }
+       } else {
+               /* <Signer> is not present or has children: ignore it and remake. */
+               _signer_chain = create_certificate_chain ();
+       }
+#else
        if (signer) {
                shared_ptr<dcp::CertificateChain> c (new dcp::CertificateChain ());
                /* Read the signing certificates and private key in from the config file */
@@ -403,6 +423,7 @@ try
                /* Make a new set of signing certificates and key */
                _signer_chain = create_certificate_chain ();
        }
+#endif
 
        /* These must be done before we call BadSignerChain as that might set one
           of the nags.
@@ -429,6 +450,21 @@ try
        }
 
        cxml::NodePtr decryption = f.optional_node_child ("Decryption");
+#ifdef DCPOMATIC_VARIANT_SWAROOP
+       if (decryption && decryption->node_children().size() == 1) {
+               /* The content of <Decryption> is a path to a file; if it's relative, it's in the same
+                  directory as .config. */
+               _decryption_chain_path = decryption->content();
+               if (_decryption_chain_path.is_relative()) {
+                       _decryption_chain = read_swaroop_chain (path(_decryption_chain_path.string()));
+               } else {
+                       _decryption_chain = read_swaroop_chain (_decryption_chain_path);
+               }
+       } else {
+               /* <Decryption> is not present or has more children: ignore it and remake. */
+               _decryption_chain = create_certificate_chain ();
+       }
+#else
        if (decryption) {
                shared_ptr<dcp::CertificateChain> c (new dcp::CertificateChain ());
                BOOST_FOREACH (cxml::NodePtr i, decryption->node_children ("Certificate")) {
@@ -439,7 +475,7 @@ try
        } else {
                _decryption_chain = create_certificate_chain ();
        }
-
+#endif
        if (f.optional_node_child("DKDMGroup")) {
                /* New-style: all DKDMs in a group */
                _dkdms = dynamic_pointer_cast<DKDMGroup> (DKDMBase::read (f.node_child("DKDMGroup")));
@@ -515,7 +551,8 @@ try
        _image_display = f.optional_number_child<int>("ImageDisplay").get_value_or(0);
        _respect_kdm_validity_periods = f.optional_bool_child("RespectKDMValidityPeriods").get_value_or(true);
        _player_log_file = f.optional_string_child("PlayerLogFile");
-       _player_dcp_directory = f.optional_string_child("PlayerDCPDirectory");
+       _player_content_directory = f.optional_string_child("PlayerContentDirectory");
+       _player_playlist_directory = f.optional_string_child("PlayerPlaylistDirectory");
        _player_kdm_directory = f.optional_string_child("PlayerKDMDirectory");
 #ifdef DCPOMATIC_VARIANT_SWAROOP
        _player_background_image = f.optional_string_child("PlayerBackgroundImage");
@@ -526,7 +563,7 @@ try
        BOOST_FOREACH (cxml::ConstNodePtr i, f.node_children("RequiredMonitor")) {
                _required_monitors.push_back(Monitor(i));
        }
-       _allow_spl_editing = f.optional_bool_child("AllowSPLEditing").get_value_or(true);
+       _player_lock_file = f.optional_string_child("PlayerLockFile");
 #endif
 
        /* Replace any cinemas from config.xml with those from the configured file */
@@ -654,8 +691,8 @@ Config::write_config () const
        }
        if (_default_container) {
                /* [XML:opt] DefaultContainer ID of default container
-                * to use when creating new films (<code>185</code>,<code>239</code> or
-                * <code>190</code>).
+                  to use when creating new films (<code>185</code>,<code>239</code> or
+                  <code>190</code>).
                */
                root->add_child("DefaultContainer")->add_child_text (_default_container->id ());
        }
@@ -764,20 +801,38 @@ Config::write_config () const
        /* [XML] Signer Certificate chain and private key to use when signing DCPs and KDMs.  Should contain <code>&lt;Certificate&gt;</code>
           tags in order and a <code>&lt;PrivateKey&gt;</code> tag all containing PEM-encoded certificates or private keys as appropriate.
        */
+#ifdef DCPOMATIC_VARIANT_SWAROOP
+       if (_signer_chain_path.is_relative()) {
+               write_swaroop_chain (_signer_chain, path(_signer_chain_path.string()));
+       } else {
+               write_swaroop_chain (_signer_chain, _signer_chain_path);
+       }
+       root->add_child("Signer")->add_child_text(_signer_chain_path.string());
+#else
        xmlpp::Element* signer = root->add_child ("Signer");
        DCPOMATIC_ASSERT (_signer_chain);
        BOOST_FOREACH (dcp::Certificate const & i, _signer_chain->unordered()) {
                signer->add_child("Certificate")->add_child_text (i.certificate (true));
        }
        signer->add_child("PrivateKey")->add_child_text (_signer_chain->key().get ());
+#endif
 
        /* [XML] Decryption Certificate chain and private key to use when decrypting KDMs */
+#ifdef DCPOMATIC_VARIANT_SWAROOP
+       if (_decryption_chain_path.is_relative()) {
+               write_swaroop_chain (_decryption_chain, path(_decryption_chain_path.string()));
+       } else {
+               write_swaroop_chain (_decryption_chain, _decryption_chain_path);
+       }
+       root->add_child("Decryption")->add_child_text(_decryption_chain_path.string());
+#else
        xmlpp::Element* decryption = root->add_child ("Decryption");
        DCPOMATIC_ASSERT (_decryption_chain);
        BOOST_FOREACH (dcp::Certificate const & i, _decryption_chain->unordered()) {
                decryption->add_child("Certificate")->add_child_text (i.certificate (true));
        }
        decryption->add_child("PrivateKey")->add_child_text (_decryption_chain->key().get ());
+#endif
 
        /* [XML] History Filename of DCP to present in the <guilabel>File</guilabel> menu of the GUI; there can be more than one
           of these tags.
@@ -919,8 +974,11 @@ Config::write_config () const
        if (_player_log_file) {
                root->add_child("PlayerLogFile")->add_child_text(_player_log_file->string());
        }
-       if (_player_dcp_directory) {
-               root->add_child("PlayerDCPDirectory")->add_child_text(_player_dcp_directory->string());
+       if (_player_content_directory) {
+               root->add_child("PlayerContentDirectory")->add_child_text(_player_content_directory->string());
+       }
+       if (_player_playlist_directory) {
+               root->add_child("PlayerPlaylistDirectory")->add_child_text(_player_playlist_directory->string());
        }
        if (_player_kdm_directory) {
                root->add_child("PlayerKDMDirectory")->add_child_text(_player_kdm_directory->string());
@@ -936,15 +994,26 @@ Config::write_config () const
        BOOST_FOREACH (Monitor i, _required_monitors) {
                i.as_xml(root->add_child("RequiredMonitor"));
        }
-       root->add_child("AllowSPLEditing")->add_child_text(_allow_spl_editing ? "1" : "0");
+       if (_player_lock_file) {
+               root->add_child("PlayerLockFile")->add_child_text(_player_lock_file->string());
+       }
 #endif
 
        try {
-               doc.write_to_file_formatted(config_file().string());
+               string const s = doc.write_to_string_formatted ();
+               boost::filesystem::path tmp (string(config_file().string()).append(".tmp"));
+               FILE* f = fopen_boost (tmp, "w");
+               if (!f) {
+                       throw FileError (_("Could not open file for writing"), tmp);
+               }
+               checked_fwrite (s.c_str(), s.length(), f, tmp);
+               fclose (f);
+               boost::filesystem::remove (config_file());
+               boost::filesystem::rename (tmp, config_file());
        } catch (xmlpp::exception& e) {
                string s = e.what ();
                trim (s);
-               throw FileError (s, path("config.xml"));
+               throw FileError (s, config_file());
        }
 }
 
@@ -960,7 +1029,9 @@ Config::write_cinemas () const
        }
 
        try {
-               doc.write_to_file_formatted (_cinemas_file.string ());
+               doc.write_to_file_formatted (_cinemas_file.string() + ".tmp");
+               boost::filesystem::remove (_cinemas_file);
+               boost::filesystem::rename (_cinemas_file.string() + ".tmp", _cinemas_file);
        } catch (xmlpp::exception& e) {
                string s = e.what ();
                trim (s);
@@ -1185,10 +1256,16 @@ Config::config_file ()
        }
 
        /* See if there's a link */
-       f.read_file (main);
-       optional<string> link = f.optional_string_child("Link");
-       if (link) {
-               return *link;
+       try {
+               f.read_file (main);
+               optional<string> link = f.optional_string_child("Link");
+               if (link) {
+                       return *link;
+               }
+       } catch (xmlpp::exception& e) {
+               /* There as a problem reading the main configuration file,
+                  so there can't be a link.
+               */
        }
 
        return main;