[CHEF-29745] local license check, default off

dev/Vagrantfile

@@ -63,7 +63,7 @@ Vagrant.configure("2") do |config|
   config.vm.network 'public_network' if USE_AZURE
   config.vm.network "forwarded_port", guest: 80,  host: 8080
   config.vm.network "forwarded_port", guest: 443, host: 8443
-  config.vm.box = "bento/ubuntu-20.04"
+  config.vm.box = "bento/ubuntu-24.04"
   config.ssh.forward_agent = true
   #config.omnibus.chef_version = :latest
 
@@ -214,7 +214,7 @@ def define_chef_server(config, attributes)
     # We do a number of things that can affect the initial configuration - by
     # running reconfigure here we can ensure that they're all completed
     # first  -- no matter what kind of pre-reconfigure provisioning we doing.
-    config.vm.provision "shell", inline: "chef-server-ctl reconfigure --verbose"
+    config.vm.provision "shell", inline: "chef-server-ctl reconfigure --verbose --chef-license=accept"
 
     # Another chef-zero provision - now that the server has been reconfigured, we can set
     # up a default data for testing

dev/defaults.yml

@@ -46,7 +46,7 @@ vm:
   # All settings below apply only to the chef-server vm
   cpus: 4
   memory: 4096
-  packages: [ ntp, curl, wget, htop, uuid-dev, tmux, vim, iotop, zlib1g-dev, liblzma-dev, jq, ripgrep, tree ]
+  packages: [ curl, wget, htop, uuid-dev, tmux, vim, iotop, zlib1g-dev, liblzma-dev, jq, ripgrep, tree ]
   omnibus-autoload: [] # see config.yml for details and to add components
   # Override this in config.yml to set a custom path for your dotfiles
   # that's external to this repository.

src/oc_erchef/apps/chef_db/priv/pgsql_statements.config

@@ -594,3 +594,5 @@
 
 {update_user_by_id,
 <<"SELECT update_user(0, 'this_is_not_a_key', $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, false, $11)">>}.
+
+{value_for_key, <<"SELECT value FROM kvpair WHERE key = $1">>}.

src/oc_erchef/apps/chef_license/src/chef_license_worker.erl

@@ -19,6 +19,7 @@
     terminate/2
 ]).
 
+
 -record(state, {
     scanned_time,
     license_type,
@@ -27,16 +28,29 @@
     expiration_date,
     message,
     customer_name,
-    license_id
+    license_id,
+    install_time
 }).
 
 -define(DEFAULT_LICENSE_SCAN_INTERVAL, 30000). %milli seconds
-
 -define(DEFAULT_FILE_PATH, "/tmp/lic").
-
 -define(LICENSE_SCAN_CMD, "chef-automate license status --result-json ").
 
 
+%% Valid options: cli, or a path to a file
+%% Note that this is defaulted to cli in erl_opts in rebar.config.script but can be overridden
+%% with the path at build time by setting OC_LICENSE_PATH=<path> in the environment.
+%% (In that case, path should be something like /var/opt/opscode/license.lic)
+-ifndef(OC_LICENSE_PATH).
+-define(OC_LICENSE_PATH, cli).
+-endif.
+
+%% These functions are conditionally reachable depending on the OC_LICENSE_PATH macro value.
+%% When OC_LICENSE_PATH is 'cli' (default), the file-based path functions are not called,
+%% but they are needed when OC_LICENSE_PATH is set to a file path at build time.
+-dialyzer({no_match, [get_license_info/2, make_license_payload/2]}).
+-dialyzer({no_unused, [load_local_license/2, decode_json_payload/2]}).
+
 %%% ======================================
 %%% Exported
 %%% ======================================
@@ -51,7 +65,7 @@ get_license() ->
 %%% Gen Server callbacks
 %%% ======================================
 init(_Config) ->
-    State = check_license(#state{}),
+    State = check_license(#state{install_time = install_time()}, ?OC_LICENSE_PATH),
     erlang:send_after(?DEFAULT_LICENSE_SCAN_INTERVAL, self(), check_license),
     {ok, State}.
 
@@ -66,7 +80,7 @@ handle_cast(_Message, State) ->
     {noreply, State}.
 
 handle_info(check_license, State) ->
-    State1 = check_license(State),
+    State1 = check_license(State, ?OC_LICENSE_PATH),
     erlang:send_after(?DEFAULT_LICENSE_SCAN_INTERVAL, self(), check_license),
     {noreply, State1};
 
@@ -79,35 +93,156 @@ code_change(_OldVsn, State) ->
 terminate(_Reason, _State) ->
     ok.
 
+%%%
+%%% Internal Implementation
+%%%
+
+%% Return an approximate installation time based on the unix timestamp found kvpairs
+install_time() ->
+  DefaultTime = os:system_time(second),
+  case chef_sql:select_rows({value_for_key, [<<"itime">>]}) of
+    [[{<<"value">>, Itime}]] ->
+      try
+        binary_to_integer(Itime)
+      catch error:badarg ->
+        DefaultTime
+      end;
+    not_found -> {ok, 0};
+    {error, Reason} -> {error, Reason}
+  end.
+
+% This will continue to be the default behavior - license will only be checked
+% as part of an automate install, when the automate CLI is present.
+get_license_info(InstallTime, cli) ->
+  os:cmd(?LICENSE_SCAN_CMD ++ ?DEFAULT_FILE_PATH),
+  case file:read_file(?DEFAULT_FILE_PATH) of
+    {ok, Bin} ->
+      case catch jiffy:decode(Bin) of
+        {Json} -> Json;
+        _ ->
+          lager:warning("CLI license check returned invalid JSON, falling back to default license"),
+          make_license_payload(InstallTime, #{})
+      end;
+    {error, Reason} ->
+      lager:debug("CLI license file not found (~p), falling back to default license", [Reason]),
+      make_license_payload(InstallTime, #{})
+  end;
+% This is for the file-based license mode, where we read the license directly from a file path.
+get_license_info(InstallTime, Path) ->
+  case load_local_license(InstallTime, Path) of
+    {ok, Json} ->
+      lager:debug("Loaded local license data: ~p", [Json]),
+      Json;
+    {error, Reason} ->
+      lager:warning("Failed to load local license, falling back to default: ~p", [Reason]),
+      make_license_payload(InstallTime, #{})
+  end.
+
+load_local_license(InstallTime, Loader) when is_function(Loader) ->
+  case Loader() of
+    {ok, Bin} ->
+      %% Input format is the dotted three-part JWT style base64url encoded string, so
+      %% we start by splitting on dot and ensuring we get the expected three parts
+      case binary:split(Bin, [<<".">>], [trim_all, global]) of
+        %% NOTE: This implementation does not verify signature. To implement signature verification,
+        %%       we will need to have the license service public key available to the license worker
+        %%       at a known path.
+        [_Header, Payload, _Signature] ->
+          try base64:decode(Payload, #{ padding => false, mode => urlsafe } ) of
+            Decoded ->
+              decode_json_payload(InstallTime, Decoded)
+          catch _:Reason ->
+            { error, { invalid_base64, Reason } }
+          end;
+        _ ->
+          { error, { invalid_license_format } }
+      end;
+    {error, Reason} ->
+      { error, { load_failed, Reason } }
+  end;
+load_local_license(InstallTime, Path) ->
+  load_local_license( InstallTime, fun() -> file:read_file(Path) end ).
+
+decode_json_payload(InstallTime, Decoded) ->
+  try jiffy:decode(Decoded, [return_maps]) of
+    J -> {ok, make_license_payload(InstallTime, J)}
+  catch _:Reason ->
+    { error, {invalid_json, Reason } }
+  end.
+
+
+%% Generates a license payload using a parsed license.  The generated license is 's compatiable with the
+%% automate-ctl license status json output object, so that we can use the same processing function for both
+%% the CLI and file-based license modes.
+%% In some cases, we don't have all the data that the license service would provide, so we'll make substitutes.
+make_license_payload(_InstallTime, #{ <<"id">> := LicenseId,
+                                      <<"customer">> := CustomerName,
+                                      <<"entitlements">> := Entitlements,
+                                      <<"type">> := LicenseType
+                                    }) ->
+
+  %% The license server itself would give us actual expiration date. We have to
+  %% approximate as best we can based the latest end date of available entitilements.
+  ExpireInSeconds = case Entitlements of
+                      [] ->  0;  % No entitlements, treat as expired or invalid license
+                      _ -> lists:max([Ent || #{ <<"end">> := #{<<"seconds">> := Ent}} <- Entitlements])
+                    end,
+
+  [ {<<"result">>, {[
+                    {<<"license_id">>, LicenseId},
+                    {<<"customer_name">>, CustomerName},
+                    {<<"expiration_date">>, {[{<<"seconds">>, ExpireInSeconds}]}},
+                    {<<"license_type">>, LicenseType},
+                    {<<"grace_period">>, false}
+                   ]}}
+    ];
+make_license_payload(InstallTime, _Other) ->
+  %% If we don't have the expected fields, we don't have a valid license - so let's make something that looks like one,
+  %% but is valid from the install date + 90 days.
+  ExpirationTime = InstallTime + (60 * 60 * 24 * 90), % 90 days from install time
+  lager:debug("License payload is missing expected fields, treating as valid license with expiration : ~p", [ExpirationTime]),
+  [ {<<"result">>, {[
+                    {<<"license_id">>, <<>>},
+                    {<<"customer_name">>, <<>>},
+                    {<<"expiration_date">>, {[{<<"seconds">>, ExpirationTime}]}},
+                    {<<"license_type">>, <<"commercial">>},
+                    {<<"grace_period">>, false}
+                   ]}}
+  ].
+
+
+
+%%%
 %%% =====================
 %%% Internal functions
 %%% =====================
-check_license(State) ->
-    JsonStr =
-        case catch get_license_info() of
-            Result when is_list(Result) -> Result;
-            {'EXIT', _} -> <<"">>
-        end,
-    case process_license(JsonStr) of
-        {ok, valid_license, ExpDate, CustomerName, LicenseId} ->
-            State#state{license_cache=valid_license, grace_period=undefined, scanned_time = erlang:timestamp(), expiration_date=ExpDate, customer_name=CustomerName, license_id = LicenseId};
-        {ok, commercial_expired, ExpDate, Msg, CustomerName, LicenseId} ->
-            State#state{license_cache=commercial_expired, license_type = <<"commercial">>, grace_period=undefined, scanned_time = erlang:timestamp(), expiration_date=ExpDate, message=Msg, customer_name=CustomerName, license_id = LicenseId};
-        {ok, commercial_grace_period, ExpDate, Msg, CustomerName, LicenseId} ->
-            State#state{license_cache=commercial_grace_period, grace_period=true, scanned_time = erlang:timestamp(), expiration_date=ExpDate, message=Msg, customer_name=CustomerName, license_id = LicenseId};
-        {ok, trial_expired, ExpDate, Msg, CustomerName, LicenseId} ->
-            State#state{license_cache=trial_expired_expired, license_type = <<"trial">>, grace_period=undefined, scanned_time = erlang:timestamp(), expiration_date=ExpDate, message=Msg, customer_name=CustomerName, license_id = LicenseId};
-        {error, no_license} ->
-            State#state{license_cache=trial_expired_expired, license_type = <<"trial">>, grace_period=undefined, scanned_time = erlang:timestamp(), expiration_date="", message=get_alert_message(trial_expired, "")};
-        {error, _} -> State
-    end.
+check_license(#state{install_time = InstallTime} = State,  ModeOrPath) ->
+  JsonStr = case catch get_license_info(InstallTime, ModeOrPath) of
+              Result when is_list(Result) -> Result;
+              {'EXIT', N} ->
+                lager:error("License check failed with exit: ~p", [N]),
+                <<"">>
+            end,
+  case process_license(JsonStr) of
+    {ok, valid_license, ExpDate, CustomerName, LicenseId} ->
+      State#state{license_cache=valid_license, grace_period=undefined, scanned_time = erlang:timestamp(), expiration_date=ExpDate, customer_name=CustomerName, license_id = LicenseId};
+    {ok, commercial_expired, ExpDate, Msg, CustomerName, LicenseId} ->
+      State#state{license_cache=commercial_expired, license_type = <<"commercial">>, grace_period=undefined, scanned_time = erlang:timestamp(), expiration_date=ExpDate, message=Msg, customer_name=CustomerName, license_id = LicenseId};
+    {ok, commercial_grace_period, ExpDate, Msg, CustomerName, LicenseId} ->
+      State#state{license_cache=commercial_grace_period, grace_period=true, scanned_time = erlang:timestamp(), expiration_date=ExpDate, message=Msg, customer_name=CustomerName, license_id = LicenseId};
+    {ok, trial_expired, ExpDate, Msg, CustomerName, LicenseId} ->
+      State#state{license_cache=trial_expired_expired, license_type = <<"trial">>, grace_period=undefined, scanned_time = erlang:timestamp(), expiration_date=ExpDate, message=Msg, customer_name=CustomerName, license_id = LicenseId};
+    {error, no_license} ->
+      State#state{license_cache=trial_expired_expired, license_type = <<"trial">>, grace_period=undefined, scanned_time = erlang:timestamp(), expiration_date="", message=get_alert_message(trial_expired, "")};
+    {error, _} -> State
+  end.
 
-get_license_info() ->
-    os:cmd(?LICENSE_SCAN_CMD ++ ?DEFAULT_FILE_PATH),
-    {ok, Bin} = file:read_file(?DEFAULT_FILE_PATH),
-    {JsonStr} = jiffy:decode(Bin),
-    JsonStr.
 
+% missing license: gets treated as a trial that expires at TRACK_INSTALL_DATE + 90 days (configurable at build)
+% a present license that is not valid gets treated as an expired license.
+% a valid unexpired license gets treated as valid
+% a valid expired license gets treated as expired. license gets treated as valid, and we don not
+%
 process_license(<<"">>) ->
     {error, invalid_json};
 process_license(LicJson) ->
@@ -125,10 +260,9 @@ process_license(LicJson) ->
                                 <<"commercial">> ->
                                     case ej:get({<<"grace_period">>}, LicDetails) of
                                         true ->
-                                            {ok, commercial_grace_period, ExpDate,
-                                                get_alert_message(commercial_grace_period, ExpDate), CustomerName, LicenseId};
+                                            {ok, commercial_grace_period, ExpDate, get_alert_message(commercial_grace_period, ExpDate), CustomerName, LicenseId};
                                         _ ->
-                                            { ok, commercial_expired, ExpDate, get_alert_message(commercial_expired, ExpDate), CustomerName, LicenseId}
+                                            {ok, commercial_expired, ExpDate, get_alert_message(commercial_expired, ExpDate), CustomerName, LicenseId}
                                     end;
                                 _ ->
                                     {ok, trial_expired, ExpDate, get_alert_message(trial_expired, ExpDate), CustomerName, LicenseId}
@@ -148,6 +282,7 @@ process_license(LicJson) ->
             {error, invalid_response}
     end.
 
+
 get_alert_message(Type, ExpDate) ->
     case Type of
         trial_expired ->

src/oc_erchef/apps/chef_license/test/chef_license_worker_test.erl

@@ -24,21 +24,23 @@ get_trail_license_expired()->
     <<"{\"command\":\"chef-automate license status --result-json /tmp/string3\",\"status\":\"OK\",\"error_code\":0,\"error_description\":\"\",\"error_cause\":\"\",\"error_stack_trace\":\"\",\"error_recovery\":\"\",\"error_type\":\"\",\"result\":{\"set\":true,\"grace_period\":true,\"license_id\":\"6541d90a-2ed0-4d64-9861-c20fc21a3093\",\"customer_name\":\"janshahid.shaik@progress.com\",\"expiration_date\":{\"seconds\":1635689599},\"deployment_id\":\"fa7cce37-d8b3-4542-ad38-2e587a05faec\",\"deployment_type\":\"Standalone\",\"license_type\":\"trail\",\"deployment_at\":{\"seconds\":1727169083}}}">>.
 
 license_test()->
+    meck:new(chef_sql, [non_strict]),
+    meck:expect(chef_sql, select_rows, fun(_) -> not_found end),
     application:start(chef_license),
     file:write_file(?DEFAULT_FILE_PATH,get_commercial_license()),
     refresh_license(),
     timer:sleep(100),
     {Result, _, _, _, _,_,_} = chef_license_worker:get_license(),
     ?assertEqual(valid_license, Result),
     os:cmd("rm -rf " ++ ?DEFAULT_FILE_PATH),
-    
+
     file:write_file(?DEFAULT_FILE_PATH,get_commercial_license_expired()),
     refresh_license(),
     timer:sleep(100),
     {Result1, _, _, _, _,_,_} = chef_license_worker:get_license(),
     ?assertEqual(commercial_expired, Result1),
     os:cmd("rm -rf " ++ ?DEFAULT_FILE_PATH),
-    
+
     file:write_file(?DEFAULT_FILE_PATH,get_commercial_grace_license()),
     refresh_license(),
     timer:sleep(100),
@@ -58,7 +60,10 @@ license_test()->
     timer:sleep(100),
     {Result4,_, _, _, _ ,_,_} = chef_license_worker:get_license(),
     ?assertEqual(trial_expired_expired, Result4),
-    os:cmd("rm -rf " ++ ?DEFAULT_FILE_PATH).
+    os:cmd("rm -rf " ++ ?DEFAULT_FILE_PATH),
+    application:stop(chef_license),
+    meck:unload(chef_sql).
 
 refresh_license()->
-    erlang:send(chef_license_worker, check_license).
+    erlang:send(chef_license_worker, check_license).
+

src/oc_erchef/apps/chef_telemetry/test/chef_telemetry_worker_test.erl

@@ -29,6 +29,10 @@
     fqdn = []}).
 
 field_value_test() ->
+    meck:new(chef_license, [non_strict]),
+    meck:expect(chef_license, get_license, fun() ->
+        {valid_license, <<"commercial">>, false, 1835689599, undefined, <<"testorg">>, <<"test-license-id">>}
+    end),
     State = #state{fqdn_select = {ok, [[{<<"property">>, <<"FQDN:node1.domain1.com">>}],
                                        [{<<"property">>, <<"FQDN:node2.subdomain2.domain2.com">>}],
                                        [{<<"property">>, <<"FQDN:node3.subdomain3.domain3.co.uk">>}]]},

src/oc_erchef/rebar.config

@@ -26,8 +26,6 @@
         {git, "https://github.com/chef/ej",                         {branch, "master"}}},
     {envy, ".*",
         {git, "https://github.com/markan/envy",                     {branch, "master"}}},
-%    {eper, ".*",
-%        {git, "https://github.com/massemanet/eper",                 {branch, "master"}}},
     {erlcloud, ".*",
         {git, "https://github.com/chef/erlcloud",                   {branch, "CHEF-11677/CHEF-12498/lbaker"}}},
     {erlware_commons, ".*",
@@ -78,6 +76,8 @@
             {d, 'OC_CHEF'},
             {d, 'CHEF_DB_DARKLAUNCH', xdarklaunch_req},
             {d, 'CHEF_WM_DARKLAUNCH', xdarklaunch_req},
+            % Note: OC_LICENSE_PATH value is set dynamically in rebar.config.script
+            % {d, OC_LICENSE_PATH, cli|"path/to/license/file"}
             {parse_transform, lager_transform},
                 warnings_as_errors,
                 debug_info,
@@ -114,7 +114,7 @@
 {profiles, [
     {test, [
         {deps, [
-            {meck, 
+            {meck,
                 {git,"https://github.com/eproxus/meck", {ref,"e48641a20a605174e640ac91a528d443be11c9b9"}}},
             {automeck,
                 {git, "https://github.com/chef/automeck", {branch, "otp_24"}}},

src/oc_erchef/rebar.config.script

@@ -0,0 +1,12 @@
+%% -*- mode: erlang -*-
+%% ex: ts=4 sw=4 ft=erlang
+
+%% Include erl_opts {d, OC_LICENSE_PATH, X} where X is determined based on the OC_LICENSE_PATH environment variable for compile-time resolution of the path.
+%% Special value 'cli' means to use the automate CLI
+%% to obtain license information intead.  This is the default.
+LicensePath = os:getenv("OC_LICENSE_PATH", cli),
+ErlOpts = proplists:get_value(erl_opts, CONFIG, []),
+UpdatedErlOpts = lists:keystore(d, 99, ErlOpts,
+    {d, 'OC_LICENSE_PATH', LicensePath}),
+Config1 = lists:keydelete(erl_opts, 1, CONFIG),
+[{erl_opts, UpdatedErlOpts} | Config1].