XRootD
Loading...
Searching...
No Matches
XrdSecProtocolgsi.cc
Go to the documentation of this file.
1/******************************************************************************/
2/* */
3/* X r d S e c P r o t o c o l g s i . c c */
4/* */
5/* (c) 2005 G. Ganis / CERN */
6/* */
7/* This file is part of the XRootD software suite. */
8/* */
9/* XRootD is free software: you can redistribute it and/or modify it under */
10/* the terms of the GNU Lesser General Public License as published by the */
11/* Free Software Foundation, either version 3 of the License, or (at your */
12/* option) any later version. */
13/* */
14/* XRootD is distributed in the hope that it will be useful, but WITHOUT */
15/* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or */
16/* FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public */
17/* License for more details. */
18/* */
19/* You should have received a copy of the GNU Lesser General Public License */
20/* along with XRootD in a file called COPYING.LESSER (LGPL license) and file */
21/* COPYING (GPL license). If not, see <http://www.gnu.org/licenses/>. */
22/* */
23/* The copyright holder's institutional names and contributor's names may not */
24/* be used to endorse or promote products derived from this software without */
25/* specific prior written permission of the institution or contributor. */
26/* */
27/******************************************************************************/
28
29#include <unistd.h>
30#include <cctype>
31#include <cerrno>
32#include <cstdlib>
33#include <strings.h>
34#include <cstdio>
35#include <sys/param.h>
36#include <pwd.h>
37#include <sys/types.h>
38#include <sys/stat.h>
39#include <fcntl.h>
40#include <dirent.h>
41#include <iostream>
42
43#include "XrdVersion.hh"
44
45#include "XrdNet/XrdNetAddr.hh"
49#include "XrdSys/XrdSysError.hh"
52#include "XrdOuc/XrdOucEnv.hh"
53
54#include "XrdSut/XrdSutAux.hh"
55
59
62
63/******************************************************************************/
64/* T r a c i n g I n i t O p t i o n s */
65/******************************************************************************/
66#ifndef NODEBUG
67//#define POPTS(t,y) {if (t) {t->Beg(epname); std::cerr <<y; t->End();}}
68#define POPTS(t,y) {if (t) {std::cerr <<"Secgsi" <<y <<'\n' << std::flush;}}
69#else
70#define POPTS(t,y)
71#endif
72
73/******************************************************************************/
74/* S t a t i c D a t a */
75/******************************************************************************/
76
77static String Prefix = "xrd";
80
81static const char *gsiClientSteps[] = {
82 "kXGC_none",
83 "kXGC_certreq",
84 "kXGC_cert",
85 "kXGC_sigpxy",
86 "kXGC_reserved"
87};
88
89static const char *gsiServerSteps[] = {
90 "kXGS_none",
91 "kXGS_init",
92 "kXGS_cert",
93 "kXGS_pxyreq",
94 "kXGS_reserved"
95};
96
97static const char *gGSErrStr[] = {
98 "ErrParseBuffer", // 10000
99 "ErrDecodeBuffer", // 10001
100 "ErrLoadCrypto", // 10002
101 "ErrBadProtocol", // 10003
102 "ErrCreateBucket", // 10004
103 "ErrDuplicateBucket", // 10005
104 "ErrCreateBuffer", // 10006
105 "ErrSerialBuffer", // 10007
106 "ErrGenCipher", // 10008
107 "ErrExportPuK", // 10009
108 "ErrEncRndmTag", // 10010
109 "ErrBadRndmTag", // 10011
110 "ErrNoRndmTag", // 10012
111 "ErrNoCipher", // 10013
112 "ErrNoCreds", // 10014
113 "ErrBadOpt", // 10015
114 "ErrMarshal", // 10016
115 "ErrUnmarshal", // 10017
116 "ErrSaveCreds", // 10018
117 "ErrNoBuffer", // 10019
118 "ErrRefCipher", // 10020
119 "ErrNoPublic", // 10021
120 "ErrAddBucket", // 10022
121 "ErrFinCipher", // 10023
122 "ErrInit", // 10024
123 "ErrBadCreds", // 10025
124 "ErrError" // 10026
125};
126
127// One day in secs
128static const int kOneDay = 86400;
129// Default proxy location template
130static const char *gUsrPxyDef = "/tmp/x509up_u";
131// Tag for pad support
132static const char *gNoPadTag = "nopad";
133// static const char *gPadTag = "&pad";
134
135
136/******************************************************************************/
137/* S t a t i c C l a s s D a t a */
138/******************************************************************************/
139
140XrdSysMutex XrdSecProtocolgsi::gsiContext;
141String XrdSecProtocolgsi::CAdir = "/etc/grid-security/certificates/";
142String XrdSecProtocolgsi::CRLdir = "/etc/grid-security/certificates/";
143String XrdSecProtocolgsi::DefCRLext= ".r0";
144String XrdSecProtocolgsi::GMAPFile = "/etc/grid-security/grid-mapfile";
145String XrdSecProtocolgsi::SrvCert = "/etc/grid-security/xrd/xrdcert.pem";
146String XrdSecProtocolgsi::SrvKey = "/etc/grid-security/xrd/xrdkey.pem";
147String XrdSecProtocolgsi::UsrProxy;
148String XrdSecProtocolgsi::UsrCert = "/.globus/usercert.pem";
149String XrdSecProtocolgsi::UsrKey = "/.globus/userkey.pem";
150String XrdSecProtocolgsi::PxyValid = "12:00";
151int XrdSecProtocolgsi::DepLength= 0;
152int XrdSecProtocolgsi::DefBits = XrdCryptoDefRSABits;
153int XrdSecProtocolgsi::CACheck = caVerifyss;
154int XrdSecProtocolgsi::CRLCheck = crlTry; // 1
155int XrdSecProtocolgsi::CRLDownload = 0;
156int XrdSecProtocolgsi::CRLRefresh = 86400;
157int XrdSecProtocolgsi::GMAPOpt = 1;
158bool XrdSecProtocolgsi::GMAPuseDNname = 0;
159String XrdSecProtocolgsi::DefCrypto= "ssl";
160String XrdSecProtocolgsi::DefCipher= "aes-128-cbc:bf-cbc:des-ede3-cbc";
161String XrdSecProtocolgsi::DefMD = "sha256";
162String XrdSecProtocolgsi::DefError = "invalid credentials ";
163int XrdSecProtocolgsi::PxyReqOpts = 0;
164int XrdSecProtocolgsi::AuthzPxyWhat = -1;
165int XrdSecProtocolgsi::AuthzPxyWhere = -1;
166int XrdSecProtocolgsi::AuthzAlways = 1;
167XrdSecgsiGMAP_t XrdSecProtocolgsi::GMAPFun = 0;
168XrdSecgsiAuthz_t XrdSecProtocolgsi::AuthzFun = 0;
169XrdSecgsiAuthzKey_t XrdSecProtocolgsi::AuthzKey = 0;
170int XrdSecProtocolgsi::AuthzCertFmt = -1;
171int XrdSecProtocolgsi::GMAPCacheTimeOut = -1;
172int XrdSecProtocolgsi::AuthzCacheTimeOut = 43200; // 12h, default
173String XrdSecProtocolgsi::SrvAllowedNames;
174int XrdSecProtocolgsi::VOMSAttrOpt = vatIgnore; // Was '1' or extract
175XrdSecgsiAuthz_t XrdSecProtocolgsi::VOMSFun = 0;
176int XrdSecProtocolgsi::VOMSCertFmt = -1;
177int XrdSecProtocolgsi::MonInfoOpt = 0;
178bool XrdSecProtocolgsi::HashCompatibility = 1;
179bool XrdSecProtocolgsi::TrustDNS = false;
180bool XrdSecProtocolgsi::ShowDN = false;
181//
182// Crypto related info
183int XrdSecProtocolgsi::ncrypt = 0; // Number of factories
184XrdCryptoFactory *XrdSecProtocolgsi::cryptF[XrdCryptoMax] = {0}; // their hooks
185int XrdSecProtocolgsi::cryptID[XrdCryptoMax] = {0}; // their IDs
186String XrdSecProtocolgsi::cryptName[XrdCryptoMax] = {0}; // their names
187XrdCryptoCipher *XrdSecProtocolgsi::refcip[XrdCryptoMax] = {0}; // ref for session ciphers
188//
189// Caches
190XrdSutCache XrdSecProtocolgsi::cacheCA; // Server certificates info cache (default size 144)
191XrdSutCache XrdSecProtocolgsi::cacheCert(8,13); // Server certificates info cache (Fibonacci-based sizes)
192XrdSutCache XrdSecProtocolgsi::cachePxy(8,13); // Client proxies cache (Fibonacci-based sizes)
193XrdSutCache XrdSecProtocolgsi::cacheGMAPFun; // Entries mapped by GMAPFun (default size 144)
194XrdSutCache XrdSecProtocolgsi::cacheAuthzFun; // Entities filled by AuthzFun (default size 144)
195//
196// Services
197XrdOucGMap *XrdSecProtocolgsi::servGMap = 0; // Grid map service
198//
199// CA and CRL stacks
200GSIStack<XrdCryptoX509Chain> XrdSecProtocolgsi::stackCA; // Stack of CA in use
201std::unique_ptr<GSIStack<XrdCryptoX509Crl>> XrdSecProtocolgsi::stackCRL( new GSIStack<XrdCryptoX509Crl>() ); // Stack of CRL in use
202//
203// GMAP control vars
204time_t XrdSecProtocolgsi::lastGMAPCheck = -1; // Time of last check
205XrdSysMutex XrdSecProtocolgsi::mutexGMAP; // Mutex to control GMAP reloads
206//
207// Running options / settings
208int XrdSecProtocolgsi::Debug = 0; // [CS] Debug level
209bool XrdSecProtocolgsi::Server = 1; // [CS] If server mode
210int XrdSecProtocolgsi::TimeSkew = 300; // [CS] Allowed skew in secs for time stamps
211//
212// Debug an tracing
213XrdSysError XrdSecProtocolgsi::eDest(0, "secgsi_");
214XrdSysLogger XrdSecProtocolgsi::Logger;
215XrdOucTrace *XrdSecProtocolgsi::GSITrace = 0;
216
218
219/******************************************************************************/
220/* S t a t i c F u n c t i o n s */
221/******************************************************************************/
222//_____________________________________________________________________________
223static const char *ClientStepStr(int kclt)
224{
225 // Return string with client step
226 static const char *ukn = "Unknown";
227
228 kclt = (kclt < 0) ? 0 : kclt;
229 kclt = (kclt > kXGC_reserved) ? 0 : kclt;
230 kclt = (kclt >= kXGC_certreq) ? (kclt - kXGC_certreq + 1) : kclt;
231
232 if (kclt < 0 || kclt > (kXGC_reserved - kXGC_certreq + 1))
233 return ukn;
234 else
235 return gsiClientSteps[kclt];
236}
237
238//_____________________________________________________________________________
239static const char *ServerStepStr(int ksrv)
240{
241 // Return string with server step
242 static const char *ukn = "Unknown";
243
244 ksrv = (ksrv < 0) ? 0 : ksrv;
245 ksrv = (ksrv > kXGS_reserved) ? 0 : ksrv;
246 ksrv = (ksrv >= kXGS_init) ? (ksrv - kXGS_init + 1) : ksrv;
247
248 if (ksrv < 0 || ksrv > (kXGS_reserved - kXGS_init + 1))
249 return ukn;
250 else
251 return gsiServerSteps[ksrv];
252}
253
254
255/******************************************************************************/
256/* D u m p o f H a n d s h a k e v a r i a b l e s */
257/******************************************************************************/
258
259//_____________________________________________________________________________
261{
262 // Dump content
263 EPNAME("HSVars::Dump");
264
265 PRINT("----------------------------------------------------------------");
266 PRINT("protocol instance: "<<p);
267 PRINT("this: "<<this);
268 PRINT(" ");
269 PRINT("Time stamp: "<<TimeStamp);
270 PRINT("Crypto mod: "<<CryptoMod);
271 PRINT("Remote version: "<<RemVers);
272 PRINT("Ref cipher: "<<Rcip);
273 PRINT("Cipher padding: "<<HasPad);
274 PRINT("Bucket for exp cert: "<<Cbck);
275 PRINT("Handshake ID: "<<ID);
276 PRINT("Cache reference: "<<Cref);
277 PRINT("Relevant file entry: "<<Pent);
278 PRINT("Chain pointer: "<<Chain);
279 PRINT("CRL pointer: "<<Crl);
280 PRINT("Proxy chain: "<<PxyChain);
281 PRINT("Rndm tag checked: "<<RtagOK);
282 PRINT("Last step: "<<LastStep);
283 PRINT("Options: "<<Options);
284 PRINT("----------------------------------------------------------------");
285}
286
287/******************************************************************************/
288/* P r o t o c o l I n i t i a l i z a t i o n M e t h o d s */
289/******************************************************************************/
290
291
292//_____________________________________________________________________________
294 XrdNetAddrInfo &endPoint,
295 const char *parms) : XrdSecProtocol("gsi")
296{
297 // Default constructor
298 EPNAME("XrdSecProtocolgsi");
299
300 if (QTRACE(Authen)) { PRINT("constructing: "<<this); }
301
302 // Create instance of the handshake vars
303 if ((hs = new gsiHSVars())) {
304 // Update time stamp
305 hs->TimeStamp = time(0);
306 // Local handshake variables
307 hs->Tty = (isatty(0) == 0 || isatty(1) == 0) ? 0 : 1;
308 } else {
309 PRINT("could not create handshake vars object");
310 }
311
312 // Set host name and address
313 // The hostname is critical for the GSI protocol; it must match the potential
314 // names on the remote EEC. We default to the hostname requested by the user to
315 // the client (or proxy). However, as we may have been redirected to an IP
316 // address instead of an actual hostname, we must fallback to a reverse DNS lookup.
317 // As of time of testing (June 2018), EOS will redirect to an IP address to handle
318 // metadata commands and rely on the reverse DNS lookup for GSI security to function.
319 // Hence, this fallback likely needs to be kept for some time.
320 //
321 // We provide servers a switch and clients an environment variable to override all
322 // usage of DNS (processed on XrdSecProtocolgsiInit).
323 // Default is to fallback to DNS lookups in limited
324 // cases for backward compatibility.
325 expectedHost = NULL;
326 if (TrustDNS) {
327 if (!hname || !XrdNetAddrInfo::isHostName(hname)) {
328 Entity.host = strdup(endPoint.Name(""));
329 } else {
330 // At this point, hname still may possibly be a non-qualified domain name.
331 // If there is a '.' character, then we assume it is a qualified domain name --
332 // otherwise, we use DNS.
333 //
334 // NOTE: We can definitively test whether this is a qualified domain name by
335 // simply appending a '.' to `hname` and performing a lookup. However, this
336 // causes DNS to be used by every lookup - meaning we rely on the security
337 // of DNS for all cases; we want to avoid this.
338 if (strchr(hname, '.')) {
339 // We have a valid hostname; proceed.
340 Entity.host = strdup(hname);
341 } else {
342 XrdNetAddr xrd_addr;
343 char canonname[256];
344 if (!xrd_addr.Set(hname) || (xrd_addr.Format(canonname, 256, XrdNetAddrInfo::fmtName, XrdNetAddrInfo::noPort) <= 0)) {
345 Entity.host = strdup(hname);
346 } else {
347 Entity.host = strdup(canonname);
348 }
349 }
350 }
351 } else {
352 // We have been told via environment variable to not trust DNS; use the exact
353 // hostname provided by the user.
354// char dnBuff[256];
355// getdomainname(dnBuff, sizeof(dnBuff));
356 Entity.host = strdup(hname);
357 expectedHost = strdup(hname);
358 }
359 epAddr = endPoint;
360 Entity.addrInfo = &epAddr;
361
362 // Init session variables
363 sessionCF = 0;
364 sessionKey = 0;
365 bucketKey = 0;
366 sessionMD = 0;
367 sessionKsig = 0;
368 sessionKver = 0;
369 sessionKver = 0;
370 proxyChain = 0;
371 useIV = false;
372
373 //
374 // Notify, if required
375 DEBUG("constructing: host: "<< Entity.host);
376 DEBUG("p: "<<XrdSecPROTOIDENT<<", plen: "<<XrdSecPROTOIDLEN);
377 //
378 // basic settings
379 options = opts;
380 srvMode = 0;
381
382 //
383 // Mode specific initializations
384 if (Server) {
385 srvMode = 1;
386 DEBUG("mode: server");
387 } else {
388 DEBUG("mode: client");
389 //
390 // Decode received buffer
391 if (parms) {
392 XrdOucString p("&P=gsi,");
393 p += parms;
394 hs->Parms = new XrdSutBuffer(p.c_str(), p.length());
395 }
396 }
397
398 // We are done
399 String vers = Version;
400 vers.insert('.',vers.length()-2);
401 vers.insert('.',vers.length()-5);
402 DEBUG("object created: v"<<vers.c_str());
403}
404
405//_____________________________________________________________________________
407{
408 // Static method to the configure the static part of the protocol
409 // Called once by XrdSecProtocolgsiInit
410 EPNAME("Init");
411 char *Failure = 0, *Parms = 0;
412
413 //
414 // Debug an tracing
415 Debug = (opt.debug > -1) ? opt.debug : Debug;
416
417 // We must have the tracing object at this point
418 // (initialized in XrdSecProtocolgsiInit)
419 if (!gsiTrace) {
420 ErrF(erp,kGSErrInit,"tracing object (gsiTrace) not initialized! cannot continue");
421 return Failure;
422 }
423 // Set debug mask ... also for auxilliary libs
424 int trace = 0, traceSut = 0, traceCrypto = 0;
425 if (Debug >= 3) {
426 trace = cryptoTRACE_Dump;
427 traceSut = sutTRACE_Dump;
428 traceCrypto = cryptoTRACE_Dump;
429 GSITrace->What = TRACE_ALL;
430 } else if (Debug >= 2) {
431 trace = cryptoTRACE_Debug;
432 traceSut = sutTRACE_Debug;
433 traceCrypto = cryptoTRACE_Debug;
434 GSITrace->What = TRACE_Debug;
435 GSITrace->What |= TRACE_Authen;
436 } else if (Debug >= 1) {
437 trace = cryptoTRACE_Debug;
438 traceSut = sutTRACE_Notify;
439 traceCrypto = cryptoTRACE_Notify;
440 GSITrace->What = TRACE_Debug;
441 }
442
443 // ... also for auxilliary libs
444 XrdSutSetTrace(traceSut);
445 XrdCryptoSetTrace(traceCrypto);
446
447 // Name hashing algorithm compatibility
448 if (opt.hashcomp == 0) HashCompatibility = 0;
449
450 //
451 // Operation mode
452 Server = (opt.mode == 's');
453
454 //
455 // CA verification level
456 //
457 // 0 do not verify
458 // 1 verify if self-signed; warn if not
459 // 2 verify in all cases; fail if not possible
460 //
461 if (opt.ca >= caNoVerify && opt.ca <= caVerify)
462 CACheck = opt.ca;
463 DEBUG("option CACheck: "<<getOptName(caVerOpts,CACheck));
464
465 //
466 // Check existence of CA directory
467 struct stat st;
468 if (opt.certdir) {
469 DEBUG("testing CA dir(s): "<<opt.certdir);
470 String CAtmp;
471 String tmp = opt.certdir;
472 String dp;
473 int from = 0;
474 while ((from = tmp.tokenize(dp, from, ',')) != -1) {
475 if (dp.length() > 0) {
476 if (XrdSutExpand(dp) == 0) {
477 if (stat(dp.c_str(),&st) == -1) {
478 if (errno == ENOENT) {
479 ErrF(erp,kGSErrError,"CA directory non existing",dp.c_str());
480 PRINT(erp->getErrText());
481 } else {
482 ErrF(erp,kGSErrError,"cannot stat CA directory",dp.c_str());
483 PRINT(erp->getErrText());
484 }
485 } else {
486 if (!(dp.endswith('/'))) dp += '/';
487 if (!(CAtmp.endswith(','))) CAtmp += ',';
488 CAtmp += dp;
489 }
490 } else {
491 PRINT("Warning: could not expand: "<<dp);
492 }
493 }
494 }
495 if (CAtmp.length() > 0)
496 CAdir = CAtmp;
497 }
498 DEBUG("using CA dir(s): "<<CAdir);
499
500 //
501 // CRL check level
502 //
503 // 0 do not care
504 // 1 use if available
505 // 2 require
506 // 3 require not expired
507 // 12 require; try download if missing
508 // 13 require not expired; try download if missing
509 //
510 const char *cocrl[] = { "do-not-care", "use-if-available", "require", "require-not-expired" };
511 const char *codwld[] = { "no", "yes"};
512 if (opt.crl >= crlUpdate) {
513 CRLDownload = 1;
514 opt.crl %= 10;
515 }
516 if (opt.crl >= crlIgnore && opt.crl <= crlRequire)
517 CRLCheck = opt.crl;
518 DEBUG("option CRLCheck: "<<CRLCheck<<" ('"<<cocrl[CRLCheck]<<"'; download? "<<
519 codwld[CRLDownload]<<")");
520
521 //
522 // Check existence of CRL directory
523 if (opt.crldir) {
524
525 DEBUG("testing CRL dir(s): "<<opt.crldir);
526 String CRLtmp;
527 String tmp = opt.crldir;
528 String dp;
529 int from = 0;
530 while ((from = tmp.tokenize(dp, from, ',')) != -1) {
531 if (dp.length() > 0) {
532 if (XrdSutExpand(dp) == 0) {
533 if (stat(dp.c_str(),&st) == -1) {
534 if (errno == ENOENT) {
535 ErrF(erp,kGSErrError,"CRL directory non existing:",dp.c_str());
536 PRINT(erp->getErrText());
537 } else {
538 ErrF(erp,kGSErrError,"cannot stat CRL directory:",dp.c_str());
539 PRINT(erp->getErrText());
540 }
541 } else {
542 if (!(dp.endswith('/'))) dp += '/';
543 if (!(CRLtmp.endswith(','))) CRLtmp += ',';
544 CRLtmp += dp;
545 }
546 } else {
547 PRINT("Warning: could not expand: "<<dp);
548 }
549 }
550 }
551 if (CRLtmp.length() > 0)
552 CRLdir = CRLtmp;
553
554 } else {
555 // Use CAdir
556 CRLdir = CAdir;
557 }
558 if (CRLCheck > 0)
559 DEBUG("using CRL dir(s): "<<CRLdir);
560
561 //
562 // Default extension for CRL files
563 if (opt.crlext)
564 DefCRLext = opt.crlext;
565
566 //
567 // Refresh or expiration time for CRLs
568 if (opt.crlrefresh)
569 CRLRefresh = opt.crlrefresh;
570 DEBUG("CRL information refreshed every "<<CRLRefresh<<" secs");
571
572 //
573 // Honour trust / unstrust DNS settings (switch or env)
574 TrustDNS = opt.trustdns;
575 DEBUG("trust DNS option: "<<TrustDNS);
576
577 //
578 // Enable/disable displaying the DN
579 ShowDN = opt.showDN;
580 DEBUG("show DN option: "<<ShowDN);
581
582 //
583 // Server specific options
584 if (Server) {
585 //
586 // List of supported / wanted crypto modules
587 if (opt.clist)
588 DefCrypto = opt.clist;
589 //
590 // List of crypto modules
591 String cryptlist;
592 String crypts(DefCrypto,0,-1,64);
593 //
594 // Load crypto modules
595 XrdSutPFEntry ent;
596 XrdCryptoFactory *cf = 0;
597 if (crypts.length()) {
598 String ncpt = "";
599 int from = 0;
600 while ((from = crypts.tokenize(ncpt, from, '|')) != -1) {
601 if (ncpt.length() > 0 && ncpt[0] != '-') {
602 // Try loading
603 if ((cf = XrdCryptoFactory::GetCryptoFactory(ncpt.c_str()))) {
604 // Add it to the list
605 cryptF[ncrypt] = cf;
606 cryptID[ncrypt] = cf->ID();
607 cryptName[ncrypt].insert(cf->Name(),0,strlen(cf->Name())+1);
608 cf->SetTrace(trace);
609 cf->Notify();
610 // Ref cipher
611 if (!(refcip[ncrypt] = cf->Cipher(0,0,0))) {
612 PRINT("ref cipher for module "<<ncpt<<
613 " cannot be instantiated : disable");
614 from -= ncpt.length();
615 } else {
616 ncrypt++;
617 if (ncrypt >= XrdCryptoMax) {
618 PRINT("max number of crypto modules ("
619 << XrdCryptoMax <<") reached ");
620 break;
621 }
622 if (cryptlist.length()) cryptlist += ":";
623 cryptlist += ncpt;
624 if (!cf->HasPaddingSupport()) cryptlist += gNoPadTag;
625 }
626 } else {
627 PRINT("cannot instantiate crypto factory "<<ncpt<<
628 ": disable");
629 from -= ncpt.length();
630 }
631 }
632 }
633 }
634 //
635 // We need at least one valid crypto module
636 if (ncrypt <= 0) {
637 ErrF(erp,kGSErrInit,"could not find any valid crypto module");
638 PRINT(erp->getErrText());
639 return Failure;
640 }
641 //
642 // List of supported / wanted ciphers
643 if (opt.cipher)
644 DefCipher = opt.cipher;
645 // make sure we support all of them
646 String cip = "";
647 int from = 0;
648 while ((from = DefCipher.tokenize(cip, from, ':')) != -1) {
649 if (cip.length() > 0) {
650 int i = 0;
651 for (; i < ncrypt; i++) {
652 if (!(cryptF[i]->SupportedCipher(cip.c_str()))) {
653 // Not supported: drop from the list
654 DEBUG("cipher type not supported ("<<cip<<") - disabling");
655 from -= cip.length();
656 DefCipher.erase(cip);
657 }
658 }
659 }
660 }
661
662 //
663 // List of supported / wanted Message Digest
664 if (opt.md)
665 DefMD = opt.md;
666 // make sure we support all of them
667 String md = "";
668 from = 0;
669 while ((from = DefMD.tokenize(md, from, ':')) != -1) {
670 if (md.length() > 0) {
671 int i = 0;
672 for (; i < ncrypt; i++) {
673 if (!(cryptF[i]->SupportedMsgDigest(md.c_str()))) {
674 // Not supported: drop from the list
675 PRINT("MD type not supported ("<<md<<") - disabling");
676 from -= md.length();
677 DefMD.erase(md);
678 }
679 }
680 }
681 }
682
683 //
684 // Load server certificate and key
685 if (opt.cert) {
686 String TmpCert = opt.cert;
687 if (XrdSutExpand(TmpCert) == 0) {
688 SrvCert = TmpCert;
689 } else {
690 PRINT("Could not expand: "<<opt.cert<<": use default");
691 }
692 }
693 if (opt.key) {
694 String TmpKey = opt.key;
695 if (XrdSutExpand(TmpKey) == 0) {
696 SrvKey = TmpKey;
697 } else {
698 PRINT("Could not expand: "<<opt.key<<": use default");
699 }
700 }
701 //
702 // Check if we can read the certificate key
703 if (access(SrvKey.c_str(), R_OK)) {
704 PRINT("WARNING: process has no permission to read the certificate key file: "<<SrvKey);
705 }
706 int i = 0;
707 String certcalist = ""; // list of CA for server certificates
708 XrdSutCERef ceref;
709 for (; i<ncrypt; i++) {
710 if (!GetSrvCertEnt(ceref, cryptF[i], time(0), certcalist)) {
711 PRINT("problems loading srv cert");
712 ceref.UnLock();
713 continue;
714 }
715 }
716 // Rehash cache
717 ceref.UnLock();
718 //
719 // We must have got at least one valid certificate
720 if (cacheCert.Num() <= 0) {
721 ErrF(erp,kGSErrError,"no valid server certificate found");
722 PRINT(erp->getErrText());
723 return Failure;
724 }
725
726 DEBUG("CA list: "<<certcalist);
727
728 //
729 // GRID map check option
730 //
731 // 0 do not use (DN hash will be used as identifier)
732 // 1 use if available; otherwise as 0
733 // 2 require
734 // 10 do not use (DN name will be used as identifier)
735 // 11 use if available; otherwise as 10
736 const char *cogmap[] = { "do-not-use", "use-if-available", "require" };
737 const char *codnnm[] = { "DN hash", "DN name"};
738 if (opt.ogmap >= 10) {
739 GMAPuseDNname = 1;
740 opt.ogmap %= 10;
741 }
742 if (opt.ogmap >= 0 && opt.ogmap <= 2)
743 GMAPOpt = opt.ogmap;
744 DEBUG("user mapping file option: "<<cogmap[GMAPOpt]);
745 if (GMAPOpt < 2)
746 DEBUG("default option for entity name if no mapping available: "<<codnnm[(int)GMAPuseDNname]);
747
748 //
749 // Check existence of GRID map file
750 if (opt.gridmap) {
751 String GMAPTmp = opt.gridmap;
752 if (XrdSutExpand(GMAPTmp) == 0) {
753 GMAPFile = GMAPTmp;
754 } else {
755 PRINT("Could not expand: "<<opt.gridmap<<": use default");
756 }
757 }
758 bool hasgmap = 0;
759 if (GMAPOpt > 0) {
760 // Initialize the GMap service
761 //
762 String pars;
763 if (Debug) pars += "dbg|";
764 if (opt.gmapto > 0) { pars += "to="; pars += (int)opt.gmapto; }
765 if (!(servGMap = XrdOucgetGMap(&eDest, GMAPFile.c_str(), pars.c_str()))) {
766 if (GMAPOpt > 1) {
767 ErrF(erp,kGSErrError,"error loading grid map file",GMAPFile.c_str());
768 PRINT(erp->getErrText());
769 return Failure;
770 } else {
771 NOTIFY("Grid map file: "<<GMAPFile<<" cannot be 'access'ed: do not use");
772 }
773 } else {
774 DEBUG("using grid map file: "<<GMAPFile);
775 hasgmap = 1;
776 }
777 }
778 //
779 // Load function be used to map DN to usernames, if specified
780 bool hasgmapfun = 0;
781 if (opt.gmapfun && GMAPOpt > 0) {
782 if (!(GMAPFun = LoadGMAPFun((const char *) opt.gmapfun,
783 (const char *) opt.gmapfunparms))) {
784 ErrF(erp, kGSErrError, "GMAP plug-in could not be loaded", opt.gmapfun);
785 PRINT(erp->getErrText());
786 return Failure;
787 } else {
788 hasgmapfun = 1;
789 }
790 }
791 //
792 // Disable GMAP if neither a grid mapfile nor a GMAP function are available
793 if (!hasgmap && !hasgmapfun) {
794 if (GMAPOpt > 1) {
795 ErrF(erp,kGSErrError,"User mapping required, but neither a grid mapfile"
796 " nor a mapping function are available");
797 PRINT(erp->getErrText());
798 return Failure;
799 }
800 GMAPOpt = 0;
801 }
802 //
803 // Authentication function
804 bool hasauthzfun = 0;
805 AuthzAlways = opt.authzcall;
806 if (opt.authzfun) {
807 if (!(AuthzFun = LoadAuthzFun((const char *) opt.authzfun,
808 (const char *) opt.authzfunparms, AuthzCertFmt))) {
809 ErrF(erp, kGSErrError, "Authz plug-in could not be loaded", opt.authzfun);
810 PRINT(erp->getErrText());
811 return Failure;
812 } else {
813 hasauthzfun = 1;
814 // Notify certificate format
815 if (AuthzCertFmt >= 0 && AuthzCertFmt <= 1) {
816 const char *ccfmt[] = { "raw", "PEM base64" };
817 DEBUG("authzfun: proxy certificate format: "<<ccfmt[AuthzCertFmt]);
818 } else {
819 NOTIFY("authzfun: proxy certificate format: unknown (code: "<<AuthzCertFmt<<")");
820 }
821 // Expiration of Authz related cache entries
822 if (opt.authzto > 0) {
823 AuthzCacheTimeOut = opt.authzto;
824 DEBUG("grid-map cache entries expire after "<<AuthzCacheTimeOut<<" secs");
825 }
826 }
827 }
828 //
829 // Expiration of GRIDMAP related cache entries
830 if (GMAPOpt > 0 && !hasauthzfun && opt.gmapto > 0) {
831 GMAPCacheTimeOut = opt.gmapto;
832 DEBUG("grid-map cache entries expire after "<<GMAPCacheTimeOut<<" secs");
833 }
834
835 //
836 // Request for proxy export for authorization
837 // authzpxy = opt_what*10 + opt_where
838 // opt_what = 0 full chain
839 // 1 last proxy only
840 // opt_where = 1 Entity.creds
841 // 2 Entity.endorsements
842 if (opt.authzpxy) {
843 AuthzPxyWhat = opt.authzpxy / 10;
844 AuthzPxyWhere = opt.authzpxy % 10;
845 // Some notification
846 const char *capxy_what = (AuthzPxyWhat == 1) ? "'last proxy only'"
847 : "'full proxy chain'";
848 const char *capxy_where = (AuthzPxyWhere == 1) ? "XrdSecEntity.creds"
849 : "XrdSecEntity.endorsements";
850 DEBUG("Export proxy for authorization in '"<<capxy_where<<"': "<<capxy_what);
851 if (hasauthzfun) {
852 // Warn user about possible overwriting of Entity.creds or Entity.endorsements
853 PRINT("WARNING: proxy export for authz enabled: be aware that any setting of '"<<capxy_what<<
854 "' done by '"<<opt.authzfun<<"' will get overwritten with "<<capxy_what);
855 }
856 }
857
858 //
859 // Handle delegated proxies options
860 if (opt.dlgpxy == -1) {
861 // Will not accept any delegated proxies
862 DEBUG("Will not accept delegated proxies");
863 } else {
864 // Ask the client to sign a delegated proxy; client may decide to forward its proxy
865 if (opt.dlgpxy == dlgReqSign)
866 PxyReqOpts |= kOptsSrvReq;
867
868 // Exporting options (default none: delegated proxy kept in memory, in proxyChain)
869 if (opt.exppxy) {
870 if (!strcmp(opt.exppxy, "=creds")) {
871 // register the delegated proxy in Entity.creds (in HEX format)
872 PxyReqOpts |= kOptsPxCred;
873 DEBUG("Delegated proxy saved in Entity.creds ");
874 } else {
875 String TmpProxy = gUsrPxyDef;
876 if (strcmp(opt.exppxy, "=default"))
877 TmpProxy = opt.exppxy;
878 if (XrdSutExpand(TmpProxy) == 0) {
879 UsrProxy = TmpProxy;
880 } else {
881 UsrProxy = gUsrPxyDef;
882 UsrProxy += "u<uid>";
883 }
884 PxyReqOpts |= kOptsPxFile;
885 DEBUG("File template for delegated proxy: "<<UsrProxy);
886 }
887 }
888 DEBUG("Delegated proxies options: "<<PxyReqOpts);
889 }
890
891 //
892 // VOMS attributes switch
893 // vomsat = 0 do not look for
894 // 1 extract if any (fill 'vorg', 'role'; the full string in 'endorsements');
895 // 2 require (fill 'vorg', 'role'; the full string in 'endorsements');
896 VOMSAttrOpt = (opt.vomsat <= vatRequire && opt.vomsat >= vatIgnore)
897 ? opt.vomsat : VOMSAttrOpt;
898
899 //
900 // Alternative VOMS extraction function
901 if (opt.vomsfun) {
902 if (!(VOMSFun = LoadVOMSFun((const char *) opt.vomsfun,
903 (const char *) opt.vomsfunparms, VOMSCertFmt))) {
904 ErrF(erp, kGSErrError, "VOMS plug-in loading failed", opt.vomsfun);
905 PRINT(erp->getErrText());
906 return Failure;
907 } else {
908 // Notify certificate format
909 if (VOMSCertFmt >= 0 && VOMSCertFmt <= 1) {
910 const char *ccfmt[] = { "raw", "PEM base64" };
911 DEBUG("vomsfun: proxy certificate format: "<<ccfmt[VOMSCertFmt]);
912 } else {
913 char fbuff[64];
914 snprintf(fbuff, sizeof(fbuff), "%d", VOMSCertFmt);
915 ErrF(erp, kGSErrError, "VOMS plug-in returned invalid cert "
916 "format", fbuff);
917 PRINT(erp->getErrText());
918 return Failure;
919 }
920 }
921 } else opt.authzcall = AuthzAlways = 1;
922 DEBUG("VOMS attributes options: "<<getOptName(vomsatOpts, VOMSAttrOpt));
923
924 //
925 // Default moninfo option
926 // 0 nothing
927 // 1 DN
928 MonInfoOpt = opt.moninfo;
929 const char *cmoninfo = (MonInfoOpt == 1) ? "DN" : "none";
930 DEBUG("Monitor information options: "<<cmoninfo);
931
932 // Make sure we have a calist as the client can't do anything without it.
933 // If the cryptlist is empty the client will use the default one.
934 //
935 if (certcalist.length() == 0)
936 {ErrF(erp,kGSErrInit,"unable to generate ca cert hash list!");
937 PRINT(erp->getErrText());
938 return Failure;
939 }
940
941 //
942 // Parms in the form:
943 // &P=gsi,v:<version>,c:<cryptomod>,ca:<list_of_srv_cert_ca>
944 Parms = new char[cryptlist.length()+3+12+certcalist.length()+5];
945 if (Parms) {
946 sprintf(Parms,"v:%d,c:%s,ca:%s",
947 Version,cryptlist.c_str(),certcalist.c_str());
948 } else {
949 ErrF(erp,kGSErrInit,"no system resources for 'Parms'");
950 PRINT(erp->getErrText());
951 return Failure;
952 }
953
954 // Some notification
955 DEBUG("available crypto modules: "<<cryptlist);
956 DEBUG("issuer CAs of server certs (hashes): "<<certcalist);
957 }
958
959 //
960 // Client specific options
961 if (!Server) {
962 // use default dir $(HOME)/.<prefix>
963 struct passwd *pw = getpwuid(getuid());
964 if (!pw) {
965 NOTIFY("WARNING: cannot get user information (uid:"<<getuid()<<")");
966 }
967 //
968 // Define user proxy file
969 UsrProxy = gUsrPxyDef;
970 if (opt.proxy) {
971 String TmpProxy = opt.proxy;
972 if (XrdSutExpand(TmpProxy) == 0) {
973 UsrProxy = TmpProxy;
974 } else {
975 PRINT("Could not expand: "<<opt.proxy<<": use default");
976 }
977 } else {
978 if (pw)
979 UsrProxy += (int)(pw->pw_uid);
980 }
981 // Define user certificate file
982 if (opt.cert) {
983 String TmpCert = opt.cert;
984 if (XrdSutExpand(TmpCert) == 0) {
985 UsrCert = TmpCert;
986 } else {
987 PRINT("Could not expand: "<<opt.cert<<": use default");
988 }
989 } else {
990 if (pw)
991 UsrCert.insert(XrdSutHome(),0);
992 }
993 // Define user private key file
994 if (opt.key) {
995 String TmpKey = opt.key;
996 if (XrdSutExpand(TmpKey) == 0) {
997 UsrKey = TmpKey;
998 } else {
999 PRINT("Could not expand: "<<opt.key<<": use default");
1000 }
1001 } else {
1002 if (pw)
1003 UsrKey.insert(XrdSutHome(),0);
1004 }
1005 // Define proxy validity at renewal
1006 if (opt.valid)
1007 PxyValid = opt.valid;
1008 // Set depth of signature path
1009 if (opt.deplen != DepLength)
1010 DepLength = opt.deplen;
1011 // Set number of bits for proxy key
1012 if (opt.bits > DefBits)
1013 DefBits = opt.bits;
1014 //
1015 // Delegate proxy options
1016 if (opt.dlgpxy > dlgIgnore) {
1017 PxyReqOpts |= kOptsSigReq;
1018 if (opt.dlgpxy == dlgSendpxy) {
1019 PxyReqOpts |= kOptsFwdPxy;
1020 } else {
1021 PxyReqOpts |= kOptsDlgPxy;
1022 }
1023 }
1024 //
1025 // No proxy options
1026 if (opt.createpxy) {
1027 PxyReqOpts |= kOptsCreatePxy;
1028 }
1029 //
1030 // Define valid CNs for the server certificates; default is null, which means that
1031 // the server CN must be in the form "*/<hostname>"
1032 if (opt.srvnames)
1033 SrvAllowedNames = opt.srvnames;
1034 //
1035 // Notify
1036 TRACE(Authen, "using certificate file: "<<UsrCert);
1037 TRACE(Authen, "using private key file: "<<UsrKey);
1038 TRACE(Authen, "proxy: file: "<<UsrProxy);
1039 TRACE(Authen, "proxy: validity: "<<PxyValid);
1040 TRACE(Authen, "proxy: depth of signature path: "<<DepLength);
1041 TRACE(Authen, "proxy: bits in key: "<<DefBits);
1042 TRACE(Authen, "server cert: allowed names: "<<SrvAllowedNames);
1043 if (!(PxyReqOpts & kOptsCreatePxy)) {
1044 TRACE(Authen, "allowing for pure cert/key authentication (no proxy) ");
1045 }
1046
1047 // We are done
1048 Parms = (char *)"";
1049 }
1050
1051 // We are done
1052 return Parms;
1053}
1054
1055/******************************************************************************/
1056/* D e l e t e */
1057/******************************************************************************/
1059{
1060 // Deletes the protocol
1068 if (Entity.creds && Entity.credslen > 0) {
1070 } else {
1071 Entity.creds = 0;
1072 }
1073 Entity.credslen = 0;
1075 // Cleanup the handshake variables, if still there
1076 SafeDelete(hs);
1077 // Cleanup any other instance specific to this protocol
1078 SafeDelete(sessionKey); // Session Key (result of the handshake)
1079 SafeDelete(bucketKey); // Bucket with the key in export form
1080 SafeDelete(sessionMD); // Message Digest instance
1081 SafeDelete(sessionKsig); // RSA key to sign
1082 SafeDelete(sessionKver); // RSA key to verify
1083 if (proxyChain) proxyChain->Cleanup();
1084 SafeDelete(proxyChain); // Chain with delegated proxies
1085 SafeFree(expectedHost);
1086
1087 delete this;
1088}
1089
1090
1091/******************************************************************************/
1092/* E n c r y p t i o n R e l a t e d M e t h o d s */
1093/******************************************************************************/
1094
1095//_____________________________________________________________________________
1096int XrdSecProtocolgsi::Encrypt(const char *inbuf, // Data to be encrypted
1097 int inlen, // Length of data in inbuff
1098 XrdSecBuffer **outbuf) // Returns encrypted data
1099{
1100 // Encrypt data in inbuff and place it in outbuff.
1101 //
1102 // Returns: < 0 Failed, the return value is -errno of the reason. Typically,
1103 // -EINVAL - one or more arguments are invalid.
1104 // -ENOTSUP - encryption not supported by the protocol
1105 // -EOVERFLOW - outbuff is too small to hold result
1106 // -ENOENT - Context not initialized
1107 // = 0 Success, outbuff contains a pointer to the encrypted data.
1108 //
1109 EPNAME("Encrypt");
1110
1111 // We must have a key
1112 if (!sessionKey)
1113 return -ENOENT;
1114
1115 // And something to encrypt
1116 if (!inbuf || inlen <= 0 || !outbuf)
1117 return -EINVAL;
1118
1119 // Regenerate IV
1120 int liv = 0;
1121 char *iv = 0;
1122 if (useIV) {
1123 iv = sessionKey->RefreshIV(liv); // no need to call sessionKeySetIV as
1124 // RefreshIV will set the internal value
1125 }
1126
1127 // Get output buffer
1128 char *buf = (char *)malloc(sessionKey->EncOutLength(inlen) + liv);
1129 if (!buf)
1130 return -ENOMEM;
1131 // IV at beginning
1132 memcpy(buf, iv, liv);
1133
1134 // Encrypt
1135 int len = sessionKey->Encrypt(inbuf, inlen, buf + liv) + liv; // the size of initialization vector which is being appended at
1136 // the beginning of the output buffer has to be taken into account
1137 if (len <= 0) {
1138 SafeFree(buf);
1139 return -EINVAL;
1140 }
1141
1142 // Create and fill output buffer
1143 *outbuf = new XrdSecBuffer(buf, len);
1144
1145 // We are done
1146 DEBUG("encrypted buffer has "<<len<<" bytes");
1147 return 0;
1148}
1149
1150//_____________________________________________________________________________
1151int XrdSecProtocolgsi::Decrypt(const char *inbuf, // Data to be decrypted
1152 int inlen, // Length of data in inbuff
1153 XrdSecBuffer **outbuf) // Returns decrypted data
1154{
1155 // Decrypt data in inbuff and place it in outbuff.
1156 //
1157 // Returns: < 0 Failed,the return value is -errno (see Encrypt).
1158 // = 0 Success, outbuff contains a pointer to the encrypted data.
1159 EPNAME("Decrypt");
1160
1161 // We must have a key
1162 if (!sessionKey)
1163 return -ENOENT;
1164
1165 // And something to decrypt
1166 if (!inbuf || inlen <= 0 || !outbuf)
1167 return -EINVAL;
1168
1169 // Size
1170 int liv = (useIV) ? sessionKey->MaxIVLength() : 0;
1171 int sz = inlen - liv;
1172 // Get output buffer
1173 char *buf = (char *)malloc(sessionKey->DecOutLength(sz) + liv);
1174 if (!buf)
1175 return -ENOMEM;
1176
1177 // Get and set IV
1178 if (useIV) {
1179 char *iv = new char[liv];
1180 memcpy(iv, inbuf, liv);
1181 sessionKey->SetIV(liv, iv);
1182 delete[] iv;
1183 }
1184
1185 // Decrypt
1186 int len = sessionKey->Decrypt(inbuf + liv, sz, buf);
1187 if (len <= 0) {
1188 SafeFree(buf);
1189 return -EINVAL;
1190 }
1191
1192 // Create and fill output buffer
1193 *outbuf = new XrdSecBuffer(buf, len);
1194
1195 // We are done
1196 DEBUG("decrypted buffer has "<<len<<" bytes");
1197 return 0;
1198}
1199
1200//_____________________________________________________________________________
1201int XrdSecProtocolgsi::Sign(const char *inbuf, // Data to be signed
1202 int inlen, // Length of data to be signed
1203 XrdSecBuffer **outbuf) // Buffer for the signature
1204{
1205 // Sign data in inbuff and place the signature in outbuf.
1206 //
1207 // Returns: < 0 Failed, returned value is -errno (see Encrypt).
1208 // = 0 Success, the return value is the length of the signature
1209 // placed in outbuf.
1210 //
1211 EPNAME("Sign");
1212
1213 // We must have a PKI and a digest
1214 if (!sessionKsig || !sessionMD)
1215 return -ENOENT;
1216
1217 // And something to sign
1218 if (!inbuf || inlen <= 0 || !outbuf)
1219 return -EINVAL;
1220
1221 // Reset digest
1222 sessionMD->Reset(0);
1223
1224 // Calculate digest
1225 sessionMD->Update(inbuf, inlen);
1226 sessionMD->Final();
1227
1228 // Output length
1229 int lmax = sessionKsig->GetOutlen(sessionMD->Length());
1230 char *buf = (char *)malloc(lmax);
1231 if (!buf)
1232 return -ENOMEM;
1233
1234 // Sign
1235 int len = sessionKsig->EncryptPrivate(sessionMD->Buffer(),
1236 sessionMD->Length(),
1237 buf, lmax);
1238 if (len <= 0) {
1239 SafeFree(buf);
1240 return -EINVAL;
1241 }
1242
1243 // Create and fill output buffer
1244 *outbuf = new XrdSecBuffer(buf, len);
1245
1246 // We are done
1247 DEBUG("signature has "<<len<<" bytes");
1248 return 0;
1249}
1250
1251//_____________________________________________________________________________
1252int XrdSecProtocolgsi::Verify(const char *inbuf, // Data to be verified
1253 int inlen, // Length of data in inbuf
1254 const char *sigbuf, // Buffer with signature
1255 int siglen) // Length of signature
1256{
1257 // Verify a signature
1258 //
1259 // Returns: < 0 Failed, returned value is -errno (see Encrypt).
1260 // = 0 Signature matches the value in inbuff.
1261 // > 0 Failed to verify, signature does not match inbuff data.
1262 //
1263 EPNAME("Verify");
1264
1265 // We must have a PKI and a digest
1266 if (!sessionKver || !sessionMD)
1267 return -ENOENT;
1268
1269 // And something to verify
1270 if (!inbuf || inlen <= 0 || !sigbuf || siglen <= 0)
1271 return -EINVAL;
1272
1273 // Reset digest
1274 sessionMD->Reset(0);
1275
1276 // Calculate digest
1277 sessionMD->Update(inbuf, inlen);
1278 sessionMD->Final();
1279
1280 // Output length
1281 int lmax = sessionKver->GetOutlen(siglen);
1282 char *buf = new char[lmax];
1283 if (!buf)
1284 return -ENOMEM;
1285
1286 // Decrypt signature
1287 int len = sessionKver->DecryptPublic(sigbuf, siglen, buf, lmax);
1288 if (len <= 0) {
1289 delete[] buf;
1290 return -EINVAL;
1291 }
1292
1293 // Verify signature
1294 bool bad = 1;
1295 if (len == sessionMD->Length()) {
1296 if (!strncmp(buf, sessionMD->Buffer(), len)) {
1297 // Signature matches
1298 bad = 0;
1299 DEBUG("signature successfully verified");
1300 }
1301 }
1302
1303 // Cleanup
1304 if (buf) delete[] buf;
1305
1306 // We are done
1307 return ((bad) ? 1 : 0);
1308}
1309
1310//_____________________________________________________________________________
1311int XrdSecProtocolgsi::getKey(char *kbuf, int klen)
1312{
1313 // Get the current encryption key
1314 //
1315 // Returns: < 0 Failed, returned value if -errno (see Encrypt)
1316 // >= 0 The size of the encyption key. The supplied buffer of length
1317 // size hold the key. If the buffer address is 0, only the
1318 // size of the key is returned.
1319 //
1320 EPNAME("getKey");
1321
1322 // Check if we have to serialize the key
1323 if (!bucketKey) {
1324
1325 // We must have a key for that
1326 if (!sessionKey)
1327 // Invalid call
1328 return -ENOENT;
1329 // Create bucket
1330 bucketKey = sessionKey->AsBucket();
1331 }
1332
1333 // Prepare output now, if we have any
1334 if (bucketKey) {
1335 // If are asked only the size, we are done
1336 if (kbuf == 0)
1337 return bucketKey->size;
1338
1339 // Check the size of the buffer
1340 if (klen < bucketKey->size)
1341 // Too small
1342 return -EOVERFLOW;
1343
1344 // Copy the buffer
1345 memcpy(kbuf, bucketKey->buffer, bucketKey->size);
1346
1347 // We are done
1348 DEBUG("session key exported");
1349 return bucketKey->size;
1350 }
1351
1352 // Key exists but we could export it in bucket format
1353 return -ENOMEM;
1354}
1355
1356//_____________________________________________________________________________
1357int XrdSecProtocolgsi::setKey(char *kbuf, int klen)
1358{
1359 // Set the current encryption key
1360 //
1361 // Returns: < 0 Failed, returned value if -errno (see Encrypt)
1362 // 0 The new key has been set.
1363 //
1364 EPNAME("setKey");
1365
1366 // Make sur that we can initialize the new key
1367 if (!kbuf || klen <= 0)
1368 // Invalid inputs
1369 return -EINVAL;
1370
1371 if (!sessionCF)
1372 // Invalid context
1373 return -ENOENT;
1374
1375 // Put the buffer key into a bucket
1376 XrdSutBucket *bck = new XrdSutBucket();
1377 if (!bck)
1378 // Cannot get buffer: out-of-resources?
1379 return -ENOMEM;
1380 // Set key buffer
1381 bck->SetBuf(kbuf, klen);
1382
1383 // Init a new cipher from the bucket
1384 XrdCryptoCipher *newKey = sessionCF->Cipher(bck);
1385 if (!newKey) {
1386 SafeDelete(bck);
1387 return -ENOMEM;
1388 }
1389
1390 // Delete current key
1391 SafeDelete(sessionKey);
1392
1393 // Set the new key
1394 sessionKey = newKey;
1395
1396 // Cleanup
1397 SafeDelete(bck);
1398
1399 // Ok
1400 DEBUG("session key update");
1401 return 0;
1402}
1403
1404/******************************************************************************/
1405/* C l i e n t O r i e n t e d F u n c t i o n s */
1406/******************************************************************************/
1407/******************************************************************************/
1408/* g e t C r e d e n t i a l s */
1409/******************************************************************************/
1410
1412 XrdOucErrInfo *ei)
1413{
1414 // Query client for the password; remote username and host
1415 // are specified in 'parm'. File '.rootnetrc' is checked.
1416 EPNAME("getCredentials");
1417
1418 // If we are a server the only reason to be here is to get the forwarded
1419 // or saved client credentials
1420 if (srvMode) {
1421 XrdSecCredentials *creds = 0;
1422 if (proxyChain) {
1423 // Export the proxy chain into a bucket
1424 XrdCryptoX509ExportChain_t ExportChain = sessionCF->X509ExportChain();
1425 if (ExportChain) {
1426 XrdSutBucket *bck = (*ExportChain)(proxyChain, 1);
1427 if (bck) {
1428 // We need to duplicate it because XrdSecCredentials uses
1429 // {malloc, free} instead of {new, delete}
1430 char *nbuf = (char *) malloc(bck->size);
1431 if (nbuf) {
1432 memcpy(nbuf, bck->buffer, bck->size);
1433 // Import the buffer in a XrdSecCredentials object
1434 creds = new XrdSecCredentials(nbuf, bck->size);
1435 }
1436 delete bck;
1437 }
1438 }
1439 }
1440 return creds;
1441 }
1442
1443 // Handshake vars container must be initialized at this point
1444 if (!hs)
1445 return ErrC(ei,0,0,0,kGSErrError,
1446 "handshake var container missing","getCredentials");
1447 //
1448 // Nothing to do if buffer is empty
1449 if ((!parm && !hs->Parms) || (parm && (!(parm->buffer) || parm->size <= 0))) {
1450 if (hs->Iter == 0)
1451 return ErrC(ei,0,0,0,kGSErrNoBuffer,"missing parameters","getCredentials");
1452 else
1453 return (XrdSecCredentials *)0;
1454 }
1455
1456 // We support passing the user {proxy, cert, key} paths via Url parameter
1457 char *upp = (ei && ei->getEnv()) ? ei->getEnv()->Get("xrd.gsiusrpxy") : 0;
1458 if (upp) UsrProxy = upp;
1459 upp = (ei && ei->getEnv()) ? ei->getEnv()->Get("xrd.gsiusrcrt") : 0;
1460 if (upp) UsrCert = upp;
1461 upp = (ei && ei->getEnv()) ? ei->getEnv()->Get("xrd.gsiusrkey") : 0;
1462 if (upp) UsrKey = upp;
1463
1464 // Count interations
1465 (hs->Iter)++;
1466
1467 // Update time stamp
1468 hs->TimeStamp = time(0);
1469
1470 // Local vars
1471 int step = 0;
1472 int nextstep = 0;
1473 const char *stepstr = 0;
1474 char *bpub = 0;
1475 int lpub = 0;
1476 String CryptoMod = "";
1477 String Host = "";
1478 String RemID = "";
1479 String Emsg;
1480 String specID = "";
1481 String issuerHash = "";
1482 // Buffer / Bucket related
1483 XrdSutBuffer *bpar = 0; // Global buffer
1484 XrdSutBuffer *bmai = 0; // Main buffer
1485 XrdSutBucket *bck = 0; // Generic bucket
1486
1487 //
1488 // Decode received buffer
1489 bpar = hs->Parms;
1490 if (!bpar && !(bpar = new XrdSutBuffer((const char *)parm->buffer,parm->size)))
1491 return ErrC(ei,0,0,0,kGSErrDecodeBuffer,"global",stepstr);
1492 // Ownership has been transferred
1493 hs->Parms = 0;
1494 //
1495 // Check protocol ID name
1496 if (strcmp(bpar->GetProtocol(),XrdSecPROTOIDENT))
1497 return ErrC(ei,bpar,bmai,0,kGSErrBadProtocol,stepstr);
1498 //
1499 // The step indicates what we are supposed to do
1500 if (!(step = bpar->GetStep())) {
1501 // The first, fake, step
1502 step = kXGS_init;
1503 bpar->SetStep(step);
1504 }
1505 stepstr = ServerStepStr(step);
1506 // Dump, if requested
1507 XrdOucString bmsg;
1508 if (QTRACE(Dump)) {
1509 bmsg.form("IN: bpar: %s", stepstr);
1510 bpar->Dump(bmsg.c_str());
1511 }
1512 //
1513 // Parse input buffer
1514 if (ParseClientInput(bpar, &bmai, Emsg) == -1) {
1515 DEBUG(Emsg<<" CF: "<<sessionCF);
1516 return ErrC(ei,bpar,bmai,0,kGSErrParseBuffer,Emsg.c_str(),stepstr);
1517 }
1518 // Dump, if requested
1519 if (QTRACE(Dump)) {
1520 if (bmai) {
1521 bmsg.form("IN: bmai: %s", stepstr);
1522 bmai->Dump(bmsg.c_str());
1523 }
1524 }
1525 //
1526 // Version
1527 DEBUG("version run by server: "<< hs->RemVers);
1528 //
1529 // Check random challenge
1530 if (!CheckRtag(bmai, Emsg))
1531 return ErrC(ei,bpar,bmai,0,kGSErrBadRndmTag,Emsg.c_str(),stepstr);
1532 //
1533 // Login name if any
1534 String user(Entity.name);
1535 if (user.length() <= 0) user = getenv("XrdSecUSER");
1536 //
1537 // Now action depens on the step
1538 nextstep = kXGC_none;
1539
1540 XrdCryptoX509 *c = 0;
1541
1542 switch (step) {
1543
1544 case kXGS_init:
1545 //
1546 // Add bucket with cryptomod to the global list
1547 // (This must be always visible from now on)
1548 CryptoMod = hs->CryptoMod;
1549 if (hs->RemVers >= XrdSecgsiVersDHsigned && !(hs->HasPad)) CryptoMod += gNoPadTag;
1550 if (bpar->AddBucket(CryptoMod,kXRS_cryptomod) != 0)
1551 return ErrC(ei,bpar,bmai,0,
1553 //
1554 // Add bucket with our version to the main list
1555 if (bpar->MarshalBucket(kXRS_version,(kXR_int32)(Version)) != 0)
1556 return ErrC(ei,bpar,bmai,0, kGSErrCreateBucket,
1557 XrdSutBuckStr(kXRS_version),"global",stepstr);
1558 //
1559 // Add our issuer hash
1560 c = hs->PxyChain->Begin();
1561 if (c->type == XrdCryptoX509::kCA) {
1562 issuerHash = c->SubjectHash();
1563 if (HashCompatibility && c->SubjectHash(1)) {
1564 issuerHash += "|"; issuerHash += c->SubjectHash(1); }
1565 } else {
1566 issuerHash = c->IssuerHash();
1567 if (HashCompatibility && c->IssuerHash(1)
1568 && strcmp(c->IssuerHash(1),c->IssuerHash())) {
1569 issuerHash += "|"; issuerHash += c->IssuerHash(1); }
1570 }
1571 while ((c = hs->PxyChain->Next()) != 0) {
1572 if (c->type != XrdCryptoX509::kCA)
1573 break;
1574 issuerHash = c->SubjectHash();
1575 if (HashCompatibility && c->SubjectHash(1)
1576 && strcmp(c->IssuerHash(1),c->IssuerHash())) {
1577 issuerHash += "|"; issuerHash += c->SubjectHash(1); }
1578 }
1579
1580 DEBUG("Client issuer hash: " << issuerHash);
1581 if (bpar->AddBucket(issuerHash,kXRS_issuer_hash) != 0)
1582 return ErrC(ei,bpar,bmai,0, kGSErrCreateBucket,
1584 //
1585 // Add bucket with our delegate proxy options
1586 if (hs->RemVers >= 10100) {
1587 if (bpar->MarshalBucket(kXRS_clnt_opts,(kXR_int32)(hs->Options)) != 0)
1588 return ErrC(ei,bpar,bmai,0, kGSErrCreateBucket,
1589 XrdSutBuckStr(kXRS_clnt_opts),"global",stepstr);
1590 }
1591
1592 //
1593 nextstep = kXGC_certreq;
1594 break;
1595
1596 case kXGS_cert:
1597 //
1598 // We must have a session cipher at this point
1599 if (!(sessionKey))
1600 return ErrC(ei,bpar,bmai,0,
1601 kGSErrNoCipher,"session cipher",stepstr);
1602
1603 //
1604 // Extract buffer with public info for the cipher agreement
1605 if (!(bpub = sessionKey->Public(lpub)))
1606 return ErrC(ei,bpar,bmai,0,
1607 kGSErrNoPublic,"session",stepstr);
1608
1609 //
1610 // If server supports decoding of signed DH, do sign them
1611 if (hs->RemVers >= XrdSecgsiVersDHsigned) {
1612 bck = new XrdSutBucket(bpub,lpub,kXRS_cipher);
1613 if (sessionKsig) {
1614 // Encrypt client DH public parameters with client private key
1615 if (sessionKsig->EncryptPrivate(*bck) <= 0)
1616 return ErrC(ei,bpar,bmai,0, kGSErrExportPuK,
1617 "encrypting client DH public parameters",stepstr);
1618 } else {
1619 return ErrC(ei,bpar,bmai,0, kGSErrExportPuK,
1620 "client signing key undefined!",stepstr);
1621 }
1622 //
1623 // Add it to the global list
1624 if (bpar->AddBucket(bck) != 0)
1625 return ErrC(ei,bpar,bmai,0, kGSErrAddBucket, "main",stepstr);
1626 //
1627 // Export client public key
1628 XrdOucString cpub;
1629 if (sessionKsig->ExportPublic(cpub) < 0)
1630 return ErrC(ei,bpar,bmai,0, kGSErrExportPuK,
1631 "exporting client public key",stepstr);
1632 // Add it to the global list
1633 if (bpar->UpdateBucket(cpub.c_str(),cpub.length(),kXRS_puk) != 0)
1634 return ErrC(ei,bpar,bmai,0, kGSErrAddBucket,
1635 XrdSutBuckStr(kXRS_puk),"global",stepstr);
1636 } else {
1637 //
1638 // Add it to the global list
1639 if (bpar->UpdateBucket(bpub,lpub,kXRS_puk) != 0)
1640 return ErrC(ei,bpar,bmai,0, kGSErrAddBucket,
1641 XrdSutBuckStr(kXRS_puk),"global",stepstr);
1642 delete[] bpub; // bpub is being duplicated inside of 'UpdateBucket'
1643 }
1644
1645 //
1646 // Add the proxy certificate
1647 bmai->AddBucket(hs->Cbck);
1648 //
1649 // Add login name if any, needed while chosing where to export the proxies
1650 if (user.length() > 0) {
1651 if (bmai->AddBucket(user, kXRS_user) != 0)
1652 return ErrC(ei,bpar,bmai,0, kGSErrCreateBucket,
1653 XrdSutBuckStr(kXRS_user),stepstr);
1654 }
1655 //
1656 nextstep = kXGC_cert;
1657 break;
1658
1659 case kXGS_pxyreq:
1660 //
1661 // If something went wrong, send explanation
1662 if (Emsg.length() > 0) {
1663 if (bmai->AddBucket(Emsg,kXRS_message) != 0)
1664 return ErrC(ei,bpar,bmai,0, kGSErrCreateBucket,
1665 XrdSutBuckStr(kXRS_message),stepstr);
1666 }
1667 //
1668 // Add login name if any, needed while chosing where to export the proxies
1669 if (user.length() > 0) {
1670 if (bmai->AddBucket(user, kXRS_user) != 0)
1671 return ErrC(ei,bpar,bmai,0, kGSErrCreateBucket,
1672 XrdSutBuckStr(kXRS_user),stepstr);
1673 }
1674 //
1675 // The relevant buckets should already be in the buffers
1676 nextstep = kXGC_sigpxy;
1677 break;
1678
1679 default:
1680 return ErrC(ei,bpar,bmai,0, kGSErrBadOpt,stepstr);
1681 }
1682
1683 //
1684 // Serialize and encrypt
1685 if (AddSerialized('c', nextstep, hs->ID,
1686 bpar, bmai, kXRS_main, sessionKey) != 0) {
1687 return ErrC(ei,bpar,bmai,0,
1688 kGSErrSerialBuffer,"main",stepstr);
1689 }
1690 //
1691 // Serialize the global buffer
1692 char *bser = 0;
1693 int nser = bpar->Serialized(&bser,'f');
1694
1695 if (QTRACE(Authen)) {
1696 bmsg.form("OUT: bpar: %s", ClientStepStr(bpar->GetStep()));
1697 bpar->Dump(bmsg.c_str());
1698 bmsg.form("OUT: bmai: %s", ClientStepStr(bpar->GetStep()));
1699 bmai->Dump(bmsg.c_str());
1700 }
1701 //
1702 // We may release the buffers now
1703 REL2(bpar,bmai);
1704 //
1705 // Return serialized buffer
1706 if (nser > 0) {
1707 DEBUG("returned " << nser <<" bytes of credentials");
1708 return new XrdSecCredentials(bser, nser);
1709 } else {
1710 NOTIFY("problems with final serialization");
1711 return (XrdSecCredentials *)0;
1712 }
1713}
1714
1715/******************************************************************************/
1716/* S e r v e r O r i e n t e d M e t h o d s */
1717/******************************************************************************/
1718
1719//_____________________________________________________________________________
1720static bool AuthzFunCheck(XrdSutCacheEntry *e, void *a) {
1721
1722 int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
1723 time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
1724 long to_ref = (*((XrdSutCacheArg_t *)a)).arg3;
1725 int st_exp = (*((XrdSutCacheArg_t *)a)).arg4;
1726
1727 if (e && (e->status == st_ref)) {
1728 // Check expiration, if required
1729 bool expired = 0;
1730 if (to_ref > 0 && (ts_ref - e->mtime) > to_ref) expired = 1;
1731 int notafter = *((int *) e->buf2.buf);
1732 if (to_ref > notafter) expired = 1;
1733
1734 if (expired) {
1735 // Invalidate the entry, if the case
1736 e->status = st_exp;
1737 } else {
1738 return true;
1739 }
1740 }
1741 return false;
1742}
1743
1744/******************************************************************************/
1745/* A u t h e n t i c a t e */
1746/******************************************************************************/
1747
1749 XrdSecParameters **parms,
1750 XrdOucErrInfo *ei)
1751{
1752 //
1753 // Check if we have any credentials or if no credentials really needed.
1754 // In either case, use host name as client name
1755 EPNAME("Authenticate");
1756
1757 //
1758 // If cred buffer is two small or empty assume host protocol
1759 if (cred->size <= (int)XrdSecPROTOIDLEN || !cred->buffer) {
1760 strncpy(Entity.prot, "host", sizeof(Entity.prot));
1761 return 0;
1762 }
1763
1764 // Handshake vars conatiner must be initialized at this point
1765 if (!hs)
1766 return ErrS(Entity.tident,ei,0,0,0,kGSErrError,
1767 "handshake var container missing",
1768 "protocol initialization problems");
1769
1770 // Update time stamp
1771 hs->TimeStamp = time(0);
1772
1773 //
1774 // ID of this handshaking
1775 if (hs->ID.length() <= 0)
1776 hs->ID = Entity.tident;
1777 DEBUG("handshaking ID: " << hs->ID);
1778
1779 // Local vars
1780 int kS_rc = kgST_more;
1781 int step = 0;
1782 int nextstep = 0;
1783 char *bpub = 0;
1784 int lpub = 0;
1785 bool vomsFailed = false;
1786 const char *stepstr = 0;
1787 String Message;
1789 String Ciphers;
1790 String Host;
1791 String SrvPuKExp;
1792 String Salt;
1793 String RndmTag;
1794 String ClntMsg(256);
1795 // Buffer related
1796 XrdSutBuffer *bpar = 0; // Global buffer
1797 XrdSutBuffer *bmai = 0; // Main buffer
1798 XrdSutBucket *bck = 0; // Generic bucket
1799 // Proxy export related
1800 XrdOucString spxy;
1801 XrdSutBucket *bpxy = 0;
1802
1803 //
1804 // Decode received buffer
1805 if (!(bpar = new XrdSutBuffer((const char *)cred->buffer,cred->size)))
1806 return ErrS(hs->ID,ei,0,0,0,kGSErrDecodeBuffer,"global",stepstr);
1807 //
1808 // Check protocol ID name
1809 if (strcmp(bpar->GetProtocol(),XrdSecPROTOIDENT))
1810 return ErrS(hs->ID,ei,bpar,bmai,0,kGSErrBadProtocol,stepstr);
1811 //
1812 // The step indicates what we are supposed to do
1813 step = bpar->GetStep();
1814 stepstr = ClientStepStr(step);
1815 // Dump, if requested
1816 XrdOucString bmsg;
1817 if (QTRACE(Dump)) {
1818 bmsg.form("IN: bpar: %s", stepstr);
1819 bpar->Dump(bmsg.c_str());
1820 }
1821 //
1822 // Parse input buffer
1823 if (ParseServerInput(bpar, &bmai, ClntMsg) == -1) {
1824 DEBUG(ClntMsg);
1825 return ErrS(hs->ID,ei,bpar,bmai,0,kGSErrParseBuffer,ClntMsg.c_str(),stepstr);
1826 }
1827 //
1828 // Version
1829 DEBUG("version run by client: "<< hs->RemVers);
1830 DEBUG("options req by client: "<< hs->Options);
1831 //
1832 // Dump, if requested
1833 if (QTRACE(Dump)) {
1834 if (bmai) {
1835 bmsg.form("IN: bmai: %s", stepstr);
1836 bmai->Dump(bmsg.c_str());
1837 }
1838 }
1839 //
1840 // Check random challenge
1841 if (!CheckRtag(bmai, ClntMsg))
1842 return ErrS(hs->ID,ei,bpar,bmai,0,kGSErrBadRndmTag,stepstr,ClntMsg.c_str());
1843
1844 // Extract the VOMS attrbutes, if required
1845 XrdCryptoX509ExportChain_t X509ExportChain = (sessionCF) ? sessionCF->X509ExportChain() : 0;
1846 if (!X509ExportChain) {
1847 // Error
1848 return ErrS(hs->ID,ei,0,0,0,kGSErrError,
1849 "crypto factory function for chain export not found");
1850 }
1851
1852 //
1853 // Now action depens on the step
1854 switch (step) {
1855
1856 case kXGC_certreq:
1857 //
1858 // Client required us to send our certificate and cipher DH public parameters:
1859 // add first this last one.
1860 // Extract buffer with public info for the cipher agreement
1861 if (!(bpub = hs->Rcip->Public(lpub)))
1862 return ErrS(hs->ID,ei,bpar,bmai,0, kGSErrNoPublic,
1863 "session",stepstr);
1864
1865 // If client supports decoding of signed DH, do sign them
1866 if (hs->RemVers >= XrdSecgsiVersDHsigned) {
1867 bck = new XrdSutBucket(bpub,lpub,kXRS_cipher);
1868 if (sessionKsig) {
1869 //
1870 // Encrypt server DH public parameters with server key
1871 if (sessionKsig->EncryptPrivate(*bck) <= 0)
1872 return ErrS(hs->ID,ei,bpar,bmai,0, kGSErrExportPuK,
1873 "encrypting server DH public parameters",stepstr);
1874 } else {
1875 return ErrS(hs->ID,ei,bpar,bmai,0, kGSErrExportPuK,
1876 "server signing key undefined!",stepstr);
1877 }
1878 } else {
1879 // Previous naming
1880 bck = new XrdSutBucket(bpub,lpub,kXRS_puk);
1881 }
1882
1883 //
1884 // Add it to the global list
1885 if (bpar->AddBucket(bck) != 0)
1886 return ErrS(hs->ID,ei,bpar,bmai,0, kGSErrAddBucket,
1887 "main",stepstr);
1888
1889 //
1890 // Add bucket with list of supported ciphers
1891 if (bpar->AddBucket(DefCipher,kXRS_cipher_alg) != 0)
1892 return ErrS(hs->ID,ei,bpar,bmai,0,
1894 //
1895 // Add bucket with list of supported MDs
1896 if (bpar->AddBucket(DefMD,kXRS_md_alg) != 0)
1897 return ErrS(hs->ID,ei,bpar,bmai,0,
1899 //
1900 // Add the server certificate
1901 bpar->AddBucket(hs->Cbck);
1902
1903 // We are done for the moment
1904 nextstep = kXGS_cert;
1905 break;
1906
1907 case kXGC_cert:
1908 //
1909 // Client sent its own credentials: their are checked in
1910 // ParseServerInput, so if we are here they are OK
1911 kS_rc = kgST_ok;
1912 nextstep = kXGS_none;
1913
1914 if (GMAPOpt > 0) {
1915 // Get name from gridmap
1916 String name;
1917 QueryGMAP(hs->Chain, hs->TimeStamp, name);
1918 DEBUG("username(s) associated with this DN: "<<name);
1919 if (name.length() <= 0) {
1920 // Grid map lookup failure
1921 if (GMAPOpt == 2) {
1922 // It was required, so we fail
1923 kS_rc = kgST_error;
1924 PRINT("ERROR: user mapping required, but lookup failed - failure");
1925 break;
1926 } else {
1927 NOTIFY("WARNING: user mapping lookup failed - use DN or DN-hash as name");
1928 }
1929 } else {
1930 //
1931 // Extract user login name, if any
1932 XrdSutBucket *bck = 0;
1933 String user;
1934 if ((bck = bmai->GetBucket(kXRS_user))) {
1935 bck->ToString(user);
1936 bmai->Deactivate(kXRS_user);
1937 }
1938 DEBUG("target user: "<<user);
1939 if (user.length() > 0) {
1940 // Check if the wanted username is authorized
1941 String u;
1942 int from = 0;
1943 bool ok = 0;
1944 while ((from = name.tokenize(u, from, ',')) != -1) {
1945 if (user == u) { ok = 1; break; }
1946 }
1947 if (ok) {
1948 name = u;
1949 DEBUG("DN mapping: requested user is authorized: name is '"<<name<<"'");
1950 } else {
1951 // The requested username is not in the list; we warn and default to the first
1952 // found (to be Globus compliant)
1953 if (name.find(',') != STR_NPOS) name.erase(name.find(','));
1954 PRINT("WARNING: user mapping lookup ok, but the requested user is not"
1955 " authorized ("<<user<<"). Instead, mapped as " << name << ".");
1956 }
1957 } else {
1958 // No username requested: we default to the first found (to be Globus compliant)
1959 if (name.find(',') != STR_NPOS) name.erase(name.find(','));
1960 DEBUG("user mapping lookup successful: name is '"<<name<<"'");
1961 }
1962 Entity.name = strdup(name.c_str());
1963 Entity.eaAPI->Add("gridmap.name", "1", true);
1964 }
1965 }
1966 // If not set, use DN
1967 if (!Entity.name || (strlen(Entity.name) <= 0)) {
1968 // No grid map: set the hash of the client DN as name
1969 if (!GMAPuseDNname && hs->Chain->EEChash()) {
1970 Entity.name = strdup(hs->Chain->EEChash());
1971 } else if (GMAPuseDNname && hs->Chain->EECname()) {
1972 Entity.name = strdup(hs->Chain->EECname());
1973 } else {
1974 PRINT("WARNING: DN missing: corruption? ");
1975 }
1976 }
1977
1978 // Add the DN as default moninfo if requested (the authz plugin may change this)
1979 if (MonInfoOpt > 0 || ShowDN) {
1980 const char *theDN = hs->Chain->EECname();
1981 if (theDN) {
1982 if (ShowDN && !GMAPuseDNname) {
1983 PRINT(Entity.name<<" Subject DN='"<<theDN<<"'");
1984 }
1985 if (MonInfoOpt > 0) Entity.moninfo = strdup(theDN);
1986 }
1987 }
1988
1989 if (VOMSAttrOpt > vatIgnore && VOMSFun) {
1990 // Fill the information needed by the external function
1991 if (VOMSCertFmt == 1) {
1992 // PEM base64
1993 bpxy = (*X509ExportChain)(hs->Chain, true);
1994 bpxy->ToString(spxy);
1995 delete bpxy;
1996 Entity.creds = strdup(spxy.c_str());
1997 Entity.credslen = spxy.length();
1998 } else {
1999 // Raw (opaque) format, to be used with XrdCrypto
2000 Entity.creds = (char *) hs->Chain;
2001 Entity.credslen = 0;
2002 }
2003 if ((*VOMSFun)(Entity) != 0) {
2004 vomsFailed = true;
2005 if (VOMSAttrOpt == vatRequire) {
2006 // Error
2007 kS_rc = kgST_error;
2008 PRINT("ERROR: the VOMS extraction plug-in reported "
2009 "authentication failure");
2010 break;
2011 }
2012 }
2013 NOTIFY("VOMS: Entity.vorg: "<< (Entity.vorg ? Entity.vorg : "<none>"));
2014 NOTIFY("VOMS: Entity.grps: "<< (Entity.grps ? Entity.grps : "<none>"));
2015 NOTIFY("VOMS: Entity.role: "<< (Entity.role ? Entity.role : "<none>"));
2016 NOTIFY("VOMS: Entity.endorsements: "<< (Entity.endorsements ? Entity.endorsements : "<none>"));
2017 }
2018
2019 // Here prepare/extract the information for authorization
2020 spxy = "";
2021 bpxy = 0;
2022 if (AuthzFun && AuthzKey && (AuthzAlways || vomsFailed)) {
2023 // Fill the information needed by the external function
2024 if (AuthzCertFmt == 1) {
2025 // May have been already done
2026 if (!Entity.creds || (Entity.creds && Entity.credslen == 0)) {
2027 // PEM base64
2028 bpxy = (*X509ExportChain)(hs->Chain, true);
2029 bpxy->ToString(spxy);
2030 Entity.creds = strdup(spxy.c_str());
2031 Entity.credslen = spxy.length();
2032 // If not empty Entity.creds is a pointer to hs->Chain and
2033 // we need not to free it
2034 }
2035 } else {
2036 // May have been already done
2037 if (Entity.creds && Entity.credslen > 0) {
2038 // Entity.creds is in PEM form, we need to free it
2039 free(Entity.creds);
2040 // Raw (opaque) format, to be used with XrdCrypto
2041 Entity.creds = (char *) hs->Chain;
2042 Entity.credslen = 0;
2043 }
2044 }
2045 // Get the key
2046 char *key = 0;
2047 int lkey = 0;
2048 if ((lkey = (*AuthzKey)(Entity, &key)) < 0) {
2049 // Fatal error
2050 kS_rc = kgST_error;
2051 PRINT("ERROR: unable to get the key associated to this user");
2052 break;
2053 }
2054 const char *dn = (const char *)key;
2055 time_t now = hs->TimeStamp;
2056 // We may have it in the cache
2057 XrdSutCERef ceref;
2058 bool rdlock = false;
2059 XrdSutCacheArg_t arg = {kCE_ok, now, AuthzCacheTimeOut, kCE_disabled};
2060 XrdSutCacheEntry *cent = cacheAuthzFun.Get(dn, rdlock, AuthzFunCheck, (void *) &arg);
2061 if (!cent) {
2062 // Fatal error
2063 kS_rc = kgST_error;
2064 PRINT("ERROR: unable to get cache entry for dn: "<<dn);
2065 break;
2066 }
2067 ceref.Set(&(cent->rwmtx));
2068 if (!rdlock) {
2069 if (cent->buf1.buf)
2070 FreeEntity((XrdSecEntity *) cent->buf1.buf);
2071 SafeDelete(cent->buf1.buf);
2072 SafeDelete(cent->buf2.buf);
2073 }
2074 if (cent->status != kCE_ok) {
2075 int authzrc = 0;
2076 if ((authzrc = (*AuthzFun)(Entity)) != 0) {
2077 // Error
2078 kS_rc = kgST_error;
2079 PRINT("ERROR: the authz plug-in reported failure");
2080 SafeDelete(key);
2081 ceref.UnLock();
2082 break;
2083 } else {
2084 cent->status = kCE_ok;
2085 // Save a copy of the relevant Entity fields
2086 XrdSecEntity *se = new XrdSecEntity();
2087 int slen = 0;
2088 CopyEntity(&Entity, se, &slen);
2089 FreeEntity((XrdSecEntity *) cent->buf1.buf);
2090 SafeDelete(cent->buf1.buf);
2091 cent->buf1.buf = (char *) se;
2092 cent->buf1.len = slen;
2093 // Proxy expiration time
2094 int notafter = hs->Chain->End() ? hs->Chain->End()->NotAfter() : -1;
2095 cent->buf2.buf = (char *) new int(notafter);
2096 cent->buf2.len = sizeof(int);
2097 // Fill up the rest
2098 cent->cnt = 0;
2099 cent->mtime = now; // creation time
2100 // Notify
2101 DEBUG("Saved Entity to cacheAuthzFun ("<<slen<<" bytes)");
2102 }
2103 } else {
2104 // Fetch a copy of the saved entity
2105 int slen = 0;
2106 FreeEntity(&Entity);
2107 CopyEntity((XrdSecEntity *) cent->buf1.buf, &Entity, &slen);
2108 // Notify
2109 DEBUG("Got Entity from cacheAuthzFun ("<<slen<<" bytes)");
2110 }
2111 // Release lock
2112 ceref.UnLock();
2113 // Cleanup
2114 SafeDelArray(key);
2115 }
2116
2117 // Export proxy for authorization, if required
2118 if (AuthzPxyWhat >= azFull) {
2119 if (bpxy && AuthzPxyWhat == azLast) {
2120 SafeDelete(bpxy); spxy = "";
2122 Entity.credslen = 0;
2123 }
2124 if (!bpxy) {
2125 if (AuthzPxyWhat == 1 && hs->Chain->End()) {
2126 bpxy = hs->Chain->End()->Export();
2127 } else {
2128 bpxy = (*X509ExportChain)(hs->Chain, true);
2129 }
2130 bpxy->ToString(spxy);
2131 }
2132 if (AuthzPxyWhere == azCred) {
2133 Entity.creds = strdup(spxy.c_str());
2134 Entity.credslen = spxy.length();
2135 } else {
2136 // This should be deprecated
2137 Entity.endorsements = strdup(spxy.c_str());
2138 }
2139 delete bpxy;
2140 NOTIFY("Entity.endorsements: "<<(void *)Entity.endorsements);
2141 NOTIFY("Entity.creds: "<<(void *)Entity.creds);
2142 NOTIFY("Entity.credslen: "<<Entity.credslen);
2143
2144 } else if (bpxy) {
2145 // Cleanup
2146 SafeDelete(bpxy); spxy = "";
2147 }
2148
2149 if (hs->RemVers >= 10100) {
2150 if (hs->PxyChain) {
2151 // The client is going to send over info for delegation
2152 kS_rc = kgST_more;
2153 nextstep = kXGS_pxyreq;
2154 }
2155 }
2156
2157 break;
2158
2159 case kXGC_sigpxy:
2160 //
2161 // Nothing to do after this
2162 kS_rc = kgST_ok;
2163 nextstep = kXGS_none;
2164 //
2165 // If something went wrong, print explanation
2166 if (ClntMsg.length() > 0) {
2167 PRINT(ClntMsg);
2168 }
2169 break;
2170
2171 default:
2172 return ErrS(hs->ID,ei,bpar,bmai,0, kGSErrBadOpt, stepstr);
2173 }
2174
2175 if (kS_rc == kgST_more) {
2176 //
2177 // Add message to client
2178 if (ClntMsg.length() > 0)
2179 if (bmai->AddBucket(ClntMsg,kXRS_message) != 0) {
2180 NOTIFY("problems adding bucket with message for client");
2181 }
2182 //
2183 // Serialize, encrypt and add to the global list
2184 if (AddSerialized('s', nextstep, hs->ID,
2185 bpar, bmai, kXRS_main, sessionKey) != 0) {
2186 return ErrS(hs->ID,ei,bpar,bmai,0, kGSErrSerialBuffer,
2187 "main / session cipher",stepstr);
2188 }
2189 //
2190 // Serialize the global buffer
2191 char *bser = 0;
2192 int nser = bpar->Serialized(&bser,'f');
2193 //
2194 // Dump, if requested
2195 if (QTRACE(Authen)) {
2196 bmsg.form("OUT: bpar: %s", ServerStepStr(bpar->GetStep()));
2197 bpar->Dump(bmsg.c_str());
2198 bmsg.form("OUT: bmai: %s", ServerStepStr(bpar->GetStep()));
2199 bmai->Dump(bmsg.c_str());
2200 }
2201 //
2202 // Create buffer for client
2203 *parms = new XrdSecParameters(bser,nser);
2204
2205 } else {
2206 //
2207 // Cleanup handshake vars
2208 SafeDelete(hs);
2209 }
2210 //
2211 // We may release the buffers now
2212 REL2(bpar,bmai);
2213 //
2214 // All done
2215 return kS_rc;
2216}
2217
2218/******************************************************************************/
2219/* C o p y E n t i ty */
2220/******************************************************************************/
2221
2222void XrdSecProtocolgsi::CopyEntity(XrdSecEntity *in, XrdSecEntity *out, int *lout)
2223{
2224 // Copy relevant fields of 'in' into 'out'; return length of 'out'
2225
2226 if (!in || !out) return;
2227
2228 int slen = sizeof(XrdSecEntity);
2229 if (in->name) { out->name = strdup(in->name); slen += strlen(in->name); }
2230 if (in->host) { out->host = strdup(in->host); slen += strlen(in->host); }
2231 if (in->vorg) { out->vorg = strdup(in->vorg); slen += strlen(in->vorg); }
2232 if (in->role) { out->role = strdup(in->role); slen += strlen(in->role); }
2233 if (in->grps) { out->grps = strdup(in->grps); slen += strlen(in->grps); }
2234 if (in->creds && in->credslen > 0) {
2235 out->creds = strdup(in->creds); slen += in->credslen;
2236 out->credslen = in->credslen; }
2237 if (in->endorsements) { out->endorsements = strdup(in->endorsements);
2238 slen += strlen(in->endorsements); }
2239 if (in->moninfo) { out->moninfo = strdup(in->moninfo);
2240 slen += strlen(in->moninfo); }
2241
2242 // Save length, if required
2243 if (lout) *lout = slen;
2244
2245 // Done
2246 return;
2247}
2248
2249/******************************************************************************/
2250/* F r e e E n t i ty */
2251/******************************************************************************/
2252
2253void XrdSecProtocolgsi::FreeEntity(XrdSecEntity *in)
2254{
2255 // Free relevant fields of 'in';
2256
2257 if (!in) return;
2258
2259 if (in->name) SafeFree(in->name);
2260 if (in->host) SafeFree(in->host);
2261 if (in->vorg) SafeFree(in->vorg);
2262 if (in->role) SafeFree(in->role);
2263 if (in->grps) SafeFree(in->grps);
2264 if (in->creds && in->credslen > 0) { SafeFree(in->creds); in->credslen = 0; }
2265 if (in->endorsements) SafeFree(in->endorsements);
2266 if (in->moninfo) SafeFree(in->moninfo);
2267
2268 // Done
2269 return;
2270}
2271
2272/******************************************************************************/
2273/* E n a b l e T r a c i n g */
2274/******************************************************************************/
2275
2277{
2278 // Initiate error logging and tracing
2279
2281 GSITrace = new XrdOucTrace(&eDest);
2282 return GSITrace;
2283}
2284
2285/******************************************************************************/
2286/* g s i O p t i o n s :: P r i n t */
2287/******************************************************************************/
2288
2290{
2291 // Dump summary of GSI init options
2292// EPNAME("InitOpts");
2293
2294 // For clients print only if really required (for servers we notified it
2295 // always once for all)
2296 if ((mode == 'c') && debug <= 0) return;
2297
2298 POPTS(t, " -------------------------------------------------------------------");
2299 POPTS(t, " Mode: "<< ((mode == 'c') ? "client" : "server"));
2300 POPTS(t, " Debug: "<< debug);
2301 POPTS(t, " CA dir: " << (certdir ? certdir : XrdSecProtocolgsi::CAdir));
2302 POPTS(t, " CA verification level: "<< getOptName(caVerOpts, ca));
2303 POPTS(t, " CRL dir: " << (crldir ? crldir : XrdSecProtocolgsi::CRLdir ));
2304 POPTS(t, " CRL extension: " << (crlext ? crlext : XrdSecProtocolgsi::DefCRLext));
2305 POPTS(t, " CRL check level: "<< getOptName(crlOpts,crl));
2306 if (crl > 0) POPTS(t, " CRL refresh time: "<< crlrefresh);
2307 if (mode == 'c') {
2308 POPTS(t, " Certificate: " << (cert ? cert : XrdSecProtocolgsi::UsrCert));
2309 POPTS(t, " Key: " << (key ? key : XrdSecProtocolgsi::UsrKey));
2310 POPTS(t, " Proxy file: " << XrdSecProtocolgsi::UsrProxy);
2311 POPTS(t, " Proxy validity: " << (valid ? valid : XrdSecProtocolgsi::PxyValid));
2312 POPTS(t, " Proxy dep length: " << deplen);
2313 POPTS(t, " Proxy bits: " << bits);
2314 POPTS(t, " Proxy sign option: "<< sigpxy);
2315 POPTS(t, " Proxy delegation option: "<< dlgpxy);
2316 if (createpxy) POPTS(t, " Pure Cert/Key authentication allowed");
2317 POPTS(t, " Allowed server names: "<< (srvnames ? srvnames : "[*/]<target host name>[/*]"));
2318 } else {
2319 POPTS(t, " Certificate: " << (cert ? cert : XrdSecProtocolgsi::SrvCert));
2320 POPTS(t, " Key: " << (key ? key : XrdSecProtocolgsi::SrvKey));
2321 POPTS(t, " Proxy delegation option: "<< getOptName(sDlgOpts,dlgpxy));
2322 if (exppxy)
2323 POPTS(t, " Template for exported proxy: "<< (exppxy ? exppxy : gUsrPxyDef));
2324 POPTS(t, " GRIDmap file: " << (gridmap ? gridmap : XrdSecProtocolgsi::GMAPFile));
2325 POPTS(t, " GRIDmap option: "<< getOptName(gmoOpts,ogmap));
2326 POPTS(t, " GRIDmap cache entries expiration (secs): "<< gmapto);
2327 if (gmapfun) {
2328 POPTS(t, " DN mapping function: " << gmapfun);
2329 if (gmapfunparms) POPTS(t, " DN mapping function parms: " << gmapfunparms);
2330 } else {
2331 if (gmapfunparms) POPTS(t, " DN mapping function parms: ignored (no mapping function defined)");
2332 }
2333 if (authzfun) {
2334 POPTS(t, " Authz function: " << authzfun);
2335 if (authzfunparms) POPTS(t, " Authz function parms: " << authzfunparms);
2336 POPTS(t, " Authz call: " <<getOptName(azCallOpts,authzcall));
2337 POPTS(t, " Authz cache entries expiration (secs): " << authzto);
2338 } else {
2339 if (authzfunparms) POPTS(t, " Authz function parms: ignored (no authz function defined)");
2340 }
2341 if (authzpxy)
2342 POPTS(t, " Client proxy availability in XrdSecEntity.endorsement: "<< getOptName(azPxyOpts,authzpxy));
2343 POPTS(t, " VOMS option: "<< getOptName(vomsatOpts,vomsat));
2344 if (vomsfun) {
2345 POPTS(t, " VOMS extraction function: " << vomsfun);
2346 if (vomsfunparms) POPTS(t, " VOMS extraction function parms: " << vomsfunparms);
2347 } else {
2348 if (vomsfunparms) POPTS(t, " VOMS extraction function parms: ignored (no VOMS extraction function defined)");
2349 }
2350 POPTS(t, " MonInfo option: "<< moninfo);
2351 if (!hashcomp)
2352 POPTS(t, " Name hashing algorithm compatibility OFF");
2353 POPTS(t, " Show DN option: "<<showDN);
2354 }
2355 // Crypto options
2356 POPTS(t, " Crypto modules: "<< (clist ? clist : XrdSecProtocolgsi::DefCrypto));
2357 POPTS(t, " Ciphers: "<< (cipher ? cipher : XrdSecProtocolgsi::DefCipher));
2358 POPTS(t, " MDigests: "<< (md ? md : XrdSecProtocolgsi::DefMD));
2359 if (trustdns) {
2360 POPTS(t, " Trusting DNS for hostname checking");
2361 } else {
2362 POPTS(t, " Untrusting DNS for hostname checking");
2363 }
2364 POPTS(t, " -------------------------------------------------------------------");
2365}
2366
2367/******************************************************************************/
2368/* X r d S e c P r o t o c o l g s i I n i t */
2369/******************************************************************************/
2370
2371extern "C"
2372{
2373char *XrdSecProtocolgsiInit(const char mode,
2374 const char *parms, XrdOucErrInfo *erp)
2375{
2376 // One-time protocol initialization, filling the static flags and options
2377 // of the protocol.
2378 // For clients (mode == 'c') we use values in envs.
2379 // For servers (mode == 's') the command line options are passed through
2380 // parms.
2381 EPNAME("ProtocolgsiInit");
2382
2384 char *rc = (char *)"";
2385 char *cenv = 0;
2386
2387 // Initiate error logging and tracing
2389
2390 //
2391 // Clients first
2392 if (mode == 'c') {
2393 //
2394 // Decode envs:
2395 // "XrdSecDEBUG" debug flag ("0","1","2","3")
2396 // "XrdSecGSICADIR" full path to an alternative path
2397 // containing the CA info
2398 // [/etc/grid-security/certificates]
2399 // "XrdSecGSICRLDIR" full path to an alternative path
2400 // containing the CRL info
2401 // [/etc/grid-security/certificates]
2402 // "XrdSecGSICRLEXT" default extension of CRL files [.r0]
2403 // "XrdSecGSIUSERCERT" full path to an alternative file
2404 // containing the user certificate
2405 // [$HOME/.globus/usercert.pem]
2406 // "XrdSecGSIUSERKEY" full path to an alternative file
2407 // containing the user key
2408 // [$HOME/.globus/userkey.pem]
2409 // "XrdSecGSIUSERPROXY" full path to an alternative file
2410 // containing the user proxy
2411 // [/tmp/x509up_u<uid>]
2412 // "XrdSecGSIPROXYVALID" validity of proxies in the
2413 // grid-proxy-init format
2414 // ["12:00", i.e. 12 hours]
2415 // "XrdSecGSIPROXYDEPLEN" depth of signature path for proxies;
2416 // use -1 for unlimited [0]
2417 // "XrdSecGSIPROXYKEYBITS" bits in PKI for proxies [default: XrdCryptoDefRSABits]
2418 // "XrdSecGSICACHECK" CA check level [1]:
2419 // 0 do not verify;
2420 // 1 verify if self-signed, warn if not;
2421 // 2 verify in all cases, fail if not possible
2422 // "XrdSecGSICRLCHECK" CRL check level [2]:
2423 // 0 don't care;
2424 // 1 use if available;
2425 // 2 require,
2426 // 3 require non-expired CRL
2427 // "XrdSecGSIDELEGPROXY" Forwarding of credentials option:
2428 // 0 deny; 1 sign request created
2429 // by server; 2 forward local proxy
2430 // (include private key) [1]
2431 // "XrdSecGSICREATEPROXY" Controls use of proxy [1]:
2432 // 1 auto-generate proxy from the cert/key pair if no one is not found
2433 // 0 a proxy is used if present; else, the cert/key pair is used if present.
2434 // "XrdSecGSISRVNAMES" Server names allowed: if the server CN
2435 // does not match any of these, or it is
2436 // explicitely denied by these, or it is
2437 // not in the form "*/<hostname>", the
2438 // handshake fails.
2439 // "XrdSecGSIUSEDEFAULTHASH" If this variable is set only the default
2440 // name hashing algorithm is used
2441
2442 //
2443 opts.mode = mode;
2444 // debug
2445 cenv = getenv("XrdSecDEBUG");
2446 if (cenv)
2447 {if (cenv[0] >= 49 && cenv[0] <= 51) opts.debug = atoi(cenv);
2448 else {PRINT("unsupported debug value from env XrdSecDEBUG: "<<cenv<<" - setting to 1");
2449 opts.debug = 1;
2450 }
2451 }
2452
2453 // directory with CA certificates
2454 cenv = (getenv("XrdSecGSICADIR") ? getenv("XrdSecGSICADIR")
2455 : getenv("X509_CERT_DIR"));
2456 if (cenv)
2457 opts.certdir = strdup(cenv);
2458
2459 // directory with CRL info
2460 cenv = (getenv("XrdSecGSICRLDIR") ? getenv("XrdSecGSICRLDIR")
2461 : getenv("X509_CERT_DIR"));
2462 if (cenv)
2463 opts.crldir = strdup(cenv);
2464
2465 // Default extension CRL files
2466 cenv = getenv("XrdSecGSICRLEXT");
2467 if (cenv)
2468 opts.crlext = strdup(cenv);
2469
2470 // CRL refresh or expiration time
2471 cenv = getenv("XrdSecGSICRLRefresh");
2472 if (cenv)
2473 opts.crlrefresh = atoi(cenv);
2474
2475 // file with user cert
2476 cenv = (getenv("XrdSecGSIUSERCERT") ? getenv("XrdSecGSIUSERCERT")
2477 : getenv("X509_USER_CERT"));
2478 if (cenv)
2479 opts.cert = strdup(cenv);
2480
2481 // file with user key
2482 cenv = (getenv("XrdSecGSIUSERKEY") ? getenv("XrdSecGSIUSERKEY")
2483 : getenv("X509_USER_KEY"));
2484 if (cenv)
2485 opts.key = strdup(cenv);
2486
2487 // file with user proxy
2488 cenv = (getenv("XrdSecGSIUSERPROXY") ? getenv("XrdSecGSIUSERPROXY")
2489 : getenv("X509_USER_PROXY"));
2490 if (cenv)
2491 opts.proxy = strdup(cenv);
2492
2493 // file with user proxy
2494 cenv = getenv("XrdSecGSIPROXYVALID");
2495 if (cenv)
2496 opts.valid = strdup(cenv);
2497
2498 // Depth of signature path for proxies
2499 cenv = getenv("XrdSecGSIPROXYDEPLEN");
2500 if (cenv)
2501 opts.deplen = atoi(cenv);
2502
2503 // Key Bit length
2504 cenv = getenv("XrdSecGSIPROXYKEYBITS");
2505 if (cenv)
2506 opts.bits = atoi(cenv);
2507
2508 // CA verification level
2509 cenv = getenv("XrdSecGSICACHECK");
2510 if (cenv)
2511 opts.ca = atoi(cenv);
2512
2513 // CRL check level
2514 cenv = getenv("XrdSecGSICRLCHECK");
2515 if (cenv)
2516 opts.crl = atoi(cenv);
2517
2518 // Delegate proxy
2519 cenv = getenv("XrdSecGSIDELEGPROXY");
2520 if (cenv)
2521 opts.dlgpxy = atoi(cenv);
2522
2523 // No proxy
2524 cenv = getenv("XrdSecGSICREATEPROXY");
2525 if (cenv)
2526 opts.createpxy = atoi(cenv);
2527
2528 // Allowed server name formats
2529 cenv = getenv("XrdSecGSISRVNAMES");
2530 if (cenv)
2531 opts.srvnames = strdup(cenv);
2532
2533 // Name hashing algorithm
2534 cenv = getenv("XrdSecGSIUSEDEFAULTHASH");
2535 if (cenv)
2536 opts.hashcomp = 0;
2537
2538 // DNS trusting control
2539 if ((cenv = getenv("XrdSecGSITRUSTDNS")))
2540 opts.trustdns = (!strcmp(cenv, "0")) ? false : true;
2541
2542 //
2543 // Setup the object with the chosen options
2544 rc = XrdSecProtocolgsi::Init(opts,erp);
2545
2546 // Notify init options, if required or in case of init errors
2547 if (!rc) opts.debug = 1;
2548 opts.Print(gsiTrace);
2549
2550 // Some cleanup
2551 SafeFree(opts.certdir);
2552 SafeFree(opts.crldir);
2553 SafeFree(opts.crlext);
2554 SafeFree(opts.cert);
2555 SafeFree(opts.key);
2556 SafeFree(opts.proxy);
2557 SafeFree(opts.valid);
2558 SafeFree(opts.srvnames);
2559
2560 // We are done
2561 return rc;
2562 }
2563
2564 // Take into account xrootd debug flag
2565 cenv = getenv("XRDDEBUG");
2566 if (cenv && !strcmp(cenv,"1")) opts.debug = 1;
2567
2568 //
2569 // Server initialization
2570 if (parms) {
2571 //
2572 // Duplicate the parms
2573 char parmbuff[1024];
2574 strlcpy(parmbuff, parms, sizeof(parmbuff));
2575 //
2576 // The tokenizer
2577 XrdOucTokenizer inParms(parmbuff);
2578 //
2579 // Decode parms:
2580 // for servers:
2581 // [-d:<debug_level>]
2582 // [-c:[-]ssl[:[-]<CryptoModuleName]]
2583 // [-certdir:<dir_with_CA_info>]
2584 // [-crldir:<dir_with_CRL_info>]
2585 // [-crlext:<default_extension_CRL_files>]
2586 // [-cert:<path_to_server_certificate>]
2587 // [-key:<path_to_server_key>]
2588 // [-cipher:<list_of_supported_ciphers>]
2589 // [-md:<list_of_supported_digests>]
2590 // [-ca:<crl_verification_level>]
2591 // [-crl:<crl_check_level>]
2592 // [-crlrefresh:<crl_refresh_time>]
2593 // [-gridmap:<grid_map_file>]
2594 // [-gmapfun:<grid_map_function>]
2595 // [-gmapfunparms:<grid_map_function_init_parameters>]
2596 // [-authzcall:<authz_callopt>]
2597 // [-authzfun:<authz_function>]
2598 // [-authzfunparms:<authz_function_init_parameters>]
2599 // [-authzto:<authz_cache_entry_validity_in_secs>]
2600 // [-gmapto:<grid_map_cache_entry_validity_in_secs>]
2601 // [-gmapopt:<grid_map_check_option>]
2602 // [-dlgpxy:<proxy_req_option>]
2603 // [-exppxy:<filetemplate>]
2604 // [-authzpxy]
2605 // [-vomsat:<voms_option>]
2606 // [-vomsfun:<voms_function>]
2607 // [-vomsfunparms:<voms_function_init_parameters>]
2608 // [-defaulthash]
2609 // [-trustdns:<0|1>]
2610 //
2611 int debug = -1;
2612 String clist = "";
2613 String certdir = "";
2614 String crldir = "";
2615 String crlext = "";
2616 String cert = "";
2617 String key = "";
2618 String cipher = "";
2619 String md = "";
2620 String gridmap = "";
2621 String gmapfun = "";
2622 String gmapfunparms = "";
2623 String authzfun = "";
2624 String authzfunparms = "";
2625 String vomsfun = "";
2626 String vomsfunparms = "";
2627 String exppxy = "";
2628 int ca = 1;
2629 int crl = 1;
2630 int crlrefresh = 86400;
2631 int ogmap = 1;
2632 int gmapto = 600;
2633 int authzto = -1;
2634 int authzcall = 1;
2635 int dlgpxy = dlgIgnore;
2636 int authzpxy = 0;
2637 int vomsat = vatIgnore; // Was 1 or extract
2638 int moninfo = 0;
2639 int hashcomp = 1;
2640 int trustdns = false;
2641 int showDN = false;
2642 char *op = 0;
2643 while (inParms.GetLine()) {
2644 while ((op = inParms.GetToken())) {
2645 if (!strncmp(op, "-d:",3)) {
2646 debug = atoi(op+3);
2647 } else if (!strncmp(op, "-c:",3)) {
2648 clist = (const char *)(op+3);
2649 } else if (!strncmp(op, "-certdir:",9)) {
2650 certdir = (const char *)(op+9);
2651 } else if (!strncmp(op, "-crldir:",8)) {
2652 crldir = (const char *)(op+8);
2653 } else if (!strncmp(op, "-crlext:",8)) {
2654 crlext = (const char *)(op+8);
2655 } else if (!strncmp(op, "-cert:",6)) {
2656 cert = (const char *)(op+6);
2657 } else if (!strncmp(op, "-key:",5)) {
2658 key = (const char *)(op+5);
2659 } else if (!strncmp(op, "-cipher:",8)) {
2660 cipher = (const char *)(op+8);
2661 } else if (!strncmp(op, "-md:",4)) {
2662 md = (const char *)(op+4);
2663 } else if (!strncmp(op, "-ca:",4)) {
2664 ca = getOptVal(caVerOpts, op+4);
2665 ca = atoi(op+4);
2666 } else if (!strncmp(op, "-crl:",5)) {
2667 crl = getOptVal(crlOpts, op+5);
2668 } else if (!strncmp(op, "-crlrefresh:",12)) {
2669 crlrefresh = atoi(op+12);
2670 } else if (!strncmp(op, "-gmapopt:",9)) {
2671 ogmap = getOptVal(gmoOpts, op+9);
2672 } else if (!strncmp(op, "-gridmap:",9)) {
2673 gridmap = (const char *)(op+9);
2674 } else if (!strncmp(op, "-gmapfun:",9)) {
2675 gmapfun = (const char *)(op+9);
2676 } else if (!strncmp(op, "-gmapfunparms:",14)) {
2677 gmapfunparms = (const char *)(op+14);
2678 } else if (!strncmp(op, "-authzcall:",11)) {
2679 authzcall = getOptVal(azCallOpts, op+11);
2680 } else if (!strncmp(op, "-authzfun:",10)) {
2681 authzfun = (const char *)(op+10);
2682 } else if (!strncmp(op, "-authzfunparms:",15)) {
2683 authzfunparms = (const char *)(op+15);
2684 } else if (!strncmp(op, "-authzto:",9)) {
2685 authzto = atoi(op+9);
2686 } else if (!strncmp(op, "-gmapto:",8)) {
2687 gmapto = atoi(op+8);
2688 } else if (!strncmp(op, "-dlgpxy:",8)) {
2689 opts.dlgpxy = getOptVal(sDlgOpts, op+8);
2690 } else if (!strncmp(op, "-exppxy:",8)) {
2691 exppxy = (const char *)(op+8);
2692 } else if (!strncmp(op, "-authzpxy:",10)) {
2693 opts.authzpxy = getOptVal(azPxyOpts, op+10);
2694 } else if (!strncmp(op, "-authzpxy",9)) {
2695 authzpxy = 11;
2696 } else if (!strncmp(op, "-vomsat:",8)) {
2697 vomsat = getOptVal(vomsatOpts, op+8);
2698 } else if (!strncmp(op, "-vomsfun:",9)) {
2699 vomsfun = (const char *)(op+9);
2700 } else if (!strncmp(op, "-vomsfunparms:",14)) {
2701 vomsfunparms = (const char *)(op+14);
2702 } else if (!strcmp(op, "-moninfo")) {
2703 moninfo = 1;
2704 } else if (!strncmp(op, "-moninfo:",9)) {
2705 moninfo = atoi(op+9);
2706 } else if (!strcmp(op, "-defaulthash")) {
2707 hashcomp = 0;
2708 } else if (!strncmp(op, "-trustdns:",10)) {
2709 trustdns = getOptVal(tdnsOpts, op+10);
2710 } else if (!strncmp(op, "-showdn:",8)) {
2711 showDN = getOptVal(tdnsOpts, op+8);
2712 } else {
2713 PRINT("ignoring unknown switch: "<<op);
2714 }
2715 }
2716 }
2717
2718 // If vomsfun is 'default' substitute the default plugin. The go on to
2719 // resolve conflicts between vomsfun and vomsat options. So, if vomsfun
2720 // was specified but vomsat is set to 'ignore' then we set vomsat to be
2721 // 'required'.
2722 //
2723 if (vomsfun.length() > 0)
2724 {if (vomsat == vatIgnore) vomsat = vatExtract;
2725 if (vomsfun == "default") vomsfun = LIB_XRDVOMS;
2726 } else authzcall = azAlways;
2727
2728 //
2729 // Build the option object
2730 opts.debug = (debug > -1) ? debug : opts.debug;
2731 opts.mode = 's';
2732 opts.ca = ca;
2733 opts.crl = crl;
2734 opts.crlrefresh = crlrefresh;
2735 opts.ogmap = ogmap;
2736 opts.gmapto = gmapto;
2737 opts.authzcall = authzcall;
2738 opts.authzto = authzto;
2739 opts.dlgpxy = (dlgpxy >= dlgIgnore && dlgpxy <= dlgReqSign) ? dlgpxy : 0;
2740 opts.authzpxy = authzpxy;
2741 opts.vomsat = vomsat;
2742 opts.moninfo = moninfo;
2743 opts.hashcomp = hashcomp;
2744 opts.trustdns = (trustdns <= 0) ? false : true;
2745 opts.showDN = (showDN > 0) ? true : false;
2746 if (clist.length() > 0)
2747 opts.clist = (char *)clist.c_str();
2748 if (certdir.length() > 0)
2749 opts.certdir = (char *)certdir.c_str();
2750 if (crldir.length() > 0)
2751 opts.crldir = (char *)crldir.c_str();
2752 if (crlext.length() > 0)
2753 opts.crlext = (char *)crlext.c_str();
2754 if (cert.length() > 0)
2755 opts.cert = (char *)cert.c_str();
2756 if (key.length() > 0)
2757 opts.key = (char *)key.c_str();
2758 if (cipher.length() > 0)
2759 opts.cipher = (char *)cipher.c_str();
2760 if (md.length() > 0)
2761 opts.md = (char *)md.c_str();
2762 if (gridmap.length() > 0)
2763 opts.gridmap = (char *)gridmap.c_str();
2764 if (gmapfun.length() > 0)
2765 opts.gmapfun = (char *)gmapfun.c_str();
2766 if (gmapfunparms.length() > 0)
2767 opts.gmapfunparms = (char *)gmapfunparms.c_str();
2768 if (authzfun.length() > 0)
2769 opts.authzfun = (char *)authzfun.c_str();
2770 if (authzfunparms.length() > 0)
2771 opts.authzfunparms = (char *)authzfunparms.c_str();
2772 if (exppxy.length() > 0)
2773 opts.exppxy = (char *)exppxy.c_str();
2774 if (vomsfun.length() > 0)
2775 opts.vomsfun = (char *)vomsfun.c_str();
2776 if (vomsfunparms.length() > 0)
2777 opts.vomsfunparms = (char *)vomsfunparms.c_str();
2778
2779 // Notify init options, if required
2780 opts.Print(gsiTrace);
2781
2782 //
2783 // Setup the plug-in with the chosen options
2784 return XrdSecProtocolgsi::Init(opts,erp);
2785 }
2786
2787 // Notify init options, if required
2788 opts.Print(gsiTrace);
2789 //
2790 // Setup the plug-in with the defaults
2791 return XrdSecProtocolgsi::Init(opts,erp);
2792}}
2793
2794
2795/******************************************************************************/
2796/* X r d S e c P r o t o c o l g s i O b j e c t */
2797/******************************************************************************/
2798
2800
2801namespace
2802{XrdVersionInfo *gsiVersion = &XrdVERSIONINFOVAR(XrdSecProtocolgsiObject);}
2803
2804extern "C"
2805{
2807 const char *hostname,
2808 XrdNetAddrInfo &endPoint,
2809 const char *parms,
2810 XrdOucErrInfo *erp)
2811{
2812 XrdSecProtocolgsi *prot;
2813 int options = XrdSecNOIPCHK;
2814
2815 //
2816 // Get a new protocol object
2817 if (!(prot = new XrdSecProtocolgsi(options, hostname, endPoint, parms))) {
2818 const char *msg = "Secgsi: Insufficient memory for protocol.";
2819 if (erp)
2820 erp->setErrInfo(ENOMEM, msg);
2821 else
2822 std::cerr <<msg <<std::endl;
2823 return (XrdSecProtocol *)0;
2824 }
2825 //
2826 // We are done
2827 if (!erp)
2828 std::cerr << "protocol object instantiated" << std::endl;
2829 return prot;
2830}}
2831
2832
2833/******************************************************************************/
2834/* P r i v a t e M e t h o d s */
2835/******************************************************************************/
2836
2837//_________________________________________________________________________
2838int XrdSecProtocolgsi::AddSerialized(char opt, kXR_int32 step, String ID,
2839 XrdSutBuffer *bls, XrdSutBuffer *buf,
2840 kXR_int32 type,
2841 XrdCryptoCipher *cip)
2842{
2843 // Serialize buf, and add it encrypted to bls as bucket type
2844 // Cipher cip is used if defined; else PuK rsa .
2845 // If both are undefined the buffer is just serialized and added.
2846 EPNAME("AddSerialized");
2847
2848 if (!bls || !buf || (opt != 0 && opt != 'c' && opt != 's')) {
2849 PRINT("invalid inputs ("
2850 <<bls<<","<<buf<<","<<opt<<")"
2851 <<" - type: "<<XrdSutBuckStr(type));
2852 return -1;
2853 }
2854
2855 //
2856 // Add step to indicate the counterpart what we send
2857 if (step > 0) {
2858 bls->SetStep(step);
2859 buf->SetStep(step);
2860 hs->LastStep = step;
2861 }
2862
2863 //
2864 // If a random tag has been sent and we have a session cipher,
2865 // we sign it
2866 XrdSutBucket *brt = buf->GetBucket(kXRS_rtag);
2867 if (brt && sessionKsig) {
2868 //
2869 // Encrypt random tag with session cipher
2870 if (sessionKsig->EncryptPrivate(*brt) <= 0) {
2871 PRINT("error encrypting random tag");
2872 return -1;
2873 }
2874 //
2875 // Update type
2876 brt->type = kXRS_signed_rtag;
2877 }
2878 //
2879 // Add an random challenge: if a next exchange is required this will
2880 // allow to prove authenticity of counter part
2881 //
2882 // Generate new random tag and create a bucket
2883 if (!(opt == 'c' && step == kXGC_sigpxy)) {
2884 String RndmTag;
2885 XrdSutRndm::GetRndmTag(RndmTag);
2886 //
2887 // Get bucket
2888 brt = 0;
2889 if (!(brt = new XrdSutBucket(RndmTag,kXRS_rtag))) {
2890 PRINT("error creating random tag bucket");
2891 return -1;
2892 }
2893 buf->AddBucket(brt);
2894 }
2895 //
2896 // Get cache entry
2897 if (!hs->Cref) {
2898 PRINT("cache entry not found: protocol error");
2899 return -1;
2900 }
2901 //
2902 // Add random tag to the cache and update timestamp
2903 hs->Cref->buf1.SetBuf(brt->buffer,brt->size);
2904 hs->Cref->mtime = (kXR_int32)hs->TimeStamp;
2905 //
2906 // Now serialize the buffer ...
2907 char *bser = 0;
2908 int nser = buf->Serialized(&bser);
2909 //
2910 // Update bucket with this content
2911 XrdSutBucket *bck = 0;;
2912 if (!(bck = bls->GetBucket(type))) {
2913 // or create new bucket, if not existing
2914 if (!(bck = new XrdSutBucket(bser,nser,type))) {
2915 PRINT("error creating bucket "
2916 <<" - type: "<<XrdSutBuckStr(type));
2917 return -1;
2918 }
2919 //
2920 // Add the bucket to the list
2921 bls->AddBucket(bck);
2922 } else {
2923 bck->Update(bser,nser);
2924 }
2925 //
2926 // Encrypted the bucket
2927 if (cip) {
2928 if (cip->Encrypt(*bck, useIV) == 0) {
2929 PRINT("error encrypting bucket - cipher "
2930 <<" - type: "<<XrdSutBuckStr(type));
2931 return -1;
2932 }
2933 }
2934 // We are done
2935 return 0;
2936}
2937
2938//_________________________________________________________________________
2939int XrdSecProtocolgsi::ParseClientInput(XrdSutBuffer *br, XrdSutBuffer **bm,
2940 String &cmsg)
2941{
2942 // Parse received buffer b,
2943 // Result used to fill the handshake local variables
2944 EPNAME("ParseClientInput");
2945
2946 // Space for pointer to main buffer must be already allocated
2947 if (!br || !bm) {
2948 PRINT("invalid inputs ("<<br<<","<<bm<<")");
2949 cmsg = "invalid inputs";
2950 return -1;
2951 }
2952
2953 //
2954 // Get the step
2955 int step = br->GetStep();
2956
2957 // Do the right action
2958 switch (step) {
2959 case kXGS_init:
2960 // Process message
2961 if (ClientDoInit(br, bm, cmsg) != 0)
2962 return -1;
2963 break;
2964 case kXGS_cert:
2965 // Process message
2966 if (ClientDoCert(br, bm, cmsg) != 0)
2967 return -1;
2968 break;
2969 case kXGS_pxyreq:
2970 // Process message
2971 if (ClientDoPxyreq(br, bm, cmsg) != 0)
2972 return -1;
2973 break;
2974 default:
2975 cmsg = "protocol error: unknown action: "; cmsg += step;
2976 return -1;
2977 break;
2978 }
2979
2980 // We are done
2981 return 0;
2982}
2983
2984//_________________________________________________________________________
2985int XrdSecProtocolgsi::ClientDoInit(XrdSutBuffer *br, XrdSutBuffer **bm,
2986 String &emsg)
2987{
2988 // Client side: process a kXGS_init message.
2989 // Return 0 on success, -1 on error. If the case, a message is returned
2990 // in cmsg.
2991 EPNAME("ClientDoInit");
2992
2993 //
2994 // Create the main buffer as a copy of the buffer received
2995 if (!((*bm) = new XrdSutBuffer(br->GetProtocol(),br->GetOptions()))) {
2996 emsg = "error instantiating main buffer";
2997 return -1;
2998 }
2999 //
3000 // Extract server version from options
3001 String opts = br->GetOptions();
3002 int ii = opts.find("v:");
3003 if (ii >= 0) {
3004 String sver(opts,ii+2);
3005 sver.erase(sver.find(','));
3006 hs->RemVers = atoi(sver.c_str());
3007 } else {
3008 hs->RemVers = Version;
3009 emsg = "server version information not found in options:"
3010 " assume same as local";
3011 }
3012 // Set use IV depending on the remote version
3013 useIV = false;
3014 if (hs->RemVers >= XrdSecgsiVersDHsigned) {
3015 // Supports setting a unique IV in enc/dec operations
3016 useIV = true;
3017 }
3018 //
3019 // Create cache
3020 if (!(hs->Cref = new XrdSutPFEntry("c"))) {
3021 emsg = "error creating cache";
3022 return -1;
3023 }
3024 //
3025 // Save server version in cache
3026 hs->Cref->status = hs->RemVers;
3027 //
3028 // Set options
3029 hs->Options = PxyReqOpts;
3030 //
3031 // Extract list of crypto modules
3032 String clist;
3033 ii = opts.find("c:");
3034 if (ii >= 0) {
3035 clist.assign(opts, ii+2);
3036 clist.erase(clist.find(','));
3037 } else {
3038 NOTIFY("Crypto list missing: protocol error? (use defaults)");
3039 clist = DefCrypto;
3040 }
3041 // Parse the list loading the first we can
3042 if (ParseCrypto(clist) != 0) {
3043 emsg = "cannot find / load crypto requested modules :";
3044 emsg += clist;
3045 return -1;
3046 }
3047 //
3048 // Extract server certificate CA hashes
3049 String srvca;
3050 ii = opts.find("ca:");
3051 if (ii >= 0) {
3052 srvca.assign(opts, ii+3);
3053 srvca.erase(srvca.find(','));
3054 }
3055 // Parse the list loading the first we can
3056 if (ParseCAlist(srvca) != 0) {
3057 emsg = "unknown CA: cannot verify server certificate";
3058 hs->Chain = 0;
3059 return -1;
3060 }
3061
3062 //
3063 // Extract no proxy option, if any
3064 bool createpxy = (PxyReqOpts & kOptsCreatePxy) ? 1 : 0;
3065 if (hs->RemVers < XrdSecgsiVersCertKey && !createpxy) {
3066 // Server does not accept pure cert files
3067 createpxy = 1;
3068 DEBUG("Server does not accept pure cert/key authentication: version < "<< (int)XrdSecgsiVersCertKey);
3069 }
3070
3071 //
3072 // Resolve place-holders in cert, key and proxy file paths, if any
3073 if (XrdSutResolve(UsrCert, Entity.host, Entity.vorg, Entity.grps, Entity.name) != 0) {
3074 PRINT("Problems resolving templates in "<<UsrCert);
3075 return -1;
3076 }
3077 if (XrdSutResolve(UsrKey, Entity.host, Entity.vorg, Entity.grps, Entity.name) != 0) {
3078 PRINT("Problems resolving templates in "<<UsrKey);
3079 return -1;
3080 }
3081 //
3082 // In the standard case we need to resolve also the proxy file path
3083 // Get the proxy path
3084 if (XrdSutResolve(UsrProxy, Entity.host, Entity.vorg, Entity.grps, Entity.name) != 0) {
3085 PRINT("Problems resolving templates in "<<UsrProxy);
3086 return -1;
3087 }
3088 //
3089 // Load / Attach-to user proxies
3090 ProxyIn_t pi = {UsrCert.c_str(), UsrKey.c_str(), CAdir.c_str(),
3091 UsrProxy.c_str(), PxyValid.c_str(),
3092 DepLength, DefBits, createpxy};
3093 ProxyOut_t po = {hs->PxyChain, sessionKsig, hs->Cbck };
3094 if (QueryProxy(1, &cachePxy, UsrProxy.c_str(),
3095 sessionCF, hs->TimeStamp, &pi, &po) != 0) {
3096 emsg = "error getting user proxies";
3097 hs->Chain = 0;
3098 return -1;
3099 }
3100
3101 if (!po.cbck) {
3102 emsg = "failed to initialize user proxies";
3103 hs->Chain = 0;
3104 return -1;
3105 }
3106
3107 // Save the result
3108 hs->PxyChain = po.chain;
3109 hs->Cbck = new XrdSutBucket(*((XrdSutBucket *)(po.cbck)));
3110 if (!po.ksig || !(sessionKsig = sessionCF->RSA(*(po.ksig)))) {
3111 emsg = "could not get a copy of the signing key:";
3112 hs->Chain = 0;
3113 return -1;
3114 }
3115 //
3116 // And we are done;
3117 return 0;
3118}
3119
3120//_________________________________________________________________________
3121int XrdSecProtocolgsi::ClientDoCert(XrdSutBuffer *br, XrdSutBuffer **bm,
3122 String &emsg)
3123{
3124 // Client side: process a kXGS_cert message.
3125 // Return 0 on success, -1 on error. If the case, a message is returned
3126 // in cmsg.
3127 EPNAME("ClientDoCert");
3128 XrdSutBucket *bck = 0;
3129
3130 //
3131 // make sure the cache is still there
3132 if (!hs->Cref) {
3133 emsg = "cache entry not found";
3134 hs->Chain = 0;
3135 return -1;
3136 }
3137 //
3138 // make sure is not too old
3139 int reftime = hs->TimeStamp - TimeSkew;
3140 if (hs->Cref->mtime < reftime) {
3141 emsg = "cache entry expired";
3142 // Remove: should not be checked a second time
3143 SafeDelete(hs->Cref);
3144 hs->Chain = 0;
3145 return -1;
3146 }
3147 //
3148 // Get from cache version run by server
3149 hs->RemVers = hs->Cref->status;
3150
3151 //
3152 // Extract list of cipher algorithms supported by the server
3153 String cip = "";
3154 if ((bck = br->GetBucket(kXRS_cipher_alg))) {
3155 String ciplist;
3156 bck->ToString(ciplist);
3157 // Parse the list
3158 int from = 0;
3159 while ((from = ciplist.tokenize(cip, from, ':')) != -1) {
3160 if (cip.length() > 0)
3161 if (sessionCF->SupportedCipher(cip.c_str()))
3162 break;
3163 cip = "";
3164 }
3165 // Must have a common cipher algorithm
3166 if (cip.length() <= 0) {
3167 emsg = "no common cipher algorithm";
3168 hs->Chain = 0;
3169 return -1;
3170 }
3171 } else {
3172 NOTIFY("WARNING: list of ciphers supported by server missing"
3173 " - using default");
3174 }
3175
3176 //
3177 // Extract server certificate
3178 if (!(bck = br->GetBucket(kXRS_x509))) {
3179 emsg = "server certificate missing";
3180 hs->Chain = 0;
3181 return -1;
3182 }
3183
3184 //
3185 // Finalize chain: get a copy of it (we do not touch the reference)
3186 hs->Chain = new X509Chain(hs->Chain);
3187 if (!(hs->Chain)) {
3188 emsg = "cannot duplicate reference chain";
3189 return -1;
3190 }
3191 // The new chain must be deleted at destruction
3192 hs->Options |= kOptsDelChn;
3193
3194 // Get hook to parsing function
3195 XrdCryptoX509ParseBucket_t ParseBucket = sessionCF->X509ParseBucket();
3196 if (!ParseBucket) {
3197 emsg = "cannot attach to ParseBucket function!";
3198 return -1;
3199 }
3200 // Parse bucket
3201 int nci = (*ParseBucket)(bck, hs->Chain);
3202 if (nci != 1) {
3203 emsg += nci;
3204 emsg += " vs 1 expected)";
3205 return -1;
3206 }
3207 //
3208 // Verify the chain
3209 x509ChainVerifyOpt_t vopt = {0,static_cast<int>(hs->TimeStamp),-1,hs->Crl};
3211 if (!(hs->Chain->Verify(ecode, &vopt))) {
3212 emsg = "certificate chain verification failed: ";
3213 emsg += hs->Chain->LastError();
3214 return -1;
3215 }
3216 //
3217 // Verify server identity using RFC2818 method
3218 //
3219
3220 // First we check the SAN. If the check succeeds then we are all done.
3221 // Otherwise, if there is no SAN extension or if trustDNS is in effect,
3222 // we check if the common name matches.
3223 //
3224 DEBUG("Checking cert is for host " <<Entity.host);
3225
3226 bool hasSAN, usedDNS = false;
3227 const char *wantHost = (Entity.host ? Entity.host : "");
3228
3229 if (!hs->Chain->End()->MatchesSAN(Entity.host, hasSAN))
3230 {if (hasSAN && !TrustDNS)
3231 {emsg = "Unable to verify server hostname '"; emsg += wantHost;
3232 emsg+= "' using SAN extension; common name fallback disallowed.";
3233 return -1;
3234 }
3235 // If the common name check fails, TrustDNS allows fallback
3236 if (!ServerCertNameOK(hs->Chain->End()->Subject(),Entity.host,emsg))
3237 {if (!TrustDNS || Entity.addrInfo == 0 || expectedHost)
3238 {emsg = "Unable to verify server hostname '"; emsg += wantHost;
3239 emsg+= "' using common name; DNS fallback prohibited.";
3240 return -1;
3241 }
3242 // Use DNS to resolve possible alias name
3243 const char *name = Entity.addrInfo->Name();
3244 if (name == NULL)
3245 {emsg = "Unable to verify server hostname '"; emsg += wantHost;
3246 emsg+= "'; DNS fallback translation failed.";
3247 return -1;
3248 }
3249 DEBUG("TrustDNS: checking if cert is for host " <<name);
3250 usedDNS = true;
3251 bool hostOK = ServerCertNameOK(hs->Chain->End()->Subject(),name,emsg)
3252 || (hasSAN && hs->Chain->End()->MatchesSAN(name,hasSAN));
3253 if (!hostOK) return -1;
3254 }
3255 }
3256
3257 // If we used the DNS then we must prohibit proxy delegation of any kind
3258 //
3259 // In the case of delegation, give client a chance to use XrdSecGSISRVNAMES
3260 // to limit where it is being redirected to. If the new destination does not
3261 // match XrdSecGSISRVNAMES, refuse to delegate.
3262 //
3263 if (usedDNS ||
3264 (SrvAllowedNames.length() > 0 &&
3265 !ServerCertNameOK(hs->Chain->End()->Subject(), NULL, emsg)))
3266 {if (hs->Options & (kOptsFwdPxy | kOptsSigReq))
3267 {hs->Options &= ~(kOptsFwdPxy | kOptsSigReq);
3268 std::cerr <<"secgsi: proxy delegation forbidden when trusting DNS "
3269 "to resolve '" <<wantHost <<"'!\n" <<std::flush;
3270 }
3271 }
3272
3273 //
3274 // Extract the server key
3275 sessionKver = sessionCF->RSA(*(hs->Chain->End()->PKI()));
3276 if (!sessionKver || !sessionKver->IsValid()) {
3277 emsg = "server certificate contains an invalid key";
3278 return -1;
3279 }
3280 // Move next part to here, after sessionKver set, in order to
3281 // verify the signature of DH parameters
3282
3283 //
3284 // If client supports decoding of signed DH, do sign them
3285 if (hs->RemVers >= XrdSecgsiVersDHsigned) {
3286
3287 // Extract server public part for session cipher
3288 if (!(bck = br->GetBucket(kXRS_cipher))) {
3289 emsg = "server public part for session cipher missing";
3290 hs->Chain = 0;
3291 return -1;
3292 }
3293
3294 // Encrypt server DH public parameters with server key
3295 if (sessionKver->DecryptPublic(*bck) <= 0) {
3296 emsg = "decrypting server DH public parameters";
3297 return -1;
3298 }
3299 } else {
3300
3301 // Extract server public part for session cipher
3302 if (!(bck = br->GetBucket(kXRS_puk))) {
3303 emsg = "server public part for session cipher missing";
3304 hs->Chain = 0;
3305 return -1;
3306 }
3307
3308 // If the server doesn't provide signed DH parameter, disable proxy delegation
3309 if (hs->Options & (kOptsFwdPxy | kOptsSigReq)) {
3310 hs->Options &= ~(kOptsFwdPxy | kOptsSigReq);
3311 PRINT("no signed DH parameters from " << Entity.host
3312 << ". Will not delegate x509 proxy to it");
3313 }
3314 }
3315
3316 //
3317 // Initialize session cipher
3318 SafeDelete(sessionKey);
3319 if (!(sessionKey =
3320 sessionCF->Cipher(hs->HasPad, 0,bck->buffer,bck->size,cip.c_str())) || !(sessionKey->IsValid())) {
3321 PRINT("could not instantiate session cipher "
3322 "using cipher public info from server");
3323 emsg = "could not instantiate session cipher ";
3324 return -1;
3325 }
3326
3327 //
3328 // Communicate the cipher name to server
3329 if (hs->RemVers >= XrdSecgsiVersDHsigned) {
3330 // Including the length of the IV if supported
3331 String cipiv;
3332 String::form(cipiv, "%s#%d", cip.c_str(), sessionKey->MaxIVLength());
3333 br->UpdateBucket(cipiv, kXRS_cipher_alg);
3334 } else {
3335 br->UpdateBucket(cip, kXRS_cipher_alg);
3336 }
3337
3338 // Deactivate what not needed any longer
3339 if (hs->RemVers >= XrdSecgsiVersDHsigned) {
3341 } else {
3342 br->Deactivate(kXRS_puk);
3343 }
3344 br->Deactivate(kXRS_x509);
3345
3346 //
3347 // Extract list of MD algorithms supported by the server
3348 String md = "";
3349 if ((bck = br->GetBucket(kXRS_md_alg))) {
3350 String mdlist;
3351 bck->ToString(mdlist);
3352 // Parse the list
3353 int from = 0;
3354 while ((from = mdlist.tokenize(md, from, ':')) != -1) {
3355 if (md.length() > 0)
3356 if (sessionCF->SupportedMsgDigest(md.c_str()))
3357 break;
3358 md = "";
3359 }
3360 } else {
3361 NOTIFY("WARNING: list of digests supported by server missing"
3362 " - using default");
3363 md = "sha256";
3364 }
3365 if (!(sessionMD = sessionCF->MsgDigest(md.c_str()))) {
3366 emsg = "could not instantiate digest object";
3367 return -1;
3368 }
3369 // Communicate choice to server
3370 br->UpdateBucket(md, kXRS_md_alg);
3371
3372 //
3373 // Extract the main buffer (it contains the random challenge
3374 // and will contain our credentials encrypted)
3375 XrdSutBucket *bckm = 0;
3376 if (!(bckm = br->GetBucket(kXRS_main))) {
3377 emsg = "main buffer missing";
3378 return -1;
3379 }
3380
3381 //
3382 // Deserialize main buffer
3383 if (!((*bm) = new XrdSutBuffer(bckm->buffer,bckm->size))) {
3384 emsg = "error deserializing main buffer";
3385 return -1;
3386 }
3387
3388 //
3389 // And we are done;
3390 return 0;
3391}
3392
3393//_________________________________________________________________________
3394int XrdSecProtocolgsi::ClientDoPxyreq(XrdSutBuffer *br, XrdSutBuffer **bm,
3395 String &emsg)
3396{
3397 // Client side: process a kXGS_pxyreq message.
3398 // Return 0 on success, -1 on error. If the case, a message is returned
3399 // in cmsg.
3400 XrdSutBucket *bck = 0;
3401
3402 //
3403 // Extract the main buffer (it contains the random challenge
3404 // and will contain our credentials encrypted)
3405 XrdSutBucket *bckm = 0;
3406 if (!(bckm = br->GetBucket(kXRS_main))) {
3407 emsg = "main buffer missing";
3408 return -1;
3409 }
3410 //
3411 // Decrypt the main buffer with the session cipher, if available
3412 if (sessionKey) {
3413 if (!(sessionKey->Decrypt(*bckm, useIV))) {
3414 emsg = "error with session cipher";
3415 return -1;
3416 }
3417 }
3418
3419 //
3420 // Deserialize main buffer
3421 if (!((*bm) = new XrdSutBuffer(bckm->buffer,bckm->size))) {
3422 emsg = "error deserializing main buffer";
3423 return -1;
3424 }
3425
3426 //
3427 // Check if we are ready to proces this
3428 if ((hs->Options & kOptsFwdPxy)) {
3429 // We have to send the private key of our proxy
3430 XrdCryptoX509 *pxy = 0;
3431 XrdCryptoRSA *kpxy = 0;
3432 if (!(hs->PxyChain) ||
3433 !(pxy = hs->PxyChain->End()) || !(kpxy = pxy->PKI())) {
3434 emsg = "local proxy info missing or corrupted";
3435 return 0;
3436 }
3437 // Send back the signed request as bucket
3438 String pri;
3439 if (kpxy->ExportPrivate(pri) != 0) {
3440 emsg = "problems exporting private key";
3441 return 0;
3442 }
3443 // Add it to the main list
3444 if ((*bm)->AddBucket(pri, kXRS_x509) != 0) {
3445 emsg = "problem adding bucket with private key to main buffer";
3446 return 0;
3447 }
3448 } else {
3449 // Proxy request: check if we are allowed to sign it
3450 if (!(hs->Options & kOptsSigReq)) {
3451 emsg = "Not allowed to sign proxy requests";
3452 return 0;
3453 }
3454 // Get the request
3455 if (!(bck = (*bm)->GetBucket(kXRS_x509_req))) {
3456 emsg = "bucket with proxy request missing";
3457 return 0;
3458 }
3459 XrdCryptoX509Req *req = sessionCF->X509Req(bck);
3460 if (!req) {
3461 emsg = "could not resolve proxy request";
3462 return 0;
3463 }
3464 req->SetVersion(hs->RemVers);
3465 // Get our proxy and its private key
3466 XrdCryptoX509 *pxy = 0;
3467 XrdCryptoRSA *kpxy = 0;
3468 if (!(hs->PxyChain) ||
3469 !(pxy = hs->PxyChain->End()) || !(kpxy = pxy->PKI())) {
3470 emsg = "local proxy info missing or corrupted";
3471 return 0;
3472 }
3473 // Sign the request
3474 XrdCryptoX509SignProxyReq_t X509SignProxyReq = (sessionCF) ? sessionCF->X509SignProxyReq() : 0;
3475 if (!X509SignProxyReq) {
3476 emsg = "problems getting method to sign request";
3477 return 0;
3478 }
3479 XrdCryptoX509 *npxy = 0;
3480 if ((*X509SignProxyReq)(pxy, kpxy, req, &npxy) != 0) {
3481 emsg = "problems signing the request";
3482 return 0;
3483 }
3484 delete req;
3485 (*bm)->Deactivate(kXRS_x509_req);
3486
3487 // Send back the signed request as bucket
3488 if ((bck = npxy->Export())) {
3489 // Add it to the main list
3490 if ((*bm)->AddBucket(bck) != 0) {
3491 emsg = "problem adding signed request to main buffer";
3492 return 0;
3493 }
3494 }
3495 delete npxy; // has been allocated in *X509SignProxyReq
3496 }
3497
3498 //
3499 // And we are done;
3500 return 0;
3501
3502}
3503
3504//_________________________________________________________________________
3505int XrdSecProtocolgsi::ParseServerInput(XrdSutBuffer *br, XrdSutBuffer **bm,
3506 String &cmsg)
3507{
3508 // Parse received buffer b, extracting and decrypting the main
3509 // buffer *bm and extracting the session
3510 // cipher, random tag buckets and user name, if any.
3511 // Results used to fill the local handshake variables
3512 EPNAME("ParseServerInput");
3513
3514 // Space for pointer to main buffer must be already allocated
3515 if (!br || !bm) {
3516 PRINT("invalid inputs ("<<br<<","<<bm<<")");
3517 cmsg = "invalid inputs";
3518 return -1;
3519 }
3520
3521 //
3522 // Get the step
3523 int step = br->GetStep();
3524
3525 // Do the right action
3526 switch (step) {
3527 case kXGC_certreq:
3528 // Process message
3529 if (ServerDoCertreq(br, bm, cmsg) != 0)
3530 return -1;
3531 break;
3532 case kXGC_cert:
3533 // Process message
3534 if (ServerDoCert(br, bm, cmsg) != 0)
3535 return -1;
3536 break;
3537 case kXGC_sigpxy:
3538 // Process message
3539 if (ServerDoSigpxy(br, bm, cmsg) != 0)
3540 return -1;
3541 break;
3542 default:
3543 cmsg = "protocol error: unknown action: "; cmsg += step;
3544 return -1;
3545 break;
3546 }
3547
3548 //
3549 // We are done
3550 return 0;
3551}
3552
3553//_________________________________________________________________________
3554int XrdSecProtocolgsi::ServerDoCertreq(XrdSutBuffer *br, XrdSutBuffer **bm,
3555 String &cmsg)
3556{
3557 // Server side: process a kXGC_certreq message.
3558 // Return 0 on success, -1 on error. If the case, a message is returned
3559 // in cmsg.
3560 XrdSutCERef ceref;
3561 XrdSutBucket *bck = 0;
3562 XrdSutBucket *bckm = 0;
3563
3564 //
3565 // Get version run by client, if there
3566 if (br->UnmarshalBucket(kXRS_version,hs->RemVers) != 0) {
3567 hs->RemVers = Version;
3568 cmsg = "client version information not found in options:"
3569 " assume same as local";
3570 } else {
3572 }
3573 // Reset use IV; will be set in next round depending on the remote version
3574 useIV = false;
3575
3576 //
3577 // Extract the main buffer
3578 if (!(bckm = br->GetBucket(kXRS_main))) {
3579 cmsg = "main buffer missing";
3580 return -1;
3581 }
3582 //
3583 // Extract bucket with crypto module
3584 if (!(bck = br->GetBucket(kXRS_cryptomod))) {
3585 cmsg = "crypto module specification missing";
3586 return -1;
3587 }
3588 String cmod;
3589 bck->ToString(cmod);
3590 // Parse the list loading the first we can
3591 if (ParseCrypto(cmod) != 0) {
3592 cmsg = "cannot find / load crypto requested module :";
3593 cmsg += cmod;
3594 return -1;
3595 }
3596 //
3597 // Extract bucket with client issuer hash
3598 if (!(bck = br->GetBucket(kXRS_issuer_hash))) {
3599 cmsg = "client issuer hash missing";
3600 return -1;
3601 }
3602 String cahash;
3603 bck->ToString(cahash);
3604 //
3605 // Check if we know it
3606 if (ParseCAlist(cahash) != 0) {
3607 cmsg = "unknown CA: cannot verify client credentials";
3608 return -1;
3609 }
3610 // Find our certificate in cache
3611 String cadum;
3612 XrdSutCacheEntry *cent = GetSrvCertEnt(ceref, sessionCF, hs->TimeStamp, cadum);
3613 if (!cent) {
3614 cmsg = "cannot find certificate: corruption?";
3615 return -1;
3616 }
3617
3618 // Fill some relevant handshake variables
3619 sessionKsig = sessionCF->RSA(*((XrdCryptoRSA *)(cent->buf2.buf)));
3620 hs->Cbck = new XrdSutBucket(*((XrdSutBucket *)(cent->buf3.buf)));
3621 ceref.UnLock();
3622
3623 // Create a handshake cache
3624 if (!(hs->Cref = new XrdSutPFEntry(hs->ID.c_str()))) {
3625 cmsg = "cannot create cache entry";
3626 return -1;
3627 }
3628 //
3629 // Deserialize main buffer
3630 if (!((*bm) = new XrdSutBuffer(bckm->buffer,bckm->size))) {
3631 cmsg = "error deserializing main buffer";
3632 return -1;
3633 }
3634
3635 // Deactivate what not need any longer
3637
3638 //
3639 // Get options, if any
3640 if (br->UnmarshalBucket(kXRS_clnt_opts, hs->Options) == 0)
3642
3643 // We are done
3644 return 0;
3645}
3646
3647//_________________________________________________________________________
3648int XrdSecProtocolgsi::ServerDoCert(XrdSutBuffer *br, XrdSutBuffer **bm,
3649 String &cmsg)
3650{
3651 // Server side: process a kXGC_cert message.
3652 // Return 0 on success, -1 on error. If the case, a message is returned
3653 // in cmsg.
3654 EPNAME("ServerDoCert");
3655
3656 XrdSutBucket *bck = 0;
3657 XrdSutBucket *bckm = 0;
3658
3659 //
3660 // Extract the main buffer
3661 if (!(bckm = br->GetBucket(kXRS_main))) {
3662 cmsg = "main buffer missing";
3663 return -1;
3664 }
3665 //
3666 // Extract cipher algorithm chosen by the client
3667 int lenIV = 0;
3668 String cip = "";
3669 if ((bck = br->GetBucket(kXRS_cipher_alg))) {
3670 bck->ToString(cip);
3671 // Extract IV length, if any
3672 int piv = cip.find('#');
3673 if (piv >= 0) {
3674 String siv(cip, piv+1);
3675 if (siv.isdigit()) lenIV = siv.atoi();
3676 cip.erase(piv);
3677 }
3678 // Parse the list
3679 if (DefCipher.find(cip) == -1) {
3680 cmsg = "unsupported cipher chosen by the client";
3681 hs->Chain = 0;
3682 return -1;
3683 }
3684 // Deactivate the bucket
3686 } else {
3687 NOTIFY("WARNING: client choice for cipher missing"
3688 " - using default");
3689 }
3690
3691 XrdOucString cpub;
3692 if (hs->RemVers >= XrdSecgsiVersDHsigned) {
3693 // Supports setting a unique IV in enc/dec operations
3694 useIV = true;
3695 // First get the client public key
3696 if (!(bck = br->GetBucket(kXRS_puk))) {
3697 cmsg = "bucket with client public key missing";
3698 return -1;
3699 }
3700 bck->ToString(cpub);
3701 sessionKver = sessionCF->RSA(cpub.c_str(), cpub.length());
3702 if (!sessionKver || !sessionKver->IsValid()) {
3703 cmsg = "bucket with client public key contains an invalid key";
3704 return -1;
3705 }
3706
3707 // Get the client DH parameters
3708 if (!(bck = br->GetBucket(kXRS_cipher))) {
3709 cmsg = "bucket with client DH parameters missing";
3710 return -1;
3711 }
3712
3713 // Decrypt client DH public parameters with client key
3714 if (sessionKver->DecryptPublic(*bck) <= 0) {
3715 cmsg = "decrypting client DH public parameters";
3716 return -1;
3717 }
3718
3719 } else {
3720
3721 // Get the client DH parameters
3722 if (!(bck = br->GetBucket(kXRS_puk))) {
3723 cmsg = "bucket with client DH parameters missing";
3724 return -1;
3725 }
3726
3727 // If the client doesn't provide signed DH parameter, disable proxy delegation
3728 if ((PxyReqOpts & kOptsSrvReq) ||
3730 PRINT("no signed DH parameters from client:" << Entity.tident <<
3731 " : will not delegate x509 proxy to it");
3732 if ((PxyReqOpts & kOptsSrvReq)) PxyReqOpts &= ~kOptsSrvReq;
3735 }
3736
3737 // Get the session cipher
3738 if (bck) {
3739 //
3740 // Cleanup
3741 SafeDelete(sessionKey);
3742 //
3743 // Prepare cipher agreement: make sure we have the reference cipher
3744 if (!hs->Rcip) {
3745 cmsg = "reference cipher missing";
3746 hs->Chain = 0;
3747 return -1;
3748 }
3749 sessionKey = hs->Rcip;
3750 //
3751 // Instantiate the session cipher
3752 if (!(sessionKey->Finalize(hs->HasPad,bck->buffer,bck->size,cip.c_str()))) {
3753 cmsg = "cannot finalize session cipher";
3754 hs->Chain = 0;
3755 return -1;
3756 }
3757
3758 // Set IV length, if any
3759 if (lenIV > 0) sessionKey->SetIV(lenIV, (const char *)0);
3760
3761 } else {
3762 cmsg = "bucket with DH parameters not found or invalid: cannot finalize session cipher";
3763 return -1;
3764 }
3765 //
3766 // We need it only once
3768 br->Deactivate(kXRS_puk);
3769
3770 //
3771 // Decrypt the main buffer with the session cipher, if available
3772 if (sessionKey) {
3773 if (!(sessionKey->Decrypt(*bckm, useIV))) {
3774 cmsg = "error decrypting main buffer with session cipher";
3775 hs->Chain = 0;
3776 return -1;
3777 }
3778 }
3779 //
3780 // Deserialize main buffer
3781 if (!((*bm) = new XrdSutBuffer(bckm->buffer,bckm->size))) {
3782 cmsg = "error deserializing main buffer";
3783 hs->Chain = 0;
3784 return -1;
3785 }
3786 //
3787 // Get version run by client, if there
3788 if (hs->RemVers == -1) {
3789 if ((*bm)->UnmarshalBucket(kXRS_version,hs->RemVers) != 0) {
3790 hs->RemVers = Version;
3791 cmsg = "client version information not found in options:"
3792 " assume same as local";
3793 } else {
3794 (*bm)->Deactivate(kXRS_version);
3795 }
3796 }
3797
3798 //
3799 // Get cache entry
3800 if (!hs->Cref) {
3801 cmsg = "session cache has gone";
3802 hs->Chain = 0;
3803 return -1;
3804 }
3805 //
3806 // make sure cache is not too old
3807 int reftime = hs->TimeStamp - TimeSkew;
3808 if (hs->Cref->mtime < reftime) {
3809 cmsg = "cache entry expired";
3810 SafeDelete(hs->Cref);
3811 hs->Chain = 0;
3812 return -1;
3813 }
3814
3815 //
3816 // Extract the client certificate
3817 if (!(bck = (*bm)->GetBucket(kXRS_x509))) {
3818 cmsg = "client certificate missing";
3819 SafeDelete(hs->Cref);
3820 hs->Chain = 0;
3821 return -1;
3822 }
3823
3824 //
3825 // Finalize chain: get a copy of it (we do not touch the reference)
3826 hs->Chain = new X509Chain(hs->Chain);
3827 if (!(hs->Chain)) {
3828 cmsg = "cannot duplicate reference chain";
3829 return -1;
3830 }
3831 // The new chain must be deleted at destruction
3832 hs->Options |= kOptsDelChn;
3833
3834 // Get hook to parsing function
3835 XrdCryptoX509ParseBucket_t ParseBucket = sessionCF->X509ParseBucket();
3836 if (!ParseBucket) {
3837 cmsg = "cannot attach to ParseBucket function!";
3838 return -1;
3839 }
3840 // Parse bucket
3841 int ncimin = (hs->Options & kOptsCreatePxy) ? 2 : 1;
3842 int nci = (*ParseBucket)(bck, hs->Chain);
3843 if (nci < ncimin) {
3844 cmsg = "wrong number of certificates in received bucket (received: ";
3845 cmsg += nci;
3846 cmsg += ", expected: >= ";
3847 cmsg += ncimin;
3848 cmsg += ")";
3849 return -1;
3850 }
3851 //
3852 // Verify the chain
3853 x509ChainVerifyOpt_t vopt = {0,static_cast<int>(hs->TimeStamp),-1,hs->Crl};
3855 if (!(hs->Chain->Verify(ecode, &vopt))) {
3856 cmsg = "certificate chain verification failed: ";
3857 cmsg += hs->Chain->LastError();
3858 return -1;
3859 }
3860
3861 //
3862 // Extract the client public key from the certificate
3863 XrdCryptoRSA *ckey = sessionCF->RSA(*(hs->Chain->End()->PKI()));
3864 if (!ckey || !ckey->IsValid()) {
3865 cmsg = "client certificate contains an invalid key";
3866 return -1;
3867 }
3868 if (hs->RemVers >= XrdSecgsiVersDHsigned) {
3869 // For new clients, make sure it is the same we got from the bucket
3870 XrdOucString cpubcert;
3871 if ((ckey->ExportPublic(cpubcert) < 0)) {
3872 cmsg = "exporting client public key";
3873 return -1;
3874 }
3875 if (cpubcert != cpub) {
3876 cmsg = "client public key does not match the one from the bucket!";
3877 return -1;
3878 }
3879 delete ckey;
3880 } else {
3881 // For old clients, set the client public key from the certificate
3882 sessionKver = ckey;
3883 }
3884
3885 // Deactivate certificate buffer
3886 (*bm)->Deactivate(kXRS_x509);
3887
3888 //
3889 // Check if there will be delegated proxies; these can be through
3890 // normal request+signature, or just forwarded by the client.
3891 // In both cases we need to save the proxy chain. If we need a
3892 // request, we have to prepare it and send it back to the client.
3893 // Get hook to parsing function
3894 XrdCryptoX509CreateProxyReq_t X509CreateProxyReq = sessionCF->X509CreateProxyReq();
3895 if (!X509CreateProxyReq) {
3896 cmsg = "cannot attach to X509CreateProxyReq function!";
3897 return -1;
3898 }
3899 bool needReq =
3900 ((PxyReqOpts & kOptsSrvReq) && (hs->Options & kOptsSigReq)) ||
3901 (hs->Options & kOptsDlgPxy);
3902 if (needReq || (hs->Options & kOptsFwdPxy)) {
3903 // Create a new proxy chain
3904 hs->PxyChain = new X509Chain();
3905 // The new chain must be deleted if still in the handshake info
3906 // when the info is destroyed
3907 hs->Options |= kOptsDelPxy;
3908 // Add the current proxy
3909 if ((*ParseBucket)(bck, hs->PxyChain) > 1) {
3910 // Reorder it
3911 hs->PxyChain->Reorder();
3912 if (needReq) {
3913 // Create the request
3914 XrdCryptoX509Req *rPXp = (XrdCryptoX509Req *) &(hs->RemVers);
3915 XrdCryptoRSA *krPXp = 0;
3916 if ((*X509CreateProxyReq)(hs->PxyChain->End(), &rPXp, &krPXp) == 0) {
3917 // Save key in the cache
3918 hs->Cref->buf4.len = krPXp->GetPrilen() + 1;
3919 hs->Cref->buf4.buf = new char[hs->Cref->buf4.len];
3920 if (krPXp->ExportPrivate(hs->Cref->buf4.buf, hs->Cref->buf4.len) != 0) {
3921 delete krPXp;
3922 delete rPXp;
3923 if (hs->PxyChain) hs->PxyChain->Cleanup();
3924 SafeDelete(hs->PxyChain);
3925 cmsg = "cannot export private key of the proxy request!";
3926 return -1;
3927 }
3928 // Prepare export bucket for request
3929 XrdSutBucket *bckr = rPXp->Export();
3930 // Add it to the main list
3931 if ((*bm)->AddBucket(bckr) != 0) {
3932 if (hs->PxyChain) hs->PxyChain->Cleanup();
3933 SafeDelete(hs->PxyChain);
3934 NOTIFY("WARNING: proxy req: problem adding bucket to main buffer");
3935 }
3936 delete krPXp;
3937 delete rPXp;
3938 } else {
3939 if (hs->PxyChain) hs->PxyChain->Cleanup();
3940 SafeDelete(hs->PxyChain);
3941 NOTIFY("WARNING: proxy req: problem creating request");
3942 }
3943 }
3944 } else {
3945 if (hs->PxyChain) hs->PxyChain->Cleanup();
3946 SafeDelete(hs->PxyChain);
3947 NOTIFY("WARNING: proxy req: wrong number of certificates");
3948 }
3949 }
3950
3951 //
3952 // Extract the MD algorithm chosen by the client
3953 String md = "";
3954 if ((bck = br->GetBucket(kXRS_md_alg))) {
3955 String mdlist;
3956 bck->ToString(md);
3957 // Parse the list
3958 if (DefMD.find(md) == -1) {
3959 cmsg = "unsupported MD chosen by the client";
3960 return -1;
3961 }
3962 // Deactivate
3964 } else {
3965 NOTIFY("WARNING: client choice for digests missing"
3966 " - using default");
3967 md = "md5";
3968 }
3969 if (!(sessionMD = sessionCF->MsgDigest(md.c_str()))) {
3970 cmsg = "could not instantiate digest object";
3971 return -1;
3972 }
3973
3974 // We are done
3975 return 0;
3976}
3977
3978//_________________________________________________________________________
3979int XrdSecProtocolgsi::ServerDoSigpxy(XrdSutBuffer *br, XrdSutBuffer **bm,
3980 String &cmsg)
3981{
3982 // Server side: process a kXGC_sigpxy message.
3983 // Return 0 on success, -1 on error. If the case, a message is returned
3984 // in cmsg.
3985 EPNAME("ServerDoSigpxy");
3986
3987 XrdSutBucket *bck = 0;
3988 XrdSutBucket *bckm = 0;
3989
3990 //
3991 // Extract the main buffer
3992 if (!(bckm = br->GetBucket(kXRS_main))) {
3993 cmsg = "main buffer missing";
3994 return 0;
3995 }
3996 //
3997 // Decrypt the main buffer with the session cipher, if available
3998 if (sessionKey) {
3999 if (!(sessionKey->Decrypt(*bckm, useIV))) {
4000 cmsg = "error decrypting main buffer with session cipher";
4001 return 0;
4002 }
4003 }
4004 //
4005 // Deserialize main buffer
4006 if (!((*bm) = new XrdSutBuffer(bckm->buffer,bckm->size))) {
4007 cmsg = "error deserializing main buffer";
4008 return 0;
4009 }
4010
4011 // Get the bucket
4012 if (!(bck = (*bm)->GetBucket(kXRS_x509))) {
4013 cmsg = "buffer with requested info missing";
4014 // Is there a message from the client?
4015 if ((bck = (*bm)->GetBucket(kXRS_message))) {
4016 // Yes: decode it and print it
4017 String m;
4018 bck->ToString(m);
4019 DEBUG("msg from client: "<<m);
4020 // Add it to the main message
4021 cmsg += " :"; cmsg += m;
4022 }
4023 return 0;
4024 }
4025
4026 // Make sure we still have the chain
4027 X509Chain *pxyc = hs->PxyChain;
4028 if (!pxyc) {
4029 cmsg = "the proxy chain is gone";
4030 return 0;
4031 }
4032
4033 // Action depend on the type of message
4034 if ((hs->Options & kOptsFwdPxy)) {
4035 // The bucket contains a private key to be added to the proxy
4036 // public key
4037 XrdCryptoRSA *kpx = pxyc->End()->PKI();
4038 if (kpx->ImportPrivate(bck->buffer, bck->size) != 0) {
4039 cmsg = "problems importing private key";
4040 return 0;
4041 }
4042 } else {
4043 // The bucket contains our request signed by the client
4044 // The full key is in the cache
4045 if (!hs->Cref) {
4046 cmsg = "session cache has gone";
4047 return 0;
4048 }
4049 // Get the signed certificate
4050 XrdCryptoX509 *npx = sessionCF->X509(bck);
4051 if (!npx) {
4052 cmsg = "could not resolve signed request";
4053 return 0;
4054 }
4055 // Set full PKI
4056 XrdCryptoRSA *const knpx = npx->PKI();
4057 if (!knpx || knpx->ImportPrivate(hs->Cref->buf4.buf, hs->Cref->buf4.len) != 0) {
4058 delete npx;
4059 cmsg = "could not import private key into signed request";
4060 return 0;
4061 }
4062 // Add the new proxy ecert to the chain
4063 pxyc->PushBack(npx);
4064 }
4065 // Save the chain in the instance
4066 proxyChain = pxyc;
4067 hs->PxyChain = 0;
4068 // Notify
4069 if (QTRACE(Authen)) { proxyChain->Dump(); }
4070
4071 // Check if the proxy chain is to become the actual credentials
4072 //
4073 if ((PxyReqOpts & kOptsPxCred)) {
4075 (sessionCF) ? sessionCF->X509ExportChain() : 0;
4076 if (!c2mem) {
4077 cmsg = "chain exporter not found; proxy chain not exported";
4078 return 0;
4079 }
4080 XrdOucString spxy;
4081 XrdSutBucket *bpxy = (*c2mem)(proxyChain, true);
4082 bpxy->ToString(spxy);
4084 Entity.creds = strdup(spxy.c_str());
4085 Entity.credslen = spxy.length();
4086 DEBUG("proxy chain exported in Entity.creds (" << Entity.credslen << " bytes)");
4087 DEBUG("\n\n" << spxy.c_str() << "\n\n");
4088 delete bpxy;
4089 return 0;
4090 }
4091
4092 //
4093 // Extract user login name, if any
4094 String user;
4095 if ((bck = (*bm)->GetBucket(kXRS_user))) {
4096 bck->ToString(user);
4097 (*bm)->Deactivate(kXRS_user);
4098 }
4099 if (user.length() <= 0) user = Entity.name;
4100
4101 // Dump to file if required
4102 if ((PxyReqOpts & kOptsPxFile)) {
4103 if (user.length() > 0) {
4104 String pxfile = UsrProxy, name;
4105 struct passwd *pw = getpwnam(user.c_str());
4106 if (pw) {
4107 name = pw->pw_name;
4108 } else {
4109 // Get Hash of the subject
4110 XrdCryptoX509 *c = proxyChain->SearchBySubject(proxyChain->EECname());
4111 if (c) {
4112 name = c->SubjectHash();
4113 } else {
4114 cmsg = "proxy chain not dumped to file: could not find subject hash";
4115 return 0;
4116 }
4117 }
4118 if (XrdSutResolve(pxfile, Entity.host,
4119 Entity.vorg, Entity.grps, name.c_str()) != 0) {
4120 PRINT("Problems resolving templates in "<<pxfile);
4121 return 0;
4122 }
4123 // Replace <uid> placeholder
4124 if (pw && pxfile.find("<uid>") != STR_NPOS) {
4125 String suid; suid += (int) pw->pw_uid;
4126 pxfile.replace("<uid>", suid.c_str());
4127 }
4128
4129 // Get the function
4130 XrdCryptoX509ChainToFile_t ctofile = sessionCF->X509ChainToFile();
4131 if ((*ctofile)(proxyChain,pxfile.c_str()) != 0) {
4132 cmsg = "problems dumping proxy chain to file ";
4133 cmsg += pxfile;
4134 return 0;
4135 }
4136 PRINT("proxy chain dumped to "<< pxfile);
4137 } else {
4138 cmsg = "proxy chain not dumped to file: entity name undefined";
4139 return 0;
4140 }
4141 }
4142
4143 // We are done
4144 return 0;
4145}
4146
4147//__________________________________________________________________
4148void XrdSecProtocolgsi::ErrF(XrdOucErrInfo *einfo, kXR_int32 ecode,
4149 const char *msg1, const char *msg2,
4150 const char *msg3)
4151{
4152 // Filling the error structure
4153 EPNAME("ErrF");
4154
4155 char *msgv[12];
4156 int k, i = 0, sz = strlen("Secgsi");
4157
4158 //
4159 // Code message, if any
4160 int cm = (ecode >= kGSErrParseBuffer &&
4161 ecode <= kGSErrError) ? (ecode-kGSErrParseBuffer) : -1;
4162 const char *cmsg = (cm > -1) ? gGSErrStr[cm] : 0;
4163
4164 //
4165 // Build error message array
4166 msgv[i++] = (char *)"Secgsi"; //0
4167 if (cmsg) {msgv[i++] = (char *)": "; //1
4168 msgv[i++] = (char *)cmsg; //2
4169 sz += strlen(msgv[i-1]) + 2;
4170 }
4171 if (msg1) {msgv[i++] = (char *)": "; //3
4172 msgv[i++] = (char *)msg1; //4
4173 sz += strlen(msgv[i-1]) + 2;
4174 }
4175 if (msg2) {msgv[i++] = (char *)": "; //5
4176 msgv[i++] = (char *)msg2; //6
4177 sz += strlen(msgv[i-1]) + 2;
4178 }
4179 if (msg3) {msgv[i++] = (char *)": "; //7
4180 msgv[i++] = (char *)msg3; //8
4181 sz += strlen(msgv[i-1]) + 2;
4182 }
4183
4184 // save it (or print it)
4185 if (einfo) {
4186 einfo->setErrInfo(ecode, (const char **)msgv, i);
4187 }
4188 if (QTRACE(Debug)) {
4189 char *bout = new char[sz+10];
4190 if (bout) {
4191 bout[0] = 0;
4192 for (k = 0; k < i; k++)
4193 strcat(bout, msgv[k]);
4194 DEBUG(bout);
4195 } else {
4196 for (k = 0; k < i; k++)
4197 DEBUG(msgv[k]);
4198 }
4199 }
4200}
4201
4202//__________________________________________________________________
4203XrdSecCredentials *XrdSecProtocolgsi::ErrC(XrdOucErrInfo *einfo,
4204 XrdSutBuffer *b1,
4205 XrdSutBuffer *b2,
4206 XrdSutBuffer *b3,
4207 kXR_int32 ecode,
4208 const char *msg1,
4209 const char *msg2,
4210 const char *msg3)
4211{
4212 // Error logging client method
4213
4214 // Fill the error structure
4215 ErrF(einfo, ecode, msg1, msg2, msg3);
4216
4217 // Release buffers
4218 REL3(b1,b2,b3);
4219
4220 // We are done
4221 return (XrdSecCredentials *)0;
4222}
4223
4224//__________________________________________________________________
4225int XrdSecProtocolgsi::ErrS(String ID, XrdOucErrInfo *einfo,
4226 XrdSutBuffer *b1, XrdSutBuffer *b2,
4227 XrdSutBuffer *b3, kXR_int32 ecode,
4228 const char *msg1, const char *msg2,
4229 const char *msg3)
4230{
4231 // Error logging server method
4232
4233 // Fill the error structure
4234 ErrF(einfo, ecode, msg1, msg2, msg3);
4235
4236 // Release buffers
4237 REL3(b1,b2,b3);
4238
4239 // We are done
4240 return kgST_error;
4241}
4242
4243//______________________________________________________________________________
4244bool XrdSecProtocolgsi::CheckRtag(XrdSutBuffer *bm, String &emsg)
4245{
4246 // Check random tag signature if it was sent with previous packet
4247 EPNAME("CheckRtag");
4248
4249 // Make sure we got a buffer
4250 if (!bm) {
4251 emsg = "Buffer not defined";
4252 return 0;
4253 }
4254 //
4255 // If we sent out a random tag check its signature
4256 if (hs->Cref && hs->Cref->buf1.len > 0) {
4257 XrdSutBucket *brt = 0;
4258 if ((brt = bm->GetBucket(kXRS_signed_rtag))) {
4259 // Make sure we got the right key to decrypt
4260 if (!(sessionKver)) {
4261 emsg = "Session cipher undefined";
4262 return 0;
4263 }
4264 // Decrypt it with the counter part public key
4265 if (sessionKver->DecryptPublic(*brt) <= 0) {
4266 emsg = "error decrypting random tag with public key";
4267 return 0;
4268 }
4269 } else {
4270 emsg = "random tag missing - protocol error";
4271 return 0;
4272 }
4273 //
4274 // Random tag cross-check: content
4275 if (memcmp(brt->buffer,hs->Cref->buf1.buf,hs->Cref->buf1.len)) {
4276 emsg = "random tag content mismatch";
4277 SafeDelete(hs->Cref);
4278 // Remove: should not be checked a second time
4279 return 0;
4280 }
4281 //
4282 // Reset the cache entry but we will not use the info a second time
4283 memset(hs->Cref->buf1.buf,0,hs->Cref->buf1.len);
4284 hs->Cref->buf1.SetBuf();
4285 //
4286 // Flag successful check
4287 hs->RtagOK = 1;
4289 DEBUG("Random tag successfully checked");
4290 } else {
4291 DEBUG("Nothing to check");
4292 }
4293
4294 // We are done
4295 return 1;
4296}
4297
4298//______________________________________________________________________________
4299XrdCryptoX509Crl *XrdSecProtocolgsi::LoadCRL(XrdCryptoX509 *xca, const char *subjhash,
4300 XrdCryptoFactory *CF, int dwld, int &errcrl)
4301{
4302 // Scan crldir for a valid CRL certificate associated to CA whose
4303 // certificate is xca. If 'dwld' is true try to download the CRL from
4304 // the relevant URI, if any.
4305 // If the CRL is found and is valid according
4306 // to the chosen option, return its content in a X509Crl object.
4307 // Return 0 in any other case
4308 EPNAME("LoadCRL");
4309 XrdCryptoX509Crl *crl = 0;
4310 errcrl = 0;
4311
4312 // make sure we got what we need
4313 if (!xca || !CF) {
4314 PRINT("Invalid inputs");
4315 errcrl = -1;
4316 return crl;
4317 }
4318
4319 // Get the CA hash
4320 String cahash(subjhash);
4321 int hashalg = 0;
4322 if (strcmp(subjhash, xca->SubjectHash())) hashalg = 1;
4323 // Drop the extension (".0")
4324 String caroot(cahash, 0, cahash.find(".0")-1);
4325
4326 // The dir
4327 String crlext = XrdSecProtocolgsi::DefCRLext;
4328
4329 String crldir;
4330 int from = 0;
4331 while ((from = CRLdir.tokenize(crldir, from, ',')) != -1) {
4332 if (crldir.length() <= 0) continue;
4333 // Add the default CRL extension and the dir
4334 String crlfile = crldir + caroot;
4335 crlfile += crlext;
4336 DEBUG("target file: "<<crlfile);
4337 // Try to init a crl
4338 if ((crl = CF->X509Crl(crlfile.c_str()))) {
4339 if ((errcrl = VerifyCRL(crl, xca, crldir, CF, hashalg)) == 0) return crl;
4340 }
4341 SafeDelete(crl);
4342 }
4343
4344 // If not required, we are done
4345 if (CRLCheck < 2 || (dwld == 0)) {
4346 // Done
4347 return crl;
4348 }
4349
4350 // If in 'required' mode, we will also try to load the CRL from the
4351 // information found in the CA certificate or in the certificate directory.
4352 // To avoid this overload, the CRL information should be installed offline, e.g. with
4353 // utils/getCRLcert
4354
4355 errcrl = 0;
4356 // Try to retrieve it from the URI in the CA certificate, if any
4357 if ((crl = CF->X509Crl(xca))) {
4358 if ((errcrl = VerifyCRL(crl, xca, crldir, CF, hashalg)) == 0) return crl;
4359 SafeDelete(crl);
4360 }
4361
4362 // Finally try the ".crl_url" file
4363 from = 0;
4364 while ((from = CRLdir.tokenize(crldir, from, ',')) != -1) {
4365 if (crldir.length() <= 0) continue;
4366 SafeDelete(crl);
4367 String crlurl = crldir + caroot;
4368 crlurl += ".crl_url";
4369 DEBUG("target file: "<<crlurl);
4370 FILE *furl = fopen(crlurl.c_str(), "r");
4371 if (!furl) {
4372 PRINT("could not open file: "<<crlurl);
4373 continue;
4374 }
4375 char line[2048];
4376 while ((fgets(line, sizeof(line), furl))) {
4377 if (line[strlen(line) - 1] == '\n') line[strlen(line) - 1] = 0;
4378 if ((crl = CF->X509Crl(line, 1))) {
4379 if ((errcrl = VerifyCRL(crl, xca, crldir, CF, hashalg)) == 0) return crl;
4380 SafeDelete(crl);
4381 }
4382 }
4383 }
4384
4385 // We need to parse the full dirs: make some cleanup first
4386 from = 0;
4387 while ((from = CRLdir.tokenize(crldir, from, ',')) != -1) {
4388 if (crldir.length() <= 0) continue;
4389 SafeDelete(crl);
4390 // Open directory
4391 DIR *dd = opendir(crldir.c_str());
4392 if (!dd) {
4393 PRINT("could not open directory: "<<crldir<<" (errno: "<<errno<<")");
4394 continue;
4395 }
4396 // Read the content
4397 struct dirent *dent = 0;
4398 while ((dent = readdir(dd))) {
4399 // Do not analyse the CA certificate
4400 if (!strcmp(cahash.c_str(),dent->d_name)) continue;
4401 // File name contain the root CA hash
4402 if (!strstr(dent->d_name,caroot.c_str())) continue;
4403 // candidate name
4404 String crlfile = crldir + dent->d_name;
4405 DEBUG("analysing entry "<<crlfile);
4406 // Try to init a crl
4407 if ((crl = CF->X509Crl(crlfile.c_str()))) {
4408 if ((errcrl = VerifyCRL(crl, xca, crldir, CF, hashalg)) == 0) break;
4409 SafeDelete(crl);
4410 }
4411 }
4412 // Close dir
4413 closedir(dd);
4414 // Are we done?
4415 if (crl) break;
4416 }
4417
4418 // We are done
4419 return crl;
4420}
4421
4422//______________________________________________________________________________
4423int XrdSecProtocolgsi::VerifyCRL(XrdCryptoX509Crl *crl, XrdCryptoX509 *xca, String crldir,
4424 XrdCryptoFactory *CF, int hashalg)
4425{
4426 EPNAME("VerifyCRL");
4427 int rc = 0;
4428 // Make sure they have the same issuer
4429 if (!strcmp(xca->SubjectHash(hashalg), crl->IssuerHash(hashalg))) {
4430 // Signing certificate file
4431 String casigfile = crldir + crl->IssuerHash(hashalg);
4432 DEBUG("CA signing certificate file = "<<casigfile);
4433 // Try to get signing certificate
4434 XrdCryptoX509 *xcasig = 0;
4435 if (!(xcasig = CF->X509(casigfile.c_str()))) {
4436 if (CRLCheck >= 2) {
4437 PRINT("CA certificate to verify the signature ("<<crl->IssuerHash(hashalg)<<
4438 ") could not be loaded - exit");
4439 } else {
4440 DEBUG("CA certificate to verify the signature could not be loaded - verification skipped");
4441 }
4442 rc = -3;
4443 } else {
4444 // Verify signature
4445 if (crl->Verify(xcasig)) {
4446 // Ok, we are done
4447 if (CRLCheck >= 3 && crl && crl->IsExpired()) {
4448 rc = -5;
4449 NOTIFY("CRL is expired (CRLCheck: "<<CRLCheck<<")");
4450 }
4451 } else {
4452 rc = -4;
4453 PRINT("CA signature or CRL verification failed!");
4454 }
4455 SafeDelete(xcasig);
4456 }
4457 } else {
4458 rc = -2;
4459 PRINT("Loaded CRL does not match CA (subject CA "<<xca->SubjectHash(hashalg)<<
4460 " does not match CRL issuer "<<crl->IssuerHash(hashalg)<<"! ");
4461 }
4462 return rc;
4463}
4464
4465//______________________________________________________________________________
4466String XrdSecProtocolgsi::GetCApath(const char *cahash)
4467{
4468 // Look in the paths defined by CAdir for the certificate file related to
4469 // 'cahash', in the form <CAdir_entry>/<cahash>.0
4470
4471 String path;
4472 String ent;
4473 int from = 0;
4474 while ((from = CAdir.tokenize(ent, from, ',')) != -1) {
4475 if (ent.length() > 0) {
4476 path = ent;
4477 if (!path.endswith('/'))
4478 path += "/";
4479 path += cahash;
4480 if (!path.endswith(".0"))
4481 path += ".0";
4482 if (!access(path.c_str(), R_OK))
4483 break;
4484 }
4485 path = "";
4486 }
4487
4488 // Done
4489 return path;
4490}
4491//______________________________________________________________________________
4492bool XrdSecProtocolgsi::VerifyCA(int opt, X509Chain *cca, XrdCryptoFactory *CF)
4493{
4494 // Verify the CA in 'cca' according to 'opt':
4495 // opt = 2 full check
4496 // 1 only if self-signed
4497 // 0 no check
4498 EPNAME("VerifyCA");
4499
4500 bool verified = 0;
4502 cca->SetStatusCA(st);
4503
4504 // We nust have got a chain
4505 if (!cca) {
4506 PRINT("Invalid input ");
4507 return 0;
4508 }
4509
4510 // Get the parse function
4512 if (!ParseFile) {
4513 PRINT("Cannot attach to the ParseFile function");
4514 return 0;
4515 }
4516
4517 // Point to the certificate
4518 XrdCryptoX509 *xc = cca->Begin();
4519 if (!xc) {
4520 PRINT("Cannot attach to first certificate in chain");
4521 return 0;
4522 }
4523 // Make sure it is valid
4524 if (!(xc->IsValid())) {
4525 PRINT("CA certificate is expired ("<<xc->SubjectHash()<<", not_before: "<<xc->NotBefore()<<" secs UTC )");
4526 return 0;
4527 }
4528 // Is it self-signed ?
4529 bool self = (!strcmp(xc->IssuerHash(), xc->SubjectHash())) ? 1 : 0;
4530 if (!self) {
4531 String inam;
4532 if (opt == 2) {
4533 // We are requested to verify it
4534 bool notdone = 1;
4535 // We need to load the issuer(s) CA(s)
4536 XrdCryptoX509 *xd = xc;
4537 while (notdone) {
4538 X509Chain *ch = 0;
4539 int ncis = -1;
4540 for (int ha = 0; ha < 2; ha++) {
4541 inam = GetCApath(xd->IssuerHash(ha));
4542 if (inam.length() <= 0) continue;
4543 ch = new X509Chain();
4544 ncis = (*ParseFile)(inam.c_str(), ch, 0);
4545 if (ncis >= 1) break;
4546 SafeDelete(ch);
4547 }
4548 if (ncis < 1) break;
4549 XrdCryptoX509 *xi = ch->Begin();
4550 while (xi) {
4551 if (!strcmp(xd->IssuerHash(), xi->SubjectHash()))
4552 break;
4553 xi = ch->Next();
4554 }
4555 if (xi) {
4556 // Add the certificate to the requested CA chain
4557 ch->Remove(xi);
4558 cca->PutInFront(xi);
4559 SafeDelete(ch);
4560 // We may be over
4561 if (!strcmp(xi->IssuerHash(), xi->SubjectHash())) {
4562 notdone = 0;
4563 break;
4564 } else {
4565 // This becomes the daughter
4566 xd = xi;
4567 }
4568 } else {
4569 break;
4570 }
4571 }
4572 if (!notdone) {
4573 // Verify the chain
4575 x509ChainVerifyOpt_t vopt = {kOptsCheckSubCA, 0, -1, 0};
4576 if (!(verified = cca->Verify(e, &vopt)))
4577 PRINT("CA certificate not self-signed: verification failed for '"<<xc->SubjectHash()<<"': error: "<< cca->X509ChainError(e));
4578 } else {
4579 PRINT("CA certificate not self-signed: cannot verify integrity ("<<xc->SubjectHash()<<")");
4580 }
4581 } else {
4582 // Fill CA information
4583 cca->CheckCA(0);
4584 // Set OK in any case
4585 verified = 1;
4586 // Notify if some sort of check was required
4587 if (opt == 1) {
4588 NOTIFY("Warning: CA certificate not self-signed and"
4589 " integrity not checked: assuming OK ("<<xc->SubjectHash()<<")");
4590 }
4591 }
4592 } else {
4593 if (CACheck > caNoVerify) {
4594 // Check self-signature and fail if needed
4595 bool checkselfsigned = (CACheck > caVerifyss) ? true : false;
4596 if (!(verified = cca->CheckCA(checkselfsigned)))
4597 PRINT("CA certificate self-signed: integrity check failed ("<<xc->SubjectHash()<<")");
4598 } else {
4599 // Set OK in any case
4600 verified = 1;
4601 // Notify if some sort of check was required
4602 NOTIFY("Warning: CA certificate self-signed but"
4603 " integrity not checked: assuming OK ("<<xc->SubjectHash()<<")");
4604 }
4605 }
4606
4607 // Set the status in the chain
4608 st = (verified) ? XrdCryptoX509Chain::kValid : st;
4609 cca->SetStatusCA(st);
4610
4611 // Done
4612 return verified;
4613}
4614
4615//_____________________________________________________________________________
4616static bool GetCACheck(XrdSutCacheEntry *e, void *a) {
4617
4618 EPNAME("GetCACheck");
4619
4620 int crl_check = (*((XrdSutCacheArg_t *)a)).arg1;
4621 int crl_refresh = (*((XrdSutCacheArg_t *)a)).arg2;
4622 time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg3;
4623
4624 if (!e) return false;
4625
4626 X509Chain *chain = 0;
4627 // If we had already something, check it, as we may be done
4628 bool goodca = 0;
4629 if ((chain = (X509Chain *)(e->buf1.buf))) {
4630 // Check the validity of the certificates in the chain; if a certificate became invalid,
4631 // we need to reload a valid one for the same CA.
4632 if (chain->CheckValidity() == 0) {
4633 goodca = 1;
4634 } else {
4635 PRINT("CA entry for '"<<e->name<<"' needs refreshing: clean the related entry cache first");
4636 return false;
4637 }
4638 }
4639 if (goodca) {
4641 bool goodcrl = 1;
4642 if ((crl_check == 2 && !crl) || (crl_check == 3 && crl->IsExpired())) goodcrl = 0;
4643 if (crl_refresh > 0 && ((ts_ref - e->mtime) > crl_refresh)) goodcrl = 0;
4644 if (goodcrl) {
4645 return true;
4646 } else if (crl) {
4647 PRINT("CRL entry for '"<<e->name<<"' needs refreshing: clean the related entry cache first ("<<e<<")");
4648 }
4649 }
4650 return false;
4651}
4652
4653//______________________________________________________________________________
4654int XrdSecProtocolgsi::GetCA(const char *cahash,
4655 XrdCryptoFactory *cf, gsiHSVars *hs)
4656{
4657 // Gets entry for CA with hash cahash for crypt factory cf.
4658 // If not found in cache, try loading from <CAdir>/<cahash>.0 .
4659 // If 'hs' is defined, store pointers to chain and crl into 'hs'.
4660 // Return 0 if ok, -1 if not available, -2 if CRL not ok
4661 EPNAME("GetCA");
4662 XrdSutCERef ceref;
4663 int rc = 0;
4664
4665 // We nust have got a CA hash
4666 if (!cahash || !cf) {
4667 PRINT("Invalid input ");
4668 return -1;
4669 }
4670
4671 // Timestamp
4672 time_t timestamp = (hs) ? hs->TimeStamp : time(0);
4673
4674 // The tag
4675 String tag(cahash,20);
4676 tag += ':';
4677 tag += cf->ID();
4678 DEBUG("Querying cache for tag: "<<tag<<" (timestamp:"<<timestamp<<
4679 ", refresh fq:"<< CRLRefresh <<")");
4680
4681 bool rdlock = false;
4682 XrdSutCacheArg_t arg = {CRLCheck, CRLRefresh, timestamp, -1};
4683 XrdSutCacheEntry *cent = cacheCA.Get(tag.c_str(), rdlock, GetCACheck, (void *) &arg);
4684 if (!cent) {
4685 PRINT("unable to get a valid entry from cache for " << tag);
4686 return -1;
4687 }
4688 ceref.Set(&(cent->rwmtx));
4689
4690 // Point to the content
4691 X509Chain *chain = (X509Chain *)(cent->buf1.buf);
4692 XrdCryptoX509Crl *crl = (XrdCryptoX509Crl *)(cent->buf2.buf);
4693
4694 // If invalid we fail
4695 if (cent->status == kCE_inactive) {
4696 // Cleanup and remove existing invalid entries
4697 if (chain) stackCA.Del(chain);
4698 if (crl) stackCRL->Del(crl);
4699 PRINT("unable to get a valid entry from cache for " << tag);
4700 return -1;
4701 }
4702
4703 // Check if we are done
4704 if (rdlock) {
4705 // Save chain
4706 if (hs) hs->Chain = chain;
4707 stackCA.Add(chain);
4708 // Save crl
4709 if (crl) {
4710 if (hs) hs->Crl = crl;
4711 // Add to the stack for proper cleaning of invalidated CRLs
4712 stackCRL->Add(crl);
4713 }
4714 return 0;
4715 }
4716
4717 // Cleanup and remove existing invalid entries
4718 if (chain) stackCA.Del(chain);
4719 if (crl) stackCRL->Del(crl);
4720
4721 chain = 0;
4722 crl = 0;
4723 cent->buf1.buf = 0;
4724 cent->buf2.buf = 0;
4725
4726 // If not, prepare the file name
4727 String fnam = GetCApath(cahash);
4728 DEBUG("trying to load CA certificate from "<<fnam);
4729
4730 // Create chain ?
4731 bool createchain = (hs && hs->Chain) ? 0 : 1;
4732 chain = (createchain) ? new X509Chain() : hs->Chain;
4733 if (!chain) {
4734 PRINT("could not attach-to or create new GSI chain");
4735 rc = -1;
4736 }
4737
4738 // Get the parse function
4740 if (rc == 0 && ParseFile) {
4741 int nci = (createchain) ? (*ParseFile)(fnam.c_str(), chain, 0) : 1;
4742 bool ok = 0, verified = 0;
4743 if (nci == 1) {
4744 // Verify the CA
4745 verified = VerifyCA(CACheck, chain, cf);
4746 XrdCryptoX509Crl *crl = 0;
4747 if (verified) {
4748 // Get CRL, if required
4749 ok = 1;
4750 if (CRLCheck > 0) {
4751 int errcrl = 0;
4752 if ((crl = LoadCRL(chain->EffCA(), cahash, cf, CRLDownload, errcrl))) {
4753 // Good CA
4754 DEBUG("CRL successfully loaded");
4755 } else {
4756 String em = "missing or expired: ignoring";
4757 if ((CRLCheck == 1 && errcrl != 0 && errcrl != -5) || (CRLCheck >= 2 && errcrl != 0)) {
4758 ok = 0;
4759 em = "invalid: failing";
4760 } else if (CRLCheck >= 2) {
4761 ok = 0;
4762 em = "missing or expired: failing";
4763 }
4764 NOTIFY("CRL is "<<em<<" (CRLCheck: "<<CRLCheck<<")");
4765 }
4766 }
4767 }
4768 //
4769 if (ok) {
4770 // Add to the cache
4771 cent->buf1.buf = (char *)(chain);
4772 cent->buf1.len = 0; // Just a flag
4773 stackCA.Add(chain);
4774 if (crl) {
4775 cent->buf2.buf = (char *)(crl);
4776 cent->buf2.len = 0; // Just a flag
4777 stackCRL->Add(crl);
4778 }
4779 cent->mtime = timestamp;
4780 cent->status = kCE_ok;
4781 cent->cnt = 0;
4782 // Fill output, if required
4783 if (hs) {
4784 hs->Chain = chain;
4785 hs->Crl = crl;
4786 if (strcmp(cahash, chain->Begin()->SubjectHash())) hs->HashAlg = 1;
4787 }
4788 } else {
4789 SafeDelete(crl);
4790 SafeDelete(chain);
4791 rc = -2;
4792 }
4793 } else {
4794 SafeDelete(chain);
4795 NOTIFY("certificate not found or invalid (nci: "<<nci<<", CA: "<<
4796 (int)(verified)<<")");
4797 rc = -1;
4798 }
4799 }
4800
4801 // We are done: release the lock
4802 ceref.UnLock();
4803
4804 // We are done
4805 return (rc != 0) ? rc : 0;
4806}
4807
4808//______________________________________________________________________________
4809int XrdSecProtocolgsi::InitProxy(ProxyIn_t *pi, XrdCryptoFactory *cf, X509Chain *ch, XrdCryptoRSA **kp)
4810{
4811 // Invoke 'grid-proxy-init' via the shell to create a valid the proxy file
4812 // If the variable GLOBUS_LOCATION is defined it prepares the external shell
4813 // by sourcing $GLOBUS_LOCATION/etc/globus-user-env.sh .
4814 // Return 0 in cse of success, != 0 in any other case .
4815 EPNAME("InitProxy");
4816 int rc = 0;
4817
4818 // We must be able to get an answer
4819 if (isatty(0) == 0 || isatty(1) == 0) {
4820 NOTIFY("Not a tty: cannot prompt for proxies - do nothing ");
4821 return -1;
4822 }
4823
4824#ifndef HASGRIDPROXYINIT
4825 //
4826 // Use internal function for proxy initialization
4827 //
4828 // Make sure we got a chain and a key to fill
4829 if (!ch || !kp) {
4830 PRINT("chain or key container undefined");
4831 return -1;
4832 }
4833 // Check existence and permission of the key file
4834 struct stat st;
4835 if (stat(pi->key, &st) != 0) {
4836 DEBUG("cannot access private key file: "<<pi->key);
4837 return 1;
4838 }
4839 if (!S_ISREG(st.st_mode) || S_ISDIR(st.st_mode) ||
4840 (st.st_mode & (S_IWGRP | S_IWOTH)) != 0 ||
4841 (st.st_mode & (S_IRGRP | S_IROTH)) != 0) {
4842 DEBUG("wrong permissions for file: "<<pi->key<< " (should be 0600)");
4843 return 1;
4844 }
4845 //
4846 // Validity
4847 int valid = (pi->valid) ? XrdSutParseTime(pi->valid, 1) : -1;
4848 //
4849 // Options
4850 XrdProxyOpt_t pxopt = {pi->bits, // bits in key
4851 valid, // duration validity in secs
4852 pi->deplen}; // signature path depth
4853 //
4854 // Init now
4855 XrdCryptoX509CreateProxy_t X509CreateProxy = cf->X509CreateProxy();
4856 if (!X509CreateProxy) {
4857 PRINT("cannot attach to X509CreateProxy function!");
4858 return 1;
4859 }
4860 rc = (*X509CreateProxy)(pi->cert, pi->key, &pxopt, ch, kp, pi->out);
4861#else
4862 // command string
4863 String cmd(kMAXBUFLEN);
4864
4865 // Check if GLOBUS_LOCATION is defined
4866 if (getenv("GLOBUS_LOCATION"))
4867 cmd = "source $GLOBUS_LOCATION/etc/globus-user-env.sh;";
4868
4869 // Add main command
4870 cmd += " grid-proxy-init";
4871
4872 // Add user cert
4873 cmd += " -cert ";
4874 cmd += pi->cert;
4875
4876 // Add user key
4877 cmd += " -key ";
4878 cmd += pi->key;
4879
4880 // Add CA dir (no support for multi-dirs)
4881 String cdir(pi->certdir);
4882 cdir.erase(cdir.find(','));
4883 cmd += " -certdir ";
4884 cmd += cdir;
4885
4886 // Add validity
4887 if (pi->valid) {
4888 cmd += " -valid ";
4889 cmd += pi->valid;
4890 }
4891
4892 // Add number of bits in key
4893 if (pi->bits != XrdCryptoDefRSABits) {
4894 cmd += " -bits ";
4895 cmd += pi->bits;
4896 }
4897
4898 // Add depth of signature path
4899 if (pi->deplen > -1) {
4900 cmd += " -path-length ";
4901 cmd += pi->deplen;
4902 }
4903
4904 // Add output proxy coordinates
4905 if (pi->out) {
4906 cmd += " -out ";
4907 cmd += pi->out;
4908 }
4909 // Notify
4910 DEBUG("executing: " << cmd);
4911
4912 // Execute
4913 rc = system(cmd.c_str());
4914 DEBUG("return code: "<< rc << " (0x"<<(int *)rc<<")");
4915#endif
4916
4917 // We are done
4918 return rc;
4919}
4920
4921//__________________________________________________________________________
4922int XrdSecProtocolgsi::ParseCAlist(String calist)
4923{
4924 // Parse received ca list, find the first available CA in the list
4925 // and return a chain initialized with such a CA.
4926 // If nothing found return 0.
4927 EPNAME("ParseCAlist");
4928
4929 // Check inputs
4930 if (calist.length() <= 0) {
4931 PRINT("nothing to parse");
4932 return -1;
4933 }
4934 DEBUG("parsing list: "<<calist);
4935
4936 // Load module and define relevant pointers
4937 hs->Chain = 0;
4938 String cahash = "";
4939 // Parse list
4940 if (calist.length()) {
4941 int from = 0;
4942 while ((from = calist.tokenize(cahash, from, '|')) != -1) {
4943 // Check this hash
4944 if (cahash.length()) {
4945 // Make sure the extension ".0" if there, as external implementations may not
4946 // include it
4947 if (!cahash.endswith(".0")) cahash += ".0";
4948 // Get the CA chain
4949 if (GetCA(cahash.c_str(), sessionCF, hs) == 0)
4950 return 0;
4951 }
4952 }
4953 }
4954
4955 // We did not find it
4956 return -1;
4957}
4958
4959//__________________________________________________________________________
4960int XrdSecProtocolgsi::ParseCrypto(String clist)
4961{
4962 // Parse crypto list clist, extracting the first available module
4963 // and getting a related local cipher and a related reference
4964 // cipher to be used to agree the session cipher; the local lists
4965 // crypto info is updated, if needed
4966 // The results are used to fill the handshake part of the protocol
4967 // instance.
4968 EPNAME("ParseCrypto");
4969
4970 // Check inputs
4971 if (clist.length() <= 0) {
4972 NOTIFY("empty list: nothing to parse");
4973 return -1;
4974 }
4975 DEBUG("parsing list: "<<clist);
4976
4977 // Load module and define relevant pointers
4978 hs->CryptoMod = "";
4979
4980 // Parse list
4981 int from = 0;
4982 while ((from = clist.tokenize(hs->CryptoMod, from, '|')) != -1) {
4983 // Check this module
4984 if (hs->CryptoMod.length() > 0) {
4985 DEBUG("found module: "<<hs->CryptoMod);
4986 // Padding support?
4987 bool otherHasPad = true;
4988 if (hs->RemVers >= XrdSecgsiVersDHsigned) {
4989 if (hs->CryptoMod.endswith(gNoPadTag)) {
4990 otherHasPad = false;
4991 hs->CryptoMod.replace(gNoPadTag, "");
4992 }
4993 } else {
4994 otherHasPad = false;
4995 }
4996 // Load the crypto factory
4997 if ((sessionCF =
4999 sessionCF->SetTrace(GSITrace->What);
5000 if (QTRACE(Debug)) sessionCF->Notify();
5001 if (otherHasPad && sessionCF->HasPaddingSupport()) hs->HasPad = 1;
5002 int fid = sessionCF->ID();
5003 int i = 0;
5004 // Retrieve the index in local table
5005 while (i < ncrypt) {
5006 if (cryptID[i] == fid) break;
5007 i++;
5008 }
5009 if (i >= ncrypt) {
5010 if (ncrypt == XrdCryptoMax) {
5011 DEBUG("max number of crypto slots reached - do nothing");
5012 return 0;
5013 } else {
5014 // Add new entry
5015 cryptF[i] = sessionCF;
5016 cryptID[i] = fid;
5017 ncrypt++;
5018 }
5019 }
5020 // On servers the ref cipher should be defined at this point
5021 hs->Rcip = sessionCF->Cipher(hs->HasPad, 0,0,0);
5022 // we are done
5023 return 0;
5024 }
5025 }
5026 }
5027
5028 // Nothing found
5029 return -1;
5030}
5031
5032//_____________________________________________________________________________
5033static bool QueryProxyCheck(XrdSutCacheEntry *e, void *a) {
5034
5035 time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg1;
5036
5037 if (e && e->buf1.buf) {
5038 X509Chain *chain = (X509Chain *)(e->buf1.buf);
5039 if (chain->CheckValidity(1, ts_ref) == 0) return true;
5040 }
5041 return false;
5042}
5043
5044
5045//__________________________________________________________________________
5046int XrdSecProtocolgsi::QueryProxy(bool checkcache, XrdSutCache *cache,
5047 const char *tag, XrdCryptoFactory *cf,
5048 time_t timestamp, ProxyIn_t *pi, ProxyOut_t *po)
5049{
5050 // Query users proxies, initializing if needed
5051 EPNAME("QueryProxy");
5052 XrdSutCERef ceref;
5053
5054 bool hasproxy = 0;
5055 // We may already loaded valid proxies
5056 bool rdlock = false;
5057 XrdSutCacheArg_t arg = {timestamp, -1, -1, -1};
5058 XrdSutCacheEntry *cent = cache->Get(tag, rdlock, QueryProxyCheck, (void *) &arg);
5059 if (!cent) {
5060 PRINT("cannot get cache entry for: "<<tag);
5061 return -1;
5062 }
5063 ceref.Set(&(cent->rwmtx));
5064
5065 if (checkcache && rdlock) {
5066 po->chain = (X509Chain *)(cent->buf1.buf);
5067 po->ksig = (XrdCryptoRSA *)(cent->buf2.buf);
5068 po->cbck = (XrdSutBucket *)(cent->buf3.buf);
5069 // We are done
5070 ceref.UnLock();
5071 return 0;
5072 }
5073
5074 // Cleanup the chain
5075 po->chain = (X509Chain *)(cent->buf1.buf);
5076 if (po->chain) po->chain->Cleanup();
5077 SafeDelete(po->chain);
5078
5079 // Cleanup cache entry
5080 cent->buf1.buf = 0;
5081 cent->buf1.len = 0;
5082 // The key is deleted by the certificate destructor
5083 // Just reset the buffer
5084 cent->buf2.buf = 0;
5085 cent->buf2.len = 0;
5086 // and the related bucket
5087 if (cent->buf3.buf)
5088 delete (XrdSutBucket *)(cent->buf3.buf);
5089 cent->buf3.buf = 0;
5090 cent->buf3.len = 0;
5091
5092 //
5093 // We do not have good proxies, try load (user may have initialized
5094 // them in the meanwhile)
5095 // Create a new chain first, if needed
5096 if (!(po->chain))
5097 po->chain = new X509Chain();
5098 if (!(po->chain)) {
5099 PRINT("cannot create new chain!");
5100 return -1;
5101 }
5102 int ntry = 3;
5103 bool parsefile = 1;
5104 bool exportbucket = 0;
5106 XrdCryptoX509ParseBucket_t ParseBucket = 0;
5107 while (!hasproxy && ntry > 0) {
5108
5109 // Try init as last option if not in pure cert/key mode
5110 if (ntry == 1 && pi->createpxy) {
5111
5112 // Cleanup the chain
5113 po->chain->Cleanup();
5114
5115 if (InitProxy(pi, cf, po->chain, &(po->ksig)) != 0) {
5116 NOTIFY("problems initializing proxy via external shell");
5117 ntry--;
5118 continue;
5119 }
5120 // We need to explicitely export the proxy in a bucket
5121 exportbucket = 1;
5122#ifndef HASGRIDPROXYINIT
5123 // Chain is already loaded if we used the internal function
5124 // to initialize the proxies
5125 parsefile = 0;
5126 timestamp = time(0);
5127#endif
5128 }
5129 ntry--;
5130
5131 //
5132 // A proxy chain may have been passed via XrdSecCREDS: check that first
5133 if (ntry == 2) {
5134
5135 char *cbuf = getenv("XrdSecCREDS");
5136 if (cbuf) {
5137 // Import into a bucket
5138 XrdSutBucket xbck(0, 0, kXRS_x509);
5139 // Fill bucket
5140 xbck.SetBuf(cbuf, strlen(cbuf));
5141 // Parse the bucket
5142 if (!(ParseBucket = cf->X509ParseBucket())) {
5143 PRINT("cannot attach to ParseBucket function!");
5144 continue;
5145 }
5146 int nci = (*ParseBucket)(&xbck, po->chain);
5147 if (nci < 2) {
5148 NOTIFY("proxy bucket must have at least two certificates"
5149 " (found: "<<nci<<")");
5150 continue;
5151 }
5152 } else {
5153 // No env: parse the file
5154 ntry--;
5155 }
5156 }
5157 if (ntry == 1) {
5158 if (parsefile) {
5159 if (!ParseFile) {
5160 if (!(ParseFile = cf->X509ParseFile())) {
5161 PRINT("cannot attach to ParseFile function!");
5162 continue;
5163 }
5164 }
5165
5166 // Parse the proxy file
5167 int nci = (*ParseFile)(pi->out, po->chain, 0);
5168 if (nci < 2) {
5169 DEBUG("proxy files must have at least 2 certificates"
5170 " (found: "<<nci<<")");
5171 if (!pi->createpxy) {
5172 // Parse the cert file if requested
5173 int nci = (*ParseFile)(pi->cert, po->chain, pi->key);
5174 if (nci < 1) {
5175 DEBUG("cert files must have at least 1 certificates"
5176 " (found: "<<nci<<")");
5177 continue;
5178 }
5179 } else {
5180 continue;
5181 }
5182 }
5183
5184 // Check if any CA was in the file
5185 bool checkselfsigned = (CACheck > caVerifyss) ? true : false;
5186 po->chain->CheckCA(checkselfsigned);
5187 exportbucket = 1;
5188 }
5189 }
5190
5191 // Check validity in time
5192 if (po->chain->CheckValidity(1, timestamp) != 0) {
5193 NOTIFY("proxy files contains expired certificates");
5194 continue;
5195 }
5196
5197 // Reorder chain
5198 if (po->chain->Reorder() != 0) {
5199 NOTIFY("proxy files contains inconsistent certificates");
5200 continue;
5201 }
5202
5203 // Check key
5204 po->ksig = po->chain->End()->PKI();
5205 if (po->ksig->status != XrdCryptoRSA::kComplete) {
5206 NOTIFY("proxy files contain invalid key pair");
5207 continue;
5208 }
5209
5210 XrdCryptoX509ExportChain_t ExportChain = cf->X509ExportChain();
5211 if (!ExportChain) {
5212 PRINT("cannot attach to ExportChain function!");
5213 continue;
5214 }
5215
5216 // Create bucket for export
5217 if (exportbucket) {
5218 po->cbck = (*ExportChain)(po->chain, 0);
5219 if (!(po->cbck)) {
5220 PRINT("could not create bucket for export");
5221 continue;
5222 }
5223 }
5224
5225 // Save info in cache
5226 cent->mtime = po->chain->End()->NotAfter(); // the expiring time
5227 cent->status = kCE_special; // distinguish from normal certs
5228 cent->cnt = 0;
5229 // The chain
5230 cent->buf1.buf = (char *)(po->chain);
5231 cent->buf1.len = 0; // Just a flag
5232 // The key
5233 cent->buf2.buf = (char *)(po->chain->End()->PKI());
5234 cent->buf2.len = 0; // Just a flag
5235 // The export bucket
5236 cent->buf3.buf = (char *)(po->cbck);
5237 cent->buf3.len = 0; // Just a flag
5238
5239 // Set the positive flag
5240 hasproxy = 1;
5241 }
5242 // Always unlock
5243 ceref.UnLock();
5244
5245 // We are done
5246 if (!hasproxy) {
5247 // Some cleanup
5248 po->chain->Cleanup();
5249 SafeDelete(po->chain);
5250 SafeDelete(po->cbck);
5251 return -1;
5252 }
5253 return 0;
5254}
5255
5256
5257//_____________________________________________________________________________
5258static bool QueryGMAPCheck(XrdSutCacheEntry *e, void *a) {
5259 int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
5260 time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
5261 long to_ref = (*((XrdSutCacheArg_t *)a)).arg3;
5262 if (e) {
5263 // Check expiration, if required
5264 if ((e->status != st_ref) ||
5265 ((e->status == st_ref) &&
5266 (to_ref > 0) &&
5267 ((ts_ref - e->mtime) > to_ref))) {
5268 return false;
5269 } else {
5270 return true;
5271 }
5272 }
5273 return false;
5274}
5275
5276//__________________________________________________________________________
5277void XrdSecProtocolgsi::QueryGMAP(XrdCryptoX509Chain *chain, int now, String &usrs)
5278{
5279 // Resolve usernames associated with this proxy. The lookup is typically
5280 // based on the 'dn' (either in the grid mapfile or via the 'GMAPFun' plugin) but
5281 // it can also be based on the full proxy via the AuthzFun plugin.
5282 // For 'grid mapfile' and 'GMAPFun' the result is kept valid for a certain amount
5283 // of time, hashed on the 'dn'.
5284 // On return, an empty string in 'usrs' indicates failure.
5285 // Note that 'usrs' can be a comma-separated list of usernames.
5286 EPNAME("QueryGMAP");
5287
5288 // List of user names attached to the entity
5289 usrs = "";
5290
5291 // The chain must be defined
5292 if (!chain) {
5293 PRINT("input chain undefined!");
5294 return;
5295 }
5296
5297 // Now we check the DN-mapping function and eventually the gridmap file.
5298 // The result can be cached for a while.
5299 const char *dn = chain->EECname();
5300 if (GMAPFun) {
5301 XrdSutCERef ceref;
5302 bool rdlock = false;
5303 XrdSutCacheArg_t arg = {kCE_ok, now, GMAPCacheTimeOut, -1};
5304 XrdSutCacheEntry *cent = cacheGMAPFun.Get(dn, rdlock, QueryGMAPCheck, (void *) &arg);
5305 if (!cent) {
5306 PRINT("unable to get a valid entry from cache for dn: " << dn);
5307 return;
5308 }
5309 ceref.Set(&(cent->rwmtx));
5310
5311 // Check if we need to get/update the content
5312 if (!rdlock) {
5313 // Run the search via the external function
5314 char *name = (*GMAPFun)(dn, now);
5315 if (name) {
5316 cent->status = kCE_ok;
5317 // Add username
5318 SafeDelArray(cent->buf1.buf);
5319 cent->buf1.buf = name;
5320 cent->buf1.len = strlen(name);
5321 }
5322 // Fill up the rest
5323 cent->cnt = 0;
5324 cent->mtime = now; // creation time
5325 }
5326 // Retrieve result form cache
5327 usrs = cent->buf1.buf;
5328 // We are done with the cache
5329 ceref.UnLock();
5330 }
5331
5332 // Check the map file, if any
5333 //
5334 if (servGMap) {
5335 char u[65];
5336 if (servGMap->dn2user(dn, u, sizeof(u), now) == 0) {
5337 if (usrs.length() > 0) usrs += ",";
5338 usrs += (const char *)u;
5339 }
5340 }
5341
5342 // Done
5343 return;
5344}
5345
5346//_____________________________________________________________________________
5347XrdSecgsiGMAP_t XrdSecProtocolgsi::LoadGMAPFun(const char *plugin,
5348 const char *parms)
5349{
5350 // Load the DN-Username mapping function from the specified plug-in
5351 EPNAME("LoadGMAPFun");
5352 char errBuff[2048];
5353
5354 // Make sure the input config file is defined
5355 if (!plugin || strlen(plugin) <= 0) {
5356 PRINT("plug-in file undefined");
5357 return (XrdSecgsiGMAP_t)0;
5358 }
5359
5360 // Create the plug-in instance
5361 XrdOucPinLoader gmapLib(errBuff,sizeof(errBuff),gsiVersion,"gmaplib",plugin);
5362
5363 // Use global symbols?
5364 bool useglobals = 0;
5365 XrdOucString params, ps(parms), p;
5366 int from = 0;
5367 while ((from = ps.tokenize(p, from, '|')) != -1) {
5368 if (p == "useglobals") {
5369 useglobals = 1;
5370 } else {
5371 if (params.length() > 0) params += " ";
5372 params += p;
5373 }
5374 }
5375 DEBUG("params: '"<< params<<"'; useglobals: "<<useglobals);
5376
5377 // Get the function
5378 XrdSecgsiGMAP_t ep = 0;
5379 if (useglobals) gmapLib.Global(true);
5380 ep = (XrdSecgsiGMAP_t) gmapLib.Resolve("XrdSecgsiGMAPFun");
5381
5382 if (!ep) {
5383 PRINT(errBuff);
5384 PRINT("could not find 'XrdSecgsiGMAPFun()' in "<<plugin);
5385 return (XrdSecgsiGMAP_t)0;
5386 }
5387
5388 // Init it
5389 if ((*ep)(params.c_str(), 0) == (char *)-1) {
5390 PRINT("could not initialize 'XrdSecgsiGMAPFun()'");
5391 return (XrdSecgsiGMAP_t)0;
5392 }
5393
5394 // Notify
5395 PRINT("using 'XrdSecgsiGMAPFun()' from "<<plugin);
5396
5397 // Done
5398 return ep;
5399}
5400
5401//_____________________________________________________________________________
5402XrdSecgsiAuthz_t XrdSecProtocolgsi::LoadAuthzFun(const char *plugin,
5403 const char *parms, int &certfmt)
5404{
5405 // Load the authorization function from the specified plug-in.
5406 // The plug-in must contain three functions, to be all declared as 'extern C'.
5407 //
5408 // 1. The main function:
5409 //
5410 // int XrdSecgsiAuthzFun(XrdSecEntity &entity)
5411 //
5412 // here entity is the XrdSecEntity object associated with the handshake on the
5413 // server side. On input entity contains:
5414 // - in 'name' the username, DN, DN hash according to the GMAP option
5415 // - in 'host' the client hostname
5416 // - in 'creds'the proxy chain
5417 // The proxy chain can be either in 'raw' or 'PEM base64' format (see below).
5418 // This function returns
5419 // 0 on success
5420 // <0 on error (implies authentication failure)
5421 //
5422 // 2. The initialization function:
5423 //
5424 // int XrdSecgsiAuthzInit(const char *)
5425 //
5426 // here 'parameters' is the string of parameters, separated by ' '.
5427 // This function return <0 in case of failure or the format type of the proxy chain
5428 // expected by the main function:
5429 // 0 raw, to be used with XrdCrypto tools
5430 // 1 PEM (base64 standard string)
5431 //
5432 // 3. The key function:
5433 //
5434 // int XrdSecgsiAuthzKey(XrdSecEntity &entity, char **key)
5435 //
5436 // here entity is the XrdSecEntity object associated with the handshake on the
5437 // server side. On input entity contains in 'creds' the proxy chain, with the same
5438 // convention for the format as above. The function is expecetd to fill in '*key'
5439 // the key to be used to cache the result of the main function and to return the
5440 // length of the key. The key will be destroyed with 'delete []', so it must be
5441 // allocated internally with 'new char[]'.
5442 //
5443 EPNAME("LoadAuthzFun");
5444 char errBuff[2048];
5445
5446 certfmt = -1;
5447 // Make sure the input config file is defined
5448 if (!plugin || strlen(plugin) <= 0) {
5449 PRINT("plug-in file undefined");
5450 return (XrdSecgsiAuthz_t)0;
5451 }
5452
5453 // Create the plug-in instance
5454 XrdOucPinLoader authzLib(errBuff,sizeof(errBuff),gsiVersion,"authzlib",plugin);
5455
5456 // Use global symbols?
5457 bool useglobals = 0;
5458 XrdOucString params, ps(parms), p;
5459 int from = 0;
5460 while ((from = ps.tokenize(p, from, '|')) != -1) {
5461 if (p == "useglobals") {
5462 useglobals = 1;
5463 } else {
5464 if (params.length() > 0) params += " ";
5465 params += p;
5466 }
5467 }
5468 DEBUG("params: '"<< params<<"'; useglobals: "<<useglobals);
5469
5470 // Get the function
5471 XrdSecgsiAuthz_t ep = 0;
5472 if (useglobals) authzLib.Global(true);
5473 ep = (XrdSecgsiAuthz_t) authzLib.Resolve("XrdSecgsiAuthzFun");
5474 if (!ep) {
5475 PRINT(errBuff);
5476 PRINT("could not find 'XrdSecgsiAuthzFun()' in "<<plugin);
5477 return (XrdSecgsiAuthz_t)0;
5478 }
5479
5480 // Get the key function
5481 AuthzKey = (XrdSecgsiAuthzKey_t) authzLib.Resolve("XrdSecgsiAuthzKey");
5482 if (!AuthzKey) {
5483 PRINT(errBuff);
5484 PRINT("could not find 'XrdSecgsiAuthzKey()' in "<<plugin);
5485 return (XrdSecgsiAuthz_t)0;
5486 }
5487
5488 // Get the init function
5489 XrdSecgsiAuthzInit_t epinit = 0;
5490 epinit = (XrdSecgsiAuthzInit_t) authzLib.Resolve("XrdSecgsiAuthzInit");
5491 if (!epinit) {
5492 PRINT("could not find 'XrdSecgsiAuthzInit()' in "<<plugin);
5493 return (XrdSecgsiAuthz_t)0;
5494 }
5495
5496 // Init it
5497 if ((certfmt = (*epinit)(params.c_str())) == -1) {
5498 PRINT("problems executing 'XrdSecgsiAuthzInit()' (rc: "<<certfmt<<")");
5499 return (XrdSecgsiAuthz_t)0;
5500 }
5501
5502 // Notify
5503 PRINT("using 'XrdSecgsiAuthzFun()' from "<<plugin);
5504
5505 // Done
5506 return ep;
5507}
5508
5509//_____________________________________________________________________________
5510XrdSecgsiVOMS_t XrdSecProtocolgsi::LoadVOMSFun(const char *plugin,
5511 const char *parms, int &certfmt)
5512{
5513 // Load the authorization function from the specified plug-in.
5514 // The plug-in must contain two functions, to be all declared as 'extern C'.
5515 //
5516 // 1. The main function:
5517 //
5518 // int XrdSecgsiVOMSFun(XrdSecEntity &entity)
5519 //
5520 // here entity is the XrdSecEntity object associated with the handshake on the
5521 // server side. On input entity contains:
5522 // - in 'name' the username, DN, DN hash according to the GMAP option
5523 // - in 'host' the client hostname
5524 // - in 'creds'the proxy chain
5525 // The proxy chain can be either in 'raw' or 'PEM base64' format (see below).
5526 // This function returns
5527 // 0 on success
5528 // <0 on error (implies authentication failure)
5529 //
5530 // 2. The initialization function:
5531 //
5532 // int XrdSecgsiVOMSInit(const char *)
5533 //
5534 // here 'parameters' is the string of parameters, separated by ' '.
5535 // This function return <0 in case of failure or the format type of the proxy chain
5536 // expected by the main function:
5537 // 0 raw, to be used with XrdCrypto tools
5538 // 1 PEM (base64 standard string)
5539 //
5540 EPNAME("LoadVOMSFun");
5541 char errBuff[2048];
5542
5543 certfmt = -1;
5544 // Make sure the input config file is defined
5545 if (!plugin || strlen(plugin) <= 0) {
5546 PRINT("plug-in file undefined");
5547 return (XrdSecgsiAuthz_t)0;
5548 }
5549
5550 // Create the plug-in instance
5551 XrdOucPinLoader vomsLib(errBuff,sizeof(errBuff),gsiVersion,"vomslib",plugin);
5552
5553 // Use global symbols?
5554 bool useglobals = 0;
5555 XrdOucString params, ps(parms), p;
5556 int from = 0;
5557 while ((from = ps.tokenize(p, from, '|')) != -1) {
5558 if (p == "useglobals") {
5559 useglobals = 1;
5560 } else {
5561 if (params.length() > 0) params += " ";
5562 params += p;
5563 }
5564 }
5565 DEBUG("params: '"<< params<<"'; useglobals: "<<useglobals);
5566
5567 // Get the function
5568 XrdSecgsiVOMS_t ep = 0;
5569 if (useglobals) vomsLib.Global(true);
5570 ep = (XrdSecgsiVOMS_t) vomsLib.Resolve("XrdSecgsiVOMSFun");
5571 if (!ep) {
5572 PRINT(errBuff);
5573 PRINT("could not find 'XrdSecgsiVOMSFun()' in "<<plugin);
5574 return (XrdSecgsiAuthz_t)0;
5575 }
5576
5577 // Get the init function
5578 XrdSecgsiVOMSInit_t epinit = 0;
5579 epinit = (XrdSecgsiVOMSInit_t) vomsLib.Resolve("XrdSecgsiVOMSInit");
5580 if (!epinit) {
5581 PRINT(errBuff);
5582 PRINT("could not find 'XrdSecgsiVOMSInit()' in "<<plugin);
5583 return (XrdSecgsiVOMS_t)0;
5584 }
5585
5586 // Init it
5587 if ((certfmt = (*epinit)(params.c_str())) == -1) {
5588 PRINT("problems executing 'XrdSecgsiVOMSInit()' (rc: "<<certfmt<<")");
5589 return (XrdSecgsiVOMS_t)0;
5590 }
5591
5592 // Notify
5593 PRINT("using 'XrdSecgsiVOMSFun()' from "<<plugin);
5594
5595 // Done
5596 return ep;
5597}
5598
5599
5600//_____________________________________________________________________________
5601bool XrdSecProtocolgsi::ServerCertNameOK(const char *subject, const char *hname, XrdOucString &emsg)
5602{
5603 // Check that the server certificate subject name is consistent with the
5604 // expectations defined by the static SrvAllowedNames
5605
5606 // The subject must be defined
5607 if (!subject || strlen(subject) <= 0) return 0;
5608
5609 bool allowed = 0;
5610 emsg = "";
5611
5612 // The server subject and its CN
5613 String srvsubj(subject);
5614 String srvcn;
5615 int cnidx = srvsubj.find("CN=");
5616 if (cnidx != STR_NPOS) srvcn.assign(srvsubj, cnidx + 3);
5617
5618 // Always check if the server CN is in the standard form "[*/]<target host name>[/*]"
5619 if (hname) {
5620 size_t ih = srvcn.find("/");
5621 if (ih != std::string::npos) {
5622 srvcn.erasefromstart(ih + 1);
5623 }
5624 allowed = XrdCryptoX509::MatchHostnames(srvcn.c_str(), hname);
5625
5626 // Update the error msg, if the case
5627 if (!allowed) {
5628 if (emsg.length() <= 0) {
5629 emsg = "server certificate CN '"; emsg += srvcn;
5630 emsg += "' does not match the expected format(s):";
5631 }
5632 String defcn("[*/]"); defcn += hname; defcn += "[/*]";
5633 emsg += " '"; emsg += defcn; emsg += "' (default)";
5634 }
5635 }
5636
5637 // Take into account specific requests, if any
5638 if (SrvAllowedNames.length() > 0) {
5639 // The SrvAllowedNames string contains the allowed formats separated by a '|'.
5640 // The specifications can contain the <host> or <fqdn> placeholders which
5641 // are replaced by hname; they can also contain the '*' wildcard, in
5642 // which case XrdOucString::matches is used. A '-' before the specification
5643 // will deny the matching CN's; the last matching wins.
5644 String allowedfmts(SrvAllowedNames);
5645 allowedfmts.replace("<host>", hname);
5646 allowedfmts.replace("<fqdn>", hname);
5647 int from = 0;
5648 String fmt;
5649 while ((from = allowedfmts.tokenize(fmt, from, '|')) != -1) {
5650 // Check if this should be denied
5651 bool deny = 0;
5652 if (fmt.beginswith("-")) {
5653 deny = 1;
5654 fmt.erasefromstart(1);
5655 }
5656 if (srvcn.matches(fmt.c_str()) > 0) allowed = (deny) ? 0 : 1;
5657 }
5658 // Update the error msg, if the case
5659 if (!allowed) {
5660 if (emsg.length() <= 0) {
5661 emsg = "server certificate CN '"; emsg += srvcn;
5662 emsg += "' does not match the expected format:";
5663 }
5664 emsg += " '"; emsg += SrvAllowedNames; emsg += "' (exceptions)";
5665 }
5666 }
5667 // Reset error msg, if the match was successful
5668 if (allowed)
5669 emsg = "";
5670 else
5671 emsg += "; exceptions are controlled by the env XrdSecGSISRVNAMES";
5672
5673 // Done
5674 return allowed;
5675}
5676
5677//_____________________________________________________________________________
5678static bool GetSrvCertEntCheck(XrdSutCacheEntry *e, void *a) {
5679 int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
5680 time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
5681 if (e) {
5682 if (e->status > st_ref) {
5683 if (e->mtime >= ts_ref)
5684 return true;
5685 }
5686 }
5687 return false;
5688}
5689
5690//_____________________________________________________________________________
5691XrdSutCacheEntry *XrdSecProtocolgsi::GetSrvCertEnt(XrdSutCERef &ceref,
5692 XrdCryptoFactory *cf,
5693 time_t timestamp, String &certcalist)
5694{
5695 // Get cache entry for server certificate. This function checks the cache
5696 // and loads or re-loads the certificate form the specified files if required.
5697 // make sure we got what we need
5698 EPNAME("GetSrvCertEnt");
5699
5700 if (!cf) {
5701 PRINT("Invalid inputs");
5702 return (XrdSutCacheEntry *)0;
5703 }
5704
5705 bool rdlock = false;
5706 XrdSutCacheArg_t arg = {kCE_allowed, timestamp, -1, -1};
5707 XrdSutCacheEntry *cent = cacheCert.Get(cf->Name(), rdlock, GetSrvCertEntCheck, (void *) &arg);
5708 if (!cent) {
5709 PRINT("unable to get a valid entry from cache for " << cf->Name());
5710 return (XrdSutCacheEntry *)0;
5711 }
5712 ceref.Set(&(cent->rwmtx));
5713
5714 // Are we done ?
5715 if (rdlock) return cent;
5716 if (cent->buf1.buf) PRINT("entry has expired: trying to renew ...");
5717
5718 // Try get one or renew-it
5719 if (cent->status == kCE_special) {
5720 // Try init proxies
5721 ProxyIn_t pi = {SrvCert.c_str(), SrvKey.c_str(), CAdir.c_str(),
5722 UsrProxy.c_str(), PxyValid.c_str(), 0, 512, false};
5723 X509Chain *ch = 0;
5724 XrdCryptoRSA *k = 0;
5725 XrdSutBucket *b = 0;
5726 ProxyOut_t po = {ch, k, b };
5727 // We lock inside
5728 ceref.UnLock(false);
5729 if (QueryProxy(0, &cacheCert, cf->Name(), cf, timestamp, &pi, &po) != 0) {
5730 PRINT("proxy expired and cannot be renewed");
5731 return (XrdSutCacheEntry *)0;
5732 }
5733 // When successful we return read-locked (this flow needs checking; but it is not mainstream)
5734 ceref.ReadLock();
5735 return cent;
5736 }
5737
5738 // Reset the entry
5739 delete (XrdCryptoX509 *) cent->buf1.buf; // Destroys also xsrv->PKI() pointed in cent->buf2.buf
5740 delete (XrdSutBucket *) cent->buf3.buf;
5741 cent->buf1.buf = 0;
5742 cent->buf2.buf = 0;
5743 cent->buf3.buf = 0;
5744
5745 //
5746 // Get the IDs of the file: we need them to acquire the right privileges when opening
5747 // the certificate
5748 uid_t gsi_uid = geteuid();
5749 gid_t gsi_gid = getegid();
5750 struct stat st;
5751 if (!stat(SrvKey.c_str(), &st)) {
5752 if (st.st_uid != gsi_uid || st.st_gid != gsi_gid) {
5753 gsi_uid = st.st_uid;
5754 gsi_gid = st.st_gid;
5755 }
5756 }
5757
5758 // Check normal certificates
5759 XrdCryptoX509 *xsrv = cf->X509(SrvCert.c_str(), SrvKey.c_str());
5760 if (xsrv) {
5761 // Must be of EEC type
5762 if (xsrv->type != XrdCryptoX509::kEEC) {
5763 PRINT("problems loading srv cert: not EEC but: "<<xsrv->Type());
5764 SafeDelete(xsrv);
5765 ceref.UnLock();
5766 return (XrdSutCacheEntry *)0;
5767 }
5768 // Must be valid
5769 if (!(xsrv->IsValid())) {
5770 PRINT("problems loading srv cert: invalid");
5771 SafeDelete(xsrv);
5772 ceref.UnLock();
5773 return (XrdSutCacheEntry *)0;
5774 }
5775 // PKI must have been successfully initialized
5776 if (!xsrv->PKI() || xsrv->PKI()->status != XrdCryptoRSA::kComplete) {
5777 PRINT("problems loading srv cert: invalid PKI");
5778 SafeDelete(xsrv);
5779 ceref.UnLock();
5780 return (XrdSutCacheEntry *)0;
5781 }
5782 // Must be exportable
5783 XrdSutBucket *xbck = xsrv->Export();
5784 if (!xbck) {
5785 PRINT("problems loading srv cert: cannot export into bucket");
5786 SafeDelete(xsrv);
5787 ceref.UnLock();
5788 return (XrdSutCacheEntry *)0;
5789 }
5790 // We must have the issuing CA certificate
5791 int rcgetca = 0;
5792 if ((rcgetca = GetCA(xsrv->IssuerHash(), cf)) != 0) {
5793 String emsg(xsrv->IssuerHash());
5794 // Try different name hash, if it makes sense
5795 if (strcmp(xsrv->IssuerHash(1), xsrv->IssuerHash(0))) {
5796 if ((rcgetca = GetCA(xsrv->IssuerHash(1), cf)) != 0) {
5797 emsg += "|";
5798 emsg += xsrv->IssuerHash(1);
5799 }
5800 }
5801 if (rcgetca != 0) {
5802 // We do not have it, really
5803 if (rcgetca == -1) {
5804 PRINT("do not have certificate for the issuing CA '"<<emsg<<"'");
5805 } else {
5806 PRINT("failed to load certificate for the issuing CA '"<<emsg<<"'");
5807 }
5808 SafeDelete(xsrv);
5809 SafeDelete(xbck);
5810 ceref.UnLock();
5811 return (XrdSutCacheEntry *)0;
5812 }
5813 }
5814
5815 // Ok: save it into the cache
5816 cent->status = kCE_ok;
5817 cent->cnt = 0;
5818 cent->mtime = xsrv->NotAfter(); // expiration time
5819 // Save pointer to certificate (destroys also xsrv->PKI())
5820 if (cent->buf1.buf) delete (XrdCryptoX509 *) cent->buf1.buf;
5821 cent->buf1.buf = (char *)xsrv;
5822 cent->buf1.len = 0; // just a flag
5823 // Save pointer to key
5824 cent->buf2.buf = 0;
5825 cent->buf2.buf = (char *)(xsrv->PKI());
5826 cent->buf2.len = 0; // just a flag
5827 // Save pointer to bucket
5828 if (cent->buf3.buf) delete (XrdSutBucket *) cent->buf3.buf;
5829 cent->buf3.buf = (char *)(xbck);
5830 cent->buf3.len = 0; // just a flag
5831 // Save CA hash in list to communicate to clients
5832 if (certcalist.find(xsrv->IssuerHash()) == STR_NPOS) {
5833 if (certcalist.length() > 0) certcalist += "|";
5834 certcalist += xsrv->IssuerHash();
5835 }
5836 // Save also old CA hash in list to communicate to clients, if relevant
5837 if (HashCompatibility && xsrv->IssuerHash(1) &&
5838 strcmp(xsrv->IssuerHash(1),xsrv->IssuerHash())) {
5839 if (certcalist.find(xsrv->IssuerHash(1)) == STR_NPOS) {
5840 if (certcalist.length() > 0) certcalist += "|";
5841 certcalist += xsrv->IssuerHash(1);
5842 }
5843 }
5844 } else {
5845 PRINT("failed to load certificate from files ("<< SrvCert <<","<<SrvKey<<")");
5846 }
5847
5848 // When successful we return read-locked; need to write-unlock before to avoid dead locking
5849 ceref.UnLock(false);
5850 ceref.ReadLock();
5851
5852 // Done
5853 return cent;
5854}
5855
int kXR_int32
Definition XPtypes.hh:89
#define DEBUG(x)
#define EPNAME(x)
#define TRACE_Debug
#define QTRACE(act)
void XrdCryptoSetTrace(kXR_int32 trace)
static XrdSysLogger Logger
static XrdSysError eDest(0,"crypto_")
#define cryptoTRACE_Notify
#define cryptoTRACE_Dump
#define cryptoTRACE_Debug
#define XrdCryptoDefRSABits
int(* XrdCryptoX509ChainToFile_t)(XrdCryptoX509Chain *, const char *)
int(* XrdCryptoX509CreateProxy_t)(const char *, const char *, XrdProxyOpt_t *, XrdCryptogsiX509Chain *, XrdCryptoRSA **, const char *)
int(* XrdCryptoX509SignProxyReq_t)(XrdCryptoX509 *, XrdCryptoRSA *, XrdCryptoX509Req *, XrdCryptoX509 **)
XrdSutBucket *(* XrdCryptoX509ExportChain_t)(XrdCryptoX509Chain *, bool)
int(* XrdCryptoX509ParseBucket_t)(XrdSutBucket *, XrdCryptoX509Chain *)
int(* XrdCryptoX509ParseFile_t)(const char *fname, XrdCryptoX509Chain *, const char *)
int(* XrdCryptoX509CreateProxyReq_t)(XrdCryptoX509 *, XrdCryptoX509Req **, XrdCryptoRSA **)
const int kOptsCheckSubCA
#define PRINT(y)
XrdOucGMap * XrdOucgetGMap(XrdOucGMapArgs)
Definition XrdOucGMap.cc:92
#define STR_NPOS
#define access(a, b)
Definition XrdPosix.hh:39
#define fopen(a, b)
Definition XrdPosix.hh:49
#define opendir(a)
Definition XrdPosix.hh:73
#define closedir(a)
Definition XrdPosix.hh:45
#define stat(a, b)
Definition XrdPosix.hh:96
#define readdir(a)
Definition XrdPosix.hh:81
XrdSecBuffer XrdSecParameters
XrdSecBuffer XrdSecCredentials
static bool GetCACheck(XrdSutCacheEntry *e, void *a)
static const char * gGSErrStr[]
static const char * gsiServerSteps[]
static bool QueryProxyCheck(XrdSutCacheEntry *e, void *a)
static const int kOneDay
static const char * gNoPadTag
static const char * ClientStepStr(int kclt)
static const char * gUsrPxyDef
static const kXR_int32 Version
static const char * ServerStepStr(int ksrv)
static String ProtoID
static bool GetSrvCertEntCheck(XrdSutCacheEntry *e, void *a)
static bool QueryGMAPCheck(XrdSutCacheEntry *e, void *a)
XrdVERSIONINFO(XrdSecProtocolgsiObject, secgsi)
#define POPTS(t, y)
static String Prefix
static const char * gsiClientSteps[]
XrdSecProtocol * XrdSecProtocolgsiObject(const char mode, const char *hostname, XrdNetAddrInfo &endPoint, const char *parms, XrdOucErrInfo *erp)
static bool AuthzFunCheck(XrdSutCacheEntry *e, void *a)
XrdOucTrace * gsiTrace
char * XrdSecProtocolgsiInit(const char mode, const char *parms, XrdOucErrInfo *erp)
@ kOptsDelChn
@ kOptsDelPxy
@ kOptsSigReq
@ kOptsFwdPxy
@ kOptsPxCred
@ kOptsSrvReq
@ kOptsDlgPxy
@ kOptsCreatePxy
@ kOptsPxFile
#define SafeDelete(x)
const char * valid
int(* XrdSecgsiAuthz_t)(XrdSecEntity &)
XrdSutBucket * cbck
const char * out
XrdCryptoRSA * ksig
XrdCryptogsiX509Chain X509Chain
const char * key
#define REL2(x, y)
#define kMAXBUFLEN
@ kXGS_cert
@ kXGS_none
@ kXGS_pxyreq
@ kXGS_init
@ kXGS_reserved
XrdSecgsiAuthz_t XrdSecgsiVOMS_t
int(* XrdSecgsiAuthzKey_t)(XrdSecEntity &, char **)
#define XrdSecgsiVersCertKey
#define XrdSecgsiVersDHsigned
@ kgST_ok
@ kgST_error
@ kgST_more
#define SafeFree(x)
int(* XrdSecgsiAuthzInit_t)(const char *)
const char * certdir
const char * cert
#define SafeDelArray(x)
#define XrdCryptoMax
@ kXGC_sigpxy
@ kXGC_cert
@ kXGC_reserved
@ kXGC_none
@ kXGC_certreq
#define XrdSecPROTOIDLEN
XrdSecgsiAuthzInit_t XrdSecgsiVOMSInit_t
#define REL3(x, y, z)
@ kGSErrExportPuK
@ kGSErrBadRndmTag
@ kGSErrNoCipher
@ kGSErrInit
@ kGSErrParseBuffer
@ kGSErrBadProtocol
@ kGSErrNoPublic
@ kGSErrSerialBuffer
@ kGSErrDecodeBuffer
@ kGSErrBadOpt
@ kGSErrAddBucket
@ kGSErrError
@ kGSErrCreateBucket
@ kGSErrNoBuffer
char *(* XrdSecgsiGMAP_t)(const char *, int)
#define XrdSecPROTOIDENT
#define XrdSecgsiVERSION
X509Chain * chain
#define XrdSecNOIPCHK
#define TRACE_Authen
XrdOucTrace * gsiTrace
#define LIB_XRDVOMS
XrdCryptoX509ParseFile_t ParseFile
XrdOucString CAdir
XrdOucString CRLdir
bool Debug
XrdOucString CryptoMod
#define NOTIFY(y)
int ncrypt
XrdOucString DefCrypto
XrdOucString CryptList
XrdCryptoFactory ** CF
void ParseCrypto()
struct myOpts opts
int emsg(int rc, char *msg)
int XrdSutParseTime(const char *tstr, int opt)
Definition XrdSutAux.cc:540
int XrdSutExpand(XrdOucString &path)
Definition XrdSutAux.cc:366
int XrdSutResolve(XrdOucString &path, const char *ho, const char *vo, const char *gr, const char *us)
Definition XrdSutAux.cc:425
const char * XrdSutHome()
Definition XrdSutAux.cc:465
const char * XrdSutBuckStr(int kbck)
Definition XrdSutAux.cc:121
void XrdSutSetTrace(kXR_int32 trace)
Definition XrdSutAux.cc:93
@ kXRS_issuer_hash
Definition XrdSutAux.hh:80
@ kXRS_user
Definition XrdSutAux.hh:65
@ kXRS_signed_rtag
Definition XrdSutAux.hh:64
@ kXRS_cipher_alg
Definition XrdSutAux.hh:82
@ kXRS_rtag
Definition XrdSutAux.hh:63
@ kXRS_version
Definition XrdSutAux.hh:71
@ kXRS_message
Definition XrdSutAux.hh:68
@ kXRS_x509
Definition XrdSutAux.hh:79
@ kXRS_puk
Definition XrdSutAux.hh:61
@ kXRS_cipher
Definition XrdSutAux.hh:62
@ kXRS_main
Definition XrdSutAux.hh:58
@ kXRS_x509_req
Definition XrdSutAux.hh:81
@ kXRS_md_alg
Definition XrdSutAux.hh:83
@ kXRS_cryptomod
Definition XrdSutAux.hh:57
@ kXRS_clnt_opts
Definition XrdSutAux.hh:76
#define sutTRACE_Notify
Definition XrdSutAux.hh:100
#define sutTRACE_Debug
Definition XrdSutAux.hh:99
#define sutTRACE_Dump
Definition XrdSutAux.hh:98
@ kCE_special
@ kCE_ok
@ kCE_allowed
@ kCE_disabled
@ kCE_inactive
size_t strlcpy(char *dst, const char *src, size_t sz)
#define TRACE(act, x)
Definition XrdTrace.hh:63
#define TRACE_ALL
Definition XrdTrace.hh:35
#define ID
void Add(T *t)
void Del(T *t)
virtual int Length() const
virtual char * Buffer() const
virtual void SetIV(int l, const char *iv)
virtual int Decrypt(const char *in, int lin, char *out)
virtual int DecOutLength(int l)
virtual char * RefreshIV(int &l)
virtual int Encrypt(const char *in, int lin, char *out)
virtual int MaxIVLength() const
virtual XrdSutBucket * AsBucket()
virtual char * Public(int &lpub)
virtual bool IsValid()
virtual int EncOutLength(int l)
virtual bool Finalize(bool padded, char *pub, int lpub, const char *t)
virtual bool HasPaddingSupport()
virtual XrdCryptoX509ParseBucket_t X509ParseBucket()
virtual XrdCryptoX509CreateProxyReq_t X509CreateProxyReq()
virtual XrdCryptoX509 * X509(const char *cf, const char *kf=0)
virtual void SetTrace(kXR_int32 trace)
virtual XrdCryptoX509ParseFile_t X509ParseFile()
virtual XrdCryptoX509CreateProxy_t X509CreateProxy()
char * Name() const
virtual XrdCryptoX509ChainToFile_t X509ChainToFile()
virtual XrdCryptoCipher * Cipher(const char *t, int l=0)
virtual XrdCryptoRSA * RSA(int b=0, int e=0)
virtual bool SupportedMsgDigest(const char *dgst)
virtual XrdCryptoMsgDigest * MsgDigest(const char *dgst)
virtual XrdCryptoX509Crl * X509Crl(const char *crlfile, int opt=0)
static XrdCryptoFactory * GetCryptoFactory(const char *factoryname)
virtual bool SupportedCipher(const char *t)
virtual XrdCryptoX509Req * X509Req(XrdSutBucket *bck)
virtual XrdCryptoX509SignProxyReq_t X509SignProxyReq()
virtual XrdCryptoX509ExportChain_t X509ExportChain()
virtual void Notify()
virtual int Update(const char *b, int l)
virtual int Reset(const char *dgst)
virtual int ExportPrivate(char *out, int lout)
ERSAStatus status
virtual int EncryptPrivate(const char *in, int lin, char *out, int lout)
virtual int GetOutlen(int lin)
virtual int ImportPrivate(const char *in, int lin)
virtual int DecryptPublic(const char *in, int lin, char *out, int lout)
virtual int GetPrilen()
virtual int ExportPublic(char *out, int lout)
bool CheckCA(bool checkselfsigned=1)
XrdCryptoX509 * Next()
virtual int CheckValidity(bool outatfirst=1, int when=0)
const char * LastError() const
XrdCryptoX509 * Begin()
XrdCryptoX509 * EffCA() const
void Cleanup(bool keepCA=0)
void Remove(XrdCryptoX509 *c)
void SetStatusCA(ECAStatus st)
void PushBack(XrdCryptoX509 *c)
const char * X509ChainError(EX509ChainErr e)
XrdCryptoX509 * End() const
void PutInFront(XrdCryptoX509 *c)
virtual const char * IssuerHash(int)
virtual bool IsExpired(int when=0)
virtual bool Verify(XrdCryptoX509 *ref)
virtual XrdSutBucket * Export()
virtual const char * Subject()
virtual bool MatchesSAN(const char *fqdn, bool &hasSAN)=0
const char * Type(EX509Type t=kUnknown) const
virtual XrdCryptoRSA * PKI()
virtual const char * SubjectHash(int)
virtual time_t NotBefore()
virtual const char * IssuerHash(int)
virtual XrdSutBucket * Export()
static bool MatchHostnames(const char *match_pattern, const char *fqdn)
virtual bool IsValid(int when=0)
virtual time_t NotAfter()
bool Verify(EX509ChainErr &e, x509ChainVerifyOpt_t *vopt=0)
static const int noPort
Do not add port number.
static bool isHostName(const char *name)
int Format(char *bAddr, int bLen, fmtUse fmtType=fmtAuto, int fmtOpts=0)
@ fmtName
Hostname if it is resolvable o/w use fmtAddr.
const char * Name(const char *eName=0, const char **eText=0)
const char * Set(const char *hSpec, int pNum=PortInSpec)
char * Get(const char *varname)
Definition XrdOucEnv.hh:69
XrdOucEnv * getEnv()
const char * getErrText()
int setErrInfo(int code, const char *emsg)
virtual int dn2user(const char *dn, char *user, int ulen, time_t now=0)
void insert(const int i, int start=-1)
void assign(const char *s, int j, int k=-1)
int erasefromstart(int sz=0)
bool endswith(char c)
bool beginswith(char c)
int erase(int start=0, int size=0)
int matches(const char *s, char wch=' *')
int replace(const char *s1, const char *s2, int from=0, int to=-1)
int find(const char c, int start=0, bool forward=1)
int length() const
int form(const char *fmt,...)
int tokenize(XrdOucString &tok, int from, char del=':')
const char * c_str() const
char * GetToken(char **rest=0, int lowcase=0)
bool Add(XrdSecAttr &attr)
char * vorg
Entity's virtual organization(s)
int credslen
Length of the 'creds' data.
XrdNetAddrInfo * addrInfo
Entity's connection details.
XrdSecEntityAttr * eaAPI
non-const API to attributes
const char * tident
Trace identifier always preset.
char prot[XrdSecPROTOIDSIZE]
Auth protocol used (e.g. krb5)
char * caps
Entity's capabilities.
char * creds
Raw entity credentials or cert.
char * grps
Entity's group name(s)
char * name
Entity's name.
char * role
Entity's role(s)
char * endorsements
Protocol specific endorsements.
char * moninfo
Information for monitoring.
char * host
Entity's host name dnr dependent.
XrdSecEntity Entity
static XrdOucTrace * EnableTracing()
int Authenticate(XrdSecCredentials *cred, XrdSecParameters **parms, XrdOucErrInfo *einfo=0)
int Verify(const char *inbuf, int inlen, const char *sigbuf, int siglen)
XrdSecProtocolgsi(int opts, const char *hname, XrdNetAddrInfo &endPoint, const char *parms=0)
int Decrypt(const char *inbuf, int inlen, XrdSecBuffer **outbuf)
int Encrypt(const char *inbuf, int inlen, XrdSecBuffer **outbuf)
void Delete()
Delete the protocol object. DO NOT use C++ delete() on this object.
static char * Init(gsiOptions o, XrdOucErrInfo *erp)
XrdSecCredentials * getCredentials(XrdSecParameters *parm=0, XrdOucErrInfo *einfo=0)
int getKey(char *kbuf=0, int klen=0)
int Sign(const char *inbuf, int inlen, XrdSecBuffer **outbuf)
int setKey(char *kbuf, int klen)
kXR_int32 type
kXR_int32 size
int SetBuf(const char *nb=0, int ns=0)
void ToString(XrdOucString &s)
void Update(char *nb=0, int ns=0, int ty=0)
int AddBucket(char *bp=0, int sz=0, int ty=0)
int UpdateBucket(const char *bp, int sz, int ty)
int Serialized(char **buffer, char opt='n')
void SetStep(int s)
const char * GetProtocol() const
void Dump(const char *stepstr=0, bool all=false)
const char * GetOptions() const
int GetStep() const
XrdSutBucket * GetBucket(kXR_int32 type, const char *tag=0)
kXR_int32 MarshalBucket(kXR_int32 type, kXR_int32 code)
void Deactivate(kXR_int32 type)
kXR_int32 UnmarshalBucket(kXR_int32 type, kXR_int32 &code)
void UnLock(bool reset=true)
void ReadLock(XrdSysRWLock *lock=0)
void Set(XrdSysRWLock *lock)
XrdSutCacheEntryBuf buf2
XrdSutCacheEntryBuf buf1
XrdSutCacheEntryBuf buf3
XrdSutCacheEntry * Get(const char *tag)
void SetBuf(const char *b=0, kXR_int32 l=0)
kXR_int32 len
kXR_int32 mtime
XrdSutPFBuf buf1
XrdSutPFBuf buf4
static int GetRndmTag(XrdOucString &rtag)
XrdSysLogger * logger(XrdSysLogger *lp=0)
XrdSutPFEntry * Cref
X509Chain * PxyChain
XrdCryptoX509Crl * Crl
XrdSutBuffer * Parms
XrdSutBucket * Cbck
void Dump(XrdSecProtocolgsi *p=0)
X509Chain * Chain
XrdSutPFEntry * Pent
XrdCryptoCipher * Rcip
void Print(XrdOucTrace *t)
Generic structure to pass security information back and forth.
char * buffer
Pointer to the buffer.
int size
Size of the buffer or length of data in the buffer.