00001
00002
00003
00004
00005
00006
00007
00008
00009 #include <XrdOuc/XrdOucErrInfo.hh>
00010 #include <XrdSys/XrdSysPthread.hh>
00011 #include <XrdOuc/XrdOucString.hh>
00012 #include <XrdOuc/XrdOucTokenizer.hh>
00013
00014 #include <XrdSec/XrdSecInterface.hh>
00015 #include <XrdSecgsi/XrdSecgsiTrace.hh>
00016
00017 #include <XrdSut/XrdSutPFEntry.hh>
00018 #include <XrdSut/XrdSutPFile.hh>
00019 #include <XrdSut/XrdSutBuffer.hh>
00020 #include <XrdSut/XrdSutRndm.hh>
00021
00022 #include <XrdCrypto/XrdCryptoAux.hh>
00023 #include <XrdCrypto/XrdCryptoCipher.hh>
00024 #include <XrdCrypto/XrdCryptoFactory.hh>
00025 #include <XrdCrypto/XrdCryptoX509Crl.hh>
00026
00027 #include <XrdCrypto/XrdCryptosslgsiX509Chain.hh>
00028
00029
00030
00031
00032
00033 typedef XrdOucString String;
00034 typedef XrdCryptosslgsiX509Chain X509Chain;
00035
00036 #define XrdSecPROTOIDENT "gsi"
00037 #define XrdSecPROTOIDLEN sizeof(XrdSecPROTOIDENT)
00038 #define XrdSecgsiVERSION 10200
00039 #define XrdSecNOIPCHK 0x0001
00040 #define XrdSecDEBUG 0x1000
00041 #define XrdCryptoMax 10
00042
00043 #define kMAXBUFLEN 1024
00044
00045
00046
00047 enum kgsiStatus {
00048 kgST_error = -1,
00049 kgST_ok = 0,
00050 kgST_more = 1
00051 };
00052
00053
00054 enum kgsiClientSteps {
00055 kXGC_none = 0,
00056 kXGC_certreq = 1000,
00057 kXGC_cert,
00058 kXGC_sigpxy,
00059 kXGC_reserved
00060 };
00061
00062
00063 enum kgsiServerSteps {
00064 kXGS_none = 0,
00065 kXGS_init = 2000,
00066 kXGS_cert,
00067 kXGS_pxyreq,
00068 kXGS_reserved
00069 };
00070
00071
00072 enum kgsiHandshakeOpts {
00073 kOptsDlgPxy = 1,
00074 kOptsFwdPxy = 2,
00075 kOptsSigReq = 4,
00076 kOptsSrvReq = 8,
00077 kOptsPxFile = 16,
00078 kOptsDelChn = 32
00079 };
00080
00081
00082 enum kgsiErrors {
00083 kGSErrParseBuffer = 10000,
00084 kGSErrDecodeBuffer,
00085 kGSErrLoadCrypto,
00086 kGSErrBadProtocol,
00087 kGSErrCreateBucket,
00088 kGSErrDuplicateBucket,
00089 kGSErrCreateBuffer,
00090 kGSErrSerialBuffer,
00091 kGSErrGenCipher,
00092 kGSErrExportPuK,
00093 kGSErrEncRndmTag,
00094 kGSErrBadRndmTag,
00095 kGSErrNoRndmTag,
00096 kGSErrNoCipher,
00097 kGSErrNoCreds,
00098 kGSErrBadOpt,
00099 kGSErrMarshal,
00100 kGSErrUnmarshal,
00101 kGSErrSaveCreds,
00102 kGSErrNoBuffer,
00103 kGSErrRefCipher,
00104 kGSErrNoPublic,
00105 kGSErrAddBucket,
00106 kGSErrFinCipher,
00107 kGSErrInit,
00108 kGSErrBadCreds,
00109 kGSErrError
00110 };
00111
00112 #define REL1(x) { if (x) delete x; }
00113 #define REL2(x,y) { if (x) delete x; if (y) delete y; }
00114 #define REL3(x,y,z) { if (x) delete x; if (y) delete y; if (z) delete z; }
00115
00116 #define SafeDelete(x) { if (x) delete x ; x = 0; }
00117 #define SafeDelArray(x) { if (x) delete [] x ; x = 0; }
00118 #define SafeFree(x) { if (x) free(x) ; x = 0; }
00119
00120
00121 typedef char *(*XrdSecgsiGMAP_t)(const char *, int);
00122 typedef char *(*XrdSecgsiAuthz_t)(const char *, int);
00123
00124
00125
00126
00127 class gsiOptions {
00128 public:
00129 short debug;
00130 short mode;
00131 char *clist;
00132 char *certdir;
00133 char *crldir;
00134 char *crlext;
00135 char *cert;
00136
00137 char *key;
00138
00139 char *cipher;
00140 char *md;
00141 int crl;
00142 int ca;
00143 char *proxy;
00144 char *valid;
00145 int deplen;
00146 int bits;
00147 char *gridmap;
00148 int gmapto;
00149 char *gmapfun;
00150 char *gmapfunparms;
00151 char *authzfun;
00152 char *authzfunparms;
00153 int ogmap;
00154 int dlgpxy;
00155
00156 int sigpxy;
00157 char *srvnames;
00158 char *exppxy;
00159 int authzpxy;
00160
00161
00162 gsiOptions() { debug = -1; mode = 's'; clist = 0;
00163 certdir = 0; crldir = 0; crlext = 0; cert = 0; key = 0;
00164 cipher = 0; md = 0; ca = 1 ; crl = 1;
00165 proxy = 0; valid = 0; deplen = 0; bits = 512;
00166 gridmap = 0; gmapto = -1;
00167 gmapfun = 0; gmapfunparms = 0; authzfun = 0; authzfunparms = 0;
00168 ogmap = 1; dlgpxy = 0; sigpxy = 1; srvnames = 0; exppxy = 0; authzpxy = 0;}
00169 virtual ~gsiOptions() { }
00170 };
00171
00172 class XrdSecProtocolgsi;
00173 class gsiHSVars {
00174 public:
00175 int Iter;
00176 int TimeStamp;
00177 String CryptoMod;
00178 int RemVers;
00179 XrdCryptoCipher *Rcip;
00180 XrdSutBucket *Cbck;
00181 String ID;
00182 XrdSutPFEntry *Cref;
00183 XrdSutPFEntry *Pent;
00184 X509Chain *Chain;
00185 XrdCryptoX509Crl *Crl;
00186 X509Chain *PxyChain;
00187 bool RtagOK;
00188 bool Tty;
00189 int LastStep;
00190 int Options;
00191 XrdSutBuffer *Parms;
00192
00193 gsiHSVars() { Iter = 0; TimeStamp = -1; CryptoMod = "";
00194 RemVers = -1; Rcip = 0;
00195 Cbck = 0;
00196 ID = ""; Cref = 0; Pent = 0; Chain = 0; Crl = 0; PxyChain = 0;
00197 RtagOK = 0; Tty = 0; LastStep = 0; Options = 0; Parms = 0;}
00198
00199 ~gsiHSVars() { SafeDelete(Cref);
00200 if (Options & kOptsDelChn) {
00201
00202 if (Chain) Chain->Cleanup(1);
00203 SafeDelete(Chain);
00204 }
00205
00206
00207 PxyChain = 0;
00208 SafeDelete(Parms); }
00209 void Dump(XrdSecProtocolgsi *p = 0);
00210 };
00211
00212
00213 typedef struct {
00214 X509Chain *chain;
00215 XrdCryptoRSA *ksig;
00216 XrdSutBucket *cbck;
00217 } ProxyOut_t;
00218
00219
00220 typedef struct {
00221 const char *cert;
00222 const char *key;
00223 const char *certdir;
00224 const char *out;
00225 const char *valid;
00226 int deplen;
00227 int bits;
00228 } ProxyIn_t;
00229
00230
00231
00232
00233
00234 class XrdSecProtocolgsi : public XrdSecProtocol
00235 {
00236 public:
00237 int Authenticate (XrdSecCredentials *cred,
00238 XrdSecParameters **parms,
00239 XrdOucErrInfo *einfo=0);
00240
00241 XrdSecCredentials *getCredentials(XrdSecParameters *parm=0,
00242 XrdOucErrInfo *einfo=0);
00243
00244 XrdSecProtocolgsi(int opts, const char *hname,
00245 const struct sockaddr *ipadd, const char *parms = 0);
00246 virtual ~XrdSecProtocolgsi() {}
00247
00248
00249 static char *Init(gsiOptions o, XrdOucErrInfo *erp);
00250
00251 void Delete();
00252
00253
00254 int Encrypt(const char *inbuf, int inlen,
00255 XrdSecBuffer **outbuf);
00256 int Decrypt(const char *inbuf, int inlen,
00257 XrdSecBuffer **outbuf);
00258
00259 int Sign(const char *inbuf, int inlen,
00260 XrdSecBuffer **outbuf);
00261 int Verify(const char *inbuf, int inlen,
00262 const char *sigbuf, int siglen);
00263
00264
00265 int getKey(char *kbuf=0, int klen=0);
00266
00267 int setKey(char *kbuf, int klen);
00268
00269 private:
00270
00271
00272 static XrdSysMutex gsiContext;
00273 static String CAdir;
00274 static String CRLdir;
00275 static String DefCRLext;
00276 static String SrvCert;
00277 static String SrvKey;
00278 static String UsrProxy;
00279 static String UsrCert;
00280 static String UsrKey;
00281 static String PxyValid;
00282 static int DepLength;
00283 static int DefBits;
00284 static int CACheck;
00285 static int CRLCheck;
00286 static String DefCrypto;
00287 static String DefCipher;
00288 static String DefMD;
00289 static String DefError;
00290 static String GMAPFile;
00291 static int GMAPOpt;
00292 static bool GMAPuseDNname;
00293 static int GMAPCacheTimeOut;
00294 static XrdSysPlugin *GMAPPlugin;
00295 static XrdSecgsiGMAP_t GMAPFun;
00296 static XrdSysPlugin *AuthzPlugin;
00297 static XrdSecgsiAuthz_t AuthzFun;
00298 static int PxyReqOpts;
00299 static int AuthzPxyWhat;
00300 static int AuthzPxyWhere;
00301 static String SrvAllowedNames;
00302
00303
00304 static int ncrypt;
00305 static XrdCryptoFactory *cryptF[XrdCryptoMax];
00306 static int cryptID[XrdCryptoMax];
00307 static String cryptName[XrdCryptoMax];
00308 static XrdCryptoCipher *refcip[XrdCryptoMax];
00309
00310
00311 static XrdSutCache cacheCA;
00312 static XrdSutCache cacheCert;
00313 static XrdSutCache cachePxy;
00314 static XrdSutCache cacheGMAP;
00315 static XrdSutCache cacheGMAPFun;
00316
00317
00318 static int Debug;
00319 static bool Server;
00320 static int TimeSkew;
00321
00322
00323 static XrdSysLogger Logger;
00324 static XrdSysError eDest;
00325 static XrdOucTrace *GSITrace;
00326
00327
00328 int options;
00329 struct sockaddr hostaddr;
00330 XrdCryptoFactory *sessionCF;
00331 XrdCryptoCipher *sessionKey;
00332 XrdSutBucket *bucketKey;
00333 XrdCryptoMsgDigest *sessionMD;
00334 XrdCryptoRSA *sessionKsig;
00335 XrdCryptoRSA *sessionKver;
00336 X509Chain *proxyChain;
00337 bool srvMode;
00338
00339
00340 gsiHSVars *hs;
00341
00342
00343 int ParseClientInput(XrdSutBuffer *br, XrdSutBuffer **bm,
00344 String &emsg);
00345 int ClientDoInit(XrdSutBuffer *br, XrdSutBuffer **bm,
00346 String &cmsg);
00347 int ClientDoCert(XrdSutBuffer *br, XrdSutBuffer **bm,
00348 String &cmsg);
00349 int ClientDoPxyreq(XrdSutBuffer *br, XrdSutBuffer **bm,
00350 String &cmsg);
00351
00352
00353 int ParseServerInput(XrdSutBuffer *br, XrdSutBuffer **bm,
00354 String &cmsg);
00355 int ServerDoCertreq(XrdSutBuffer *br, XrdSutBuffer **bm,
00356 String &cmsg);
00357 int ServerDoCert(XrdSutBuffer *br, XrdSutBuffer **bm,
00358 String &cmsg);
00359 int ServerDoSigpxy(XrdSutBuffer *br, XrdSutBuffer **bm,
00360 String &cmsg);
00361
00362
00363 int ParseCrypto(String cryptlist);
00364 int ParseCAlist(String calist);
00365
00366
00367 static int LoadCADir(int timestamp);
00368 int GetCA(const char *cahash);
00369 static String GetCApath(const char *cahash);
00370 static bool VerifyCA(int opt, X509Chain *cca, XrdCryptoFactory *cf);
00371 bool ServerCertNameOK(const char *subject, String &e);
00372
00373
00374 static XrdCryptoX509Crl *LoadCRL(XrdCryptoX509 *xca,
00375 XrdCryptoFactory *CF);
00376
00377
00378 static int QueryProxy(bool checkcache, XrdSutCache *cache, const char *tag,
00379 XrdCryptoFactory *cf, int timestamp,
00380 ProxyIn_t *pi, ProxyOut_t *po);
00381 static int InitProxy(ProxyIn_t *pi,
00382 X509Chain *ch = 0, XrdCryptoRSA **key = 0);
00383
00384
00385 static void ErrF(XrdOucErrInfo *einfo, kXR_int32 ecode,
00386 const char *msg1, const char *msg2 = 0,
00387 const char *msg3 = 0);
00388 XrdSecCredentials *ErrC(XrdOucErrInfo *einfo, XrdSutBuffer *b1,
00389 XrdSutBuffer *b2,XrdSutBuffer *b3,
00390 kXR_int32 ecode, const char *msg1 = 0,
00391 const char *msg2 = 0, const char *msg3 = 0);
00392 int ErrS(String ID, XrdOucErrInfo *einfo, XrdSutBuffer *b1,
00393 XrdSutBuffer *b2, XrdSutBuffer *b3,
00394 kXR_int32 ecode, const char *msg1 = 0,
00395 const char *msg2 = 0, const char *msg3 = 0);
00396
00397
00398 bool CheckTimeStamp(XrdSutBuffer *b, int skew, String &emsg);
00399
00400
00401 bool CheckRtag(XrdSutBuffer *bm, String &emsg);
00402
00403
00404 int AddSerialized(char opt, kXR_int32 step, String ID,
00405 XrdSutBuffer *bls, XrdSutBuffer *buf,
00406 kXR_int32 type, XrdCryptoCipher *cip);
00407
00408 static int LoadGMAP(int now);
00409 static XrdSecgsiGMAP_t
00410 LoadGMAPFun(const char *plugin, const char *parms);
00411 static XrdSecgsiAuthz_t
00412 LoadAuthzFun(const char *plugin, const char *parms);
00413 static void QueryGMAP(XrdCryptoX509Chain* chain, int now, String &name);
00414 };