00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028 #include <time.h>
00029
00030 #include "XrdNet/XrdNetAddrInfo.hh"
00031
00032 #include "XrdOuc/XrdOucErrInfo.hh"
00033 #include "XrdOuc/XrdOucGMap.hh"
00034 #include "XrdOuc/XrdOucHash.hh"
00035 #include "XrdOuc/XrdOucString.hh"
00036 #include "XrdOuc/XrdOucTokenizer.hh"
00037
00038 #include "XrdSys/XrdSysPthread.hh"
00039
00040 #include "XrdSec/XrdSecInterface.hh"
00041 #include "XrdSecgsi/XrdSecgsiTrace.hh"
00042
00043 #include "XrdSut/XrdSutCache.hh"
00044
00045 #include "XrdSut/XrdSutPFEntry.hh"
00046 #include "XrdSut/XrdSutPFile.hh"
00047 #include "XrdSut/XrdSutBuffer.hh"
00048 #include "XrdSut/XrdSutRndm.hh"
00049
00050 #include "XrdCrypto/XrdCryptoAux.hh"
00051 #include "XrdCrypto/XrdCryptoCipher.hh"
00052 #include "XrdCrypto/XrdCryptoFactory.hh"
00053 #include "XrdCrypto/XrdCryptoX509Crl.hh"
00054
00055 #include "XrdCrypto/XrdCryptogsiX509Chain.hh"
00056
00057
00058
00059
00060
00061 typedef XrdOucString String;
00062 typedef XrdCryptogsiX509Chain X509Chain;
00063
00064 #define XrdSecPROTOIDENT "gsi"
00065 #define XrdSecPROTOIDLEN sizeof(XrdSecPROTOIDENT)
00066 #define XrdSecgsiVERSION 10400
00067 #define XrdSecNOIPCHK 0x0001
00068 #define XrdSecDEBUG 0x1000
00069 #define XrdCryptoMax 10
00070
00071 #define kMAXBUFLEN 1024
00072
00073
00074 #define XrdSecgsiVersDHsigned 10400 // Version at which started signing
00075
00076
00077
00078
00079 enum kgsiStatus {
00080 kgST_error = -1,
00081 kgST_ok = 0,
00082 kgST_more = 1
00083 };
00084
00085
00086 enum kgsiClientSteps {
00087 kXGC_none = 0,
00088 kXGC_certreq = 1000,
00089 kXGC_cert,
00090 kXGC_sigpxy,
00091 kXGC_reserved
00092 };
00093
00094
00095 enum kgsiServerSteps {
00096 kXGS_none = 0,
00097 kXGS_init = 2000,
00098 kXGS_cert,
00099 kXGS_pxyreq,
00100 kXGS_reserved
00101 };
00102
00103
00104 enum kgsiHandshakeOpts {
00105 kOptsDlgPxy = 1,
00106 kOptsFwdPxy = 2,
00107 kOptsSigReq = 4,
00108 kOptsSrvReq = 8,
00109 kOptsPxFile = 16,
00110 kOptsDelChn = 32,
00111 kOptsPxCred = 64
00112 };
00113
00114
00115 enum kgsiErrors {
00116 kGSErrParseBuffer = 10000,
00117 kGSErrDecodeBuffer,
00118 kGSErrLoadCrypto,
00119 kGSErrBadProtocol,
00120 kGSErrCreateBucket,
00121 kGSErrDuplicateBucket,
00122 kGSErrCreateBuffer,
00123 kGSErrSerialBuffer,
00124 kGSErrGenCipher,
00125 kGSErrExportPuK,
00126 kGSErrEncRndmTag,
00127 kGSErrBadRndmTag,
00128 kGSErrNoRndmTag,
00129 kGSErrNoCipher,
00130 kGSErrNoCreds,
00131 kGSErrBadOpt,
00132 kGSErrMarshal,
00133 kGSErrUnmarshal,
00134 kGSErrSaveCreds,
00135 kGSErrNoBuffer,
00136 kGSErrRefCipher,
00137 kGSErrNoPublic,
00138 kGSErrAddBucket,
00139 kGSErrFinCipher,
00140 kGSErrInit,
00141 kGSErrBadCreds,
00142 kGSErrError
00143 };
00144
00145 #define REL1(x) { if (x) delete x; }
00146 #define REL2(x,y) { if (x) delete x; if (y) delete y; }
00147 #define REL3(x,y,z) { if (x) delete x; if (y) delete y; if (z) delete z; }
00148
00149 #define SafeDelete(x) { if (x) {delete x ; x = 0;} }
00150 #define SafeDelArray(x) { if (x) {delete [] x ; x = 0;} }
00151 #define SafeFree(x) { if (x) {free(x) ; x = 0;} }
00152
00153
00154 typedef char *(*XrdSecgsiGMAP_t)(const char *, int);
00155 typedef int (*XrdSecgsiAuthz_t)(XrdSecEntity &);
00156 typedef int (*XrdSecgsiAuthzInit_t)(const char *);
00157 typedef int (*XrdSecgsiAuthzKey_t)(XrdSecEntity &, char **);
00158
00159 typedef XrdSecgsiAuthz_t XrdSecgsiVOMS_t;
00160 typedef XrdSecgsiAuthzInit_t XrdSecgsiVOMSInit_t;
00161
00162
00163
00164 class XrdOucGMap;
00165 class XrdOucTrace;
00166 class gsiOptions {
00167 public:
00168 short debug;
00169 char mode;
00170 char *clist;
00171 char *certdir;
00172 char *crldir;
00173 char *crlext;
00174 char *cert;
00175
00176 char *key;
00177
00178 char *cipher;
00179 char *md;
00180 int crl;
00181 int ca;
00182 int crlrefresh;
00183 char *proxy;
00184 char *valid;
00185 int deplen;
00186 int bits;
00187 char *gridmap;
00188 int gmapto;
00189 char *gmapfun;
00190 char *gmapfunparms;
00191 char *authzfun;
00192 char *authzfunparms;
00193 int authzto;
00194 int ogmap;
00195 int dlgpxy;
00196
00197 int sigpxy;
00198 char *srvnames;
00199 char *exppxy;
00200 int authzpxy;
00201
00202 int vomsat;
00203 char *vomsfun;
00204 char *vomsfunparms;
00205 int moninfo;
00206 int hashcomp;
00207
00208 bool trustdns;
00209
00210 gsiOptions() { debug = -1; mode = 's'; clist = 0;
00211 certdir = 0; crldir = 0; crlext = 0; cert = 0; key = 0;
00212 cipher = 0; md = 0; ca = 1 ; crl = 1; crlrefresh = 86400;
00213 proxy = 0; valid = 0; deplen = 0; bits = 512;
00214 gridmap = 0; gmapto = 600;
00215 gmapfun = 0; gmapfunparms = 0; authzfun = 0; authzfunparms = 0; authzto = -1;
00216 ogmap = 1; dlgpxy = 0; sigpxy = 1; srvnames = 0;
00217 exppxy = 0; authzpxy = 0;
00218 vomsat = 1; vomsfun = 0; vomsfunparms = 0; moninfo = 0; hashcomp = 1; trustdns = true; }
00219 virtual ~gsiOptions() { }
00220 void Print(XrdOucTrace *t);
00221 };
00222
00223 class XrdSecProtocolgsi;
00224 class gsiHSVars;
00225
00226
00227 typedef struct {
00228 X509Chain *chain;
00229 XrdCryptoRSA *ksig;
00230 XrdSutBucket *cbck;
00231 } ProxyOut_t;
00232
00233
00234 typedef struct {
00235 const char *cert;
00236 const char *key;
00237 const char *certdir;
00238 const char *out;
00239 const char *valid;
00240 int deplen;
00241 int bits;
00242 } ProxyIn_t;
00243
00244 template<class T>
00245 class GSIStack {
00246 public:
00247 void Add(T *t) {
00248 char k[40]; snprintf(k, 40, "%p", t);
00249 mtx.Lock();
00250 if (!stack.Find(k)) stack.Add(k, t, 0, Hash_count);
00251 stack.Add(k, t, 0, Hash_count);
00252 mtx.UnLock();
00253 }
00254 void Del(T *t) {
00255 char k[40]; snprintf(k, 40, "%p", t);
00256 mtx.Lock();
00257 if (stack.Find(k)) stack.Del(k, Hash_count);
00258 mtx.UnLock();
00259 }
00260 private:
00261 XrdSysMutex mtx;
00262 XrdOucHash<T> stack;
00263 };
00264
00265
00266
00267
00268
00269 class XrdSecProtocolgsi : public XrdSecProtocol
00270 {
00271 friend class gsiOptions;
00272 friend class gsiHSVars;
00273 public:
00274 int Authenticate (XrdSecCredentials *cred,
00275 XrdSecParameters **parms,
00276 XrdOucErrInfo *einfo=0);
00277
00278 XrdSecCredentials *getCredentials(XrdSecParameters *parm=0,
00279 XrdOucErrInfo *einfo=0);
00280
00281 XrdSecProtocolgsi(int opts, const char *hname, XrdNetAddrInfo &endPoint,
00282 const char *parms = 0);
00283 virtual ~XrdSecProtocolgsi() {}
00284
00285
00286 static char *Init(gsiOptions o, XrdOucErrInfo *erp);
00287
00288 void Delete();
00289
00290
00291 int Encrypt(const char *inbuf, int inlen,
00292 XrdSecBuffer **outbuf);
00293 int Decrypt(const char *inbuf, int inlen,
00294 XrdSecBuffer **outbuf);
00295
00296 int Sign(const char *inbuf, int inlen,
00297 XrdSecBuffer **outbuf);
00298 int Verify(const char *inbuf, int inlen,
00299 const char *sigbuf, int siglen);
00300
00301
00302 int getKey(char *kbuf=0, int klen=0);
00303
00304 int setKey(char *kbuf, int klen);
00305
00306
00307 static XrdOucTrace *EnableTracing();
00308
00309 private:
00310 XrdNetAddrInfo epAddr;
00311
00312
00313 static XrdSysMutex gsiContext;
00314 static String CAdir;
00315 static String CRLdir;
00316 static String DefCRLext;
00317 static String SrvCert;
00318 static String SrvKey;
00319 static String UsrProxy;
00320 static String UsrCert;
00321 static String UsrKey;
00322 static String PxyValid;
00323 static int DepLength;
00324 static int DefBits;
00325 static int CACheck;
00326 static int CRLCheck;
00327 static int CRLDownload;
00328 static int CRLRefresh;
00329 static String DefCrypto;
00330 static String DefCipher;
00331 static String DefMD;
00332 static String DefError;
00333 static String GMAPFile;
00334 static int GMAPOpt;
00335 static bool GMAPuseDNname;
00336 static int GMAPCacheTimeOut;
00337 static XrdSecgsiGMAP_t GMAPFun;
00338 static XrdSecgsiAuthz_t AuthzFun;
00339 static XrdSecgsiAuthzKey_t AuthzKey;
00340 static int AuthzCertFmt;
00341 static int AuthzCacheTimeOut;
00342 static int PxyReqOpts;
00343 static int AuthzPxyWhat;
00344 static int AuthzPxyWhere;
00345 static String SrvAllowedNames;
00346 static int VOMSAttrOpt;
00347 static XrdSecgsiVOMS_t VOMSFun;
00348 static int VOMSCertFmt;
00349 static int MonInfoOpt;
00350 static bool HashCompatibility;
00351 static bool TrustDNS;
00352
00353
00354 static int ncrypt;
00355 static XrdCryptoFactory *cryptF[XrdCryptoMax];
00356 static int cryptID[XrdCryptoMax];
00357 static String cryptName[XrdCryptoMax];
00358 static XrdCryptoCipher *refcip[XrdCryptoMax];
00359
00360
00361 static XrdSutCache cacheCA;
00362 static XrdSutCache cacheCert;
00363 static XrdSutCache cachePxy;
00364 static XrdSutCache cacheGMAPFun;
00365 static XrdSutCache cacheAuthzFun;
00366
00367
00368 static XrdOucGMap *servGMap;
00369
00370
00371 static GSIStack<XrdCryptoX509Chain> stackCA;
00372 static GSIStack<XrdCryptoX509Crl> stackCRL;
00373
00374
00375 static time_t lastGMAPCheck;
00376 static XrdSysMutex mutexGMAP;
00377
00378
00379 static int Debug;
00380 static bool Server;
00381 static int TimeSkew;
00382
00383
00384 static XrdSysLogger Logger;
00385 static XrdSysError eDest;
00386 static XrdOucTrace *GSITrace;
00387
00388
00389 int options;
00390 XrdCryptoFactory *sessionCF;
00391 XrdCryptoCipher *sessionKey;
00392 XrdSutBucket *bucketKey;
00393 XrdCryptoMsgDigest *sessionMD;
00394 XrdCryptoRSA *sessionKsig;
00395 XrdCryptoRSA *sessionKver;
00396 X509Chain *proxyChain;
00397 bool srvMode;
00398 char *expectedHost;
00399 bool useIV;
00400
00401
00402 gsiHSVars *hs;
00403
00404
00405 int ParseClientInput(XrdSutBuffer *br, XrdSutBuffer **bm,
00406 String &emsg);
00407 int ClientDoInit(XrdSutBuffer *br, XrdSutBuffer **bm,
00408 String &cmsg);
00409 int ClientDoCert(XrdSutBuffer *br, XrdSutBuffer **bm,
00410 String &cmsg);
00411 int ClientDoPxyreq(XrdSutBuffer *br, XrdSutBuffer **bm,
00412 String &cmsg);
00413
00414
00415 int ParseServerInput(XrdSutBuffer *br, XrdSutBuffer **bm,
00416 String &cmsg);
00417 int ServerDoCertreq(XrdSutBuffer *br, XrdSutBuffer **bm,
00418 String &cmsg);
00419 int ServerDoCert(XrdSutBuffer *br, XrdSutBuffer **bm,
00420 String &cmsg);
00421 int ServerDoSigpxy(XrdSutBuffer *br, XrdSutBuffer **bm,
00422 String &cmsg);
00423
00424
00425 int ParseCrypto(String cryptlist);
00426 int ParseCAlist(String calist);
00427
00428
00429 static int GetCA(const char *cahash,
00430 XrdCryptoFactory *cryptof, gsiHSVars *hs = 0);
00431 static String GetCApath(const char *cahash);
00432 static bool VerifyCA(int opt, X509Chain *cca, XrdCryptoFactory *cf);
00433 static int VerifyCRL(XrdCryptoX509Crl *crl, XrdCryptoX509 *xca, XrdOucString crldir,
00434 XrdCryptoFactory *CF, int hashalg);
00435 bool ServerCertNameOK(const char *subject, const char *hname, String &e);
00436 static XrdSutCacheEntry *GetSrvCertEnt(XrdSutCERef &gcref,
00437 XrdCryptoFactory *cf,
00438 time_t timestamp, String &cal);
00439
00440
00441 static XrdCryptoX509Crl *LoadCRL(XrdCryptoX509 *xca, const char *sjhash,
00442 XrdCryptoFactory *CF, int dwld, int &err);
00443
00444
00445 static int QueryProxy(bool checkcache, XrdSutCache *cache, const char *tag,
00446 XrdCryptoFactory *cf, time_t timestamp,
00447 ProxyIn_t *pi, ProxyOut_t *po);
00448 static int InitProxy(ProxyIn_t *pi, XrdCryptoFactory *cf,
00449 X509Chain *ch = 0, XrdCryptoRSA **key = 0);
00450
00451
00452 static void ErrF(XrdOucErrInfo *einfo, kXR_int32 ecode,
00453 const char *msg1, const char *msg2 = 0,
00454 const char *msg3 = 0);
00455 XrdSecCredentials *ErrC(XrdOucErrInfo *einfo, XrdSutBuffer *b1,
00456 XrdSutBuffer *b2,XrdSutBuffer *b3,
00457 kXR_int32 ecode, const char *msg1 = 0,
00458 const char *msg2 = 0, const char *msg3 = 0);
00459 int ErrS(String ID, XrdOucErrInfo *einfo, XrdSutBuffer *b1,
00460 XrdSutBuffer *b2, XrdSutBuffer *b3,
00461 kXR_int32 ecode, const char *msg1 = 0,
00462 const char *msg2 = 0, const char *msg3 = 0);
00463
00464
00465 bool CheckTimeStamp(XrdSutBuffer *b, int skew, String &emsg);
00466
00467
00468 bool CheckRtag(XrdSutBuffer *bm, String &emsg);
00469
00470
00471 int AddSerialized(char opt, kXR_int32 step, String ID,
00472 XrdSutBuffer *bls, XrdSutBuffer *buf,
00473 kXR_int32 type, XrdCryptoCipher *cip);
00474
00475 static XrdSecgsiGMAP_t
00476 LoadGMAPFun(const char *plugin, const char *parms);
00477 static XrdSecgsiAuthz_t
00478 LoadAuthzFun(const char *plugin, const char *parms, int &fmt);
00479 static XrdSecgsiVOMS_t
00480 LoadVOMSFun(const char *plugin, const char *parms, int &fmt);
00481 static void QueryGMAP(XrdCryptoX509Chain* chain, int now, String &name);
00482
00483
00484 void CopyEntity(XrdSecEntity *in, XrdSecEntity *out, int *lout = 0);
00485 void FreeEntity(XrdSecEntity *in);
00486
00487
00488 int ExtractVOMS(X509Chain *c, XrdSecEntity &ent);
00489 };
00490
00491 class gsiHSVars {
00492 public:
00493 int Iter;
00494 time_t TimeStamp;
00495 String CryptoMod;
00496 int RemVers;
00497 XrdCryptoCipher *Rcip;
00498 bool HasPad;
00499 XrdSutBucket *Cbck;
00500 String ID;
00501 XrdSutPFEntry *Cref;
00502 XrdSutPFEntry *Pent;
00503 X509Chain *Chain;
00504 XrdCryptoX509Crl *Crl;
00505 X509Chain *PxyChain;
00506 bool RtagOK;
00507 bool Tty;
00508 int LastStep;
00509 int Options;
00510 int HashAlg;
00511 XrdSutBuffer *Parms;
00512
00513 gsiHSVars() { Iter = 0; TimeStamp = -1; CryptoMod = "";
00514 RemVers = -1; Rcip = 0; HasPad = 0;
00515 Cbck = 0;
00516 ID = ""; Cref = 0; Pent = 0; Chain = 0; Crl = 0; PxyChain = 0;
00517 RtagOK = 0; Tty = 0; LastStep = 0; Options = 0; HashAlg = 0; Parms = 0;}
00518
00519 ~gsiHSVars() { SafeDelete(Cref);
00520 if (Options & kOptsDelChn) {
00521
00522 if (Chain) Chain->Cleanup(1);
00523 SafeDelete(Chain);
00524 }
00525 if (Crl) {
00526
00527
00528 XrdSecProtocolgsi::stackCRL.Del(Crl);
00529 Crl = 0;
00530 }
00531
00532
00533 PxyChain = 0;
00534 SafeDelete(Parms); }
00535 void Dump(XrdSecProtocolgsi *p = 0);
00536 };