00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
00029 #include "XrdNet/XrdNetAddrInfo.hh"
00030
00031 #include "XrdOuc/XrdOucErrInfo.hh"
00032 #include "XrdSys/XrdSysPthread.hh"
00033 #include "XrdOuc/XrdOucString.hh"
00034 #include "XrdOuc/XrdOucTokenizer.hh"
00035
00036 #include "XrdSec/XrdSecInterface.hh"
00037 #include "XrdSecpwd/XrdSecpwdTrace.hh"
00038
00039 #include "XrdSut/XrdSutPFEntry.hh"
00040 #include "XrdSut/XrdSutPFile.hh"
00041 #include "XrdSut/XrdSutBuffer.hh"
00042 #include "XrdSut/XrdSutRndm.hh"
00043
00044 #include "XrdCrypto/XrdCryptoAux.hh"
00045 #include "XrdCrypto/XrdCryptoCipher.hh"
00046 #include "XrdCrypto/XrdCryptoFactory.hh"
00047
00048
00049
00050
00051
00052 typedef XrdOucString String;
00053
00054 #define XrdSecPROTOIDENT "pwd"
00055 #define XrdSecPROTOIDLEN sizeof(XrdSecPROTOIDENT)
00056 #define XrdSecpwdVERSION 10100
00057 #define XrdSecNOIPCHK 0x0001
00058 #define XrdSecDEBUG 0x1000
00059 #define XrdCryptoMax 10
00060
00061 #define kMAXBUFLEN 1024
00062 #define kMAXUSRLEN 9
00063 #define kMAXPWDLEN 64
00064
00065
00066
00067 enum kpwdStatus {
00068 kpST_error = -1,
00069 kpST_ok = 0,
00070 kpST_more = 1
00071 };
00072
00073
00074
00075 enum kpwdAutoreg {
00076 kpAR_none = 0,
00077 kpAR_users = 1,
00078 kpAR_all = 2
00079 };
00080
00081
00082
00083 enum kpwdUpdate {
00084 kpUP_none = 0,
00085 kpUP_remove = 1,
00086 kpUP_all = 2
00087 };
00088
00089
00090
00091 enum kpwdCredsInput {
00092 kpCI_undef = -1,
00093 kpCI_prompt = 0,
00094 kpCI_exact = 1,
00095 kpCI_wildcard = 2
00096 };
00097
00098
00099
00100 enum kpwdCredType {
00101 kpCT_undef = -1,
00102 kpCT_normal = 0,
00103 kpCT_onetime = 1,
00104 kpCT_old = 2,
00105 kpCT_new = 3,
00106 kpCT_newagain = 4,
00107 kpCT_autoreg = 5,
00108 kpCT_ar_again = 6,
00109 kpCT_crypt = 7,
00110 kpCT_afs = 8,
00111 kpCT_afsenc = 9
00112 };
00113
00114
00115
00116 enum kpwdCredsActions {
00117 kpCA_undef = -1,
00118 kpCA_check = 0,
00119 kpCA_checkold = 1,
00120 kpCA_cache = 2,
00121 kpCA_checkcache = 3
00122 };
00123
00124
00125 enum kpwdClientSteps {
00126 kXPC_none = 0,
00127 kXPC_normal = 1000,
00128 kXPC_verifysrv,
00129 kXPC_signedrtag,
00130 kXPC_creds,
00131 kXPC_autoreg,
00132 kXPC_failureack,
00133 kXPC_reserved
00134 };
00135
00136
00137 enum kpwdServerSteps {
00138 kXPS_none = 0,
00139 kXPS_init = 2000,
00140 kXPS_credsreq,
00141 kXPS_rtag,
00142 kXPS_signedrtag,
00143 kXPS_newpuk,
00144 kXPS_puk,
00145 kXPS_failure,
00146 kXPS_reserved
00147 };
00148
00149
00150 enum kpwdErrors {
00151 kPWErrParseBuffer = 10000,
00152 kPWErrDecodeBuffer,
00153 kPWErrLoadCrypto,
00154 kPWErrBadProtocol,
00155 kPWErrNoUserHost,
00156 kPWErrNoUser,
00157 kPWErrNoHost,
00158 kPWErrBadUser,
00159 kPWErrCreateBucket,
00160 kPWErrDuplicateBucket,
00161 kPWErrCreateBuffer,
00162 kPWErrSerialBuffer,
00163 kPWErrGenCipher,
00164 kPWErrExportPuK,
00165 kPWErrEncRndmTag,
00166 kPWErrBadRndmTag,
00167 kPWErrNoRndmTag,
00168 kPWErrNoCipher,
00169 kPWErrQueryCreds,
00170 kPWErrNoCreds,
00171 kPWErrBadPasswd,
00172 kPWErrBadCache,
00173 kPWErrNoCache,
00174 kPWErrNoSessID,
00175 kPWErrBadSessID,
00176 kPWErrBadOpt,
00177 kPWErrMarshal,
00178 kPWErrUnmarshal,
00179 kPWErrSaveCreds,
00180 kPWErrNoSalt,
00181 kPWErrNoBuffer,
00182 kPWErrRefCipher,
00183 kPWErrNoPublic,
00184 kPWErrAddBucket,
00185 kPWErrFinCipher,
00186 kPWErrInit,
00187 kPWErrBadCreds,
00188 kPWErrError
00189 };
00190
00191
00192 typedef struct {
00193 char ctype;
00194 char action;
00195 short options;
00196 } pwdStatus_t;
00197
00198 #define REL1(x) { if (x) delete x; }
00199 #define REL2(x,y) { if (x) delete x; if (y) delete y; }
00200 #define REL3(x,y,z) { if (x) delete x; if (y) delete y; if (z) delete z; }
00201 #if 0
00202 #ifndef NODEBUG
00203 #define PRINT(y) {{SecTrace->Beg(epname); cerr <<y; SecTrace->End();}}
00204 #else
00205 #define PRINT(y) { }
00206 #endif
00207 #endif
00208 #define SafeDelete(x) { if (x) delete x ; x = 0; }
00209 #define SafeDelArray(x) { if (x) delete [] x ; x = 0; }
00210
00211
00212
00213
00214 class pwdOptions {
00215 public:
00216 short debug;
00217 short mode;
00218 short areg;
00219 short upwd;
00220 short alog;
00221 short verisrv;
00222 short vericlnt;
00223 short syspwd;
00224 int lifecreds;
00225 int maxprompts;
00226 int maxfailures;
00227 char *clist;
00228 char *dir;
00229 char *udir;
00230 char *cpass;
00231 char *alogfile;
00232 char *srvpuk;
00233 short keepcreds;
00234 char *expcreds;
00235 int expfmt;
00236
00237 pwdOptions() { debug = -1; mode = 's'; areg = -1; upwd = -1; alog = -1;
00238 verisrv = -1; vericlnt = -1;
00239 syspwd = -1; lifecreds = -1; maxprompts = -1; maxfailures = -1;
00240 clist = 0; dir = 0; udir = 0; cpass = 0;
00241 alogfile = 0; srvpuk = 0; keepcreds = 0; expcreds = 0; expfmt = 0;}
00242 virtual ~pwdOptions() { }
00243 void Print(XrdOucTrace *t);
00244 };
00245
00246 class pwdHSVars {
00247 public:
00248 int Iter;
00249 int TimeStamp;
00250 String CryptoMod;
00251 String User;
00252 String Tag;
00253 int RemVers;
00254 XrdCryptoFactory *CF;
00255 XrdCryptoCipher *Hcip;
00256 XrdCryptoCipher *Rcip;
00257 String ID;
00258 XrdSutPFEntry *Cref;
00259 XrdSutPFEntry *Pent;
00260 bool RtagOK;
00261 pwdStatus_t Status;
00262 bool Tty;
00263 int Step;
00264 int LastStep;
00265 String ErrMsg;
00266 int SysPwd;
00267 String AFScell;
00268 XrdSutBuffer *Parms;
00269
00270 pwdHSVars() { Iter = 0; TimeStamp = -1; CryptoMod = ""; User = ""; Tag = "";
00271 RemVers = -1; CF = 0; Hcip = 0; Rcip = 0;
00272 ID = ""; Cref = 0; Pent = 0; RtagOK = 0; Tty = 0;
00273 Step = 0; LastStep = 0; ErrMsg = "";
00274 SysPwd = 0; AFScell = "";
00275 Status.ctype = 0; Status.action = 0; Status.options = 0; Parms = 0;}
00276
00277 ~pwdHSVars() { SafeDelete(Cref); SafeDelete(Hcip); SafeDelete(Parms); }
00278 };
00279
00280
00281
00282
00283
00284
00285 class XrdSecProtocolpwd : public XrdSecProtocol
00286 {
00287 public:
00288 int Authenticate (XrdSecCredentials *cred,
00289 XrdSecParameters **parms,
00290 XrdOucErrInfo *einfo=0);
00291
00292 XrdSecCredentials *getCredentials(XrdSecParameters *parm=0,
00293 XrdOucErrInfo *einfo=0);
00294
00295 XrdSecProtocolpwd(int opts, const char *hname,
00296 XrdNetAddrInfo &endPoint,
00297 const char *parms = 0);
00298 virtual ~XrdSecProtocolpwd() {}
00299
00300
00301 static char *Init(pwdOptions o, XrdOucErrInfo *erp);
00302
00303 void Delete();
00304
00305 static void PrintTimeStat();
00306
00307
00308 static XrdOucTrace *EnableTracing();
00309
00310 private:
00311
00312
00313 static XrdSysMutex pwdContext;
00314 static String FileAdmin;
00315 static String FileExpCreds;
00316 static String FileUser;
00317 static String FileCrypt;
00318 static String FileSrvPuk;
00319 static String SrvID;
00320 static String SrvEmail;
00321 static String DefCrypto;
00322 static String DefError;
00323 static XrdSutPFile PFAdmin;
00324 static XrdSutPFile PFAlog;
00325 static XrdSutPFile PFSrvPuk;
00326
00327
00328 static int ncrypt;
00329 static int cryptID[XrdCryptoMax];
00330 static String cryptName[XrdCryptoMax];
00331 static XrdCryptoCipher *loccip[XrdCryptoMax];
00332 static XrdCryptoCipher *refcip[XrdCryptoMax];
00333
00334
00335 static XrdSutPFCache cacheAdmin;
00336 static XrdSutPFCache cacheSrvPuk;
00337 static XrdSutPFCache cacheUser;
00338 static XrdSutPFCache cacheAlog;
00339
00340
00341 static int Debug;
00342 static bool Server;
00343 static int UserPwd;
00344 static bool SysPwd;
00345 static int VeriClnt;
00346 static int VeriSrv;
00347 static int AutoReg;
00348 static int LifeCreds;
00349 static int MaxPrompts;
00350 static int MaxFailures;
00351 static int AutoLogin;
00352 static int TimeSkew;
00353 static bool KeepCreds;
00354 static int FmtExpCreds;
00355
00356
00357 static XrdSysLogger Logger;
00358 static XrdSysError eDest;
00359 static XrdOucTrace *PWDTrace;
00360
00361
00362 XrdNetAddrInfo epAddr;
00363 int options;
00364 char CName[256];
00365 bool srvMode;
00366
00367
00368 pwdHSVars *hs;
00369
00370
00371 XrdSecCredentials *clientCreds;
00372
00373
00374 int ParseClientInput(XrdSutBuffer *br, XrdSutBuffer **bm,
00375 String &emsg);
00376 int ParseServerInput(XrdSutBuffer *br, XrdSutBuffer **bm,
00377 String &cmsg);
00378 int ParseCrypto(XrdSutBuffer *buf);
00379
00380
00381 static void ErrF(XrdOucErrInfo *einfo, kXR_int32 ecode,
00382 const char *msg1, const char *msg2 = 0,
00383 const char *msg3 = 0);
00384 XrdSecCredentials *ErrC(XrdOucErrInfo *einfo, XrdSutBuffer *b1,
00385 XrdSutBuffer *b2,XrdSutBuffer *b3,
00386 kXR_int32 ecode, const char *msg1 = 0,
00387 const char *msg2 = 0, const char *msg3 = 0);
00388 int ErrS(String ID, XrdOucErrInfo *einfo, XrdSutBuffer *b1,
00389 XrdSutBuffer *b2, XrdSutBuffer *b3,
00390 kXR_int32 ecode, const char *msg1 = 0,
00391 const char *msg2 = 0, const char *msg3 = 0);
00392
00393
00394 XrdSutBucket *QueryCreds(XrdSutBuffer *bm, bool netrc, int &status);
00395 int QueryUser(int &status, String &cmsg);
00396 int QueryCrypt(String &fn, String &pwhash);
00397 int QueryNetRc(String host, String &passwd, int &status);
00398
00399
00400 bool CheckCreds(XrdSutBucket *creds, int credtype);
00401 bool CheckCredsAFS(XrdSutBucket *creds, int ctype);
00402
00403
00404 bool CheckTimeStamp(XrdSutBuffer *b, int skew, String &emsg);
00405
00406
00407 bool CheckRtag(XrdSutBuffer *bm, String &emsg);
00408
00409
00410 int ExportCreds(XrdSutBucket *creds);
00411 int SaveCreds(XrdSutBucket *creds);
00412 int UpdateAlog();
00413
00414
00415 int GetUserHost(String &usr, String &host);
00416 int AddSerialized(char opt, kXR_int32 step, String ID,
00417 XrdSutBuffer *bls, XrdSutBuffer *buf,
00418 kXR_int32 type, XrdCryptoCipher *cip);
00419 int DoubleHash(XrdCryptoFactory *cf, XrdSutBucket *bck,
00420 XrdSutBucket *s1, XrdSutBucket *s2 = 0,
00421 const char *tag = 0);
00422 };