Loading...
Searching...
No Matches
XrdSecProtocolpwd Class Reference

`#include <XrdSecProtocolpwd.hh>`

Inheritance diagram for XrdSecProtocolpwd:
Collaboration diagram for XrdSecProtocolpwd:

## Public Member Functions

| XrdSecProtocolpwd (int opts, const char *hname, XrdNetAddrInfo &endPoint, const char *parms=0)
virtual | ~XrdSecProtocolpwd ()
int | Authenticate (XrdSecCredentials *cred, XrdSecParameters **parms, XrdOucErrInfo *einfo=0)
void | Delete ()
| Delete the protocol object. DO NOT use C++ delete() on this object.
XrdSecCredentials * | getCredentials (XrdSecParameters *parm=0, XrdOucErrInfo *einfo=0)
Public Member Functions inherited from XrdSecProtocol
| XrdSecProtocol (const char *pName)
| Constructor.
virtual int | Decrypt (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int | Encrypt (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int | getKey (char *buff=0, int size=0)
virtual bool | needTLS ()
| Check if this protocol requires TLS to properly function.
virtual int | setKey (char *buff, int size)
virtual int | Sign (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int | Verify (const char *inbuff, int inlen, const char *sigbuff, int siglen)

## Static Public Member Functions

static XrdOucTrace * | EnableTracing ()
static char * | Init (pwdOptions o, XrdOucErrInfo *erp)
static void | PrintTimeStat ()

## Additional Inherited Members

Public Attributes inherited from XrdSecProtocol
XrdSecEntity | Entity
Protected Member Functions inherited from XrdSecProtocol
virtual | ~XrdSecProtocol ()
| Destructor (prevents use of direct delete).

## Detailed Description

Definition at line 285 of file XrdSecProtocolpwd.hh.

## Constructor & Destructor Documentation

## XrdSecProtocolpwd()

XrdSecProtocolpwd::XrdSecProtocolpwd | ( | int | opts,
|  | const char * | hname,
|  | XrdNetAddrInfo & | endPoint,
|  | const char * | parms = 0 )

Definition at line 252 of file XrdSecProtocolpwd.cc.

: XrdSecProtocol("pwd")
{
// Default constructor
EPNAME("XrdSecProtocolpwd");
if (QTRACE(Authen)) { PRINT("constructing: "<<this); }
// Create instance of the handshake vars
if ((hs = new pwdHSVars())) {
// Update time stamp
hs->TimeStamp = time(0);
// Local handshake variables
hs->CryptoMod = ""; // crypto module in use
hs->User = ""; // remote username
hs->Tag.resize(256); // tag for credentials
hs->RemVers = -1; // Version run by remote counterpart
hs->CF = 0; // crypto factory
hs->Hcip = 0; // handshake cipher
hs->Rcip = 0; // reference cipher
hs->ID = ""; // Handshake ID (dummy for clients)
hs->Cref = 0; // Cache reference
hs->Pent = 0; // Pointer to relevant file entry
hs->RtagOK = 0; // Rndm tag checked / not checked
hs->Tty = (isatty(0) == 0 || isatty(1) == 0) ? 0 : 1;
hs->Step = 0; // Current step
hs->LastStep = 0; // Step required at previous iteration
} else {
PRINT("could not create handshake vars object");
}
// Used by servers to store forwarded credentials
clientCreds = 0;
// Save host name and address
if (hname) {
Entity.host = strdup(hname);
} else {
NOTIFY("warning: host name undefined");
}
epAddr = endPoint;
Entity.addrInfo = &epAddr;
// Init client name
CName[0] = '?'; CName[1] = '\0';
//
// Notify, if required
DEBUG("constructing: host: "<<hname);
DEBUG("p: "<<XrdSecPROTOIDENT<<", plen: "<<XrdSecPROTOIDLEN);
//
// basic settings
options = opts;
//
// Mode specific initializations
if (Server) {
srvMode = 1;
DEBUG("mode: server");
} else {
srvMode = 0;
DEBUG("mode: client");
if (AutoLogin > 0) {
DEBUG("using autologin file: "<<PFAlog.Name());
if (AutoLogin > 1) {
DEBUG("running in update-autologin mode");
}
}
if (VeriSrv > 0) {
DEBUG("server verification ON");
} else {
DEBUG("server verification OFF");
}
// Decode received buffer
if (parms) {
XrdOucString p("&P=pwd,");
p += parms;
hs->Parms = new XrdSutBuffer(p.c_str(), p.length());
}
}
// We are done
String vers = Version;
vers.insert('.',vers.length()-2);
vers.insert('.',vers.length()-5);
DEBUG("object created: v"<<vers.c_str());
}
DEBUG
#define DEBUG(x)
Definition XrdBwmTrace.hh:54
EPNAME
#define EPNAME(x)
Definition XrdBwmTrace.hh:56
QTRACE
#define QTRACE(act)
Definition XrdCmsTrace.hh:49
PRINT
#define PRINT(y)
Definition XrdCryptosslTrace.hh:39
Version
static const kXR_int32 Version
Definition XrdSecProtocolgsi.cc:79
String
XrdOucString String
Definition XrdSecProtocolgsi.hh:62
XrdSecPROTOIDLEN
#define XrdSecPROTOIDLEN
Definition XrdSecProtocolpwd.hh:55
XrdSecPROTOIDENT
#define XrdSecPROTOIDENT
Definition XrdSecProtocolpwd.hh:54
NOTIFY
#define NOTIFY(y)
Definition XrdSecgsiTrace.hh:41
opts
struct myOpts opts
XrdOucString::insert
void insert(const int i, int start=-1)
Definition XrdOucString.cc:691
XrdOucString::length
int length() const
Definition XrdOucString.hh:279
XrdOucString::c_str
const char * c_str() const
Definition XrdOucString.hh:278
XrdSecProtocol::Entity
XrdSecEntity Entity
Definition XrdSecInterface.hh:139
XrdSecProtocol::XrdSecProtocol
XrdSecProtocol(const char *pName)
Constructor.
Definition XrdSecInterface.hh:317

References XrdSecProtocol::XrdSecProtocol(), XrdOucString::c_str(), DEBUG, XrdSecProtocol::Entity, EPNAME, XrdOucString::insert(), XrdOucString::length(), NOTIFY, opts, PRINT, QTRACE, Version, XrdSecPROTOIDENT, and XrdSecPROTOIDLEN.

Here is the call graph for this function:

## ~XrdSecProtocolpwd()

virtual XrdSecProtocolpwd::~XrdSecProtocolpwd | ( |  | ) |

inline virtual

Definition at line 298 of file XrdSecProtocolpwd.hh.

{} // Delete() does it all

## Member Function Documentation

## Authenticate()

int XrdSecProtocolpwd::Authenticate | ( | XrdSecCredentials * | cred,
|  | XrdSecParameters ** | parms,
|  | XrdOucErrInfo * | einfo = 0 )

virtual

Authenticate a client.

Parameters

  cred | Credentials supplied by the client.
  parms | Place where the address of additional authentication data is to be placed for another autrhentication handshake.
  einfo | The error information object where error messages should be placed. The messages are returned to the client. Should einfo be null, messages should be written to stderr.

Returns
  > 0 -> parms present (more authentication needed) = 0 -> Entity present (authentication succeeded) < 0 -> einfo present (error has occurred)

Implements XrdSecProtocol.

Definition at line 1169 of file XrdSecProtocolpwd.cc.

{
//
// Check if we have any credentials or if no credentials really needed.
// In either case, use host name as client name
EPNAME("Authenticate");
//
// If cred buffer is two small or empty assume host protocol
if (cred->size <= (int)XrdSecPROTOIDLEN || !cred->buffer) {
strncpy(Entity.prot, "host", sizeof(Entity.prot));
return 0;
}
// Handshake vars container must be initialized at this point
if (!hs)
return ErrS(String("none"),ei,0,0,0,kPWErrError,
"handshake var container missing",
"protocol initialization problems");
hs->ErrMsg = "";
//
// Update time stamp
hs->TimeStamp = time(0);
//
// ID of this handshaking
hs->ID = Entity.tident;
DEBUG("handshaking ID: " << hs->ID);
// Local vars
int i = 0;
int kS_rc = kpST_more;
int rc = 0;
int entst = 0;
int nextstep = 0;
int ctype = kpCT_normal;
char *bpub = 0, *bpid = 0;
int lpub = 0;
const char *stepstr = 0;
String Message;
String CryptList;
String Host;
String SrvPuKExp;
String Salt;
String RndmTag;
String ClntMsg(256);
// Buffer related
XrdSutBuffer *bpar = 0; // Global buffer
XrdSutBuffer *bmai = 0; // Main buffer
XrdSutBucket *bck = 0; // Generic bucket
// The local status info
pwdStatus_t SessionSt = { 0, 0, 0};
//
// Unlocks automatically returning
XrdSysMutexHelper pwdGuard(&pwdContext);
//
// Decode received buffer
if (!(bpar = new XrdSutBuffer((const char *)cred->buffer,cred->size)))
return ErrS(hs->ID,ei,0,0,0,kPWErrDecodeBuffer,"global",stepstr);
//
// Check protocol ID name
if (strcmp(bpar->GetProtocol(),XrdSecPROTOIDENT))
return ErrS(hs->ID,ei,bpar,bmai,0,kPWErrBadProtocol,stepstr);
//
// The step indicates what we are supposed to do
hs->Step = bpar->GetStep();
stepstr = ClientStepStr(hs->Step);
// Dump, if requested
if (QTRACE(Dump)) {
bpar->Dump(stepstr);
}
//
// Find first crypto module to be used
if (ParseCrypto(bpar) != 0)
return ErrS(hs->ID,ei,bpar,0,0,kPWErrLoadCrypto,stepstr);
//
// Parse input buffer
if (ParseServerInput(bpar, &bmai, ClntMsg) == -1) {
PRINT(ClntMsg);
return ErrS(hs->ID,ei,bpar,bmai,0,kPWErrParseBuffer,ClntMsg.c_str(),stepstr);
}
//
// Get handshake status
if ((bck = bmai->GetBucket(kXRS_status))) {
int pst = 0;
memcpy(&pst,bck->buffer,sizeof(pwdStatus_t));
pst = ntohl(pst);
memcpy(&SessionSt, &pst, sizeof(pwdStatus_t));
bmai->Deactivate(kXRS_status);
} else {
NOTIFY("no bucket kXRS_status found in main buffer");
}
hs->Tty = SessionSt.options & kOptsClntTty;
//
// Client name
unsigned int ulen = hs->User.length();
ulen = (ulen > sizeof(CName)-1) ? sizeof(CName)-1 : ulen;
if (ulen)
strcpy(CName, hs->User.c_str());
// And set link to entity
Entity.name = strdup(CName);
//
// Version
DEBUG("version run by client: "<< hs->RemVers);
//
// Dump, if requested
if (QTRACE(Dump)) {
bmai->Dump("main IN");
}
//
// Check random challenge
if (!CheckRtag(bmai, ClntMsg))
return ErrS(hs->ID,ei,bpar,bmai,0,kPWErrBadRndmTag,stepstr,ClntMsg.c_str());
//
// Check also host / time stamp (it will be done only if really neede)
if (!CheckTimeStamp(bmai, TimeSkew, ClntMsg))
return ErrS(hs->ID,ei,bpar,bmai,0,kPWErrBadRndmTag,stepstr,ClntMsg.c_str());
//
// Now action depens on the step
bool savecreds = (SessionSt.options & kOptsExpCred);
switch (hs->Step) {
case kXPC_verifysrv:
//
// Client required us to sign a random challenge: this is done
// in AddSerialized, so nothing to do here
nextstep = kXPS_signedrtag;
break;
case kXPC_signedrtag:
//
// Client signed the random challenge we sent: if we are here,
// everything was fine
kS_rc = kpST_ok;
nextstep = kXPS_none;
break;
case kXPC_failureack:
//
// Client acknowledged failure
kS_rc = kpST_error;
nextstep = kXPS_none;
break;
case kXPC_autoreg:
//
// Client has lost the key or requested auto-registration: we
// check the username: if it has a good entry or it is allowed
// to auto-register (the check is done in QueryUser) we send
// the public part of the key; otherwise we fail
rc = QueryUser(entst, ClntMsg);
if (rc < 0 || (entst == kPFE_disabled))
return ErrS(hs->ID,ei,bpar,bmai,0, kPWErrBadCreds,
DefError.c_str(),stepstr);
//
// We have to send the public key
for (i = 0; i < ncrypt; i++) {
if (refcip[i]) {
//
// Extract buffer with public info for the cipher agreement
if (!(bpub = refcip[i]->Public(lpub)))
return ErrS(hs->ID,ei,bpar,bmai,0, kPWErrNoPublic,
"session",stepstr);
bpid = new char[lpub+5];
if (bpid) {
char cid[5] = {0};
sprintf(cid,"%d",cryptID[i]);
memcpy(bpid,cid,5);
memcpy(bpid+5, bpub, lpub);
//
// Add it to the global list
if (bmai->AddBucket(bpid,lpub+5,kXRS_puk) != 0)
return ErrS(hs->ID,ei,bpar,bmai,0, kPWErrAddBucket,
"main",stepstr);
} else
return ErrS(hs->ID,ei,bpar,bmai,0, kPWErrError,
"out-of-memory",stepstr);
SafeDelArray(bpub); // bpid is taken by the bucket
}
}
// client should now go through a complete login
nextstep = kXPS_puk;
break;
case kXPC_normal:
case kXPC_creds:
if (hs->Step == kXPC_normal)
{
//
// Complete login sequence: check user and creds
if (QueryUser(entst,ClntMsg) != 0)
return ErrS(hs->ID,ei,bpar,bmai,0, kPWErrBadCreds,
": user ",hs->User.c_str(),stepstr);
// Nothing to do, if disabled
if (entst == kPFE_disabled)
return ErrS(hs->ID,ei,bpar,bmai,0, kPWErrBadCreds,
": user ",hs->User.c_str(),stepstr);
if (entst == kPFE_expired || entst == kPFE_onetime) {
// New credentials should asked upon success first check
SessionSt.options |= kOptsExpCred;
}
if (entst == kPFE_crypt) {
// User credentials are either in crypt form (private or
// system ones) or of AFS type; in case of failure
// this flag allows the client to send the right creds
// at next iteration
if (ClntMsg.beginswith("afs:")) {
SessionSt.options |= kOptsAFSPwd;
} else
SessionSt.options |= kOptsCrypPwd;
// Reset the message
ClntMsg = "";
}
// Creds, if any, should be checked, unles we allow auto-registration
savecreds = (entst != kPFE_allowed) ? 0 : 1;
}
// case kXPC_creds: (falls into here from _normal)
//
// Final login sequence: extract and check creds
// Extract credentials from main buffer
if (!(bck = bmai->GetBucket(kXRS_creds))) {
//
// If credentials are missing, require them
kS_rc = kpST_more;
nextstep = kXPS_credsreq;
break;
}
//
// If we required new credentials at previous step, just save them
if (savecreds) {
if (SaveCreds(bck) != 0) {
ClntMsg = "Warning: could not correctly update credentials database";
}
kS_rc = kpST_ok;
nextstep = kXPS_none;
bmai->Deactivate(kXRS_creds);
break;
}
//
// Credential type
ctype = kpCT_normal;
if (SessionSt.options & kOptsCrypPwd)
ctype = kpCT_crypt;
else if (SessionSt.options & kOptsAFSPwd) {
ctype = kpCT_afs;
String afsInfo;
XrdSutBucket *bafs = bmai->GetBucket(kXRS_afsinfo);
if (bafs)
bafs->ToString(afsInfo);
if (afsInfo == "c")
ctype = kpCT_afsenc;
}
//
// Check credentials
if (!CheckCreds(bck, ctype)) {
//
// Count temporary failures
(hs->Cref->cnt)++;
// Reset expired credentials flag
SessionSt.options &= ~kOptsExpCred;
// Repeat if not too many attempts
ClntMsg = DefError;
if (hs->Cref->cnt < MaxPrompts) {
// Set next step to credential request
nextstep = kXPS_credsreq;
kS_rc = kpST_more;
// request again creds
if (hs->Pent->status == kPFE_crypt) {
SessionSt.ctype = kpCT_crypt;
if (ctype == kpCT_afs || ctype == kpCT_afsenc) {
SessionSt.ctype = kpCT_afs;
String afsinfo = hs->ErrMsg;
bmai->UpdateBucket(afsinfo, kXRS_afsinfo);
}
ClntMsg = "";
} else {
SessionSt.ctype = kpCT_normal;
ClntMsg = "insufficient credentials";
}
} else {
// We communicate failure
kS_rc = kpST_more;
nextstep = kXPS_failure;
// Count failures
(hs->Pent->cnt)++;
// Count failures
hs->Pent->mtime = (kXR_int32)time(0);
// Flush cache content to source file
XrdSysPrivGuard priv(getuid(), getgid());
if (priv.Valid()) {
if (cacheAdmin.Flush() != 0) {
PRINT("WARNING: some problem flushing to admin"
" file after updating "<<hs->Pent->name);
}
}
}
} else {
// Reset counter for temporary failures
hs->Cref->cnt = 0;
// Reset counter in file if needed
if (hs->Pent->cnt > 0) {
hs->Pent->cnt = 0;
// Count failures
hs->Pent->mtime = (kXR_int32)time(0);
// Flush cache content to source file
XrdSysPrivGuard priv(getuid(), getgid());
if (priv.Valid()) {
if (cacheAdmin.Flush() != 0) {
PRINT("WARNING: some problem flushing to admin"
" file after updating "<<hs->Pent->name);
}
}
}
kS_rc = kpST_ok;
nextstep = kXPS_none;
if (SessionSt.options & kOptsExpCred ||
// Client requested a pwd change
SessionSt.options & kOptsChngPwd) {
kS_rc = kpST_more;
nextstep = kXPS_credsreq;
if (SessionSt.options & kOptsExpCred) {
ClntMsg = "Credentials expired";
} else if (SessionSt.options & kOptsChngPwd) {
ClntMsg = "Password change requested";
}
// request new creds
SessionSt.ctype = kpCT_new;
// So we can save at next round
SessionSt.options |= kOptsExpCred;
}
// Create buffer to keep the credentials, if required
if (KeepCreds) {
int sz = bck->size+5;
char *buf = (char *) malloc(sz);
if (buf) {
memcpy(buf, "&pwd", 4);
buf[4] = 0;
memcpy(buf+5, bck->buffer, bck->size);
// Put in hex
char *out = new char[2*sz+1];
XrdSutToHex(buf, sz, out);
// Cleanup any existing info
SafeDelete(clientCreds);
clientCreds = new XrdSecCredentials(out, 2*sz+1);
}
}
// Export creds to a file, if required
if (FileExpCreds.length() > 0) {
if (ExportCreds(bck) != 0)
PRINT("WARNING: some problem exporting creds to file;"
" template is :"<<FileExpCreds);
}
}
// We will not use again these credentials
bmai->Deactivate(kXRS_creds);
break;
default:
return ErrS(hs->ID,ei,bpar,bmai,0, kPWErrBadOpt, stepstr);
}
//
// If strong signature checking is required add random tag
if (kS_rc == kpST_ok) {
if (VeriClnt == 2 && !(hs->RtagOK)) {
// Send only the random tag to sign
nextstep = kXPS_rtag;
kS_rc = kpST_more;
}
}
//
// If we need additional info but the client caa not reply, just fail
if (kS_rc == kpST_more && !(hs->Tty)) {
PRINT("client cannot reply to additional request: failure");
// Deactivate everything
bpar->Deactivate(-1);
bmai->Deactivate(-1);
kS_rc = kpST_error;
}
//
if (kS_rc == kpST_more) {
//
// Add message to client
if (ClntMsg.length() > 0)
if (bmai->AddBucket(ClntMsg,kXRS_message) != 0) {
PRINT("problems adding bucket with message for client");
}
//
// We set some options in the option field of a pwdStatus_t structure
int *pst = (int *) new char[sizeof(pwdStatus_t)];
memcpy(pst,&SessionSt,sizeof(pwdStatus_t));
*pst = htonl(*pst);
if (bmai->AddBucket((char *)pst,sizeof(pwdStatus_t), kXRS_status) != 0) {
PRINT("problems adding bucket kXRS_status");
}
//
// Serialize, encrypt and add to the global list
if (AddSerialized('s', nextstep, hs->ID,
bpar, bmai, kXRS_main, hs->Hcip) != 0)
return ErrS(hs->ID,ei,bpar,bmai,0, kPWErrSerialBuffer,
"main / session cipher",stepstr);
//
// Serialize the global buffer
char *bser = 0;
int nser = bpar->Serialized(&bser,'f');
//
// Dump, if requested
if (QTRACE(Dump)) {
bpar->Dump(ServerStepStr(bpar->GetStep()));
bmai->Dump("Main OUT");
}
//
// Create buffer for client
*parms = new XrdSecParameters(bser,nser);
} else {
//
// Cleanup handshake vars
SafeDelete(hs);
}
//
// We may release the buffers now
REL2(bpar,bmai);
//
// All done
return kS_rc;
}
kXR_int32
int kXR_int32
Definition XPtypes.hh:89
XrdSecParameters
XrdSecBuffer XrdSecParameters
Definition XrdSecInterface.hh:79
XrdSecCredentials
XrdSecBuffer XrdSecCredentials
Definition XrdSecInterface.hh:69
ClientStepStr
static const char * ClientStepStr(int kclt)
Definition XrdSecProtocolgsi.cc:223
ServerStepStr
static const char * ServerStepStr(int ksrv)
Definition XrdSecProtocolgsi.cc:239
kOptsChngPwd
static const short kOptsChngPwd
Definition XrdSecProtocolpwd.cc:152
kOptsExpCred
static const short kOptsExpCred
Definition XrdSecProtocolpwd.cc:150
kOptsAFSPwd
static const short kOptsAFSPwd
Definition XrdSecProtocolpwd.cc:153
kOptsCrypPwd
static const short kOptsCrypPwd
Definition XrdSecProtocolpwd.cc:151
kOptsClntTty
static const short kOptsClntTty
Definition XrdSecProtocolpwd.cc:149
pwdStatus_t::ctype
char ctype
Definition XrdSecProtocolpwd.hh:193
SafeDelete
#define SafeDelete(x)
Definition XrdSecProtocolpwd.hh:208
REL2
#define REL2(x, y)
Definition XrdSecProtocolpwd.hh:199
kPWErrParseBuffer
@ kPWErrParseBuffer
Definition XrdSecProtocolpwd.hh:151
kPWErrBadOpt
@ kPWErrBadOpt
Definition XrdSecProtocolpwd.hh:176
kPWErrBadCreds
@ kPWErrBadCreds
Definition XrdSecProtocolpwd.hh:187
kPWErrSerialBuffer
@ kPWErrSerialBuffer
Definition XrdSecProtocolpwd.hh:162
kPWErrNoPublic
@ kPWErrNoPublic
Definition XrdSecProtocolpwd.hh:183
kPWErrBadProtocol
@ kPWErrBadProtocol
Definition XrdSecProtocolpwd.hh:154
kPWErrLoadCrypto
@ kPWErrLoadCrypto
Definition XrdSecProtocolpwd.hh:153
kPWErrBadRndmTag
@ kPWErrBadRndmTag
Definition XrdSecProtocolpwd.hh:166
kPWErrDecodeBuffer
@ kPWErrDecodeBuffer
Definition XrdSecProtocolpwd.hh:152
kPWErrError
@ kPWErrError
Definition XrdSecProtocolpwd.hh:188
kPWErrAddBucket
@ kPWErrAddBucket
Definition XrdSecProtocolpwd.hh:184
kpST_ok
@ kpST_ok
Definition XrdSecProtocolpwd.hh:69
kpST_more
@ kpST_more
Definition XrdSecProtocolpwd.hh:70
kpST_error
@ kpST_error
Definition XrdSecProtocolpwd.hh:68
kXPC_failureack
@ kXPC_failureack
Definition XrdSecProtocolpwd.hh:132
kXPC_autoreg
@ kXPC_autoreg
Definition XrdSecProtocolpwd.hh:131
kXPC_signedrtag
@ kXPC_signedrtag
Definition XrdSecProtocolpwd.hh:129
kXPC_normal
@ kXPC_normal
Definition XrdSecProtocolpwd.hh:127
kXPC_creds
@ kXPC_creds
Definition XrdSecProtocolpwd.hh:130
kXPC_verifysrv
@ kXPC_verifysrv
Definition XrdSecProtocolpwd.hh:128
SafeDelArray
#define SafeDelArray(x)
Definition XrdSecProtocolpwd.hh:209
kpCT_afs
@ kpCT_afs
Definition XrdSecProtocolpwd.hh:110
kpCT_normal
@ kpCT_normal
Definition XrdSecProtocolpwd.hh:102
kpCT_new
@ kpCT_new
Definition XrdSecProtocolpwd.hh:105
kpCT_crypt
@ kpCT_crypt
Definition XrdSecProtocolpwd.hh:109
kpCT_afsenc
@ kpCT_afsenc
Definition XrdSecProtocolpwd.hh:111
pwdStatus_t::options
short options
Definition XrdSecProtocolpwd.hh:195
kXPS_puk
@ kXPS_puk
Definition XrdSecProtocolpwd.hh:144
kXPS_credsreq
@ kXPS_credsreq
Definition XrdSecProtocolpwd.hh:140
kXPS_failure
@ kXPS_failure
Definition XrdSecProtocolpwd.hh:145
kXPS_none
@ kXPS_none
Definition XrdSecProtocolpwd.hh:138
kXPS_signedrtag
@ kXPS_signedrtag
Definition XrdSecProtocolpwd.hh:142
kXPS_rtag
@ kXPS_rtag
Definition XrdSecProtocolpwd.hh:141
CryptList
XrdOucString CryptList
Definition XrdSecpwdSrvAdmin.cc:187
ParseCrypto
void ParseCrypto()
Definition XrdSecpwdSrvAdmin.cc:1561
XrdSutToHex
int XrdSutToHex(const char *in, int lin, char *out)
Definition XrdSutAux.cc:235
kXRS_afsinfo
@ kXRS_afsinfo
Definition XrdSutAux.hh:84
kXRS_message
@ kXRS_message
Definition XrdSutAux.hh:68
kXRS_puk
@ kXRS_puk
Definition XrdSutAux.hh:61
kXRS_status
@ kXRS_status
Definition XrdSutAux.hh:72
kXRS_main
@ kXRS_main
Definition XrdSutAux.hh:58
kXRS_creds
@ kXRS_creds
Definition XrdSutAux.hh:67
kPFE_allowed
@ kPFE_allowed
Definition XrdSutPFEntry.hh:43
kPFE_disabled
@ kPFE_disabled
Definition XrdSutPFEntry.hh:42
kPFE_onetime
@ kPFE_onetime
Definition XrdSutPFEntry.hh:45
kPFE_expired
@ kPFE_expired
Definition XrdSutPFEntry.hh:46
kPFE_crypt
@ kPFE_crypt
Definition XrdSutPFEntry.hh:49
XrdSutBucket::size
kXR_int32 size
Definition XrdSutBucket.hh:47
XrdSutBucket::buffer
char * buffer
Definition XrdSutBucket.hh:48
XrdSutBucket::ToString
void ToString(XrdOucString &s)
Definition XrdSutBucket.cc:155
XrdSutBuffer::AddBucket
int AddBucket(char *bp=0, int sz=0, int ty=0)
Definition XrdSutBuffer.hh:59
XrdSutBuffer::UpdateBucket
int UpdateBucket(const char *bp, int sz, int ty)
Definition XrdSutBuffer.cc:208
XrdSutBuffer::Serialized
int Serialized(char **buffer, char opt='n')
Definition XrdSutBuffer.cc:438
XrdSutBuffer::GetProtocol
const char * GetProtocol() const
Definition XrdSutBuffer.hh:88
XrdSutBuffer::Dump
void Dump(const char *stepstr=0, bool all=false)
Definition XrdSutBuffer.cc:240
XrdSutBuffer::GetStep
int GetStep() const
Definition XrdSutBuffer.hh:89
XrdSutBuffer::GetBucket
XrdSutBucket * GetBucket(kXR_int32 type, const char *tag=0)
Definition XrdSutBuffer.cc:388
XrdSutBuffer::Deactivate
void Deactivate(kXR_int32 type)
Definition XrdSutBuffer.cc:417
XrdSecBuffer::buffer
char * buffer
Pointer to the buffer.
Definition XrdSecInterface.hh:53
XrdSecBuffer::size
int size
Size of the buffer or length of data in the buffer.
Definition XrdSecInterface.hh:52

References XrdSutBuffer::AddBucket(), XrdOucString::beginswith(), XrdSecBuffer::buffer, XrdSutBucket::buffer, XrdOucString::c_str(), ClientStepStr(), CryptList, pwdStatus_t::ctype, XrdSutBuffer::Deactivate(), DEBUG, XrdSutBuffer::Dump(), XrdSecProtocol::Entity, EPNAME, XrdSutBuffer::GetBucket(), XrdSutBuffer::GetProtocol(), XrdSutBuffer::GetStep(), kOptsAFSPwd, kOptsChngPwd, kOptsClntTty, kOptsCrypPwd, kOptsExpCred, kpCT_afs, kpCT_afsenc, kpCT_crypt, kpCT_new, kpCT_normal, kPFE_allowed, kPFE_crypt, kPFE_disabled, kPFE_expired, kPFE_onetime, kpST_error, kpST_more, kpST_ok, kPWErrAddBucket, kPWErrBadCreds, kPWErrBadOpt, kPWErrBadProtocol, kPWErrBadRndmTag, kPWErrDecodeBuffer, kPWErrError, kPWErrLoadCrypto, kPWErrNoPublic, kPWErrParseBuffer, kPWErrSerialBuffer, kXPC_autoreg, kXPC_creds, kXPC_failureack, kXPC_normal, kXPC_signedrtag, kXPC_verifysrv, kXPS_credsreq, kXPS_failure, kXPS_none, kXPS_puk, kXPS_rtag, kXPS_signedrtag, kXRS_afsinfo, kXRS_creds, kXRS_main, kXRS_message, kXRS_puk, kXRS_status, XrdOucString::length(), NOTIFY, pwdStatus_t::options, ParseCrypto(), PRINT, QTRACE, REL2, SafeDelArray, SafeDelete, XrdSutBuffer::Serialized(), ServerStepStr(), XrdSecBuffer::size, XrdSutBucket::size, XrdSutBucket::ToString(), XrdSutBuffer::UpdateBucket(), XrdSysPrivGuard::Valid(), XrdSecPROTOIDENT, XrdSecPROTOIDLEN, and XrdSutToHex().

Here is the call graph for this function:

## Delete()

void XrdSecProtocolpwd::Delete | ( |  | ) |

virtual

Delete the protocol object. DO NOT use C++ delete() on this object.

Implements XrdSecProtocol.

Definition at line 854 of file XrdSecProtocolpwd.cc.

{
// Deletes the protocol
if (Entity.host) free(Entity.host);
// Cleanup the handshake variables, if still there
SafeDelete(hs);
delete this;
}

References XrdSecProtocol::Entity, and SafeDelete.

## EnableTracing()

XrdOucTrace * XrdSecProtocolpwd::EnableTracing | ( |  | ) |

static

Definition at line 1609 of file XrdSecProtocolpwd.cc.

{
// Initiate error logging and tracing
eDest.logger(&Logger);
PWDTrace = new XrdOucTrace(&eDest);
return PWDTrace;
}

Referenced by XrdSecProtocolpwdInit().

Here is the caller graph for this function:

## getCredentials()

XrdSecCredentials * XrdSecProtocolpwd::getCredentials | ( | XrdSecParameters * | parm = 0,
|  | XrdOucErrInfo * | einfo = 0 )

virtual

Generate client credentials to be used in the authentication process.

Parameters

  parm | Pointer to the information returned by the server either in the initial login response or the authmore response.
  einfo | The error information object where error messages should be placed. The messages are returned to the client. Should einfo be null, messages should be written to stderr.

Returns
  Success: Pointer to credentials to sent to the server. The caller is responsible for deleting the object. Failure: Null pointer with einfo, if supplied, containing the reason for the failure.

Implements XrdSecProtocol.

Definition at line 870 of file XrdSecProtocolpwd.cc.

{
// Query client for the password; remote username and host
// are specified in 'parm'. File '.rootnetrc' is checked.
EPNAME("getCredentials");
// If we are a server the only reason to be here is to get the forwarded
// or saved client credentials
if (srvMode) {
XrdSecCredentials *creds = 0;
if (clientCreds) {
// Duplicate the buffer (otherwise it will get deleted ...)
int sz = clientCreds->size;
char *nbuf = (char *) malloc(sz);
if (nbuf) {
memcpy(nbuf, clientCreds->buffer, sz);
creds = new XrdSecCredentials(nbuf, sz);
}
}
return creds;
}
// Handshake vars conatiner must be initialized at this point
if (!hs)
return ErrC(ei,0,0,0,kPWErrError,
"handshake var container missing","getCredentials");
hs->ErrMsg = "";
//
// Nothing to do if buffer is empty and not filled during construction
if ((!parm && !hs->Parms) || (parm && (!(parm->buffer) || parm->size <= 0)))
return ErrC(ei,0,0,0,kPWErrNoBuffer,"missing parameters","getCredentials");
// Count interations
(hs->Iter)++;
// Update time stamp
hs->TimeStamp = time(0);
// Local vars
int nextstep = 0;
const char *stepstr = 0;
kXR_int32 status = 0;
char *bpub = 0;
int lpub = 0;
String CryptList = "";
String Host = "";
String RemID = "";
String Emsg;
String specID = "";
// Buffer / Bucket related
XrdSutBucket *bck = 0;
XrdSutBuffer *bpar = 0; // Global buffer
XrdSutBuffer *bmai = 0; // Main buffer
// Session status
pwdStatus_t SessionSt;
memset(&SessionSt,0,sizeof(SessionSt));
//
// Unlocks automatically returning
XrdSysMutexHelper pwdGuard(&pwdContext);
//
// Decode received buffer
bpar = hs->Parms;
if (!bpar && !(bpar = new XrdSutBuffer((const char *)parm->buffer,parm->size)))
return ErrC(ei,0,0,0,kPWErrDecodeBuffer,"global",stepstr);
// Ownership has been transferred
hs->Parms = 0;
//
// Check protocol ID name
if (strcmp(bpar->GetProtocol(),XrdSecPROTOIDENT))
return ErrC(ei,bpar,bmai,0,kPWErrBadProtocol,stepstr);
//
// The step indicates what we are supposed to do
hs->Step = (bpar->GetStep()) ? bpar->GetStep() : kXPS_init;
stepstr = ServerStepStr(hs->Step);
// Dump, if requested
if (QTRACE(Dump)) {
bpar->Dump(stepstr);
}
//
// Find first crypto module to be used
if (ParseCrypto(bpar) != 0)
return ErrC(ei,bpar,0,0,kPWErrLoadCrypto,stepstr);
//
// Parse input buffer
if (ParseClientInput(bpar, &bmai, Emsg) == -1) {
PRINT(Emsg);
return ErrC(ei,bpar,bmai,0,kPWErrParseBuffer,Emsg.c_str(),stepstr);
}
//
// Version
DEBUG("version run by server: "<< hs->RemVers);
//
// Dump what we got
if (QTRACE(Dump)) {
bmai->Dump("Main IN");
}
//
// Print server messages, if any
if (hs->Iter > 1) {
bmai->Message();
bmai->Deactivate(kXRS_message);
}
//
// Check random challenge
if (!CheckRtag(bmai, Emsg))
return ErrC(ei,bpar,bmai,0,kPWErrBadRndmTag,Emsg.c_str(),stepstr);
//
// Get the status bucket, if any
if ((bck = bmai->GetBucket(kXRS_status))) {
int pst = 0;
memcpy(&pst,bck->buffer,sizeof(pwdStatus_t));
pst = ntohl(pst);
memcpy(&SessionSt, &pst, sizeof(pwdStatus_t));
bmai->Deactivate(kXRS_status);
} else {
SessionSt.ctype = kpCT_normal;
}
//
// Now action depens on the step
nextstep = kXPC_none;
switch (hs->Step) {
case kXPS_init: // The following 3 cases may fall through
case kXPS_puk:
case kXPS_signedrtag: // (after kXRC_verifysrv)
if (hs->Step == kXPS_init)
{
//
// Add bucket with cryptomod to the global list
// (This must be always visible from now on)
if (bpar->AddBucket(hs->CryptoMod,kXRS_cryptomod) != 0)
return ErrC(ei,bpar,bmai,0,
kPWErrCreateBucket,XrdSutBuckStr(kXRS_cryptomod),stepstr);
//
// Add bucket with our version to the main list
if (bmai->MarshalBucket(kXRS_version,(kXR_int32)(Version)) != 0)
return ErrC(ei,bpar,bmai,0, kPWErrCreateBucket,
XrdSutBuckStr(kXRS_version),"(main list)",stepstr);
//
// We set some options in the option field of a pwdStatus_t structure
if (hs->Tty || (AutoLogin > 0))
SessionSt.options = kOptsClntTty;
}
// case kXPS_puk:
if ((hs->Step == kXPS_init) || (hs->Step == kXPS_puk))
{
// After auto-reg request, server puk have been saved in ParseClientInput:
// we need to start a full normal login now
//
// If we have a session cipher we extract the public part
// and add to the main packet for transmission to server
if (hs->Hcip) {
//
// Extract buffer with public info for the cipher agreement
if (!(bpub = hs->Hcip->Public(lpub)))
return ErrC(ei,bpar,bmai,0,
kPWErrNoPublic,"session",stepstr);
//
// Add it to the global list
if (bpar->UpdateBucket(bpub,lpub,kXRS_puk) != 0)
return ErrC(ei,bpar,bmai,0, kPWErrAddBucket,
XrdSutBuckStr(kXRS_puk),"global",stepstr);
SafeDelArray(bpub);
//
// If we are requiring server verification of puk ownership
// we are done for this step
if (VeriSrv == 1) {
nextstep = kXPC_verifysrv;
break;
}
}
}
// case kXPS_signedrtag: // (after kXRC_verifysrv)
//
// Add the username
if (hs->User.length()) {
if (bmai->AddBucket(hs->User,kXRS_user) != 0)
return ErrC(ei,bpar,bmai,0, kPWErrDuplicateBucket,
XrdSutBuckStr(kXRS_user),stepstr);
} else
return ErrC(ei,bpar,bmai,0, kPWErrNoUser,stepstr);
//
// If we do not have a session cipher, the only thing we can
// try is auto-registration
if (!(hs->Hcip)) {
nextstep = kXPC_autoreg;
break;
}
//
// Normal attempt: add credentials
status = kpCT_normal;
if (hs->SysPwd == 1)
status = kpCT_crypt;
if (hs->SysPwd == 2)
status = kpCT_afs;
if (!(bck = QueryCreds(bmai, (AutoLogin > 0), status)))
return ErrC(ei,bpar,bmai,0, kPWErrQueryCreds,
hs->Tag.c_str(),stepstr);
bmai->AddBucket(bck);
//
// Tell the server we want to change the password, if so
if (hs->Pent->status == kPFE_onetime)
SessionSt.options |= kOptsChngPwd;
//
nextstep = kXPC_normal;
break;
case kXPS_credsreq:
//
// If this is not the first time, during the handshake, that
// we query credentials, any save buffer must insufficient,
// so invalidate it
if (hs->Pent)
hs->Pent->cnt = 1;
//
// Server requires additional credentials: the status bucket
// tells us what she wants exactly
status = SessionSt.ctype;
if (!(bck = QueryCreds(bmai, 0, status)))
return ErrC(ei,bpar,bmai,0, kPWErrQueryCreds,
hs->Tag.c_str(),stepstr);
bmai->AddBucket(bck);
//
nextstep = kXPC_creds;
break;
case kXPS_failure:
//
// Failure: invalidate cache
hs->Pent->buf1.SetBuf();
hs->Pent->buf2.SetBuf();
//
nextstep = kXPC_failureack;
break;
case kXPS_newpuk:
//
// New server puk have been saved in ParseClientInput: we
// just need to sign the random tag
case kXPS_rtag:
//
// Not much to do: the random tag is signed in AddSerialized
nextstep = kXPC_signedrtag;
break;
default:
return ErrC(ei,bpar,bmai,0, kPWErrBadOpt,stepstr);
}
//
// Add / Update status
int *pst = (int *) new char[sizeof(pwdStatus_t)];
memcpy(pst,&SessionSt,sizeof(pwdStatus_t));
*pst = htonl(*pst);
if (bmai->AddBucket((char *)pst,sizeof(pwdStatus_t), kXRS_status) != 0) {
PRINT("problems adding bucket kXRS_status");
}
//
// Serialize and encrypt
if (AddSerialized('c', nextstep, hs->ID,
bpar, bmai, kXRS_main, hs->Hcip) != 0)
return ErrC(ei,bpar,bmai,0,
kPWErrSerialBuffer,"main",stepstr);
//
// Serialize the global buffer
char *bser = 0;
int nser = bpar->Serialized(&bser,'f');
if (QTRACE(Dump)) {
bpar->Dump(ClientStepStr(bpar->GetStep()));
bmai->Dump("Main OUT");
}
//
// We may release the buffers now
REL2(bpar,bmai);
//
// Return serialized buffer
if (nser > 0) {
DEBUG("returned " << nser <<" bytes of credentials");
return new XrdSecCredentials(bser, nser);
} else {
DEBUG("problems with final serialization");
return (XrdSecCredentials *)0;
}
}
kPWErrNoBuffer
@ kPWErrNoBuffer
Definition XrdSecProtocolpwd.hh:181
kPWErrQueryCreds
@ kPWErrQueryCreds
Definition XrdSecProtocolpwd.hh:169
kPWErrDuplicateBucket
@ kPWErrDuplicateBucket
Definition XrdSecProtocolpwd.hh:160
kPWErrNoUser
@ kPWErrNoUser
Definition XrdSecProtocolpwd.hh:156
kPWErrCreateBucket
@ kPWErrCreateBucket
Definition XrdSecProtocolpwd.hh:159
kXPC_none
@ kXPC_none
Definition XrdSecProtocolpwd.hh:126
kXPS_init
@ kXPS_init
Definition XrdSecProtocolpwd.hh:139
kXPS_newpuk
@ kXPS_newpuk
Definition XrdSecProtocolpwd.hh:143
XrdSutBuckStr
const char * XrdSutBuckStr(int kbck)
Definition XrdSutAux.cc:121
kXRS_user
@ kXRS_user
Definition XrdSutAux.hh:65
kXRS_version
@ kXRS_version
Definition XrdSutAux.hh:71
kXRS_cryptomod
@ kXRS_cryptomod
Definition XrdSutAux.hh:57
XrdSutBuffer::Message
void Message(const char *prepose=0)
Definition XrdSutBuffer.cc:290
XrdSutBuffer::MarshalBucket
kXR_int32 MarshalBucket(kXR_int32 type, kXR_int32 code)
Definition XrdSutBuffer.cc:318

References XrdSutBuffer::AddBucket(), XrdSecBuffer::buffer, XrdSutBucket::buffer, XrdOucString::c_str(), ClientStepStr(), CryptList, pwdStatus_t::ctype, XrdSutBuffer::Deactivate(), DEBUG, XrdSutBuffer::Dump(), EPNAME, XrdSutBuffer::GetBucket(), XrdSutBuffer::GetProtocol(), XrdSutBuffer::GetStep(), kOptsChngPwd, kOptsClntTty, kpCT_afs, kpCT_crypt, kpCT_normal, kPFE_onetime, kPWErrAddBucket, kPWErrBadOpt, kPWErrBadProtocol, kPWErrBadRndmTag, kPWErrCreateBucket, kPWErrDecodeBuffer, kPWErrDuplicateBucket, kPWErrError, kPWErrLoadCrypto, kPWErrNoBuffer, kPWErrNoPublic, kPWErrNoUser, kPWErrParseBuffer, kPWErrQueryCreds, kPWErrSerialBuffer, kXPC_autoreg, kXPC_creds, kXPC_failureack, kXPC_none, kXPC_normal, kXPC_signedrtag, kXPC_verifysrv, kXPS_credsreq, kXPS_failure, kXPS_init, kXPS_newpuk, kXPS_puk, kXPS_rtag, kXPS_signedrtag, kXRS_cryptomod, kXRS_main, kXRS_message, kXRS_puk, kXRS_status, kXRS_user, kXRS_version, XrdSutBuffer::MarshalBucket(), XrdSutBuffer::Message(), pwdStatus_t::options, ParseCrypto(), PRINT, QTRACE, REL2, SafeDelArray, XrdSutBuffer::Serialized(), ServerStepStr(), XrdSecBuffer::size, XrdSutBuffer::UpdateBucket(), Version, XrdSecPROTOIDENT, and XrdSutBuckStr().

Here is the call graph for this function:

## Init()

char * XrdSecProtocolpwd::Init | ( | pwdOptions | o,
|  | XrdOucErrInfo * | erp )

static

Definition at line 341 of file XrdSecProtocolpwd.cc.

{
// Static method to the configure the static part of the protocol
// Called once by XrdSecProtocolpwdInit
EPNAME("Init");
XrdSutPFCacheRef pfeRef;
char *Parms = 0;
//
// Debug an tracing
Debug = (opt.debug > -1) ? opt.debug : Debug;
// We must have the tracing object at this point
// (initialized in XrdSecProtocolgsiInit)
if (!pwdTrace) {
ErrF(erp,kPWErrInit,"tracing object (pwdTrace) not initialized! cannot continue");
return Parms;
}
// Set debug mask ... also for auxilliary libs
int trace = 0, traceSut = 0, traceCrypto = 0;
if (Debug >= 3) {
trace = cryptoTRACE_Dump;
traceSut = sutTRACE_Dump;
traceCrypto = cryptoTRACE_Dump;
PWDTrace->What = TRACE_ALL;
} else if (Debug >= 2) {
trace = cryptoTRACE_Debug;
traceSut = sutTRACE_Debug;
traceCrypto = cryptoTRACE_Debug;
PWDTrace->What = TRACE_Debug;
PWDTrace->What |= TRACE_Authen;
} else if (Debug >= 1) {
trace = cryptoTRACE_Debug;
traceSut = sutTRACE_Notify;
traceCrypto = cryptoTRACE_Notify;
PWDTrace->What = TRACE_Debug;
}
// ... also for auxilliary libs
XrdSutSetTrace(traceSut);
XrdCryptoSetTrace(traceCrypto);
// Get user info
struct passwd *pw;
XrdSysPwd thePwd(getuid(), &pw);
if (!pw) {
PRINT("no user info available - invalid ");
ErrF(erp, kPWErrInit, "could not get user info from pwuid");
return Parms;
}
//
// Operation mode
Server = (opt.mode == 's');
//
// Directory with admin pwd files
bool argdir = 0;
String infodir(512);
if (opt.dir) {
infodir = opt.dir;
// Expand
if (XrdSutExpand(infodir) != 0) {
PRINT("cannot expand "<<opt.dir);
infodir = "";
}
argdir = 1;
} else {
// use default dir $(HOME)/.<prefix>
infodir = XrdSutHome();
infodir += ("/." + Prefix);
}
if (!infodir.endswith("/")) infodir += "/";
//
// If defined, check existence of the infodir and admin file
if (infodir.length()) {
// Acquire the privileges, if needed
XrdSysPrivGuard priv(pw->pw_uid, pw->pw_gid);
if (priv.Valid()) {
struct stat st;
if (stat(infodir.c_str(),&st) == -1) {
if (errno == ENOENT) {
if (argdir) {
DEBUG("infodir non existing: "<<infodir.c_str());
} else {
DEBUG("creating infodir: "<<infodir.c_str());
if (XrdSutMkdir(infodir.c_str(),0777) != 0) {
DEBUG("cannot create infodir (errno: "<<errno<<")");
infodir = "";
argdir = 0;
}
}
} else {
DEBUG("cannot stat infodir "<<infodir<<" (errno: "<<errno<<")");
infodir = "";
argdir = 0;
}
}
}
}
DEBUG("using infodir: "<<infodir.c_str());
//
// Server specific options
if (Server) {
//
// Auto registration
AutoReg = (opt.areg > -1) ? opt.areg : AutoReg;
//
// Client verification level
VeriClnt = (opt.vericlnt > -1) ? opt.vericlnt : VeriClnt;
//
// Whether to check pwd files in users' $HOME
UserPwd = (opt.upwd > -1) ? opt.upwd : UserPwd;
//
// Whether to check system pwd files (if allowed)
SysPwd = (opt.syspwd > -1) ? opt.syspwd : SysPwd;
if (SysPwd) {
// Make sure this setting makes sense
if (pw) {
#ifdef HAVE_SHADOWPW
// Acquire the privileges, if needed
XrdSysPrivGuard priv((uid_t) 0, (gid_t) 0);
if (priv.Valid()) {
// System V Rel 4 style shadow passwords
struct spwd *spw = getspnam(pw->pw_name);
if (!spw) {
SysPwd = 0;
DEBUG("no privileges to access shadow passwd file");
}
} else {
DEBUG("problems acquiring credentials"
" to access the system password file");
}
#else
// Normal passwd file
if (!pw->pw_passwd &&
(pw->pw_passwd && strlen(pw->pw_passwd) <= 1)) {
SysPwd = 0;
DEBUG("no privileges to access system passwd file");
}
#endif
} else
SysPwd = 0;
}
//
// Credential lifetime
LifeCreds = (opt.lifecreds > -1) ? opt.lifecreds : LifeCreds;
//
// Max number of failures
MaxFailures = (opt.maxfailures > -1) ? opt.maxfailures : MaxFailures;
//
// If defined, check existence of the infodir and admin file
if (infodir.length()) {
// Acquire the privileges, if needed
XrdSysPrivGuard priv(pw->pw_uid, pw->pw_gid);
if (priv.Valid()) {
struct stat st;
//
// Define admin file and check its existence
FileAdmin = infodir + AdminRef;
if (stat(FileAdmin.c_str(),&st) == -1) {
if (errno == ENOENT) {
PRINT("FileAdmin non existing: "<<FileAdmin.c_str());
} else {
PRINT("cannot stat FileAdmin (errno: "<<errno<<")");
}
FileAdmin = "";
if (UserPwd == 0 && !SysPwd) {
PRINT("no passwd info available - invalid ");
ErrF(erp,kPWErrInit,"could not find a valid password file");
return Parms;
}
}
if (FileAdmin.length() > 0) {
//
// Load server ID
PFAdmin.Init(FileAdmin.c_str(),0);
if (PFAdmin.IsValid()) {
//
// Init cache for admin file
if (cacheAdmin.Load(FileAdmin.c_str()) != 0) {
PRINT("problems init cache for file admin ");
ErrF(erp,kPWErrError,"initializing cache for file admin");
return Parms;
}
if (QTRACE(Authen)) { cacheAdmin.Dump(); }
XrdSutPFEntry *ent = cacheAdmin.Get(pfeRef, "+++SrvID");
if (ent)
{SrvID.insert(ent->buf1.buf, 0, ent->buf1.len);
pfeRef.UnLock();
}
ent = cacheAdmin.Get(pfeRef, "+++SrvEmail");
if (ent)
SrvEmail.insert(ent->buf1.buf, 0, ent->buf1.len);
// Default error message
DefError += SrvEmail;
pfeRef.UnLock();
}
DEBUG("server ID: "<<SrvID);
DEBUG("contact e-mail: "<<SrvEmail);
}
}
} else if (UserPwd == 0 && !SysPwd) {
PRINT("no passwd info available - invalid ");
ErrF(erp,kPWErrError,"could not find a valid password file");
return Parms;
}
//
// Init cache for user pwd information
if (UserPwd > 0 || SysPwd) {
if (cacheUser.Init(100) != 0) {
PRINT("problems init cache for user pwd info"
" - passwd files in user accounts will not be used");
UserPwd = 0;
}
}
//
// List of crypto modules
String cryptlist = opt.clist ? (const char *)(opt.clist) : DefCrypto;
//
// Load crypto modules
XrdSutPFEntry ent;
XrdCryptoFactory *cf = 0;
String clist = cryptlist;
if (clist.length()) {
String ncpt = "";
int from = 0;
while ((from = clist.tokenize(ncpt, from, '|')) != -1) {
if (ncpt.length() > 0) {
// Try loading
if ((cf = XrdCryptoFactory::GetCryptoFactory(ncpt.c_str()))) {
// Add it to the list
cryptID[ncrypt] = cf->ID();
cryptName[ncrypt].insert(cf->Name(),0,strlen(cf->Name())+1);
cf->SetTrace(trace);
// Ref cipher
String ptag("+++SrvPuk_");
ptag += cf->ID();
if (FileAdmin.length() > 0) {
// Acquire the privileges, if needed
XrdSysPrivGuard priv(pw->pw_uid, pw->pw_gid);
if (priv.Valid()) {
if (PFAdmin.ReadEntry(ptag.c_str(),ent) <= 0) {
PRINT("ref cipher for module "<<ncpt<<" missing: disable");
cryptlist.erase(ncpt);
} else {
XrdSutBucket bck;
bck.SetBuf(ent.buf1.buf,ent.buf1.len);
if (!(refcip[ncrypt] = cf->Cipher(&bck))) {
PRINT("ref cipher for module "<<ncpt<<
" cannot be instantiated : disable");
cryptlist.erase(ncpt);
} else {
ncrypt++;
if (ncrypt >= XrdCryptoMax) {
PRINT("max number of crypto modules ("
<< XrdCryptoMax <<") reached ");
break;
}
}
}
}
}
} else {
PRINT("cannot instantiate crypto factory "<<ncpt);
}
}
}
}
//
// We need at least one valid crypto module
if (ncrypt <= 0) {
PRINT("could not find any valid crypto module");
ErrF(erp,kPWErrInit,"could not find any valid crypto module");
return Parms;
}
//
// users' pwd information
if (UserPwd > 0) {
FileUser = ("/" + UserRef);
if (opt.udir) {
FileUser.insert(opt.udir,0);
if (FileUser[0] != '/') FileUser.insert('/',0);
} else {
// Use default $(HOME)/.<Prefix>
FileUser.insert(Prefix,0);
FileUser.insert("/.",0);
}
//
// Crypt-hash file name, if requested
if (opt.cpass) {
UserPwd = 2;
FileCrypt = opt.cpass;
if (FileCrypt[0] != '/') FileCrypt.insert('/',0);
}
}
//
// Whether to save client creds
KeepCreds = (opt.keepcreds > -1) ? opt.keepcreds : KeepCreds;
if (KeepCreds > 0)
NOTIFY("Exporting client creds to internal buffer");
//
// Whether to export client creds to a file
FileExpCreds = (opt.expcreds) ? opt.expcreds : FileExpCreds;
if (FileExpCreds.length() > 0) {
// Export format
FmtExpCreds = opt.expfmt;
const char *efmts[4] = {"PFile", "hex", "raw", "raw/nokeyword"};
NOTIFY("Exporting client creds (fmt:"<<efmts[FmtExpCreds]<<") to files "<<FileExpCreds);
}
//
// Priority option field
String popt = "";
if (SysPwd) {
popt += "sys";
}
//
// Parms in the form: &P=pwd,c:<cryptomod>,v:<version>,id:<srvid>
Parms = new char[cryptlist.length()+3+12+SrvID.length()+5+popt.length()+3];
if (Parms) {
if (popt.length() > 0)
sprintf(Parms,"v:%d,id:%s,c:%s,po:%s",
Version,SrvID.c_str(),cryptlist.c_str(),popt.c_str());
else
sprintf(Parms,"v:%d,id:%s,c:%s",
Version,SrvID.c_str(),cryptlist.c_str());
} else {
PRINT("no system resources for 'Parms'");
ErrF(erp,kPWErrInit,"no system resources for 'Parms'");
}
// Some notification
NOTIFY("using FileAdmin: "<<FileAdmin);
NOTIFY("server ID: "<<SrvID);
NOTIFY("contact e-mail: "<<SrvEmail);
NOTIFY("auto-registration mode: "<<AutoReg);
NOTIFY("verify client mode: "<<VeriClnt);
NOTIFY("available crypto modules: "<<cryptlist);
if (UserPwd > 0) {
NOTIFY("using private pwd files: $(HOME)"<<FileUser);
if (UserPwd > 1) {
NOTIFY("using private crypt-hash files: $(HOME)"<<FileCrypt);
}
}
if (SysPwd) {
NOTIFY("using system pwd information");
}
if (KeepCreds) {
NOTIFY("client credentials will be kept");
}
}
//
// Client specific options
if (!Server) {
//
// Server verification level
VeriSrv = (opt.verisrv > -1) ? opt.verisrv : VeriSrv;
//
// Server puks file
FileSrvPuk = "";
if (opt.srvpuk) {
FileSrvPuk = opt.srvpuk;
if (XrdSutExpand(FileSrvPuk) != 0) {
PRINT("cannot expand "<<opt.srvpuk);
FileSrvPuk = "";
}
}
//
// If not defined, use default
if (FileSrvPuk.length() <= 0 && infodir.length() > 0)
FileSrvPuk = infodir + SrvPukRef;
if (FileSrvPuk.length() > 0) {
kXR_int32 openmode = 0;
struct stat st;
//
if (stat(FileSrvPuk.c_str(),&st) == -1) {
if (errno == ENOENT) {
PRINT("server public key file "<<FileSrvPuk<<" non existing: creating");
openmode = kPFEcreate;
// Make sure that the dir path exists
XrdOucString dir = FileSrvPuk;
dir.erase(dir.rfind('/')+1);
DEBUG("asserting dir: "<<dir);
if (XrdSutMkdir(dir.c_str(),0777) != 0) {
PRINT("cannot create dir for srvpuk(errno: "<<errno<<")");
ErrF(erp,kPWErrInit,"cannot create dir for server public key file- exit");
return Parms;
}
} else {
PRINT("cannot stat server public key file (errno: "<<errno<<")");
FileSrvPuk = "";
PRINT("server public key file invalid - exit");
ErrF(erp,kPWErrInit,"server public key file invalid - exit");
return Parms;
}
}
//
// Load server ID
PFSrvPuk.Init(FileSrvPuk.c_str(),openmode);
if (PFSrvPuk.IsValid()) {
//
// Init cache for server puk file
if (cacheSrvPuk.Load(FileSrvPuk.c_str()) != 0) {
PRINT("problems init cache for server public key file ");
ErrF(erp,kPWErrError,"initializing cache for server public key file ");
return Parms;
}
if (QTRACE(Authen)) { cacheSrvPuk.Dump(); }
} else {
PRINT("server public key file invalid ");
ErrF(erp,kPWErrInit,"server public key file invalid");
return Parms;
}
} else {
PRINT("server public key file undefined");
ErrF(erp,kPWErrInit,"server public key file undefined");
return Parms;
}
//
// Whether to search for autologin information
AutoLogin = (opt.alog > -1) ? opt.alog : AutoLogin;
NOTIFY("AutoLogin level: "<<AutoLogin);
//
// Max number of re-prompts (for inconsistent inputs)
MaxPrompts = (opt.maxprompts > -1) ? opt.maxprompts : MaxPrompts;
//
// Attach autologin file name, if requested
if (AutoLogin > 0) {
bool filefound = 0;
String fnrc(256);
if (opt.alogfile) {
fnrc = opt.alogfile;
if (XrdSutExpand(fnrc) != 0) {
PRINT("cannot expand "<<opt.alogfile);
fnrc = "";
}
}
//
// If file name not specified ...
if (fnrc.length() <= 0)
// use default
fnrc = infodir + NetRcRef;
if (fnrc.length() > 0) {
kXR_int32 openmode = 0;
struct stat st;
if (stat(fnrc.c_str(),&st) == -1) {
if (errno == ENOENT) {
PRINT("Autologin file "<<fnrc<<" non existing: creating");
openmode = kPFEcreate;
} else {
PRINT("cannot stat autologin file (errno: "<<errno<<")");
PRINT("switching off auto-login");
AutoLogin = 0;
}
}
if (AutoLogin > 0) {
// Attach to file
PFAlog.Init(fnrc.c_str(),openmode);
if (PFAlog.IsValid()) {
// Init cache for autologin file
if (cacheAlog.Load(fnrc.c_str()) == 0) {
if (QTRACE(Authen)) { cacheAlog.Dump(); }
filefound =1;
} else {
PRINT("problems init cache for autologin file");
}
} else {
PRINT("problems attaching-to / creating autologin file");
}
}
}
//
// Notify if not found
if (!filefound) {
NOTIFY("could not init properly autologin - switch off ");
AutoLogin = 0;
}
}
//
// Notify if not found
if (AutoLogin <= 0) {
// Init anyhow cache to cache information during session
if (cacheAlog.Init(100) != 0) {
PRINT("problems init cache for user temporary autolog");
}
}
// We are done
Parms = (char *)"";
}
// We are done
return Parms;
}
TRACE_Debug
#define TRACE_Debug
Definition XrdCmsTrace.hh:37
XrdCryptoSetTrace
void XrdCryptoSetTrace(kXR_int32 trace)
Definition XrdCryptoAux.cc:49
cryptoTRACE_Notify
#define cryptoTRACE_Notify
Definition XrdCryptoAux.hh:49
cryptoTRACE_Dump
#define cryptoTRACE_Dump
Definition XrdCryptoAux.hh:47
cryptoTRACE_Debug
#define cryptoTRACE_Debug
Definition XrdCryptoAux.hh:48
stat
#define stat(a, b)
Definition XrdPosix.hh:101
Prefix
static String Prefix
Definition XrdSecProtocolgsi.cc:77
NetRcRef
static String NetRcRef
Definition XrdSecProtocolpwd.cc:76
pwdTrace
XrdOucTrace * pwdTrace
Definition XrdSecProtocolpwd.cc:209
SrvPukRef
static String SrvPukRef
Definition XrdSecProtocolpwd.cc:74
UserRef
static String UserRef
Definition XrdSecProtocolpwd.cc:75
AdminRef
static String AdminRef
Definition XrdSecProtocolpwd.cc:73
kPWErrInit
@ kPWErrInit
Definition XrdSecProtocolpwd.hh:186
XrdCryptoMax
#define XrdCryptoMax
Definition XrdSecProtocolpwd.hh:59
TRACE_Authen
#define TRACE_Authen
Definition XrdSecTrace.hh:62
XrdSutExpand
int XrdSutExpand(XrdOucString &path)
Definition XrdSutAux.cc:360
XrdSutMkdir
int XrdSutMkdir(const char *dir, unsigned int mode, const char *opt)
Definition XrdSutAux.cc:487
XrdSutHome
const char * XrdSutHome()
Definition XrdSutAux.cc:459
XrdSutSetTrace
void XrdSutSetTrace(kXR_int32 trace)
Definition XrdSutAux.cc:93
sutTRACE_Notify
#define sutTRACE_Notify
Definition XrdSutAux.hh:100
sutTRACE_Debug
#define sutTRACE_Debug
Definition XrdSutAux.hh:99
sutTRACE_Dump
#define sutTRACE_Dump
Definition XrdSutAux.hh:98
kPFEcreate
#define kPFEcreate
Definition XrdSutPFile.hh:59
TRACE_ALL
#define TRACE_ALL
Definition XrdTrace.hh:35
XrdCryptoFactory::SetTrace
virtual void SetTrace(kXR_int32 trace)
Definition XrdCryptoFactory.cc:69
XrdCryptoFactory::Name
char * Name() const
Definition XrdCryptoFactory.hh:134
XrdCryptoFactory::Cipher
virtual XrdCryptoCipher * Cipher(const char *t, int l=0)
Definition XrdCryptoFactory.cc:123
XrdCryptoFactory::ID
int ID() const
Definition XrdCryptoFactory.hh:135
XrdCryptoFactory::GetCryptoFactory
static XrdCryptoFactory * GetCryptoFactory(const char *factoryname)
Definition XrdCryptoFactory.cc:417
XrdOucString::erase
int erase(int start=0, int size=0)
Definition XrdOucString.cc:827
XrdOucString::rfind
int rfind(const char c, int start=STR_NPOS)
Definition XrdOucString.hh:285
XrdOucString::tokenize
int tokenize(XrdOucString &tok, int from, char del=':')
Definition XrdOucString.cc:1220
XrdSutBucket::SetBuf
int SetBuf(const char *nb=0, int ns=0)
Definition XrdSutBucket.cc:132
XrdSutPFBuf::buf
char * buf
Definition XrdSutPFEntry.hh:57
XrdSutPFBuf::len
kXR_int32 len
Definition XrdSutPFEntry.hh:58
XrdSutPFCacheRef::UnLock
void UnLock()
Definition XrdSutPFCache.hh:62
XrdSutPFEntry::buf1
XrdSutPFBuf buf1
Definition XrdSutPFEntry.hh:84

References AdminRef, pwdOptions::alog, pwdOptions::alogfile, pwdOptions::areg, XrdSutPFBuf::buf, XrdSutPFEntry::buf1, XrdOucString::c_str(), XrdCryptoFactory::Cipher(), pwdOptions::clist, pwdOptions::cpass, cryptoTRACE_Debug, cryptoTRACE_Dump, cryptoTRACE_Notify, DEBUG, pwdOptions::debug, pwdOptions::dir, XrdOucString::endswith(), EPNAME, XrdOucString::erase(), pwdOptions::expcreds, pwdOptions::expfmt, XrdCryptoFactory::GetCryptoFactory(), XrdCryptoFactory::ID(), pwdOptions::keepcreds, kPFEcreate, kPWErrError, kPWErrInit, XrdSutPFBuf::len, XrdOucString::length(), pwdOptions::lifecreds, pwdOptions::maxfailures, pwdOptions::maxprompts, pwdOptions::mode, XrdCryptoFactory::Name(), NetRcRef, NOTIFY, Prefix, PRINT, pwdTrace, QTRACE, XrdOucString::rfind(), XrdSutBucket::SetBuf(), XrdCryptoFactory::SetTrace(), pwdOptions::srvpuk, SrvPukRef, stat, sutTRACE_Debug, sutTRACE_Dump, sutTRACE_Notify, pwdOptions::syspwd, XrdOucString::tokenize(), TRACE_ALL, TRACE_Authen, TRACE_Debug, pwdOptions::udir, XrdSutPFCacheRef::UnLock(), pwdOptions::upwd, UserRef, XrdSysPrivGuard::Valid(), pwdOptions::vericlnt, pwdOptions::verisrv, Version, XrdCryptoMax, XrdCryptoSetTrace(), XrdSutExpand(), XrdSutHome(), XrdSutMkdir(), and XrdSutSetTrace().

Referenced by XrdSecProtocolpwdInit().

Here is the call graph for this function:
Here is the caller graph for this function:

## PrintTimeStat()

void XrdSecProtocolpwd::PrintTimeStat | ( |  | ) |

static

References emsg(), ID, and XrdCryptoMax.

Here is the call graph for this function:

The documentation for this class was generated from the following files:

- XrdSecProtocolpwd.hh
- XrdSecProtocolpwd.cc