Loading...
Searching...
No Matches
XrdSecProtocolztn Class Reference
Inheritance diagram for XrdSecProtocolztn:
Collaboration diagram for XrdSecProtocolztn:

## Public Member Functions

| XrdSecProtocolztn (const char *hname, XrdNetAddrInfo &endPoint, XrdSciTokensHelper *sthp)
| XrdSecProtocolztn (const char *parms, XrdOucErrInfo *erp, bool &aOK)
| ~XrdSecProtocolztn ()
int | Authenticate (XrdSecCredentials *cred, XrdSecParameters **parms, XrdOucErrInfo *einfo=0)
void | Delete ()
| Delete the protocol object. DO NOT use C++ delete() on this object.
XrdSecCredentials * | getCredentials (XrdSecParameters *parms, XrdOucErrInfo *einfo=0)
bool | needTLS ()
| Check if this protocol requires TLS to properly function.
Public Member Functions inherited from XrdSecProtocol
| XrdSecProtocol (const char *pName)
| Constructor.
virtual int | Decrypt (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int | Encrypt (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int | getKey (char *buff=0, int size=0)
virtual int | setKey (char *buff, int size)
virtual int | Sign (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int | Verify (const char *inbuff, int inlen, const char *sigbuff, int siglen)

## Static Public Attributes

static const int | ztnVersion = 0

## Additional Inherited Members

Public Attributes inherited from XrdSecProtocol
XrdSecEntity | Entity
Protected Member Functions inherited from XrdSecProtocol
virtual | ~XrdSecProtocol ()
| Destructor (prevents use of direct delete).

## Detailed Description

Definition at line 182 of file XrdSecProtocolztn.cc.

## Constructor & Destructor Documentation

## XrdSecProtocolztn() [1/2]

XrdSecProtocolztn::XrdSecProtocolztn | ( | const char * | parms,
|  | XrdOucErrInfo * | erp,
|  | bool & | aOK )

Definition at line 269 of file XrdSecProtocolztn.cc.

: XrdSecProtocol("ztn"), sthP(0),
tokName(""), ztnInfo(0), maxTSize(0),
cont(false), rtGet(false), verJWT(false)
{
char *endP;
// Assume we will fail
//
aOK = false;
// If there are no parameters then fail as the server must supply them
//
if (!parms || !(*parms))
{Fatal(erp, "Client parameters not specified.", EINVAL);
return;
}
// Server supplied parms: <opts+ver>:<maxtsz>:
// The first parameter is the options and version number.
//
ztnInfo = strtoll(parms, &endP, 10);
if (*endP != ':')
{Fatal(erp, "Malformed client parameters.", EINVAL);
return;
}
parms = endP+1;
// The second parameter is the maximum token size
//
maxTSize = strtol(parms, &endP, 10);
if (maxTSize <= 0 || *endP != ':')
{Fatal(erp, "Invalid or missing maxtsz parameter.", EINVAL);
return;
}
endP++;
// All done here
//
aOK = true;
}
Fatal
void Fatal(const char *op, const char *target)
Definition XrdCrc32c.cc:58
XrdSecProtocol::XrdSecProtocol
XrdSecProtocol(const char *pName)
Constructor.
Definition XrdSecInterface.hh:317

References XrdSecProtocol::XrdSecProtocol(), and Fatal().

Here is the call graph for this function:

## XrdSecProtocolztn() [2/2]

XrdSecProtocolztn::XrdSecProtocolztn | ( | const char * | hname,
|  | XrdNetAddrInfo & | endPoint,
|  | XrdSciTokensHelper * | sthp )

inline

Definition at line 204 of file XrdSecProtocolztn.cc.

: XrdSecProtocol("ztn"), sthP(sthp), tokName(""),
maxTSize(MaxTokSize), cont(false),
rtGet(false), verJWT(false)
{Entity.host = strdup(hname);
Entity.name = strdup("anon");
Entity.addrInfo = &endPoint;
}
XrdSecProtocol::Entity
XrdSecEntity Entity
Definition XrdSecInterface.hh:139

References XrdSecProtocol::XrdSecProtocol(), and XrdSecProtocol::Entity.

Here is the call graph for this function:

## ~XrdSecProtocolztn()

XrdSecProtocolztn::~XrdSecProtocolztn | ( |  | ) |

inline

Definition at line 214 of file XrdSecProtocolztn.cc.

{if (Entity.host) free(Entity.host);
if (Entity.name) free(Entity.name);
if (Entity.creds)free(Entity.creds);
} // via Delete()

References XrdSecProtocol::Entity.

## Member Function Documentation

## Authenticate()

int XrdSecProtocolztn::Authenticate | ( | XrdSecCredentials * | cred,
|  | XrdSecParameters ** | parms,
|  | XrdOucErrInfo * | einfo = 0 )

virtual

Authenticate a client.

Parameters

  cred | Credentials supplied by the client.
  parms | Place where the address of additional authentication data is to be placed for another autrhentication handshake.
  einfo | The error information object where error messages should be placed. The messages are returned to the client. Should einfo be null, messages should be written to stderr.

Returns
  > 0 -> parms present (more authentication needed) = 0 -> Entity present (authentication succeeded) < 0 -> einfo present (error has occurred)

Implements XrdSecProtocol.

Definition at line 590 of file XrdSecProtocolztn.cc.

{
static const int pfxLen = sizeof(TokenHdr) + sizeof(uint16_t);
TokenResp *tResp;
// Check if we have any credentials or if no credentials really needed.
// In either case, use host name as client name
//
if (cred->size < (int)sizeof(TokenHdr) || !cred->buffer)
{Fatal(erp, "Invalid ztn credentials", EINVAL, false);
return -1;
}
tResp = (TokenResp *)cred->buffer;
// Check if this is our protocol
//
if (strcmp(tResp->hdr.id, "ztn"))
{char msg[256];
snprintf(msg, sizeof(msg),
"Authentication protocol id mismatch ('ztn' != '%.4s').",
tResp->hdr.id);
Fatal(erp, msg, EINVAL, false);
return -1;
}
// Check if caller wants the list of authorized issuers
//
if (tResp->hdr.opr == TokenHdr::SndAI) return SendAI(erp, parms);
// If this is not a token response then this is an error
//
if (tResp->hdr.opr != TokenHdr::IsTkn)
{Fatal(erp, "Invalid ztn response code", EINVAL, false);
return -1;
}
// Make sure the response is consistent
//
const char *isBad = 0;
int tLen = ntohs(tResp->len);
if (tResp->hdr.ver != ztnVersion) isBad = "version mismatch";
else if (tLen < 1) isBad = "token length < 1";
else if (pfxLen + tLen > cred->size) isBad = "respdata > credsize";
else if (!(tResp->tkn[0])) isBad = "null token";
else if (*(tResp->tkn+(tLen-1))) isBad = "missing null byte";
if (isBad)
{char eText[80];
snprintf(eText, sizeof(eText), "'ztn' token malformed; %s", isBad);
Fatal(erp, eText, EINVAL, false);
return -1;
}
// Validate the token
//
std::string msgRC;
long long eTime;
bool validated = false;
if (Entity.name) {free(Entity.name); Entity.name = 0;}
if (tokenlib && sthP->Validate(tResp->tkn, msgRC, (expiry ? &eTime : 0), &Entity))
{if (expiry)
{if (eTime < 0 && expiry > 0)
{Fatal(erp, "'ztn' token expiry missing", EINVAL, false);
return -1;
}
if ((monotonic_time() - eTime) <= 0)
{Fatal(erp, "'ztn' token expired", EINVAL, false);
return -1;
}
}
validated = true;
}
if (!tokenlib || validated)
{
Entity.credslen = strlen(tResp->tkn);
if (Entity.creds)
free(Entity.creds);
if ((Entity.creds = (char *)malloc(Entity.credslen+1)))
strcpy(Entity.creds, tResp->tkn);
else
Fatal(erp, "'ztn' bad alloc", ENOMEM, false);
if (!Entity.name) Entity.name = strdup("anon");
return 0;
}
// Validation failed, generate message and return failure
//
// msgRC.insert(0, "ztn validation failed; ");
Fatal(erp, msgRC.c_str(), EAUTH, false);
return -1;
}
EAUTH
#define EAUTH
Definition XrdSecProtocolztn.cc:70
XrdSecProtocolztn::ztnVersion
static const int ztnVersion
Definition XrdSecProtocolztn.cc:219
XrdSecBuffer::buffer
char * buffer
Pointer to the buffer.
Definition XrdSecInterface.hh:53
XrdSecBuffer::size
int size
Size of the buffer or length of data in the buffer.
Definition XrdSecInterface.hh:52

References XrdSecBuffer::buffer, EAUTH, XrdSecProtocol::Entity, Fatal(), XrdSecBuffer::size, and ztnVersion.

Here is the call graph for this function:

## Delete()

void XrdSecProtocolztn::Delete | ( |  | ) |

inline virtual

Delete the protocol object. DO NOT use C++ delete() on this object.

Implements XrdSecProtocol.

Definition at line 190 of file XrdSecProtocolztn.cc.

{delete this;}

## getCredentials()

XrdSecCredentials * XrdSecProtocolztn::getCredentials | ( | XrdSecParameters * | parm,
|  | XrdOucErrInfo * | einfo = 0 )

virtual

Generate client credentials to be used in the authentication process.

Parameters

  parm | Pointer to the information returned by the server either in the initial login response or the authmore response.
  einfo | The error information object where error messages should be placed. The messages are returned to the client. Should einfo be null, messages should be written to stderr.

Returns
  Success: Pointer to credentials to sent to the server. The caller is responsible for deleting the object. Failure: Null pointer with einfo, if supplied, containing the reason for the failure.

Implements XrdSecProtocol.

Definition at line 376 of file XrdSecProtocolztn.cc.

{
static const char *dfltLoc[] = {"BEARER_TOKEN", "BEARER_TOKEN_FILE",
"XDG_RUNTIME_DIR", "/tmp/bt_u%d"};
static const char **dfltLocEnd = dfltLoc + sizeof(dfltLoc)/sizeof(char*);
static std::vector<XrdOucString> dfltVec(dfltLoc, dfltLocEnd);
XrdSecCredentials *resp;
bool isbad;
// If this is a continuation, then handle as such
//
if (cont) return getToken(error, parms);
// Handle the default search
//
resp = findToken(error, dfltVec, isbad);
if (resp || isbad) return resp;
// We do not have a envar value then ask the server for a list of
// token issuers so we can get one, if allowed. Otherwise, it's an error.
//
if (rtGet)
{TokenHdr *tHdr = (TokenHdr *)malloc(sizeof(TokenHdr));
tHdr->Fill(TokenHdr::SndAI);
cont = true;
return new XrdSecCredentials((char *)tHdr, sizeof(TokenHdr));
}
Fatal(error, "No token found; runtime fetch disallowed.", ENOPROTOOPT);
return 0;
}
XrdSecCredentials
XrdSecBuffer XrdSecCredentials
Definition XrdSecInterface.hh:69

References Fatal().

Here is the call graph for this function:

## needTLS()

bool XrdSecProtocolztn::needTLS | ( |  | ) |

inline virtual

Check if this protocol requires TLS to properly function.

Reimplemented from XrdSecProtocol.

Definition at line 195 of file XrdSecProtocolztn.cc.

{return true;}

## Member Data Documentation

## ztnVersion

const int XrdSecProtocolztn::ztnVersion = 0

static

Definition at line 219 of file XrdSecProtocolztn.cc.

Referenced by Authenticate(), and XrdSecProtocolztnInit().

The documentation for this class was generated from the following file:

- XrdSecProtocolztn.cc