Loading...
Searching...
No Matches
XrdSecServer Class Reference

`#include <XrdSecServer.hh>`

Inheritance diagram for XrdSecServer:
Collaboration diagram for XrdSecServer:

## Public Member Functions

| XrdSecServer (XrdSysLogger *lp)
| ~XrdSecServer ()
int | Configure (const char *cfn)
const char * | getParms (int &size, XrdNetAddrInfo *endPoint=0)
XrdSecProtocol * | getProtocol (const char *host, XrdNetAddrInfo &endPoint, const XrdSecCredentials *cred, XrdOucErrInfo &einfo)
bool | PostProcess (XrdSecEntity &entity, XrdOucErrInfo &einfo)
const char * | protTLS ()

## Detailed Description

Definition at line 45 of file XrdSecServer.hh.

## Constructor & Destructor Documentation

## XrdSecServer()

XrdSecServer::XrdSecServer | ( | XrdSysLogger * | lp | ) |

Definition at line 288 of file XrdSecServer.cc.

: eDest(lp, "sec_")
{
// Set default values
//
PManager.setErrP(&eDest);
configFN = "";
bpFirst = 0;
bpLast = 0;
bpDefault = 0;
pinInfo = 0;
pidList = 0;
STBlen = 4096;
STBuff = (char *)malloc(STBlen);
*STBuff = '\0';
SToken = STBuff;
SecTrace = new XrdOucTrace(&eDest);
if (getenv("XRDDEBUG") || getenv("XrdSecDEBUG"))
{SecTrace->What = TRACE_ALL;
PManager.setDebug(1);
}
Enforce = false;
implauth = false;
}
eDest
static XrdSysError eDest(0,"crypto_")
TRACE_ALL
#define TRACE_ALL
Definition XrdTrace.hh:35

References TRACE_ALL.

## ~XrdSecServer()

XrdSecServer::~XrdSecServer | ( |  | ) |

inline

Definition at line 67 of file XrdSecServer.hh.

{} // Server is never deleted

## Member Function Documentation

## Configure()

int XrdSecServer::Configure | ( | const char * | cfn | ) |

Definition at line 441 of file XrdSecServer.cc.

{
extern XrdSecProtector *XrdSecLoadProtection(XrdSysError &erP);
static const int isRlx = XrdSecProtectParms::relax;
static const int isFrc = XrdSecProtectParms::force;
XrdSecProtector *protObj;
const char *lName = "none", *rName = "none";
char *var;
int NoGo;
// Print warm-up message
//
eDest.Say("++++++ Authentication system initialization started.");
// Perform initialization
//
NoGo = ConfigFile(cfn);
// Load the entity post processing plugin if we have one
//
if (pinInfo && !NoGo)
{XrdSecEntityPin *secPin = pinInfo->KingPin.Load("SecEntityPin");
delete pinInfo;
secEntityPin = secPin;
if (!secPin) return 1;
}
// Export the list of security protocols that are available
//
if (pidList) XrdOucEnv::Export("XRDSECPROTOCOLS", pidList);
// Almost done
//
var = (NoGo > 0 ? (char *)"failed." : (char *)"completed.");
eDest.Say("------ Authentication system initialization ", var);
// No need to configure protect system if authentication failed
//
if (NoGo) return 1;
// Put out another banner
//
eDest.Say("++++++ Protection system initialization started.");
// If local level if greater than remote level, issue a warning
//
if (lclParms.level > rmtParms.level)
eDest.Say("Config warning: local protection level greater than "
"remote level; are you sure?");
// Check if we need to initialize protection services
//
if (lclParms.level == XrdSecProtectParms::secNone
&& rmtParms.level == XrdSecProtectParms::secNone)
{eDest.Say("Config warning: Security level is set to none; "
"request protection disabled!");
} else {
if (!(protObj = XrdSecLoadProtection(eDest))
|| !(protObj->Config(lclParms, rmtParms, *eDest.logger()))) NoGo = 1;
else {lName = protObj->LName(lclParms.level);
rName = protObj->LName(rmtParms.level);
}
}
// Blurt out what we have
//
if (!NoGo)
{eDest.Say("Config ","Local protection level: ",
(lclParms.opts & isRlx ? "relaxed " : 0), lName,
(lclParms.opts & isFrc ? " force" : 0));
eDest.Say("Config ","Remote protection level: ",
(rmtParms.opts & isRlx ? "relaxed " : 0), rName,
(rmtParms.opts & isFrc ? " force" : 0));
}
// Now we are done
//
var = (NoGo > 0 ? (char *)"failed." : (char *)"completed.");
eDest.Say("------ Protection system initialization ", var);
return (NoGo > 0);
}
XrdSecLoadProtection
XrdSecProtector * XrdSecLoadProtection(XrdSysError &erP)
Definition XrdSecLoadSecurity.cc:262
XrdOucEnv::Export
static int Export(const char *Var, const char *Val)
Definition XrdOucEnv.cc:170
XrdSecProtectParms::secNone
@ secNone
Definition XrdSecProtector.hh:42
XrdSecProtectParms::relax
static const int relax
relax old clients
Definition XrdSecProtector.hh:51
XrdSecProtectParms::force
static const int force
Allow unencryted hash.
Definition XrdSecProtector.hh:52
XrdSecProtector::Config
virtual bool Config(const XrdSecProtectParms &lclParms, const XrdSecProtectParms &rmtParms, XrdSysLogger &logr)
Definition XrdSecProtector.cc:100
XrdSecProtector::LName
virtual const char * LName(XrdSecProtectParms::secLevel level)
Definition XrdSecProtector.cc:182

References XrdSecProtector::Config(), XrdOucEnv::Export(), XrdSecProtectParms::force, XrdSecProtector::LName(), XrdSecProtectParms::relax, XrdSecProtectParms::secNone, and XrdSecLoadProtection().

Referenced by XrdSecgetService().

Here is the call graph for this function:
Here is the caller graph for this function:

## getParms()

const char * XrdSecServer::getParms | ( | int & | size,
|  | XrdNetAddrInfo * | endPoint = 0 )

virtual

Obtain security parameters to be sent to the client upon initial contact.

Parameters

  size | Where the length of the return parameters are to be placed.
  endPoint | The client's address information. It may also be a null pointer if the client's host is immaterial.

Returns
  EITHER The address of the parameter string (which may be host-specific if hname was supplied). The length of the string must be returned in size parameter. OR A null pointer if authentication need not occur for the client. The size parameter should be set to zero as well.

Implements XrdSecService.

Definition at line 317 of file XrdSecServer.cc.

{
EPNAME("getParms")
XrdSecProtBind *bp;
char buff[256];
// Try to find a specific token binding for a host or return default binding
//
if (!endPoint || !bpFirst) bp = 0;
else {const char *hname = endPoint->Name("*unknown*");
bp = bpFirst;
do {if (bp->Match(hname)) break;} while((bp = bp->next));
}
// Get endpoint info if we are debugging
//
if (endPoint && QTRACE(Debug))
endPoint->Format(buff, sizeof(buff), XrdNetAddrInfo::fmtAuto,
XrdNetAddrInfo::noPort);
else *buff = 0;
// If we have a binding, return that else return the default
//
if (!bp) bp = bpDefault;
if (bp->SecToken.buffer)
{DEBUG(buff <<" sectoken=" <<bp->SecToken.buffer);
size = bp->SecToken.size;
return bp->SecToken.buffer;
}
DEBUG(buff <<" sectoken=''");
size = 0;
return (const char *)0;
}
DEBUG
#define DEBUG(x)
Definition XrdBwmTrace.hh:54
EPNAME
#define EPNAME(x)
Definition XrdBwmTrace.hh:56
QTRACE
#define QTRACE(act)
Definition XrdCmsTrace.hh:49
Debug
bool Debug
Definition XrdSecgsiProxy.cc:95
else
else
Definition XrdSysFAttrSun.icc:99
if
if(ec< 0) ec
XrdNetAddrInfo::noPort
static const int noPort
Do not add port number.
Definition XrdNetAddrInfo.hh:104
XrdNetAddrInfo::Format
int Format(char *bAddr, int bLen, fmtUse fmtType=fmtAuto, int fmtOpts=0)
Definition XrdNetAddrInfo.cc:81
XrdNetAddrInfo::fmtAuto
@ fmtAuto
Hostname if already resolved o/w use fmtAddr.
Definition XrdNetAddrInfo.hh:99
XrdNetAddrInfo::Name
const char * Name(const char *eName=0, const char **eText=0)
Definition XrdNetAddrInfo.cc:309
XrdSecProtBind::Match
int Match(const char *hname)
Definition XrdSecServer.cc:159
XrdSecProtBind::next
XrdSecProtBind * next
Definition XrdSecServer.cc:99
XrdSecProtBind::SecToken
XrdSecParameters SecToken
Definition XrdSecServer.cc:104
XrdSecBuffer::buffer
char * buffer
Pointer to the buffer.
Definition XrdSecInterface.hh:53
XrdSecBuffer::size
int size
Size of the buffer or length of data in the buffer.
Definition XrdSecInterface.hh:52

References XrdSecBuffer::buffer, DEBUG, Debug, EPNAME, XrdNetAddrInfo::fmtAuto, XrdNetAddrInfo::Format(), XrdSecProtBind::Match(), XrdNetAddrInfo::Name(), XrdSecProtBind::next, XrdNetAddrInfo::noPort, QTRACE, XrdSecProtBind::SecToken, and XrdSecBuffer::size.

Here is the call graph for this function:

## getProtocol()

XrdSecProtocol * XrdSecServer::getProtocol | ( | const char * | host,
|  | XrdNetAddrInfo & | endPoint,
|  | const XrdSecCredentials * | cred,
|  | XrdOucErrInfo & | einfo )

virtual

Obtain a protocol object suitable for authentication based on cred and possibly based on the hostname or host address, as needed.

Parameters

  host | The client's host name or the IP address as text. An IP may be supplied if the host address is not resolvable or resolution has been suppressed (i.e. nodnr). Use endPoint to get the hostname if it's actually needed.
  endPoint | the XrdNetAddrInfo object describing the client end-point.
  cred | The initial credentials supplied by the client, the pointer may be null if the client did not supply credentials.
  einfo | The structure to record any error messages. These are normally sent to the client.

Returns
  Success: Address of protocol object to be used for authentication. If cred was null, a host protocol object shouldpo be returned if so allowed. Failure: Null, no protocol can be returned. The einfo parameter, if supplied, has the reason.

Implements XrdSecService.

Definition at line 356 of file XrdSecServer.cc.

{
XrdSecProtBind *bp;
XrdSecPMask_t pnum;
XrdSecCredentials myCreds;
const char *msgv[8];
// If null credentials supplied, default to host protocol otherwise make sure
// credentials data is actually supplied.
//
if (!cred) {myCreds.buffer=(char *)"host"; myCreds.size = 4; cred=&myCreds;}
else if (cred->size < 1 || !(cred->buffer))
{einfo.setErrInfo(EACCES,"No authentication credentials supplied.");
return 0;
}
// If protocol binding must be enforced, make sure the host is not using a
// disallowed protocol.
//
if (Enforce)
{if ((pnum = PManager.Find(cred->buffer)))
{if (bpFirst && (bp = bpFirst->Find(host))
&& !(bp->ValidProts & pnum))
{msgv[0] = host;
msgv[1] = " not allowed to authenticate using ";
msgv[2] = cred->buffer;
msgv[3] = " protocol.";
einfo.setErrInfo(EACCES, msgv, 4);
return 0;
}
}
else {msgv[0] = cred->buffer;
msgv[1] = " security protocol is not supported.";
einfo.setErrInfo(EPROTONOSUPPORT, msgv, 2);
return 0;
}
}
// If we passed the protocol binding check, try to get an instance of the
// protocol the host is using
//
return PManager.Get(host, endPoint, cred->buffer, &einfo);
}
XrdSecCredentials
XrdSecBuffer XrdSecCredentials
Definition XrdSecInterface.hh:69
XrdSecPMask_t
int XrdSecPMask_t
Definition XrdSecPManager.hh:42
XrdOucErrInfo::setErrInfo
int setErrInfo(int code, const char *emsg)
Definition XrdOucErrInfo.hh:147
XrdSecProtBind::ValidProts
XrdSecPMask_t ValidProts
Definition XrdSecServer.cc:105

References XrdSecBuffer::buffer, XrdSecProtBind::Find(), XrdOucErrInfo::setErrInfo(), XrdSecBuffer::size, and XrdSecProtBind::ValidProts.

Here is the call graph for this function:

## PostProcess()

bool XrdSecServer::PostProcess | ( | XrdSecEntity & | entity,
|  | XrdOucErrInfo & | einfo )

virtual

Post process a fully authenticated XrdSecEntity object.

Parameters

  entity | The fully authenticated entity object.
  einfo | The structure to record any error messages. These are normally sent to the client. If einfo is a null pointer, the messages should be sent to standard error via an XrdSysError object using the supplied XrdSysLogger when the the plugin was initialized.

Returns
  Success: True should be returned. Failure: False should be returned and the einfo object should hold the reason. In this case the authentication fails.

Reimplemented from XrdSecService.

Definition at line 407 of file XrdSecServer.cc.

{
// Return correct result. Make sure there is some kind of message returned.
//
if (secEntityPin && !secEntityPin->Process(entity, einfo))
{if (*einfo.getErrText() == '\0')
einfo.setErrInfo(EAUTH, "rejected by auth post processing");
return false;
}
return true;
}
EAUTH
#define EAUTH
Definition XProtocol.hh:1351
XrdOucErrInfo::getErrText
const char * getErrText()
Definition XrdOucErrInfo.hh:262

References EAUTH, XrdOucErrInfo::getErrText(), and XrdOucErrInfo::setErrInfo().

Here is the call graph for this function:

## protTLS()

const char * XrdSecServer::protTLS | ( |  | ) |

inline virtual

Get a list of authentication protocols that require TLS.

Returns
  Pointer to a list of protocols that require TLS or a nil if none.

Implements XrdSecService.

Definition at line 64 of file XrdSecServer.hh.

{return PManager.protTLS();}

The documentation for this class was generated from the following files:

- XrdSecServer.hh
- XrdSecServer.cc