Loading...
Searching...
No Matches
XrdSecProtocolsss Class Reference

`#include <XrdSecProtocolsss.hh>`

Inheritance diagram for XrdSecProtocolsss:
Collaboration diagram for XrdSecProtocolsss:

## Classes

struct | Crypto

## Public Member Functions

| XrdSecProtocolsss (const char *hname, XrdNetAddrInfo &endPoint)
int | Authenticate (XrdSecCredentials *cred, XrdSecParameters **parms, XrdOucErrInfo *einfo=0)
void | Delete ()
| Delete the protocol object. DO NOT use C++ delete() on this object.
XrdSecCredentials * | getCredentials (XrdSecParameters *parms=0, XrdOucErrInfo *einfo=0)
int | Init_Client (XrdOucErrInfo *erp, const char *Parms)
int | Init_Server (XrdOucErrInfo *erp, const char *Parms)
Public Member Functions inherited from XrdSecProtocol
| XrdSecProtocol (const char *pName)
| Constructor.
virtual int | Decrypt (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int | Encrypt (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int | getKey (char *buff=0, int size=0)
virtual bool | needTLS ()
| Check if this protocol requires TLS to properly function.
virtual int | setKey (char *buff, int size)
virtual int | Sign (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int | Verify (const char *inbuff, int inlen, const char *sigbuff, int siglen)

## Static Public Member Functions

static int | eMsg (const char *epn, int rc, const char *txt1, const char *txt2=0, const char *txt3=0, const char *txt4=0)
static int | Fatal (XrdOucErrInfo *erP, const char *epn, int rc, const char *etxt)
static char * | Load_Client (XrdOucErrInfo *erp, const char *Parms)
static char * | Load_Server (XrdOucErrInfo *erp, const char *Parms)

## Friends

class | XrdSecProtocolDummy

## Additional Inherited Members

Public Attributes inherited from XrdSecProtocol
XrdSecEntity | Entity
Protected Member Functions inherited from XrdSecProtocol
virtual | ~XrdSecProtocol ()
| Destructor (prevents use of direct delete).

## Detailed Description

Definition at line 44 of file XrdSecProtocolsss.hh.

## Class Documentation

## XrdSecProtocolsss::Crypto

struct XrdSecProtocolsss::Crypto

Definition at line 80 of file XrdSecProtocolsss.hh.

Collaboration diagram for XrdSecProtocolsss::Crypto:

Class Members
const char * | cName |
char | cType |

## Constructor & Destructor Documentation

## XrdSecProtocolsss()

XrdSecProtocolsss::XrdSecProtocolsss | ( | const char * | hname,
|  | XrdNetAddrInfo & | endPoint )

inline

Definition at line 74 of file XrdSecProtocolsss.hh.

: XrdSecProtocol("sss"),
keyTab(0), Crypto(0), idBuff(0), dataOpts(0),
Sequence(0), v2EndPnt(false)
{urName = strdup(hname); setIP(endPoint);}
XrdSecProtocol::XrdSecProtocol
XrdSecProtocol(const char *pName)
Constructor.
Definition XrdSecInterface.hh:317
XrdSecProtocolsss::Crypto
Definition XrdSecProtocolsss.hh:80

References XrdSecProtocol::XrdSecProtocol().

Here is the call graph for this function:

## Member Function Documentation

## Authenticate()

int XrdSecProtocolsss::Authenticate | ( | XrdSecCredentials * | cred,
|  | XrdSecParameters ** | parms,
|  | XrdOucErrInfo * | einfo = 0 )

virtual

Authenticate a client.

Parameters

  cred | Credentials supplied by the client.
  parms | Place where the address of additional authentication data is to be placed for another autrhentication handshake.
  einfo | The error information object where error messages should be placed. The messages are returned to the client. Should einfo be null, messages should be written to stderr.

Returns
  > 0 -> parms present (more authentication needed) = 0 -> Entity present (authentication succeeded) < 0 -> einfo present (error has occurred)

Implements XrdSecProtocol.

Definition at line 162 of file XrdSecProtocolsss.cc.

{
static const int minLen = sizeof(XrdSecsssRR_Hdr) + XrdSecsssRR_Data_HdrLen;
static const int maxLen = XrdSecsssRR_Data::MaxDSz + minLen;
static const int Special= XrdSecsssKT::ktEnt::anyUSR
| XrdSecsssKT::ktEnt::allUSR;
XrdSecsssRR_Hdr *rrHdr = (XrdSecsssRR_Hdr *)(cred->buffer);
XrdSecsssRR_Data *rrData;
XrdSecsssKT::ktEnt decKey;
Persona myID(&decKey);
char *idP = 0, *dP = 0, *eodP = 0, *theIP = 0, *theHost = 0, *atKey = 0, eType = '\0';
int idNum = 0, idTLen, idSz, dLen;
bool badAttr = false;
// Make sure we have atleast the header plus the data header
//
if (cred->size < minLen)
return Fatal(einfo, "Auth", EINVAL, "Credentials too small.");
// Make sure the credentials are not too big (people misuse sss)
//
if (cred->size > maxLen)
return Fatal(einfo, "Auth", EINVAL, "Credentials too big.");
// Allocate the buffer from the stack
//
rrData = (XrdSecsssRR_Data *)alloca(cred->size);
// Decode the credentials
//
if ((dLen = Decode(einfo, decKey, cred->buffer, rrData, cred->size)) <= 0)
return -1;
// Check if we should echo back the LID
//
if (rrData->Options == XrdSecsssRR_DataHdr::SndLID)
{XrdSecsssRR_DataResp rrResp;
char lidBuff[16];
rrResp.Options = 0;
getLID(lidBuff, sizeof(lidBuff));
dP = rrResp.Data;
*dP++ = XrdSecsssRR_Data::theLgid;
XrdOucPup::Pack(&dP, lidBuff);
int n = dP-rrResp.Data + XrdSecsssRR_Data_HdrLen;
*parms = Encode(einfo, decKey, rrHdr, &rrResp, n);
return (*parms ? 1 : -1);
}
// Extract out the entity information
//
dP = rrData->Data; eodP = dP + dLen - XrdSecsssRR_Data_HdrLen;
CLDBG("Processing " <<dLen <<" byes");
while(dP < eodP)
{eType = *dP++;
CLDBG("eType=" <<static_cast<int>(eType)
<<" Used " <<dP-rrData->Data <<" left " <<eodP-dP);
if (!XrdOucPup::Unpack(&dP, eodP, &idP, idSz) || (idP && *idP == '\0'))
{Fatal(einfo, "Authenticate", EINVAL, "Invalid id string.");
return -1;
}
idNum++;
switch(eType)
{case XrdSecsssRR_Data::theName: myID.name = idP; break;
case XrdSecsssRR_Data::theVorg: myID.vorg = idP; break;
case XrdSecsssRR_Data::theRole: myID.role = idP; break;
case XrdSecsssRR_Data::theGrps: myID.grps = idP; break;
case XrdSecsssRR_Data::theEndo: myID.endo = idP; break;
case XrdSecsssRR_Data::theCred: myID.creds = idP;
myID.credslen = idSz;break;
case XrdSecsssRR_Data::theHost:
if (idP && *idP == '[')
myID.host = theIP = idP;
else theHost = idP;
break;
case XrdSecsssRR_Data::theRand: idNum--; break;
case XrdSecsssRR_Data::theAuth: myID.xAuth = idP; break;
case XrdSecsssRR_Data::theTID: myID.pident = idP; break;
case XrdSecsssRR_Data::theAKey: if (atKey) badAttr = true;
atKey = idP; break;
case XrdSecsssRR_Data::theAVal:
if (!atKey) badAttr = true;
else {Entity.eaAPI->Add(std::string(atKey),
std::string(idP), true);
atKey = 0;
}
break;
case XrdSecsssRR_Data::theUser: myID.xUser = idP; break;
case XrdSecsssRR_Data::theGrup: myID.xGrup = idP; break;
case XrdSecsssRR_Data::theCaps: myID.caps = idP; break;
default: break;
}
}
// Verify that we have some kind of identification
//
if (!idNum)
{Fatal(einfo, "Authenticate", ENOENT, "No identification specified.");
return -1;
}
// Make sure we didn't encounter any attribute errors
//
if (badAttr)
{Fatal(einfo, "Authenticate", EINVAL, "Invalid attribute specification.");
return -1;
}
// Verify the source of the information to largely prevent packet stealing. New
// version of the protocol will send an IP address which we prefrentially use.
// Older version used a hostname. This causes problems for multi-homed machines.
//
if (!(decKey.Data.Opts & XrdSecsssKT::ktEnt::noIPCK))
{if (!theHost && !theIP)
{Fatal(einfo,"Authenticate",ENOENT,"No hostname or IP address specified.");
return -1;
}
CLDBG(urName <<' ' <<urIP <<" or " <<urIQ << " must match "
<<(theHost ? theHost : "?") <<' ' <<(theIP ? theIP : "[?]"));
if (theIP)
{if (strcmp(theIP, urIP) && strcmp(theIP, urIQ))
{Fatal(einfo, "Authenticate", EINVAL, "IP address mismatch.");
return -1;
}
} else if (strcmp(theHost, urName))
{Fatal(einfo, "Authenticate", EINVAL, "Hostname mismatch.");
return -1;
}
} else {
CLDBG(urName <<' ' <<urIP <<" or " <<urIQ << " forwarded token from "
<<(theHost ? theHost : "?") <<' ' <<(theIP ? theIP : "[?]"));
}
// At this point we need to check if this identity can be passed as a clone
//
if (aProts && myID.Clonable(aProts))
{strlcpy(Entity.prot, myID.xAuth, sizeof(Entity.prot));
Entity.prot[XrdSecPROTOIDSIZE-1] = 0;
if (myID.xUser) XrdOucUtils::getUID(myID.xUser,Entity.uid,&Entity.gid);
if (myID.xGrup) XrdOucUtils::getGID(myID.xGrup,Entity.gid);
} else {
// Set correct username
//
if (decKey.Data.Opts & Special)
{if (!myID.name) myID.name = (char *)"nobody";}
else myID.name = decKey.Data.User;
// Set correct group
//
if (decKey.Data.Opts & XrdSecsssKT::ktEnt::usrGRP) myID.grps = 0;
else {if (decKey.Data.Opts & XrdSecsssKT::ktEnt::anyGRP)
{if (!myID.grps) myID.grps = (char *)"nogroup";}
else myID.grps = decKey.Data.Grup;
}
// Set corresponding uid and gid
//
if (myID.name) XrdOucUtils::getUID(myID.name, Entity.uid, &Entity.gid);
if (myID.grps) XrdOucUtils::getGID(myID.grps, Entity.gid);
}
// Calculate the amount of space we will need
//
idTLen = strlen(urName)
+ (myID.name ? strlen(myID.name)+1 : 0)
+ (myID.vorg ? strlen(myID.vorg)+1 : 0)
+ (myID.role ? strlen(myID.role)+1 : 0)
+ (myID.grps ? strlen(myID.grps)+1 : 0)
+ (myID.caps ? strlen(myID.caps)+1 : 0)
+ (myID.endo ? strlen(myID.endo)+1 : 0)
+ (myID.creds ? myID.credslen : 0)
+ (myID.pident ? strlen(myID.pident)+1 : 0);
// Complete constructing our identification
//
if (idBuff) free(idBuff);
idBuff = idP = (char *)malloc(idTLen);
Entity.host = urName;
Entity.name = setID(myID.name, &idP);
Entity.vorg = setID(myID.vorg, &idP);
Entity.role = setID(myID.role, &idP);
Entity.grps = setID(myID.grps, &idP);
Entity.caps = setID(myID.caps, &idP);
Entity.endorsements = setID(myID.endo, &idP);
if (myID.pident)
{strcpy(idP, myID.pident);
Entity.pident = idP;
idP += strlen(myID.pident) + 1;
}
if (myID.creds)
{memcpy(idP, myID.creds, myID.credslen);
Entity.creds = idP;
Entity.credslen = myID.credslen;
}
// All done
//
return 0;
}
XrdSecPROTOIDSIZE
#define XrdSecPROTOIDSIZE
Definition XrdSecEntity.hh:47
CLDBG
#define CLDBG(x)
Definition XrdSecProtocolkrb5.cc:82
XrdSecsssRR_Data_HdrLen
static const int XrdSecsssRR_Data_HdrLen
Definition XrdSecsssRR.hh:77
strlcpy
size_t strlcpy(char *dst, const char *src, size_t sz)
Definition XrdSysPlatform.cc:60
XrdOucPup::Unpack
static int Unpack(char **buff, const char *bend, char **data, int &dlen)
Definition XrdOucPup.cc:250
XrdOucPup::Pack
static int Pack(struct iovec **, const char *, unsigned short &buff)
Definition XrdOucPup.cc:52
XrdOucUtils::getGID
static bool getGID(const char *gName, gid_t &gID)
Definition XrdOucUtils.cc:559
XrdOucUtils::getUID
static bool getUID(const char *uName, uid_t &uID, gid_t *gID=0)
Definition XrdOucUtils.cc:575
XrdSecProtocol::Entity
XrdSecEntity Entity
Definition XrdSecInterface.hh:139
XrdSecProtocolsss::Fatal
static int Fatal(XrdOucErrInfo *erP, const char *epn, int rc, const char *etxt)
Definition XrdSecProtocolsss.cc:531
XrdSecsssKT::ktEnt::ktData::User
char User[UserSZ]
Definition XrdSecsssKT.hh:62
XrdSecsssKT::ktEnt::anyUSR
static const int anyUSR
Definition XrdSecsssKT.hh:67
XrdSecsssKT::ktEnt::Data
struct XrdSecsssKT::ktEnt::ktData Data
XrdSecsssKT::ktEnt::noIPCK
static const int noIPCK
Definition XrdSecsssKT.hh:70
XrdSecsssKT::ktEnt::ktData::Opts
int Opts
Definition XrdSecsssKT.hh:58
XrdSecsssKT::ktEnt::anyGRP
static const int anyGRP
Definition XrdSecsssKT.hh:68
XrdSecsssKT::ktEnt::allUSR
static const int allUSR
Definition XrdSecsssKT.hh:66
XrdSecsssKT::ktEnt::usrGRP
static const int usrGRP
Definition XrdSecsssKT.hh:69
XrdSecsssKT::ktEnt::ktData::Grup
char Grup[GrupSZ]
Definition XrdSecsssKT.hh:63
XrdSecBuffer::buffer
char * buffer
Pointer to the buffer.
Definition XrdSecInterface.hh:53
XrdSecBuffer::size
int size
Size of the buffer or length of data in the buffer.
Definition XrdSecInterface.hh:52
XrdSecsssRR_DataHdr::Options
char Options
Definition XrdSecsssRR.hh:70
XrdSecsssRR_DataHdr::SndLID
static const char SndLID
Definition XrdSecsssRR.hh:72
XrdSecsssRR_DataResp::Data
char Data[XrdSecsssRR_Data::MinDSz+16]
Definition XrdSecsssRR.hh:113
XrdSecsssRR_Data::theHost
static const char theHost
Definition XrdSecsssRR.hh:106
XrdSecsssRR_Data::theUser
static const char theUser
Definition XrdSecsssRR.hh:101
XrdSecsssRR_Data::theAKey
static const char theAKey
Definition XrdSecsssRR.hh:99
XrdSecsssRR_Data::theCaps
static const char theCaps
Definition XrdSecsssRR.hh:103
XrdSecsssRR_Data::Data
char Data[DataSz]
Definition XrdSecsssRR.hh:85
XrdSecsssRR_Data::theAuth
static const char theAuth
Definition XrdSecsssRR.hh:97
XrdSecsssRR_Data::theRole
static const char theRole
Definition XrdSecsssRR.hh:91
XrdSecsssRR_Data::theName
static const char theName
Definition XrdSecsssRR.hh:89
XrdSecsssRR_Data::theLgid
static const char theLgid
Definition XrdSecsssRR.hh:105
XrdSecsssRR_Data::theGrps
static const char theGrps
Definition XrdSecsssRR.hh:92
XrdSecsssRR_Data::theRand
static const char theRand
Definition XrdSecsssRR.hh:95
XrdSecsssRR_Data::theEndo
static const char theEndo
Definition XrdSecsssRR.hh:93
XrdSecsssRR_Data::theAVal
static const char theAVal
Definition XrdSecsssRR.hh:100
XrdSecsssRR_Data::theVorg
static const char theVorg
Definition XrdSecsssRR.hh:90
XrdSecsssRR_Data::theGrup
static const char theGrup
Definition XrdSecsssRR.hh:102
XrdSecsssRR_Data::theTID
static const char theTID
Definition XrdSecsssRR.hh:98
XrdSecsssRR_Data::MaxDSz
static const int MaxDSz
Definition XrdSecsssRR.hh:82
XrdSecsssRR_Data::theCred
static const char theCred
Definition XrdSecsssRR.hh:94

References XrdSecsssKT::ktEnt::allUSR, XrdSecsssKT::ktEnt::anyGRP, XrdSecsssKT::ktEnt::anyUSR, XrdSecBuffer::buffer, CLDBG, XrdSecsssKT::ktEnt::Data, XrdSecsssRR_Data::Data, XrdSecsssRR_DataResp::Data, XrdSecProtocol::Entity, Fatal(), XrdOucUtils::getGID(), XrdOucUtils::getUID(), XrdSecsssKT::ktEnt::ktData::Grup, XrdSecsssRR_Data::MaxDSz, XrdSecsssKT::ktEnt::noIPCK, XrdSecsssRR_DataHdr::Options, XrdSecsssKT::ktEnt::ktData::Opts, XrdOucPup::Pack(), XrdSecBuffer::size, XrdSecsssRR_DataHdr::SndLID, strlcpy(), XrdSecsssRR_Data::theAKey, XrdSecsssRR_Data::theAuth, XrdSecsssRR_Data::theAVal, XrdSecsssRR_Data::theCaps, XrdSecsssRR_Data::theCred, XrdSecsssRR_Data::theEndo, XrdSecsssRR_Data::theGrps, XrdSecsssRR_Data::theGrup, XrdSecsssRR_Data::theHost, XrdSecsssRR_Data::theLgid, XrdSecsssRR_Data::theName, XrdSecsssRR_Data::theRand, XrdSecsssRR_Data::theRole, XrdSecsssRR_Data::theTID, XrdSecsssRR_Data::theUser, XrdSecsssRR_Data::theVorg, XrdOucPup::Unpack(), XrdSecsssKT::ktEnt::ktData::User, XrdSecsssKT::ktEnt::usrGRP, XrdSecPROTOIDSIZE, and XrdSecsssRR_Data_HdrLen.

Here is the call graph for this function:

## Delete()

void XrdSecProtocolsss::Delete | ( |  | ) |

virtual

Delete the protocol object. DO NOT use C++ delete() on this object.

Implements XrdSecProtocol.

Definition at line 444 of file XrdSecProtocolsss.cc.

{
// Delete things that get re-allocated every time. The staticID is allocated
// only once so it must stick around for every instance of this object.
//
if (urName) free(urName); // Same pointer as Entity.host
if (idBuff) free(idBuff);
if (Crypto && Crypto != CryptObj) delete Crypto;
if (keyTab && keyTab != ktObject) delete keyTab;
delete this;
}

Referenced by XrdSecProtocolsssObject().

Here is the caller graph for this function:

## eMsg()

int XrdSecProtocolsss::eMsg | ( | const char * | epn,
|  | int | rc,
|  | const char * | txt1,
|  | const char * | txt2 = 0,
|  | const char * | txt3 = 0,
|  | const char * | txt4 = 0 )

static

Definition at line 461 of file XrdSecProtocolsss.cc.

{
std::cerr <<"Secsss (" << epname <<"): ";
std::cerr <<txt1;
if (rc>0) std::cerr <<"; " <<XrdSysE2T(rc);
if (txt2) std::cerr <<txt2;
if (txt3) std::cerr <<txt3;
if (txt4) {std::cerr <<txt4;}
std::cerr <<"\n" <<std::flush;
return (rc ? (rc < 0 ? rc : -rc) : -1);
}
XrdSysE2T
const char * XrdSysE2T(int errcode)
Definition XrdSysE2T.cc:104

References XrdSysE2T().

Here is the call graph for this function:

## Fatal()

int XrdSecProtocolsss::Fatal | ( | XrdOucErrInfo * | erP,
|  | const char * | epn,
|  | int | rc,
|  | const char * | etxt )

static

Definition at line 531 of file XrdSecProtocolsss.cc.

{
if (erP) {erP->setErrInfo(rc, etxt);
CLDBG(epn <<": " <<etxt);
}
else eMsg(epn, rc, etxt);
return 0;
}
eMsg
#define eMsg(x)
Definition XrdSecsssAdmin.cc:53
XrdOucErrInfo::setErrInfo
int setErrInfo(int code, const char *emsg)
Definition XrdOucErrInfo.hh:147

References CLDBG, eMsg, and XrdOucErrInfo::setErrInfo().

Referenced by Authenticate(), getCredentials(), Init_Client(), Load_Client(), Load_Server(), and XrdSecProtocolsssObject().

Here is the call graph for this function:
Here is the caller graph for this function:

## getCredentials()

XrdSecCredentials * XrdSecProtocolsss::getCredentials | ( | XrdSecParameters * | parm = 0,
|  | XrdOucErrInfo * | einfo = 0 )

virtual

Generate client credentials to be used in the authentication process.

Parameters

  parm | Pointer to the information returned by the server either in the initial login response or the authmore response.
  einfo | The error information object where error messages should be placed. The messages are returned to the client. Should einfo be null, messages should be written to stderr.

Returns
  Success: Pointer to credentials to sent to the server. The caller is responsible for deleting the object. Failure: Null pointer with einfo, if supplied, containing the reason for the failure.

Implements XrdSecProtocol.

Definition at line 644 of file XrdSecProtocolsss.cc.

{
static const int nOpts = XrdNetUtils::oldFmt;
XrdSecsssRR_Hdr2 rrHdr;
sssRR_DataHdr rrDataHdr;
XrdSecsssKT::ktEnt encKey;
XrdOucEnv *errEnv;
const char *myIP = 0, *myUD = 0;
char ipBuff[64];
int dLen;
// Make sure we can extract out required information and get it as needed
//
if (einfo && (errEnv=einfo->getEnv()))
{if (isMapped) myUD = errEnv->Get("username");
if (!(myIP=errEnv->Get("sockname")))
{int fd = epAddr->SockFD();
if (fd > 0 && XrdNetUtils::IPFormat(-fd,ipBuff,sizeof(ipBuff),nOpts))
myIP = ipBuff;
else myIP = 0;
}
}
// Do some debugging here
//
CLDBG("getCreds: " <<static_cast<int>(Sequence)
<< " ud: '" <<(myUD ? myUD : "")
<<"' ip: '" <<(myIP ? myIP : "") <<"'");
// Get the actual data portion
//
if (Sequence) dLen = getCred(einfo, rrDataHdr.P, myUD, myIP, parms);
else dLen = getCred(einfo, rrDataHdr.P, myUD, myIP);
if (!dLen) return (XrdSecCredentials *)0;
// Get an encryption key
//
if (keyTab->getKey(encKey))
{Fatal(einfo, "getCredentials", ENOENT, "Encryption key not found.");
return (XrdSecCredentials *)0;
}
// Fill out the header
//
strcpy(rrHdr.ProtID, XrdsssPROTOIDENT);
memset(rrHdr.Pad, 0, sizeof(rrHdr.Pad));
rrHdr.KeyID = htonll(encKey.Data.ID);
rrHdr.EncType = Crypto->Type();
// Determine if we should send the keyname (v2 servers only)
//
if (v2EndPnt)
{int k = strlen(encKey.Data.Name), n = (k + 8) & ~7;
if (strlcpy(rrHdr.keyName, encKey.Data.Name, sizeof(rrHdr.keyName)) >= sizeof(rrHdr.keyName))
{ Fatal(einfo, "getCredentials", EINVAL, "Encryption key name is too long.");
return nullptr;
}
if (n - k > 1) memset(rrHdr.keyName + k, 0, n - k);
rrHdr.knSize = static_cast<uint8_t>(n);
} else rrHdr.knSize = 0;
// Now simply encode the data and return the result
//
return Encode(einfo, encKey, &rrHdr, rrDataHdr.P, dLen);
}
XrdSecCredentials
XrdSecBuffer XrdSecCredentials
Definition XrdSecInterface.hh:69
XrdsssPROTOIDENT
#define XrdsssPROTOIDENT
Definition XrdSecProtocolsss.cc:63
XrdNetUtils::IPFormat
static int IPFormat(const struct sockaddr *sAddr, char *bP, int bL, int opts=0)
Definition XrdNetUtils.cc:619
XrdNetUtils::oldFmt
static const int oldFmt
Definition XrdNetUtils.hh:274
XrdOucEnv::Get
char * Get(const char *varname)
Definition XrdOucEnv.hh:69
XrdOucErrInfo::getEnv
XrdOucEnv * getEnv()
Definition XrdOucErrInfo.hh:307
XrdSecsssKT::ktEnt::ktData::Name
char Name[NameSZ]
Definition XrdSecsssKT.hh:61
XrdSecsssKT::ktEnt::ktData::ID
long long ID
Definition XrdSecsssKT.hh:54
XrdSecsssRR_Hdr2::keyName
char keyName[XrdSecsssKT::ktEnt::NameSZ]
Definition XrdSecsssRR.hh:59
XrdSecsssRR_Hdr::KeyID
long long KeyID
Definition XrdSecsssRR.hh:49
XrdSecsssRR_Hdr::knSize
uint8_t knSize
Definition XrdSecsssRR.hh:45
XrdSecsssRR_Hdr::EncType
char EncType
Definition XrdSecsssRR.hh:46
XrdSecsssRR_Hdr::ProtID
char ProtID[4]
Definition XrdSecsssRR.hh:43
XrdSecsssRR_Hdr::Pad
char Pad[2]
Definition XrdSecsssRR.hh:44

References CLDBG, XrdSecsssKT::ktEnt::Data, XrdSecsssRR_Hdr::EncType, Fatal(), XrdOucEnv::Get(), XrdOucErrInfo::getEnv(), XrdSecsssKT::ktEnt::ktData::ID, XrdNetUtils::IPFormat(), XrdSecsssRR_Hdr::KeyID, XrdSecsssRR_Hdr2::keyName, XrdSecsssRR_Hdr::knSize, XrdSecsssKT::ktEnt::ktData::Name, XrdNetUtils::oldFmt, XrdSecsssRR_Hdr::Pad, XrdSecsssRR_Hdr::ProtID, strlcpy(), and XrdsssPROTOIDENT.

Here is the call graph for this function:

## Init_Client()

int XrdSecProtocolsss::Init_Client | ( | XrdOucErrInfo * | erp,
|  | const char * | Parms )

Definition at line 740 of file XrdSecProtocolsss.cc.

{
XrdSysMutexHelper initMon(&initMutex);
XrdSecsssKT *ktP;
struct stat buf;
char *Colon;
int lifeTime;
// We must have <enccode>.[+]<lifetime>:<keytab>
//
if (!pP || !*pP) return Fatal(erp, "Init_Client", EINVAL,
"Client parameters missing.");
// Get encryption object
//
if (!*pP || *(pP+1) != '.') return Fatal(erp, "Init_Client", EINVAL,
"Encryption type missing.");
if (!(Crypto = Load_Crypto(erp, *pP))) return 0;
pP += 2;
// Check if this is a v2 server and if credentials are to be sent
//
if (*pP == '+')
{v2EndPnt = true;
dataOpts |= XrdSecsssEnt::addExtra;
if (*(pP+1) == '0') dataOpts |= XrdSecsssEnt::addCreds;
}
// The next item is the cred lifetime
//
lifeTime = strtol(pP, &Colon, 10);
if (!lifeTime || *Colon != ':') return Fatal(erp, "Init_Client", EINVAL,
"Credential lifetime missing.");
deltaTime = lifeTime; pP = Colon+1;
// Get the correct keytab
//
if (ktFixed || (ktObject && ktObject->Same(pP))) keyTab = ktObject;
else if (*pP == '/' && !stat(pP, &buf))
{if (!(ktP=new XrdSecsssKT(erp,pP,XrdSecsssKT::isClient,3600)))
return Fatal(erp, "Init_Client", ENOMEM,
"Unable to create keytab object.");
if (erp->getErrInfo()) {delete ktP; return 0;}
if (!ktObject) ktObject = ktP;
keyTab = ktP;
CLDBG("Client keytab='" <<pP <<"'");
} else keyTab = ktObject;
if (!keyTab)
return Fatal(erp, "Init_Client", ENOENT,
"Unable to determine keytab location.");
// All done
//
return 1;
}
stat
#define stat(a, b)
Definition XrdPosix.hh:101
XrdOucErrInfo::getErrInfo
int getErrInfo()
Definition XrdOucErrInfo.hh:243
XrdSecsssEnt::addExtra
static const int addExtra
Add v2 data.
Definition XrdSecsssEnt.hh:77
XrdSecsssEnt::addCreds
static const int addCreds
Add v2 data plus creds.
Definition XrdSecsssEnt.hh:78
XrdSecsssKT::isClient
@ isClient
Definition XrdSecsssKT.hh:114

References XrdSecsssEnt::addCreds, XrdSecsssEnt::addExtra, CLDBG, Fatal(), XrdOucErrInfo::getErrInfo(), XrdSecsssKT::isClient, and stat.

Referenced by XrdSecProtocolsssObject().

Here is the call graph for this function:
Here is the caller graph for this function:

## Init_Server()

int XrdSecProtocolsss::Init_Server | ( | XrdOucErrInfo * | erp,
|  | const char * | Parms )

Definition at line 801 of file XrdSecProtocolsss.cc.

{
// This is a trivial init
//
keyTab = ktObject;
Crypto = CryptObj;
return 1;
}

Referenced by XrdSecProtocolsssObject().

Here is the caller graph for this function:

## Load_Client()

char * XrdSecProtocolsss::Load_Client | ( | XrdOucErrInfo * | erp,
|  | const char * | Parms )

static

Definition at line 815 of file XrdSecProtocolsss.cc.

{
static const char *KTPath = XrdSecsssKT::genFN();
static const int rfrHR = 60*60;
struct stat buf;
XrdSecsssID::authType aType = XrdSecsssID::idStatic;
const char *kP = 0;
char *myName;
// Get our full host name
//
if (!(myName = XrdNetUtils::MyHostName(0)))
{Fatal(erp, "Load_Client", ENOENT, "Unable to obtain local hostname.");
return (char *)0;
}
// Tell the entity serialization object who we are
//
XrdSecsssEnt::setHostName(myName);
free(myName);
// Check for the presence of a registry object
//
idMap = XrdSecsssID::getObj(aType, staticID);
switch(aType)
{case XrdSecsssID::idDynamic: isMutual = true; break;
case XrdSecsssID::idStaticM: isMutual = true;
idMap = 0; break;
case XrdSecsssID::idStatic: idMap = 0; break;
case XrdSecsssID::idMapped: isMapped = true; break;
case XrdSecsssID::idMappedM: isMapped = true; break;
default: idMap = 0; break;
}
// We want to establish the default location of the keytable. First check
// the environment passed from the client then the envar. We support two
// version of the envar for backward compatibility due to an early mistake.
//
if( erp && erp->getEnv() && ( kP = erp->getEnv()->Get( "xrd.sss" ) ) )
ktFixed = true;
else if ( ( (kP = getenv("XrdSecSSSKT")) || (kP = getenv("XrdSecsssKT")) )
&& *kP && !stat(kP, &buf))
ktFixed = true;
else kP = 0;
if (!kP && !stat(KTPath, &buf)) kP = KTPath;
// Build the keytable if we actual have a path (if none, then the server
// will have to supply the path)
//
if (kP)
{if (!(ktObject=new XrdSecsssKT(erp,kP,XrdSecsssKT::isClient,rfrHR)))
{Fatal(erp, "Load_Client", ENOMEM, "Unable to create keytab object.");
return (char *)0;
}
if (erp && erp->getErrInfo())
{delete ktObject, ktObject = 0; return (char *)0;}
CLDBG("Client keytab='" <<kP <<"'");
}
// All done
//
return (char *)"";
}
XrdNetUtils::MyHostName
static char * MyHostName(const char *eName="*unknown*", const char **eText=0)
Definition XrdNetUtils.cc:702
XrdSecsssEnt::setHostName
static void setHostName(const char *hnP)
Definition XrdSecsssEnt.cc:313
XrdSecsssID::authType
authType
Definition XrdSecsssID.hh:80
XrdSecsssID::idStatic
@ idStatic
Definition XrdSecsssID.hh:86
XrdSecsssID::idMappedM
@ idMappedM
Definition XrdSecsssID.hh:84
XrdSecsssID::idDynamic
@ idDynamic
Definition XrdSecsssID.hh:80
XrdSecsssID::idStaticM
@ idStaticM
Definition XrdSecsssID.hh:89
XrdSecsssID::idMapped
@ idMapped
Definition XrdSecsssID.hh:82
XrdSecsssKT::genFN
static char * genFN()
Definition XrdSecsssKT.cc:249

References CLDBG, Fatal(), XrdSecsssKT::genFN(), XrdOucEnv::Get(), XrdOucErrInfo::getEnv(), XrdOucErrInfo::getErrInfo(), XrdSecsssID::idDynamic, XrdSecsssID::idMapped, XrdSecsssID::idMappedM, XrdSecsssID::idStatic, XrdSecsssID::idStaticM, XrdSecsssKT::isClient, XrdNetUtils::MyHostName(), XrdSecsssEnt::setHostName(), and stat.

Referenced by XrdSecProtocolsssInit().

Here is the call graph for this function:
Here is the caller graph for this function:

## Load_Server()

char * XrdSecProtocolsss::Load_Server | ( | XrdOucErrInfo * | erp,
|  | const char * | Parms )

static

Definition at line 948 of file XrdSecProtocolsss.cc.

{
const char *msg = 0;
const char *encName = "bf32", *ktClient = "", *ktServer = 0;
char buff[2048], parmbuff[2048], *op, *od, *eP;
int lifeTime = 13, rfrTime = 60*60;
XrdOucTokenizer inParms(parmbuff);
const char *ask4Creds = "";
// Duplicate the parms
//
if (parms) strlcpy(parmbuff, parms, sizeof(parmbuff));
// Expected parameters: [{-c | --clientkt} <ckt_path>]
// [{-e | --encrypt} <enctype>]
// [{-g | --getcreds}]
// [{-k | --keyname}]
// [{-l | --lifetime} <seconds>]
// [{-p | --proxy} <prots>]
// [{-r | --refresh} <minutes>]
// [{-s | --serverkt} <skt_path>]
//
if (parms && inParms.GetLine())
while((op = inParms.GetToken()))
{if (!strcmp("-k", op) || !strcmp("--keyname", op))
{sssUseKN = true;
continue;
}
if (!strcmp("-g", op) || !strcmp("--getcreds", op))
{ask4Creds = "0";
continue;
}
if (!(od = inParms.GetToken()))
{sprintf(buff,"Secsss: Missing %s parameter argument",op);
msg = buff; break;
}
if (!strcmp("-c", op) || !strcmp("--clientkt", op))
ktClient = od;
else if (!strcmp("-e", op) || !strcmp("--encrypt", op))
encName = od;
else if (!strcmp("-l", op) || !strcmp("--lifetime", op))
{lifeTime = strtol(od, &eP, 10) * 60;
if (errno || *eP || lifeTime < 1)
{msg = "Secsss: Invalid life time"; break;}
}
else if (!strcmp("-p", op) || !strcmp("--proxy", op))
{int n = strlen(od) + 2;
aProts = (char *)malloc(n);
*aProts = ':';
strcpy(aProts+1, od);
}
else if (!strcmp("-r", op) || !strcmp("--rfresh", op))
{rfrTime = strtol(od, &eP, 10) * 60;
if (errno || *eP || rfrTime < 600)
{msg = "Secsss: Invalid refresh time"; break;}
}
else if (!strcmp("-s", op) || !strcmp("-serverkt", op))
ktServer = od;
else {sprintf(buff,"Secsss: Invalid parameter - %s",op);
msg = buff; break;
}
}
// Check for errors
//
if (msg) {Fatal(erp, "Load_Server", EINVAL, msg); return (char *)0;}
// Load the right crypto object
//
if (!(CryptObj = Load_Crypto(erp, encName))) return (char *)0;
// Supply default keytab location if not specified
//
if (!ktServer) ktServer = XrdSecsssKT::genFN();
// Set the delta time used to expire credentials
//
deltaTime = lifeTime;
// Create a keytab object (only one for the server)
//
if (!(ktObject = new XrdSecsssKT(erp, ktServer, XrdSecsssKT::isServer,
rfrTime)))
{Fatal(erp, "Load_Server", ENOMEM, "Unable to create keytab object.");
return (char *)0;
}
if (erp->getErrInfo()) return (char *)0;
ktFixed = true;
CLDBG("Server keytab='" <<ktServer <<"'");
// Construct client parameter <enccode>.+<lifetime>:<keytab>
// Note: The plus preceding the <lifetime> indicates that we are a V2 server.
// V1 clients will simply ignore this and treat us as a V1 server.
//
sprintf(buff, "%c.+%s%d:%s", CryptObj->Type(),ask4Creds,lifeTime,ktClient);
CLDBG("client parms='" <<buff <<"'");
return strdup(buff);
}
XrdSecsssKT::isServer
@ isServer
Definition XrdSecsssKT.hh:114

References CLDBG, Fatal(), XrdSecsssKT::genFN(), XrdOucErrInfo::getErrInfo(), XrdOucTokenizer::GetLine(), XrdOucTokenizer::GetToken(), XrdSecsssKT::isServer, and strlcpy().

Referenced by XrdSecProtocolsssInit().

Here is the call graph for this function:
Here is the caller graph for this function:

## Friends And Related Symbol Documentation

## XrdSecProtocolDummy

friend class XrdSecProtocolDummy

friend

Definition at line 47 of file XrdSecProtocolsss.hh.

References XrdSecProtocolDummy.

Referenced by XrdSecProtocolDummy.

The documentation for this class was generated from the following files:

- XrdSecProtocolsss.hh
- XrdSecProtocolsss.cc