XrdCmsSecurity Class Reference

#include <XrdCmsSecurity.hh>

Collaboration diagram for XrdCmsSecurity:

Public Member Functions
	XrdCmsSecurity ()
	~XrdCmsSecurity ()

Static Public Member Functions
static int	Authenticate (XrdLink *Link, const char *Token, int tlen)
static int	Configure (const char *Lib, const char *Cfn=0)
static const char *	getToken (int &size, XrdNetAddrInfo *endPoint)
static char *	getVnId (XrdSysError &eDest, const char *cfgFN, const char *nidlib, const char *nidparm, char nidType)
static int	Identify (XrdLink *Link, XrdCms::CmsRRHdr &inHdr, char *authBuff, int abLen)
static void	setSecFunc (void *secfP)
static char *	setSystemID (XrdOucTList *tp, const char *iVNID, const char *iTag, char iType)

Detailed Description

Definition at line 41 of file XrdCmsSecurity.hh.

Constructor & Destructor Documentation

XrdCmsSecurity()

XrdCmsSecurity::XrdCmsSecurity ( )

inline

Definition at line 63 of file XrdCmsSecurity.hh.

{}

~XrdCmsSecurity()

XrdCmsSecurity::~XrdCmsSecurity ( )

inline

Definition at line 64 of file XrdCmsSecurity.hh.

{}

Member Function Documentation

Authenticate()

int XrdCmsSecurity::Authenticate ( XrdLink *  Link, const char *  Token, int  tlen  )

static

Definition at line 77 of file XrdCmsSecurity.cc.

{
   CmsRRHdr myHdr = {0, kYR_xauth, 0, 0};
   XrdSecCredentials cred;
   XrdSecProtocol   *AuthProt = 0;
   XrdSecParameters *parm = 0;
   XrdOucErrInfo     eMsg;
   const char       *eText = 0;
   char *authName, authBuff[4096];
   int rc, myDlen, abLen = sizeof(authBuff);
 
// Send a request for authentication
//
   if ((eText = XrdCmsTalk::Request(Link, myHdr, (char *)Token, Toksz+1)))
      {Say.Emsg("Auth",Link->Host(),"authentication failed;",eText);
       return 0;
      }
 
// Perform standard authentication
//
do {
 
// Get the response header and verify the request code
//
   if ((eText = XrdCmsTalk::Attend(Link,myHdr,authBuff,abLen,myDlen))) break;
   if (myHdr.rrCode != kYR_xauth) {eText = "invalid auth response";    break;}
   cred.size = myDlen; cred.buffer = authBuff;
 
// If we do not yet have a protocol, get one
//
   if (!AuthProt)
      {if (!DHS || !(AuthProt=DHS->getProtocol(Link->Host(),
                                             *(Link->AddrInfo()),&cred,eMsg)))
          {eText = eMsg.getErrText(rc); break;}
      }
 
// Perform the authentication
//
    AuthProt->Entity.addrInfo = Link->AddrInfo();
    if (!(rc = AuthProt->Authenticate(&cred, &parm, &eMsg))
    &&  DHS->PostProcess(AuthProt->Entity, eMsg)) break;
    if (rc < 0) {eText = eMsg.getErrText(rc); break;}
    if (parm) 
       {eText = XrdCmsTalk::Request(Link, myHdr, parm->buffer, parm->size);
        delete parm;
        if (eText) break;
       } else {eText = "auth interface violation"; break;}
 
} while(1);
 
// Check if we succeeded
//
   if (!eText)
      {if (!(authName = AuthProt->Entity.name)) eText = "entity name missing";
          else {Link->setID(authName,0);
                Say.Emsg("Auth",Link->Host(),"authenticated as", authName);
               }
      }
 
// Check if we failed
//
   if (eText) Say.Emsg("Auth",Link->Host(),"authentication failed;",eText);
 
// Perform final steps here
//
   if (AuthProt) AuthProt->Delete();
   return (eText == 0);
}

References XrdLink::AddrInfo(), XrdSecEntity::addrInfo, XrdCmsTalk::Attend(), XrdSecProtocol::Authenticate(), XrdSecBuffer::buffer, XrdSecProtocol::Delete(), XrdSysError::Emsg(), eMsg, XrdSecProtocol::Entity, XrdLink::Host(), XrdCms::kYR_xauth, XrdSecEntity::name, XrdCmsTalk::Request(), XrdCms::CmsRRHdr::rrCode, XrdCms::Say, XrdLink::setID(), and XrdSecBuffer::size.

Referenced by XrdCmsLogin::Admit().

Here is the call graph for this function:

Here is the caller graph for this function:

Configure()

int XrdCmsSecurity::Configure ( const char *  Lib, const char *  Cfn = 0  )

static

Definition at line 187 of file XrdCmsSecurity.cc.

{
   static XrdSysMutex myMutex;
   XrdSysMutexHelper  hlpMtx(&myMutex);
 
// If we aleady have a security interface, return (may happen in client)
//
   if (!Cfn && getProtocol) return 1;
 
// Get the server object and protocol creator
//
   if (!(DHS = XrdSecLoadSecService(&Say, Cfn, (strcmp(Lib,"default") ? Lib:0),
                                    &getProtocol)))
      {Say.Emsg("Config","Unable to create security service object via",Lib);
       return 0;
      }
 
// All done
//
   return 1;
}

References XrdSysError::Emsg(), XrdCms::Say, and XrdSecLoadSecService().

Here is the call graph for this function:

getToken()

const char * XrdCmsSecurity::getToken ( int &  size, XrdNetAddrInfo *  endPoint  )

static

Definition at line 277 of file XrdCmsSecurity.cc.

{
 
// If not configured, return a null to indicate no authentication required
//
   if (!DHS) {size = 0; return 0;}
 
// Return actual token
//
   return DHS->getParms(size, endPoint);
}

Referenced by XrdCmsLogin::Admit().

Here is the caller graph for this function:

getVnId()

char * XrdCmsSecurity::getVnId ( XrdSysError &  eDest, const char *  cfgFN, const char *  nidlib, const char *  nidparm, char  nidType  )

static

Definition at line 213 of file XrdCmsSecurity.cc.

{
   static XrdVERSIONINFODEF (myVer, XrdNID, XrdVNUMBER, XrdVERSION);
   std::string (*ep)(XrdCmsgetVnIdArgs);
   std::string nidName;
 
// Read the vnid from a file is so directed
//
   if (*nidarg == '<')
      {char buff[nidMax+8];
       int nfd = XrdSysFD_Open(nidarg+1, O_RDONLY);
       if (nfd < 0)
          {eDest.Emsg("Config", errno, "open vnid file", nidarg+1);
           return 0;
          }
       int n = read(nfd, buff, sizeof(buff)-1);
       if (n < 0)
          {eDest.Emsg("Config", errno, "read vnid file", nidarg+1);
           close(nfd);
           return 0;
          }
       close(nfd);
       while(n && buff[n-1] == '\n') n--;
       buff[n] = 0;
       return chkVnId(eDest, buff, "vnid file contains");
      }
 
// Check if the actual vnid is being specified
//
   if (*nidarg == '=') return chkVnId(eDest, nidarg+1, "vnid value is");
 
// Make sure a plugin is being passed
//
   if (*nidarg != '@')
      {eDest.Emsg("Config", "vnid specification is invalid -", nidarg);
       return 0;
      }
 
// Get the entry point of the node ID creator
// 
   XrdOucPinLoader nidLib(&eDest, &myVer, "vnid", nidarg+1);
   ep = (std::string (*)(XrdCmsgetVnIdArgs))(nidLib.Resolve("XrdCmsgetVnId"));
   if (!ep) return 0;
 
// Get the node ID
// 
   nidName = ep(eDest, std::string(cfgFN), std::string(nidparm ? nidparm : ""),
                       nidType, nidMax);
 
// Unload the plugin (we don't need it anymore)
//
   nidLib.Unload();
 
// Verify that the node ID meets specs
//
   return chkVnId(eDest, nidName.c_str(), "vnid plugin returned");
}

References close, eDest, XrdSysError::Emsg(), read(), XrdOucPinLoader::Resolve(), XrdOucPinLoader::Unload(), XrdCmsgetVnIdArgs, and XrdCms::XrdVERSIONINFODEF().

Here is the call graph for this function:

Identify()

int XrdCmsSecurity::Identify ( XrdLink *  Link, XrdCms::CmsRRHdr &  inHdr, char *  authBuff, int  abLen  )

static

Definition at line 293 of file XrdCmsSecurity.cc.

{
   CmsRRHdr outHdr = {0, kYR_xauth, 0, 0};
   const char *hName = Link->Host();
   XrdSecCredentials *cred;
   XrdSecProtocol    *AuthProt = 0;
   XrdSecParameters   AuthParm, *AuthP = 0;
   XrdOucErrInfo      eMsg;
   const char        *eText = 0;
   int rc, myDlen;
 
// Verify that we are configured
//
   if (!getProtocol && !Configure("libXrdSec.so"))
      {Say.Emsg("Auth", hName ,"authentication configuration failed.");
       return 0;
      }
 
// Obtain the protocol
//
   AuthParm.buffer = (char *)authBuff; AuthParm.size = strlen(authBuff);
   if (!(AuthProt = getProtocol(hName,*(Link->AddrInfo()),AuthParm,&eMsg)))
      {Say.Emsg("Auth", hName, "getProtocol() failed;", eMsg.getErrText(rc));
       return 0;
      }
 
// Perform standard authentication
//
do {
 
// Get credentials
//
   if (!(cred = AuthProt->getCredentials(AuthP, &eMsg)))
      {eText = eMsg.getErrText(rc); break;}
 
// Send credentials to the server
//
   eText = XrdCmsTalk::Request(Link, outHdr, cred->buffer, cred->size);
   delete cred;
   if (eText) break;
 
// Get the response header and prepare for next iteration if need be
//
   if ((eText = XrdCmsTalk::Attend(Link,inHdr,authBuff,abLen,myDlen))) break;
   AuthParm.size = myDlen; AuthParm.buffer = authBuff; AuthP = &AuthParm;
 
} while(inHdr.rrCode == kYR_xauth);
 
// Check if we failed
//
   if (eText) Say.Emsg("Auth", hName, "authentication failed;", eText);
 
// Perform final steps here
//
   if (AuthProt) AuthProt->Delete();
   return (eText == 0);
}

References XrdLink::AddrInfo(), XrdCmsTalk::Attend(), XrdSecBuffer::buffer, XrdSecProtocol::Delete(), XrdSysError::Emsg(), eMsg, XrdSecProtocol::getCredentials(), XrdLink::Host(), XrdCms::kYR_xauth, XrdCmsTalk::Request(), XrdCms::CmsRRHdr::rrCode, XrdCms::Say, and XrdSecBuffer::size.

Referenced by XrdCmsLogin::Login().

Here is the call graph for this function:

Here is the caller graph for this function:

setSecFunc()

void XrdCmsSecurity::setSecFunc ( void *  secfP )

static

Definition at line 356 of file XrdCmsSecurity.cc.

     {getProtocol = (XrdSecGetProt_t)secfP;}

Referenced by XrdCmsFinderRMT::Configure().

Here is the caller graph for this function:

setSystemID()

char * XrdCmsSecurity::setSystemID ( XrdOucTList *  tp, const char *  iVNID, const char *  iTag, char  iType  )

static

Definition at line 363 of file XrdCmsSecurity.cc.

{
   XrdOucTList *tpF;
   char sidbuff[8192], *sidend = sidbuff+sizeof(sidbuff)-32;
   char *cP, *sp = sidbuff;
   char *fMan, *fp, *xp;
   int n;
 
// Extract out the instance name (we must have one)
//
   const char *instP = getenv("XRDINSTANCE");
   if (instP) instP = index(instP, ' ');
   if (!instP) return (char *)"!envar XRDINSTANCE undefined.";
   while(*instP && *instP == ' ') instP++;
   if (!(*instP)) return (char *)"!envar XRDINSTANCE invalid.";
 
// The system ID starts with the semi-unique name of this node unless it's
// a vnetid, in which case it's unique withn this cluster. Note that vnetid's
// always start with an asterisk. It does not otherwise.
//
   if (iVNID)
      {*sp++ = '*'; *sp++ = iType; *sp++ = '-';
       strcpy(sp, iVNID);
       sp += strlen(iVNID);
      } else {
       *sp++ = iType; *sp++ = '-';
       strcpy(sp, instP);
       sp += strlen(instP);
      }
 
// Export the vnid
//
   *sp = 0;
   XrdOucEnv::Export("XRDCMSVNID", sidbuff);
   *sp++ = ' '; cP = sp;
 
// Insert tag if we have one
//
   if (iTag) sp += sprintf(sp, "%s.", iTag);
 
// Develop a unique cluster name for this cluster
//
   if (!tp) sp += sprintf(sp, "%s", instP);
      else {tpF = tp;
            fMan = tp->text + strlen(tp->text) - 1;
            while((tp = tp->next))
                 {fp = fMan; xp = tp->text + strlen(tp->text) - 1;
                  do {if (*fp != *xp) break;
                      xp--;
                     } while(fp-- != tpF->text);
                  if ((n = xp - tp->text + 1) > 0)
                     {sp += sprintf(sp, "%d", tp->val);
                      if (sp+n >= sidend) return (char *)0;
                      strncpy(sp, tp->text, n); sp += n;
                     }
                 }
            sp += sprintf(sp, "%d", tpF->val);
            n = strlen(tpF->text);
            if (sp+n >= sidend) return (char *)0;
            strcpy(sp, tpF->text); sp += n;
           }
 
// Set envar to hold the cluster name
//
   *sp = '\0';
   XrdOucEnv::Export("XRDCMSCLUSTERID", cP);
 
// Export the full virtual network ID
//
   XrdOucEnv::Export("XRDCMSSYSID", sidbuff);
 
// Return the system ID
//
   return  strdup(sidbuff);
}

References XrdOucEnv::Export(), XrdOucTList::next, and XrdOucTList::text.

Here is the call graph for this function:

---

The documentation for this class was generated from the following files:

• XrdCmsSecurity.hh
• XrdCmsSecurity.cc