xrootd: XrdSecProtocolgsi.hh Source File

Go to the documentation of this file.
00001 // $Id: XrdSecProtocolgsi.hh,v 1.20 2009/04/09 13:53:16 ganis Exp $
00002 /******************************************************************************/
00003 /*                                                                            */
00004 /*                 X r d S e c P r o t o c o l g s i . h h                    */
00005 /*                                                                            */
00006 /* (c) 2005 G. Ganis / CERN                                                   */
00007 /*                                                                            */
00008 /******************************************************************************/
00009 #include <XrdOuc/XrdOucErrInfo.hh>
00010 #include <XrdSys/XrdSysPthread.hh>
00011 #include <XrdOuc/XrdOucString.hh>
00012 #include <XrdOuc/XrdOucTokenizer.hh>
00013 
00014 #include <XrdSec/XrdSecInterface.hh>
00015 #include <XrdSecgsi/XrdSecgsiTrace.hh>
00016 
00017 #include <XrdSut/XrdSutPFEntry.hh>
00018 #include <XrdSut/XrdSutPFile.hh>
00019 #include <XrdSut/XrdSutBuffer.hh>
00020 #include <XrdSut/XrdSutRndm.hh>
00021 
00022 #include <XrdCrypto/XrdCryptoAux.hh>
00023 #include <XrdCrypto/XrdCryptoCipher.hh>
00024 #include <XrdCrypto/XrdCryptoFactory.hh>
00025 #include <XrdCrypto/XrdCryptoX509Crl.hh>
00026 
00027 #include <XrdCrypto/XrdCryptosslgsiX509Chain.hh>
00028 
00029 /******************************************************************************/
00030 /*                               D e f i n e s                                */
00031 /******************************************************************************/
00032 
00033 typedef XrdOucString String;
00034 typedef XrdCryptosslgsiX509Chain X509Chain;
00035   
00036 #define XrdSecPROTOIDENT    "gsi"
00037 #define XrdSecPROTOIDLEN    sizeof(XrdSecPROTOIDENT)
00038 #define XrdSecgsiVERSION    10200
00039 #define XrdSecNOIPCHK       0x0001
00040 #define XrdSecDEBUG         0x1000
00041 #define XrdCryptoMax        10
00042 
00043 #define kMAXBUFLEN          1024
00044 
00045 //
00046 // Message codes either returned by server or included in buffers
00047 enum kgsiStatus {
00048    kgST_error    = -1,      // error occured
00049    kgST_ok       =  0,      // ok
00050    kgST_more     =  1       // need more info
00051 };
00052 
00053 // Client steps
00054 enum kgsiClientSteps {
00055    kXGC_none = 0,
00056    kXGC_certreq     = 1000, // 1000: request server certificate
00057    kXGC_cert,               // 1001: packet with (proxy) certificate
00058    kXGC_sigpxy,             // 1002: packet with signed proxy certificate
00059    kXGC_reserved            // 
00060 };
00061 
00062 // Server steps
00063 enum kgsiServerSteps {
00064    kXGS_none = 0,
00065    kXGS_init       = 2000,   // 2000: fake code used the first time 
00066    kXGS_cert,                // 2001: packet with certificate 
00067    kXGS_pxyreq,              // 2002: packet with proxy req to be signed 
00068    kXGS_reserved             //
00069 };
00070 
00071 // Handshake options
00072 enum kgsiHandshakeOpts {
00073    kOptsDlgPxy     = 1,      // 0x0001: Ask for a delegated proxy
00074    kOptsFwdPxy     = 2,      // 0x0002: Forward local proxy
00075    kOptsSigReq     = 4,      // 0x0004: Accept to sign delegated proxy
00076    kOptsSrvReq     = 8,      // 0x0008: Server request for delegated proxy
00077    kOptsPxFile     = 16,     // 0x0010: Save delegated proxies in file
00078    kOptsDelChn     = 32      // 0x0020: Delete chain
00079 };
00080 
00081 // Error codes
00082 enum kgsiErrors {
00083    kGSErrParseBuffer = 10000,       // 10000
00084    kGSErrDecodeBuffer,              // 10001
00085    kGSErrLoadCrypto,                // 10002
00086    kGSErrBadProtocol,               // 10003
00087    kGSErrCreateBucket,              // 10004
00088    kGSErrDuplicateBucket,           // 10005
00089    kGSErrCreateBuffer,              // 10006
00090    kGSErrSerialBuffer,              // 10007
00091    kGSErrGenCipher,                 // 10008
00092    kGSErrExportPuK,                 // 10009
00093    kGSErrEncRndmTag,                // 10010
00094    kGSErrBadRndmTag,                // 10011
00095    kGSErrNoRndmTag,                 // 10012
00096    kGSErrNoCipher,                  // 10013
00097    kGSErrNoCreds,                   // 10014
00098    kGSErrBadOpt,                    // 10015
00099    kGSErrMarshal,                   // 10016
00100    kGSErrUnmarshal,                 // 10017
00101    kGSErrSaveCreds,                 // 10018
00102    kGSErrNoBuffer,                  // 10019
00103    kGSErrRefCipher,                 // 10020
00104    kGSErrNoPublic,                  // 10021
00105    kGSErrAddBucket,                 // 10022
00106    kGSErrFinCipher,                 // 10023
00107    kGSErrInit,                      // 10024
00108    kGSErrBadCreds,                  // 10025
00109    kGSErrError                      // 10026  
00110 };
00111 
00112 #define REL1(x)     { if (x) delete x; }
00113 #define REL2(x,y)   { if (x) delete x; if (y) delete y; }
00114 #define REL3(x,y,z) { if (x) delete x; if (y) delete y; if (z) delete z; }
00115 
00116 #define SafeDelete(x) { if (x) delete x ; x = 0; }
00117 #define SafeDelArray(x) { if (x) delete [] x ; x = 0; }
00118 #define SafeFree(x) { if (x) free(x) ; x = 0; }
00119 
00120 // External function for DN-username mapping
00121 typedef char *(*XrdSecgsiGMAP_t)(const char *, int);
00122 
00123 //
00124 // This a small class to set the relevant options in one go
00125 //
00126 class gsiOptions {
00127 public:
00128    short  debug;  // [cs] debug flag
00129    short  mode;   // [cs] 'c' or 's'
00130    char  *clist;  // [s] list of crypto modules ["ssl" ]
00131    char  *certdir;// [cs] dir with CA info [/etc/grid-security/certificates]
00132    char  *crldir; // [cs] dir with CRL info [/etc/grid-security/certificates]
00133    char  *crlext; // [cs] extension of CRL files [.r0]
00134    char  *cert;   // [s] server certificate [/etc/grid-security/root/rootcert.pem]
00135                   // [c] user certificate [$HOME/.globus/usercert.pem]
00136    char  *key;    // [s] server private key [/etc/grid-security/root/rootkey.pem]
00137                   // [c] user private key [$HOME/.globus/userkey.pem]
00138    char  *cipher; // [s] list of ciphers [aes-128-cbc:bf-cbc:des-ede3-cbc]
00139    char  *md;     // [s] list of MDs [sha1:md5]
00140    int    crl;    // [cs] check level of CRL's [1] 
00141    int    ca;     // [cs] verification level of CA's [1] 
00142    char  *proxy;  // [c] user proxy  [/tmp/x509up_u<uid>]
00143    char  *valid;  // [c] proxy validity  [12:00]
00144    int    deplen; // [c] depth of signature path for proxies [0] 
00145    int    bits;   // [c] bits in PKI for proxies [512] 
00146    char  *gridmap;// [s] gridmap file [/etc/grid-security/gridmap]
00147    int    gmapto; // [s] validity in secs of grid-map cache entries [-1 => unlimited]
00148    char  *gmapfun;// [s] file with the function to map DN to usernames [0]
00149    char  *gmapfunparms;// [s] parameters for the function to map DN to usernames [0]
00150    int    ogmap;  // [s] gridmap file checking option 
00151    int    dlgpxy; // [c] explicitely ask the creation of a delegated proxy 
00152                   // [s] ask client for proxies
00153    int    sigpxy; // [c] accept delegated proxy requests 
00154    char  *srvnames;// [c] '|' separated list of allowed server names
00155    char  *exppxy; // [s] template for the exported file with proxies (dlgpxy == 3)
00156 
00157    gsiOptions() { debug = -1; mode = 's'; clist = 0; 
00158                   certdir = 0; crldir = 0; crlext = 0; cert = 0; key = 0;
00159                   cipher = 0; md = 0; ca = 1 ; crl = 1;
00160                   proxy = 0; valid = 0; deplen = 0; bits = 512;
00161                   gridmap = 0; gmapto = -1; gmapfun = 0; gmapfunparms = 0; ogmap = 1;
00162                   dlgpxy = 0; sigpxy = 1; srvnames = 0; exppxy = 0;}
00163    virtual ~gsiOptions() { } // Cleanup inside XrdSecProtocolgsiInit
00164 };
00165 
00166 class XrdSecProtocolgsi;
00167 class gsiHSVars {
00168 public:
00169    int               Iter;          // iteration number
00170    int               TimeStamp;     // Time of last call
00171    String            CryptoMod;     // crypto module in use
00172    int               RemVers;       // Version run by remote counterpart
00173    XrdCryptoCipher  *Rcip;          // reference cipher
00174    XrdSutBucket     *Cbck;          // Bucket with the certificate in export form
00175    String            ID;            // Handshake ID (dummy for clients)
00176    XrdSutPFEntry    *Cref;          // Cache reference
00177    XrdSutPFEntry    *Pent;          // Pointer to relevant file entry 
00178    X509Chain        *Chain;         // Chain to be eventually verified 
00179    XrdCryptoX509Crl *Crl;           // Pointer to CRL, if required 
00180    X509Chain        *PxyChain;      // Proxy Chain on clients
00181    bool              RtagOK;        // Rndm tag checked / not checked
00182    bool              Tty;           // Terminal attached / not attached
00183    int               LastStep;      // Step required at previous iteration
00184    int               Options;       // Handshake options;
00185    XrdSutBuffer     *Parms;         // Buffer with server parms on first iteration 
00186 
00187    gsiHSVars() { Iter = 0; TimeStamp = -1; CryptoMod = "";
00188                  RemVers = -1; Rcip = 0;
00189                  Cbck = 0;
00190                  ID = ""; Cref = 0; Pent = 0; Chain = 0; Crl = 0; PxyChain = 0;
00191                  RtagOK = 0; Tty = 0; LastStep = 0; Options = 0; Parms = 0;}
00192 
00193    ~gsiHSVars() { SafeDelete(Cref);
00194                   if (Options & kOptsDelChn) {
00195                      // Do not delete the CA certificate in the cached reference
00196                      if (Chain) Chain->Cleanup(1);
00197                      SafeDelete(Chain);
00198                   }
00199                   // The proxy chain is owned by the proxy cache; invalid proxies are
00200                   // detected (and eventually removed) by QueryProxy
00201                   PxyChain = 0;
00202                   SafeDelete(Parms); }
00203    void Dump(XrdSecProtocolgsi *p = 0);
00204 };
00205 
00206 // From a proxy query
00207 typedef struct {
00208    X509Chain        *chain;
00209    XrdCryptoRSA     *ksig;
00210    XrdSutBucket     *cbck;
00211 } ProxyOut_t;
00212 
00213 // To query proxies
00214 typedef struct {
00215    const char *cert;
00216    const char *key;
00217    const char *certdir;
00218    const char *out;
00219    const char *valid;
00220    int         deplen;
00221    int         bits;
00222 } ProxyIn_t;
00223 
00224 /******************************************************************************/
00225 /*              X r d S e c P r o t o c o l g s i   C l a s s                 */
00226 /******************************************************************************/
00227 
00228 class XrdSecProtocolgsi : public XrdSecProtocol
00229 {
00230 public:
00231         int                Authenticate  (XrdSecCredentials *cred,
00232                                           XrdSecParameters **parms,
00233                                           XrdOucErrInfo     *einfo=0);
00234 
00235         XrdSecCredentials *getCredentials(XrdSecParameters  *parm=0,
00236                                           XrdOucErrInfo     *einfo=0);
00237 
00238         XrdSecProtocolgsi(int opts, const char *hname,
00239                           const struct sockaddr *ipadd, const char *parms = 0);
00240         virtual ~XrdSecProtocolgsi() {} // Delete() does it all
00241 
00242         // Initialization methods
00243         static char      *Init(gsiOptions o, XrdOucErrInfo *erp);
00244 
00245         void              Delete();
00246 
00247         // Encrypt / Decrypt methods
00248         int               Encrypt(const char *inbuf, int inlen,
00249                                   XrdSecBuffer **outbuf);
00250         int               Decrypt(const char *inbuf, int inlen,
00251                                   XrdSecBuffer **outbuf);
00252         // Sign / Verify methods
00253         int               Sign(const char *inbuf, int inlen,
00254                                XrdSecBuffer **outbuf);
00255         int               Verify(const char *inbuf, int inlen,
00256                                  const char *sigbuf, int siglen);
00257 
00258         // Export session key
00259         int               getKey(char *kbuf=0, int klen=0);
00260         // Import a key
00261         int               setKey(char *kbuf, int klen);
00262 
00263 private:
00264 
00265    // Static members initialized at startup
00266    static XrdSysMutex      gsiContext;
00267    static String           CAdir;
00268    static String           CRLdir;
00269    static String           DefCRLext;
00270    static String           SrvCert;
00271    static String           SrvKey;
00272    static String           UsrProxy;
00273    static String           UsrCert;
00274    static String           UsrKey;
00275    static String           PxyValid;
00276    static int              DepLength;
00277    static int              DefBits;
00278    static int              CACheck;
00279    static int              CRLCheck;
00280    static String           DefCrypto;
00281    static String           DefCipher;
00282    static String           DefMD;
00283    static String           DefError;
00284    static String           GMAPFile;
00285    static int              GMAPOpt;
00286    static int              GMAPCacheTimeOut;
00287    static XrdSysPlugin    *GMAPPlugin;
00288    static XrdSecgsiGMAP_t  GMAPFun;
00289    static int              PxyReqOpts;
00290    static String           SrvAllowedNames;
00291    //
00292    // Crypto related info
00293    static int              ncrypt;                  // Number of factories
00294    static XrdCryptoFactory *cryptF[XrdCryptoMax];   // their hooks 
00295    static int              cryptID[XrdCryptoMax];   // their IDs 
00296    static String           cryptName[XrdCryptoMax]; // their names 
00297    static XrdCryptoCipher *refcip[XrdCryptoMax];    // ref for session ciphers 
00298    //
00299    // Caches 
00300    static XrdSutCache      cacheCA;   // Info about trusted CA's
00301    static XrdSutCache      cacheCert; // Cache for available server certs
00302    static XrdSutCache      cachePxy;  // Cache for client proxies
00303    static XrdSutCache      cacheGMAP; // Cache for gridmap entries
00304    static XrdSutCache      cacheGMAPFun; // Cache for entries mapped by GMAPFun
00305    //
00306    // Running options / settings
00307    static int              Debug;          // [CS] Debug level
00308    static bool             Server;         // [CS] If server mode 
00309    static int              TimeSkew;       // [CS] Allowed skew in secs for time stamps 
00310    //
00311    // for error logging and tracing
00312    static XrdSysLogger     Logger;
00313    static XrdSysError      eDest;
00314    static XrdOucTrace     *GSITrace;
00315 
00316    // Information local to this instance
00317    int              options;
00318    struct sockaddr  hostaddr;      // Client-side only
00319    XrdCryptoFactory *sessionCF;    // Chosen crypto factory
00320    XrdCryptoCipher *sessionKey;    // Session Key (result of the handshake)
00321    XrdSutBucket    *bucketKey;     // Bucket with the key in export form
00322    XrdCryptoMsgDigest *sessionMD;  // Message Digest instance
00323    XrdCryptoRSA    *sessionKsig;   // RSA key to sign
00324    XrdCryptoRSA    *sessionKver;   // RSA key to verify
00325    X509Chain       *proxyChain;    // Chain with the delegated proxy on servers
00326    bool             srvMode;       // TRUE if server mode 
00327 
00328    // Temporary Handshake local info
00329    gsiHSVars     *hs;
00330 
00331    // Parsing received buffers: client
00332    int            ParseClientInput(XrdSutBuffer *br, XrdSutBuffer **bm,
00333                                    String &emsg);
00334    int            ClientDoInit(XrdSutBuffer *br, XrdSutBuffer **bm,
00335                                String &cmsg);
00336    int            ClientDoCert(XrdSutBuffer *br,  XrdSutBuffer **bm,
00337                                String &cmsg);
00338    int            ClientDoPxyreq(XrdSutBuffer *br,  XrdSutBuffer **bm,
00339                                  String &cmsg);
00340 
00341    // Parsing received buffers: server
00342    int            ParseServerInput(XrdSutBuffer *br, XrdSutBuffer **bm,
00343                                    String &cmsg);
00344    int            ServerDoCertreq(XrdSutBuffer *br, XrdSutBuffer **bm,
00345                                   String &cmsg);
00346    int            ServerDoCert(XrdSutBuffer *br,  XrdSutBuffer **bm,
00347                                String &cmsg);
00348    int            ServerDoSigpxy(XrdSutBuffer *br,  XrdSutBuffer **bm,
00349                                  String &cmsg);
00350 
00351    // Auxilliary functions
00352    int            ParseCrypto(String cryptlist);
00353    int            ParseCAlist(String calist);
00354 
00355    // Load CA certificates
00356    static int     LoadCADir(int timestamp);
00357    int            GetCA(const char *cahash);
00358    static String  GetCApath(const char *cahash);
00359    static bool    VerifyCA(int opt, X509Chain *cca, XrdCryptoFactory *cf);
00360    bool           ServerCertNameOK(const char *subject, String &e);
00361 
00362    // Load CRLs
00363    static XrdCryptoX509Crl *LoadCRL(XrdCryptoX509 *xca,
00364                                     XrdCryptoFactory *CF);
00365 
00366    // Updating proxies
00367    static int     QueryProxy(bool checkcache, XrdSutCache *cache, const char *tag,
00368                              XrdCryptoFactory *cf, int timestamp,
00369                              ProxyIn_t *pi, ProxyOut_t *po);
00370    static int     InitProxy(ProxyIn_t *pi,
00371                             X509Chain *ch = 0, XrdCryptoRSA **key = 0);
00372 
00373    // Error functions
00374    static void    ErrF(XrdOucErrInfo *einfo, kXR_int32 ecode,
00375                        const char *msg1, const char *msg2 = 0,
00376                        const char *msg3 = 0);
00377    XrdSecCredentials *ErrC(XrdOucErrInfo *einfo, XrdSutBuffer *b1,
00378                            XrdSutBuffer *b2,XrdSutBuffer *b3,
00379                            kXR_int32 ecode, const char *msg1 = 0,
00380                            const char *msg2 = 0, const char *msg3 = 0);
00381    int            ErrS(String ID, XrdOucErrInfo *einfo, XrdSutBuffer *b1,
00382                        XrdSutBuffer *b2, XrdSutBuffer *b3,
00383                        kXR_int32 ecode, const char *msg1 = 0,
00384                        const char *msg2 = 0, const char *msg3 = 0);
00385 
00386    // Check Time stamp
00387    bool           CheckTimeStamp(XrdSutBuffer *b, int skew, String &emsg);
00388 
00389    // Check random challenge
00390    bool           CheckRtag(XrdSutBuffer *bm, String &emsg);
00391 
00392    // Auxilliary methods
00393    int            AddSerialized(char opt, kXR_int32 step, String ID, 
00394                                 XrdSutBuffer *bls, XrdSutBuffer *buf,
00395                                 kXR_int32 type, XrdCryptoCipher *cip);
00396    // Grid map cache handling
00397    static int     LoadGMAP(int now); // Init or refresh the cache
00398    static XrdSecgsiGMAP_t            // Load alternative function for mapping
00399                   LoadGMAPFun(const char *plugin, const char *parms);
00400    static void    QueryGMAP(const char *dn, int now, String &name); //Lookup info for DN
00401 };