XrdSecProtocolgsi.cc File Reference

#include <unistd.h>
#include <cctype>
#include <cerrno>
#include <cstdlib>
#include <strings.h>
#include <cstdio>
#include <sys/param.h>
#include <pwd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <dirent.h>
#include <iostream>
#include "XrdVersion.hh"
#include "XrdNet/XrdNetAddr.hh"
#include "XrdSec/XrdSecEntityAttr.hh"
#include "XrdSys/XrdSysHeaders.hh"
#include "XrdSys/XrdSysLogger.hh"
#include "XrdSys/XrdSysError.hh"
#include "XrdOuc/XrdOucPinLoader.hh"
#include "XrdOuc/XrdOucStream.hh"
#include "XrdOuc/XrdOucEnv.hh"
#include "XrdSut/XrdSutAux.hh"
#include "XrdCrypto/XrdCryptoMsgDigest.hh"
#include "XrdCrypto/XrdCryptoX509Chain.hh"
#include "XrdCrypto/XrdCryptoX509Req.hh"
#include "XrdSecgsi/XrdSecProtocolgsi.hh"
#include "XrdSecgsi/XrdSecgsiOpts.hh"

Include dependency graph for XrdSecProtocolgsi.cc:

Go to the source code of this file.

Macros
#define	POPTS(t, y)

Functions
static bool	AuthzFunCheck (XrdSutCacheEntry *e, void *a)
static const char *	ClientStepStr (int kclt)
static bool	GetCACheck (XrdSutCacheEntry *e, void *a)
static bool	GetSrvCertEntCheck (XrdSutCacheEntry *e, void *a)
static bool	QueryGMAPCheck (XrdSutCacheEntry *e, void *a)
static bool	QueryProxyCheck (XrdSutCacheEntry *e, void *a)
static const char *	ServerStepStr (int ksrv)
char *	XrdSecProtocolgsiInit (const char mode, const char *parms, XrdOucErrInfo *erp)
XrdSecProtocol *	XrdSecProtocolgsiObject (const char mode, const char *hostname, XrdNetAddrInfo &endPoint, const char *parms, XrdOucErrInfo *erp)
	XrdVERSIONINFO (XrdSecProtocolgsiObject, secgsi)

Variables
static const char *	gGSErrStr []
static const char *	gNoPadTag = "nopad"
static const char *	gsiClientSteps []
static const char *	gsiServerSteps []
XrdOucTrace *	gsiTrace = 0
static const char *	gUsrPxyDef = "/tmp/x509up_u"
static const int	kOneDay = 86400
static String	Prefix = "xrd"
static String	ProtoID = XrdSecPROTOIDENT
static const kXR_int32	Version = XrdSecgsiVERSION

Macro Definition Documentation

POPTS

#define POPTS	(		t,
			y )

Value:

{if (t) {std::cerr <<"Secgsi" <<y <<'\n' << std::flush;}}

Definition at line 68 of file XrdSecProtocolgsi.cc.

Referenced by gsiOptions::Print(), and pwdOptions::Print().

Function Documentation

AuthzFunCheck()

static bool AuthzFunCheck ( XrdSutCacheEntry * e, void * a )

static

Definition at line 1721 of file XrdSecProtocolgsi.cc.

                                                        {
 
   int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
   time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
   long to_ref = (*((XrdSutCacheArg_t *)a)).arg3;
   int st_exp = (*((XrdSutCacheArg_t *)a)).arg4;
 
   if (e && (e->status == st_ref)) {
      // Check expiration, if required
      bool expired = 0;
      if (to_ref > 0 && (ts_ref - e->mtime) > to_ref) expired = 1;
      int notafter = *((int *) e->buf2.buf);
      if (to_ref > notafter) expired = 1;
 
      if (expired) {
         // Invalidate the entry, if the case
         e->status = st_exp;
      } else {
         return true;
      }
   }
   return false;
}

References XrdSutCacheEntryBuf::buf, XrdSutCacheEntry::buf2, XrdSutCacheEntry::mtime, and XrdSutCacheEntry::status.

Referenced by XrdSecProtocolgsi::Authenticate().

Here is the caller graph for this function:

ClientStepStr()

static const char * ClientStepStr ( int kclt )

static

Definition at line 223 of file XrdSecProtocolgsi.cc.

{
   // Return string with client step  
   static const char *ukn = "Unknown";
 
   kclt = (kclt < 0) ? 0 : kclt;
   kclt = (kclt > kXGC_reserved) ? 0 : kclt;
   kclt = (kclt >= kXGC_certreq) ? (kclt - kXGC_certreq + 1) : kclt;
 
   if (kclt < 0 || kclt > (kXGC_reserved - kXGC_certreq + 1))
      return ukn;  
   else
      return gsiClientSteps[kclt];
}

References gsiClientSteps, kXGC_certreq, and kXGC_reserved.

Referenced by XrdSecProtocolgsi::Authenticate(), XrdSecProtocolpwd::Authenticate(), XrdSecProtocolgsi::getCredentials(), and XrdSecProtocolpwd::getCredentials().

Here is the caller graph for this function:

GetCACheck()

static bool GetCACheck ( XrdSutCacheEntry * e, void * a )

static

Definition at line 4624 of file XrdSecProtocolgsi.cc.

                                                     {
 
   EPNAME("GetCACheck");
 
   int crl_check = (*((XrdSutCacheArg_t *)a)).arg1;
   int crl_refresh = (*((XrdSutCacheArg_t *)a)).arg2;
   time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg3;
 
   if (!e) return false;
 
   X509Chain *chain = 0;
   // If we had already something, check it, as we may be done
   bool goodca = 0;
   if ((chain = (X509Chain *)(e->buf1.buf))) {
      // Check the validity of the certificates in the chain; if a certificate became invalid,
      // we need to reload a valid one for the same CA.
      if (chain->CheckValidity() == 0) {
         goodca = 1;
      } else {
         PRINT("CA entry for '"<<e->name<<"' needs refreshing: clean the related entry cache first");
         return false;
      }
   }
   if (goodca) {
      XrdCryptoX509Crl *crl = (XrdCryptoX509Crl *)(e->buf2.buf);
      bool goodcrl = 1;
      if ((crl_check == 2 && !crl) || (crl_check == 3 && crl->IsExpired())) goodcrl = 0;
      if (crl_refresh > 0 && ((ts_ref - e->mtime) > crl_refresh)) goodcrl = 0;
      if (goodcrl) {
         return true;
      } else if (crl) {
         PRINT("CRL entry for '"<<e->name<<"' needs refreshing: clean the related entry cache first ("<<e<<")");
      }
   }
   return false;
}

References XrdSutCacheEntryBuf::buf, XrdSutCacheEntry::buf1, XrdSutCacheEntry::buf2, XrdCryptoX509Chain::CheckValidity(), EPNAME, XrdCryptoX509Crl::IsExpired(), XrdSutCacheEntry::mtime, XrdSutCacheEntry::name, and PRINT.

Here is the call graph for this function:

GetSrvCertEntCheck()

static bool GetSrvCertEntCheck ( XrdSutCacheEntry * e, void * a )

static

Definition at line 5628 of file XrdSecProtocolgsi.cc.

                                                             {
   int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
   time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
   if (e) {
      if (e->status > st_ref) {
         if (e->mtime >= ts_ref)
            return true;
      }
   }
   return false;
}

References XrdSutCacheEntry::mtime, and XrdSutCacheEntry::status.

QueryGMAPCheck()

static bool QueryGMAPCheck ( XrdSutCacheEntry * e, void * a )

static

Definition at line 5208 of file XrdSecProtocolgsi.cc.

                                                         {
   int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
   time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
   long to_ref = (*((XrdSutCacheArg_t *)a)).arg3;
   if (e) {
      // Check expiration, if required
      if ((e->status != st_ref) ||
          ((e->status == st_ref) &&
           (to_ref > 0) &&
           ((ts_ref - e->mtime) > to_ref))) {
         return false;
      } else {
         return true;
      }
   }
   return false;
}

References XrdSutCacheEntry::mtime, and XrdSutCacheEntry::status.

QueryProxyCheck()

static bool QueryProxyCheck ( XrdSutCacheEntry * e, void * a )

static

Definition at line 4985 of file XrdSecProtocolgsi.cc.

                                                          {
 
   time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg1;
 
   if (e && e->buf1.buf) {
      X509Chain *chain = (X509Chain *)(e->buf1.buf);
      if (chain->CheckValidity(1, ts_ref) == 0) return true;
   }
   return false;
}

References XrdSutCacheEntryBuf::buf, XrdSutCacheEntry::buf1, and XrdCryptoX509Chain::CheckValidity().

Here is the call graph for this function:

ServerStepStr()

static const char * ServerStepStr ( int ksrv )

static

Definition at line 239 of file XrdSecProtocolgsi.cc.

{
   // Return string with server step  
   static const char *ukn = "Unknown";
 
   ksrv = (ksrv < 0) ? 0 : ksrv;
   ksrv = (ksrv > kXGS_reserved) ? 0 : ksrv;
   ksrv = (ksrv >= kXGS_init) ? (ksrv - kXGS_init + 1) : ksrv;
 
   if (ksrv < 0 || ksrv > (kXGS_reserved - kXGS_init + 1))
      return ukn;  
   else
      return gsiServerSteps[ksrv];
}

References gsiServerSteps, kXGS_init, and kXGS_reserved.

Referenced by XrdSecProtocolgsi::Authenticate(), XrdSecProtocolpwd::Authenticate(), XrdSecProtocolgsi::getCredentials(), and XrdSecProtocolpwd::getCredentials().

Here is the caller graph for this function:

XrdSecProtocolgsiInit()

char * XrdSecProtocolgsiInit	(	const char	mode,
		const char *	parms,
		XrdOucErrInfo *	erp )

Definition at line 2374 of file XrdSecProtocolgsi.cc.

{
   // One-time protocol initialization, filling the static flags and options
   // of the protocol.
   // For clients (mode == 'c') we use values in envs.
   // For servers (mode == 's') the command line options are passed through
   // parms.
   EPNAME("ProtocolgsiInit");
 
   gsiOptions opts;
   char *rc = (char *)"";
   char *cenv = 0;
 
   // Initiate error logging and tracing
   gsiTrace = XrdSecProtocolgsi::EnableTracing();
 
   //
   // Clients first
   if (mode == 'c') {
      //
      // Decode envs:
      //             "XrdSecDEBUG"           debug flag ("0","1","2","3")
      //             "XrdSecGSICADIR"        full path to an alternative path
      //                                     containing the CA info
      //                                     [/etc/grid-security/certificates]
      //             "XrdSecGSICRLDIR"       full path to an alternative path
      //                                     containing the CRL info
      //                                     [/etc/grid-security/certificates]
      //             "XrdSecGSICRLEXT"       default extension of CRL files [.r0]
      //             "XrdSecGSIUSERCERT"     full path to an alternative file
      //                                     containing the user certificate
      //                                     [$HOME/.globus/usercert.pem]
      //             "XrdSecGSIUSERKEY"      full path to an alternative file
      //                                     containing the user key
      //                                     [$HOME/.globus/userkey.pem]
      //             "XrdSecGSIUSERPROXY"    full path to an alternative file
      //                                     containing the user proxy
      //                                     [/tmp/x509up_u<uid>]
      //             "XrdSecGSIPROXYVALID"   validity of proxies in the 
      //                                     grid-proxy-init format
      //                                     ["12:00", i.e. 12 hours]
      //             "XrdSecGSIPROXYDEPLEN"  depth of signature path for proxies;
      //                                     use -1 for unlimited [0]
      //             "XrdSecGSIPROXYKEYBITS" bits in PKI for proxies [default: XrdCryptoDefRSABits]
      //             "XrdSecGSICACHECK"      CA check level [1]:
      //                                      0 do not verify;
      //                                      1 verify if self-signed, warn if not;
      //                                      2 verify in all cases, fail if not possible
      //             "XrdSecGSICRLCHECK"     CRL check level [2]:
      //                                      0 don't care;
      //                                      1 use if available;
      //                                      2 require,
      //                                      3 require non-expired CRL
      //             "XrdSecGSIDELEGPROXY"   Forwarding of credentials option:
      //                                     0 deny; 1 sign request created
      //                                     by server; 2 forward local proxy
      //                                     (include private key) [1]
      //             "XrdSecGSICREATEPROXY"  Controls use of proxy [1]:
      //                                       1 auto-generate proxy from the cert/key pair if no one is not found
      //                                       0 a proxy is used if present; else, the cert/key pair is used if present.
      //             "XrdSecGSISRVNAMES"     Server names allowed: if the server CN
      //                                     does not match any of these, or it is
      //                                     explicitely denied by these, or it is
      //                                     not in the form "*/<hostname>", the
      //                                     handshake fails.
      //             "XrdSecGSIUSEDEFAULTHASH" If this variable is set only the default
      //                                     name hashing algorithm is used
 
      //
      opts.mode = mode;
      // debug
      cenv = getenv("XrdSecDEBUG");
      if (cenv)
         {if (cenv[0] >= 49 && cenv[0] <= 51) opts.debug = atoi(cenv);
             else {PRINT("unsupported debug value from env XrdSecDEBUG: "<<cenv<<" - setting to 1");
                   opts.debug = 1;
                  }
         }
 
      // directory with CA certificates
      cenv = (getenv("XrdSecGSICADIR") ? getenv("XrdSecGSICADIR")
                                       : getenv("X509_CERT_DIR"));
      if (cenv)
         opts.certdir = strdup(cenv);
 
      // directory with CRL info
      cenv = (getenv("XrdSecGSICRLDIR") ? getenv("XrdSecGSICRLDIR")
                                        : getenv("X509_CERT_DIR"));
      if (cenv)
         opts.crldir = strdup(cenv);
 
      // Default extension CRL files
      cenv = getenv("XrdSecGSICRLEXT");
      if (cenv)
         opts.crlext = strdup(cenv);
 
      // CRL refresh or expiration time
      cenv = getenv("XrdSecGSICRLRefresh");
      if (cenv)
         opts.crlrefresh = atoi(cenv);
 
      // file with user cert
      cenv = (getenv("XrdSecGSIUSERCERT") ? getenv("XrdSecGSIUSERCERT")
                                          : getenv("X509_USER_CERT"));
      if (cenv)
         opts.cert = strdup(cenv);
 
      // file with user key
      cenv = (getenv("XrdSecGSIUSERKEY") ? getenv("XrdSecGSIUSERKEY")
                                         : getenv("X509_USER_KEY"));
      if (cenv)
         opts.key = strdup(cenv);
 
      // file with user proxy
      cenv = (getenv("XrdSecGSIUSERPROXY") ? getenv("XrdSecGSIUSERPROXY")
                                           : getenv("X509_USER_PROXY"));
      if (cenv)
         opts.proxy = strdup(cenv);
 
      // file with user proxy
      cenv = getenv("XrdSecGSIPROXYVALID");
      if (cenv)
         opts.valid = strdup(cenv);
 
      // Depth of signature path for proxies
      cenv = getenv("XrdSecGSIPROXYDEPLEN");
      if (cenv)
         opts.deplen = atoi(cenv);
 
      // Key Bit length 
      cenv = getenv("XrdSecGSIPROXYKEYBITS");
      if (cenv)
         opts.bits = atoi(cenv);
 
      // CA verification level 
      cenv = getenv("XrdSecGSICACHECK");
      if (cenv)
         opts.ca = atoi(cenv);
 
      // CRL check level 
      cenv = getenv("XrdSecGSICRLCHECK");
      if (cenv)
         opts.crl = atoi(cenv);
 
      // Delegate proxy
      cenv = getenv("XrdSecGSIDELEGPROXY");
      if (cenv)
         opts.dlgpxy = atoi(cenv);
 
      // No proxy
      cenv = getenv("XrdSecGSICREATEPROXY");
      if (cenv)
         opts.createpxy = atoi(cenv);
 
      // Allowed server name formats
      cenv = getenv("XrdSecGSISRVNAMES");
      if (cenv)
         opts.srvnames = strdup(cenv);
 
      // Name hashing algorithm
      cenv = getenv("XrdSecGSIUSEDEFAULTHASH");
      if (cenv)
         opts.hashcomp = 0;
 
      // DNS trusting control
      if ((cenv = getenv("XrdSecGSITRUSTDNS")))
         opts.trustdns = (!strcmp(cenv, "0")) ? false : true;
 
      //
      // Setup the object with the chosen options
      rc = XrdSecProtocolgsi::Init(opts,erp);
 
      // Notify init options, if required or in case of init errors
      if (!rc) opts.debug = 1;
      opts.Print(gsiTrace);
 
      // Some cleanup
      SafeFree(opts.certdir);
      SafeFree(opts.crldir);
      SafeFree(opts.crlext);
      SafeFree(opts.cert);
      SafeFree(opts.key);
      SafeFree(opts.proxy);
      SafeFree(opts.valid);
      SafeFree(opts.srvnames);
 
      // We are done
      return rc;
   }
 
   // Take into account xrootd debug flag
   cenv = getenv("XRDDEBUG");
   if (cenv && !strcmp(cenv,"1")) opts.debug = 1;
 
   //
   // Server initialization
   if (parms) {
      //
      // Duplicate the parms
      char parmbuff[1024];
      strlcpy(parmbuff, parms, sizeof(parmbuff));
      //
      // The tokenizer
      XrdOucTokenizer inParms(parmbuff);
      //
      // Decode parms:
      // for servers:
      //              [-d:<debug_level>]
      //              [-c:[-]ssl[:[-]<CryptoModuleName]]
      //              [-certdir:<dir_with_CA_info>]
      //              [-crldir:<dir_with_CRL_info>]
      //              [-crlext:<default_extension_CRL_files>]
      //              [-cert:<path_to_server_certificate>]
      //              [-key:<path_to_server_key>]
      //              [-cipher:<list_of_supported_ciphers>]
      //              [-md:<list_of_supported_digests>]
      //              [-ca:<crl_verification_level>]
      //              [-crl:<crl_check_level>]
      //              [-crlrefresh:<crl_refresh_time>]
      //              [-gridmap:<grid_map_file>]
      //              [-gmapfun:<grid_map_function>]
      //              [-gmapfunparms:<grid_map_function_init_parameters>]
      //              [-authzcall:<authz_callopt>]
      //              [-authzfun:<authz_function>]
      //              [-authzfunparms:<authz_function_init_parameters>]
      //              [-authzto:<authz_cache_entry_validity_in_secs>]
      //              [-gmapto:<grid_map_cache_entry_validity_in_secs>]
      //              [-gmapopt:<grid_map_check_option>]
      //              [-dlgpxy:<proxy_req_option>]
      //              [-exppxy:<filetemplate>]
      //              [-authzpxy]
      //              [-vomsat:<voms_option>]
      //              [-vomsfun:<voms_function>]
      //              [-vomsfunparms:<voms_function_init_parameters>]
      //              [-defaulthash]
      //              [-trustdns:<0|1>]
      //
      int debug = -1;
      String clist = "";
      String certdir = "";
      String crldir = "";
      String crlext = "";
      String cert = "";
      String key = "";
      String cipher = "";
      String md = "";
      String gridmap = "";
      String gmapfun = "";
      String gmapfunparms = "";
      String authzfun = "";
      String authzfunparms = "";
      String vomsfun = "";
      String vomsfunparms = "";
      String exppxy = "";
      int ca = 1;
      int crl = 1;
      int crlrefresh = 86400;
      int ogmap = 1;
      int gmapto = 600;
      int authzto = -1;
      int authzcall = 1;
      int dlgpxy = dlgIgnore;
      int authzpxy = 0;
      int vomsat = vatIgnore; // Was 1 or extract
      int moninfo = 0;
      int hashcomp = 1;
      int trustdns = false;
      int showDN = false;
      char *op = 0;
      while (inParms.GetLine()) { 
         while ((op = inParms.GetToken())) {
            if (!strncmp(op, "-d:",3)) {
               debug = atoi(op+3);
            } else if (!strncmp(op, "-c:",3)) {
               clist = (const char *)(op+3);
            } else if (!strncmp(op, "-certdir:",9)) {
               certdir = (const char *)(op+9);
            } else if (!strncmp(op, "-crldir:",8)) {
               crldir = (const char *)(op+8);
            } else if (!strncmp(op, "-crlext:",8)) {
               crlext = (const char *)(op+8);
            } else if (!strncmp(op, "-cert:",6)) {
               cert = (const char *)(op+6);
            } else if (!strncmp(op, "-key:",5)) {
               key = (const char *)(op+5);
            } else if (!strncmp(op, "-cipher:",8)) {
               cipher = (const char *)(op+8);
            } else if (!strncmp(op, "-md:",4)) {
               md = (const char *)(op+4);
            } else if (!strncmp(op, "-ca:",4)) {
               ca = getOptVal(caVerOpts, op+4);
               ca = atoi(op+4);
            } else if (!strncmp(op, "-crl:",5)) {
               crl = getOptVal(crlOpts, op+5);
            } else if (!strncmp(op, "-crlrefresh:",12)) {
               crlrefresh = atoi(op+12);
            } else if (!strncmp(op, "-gmapopt:",9)) {
               ogmap = getOptVal(gmoOpts, op+9);
            } else if (!strncmp(op, "-gridmap:",9)) {
               gridmap = (const char *)(op+9);
            } else if (!strncmp(op, "-gmapfun:",9)) {
               gmapfun = (const char *)(op+9);
            } else if (!strncmp(op, "-gmapfunparms:",14)) {
               gmapfunparms = (const char *)(op+14);
            } else if (!strncmp(op, "-authzcall:",11)) {
               authzcall = getOptVal(azCallOpts, op+11);
            } else if (!strncmp(op, "-authzfun:",10)) {
               authzfun = (const char *)(op+10);
            } else if (!strncmp(op, "-authzfunparms:",15)) {
               authzfunparms = (const char *)(op+15);
            } else if (!strncmp(op, "-authzto:",9)) {
               authzto = atoi(op+9);
            } else if (!strncmp(op, "-gmapto:",8)) {
               gmapto = atoi(op+8);
            } else if (!strncmp(op, "-dlgpxy:",8)) {
               opts.dlgpxy = getOptVal(sDlgOpts, op+8);
            } else if (!strncmp(op, "-exppxy:",8)) {
               exppxy = (const char *)(op+8);
            } else if (!strncmp(op, "-authzpxy:",10)) {
               opts.authzpxy = getOptVal(azPxyOpts, op+10);
            } else if (!strncmp(op, "-authzpxy",9)) {
               authzpxy = 11;
            } else if (!strncmp(op, "-vomsat:",8)) {
               vomsat = getOptVal(vomsatOpts, op+8);
               if (vomsat != vatIgnore && vomsfun.length() == 0)
                  vomsfun = "default";
            } else if (!strncmp(op, "-vomsfun:",9)) {
               vomsfun = (const char *)(op+9);
            } else if (!strncmp(op, "-vomsfunparms:",14)) {
               vomsfunparms = (const char *)(op+14);
            } else if (!strcmp(op, "-moninfo")) {
               moninfo = 1;
            } else if (!strncmp(op, "-moninfo:",9)) {
               moninfo = atoi(op+9);
            } else if (!strcmp(op, "-defaulthash")) {
               hashcomp = 0;
            } else if (!strncmp(op, "-trustdns:",10)) {
               trustdns = getOptVal(tdnsOpts, op+10);
            } else if (!strncmp(op, "-showdn:",8)) {
               showDN = getOptVal(tdnsOpts, op+8);
            } else {
               PRINT("ignoring unknown switch: "<<op);
            }
         }
      }
 
      // If vomsfun is 'default' substitute the default plugin. The go on to
      // resolve conflicts between vomsfun and vomsat options. So, if vomsfun
      // was specified but vomsat is set to 'ignore' then we set vomsat to be
      // 'required'.
      //
      if (vomsfun.length() > 0)
         {if (vomsat == vatIgnore) vomsat = vatExtract;
          if (vomsfun == "default") vomsfun =  LIB_XRDVOMS;
         } else authzcall = azAlways;
 
      //
      // Build the option object
      opts.debug = (debug > -1) ? debug : opts.debug;
      opts.mode = 's';
      opts.ca = ca;
      opts.crl = crl;
      opts.crlrefresh = crlrefresh;
      opts.ogmap = ogmap;
      opts.gmapto = gmapto;
      opts.authzcall = authzcall;
      opts.authzto = authzto;
      opts.dlgpxy = (dlgpxy >= dlgIgnore && dlgpxy <= dlgReqSign) ? dlgpxy : 0;
      opts.authzpxy = authzpxy;
      opts.vomsat = vomsat;
      opts.moninfo = moninfo;
      opts.hashcomp = hashcomp;
      opts.trustdns = (trustdns <= 0) ? false : true;
      opts.showDN = (showDN > 0) ? true : false;
      if (clist.length() > 0)
         opts.clist = (char *)clist.c_str();
      if (certdir.length() > 0)
         opts.certdir = (char *)certdir.c_str();
      if (crldir.length() > 0)
         opts.crldir = (char *)crldir.c_str();
      if (crlext.length() > 0)
         opts.crlext = (char *)crlext.c_str();
      if (cert.length() > 0)
         opts.cert = (char *)cert.c_str();
      if (key.length() > 0)
         opts.key = (char *)key.c_str();
      if (cipher.length() > 0)
         opts.cipher = (char *)cipher.c_str();
      if (md.length() > 0)
         opts.md = (char *)md.c_str();
      if (gridmap.length() > 0)
         opts.gridmap = (char *)gridmap.c_str();
      if (gmapfun.length() > 0)
         opts.gmapfun = (char *)gmapfun.c_str();
      if (gmapfunparms.length() > 0)
         opts.gmapfunparms = (char *)gmapfunparms.c_str();
      if (authzfun.length() > 0)
         opts.authzfun = (char *)authzfun.c_str();
      if (authzfunparms.length() > 0)
         opts.authzfunparms = (char *)authzfunparms.c_str();
      if (exppxy.length() > 0)
         opts.exppxy = (char *)exppxy.c_str();
      if (vomsfun.length() > 0)
         opts.vomsfun = (char *)vomsfun.c_str();
      if (vomsfunparms.length() > 0)
         opts.vomsfunparms = (char *)vomsfunparms.c_str();
 
      // Notify init options, if required
      opts.Print(gsiTrace);
 
      //
      // Setup the plug-in with the chosen options
      return XrdSecProtocolgsi::Init(opts,erp);
   }
 
   // Notify init options, if required
   opts.Print(gsiTrace);
   //
   // Setup the plug-in with the defaults
   return XrdSecProtocolgsi::Init(opts,erp);
}}

References XrdOucString::c_str(), XrdSecProtocolgsi::EnableTracing(), EPNAME, XrdOucTokenizer::GetLine(), XrdOucTokenizer::GetToken(), gsiTrace, XrdSecProtocolgsi::Init(), XrdOucString::length(), LIB_XRDVOMS, opts, PRINT, SafeFree, and strlcpy().

Here is the call graph for this function:

XrdSecProtocolgsiObject()

XrdSecProtocol * XrdSecProtocolgsiObject	(	const char	mode,
		const char *	hostname,
		XrdNetAddrInfo &	endPoint,
		const char *	parms,
		XrdOucErrInfo *	erp )

Definition at line 2809 of file XrdSecProtocolgsi.cc.

{
   XrdSecProtocolgsi *prot;
   int options = XrdSecNOIPCHK;
 
   //
   // Get a new protocol object
   if (!(prot = new XrdSecProtocolgsi(options, hostname, endPoint, parms))) {
      const char *msg = "Secgsi: Insufficient memory for protocol.";
      if (erp) 
         erp->setErrInfo(ENOMEM, msg);
      else 
         std::cerr <<msg <<std::endl;
      return (XrdSecProtocol *)0;
   }
   //
   // We are done
   if (!erp)
      std::cerr << "protocol object instantiated" << std::endl;
   return prot;
}}

References XrdOucErrInfo::setErrInfo(), and XrdSecNOIPCHK.

Referenced by XrdVERSIONINFO().

Here is the call graph for this function:

Here is the caller graph for this function:

XrdVERSIONINFO()

XrdVERSIONINFO	(	XrdSecProtocolgsiObject	,
		secgsi	)

References XrdSecProtocolgsiObject().

Here is the call graph for this function:

Variable Documentation

gGSErrStr

const char* gGSErrStr[]

static

Initial value:

= {
   "ErrParseBuffer",               
   "ErrDecodeBuffer",              
   "ErrLoadCrypto",                
   "ErrBadProtocol",               
   "ErrCreateBucket",              
   "ErrDuplicateBucket",           
   "ErrCreateBuffer",              
   "ErrSerialBuffer",              
   "ErrGenCipher",                 
   "ErrExportPuK",                 
   "ErrEncRndmTag",                
   "ErrBadRndmTag",                
   "ErrNoRndmTag",                 
   "ErrNoCipher",                  
   "ErrNoCreds",                   
   "ErrBadOpt",                    
   "ErrMarshal",                   
   "ErrUnmarshal",                 
   "ErrSaveCreds",                 
   "ErrNoBuffer",                  
   "ErrRefCipher",                 
   "ErrNoPublic",                  
   "ErrAddBucket",                 
   "ErrFinCipher",                 
   "ErrInit",                      
   "ErrBadCreds",                  
   "ErrError"                      
}

Definition at line 97 of file XrdSecProtocolgsi.cc.

                                 {
   "ErrParseBuffer",               // 10000
   "ErrDecodeBuffer",              // 10001
   "ErrLoadCrypto",                // 10002
   "ErrBadProtocol",               // 10003
   "ErrCreateBucket",              // 10004
   "ErrDuplicateBucket",           // 10005
   "ErrCreateBuffer",              // 10006
   "ErrSerialBuffer",              // 10007
   "ErrGenCipher",                 // 10008
   "ErrExportPuK",                 // 10009
   "ErrEncRndmTag",                // 10010
   "ErrBadRndmTag",                // 10011
   "ErrNoRndmTag",                 // 10012
   "ErrNoCipher",                  // 10013
   "ErrNoCreds",                   // 10014
   "ErrBadOpt",                    // 10015
   "ErrMarshal",                   // 10016
   "ErrUnmarshal",                 // 10017
   "ErrSaveCreds",                 // 10018
   "ErrNoBuffer",                  // 10019
   "ErrRefCipher",                 // 10020
   "ErrNoPublic",                  // 10021
   "ErrAddBucket",                 // 10022
   "ErrFinCipher",                 // 10023
   "ErrInit",                      // 10024
   "ErrBadCreds",                  // 10025
   "ErrError"                      // 10026  
};

gNoPadTag

const char* gNoPadTag = "nopad"

static

Definition at line 132 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::getCredentials(), and XrdSecProtocolgsi::Init().

gsiClientSteps

const char* gsiClientSteps[]

static

Initial value:

= {
   "kXGC_none",
   "kXGC_certreq",
   "kXGC_cert",
   "kXGC_sigpxy",
   "kXGC_reserved"
}

Definition at line 81 of file XrdSecProtocolgsi.cc.

                                      {
   "kXGC_none",
   "kXGC_certreq",
   "kXGC_cert",
   "kXGC_sigpxy",
   "kXGC_reserved"
};

Referenced by ClientStepStr().

gsiServerSteps

const char* gsiServerSteps[]

static

Initial value:

= {
   "kXGS_none",
   "kXGS_init",
   "kXGS_cert",
   "kXGS_pxyreq",
   "kXGS_reserved"
}

Definition at line 89 of file XrdSecProtocolgsi.cc.

                                      {
   "kXGS_none",
   "kXGS_init",
   "kXGS_cert",
   "kXGS_pxyreq",
   "kXGS_reserved"
};

Referenced by ServerStepStr().

gsiTrace

XrdOucTrace* gsiTrace = 0

Definition at line 217 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::Init(), main(), XrdSecProtocolgsiInit(), and XrdVERSIONINFO().

gUsrPxyDef

const char* gUsrPxyDef = "/tmp/x509up_u"

static

Definition at line 130 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::Init(), and gsiOptions::Print().

kOneDay

const int kOneDay = 86400

static

Definition at line 128 of file XrdSecProtocolgsi.cc.

Prefix

String Prefix = "xrd"

static

Definition at line 77 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolpwd::Init().

ProtoID

String ProtoID = XrdSecPROTOIDENT

static

Definition at line 78 of file XrdSecProtocolgsi.cc.

Version

const kXR_int32 Version = XrdSecgsiVERSION

static

Definition at line 79 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::XrdSecProtocolgsi(), XrdSecProtocolpwd::XrdSecProtocolpwd(), XrdSecProtocolgsi::getCredentials(), XrdSecProtocolpwd::getCredentials(), XrdSecProtocolgsi::Init(), and XrdSecProtocolpwd::Init().