xrootd
XrdSecProtocolpwd.hh
Go to the documentation of this file.
1 // $Id$
2 /******************************************************************************/
3 /* */
4 /* X r d S e c P r o t o c o l p w d . h h */
5 /* */
6 /* (c) 2005 by the Board of Trustees of the Leland Stanford, Jr., University */
7 /* All Rights Reserved */
8 /* Produced by Andrew Hanushevsky for Stanford University under contract */
9 /* DE-AC03-76-SFO0515 with the Department of Energy */
10 /******************************************************************************/
11 #include <XrdOuc/XrdOucErrInfo.hh>
12 #include <XrdSys/XrdSysPthread.hh>
13 #include <XrdOuc/XrdOucString.hh>
14 #include <XrdOuc/XrdOucTokenizer.hh>
15 
16 #include <XrdSec/XrdSecInterface.hh>
17 #include <XrdSec/XrdSecTrace.hh>
18 
19 #include <XrdSut/XrdSutPFEntry.hh>
20 #include <XrdSut/XrdSutPFile.hh>
21 #include <XrdSut/XrdSutBuffer.hh>
22 #include <XrdSut/XrdSutRndm.hh>
23 
24 #include <XrdCrypto/XrdCryptoAux.hh>
25 #include <XrdCrypto/XrdCryptoCipher.hh>
26 #include <XrdCrypto/XrdCryptoFactory.hh>
27 
28 /******************************************************************************/
29 /* D e f i n e s */
30 /******************************************************************************/
31 
32 typedef XrdOucString String;
33 
34 #define XrdSecPROTOIDENT "pwd"
35 #define XrdSecPROTOIDLEN sizeof(XrdSecPROTOIDENT)
36 #define XrdSecpwdVERSION 10100
37 #define XrdSecNOIPCHK 0x0001
38 #define XrdSecDEBUG 0x1000
39 #define XrdCryptoMax 10
40 
41 #define kMAXBUFLEN 1024
42 #define kMAXUSRLEN 9
43 #define kMAXPWDLEN 64
44 
45 //
46 // Message codes either returned by server or included in buffers
47 enum kpwdStatus {
48  kpST_error = -1, // error occured
49  kpST_ok = 0, // ok
50  kpST_more = 1 // need more info
51 };
52 
53 //
54 // Auto-reg modes
55 enum kpwdAutoreg {
56  kpAR_none = 0, // autoreg disabled
57  kpAR_users = 1, // only for tags in password files (local, system's)
58  kpAR_all = 2 // for all tags
59 };
60 
61 //
62 // Client update autologin modes
63 enum kpwdUpdate {
64  kpUP_none = 0, // no update
65  kpUP_remove = 1, // remove obsolete entries only
66  kpUP_all = 2 // remove obsolete entries and register new valid info
67 };
68 
69 //
70 // Creds input type
71 enum kpwdCredsInput {
72  kpCI_undef = -1, // undefined
73  kpCI_prompt = 0, // from prompt
74  kpCI_exact = 1, // from FileNetRc, exact tag
75  kpCI_wildcard = 2 // from FileNetRc, wildcard tag
76 };
77 
78 //
79 // Creds type (for prompt)
80 enum kpwdCredType {
81  kpCT_undef = -1, // undefined
82  kpCT_normal = 0, // confirmed credentials
83  kpCT_onetime = 1, // one-time credentials
84  kpCT_old = 2, // old credentials to be changed
85  kpCT_new = 3, // new credentials to be confirmed
86  kpCT_newagain = 4, // new credentials again for confirmation
87  kpCT_autoreg = 5, // autoreg: new creds to be confirmed
88  kpCT_ar_again = 6, // autoreg: new creds again for confirmation
89  kpCT_crypt = 7, // standard crypt hash
90  kpCT_afs = 8, // AFS plain password
91  kpCT_afsenc = 9 // AFS encrypted password
92 };
93 
94 //
95 // Creds actions
96 enum kpwdCredsActions {
97  kpCA_undef = -1, // undefined
98  kpCA_check = 0, // normal check of credentials
99  kpCA_checkold = 1, // check current creds before asking for new ones
100  kpCA_cache = 2, // cache received (new) credentials
101  kpCA_checkcache = 3 // check cached credentials and save them, if ok
102 };
103 
104 // Client steps
105 enum kpwdClientSteps {
106  kXPC_none = 0,
107  kXPC_normal = 1000, // 1000: standard packet
108  kXPC_verifysrv, // 1001: request for server verification
109  kXPC_signedrtag, // 1002: signed rtag (after server request for verification)
110  kXPC_creds, // 1003: credentials packet
111  kXPC_autoreg, // 1004: query for autoregistration
112  kXPC_failureack, // 1005: failure acknowledgement
113  kXPC_reserved //
114 };
115 
116 // Server steps
117 enum kpwdServerSteps {
118  kXPS_none = 0,
119  kXPS_init = 2000, // 2000: fake code used the first time
120  kXPS_credsreq, // 2001: request for credentials
121  kXPS_rtag, // 2002: rndm tag to be signed (strong verification)
122  kXPS_signedrtag, // 2003: signed rtag (after client request for verification)
123  kXPS_newpuk, // 2004: new public part for session ciphers
124  kXPS_puk, // 2005: public part for session ciphers (after autoreg)
125  kXPS_failure, // 2006: signal failure to client to drop invalid cached info
126  kXPS_reserved //
127 };
128 
129 // Error codes
130 enum kpwdErrors {
131  kPWErrParseBuffer = 10000, // 10000
132  kPWErrDecodeBuffer, // 10001
133  kPWErrLoadCrypto, // 10002
134  kPWErrBadProtocol, // 10003
135  kPWErrNoUserHost, // 10004
136  kPWErrNoUser, // 10005
137  kPWErrNoHost, // 10006
138  kPWErrBadUser, // 10007
139  kPWErrCreateBucket, // 10008
140  kPWErrDuplicateBucket, // 10009
141  kPWErrCreateBuffer, // 10010
142  kPWErrSerialBuffer, // 10011
143  kPWErrGenCipher, // 10012
144  kPWErrExportPuK, // 10013
145  kPWErrEncRndmTag, // 10014
146  kPWErrBadRndmTag, // 10015
147  kPWErrNoRndmTag, // 10016
148  kPWErrNoCipher, // 10017
149  kPWErrQueryCreds, // 10018
150  kPWErrNoCreds, // 10019
151  kPWErrBadPasswd, // 10020
152  kPWErrBadCache, // 10021
153  kPWErrNoCache, // 10022
154  kPWErrNoSessID, // 10023
155  kPWErrBadSessID, // 10024
156  kPWErrBadOpt, // 10025
157  kPWErrMarshal, // 10026
158  kPWErrUnmarshal, // 10027
159  kPWErrSaveCreds, // 10028
160  kPWErrNoSalt, // 10029
161  kPWErrNoBuffer, // 10030
162  kPWErrRefCipher, // 10031
163  kPWErrNoPublic, // 10032
164  kPWErrAddBucket, // 10033
165  kPWErrFinCipher, // 10034
166  kPWErrInit, // 10034
167  kPWErrBadCreds, // 10035
168  kPWErrError // 10036
169 };
170 
171 // Structuring the status word
172 typedef struct {
173  char ctype;
174  char action;
175  short options;
176 } pwdStatus_t;
177 
178 #define REL1(x) { if (x) delete x; }
179 #define REL2(x,y) { if (x) delete x; if (y) delete y; }
180 #define REL3(x,y,z) { if (x) delete x; if (y) delete y; if (z) delete z; }
181 
182 #ifndef NODEBUG
183 #define PRINT(y) {{SecTrace->Beg(epname); cerr <<y; SecTrace->End();}}
184 #else
185 #define PRINT(y) { }
186 #endif
187 
188 #define SafeDelete(x) { if (x) delete x ; x = 0; }
189 #define SafeDelArray(x) { if (x) delete [] x ; x = 0; }
190 
191 //
192 // This a small class to set the relevant options in one go
193 //
194 class pwdOptions {
195 public:
196  short debug; // [cs] debug flag
197  short mode; // [cs] 'c' or 's'
198  short areg; // [cs] auto-registration opt (s); update-autolog-info opt (c)
199  short upwd; // [s] check / do-not-check pwd file in user's $HOME
200  short alog; // [c] check / do-not-check user's autologin info
201  short verisrv; // [c] verify / do-not-verify server ownership of srvpuk
202  short vericlnt; // [s] level of verification client ownership of clntpuk
203  short syspwd; // [s] check / do-not-check system pwd (requires privileges)
204  int lifecreds; // [s] lifetime in seconds of credentials
205  int maxprompts; // [c] max number of empty prompts
206  int maxfailures; // [s] max passwd failures before blocking
207  char *clist; // [s] list of crypto modules ["ssl"]
208  char *dir; // [s] directory with admin pwd files [$HOME/.xrd]
209  char *udir; // [s] users's sub-directory with pwd files [$HOME/.xrd]
210  char *cpass; // [s] users's crypt hash pwd file [$HOME/.xrootdpass]
211  char *alogfile; // [c] autologin file [$HOME/.xrd/pwdnetrc]
212  char *srvpuk; // [c] file with server puks [$HOME/.xrd/pwdsrvpuk]
213  short keepcreds; // [s] keep / do-not-keep client credentials
214  char *expcreds; // [s] (template for) file with exported creds
215 
216  pwdOptions() { debug = -1; mode = 's'; areg = -1; upwd = -1; alog = -1;
217  verisrv = -1; vericlnt = -1;
218  syspwd = -1; lifecreds = -1; maxprompts = -1; maxfailures = -1;
219  clist = 0; dir = 0; udir = 0; cpass = 0;
220  alogfile = 0; srvpuk = 0; keepcreds = 0; expcreds = 0;}
221  virtual ~pwdOptions() { } // Cleanup inside XrdSecProtocolpwdInit
222 };
223 
224 class pwdHSVars {
225 public:
226  int Iter; // iteration number
227  int TimeStamp; // Time of last call
228  String CryptoMod; // crypto module in use
229  String User; // remote username
230  String Tag; // tag for credentials
231  int RemVers; // Version run by remote counterpart
232  XrdCryptoFactory *CF; // crypto factory
233  XrdCryptoCipher *Hcip; // handshake cipher
234  XrdCryptoCipher *Rcip; // reference cipher
235  String ID; // Handshake ID (dummy for clients)
236  XrdSutPFEntry *Cref; // Cache reference
237  XrdSutPFEntry *Pent; // Pointer to relevant file entry
238  bool RtagOK; // Rndm tag checked / not checked
239  pwdStatus_t Status; // Some state flags
240  bool Tty; // Terminal attached / not attached
241  int Step; // Current step
242  int LastStep; // Step required at previous iteration
243  String ErrMsg; // Last error message
244  int SysPwd; // 0 = no, 1 = Unix sys pwd, 2 = AFS pwd
245  String AFScell; // AFS cell if it makes sense
246  XrdSutBuffer *Parms; // Buffer with server parms on first iteration
247 
248  pwdHSVars() { Iter = 0; TimeStamp = -1; CryptoMod = ""; User = ""; Tag = "";
249  RemVers = -1; CF = 0; Hcip = 0; Rcip = 0;
250  ID = ""; Cref = 0; Pent = 0; RtagOK = 0; Tty = 0;
251  Step = 0; LastStep = 0; ErrMsg = "";
252  SysPwd = 0; AFScell = "";
253  Status.ctype = 0; Status.action = 0; Status.options = 0; Parms = 0;}
254 
255  ~pwdHSVars() { SafeDelete(Cref); SafeDelete(Hcip); SafeDelete(Parms); }
256 };
257 
258 
259 /******************************************************************************/
260 /* X r d S e c P r o t o c o l p w d C l a s s */
261 /******************************************************************************/
262 
263 class XrdSecProtocolpwd : public XrdSecProtocol
264 {
265 public:
266  int Authenticate (XrdSecCredentials *cred,
267  XrdSecParameters **parms,
268  XrdOucErrInfo *einfo=0);
269 
270  XrdSecCredentials *getCredentials(XrdSecParameters *parm=0,
271  XrdOucErrInfo *einfo=0);
272 
273  XrdSecProtocolpwd(int opts, const char *hname,
274  const struct sockaddr *ipadd,
275  const char *parms = 0);
276  virtual ~XrdSecProtocolpwd() {} // Delete() does it all
277 
278  // Initialization methods
279  static char *Init(pwdOptions o, XrdOucErrInfo *erp);
280 
281  void Delete();
282 
283  static void PrintTimeStat();
284 
285 private:
286 
287  // Static members initialized at startup
288  static XrdSysMutex pwdContext;
289  static String FileAdmin;
290  static String FileExpCreds; // (Template for) file with exported creds [S]
291  static String FileUser;
292  static String FileCrypt;
293  static String FileSrvPuk;
294  static String SrvID;
295  static String SrvEmail;
296  static String DefCrypto;
297  static String DefError;
298  static XrdSutPFile PFAdmin; // Admin file [S]
299  static XrdSutPFile PFAlog; // Autologin file [CS]
300  static XrdSutPFile PFSrvPuk; // File with server public keys [CS]
301  //
302  // Crypto related info
303  static int ncrypt; // Number of factories
304  static int cryptID[XrdCryptoMax]; // their IDs
305  static String cryptName[XrdCryptoMax]; // their names
306  static XrdCryptoCipher *loccip[XrdCryptoMax]; // local ciphers
307  static XrdCryptoCipher *refcip[XrdCryptoMax]; // ref for session ciphers
308  //
309  // Caches for info files
310  static XrdSutCache cacheAdmin; // Admin file
311  static XrdSutCache cacheSrvPuk; // SrvPuk file
312  static XrdSutCache cacheUser; // User files
313  static XrdSutCache cacheAlog; // Autologin file
314  //
315  // Running options / settings
316  static int Debug; // [CS] Debug level
317  static bool Server; // [CS] If server mode
318  static int UserPwd; // [S] Check passwd file in user's <xrdsecdir>
319  static bool SysPwd; // [S] Check system passwd file if allowed
320  static int VeriClnt; // [S] Client verification level
321  static int VeriSrv; // [C] Server verification level
322  static int AutoReg; // [S] Autoreg mode
323  static int LifeCreds; // [S] if > 0, credential lifetime in secs
324  static int MaxPrompts; // [C] Repeating prompt
325  static int MaxFailures; // [S] Max passwd failures before blocking
326  static int AutoLogin; // [C] do-not-check/check/update autolog info
327  static int TimeSkew; // [CS] Allowed skew in secs for time stamps
328  static bool KeepCreds; // [S] Keep / Do-Not-Keep client creds
329  //
330  // for error logging and tracing
331  static XrdSysLogger Logger;
332  static XrdSysError eDest;
333  static XrdOucTrace *SecTrace;
334 
335  // Information local to this instance
336  int options;
337  struct sockaddr hostaddr; // Client-side only
338  char CName[256]; // Client-name
339  bool srvMode; // TRUE if server mode
340 
341  // Handshake local info
342  pwdHSVars *hs;
343 
344  // Acquired credentials (server side)
345  XrdSecCredentials *clientCreds;
346 
347  // Parsing received buffers
348  int ParseClientInput(XrdSutBuffer *br, XrdSutBuffer **bm,
349  String &emsg);
350  int ParseServerInput(XrdSutBuffer *br, XrdSutBuffer **bm,
351  String &cmsg);
352  int ParseCrypto(XrdSutBuffer *buf);
353 
354  // Error functions
355  static void ErrF(XrdOucErrInfo *einfo, kXR_int32 ecode,
356  const char *msg1, const char *msg2 = 0,
357  const char *msg3 = 0);
358  XrdSecCredentials *ErrC(XrdOucErrInfo *einfo, XrdSutBuffer *b1,
359  XrdSutBuffer *b2,XrdSutBuffer *b3,
360  kXR_int32 ecode, const char *msg1 = 0,
361  const char *msg2 = 0, const char *msg3 = 0);
362  int ErrS(String ID, XrdOucErrInfo *einfo, XrdSutBuffer *b1,
363  XrdSutBuffer *b2, XrdSutBuffer *b3,
364  kXR_int32 ecode, const char *msg1 = 0,
365  const char *msg2 = 0, const char *msg3 = 0);
366 
367  // Query methods
368  XrdSutBucket *QueryCreds(XrdSutBuffer *bm, bool netrc, int &status);
369  int QueryUser(int &status, String &cmsg);
370  int QueryCrypt(String &fn, String &pwhash);
371  int QueryNetRc(String host, String &passwd, int &status);
372 
373  // Check credentials
374  bool CheckCreds(XrdSutBucket *creds, int credtype);
375  bool CheckCredsAFS(XrdSutBucket *creds, int ctype);
376 
377  // Check Time stamp
378  bool CheckTimeStamp(XrdSutBuffer *b, int skew, String &emsg);
379 
380  // Check random challenge
381  bool CheckRtag(XrdSutBuffer *bm, String &emsg);
382 
383  // Saving / Updating
384  int ExportCreds(XrdSutBucket *creds);
385  int SaveCreds(XrdSutBucket *creds);
386  int UpdateAlog();
387 
388  // Auxilliary methods
389  int GetUserHost(String &usr, String &host);
390  int AddSerialized(char opt, kXR_int32 step, String ID,
391  XrdSutBuffer *bls, XrdSutBuffer *buf,
392  kXR_int32 type, XrdCryptoCipher *cip);
393  int DoubleHash(XrdCryptoFactory *cf, XrdSutBucket *bck,
394  XrdSutBucket *s1, XrdSutBucket *s2 = 0,
395  const char *tag = 0);
396 };
Generated by   doxygen 1.8.1.2