#include <unistd.h>
#include <cctype>
#include <cerrno>
#include <cstdlib>
#include <strings.h>
#include <cstdio>
#include <sys/param.h>
#include <pwd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <dirent.h>
#include <iostream>
#include "XrdVersion.hh"
#include "XrdNet/XrdNetAddr.hh"
#include "XrdSec/XrdSecEntityAttr.hh"
#include "XrdSys/XrdSysHeaders.hh"
#include "XrdSys/XrdSysLogger.hh"
#include "XrdSys/XrdSysError.hh"
#include "XrdOuc/XrdOucPinLoader.hh"
#include "XrdOuc/XrdOucStream.hh"
#include "XrdOuc/XrdOucEnv.hh"
#include "XrdSut/XrdSutAux.hh"
#include "XrdCrypto/XrdCryptoMsgDigest.hh"
#include "XrdCrypto/XrdCryptoX509Chain.hh"
#include "XrdCrypto/XrdCryptoX509Req.hh"
#include "XrdSecgsi/XrdSecProtocolgsi.hh"
#include "XrdSecgsi/XrdSecgsiOpts.hh"

Include dependency graph for XrdSecProtocolgsi.cc:

Macros
#define	POPTS(t, y) {if (t) {std::cerr <<"Secgsi" <<y <<'\n' << std::flush;}}

Functions
static bool	AuthzFunCheck (XrdSutCacheEntry e, void a)

static const char *	ClientStepStr (int kclt)

static bool	GetCACheck (XrdSutCacheEntry e, void a)

static bool	GetSrvCertEntCheck (XrdSutCacheEntry e, void a)

static bool	QueryGMAPCheck (XrdSutCacheEntry e, void a)

static bool	QueryProxyCheck (XrdSutCacheEntry e, void a)

static const char *	ServerStepStr (int ksrv)

char *	XrdSecProtocolgsiInit (const char mode, const char parms, XrdOucErrInfo erp)

XrdSecProtocol *	XrdSecProtocolgsiObject (const char mode, const char hostname, XrdNetAddrInfo &endPoint, const char parms, XrdOucErrInfo *erp)

	XrdVERSIONINFO (XrdSecProtocolgsiObject, secgsi)

Variables
static const char *	gGSErrStr []

static const char *	gNoPadTag = "nopad"

static const char *	gsiClientSteps []

static const char *	gsiServerSteps []

XrdOucTrace *	gsiTrace = 0

static const char *	gUsrPxyDef = "/tmp/x509up_u"

static const int	kOneDay = 86400

static String	Prefix = "xrd"

static String	ProtoID = XrdSecPROTOIDENT

static const kXR_int32	Version = XrdSecgsiVERSION

Macro Definition Documentation

◆ POPTS

#define POPTS	(	t,
		y
	)	{if (t) {std::cerr <<"Secgsi" <<y <<'\n' << std::flush;}}

Definition at line 68 of file XrdSecProtocolgsi.cc.

Function Documentation

◆ AuthzFunCheck()

static bool AuthzFunCheck	(	XrdSutCacheEntry *	e,
		void *	a
	)

static

Definition at line 1720 of file XrdSecProtocolgsi.cc.

                                                        {
 
   int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
   time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
   long to_ref = (*((XrdSutCacheArg_t *)a)).arg3;
   int st_exp = (*((XrdSutCacheArg_t *)a)).arg4;
 
   if (e && (e->status == st_ref)) {
      // Check expiration, if required
      bool expired = 0;
      if (to_ref > 0 && (ts_ref - e->mtime) > to_ref) expired = 1;
      int notafter = *((int *) e->buf2.buf);
      if (to_ref > notafter) expired = 1;
 
      if (expired) {
         // Invalidate the entry, if the case
         e->status = st_exp;
      } else {
         return true;
      }
   }
   return false;
}

References XrdSutCacheEntryBuf::buf, XrdSutCacheEntry::buf2, XrdSutCacheEntry::mtime, and XrdSutCacheEntry::status.

Referenced by XrdSecProtocolgsi::Authenticate().

Here is the caller graph for this function:

◆ ClientStepStr()

static const char * ClientStepStr ( int kclt )

static

Definition at line 223 of file XrdSecProtocolgsi.cc.

{
   // Return string with client step  
   static const char *ukn = "Unknown";
 
   kclt = (kclt < 0) ? 0 : kclt;
   kclt = (kclt > kXGC_reserved) ? 0 : kclt;
   kclt = (kclt >= kXGC_certreq) ? (kclt - kXGC_certreq + 1) : kclt;
 
   if (kclt < 0 || kclt > (kXGC_reserved - kXGC_certreq + 1))
      return ukn;  
   else
      return gsiClientSteps[kclt];
}

References gsiClientSteps, kXGC_certreq, and kXGC_reserved.

Referenced by XrdSecProtocolgsi::Authenticate(), XrdSecProtocolpwd::Authenticate(), XrdSecProtocolgsi::getCredentials(), and XrdSecProtocolpwd::getCredentials().

Here is the caller graph for this function:

◆ GetCACheck()

static bool GetCACheck	(	XrdSutCacheEntry *	e,
		void *	a
	)

static

Definition at line 4623 of file XrdSecProtocolgsi.cc.

                                                     {
 
   EPNAME("GetCACheck");
 
   int crl_check = (*((XrdSutCacheArg_t *)a)).arg1;
   int crl_refresh = (*((XrdSutCacheArg_t *)a)).arg2;
   time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg3;
 
   if (!e) return false;
 
   X509Chain *chain = 0;
   // If we had already something, check it, as we may be done
   bool goodca = 0;
   if ((chain = (X509Chain *)(e->buf1.buf))) {
      // Check the validity of the certificates in the chain; if a certificate became invalid,
      // we need to reload a valid one for the same CA.
      if (chain->CheckValidity() == 0) {
         goodca = 1;
      } else {
         PRINT("CA entry for '"<<e->name<<"' needs refreshing: clean the related entry cache first");
         return false;
      }
   }
   if (goodca) {
      XrdCryptoX509Crl *crl = (XrdCryptoX509Crl *)(e->buf2.buf);
      bool goodcrl = 1;
      if ((crl_check == 2 && !crl) || (crl_check == 3 && crl->IsExpired())) goodcrl = 0;
      if (crl_refresh > 0 && ((ts_ref - e->mtime) > crl_refresh)) goodcrl = 0;
      if (goodcrl) {
         return true;
      } else if (crl) {
         PRINT("CRL entry for '"<<e->name<<"' needs refreshing: clean the related entry cache first ("<<e<<")");
      }
   }
   return false;
}

References XrdSutCacheEntryBuf::buf, XrdSutCacheEntry::buf1, XrdSutCacheEntry::buf2, XrdCryptoX509Chain::CheckValidity(), EPNAME, XrdCryptoX509Crl::IsExpired(), XrdSutCacheEntry::mtime, XrdSutCacheEntry::name, and PRINT.

Here is the call graph for this function:

◆ GetSrvCertEntCheck()

static bool GetSrvCertEntCheck	(	XrdSutCacheEntry *	e,
		void *	a
	)

static

Definition at line 5685 of file XrdSecProtocolgsi.cc.

                                                             {
   int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
   time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
   if (e) {
      if (e->status > st_ref) {
         if (e->mtime >= ts_ref)
            return true;
      }
   }
   return false;
}

References XrdSutCacheEntry::mtime, and XrdSutCacheEntry::status.

◆ QueryGMAPCheck()

static bool QueryGMAPCheck	(	XrdSutCacheEntry *	e,
		void *	a
	)

static

Definition at line 5265 of file XrdSecProtocolgsi.cc.

                                                         {
   int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
   time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
   long to_ref = (*((XrdSutCacheArg_t *)a)).arg3;
   if (e) {
      // Check expiration, if required
      if ((e->status != st_ref) ||
          ((e->status == st_ref) &&
           (to_ref > 0) &&
           ((ts_ref - e->mtime) > to_ref))) {
         return false;
      } else {
         return true;
      }
   }
   return false;
}

References XrdSutCacheEntry::mtime, and XrdSutCacheEntry::status.

◆ QueryProxyCheck()

static bool QueryProxyCheck	(	XrdSutCacheEntry *	e,
		void *	a
	)

static

Definition at line 5040 of file XrdSecProtocolgsi.cc.

                                                          {
 
   time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg1;
 
   if (e && e->buf1.buf) {
      X509Chain *chain = (X509Chain *)(e->buf1.buf);
      if (chain->CheckValidity(1, ts_ref) == 0) return true;
   }
   return false;
}

References XrdSutCacheEntryBuf::buf, XrdSutCacheEntry::buf1, and XrdCryptoX509Chain::CheckValidity().

Here is the call graph for this function:

◆ ServerStepStr()

static const char * ServerStepStr ( int ksrv )

static

Definition at line 239 of file XrdSecProtocolgsi.cc.

{
   // Return string with server step  
   static const char *ukn = "Unknown";
 
   ksrv = (ksrv < 0) ? 0 : ksrv;
   ksrv = (ksrv > kXGS_reserved) ? 0 : ksrv;
   ksrv = (ksrv >= kXGS_init) ? (ksrv - kXGS_init + 1) : ksrv;
 
   if (ksrv < 0 || ksrv > (kXGS_reserved - kXGS_init + 1))
      return ukn;  
   else
      return gsiServerSteps[ksrv];
}

References gsiServerSteps, kXGS_init, and kXGS_reserved.

Referenced by XrdSecProtocolgsi::Authenticate(), XrdSecProtocolpwd::Authenticate(), XrdSecProtocolgsi::getCredentials(), and XrdSecProtocolpwd::getCredentials().

Here is the caller graph for this function:

◆ XrdSecProtocolgsiInit()

char * XrdSecProtocolgsiInit	(	const char	mode,
		const char *	parms,
		XrdOucErrInfo *	erp
	)

Definition at line 2373 of file XrdSecProtocolgsi.cc.

{
   // One-time protocol initialization, filling the static flags and options
   // of the protocol.
   // For clients (mode == 'c') we use values in envs.
   // For servers (mode == 's') the command line options are passed through
   // parms.
   EPNAME("ProtocolgsiInit");
 
   gsiOptions opts;
   char *rc = (char *)"";
   char *cenv = 0;
 
   // Initiate error logging and tracing
   gsiTrace = XrdSecProtocolgsi::EnableTracing();
 
   //
   // Clients first
   if (mode == 'c') {
      //
      // Decode envs:
      //             "XrdSecDEBUG"           debug flag ("0","1","2","3")
      //             "XrdSecGSICADIR"        full path to an alternative path
      //                                     containing the CA info
      //                                     [/etc/grid-security/certificates]
      //             "XrdSecGSICRLDIR"       full path to an alternative path
      //                                     containing the CRL info
      //                                     [/etc/grid-security/certificates]
      //             "XrdSecGSICRLEXT"       default extension of CRL files [.r0]
      //             "XrdSecGSIUSERCERT"     full path to an alternative file
      //                                     containing the user certificate
      //                                     [$HOME/.globus/usercert.pem]
      //             "XrdSecGSIUSERKEY"      full path to an alternative file
      //                                     containing the user key
      //                                     [$HOME/.globus/userkey.pem]
      //             "XrdSecGSIUSERPROXY"    full path to an alternative file
      //                                     containing the user proxy
      //                                     [/tmp/x509up_u<uid>]
      //             "XrdSecGSIPROXYVALID"   validity of proxies in the 
      //                                     grid-proxy-init format
      //                                     ["12:00", i.e. 12 hours]
      //             "XrdSecGSIPROXYDEPLEN"  depth of signature path for proxies;
      //                                     use -1 for unlimited [0]
      //             "XrdSecGSIPROXYKEYBITS" bits in PKI for proxies [default: XrdCryptoDefRSABits]
      //             "XrdSecGSICACHECK"      CA check level [1]:
      //                                      0 do not verify;
      //                                      1 verify if self-signed, warn if not;
      //                                      2 verify in all cases, fail if not possible
      //             "XrdSecGSICRLCHECK"     CRL check level [2]:
      //                                      0 don't care;
      //                                      1 use if available;
      //                                      2 require,
      //                                      3 require non-expired CRL
      //             "XrdSecGSIDELEGPROXY"   Forwarding of credentials option:
      //                                     0 deny; 1 sign request created
      //                                     by server; 2 forward local proxy
      //                                     (include private key) [1]
      //             "XrdSecGSICREATEPROXY"  Controls use of proxy [1]:
      //                                       1 auto-generate proxy from the cert/key pair if no one is not found
      //                                       0 a proxy is used if present; else, the cert/key pair is used if present.
      //             "XrdSecGSISRVNAMES"     Server names allowed: if the server CN
      //                                     does not match any of these, or it is
      //                                     explicitely denied by these, or it is
      //                                     not in the form "*/<hostname>", the
      //                                     handshake fails.
      //             "XrdSecGSIUSEDEFAULTHASH" If this variable is set only the default
      //                                     name hashing algorithm is used
 
      //
      opts.mode = mode;
      // debug
      cenv = getenv("XrdSecDEBUG");
      if (cenv)
         {if (cenv[0] >= 49 && cenv[0] <= 51) opts.debug = atoi(cenv);
             else {PRINT("unsupported debug value from env XrdSecDEBUG: "<<cenv<<" - setting to 1");
                   opts.debug = 1;
                  }
         }
 
      // directory with CA certificates
      cenv = (getenv("XrdSecGSICADIR") ? getenv("XrdSecGSICADIR")
                                       : getenv("X509_CERT_DIR"));
      if (cenv)
         opts.certdir = strdup(cenv);
 
      // directory with CRL info
      cenv = (getenv("XrdSecGSICRLDIR") ? getenv("XrdSecGSICRLDIR")
                                        : getenv("X509_CERT_DIR"));
      if (cenv)
         opts.crldir = strdup(cenv);
 
      // Default extension CRL files
      cenv = getenv("XrdSecGSICRLEXT");
      if (cenv)
         opts.crlext = strdup(cenv);
 
      // CRL refresh or expiration time
      cenv = getenv("XrdSecGSICRLRefresh");
      if (cenv)
         opts.crlrefresh = atoi(cenv);
 
      // file with user cert
      cenv = (getenv("XrdSecGSIUSERCERT") ? getenv("XrdSecGSIUSERCERT")
                                          : getenv("X509_USER_CERT"));
      if (cenv)
         opts.cert = strdup(cenv);
 
      // file with user key
      cenv = (getenv("XrdSecGSIUSERKEY") ? getenv("XrdSecGSIUSERKEY")
                                         : getenv("X509_USER_KEY"));
      if (cenv)
         opts.key = strdup(cenv);
 
      // file with user proxy
      cenv = (getenv("XrdSecGSIUSERPROXY") ? getenv("XrdSecGSIUSERPROXY")
                                           : getenv("X509_USER_PROXY"));
      if (cenv)
         opts.proxy = strdup(cenv);
 
      // file with user proxy
      cenv = getenv("XrdSecGSIPROXYVALID");
      if (cenv)
         opts.valid = strdup(cenv);
 
      // Depth of signature path for proxies
      cenv = getenv("XrdSecGSIPROXYDEPLEN");
      if (cenv)
         opts.deplen = atoi(cenv);
 
      // Key Bit length 
      cenv = getenv("XrdSecGSIPROXYKEYBITS");
      if (cenv)
         opts.bits = atoi(cenv);
 
      // CA verification level 
      cenv = getenv("XrdSecGSICACHECK");
      if (cenv)
         opts.ca = atoi(cenv);
 
      // CRL check level 
      cenv = getenv("XrdSecGSICRLCHECK");
      if (cenv)
         opts.crl = atoi(cenv);
 
      // Delegate proxy
      cenv = getenv("XrdSecGSIDELEGPROXY");
      if (cenv)
         opts.dlgpxy = atoi(cenv);
 
      // No proxy
      cenv = getenv("XrdSecGSICREATEPROXY");
      if (cenv)
         opts.createpxy = atoi(cenv);
 
      // Allowed server name formats
      cenv = getenv("XrdSecGSISRVNAMES");
      if (cenv)
         opts.srvnames = strdup(cenv);
 
      // Name hashing algorithm
      cenv = getenv("XrdSecGSIUSEDEFAULTHASH");
      if (cenv)
         opts.hashcomp = 0;
 
      // DNS trusting control
      if ((cenv = getenv("XrdSecGSITRUSTDNS")))
         opts.trustdns = (!strcmp(cenv, "0")) ? false : true;
 
      //
      // Setup the object with the chosen options
      rc = XrdSecProtocolgsi::Init(opts,erp);
 
      // Notify init options, if required or in case of init errors
      if (!rc) opts.debug = 1;
      opts.Print(gsiTrace);
 
      // Some cleanup
      SafeFree(opts.certdir);
      SafeFree(opts.crldir);
      SafeFree(opts.crlext);
      SafeFree(opts.cert);
      SafeFree(opts.key);
      SafeFree(opts.proxy);
      SafeFree(opts.valid);
      SafeFree(opts.srvnames);
 
      // We are done
      return rc;
   }
 
   // Take into account xrootd debug flag
   cenv = getenv("XRDDEBUG");
   if (cenv && !strcmp(cenv,"1")) opts.debug = 1;
 
   //
   // Server initialization
   if (parms) {
      //
      // Duplicate the parms
      char parmbuff[1024];
      strlcpy(parmbuff, parms, sizeof(parmbuff));
      //
      // The tokenizer
      XrdOucTokenizer inParms(parmbuff);
      //
      // Decode parms:
      // for servers:
      //              [-d:<debug_level>]
      //              [-c:[-]ssl[:[-]<CryptoModuleName]]
      //              [-certdir:<dir_with_CA_info>]
      //              [-crldir:<dir_with_CRL_info>]
      //              [-crlext:<default_extension_CRL_files>]
      //              [-cert:<path_to_server_certificate>]
      //              [-key:<path_to_server_key>]
      //              [-cipher:<list_of_supported_ciphers>]
      //              [-md:<list_of_supported_digests>]
      //              [-ca:<crl_verification_level>]
      //              [-crl:<crl_check_level>]
      //              [-crlrefresh:<crl_refresh_time>]
      //              [-gridmap:<grid_map_file>]
      //              [-gmapfun:<grid_map_function>]
      //              [-gmapfunparms:<grid_map_function_init_parameters>]
      //              [-authzcall:<authz_callopt>]
      //              [-authzfun:<authz_function>]
      //              [-authzfunparms:<authz_function_init_parameters>]
      //              [-authzto:<authz_cache_entry_validity_in_secs>]
      //              [-gmapto:<grid_map_cache_entry_validity_in_secs>]
      //              [-gmapopt:<grid_map_check_option>]
      //              [-dlgpxy:<proxy_req_option>]
      //              [-exppxy:<filetemplate>]
      //              [-authzpxy]
      //              [-vomsat:<voms_option>]
      //              [-vomsfun:<voms_function>]
      //              [-vomsfunparms:<voms_function_init_parameters>]
      //              [-defaulthash]
      //              [-trustdns:<0|1>]
      //
      int debug = -1;
      String clist = "";
      String certdir = "";
      String crldir = "";
      String crlext = "";
      String cert = "";
      String key = "";
      String cipher = "";
      String md = "";
      String gridmap = "";
      String gmapfun = "";
      String gmapfunparms = "";
      String authzfun = "";
      String authzfunparms = "";
      String vomsfun = "";
      String vomsfunparms = "";
      String exppxy = "";
      int ca = 1;
      int crl = 1;
      int crlrefresh = 86400;
      int ogmap = 1;
      int gmapto = 600;
      int authzto = -1;
      int authzcall = 1;
      int dlgpxy = dlgIgnore;
      int authzpxy = 0;
      int vomsat = vatIgnore; // Was 1 or extract
      int moninfo = 0;
      int hashcomp = 1;
      int trustdns = false;
      int showDN = false;
      char *op = 0;
      while (inParms.GetLine()) { 
         while ((op = inParms.GetToken())) {
            if (!strncmp(op, "-d:",3)) {
               debug = atoi(op+3);
            } else if (!strncmp(op, "-c:",3)) {
               clist = (const char *)(op+3);
            } else if (!strncmp(op, "-certdir:",9)) {
               certdir = (const char *)(op+9);
            } else if (!strncmp(op, "-crldir:",8)) {
               crldir = (const char *)(op+8);
            } else if (!strncmp(op, "-crlext:",8)) {
               crlext = (const char *)(op+8);
            } else if (!strncmp(op, "-cert:",6)) {
               cert = (const char *)(op+6);
            } else if (!strncmp(op, "-key:",5)) {
               key = (const char *)(op+5);
            } else if (!strncmp(op, "-cipher:",8)) {
               cipher = (const char *)(op+8);
            } else if (!strncmp(op, "-md:",4)) {
               md = (const char *)(op+4);
            } else if (!strncmp(op, "-ca:",4)) {
               ca = getOptVal(caVerOpts, op+4);
               ca = atoi(op+4);
            } else if (!strncmp(op, "-crl:",5)) {
               crl = getOptVal(crlOpts, op+5);
            } else if (!strncmp(op, "-crlrefresh:",12)) {
               crlrefresh = atoi(op+12);
            } else if (!strncmp(op, "-gmapopt:",9)) {
               ogmap = getOptVal(gmoOpts, op+9);
            } else if (!strncmp(op, "-gridmap:",9)) {
               gridmap = (const char *)(op+9);
            } else if (!strncmp(op, "-gmapfun:",9)) {
               gmapfun = (const char *)(op+9);
            } else if (!strncmp(op, "-gmapfunparms:",14)) {
               gmapfunparms = (const char *)(op+14);
            } else if (!strncmp(op, "-authzcall:",11)) {
               authzcall = getOptVal(azCallOpts, op+11);
            } else if (!strncmp(op, "-authzfun:",10)) {
               authzfun = (const char *)(op+10);
            } else if (!strncmp(op, "-authzfunparms:",15)) {
               authzfunparms = (const char *)(op+15);
            } else if (!strncmp(op, "-authzto:",9)) {
               authzto = atoi(op+9);
            } else if (!strncmp(op, "-gmapto:",8)) {
               gmapto = atoi(op+8);
            } else if (!strncmp(op, "-dlgpxy:",8)) {
               opts.dlgpxy = getOptVal(sDlgOpts, op+8);
            } else if (!strncmp(op, "-exppxy:",8)) {
               exppxy = (const char *)(op+8);
            } else if (!strncmp(op, "-authzpxy:",10)) {
               opts.authzpxy = getOptVal(azPxyOpts, op+10);
            } else if (!strncmp(op, "-authzpxy",9)) {
               authzpxy = 11;
            } else if (!strncmp(op, "-vomsat:",8)) {
               vomsat = getOptVal(vomsatOpts, op+8);
               if (vomsat != vatIgnore && vomsfun.length() == 0)
                  vomsfun = "default";
            } else if (!strncmp(op, "-vomsfun:",9)) {
               vomsfun = (const char *)(op+9);
            } else if (!strncmp(op, "-vomsfunparms:",14)) {
               vomsfunparms = (const char *)(op+14);
            } else if (!strcmp(op, "-moninfo")) {
               moninfo = 1;
            } else if (!strncmp(op, "-moninfo:",9)) {
               moninfo = atoi(op+9);
            } else if (!strcmp(op, "-defaulthash")) {
               hashcomp = 0;
            } else if (!strncmp(op, "-trustdns:",10)) {
               trustdns = getOptVal(tdnsOpts, op+10);
            } else if (!strncmp(op, "-showdn:",8)) {
               showDN = getOptVal(tdnsOpts, op+8);
            } else {
               PRINT("ignoring unknown switch: "<<op);
            }
         }
      }
 
      // If vomsfun is 'default' substitute the default plugin. The go on to
      // resolve conflicts between vomsfun and vomsat options. So, if vomsfun
      // was specified but vomsat is set to 'ignore' then we set vomsat to be
      // 'required'.
      //
      if (vomsfun.length() > 0)
         {if (vomsat == vatIgnore) vomsat = vatExtract;
          if (vomsfun == "default") vomsfun =  LIB_XRDVOMS;
         } else authzcall = azAlways;
 
      //
      // Build the option object
      opts.debug = (debug > -1) ? debug : opts.debug;
      opts.mode = 's';
      opts.ca = ca;
      opts.crl = crl;
      opts.crlrefresh = crlrefresh;
      opts.ogmap = ogmap;
      opts.gmapto = gmapto;
      opts.authzcall = authzcall;
      opts.authzto = authzto;
      opts.dlgpxy = (dlgpxy >= dlgIgnore && dlgpxy <= dlgReqSign) ? dlgpxy : 0;
      opts.authzpxy = authzpxy;
      opts.vomsat = vomsat;
      opts.moninfo = moninfo;
      opts.hashcomp = hashcomp;
      opts.trustdns = (trustdns <= 0) ? false : true;
      opts.showDN = (showDN > 0) ? true : false;
      if (clist.length() > 0)
         opts.clist = (char *)clist.c_str();
      if (certdir.length() > 0)
         opts.certdir = (char *)certdir.c_str();
      if (crldir.length() > 0)
         opts.crldir = (char *)crldir.c_str();
      if (crlext.length() > 0)
         opts.crlext = (char *)crlext.c_str();
      if (cert.length() > 0)
         opts.cert = (char *)cert.c_str();
      if (key.length() > 0)
         opts.key = (char *)key.c_str();
      if (cipher.length() > 0)
         opts.cipher = (char *)cipher.c_str();
      if (md.length() > 0)
         opts.md = (char *)md.c_str();
      if (gridmap.length() > 0)
         opts.gridmap = (char *)gridmap.c_str();
      if (gmapfun.length() > 0)
         opts.gmapfun = (char *)gmapfun.c_str();
      if (gmapfunparms.length() > 0)
         opts.gmapfunparms = (char *)gmapfunparms.c_str();
      if (authzfun.length() > 0)
         opts.authzfun = (char *)authzfun.c_str();
      if (authzfunparms.length() > 0)
         opts.authzfunparms = (char *)authzfunparms.c_str();
      if (exppxy.length() > 0)
         opts.exppxy = (char *)exppxy.c_str();
      if (vomsfun.length() > 0)
         opts.vomsfun = (char *)vomsfun.c_str();
      if (vomsfunparms.length() > 0)
         opts.vomsfunparms = (char *)vomsfunparms.c_str();
 
      // Notify init options, if required
      opts.Print(gsiTrace);
 
      //
      // Setup the plug-in with the chosen options
      return XrdSecProtocolgsi::Init(opts,erp);
   }
 
   // Notify init options, if required
   opts.Print(gsiTrace);
   //
   // Setup the plug-in with the defaults
   return XrdSecProtocolgsi::Init(opts,erp);
}}

References XrdOucString::c_str(), myOpts::debug, XrdSecProtocolgsi::EnableTracing(), EPNAME, XrdOucTokenizer::GetLine(), XrdOucTokenizer::GetToken(), gsiTrace, XrdSecProtocolgsi::Init(), XrdOucString::length(), LIB_XRDVOMS, opts, PRINT, SafeFree, and strlcpy().

Here is the call graph for this function:

◆ XrdSecProtocolgsiObject()

XrdSecProtocol * XrdSecProtocolgsiObject	(	const char	mode,
		const char *	hostname,
		XrdNetAddrInfo &	endPoint,
		const char *	parms,
		XrdOucErrInfo *	erp
	)

Definition at line 2808 of file XrdSecProtocolgsi.cc.

{
   XrdSecProtocolgsi *prot;
   int options = XrdSecNOIPCHK;
 
   //
   // Get a new protocol object
   if (!(prot = new XrdSecProtocolgsi(options, hostname, endPoint, parms))) {
      const char *msg = "Secgsi: Insufficient memory for protocol.";
      if (erp) 
         erp->setErrInfo(ENOMEM, msg);
      else 
         std::cerr <<msg <<std::endl;
      return (XrdSecProtocol *)0;
   }
   //
   // We are done
   if (!erp)
      std::cerr << "protocol object instantiated" << std::endl;
   return prot;
}}

References XrdOucErrInfo::setErrInfo(), and XrdSecNOIPCHK.

Here is the call graph for this function:

◆ XrdVERSIONINFO()

XrdVERSIONINFO	(	XrdSecProtocolgsiObject	,
		secgsi
	)

Variable Documentation

◆ gGSErrStr

const char* gGSErrStr[]

static

Initial value:

= {
   "ErrParseBuffer",               
   "ErrDecodeBuffer",              
   "ErrLoadCrypto",                
   "ErrBadProtocol",               
   "ErrCreateBucket",              
   "ErrDuplicateBucket",           
   "ErrCreateBuffer",              
   "ErrSerialBuffer",              
   "ErrGenCipher",                 
   "ErrExportPuK",                 
   "ErrEncRndmTag",                
   "ErrBadRndmTag",                
   "ErrNoRndmTag",                 
   "ErrNoCipher",                  
   "ErrNoCreds",                   
   "ErrBadOpt",                    
   "ErrMarshal",                   
   "ErrUnmarshal",                 
   "ErrSaveCreds",                 
   "ErrNoBuffer",                  
   "ErrRefCipher",                 
   "ErrNoPublic",                  
   "ErrAddBucket",                 
   "ErrFinCipher",                 
   "ErrInit",                      
   "ErrBadCreds",                  
   "ErrError"                      
}

Definition at line 97 of file XrdSecProtocolgsi.cc.

                                 {
   "ErrParseBuffer",               // 10000
   "ErrDecodeBuffer",              // 10001
   "ErrLoadCrypto",                // 10002
   "ErrBadProtocol",               // 10003
   "ErrCreateBucket",              // 10004
   "ErrDuplicateBucket",           // 10005
   "ErrCreateBuffer",              // 10006
   "ErrSerialBuffer",              // 10007
   "ErrGenCipher",                 // 10008
   "ErrExportPuK",                 // 10009
   "ErrEncRndmTag",                // 10010
   "ErrBadRndmTag",                // 10011
   "ErrNoRndmTag",                 // 10012
   "ErrNoCipher",                  // 10013
   "ErrNoCreds",                   // 10014
   "ErrBadOpt",                    // 10015
   "ErrMarshal",                   // 10016
   "ErrUnmarshal",                 // 10017
   "ErrSaveCreds",                 // 10018
   "ErrNoBuffer",                  // 10019
   "ErrRefCipher",                 // 10020
   "ErrNoPublic",                  // 10021
   "ErrAddBucket",                 // 10022
   "ErrFinCipher",                 // 10023
   "ErrInit",                      // 10024
   "ErrBadCreds",                  // 10025
   "ErrError"                      // 10026  
};

◆ gNoPadTag

const char* gNoPadTag = "nopad"

static

Definition at line 132 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::getCredentials(), and XrdSecProtocolgsi::Init().

◆ gsiClientSteps

const char* gsiClientSteps[]

static

Initial value:

= {
   "kXGC_none",
   "kXGC_certreq",
   "kXGC_cert",
   "kXGC_sigpxy",
   "kXGC_reserved"
}

Definition at line 81 of file XrdSecProtocolgsi.cc.

                                      {
   "kXGC_none",
   "kXGC_certreq",
   "kXGC_cert",
   "kXGC_sigpxy",
   "kXGC_reserved"
};

Referenced by ClientStepStr().

◆ gsiServerSteps

const char* gsiServerSteps[]

static

Initial value:

= {
   "kXGS_none",
   "kXGS_init",
   "kXGS_cert",
   "kXGS_pxyreq",
   "kXGS_reserved"
}

Definition at line 89 of file XrdSecProtocolgsi.cc.

                                      {
   "kXGS_none",
   "kXGS_init",
   "kXGS_cert",
   "kXGS_pxyreq",
   "kXGS_reserved"
};

Referenced by ServerStepStr().

◆ gsiTrace

XrdOucTrace* gsiTrace = 0

Definition at line 217 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::Init(), and XrdSecProtocolgsiInit().

◆ gUsrPxyDef

const char* gUsrPxyDef = "/tmp/x509up_u"

static

Definition at line 130 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::Init(), and gsiOptions::Print().

◆ kOneDay

const int kOneDay = 86400

static

Definition at line 128 of file XrdSecProtocolgsi.cc.

◆ Prefix

String Prefix = "xrd"

static

Definition at line 77 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolpwd::Init().

◆ ProtoID

String ProtoID = XrdSecPROTOIDENT

static

Definition at line 78 of file XrdSecProtocolgsi.cc.

◆ Version

const kXR_int32 Version = XrdSecgsiVERSION

static

Definition at line 79 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::XrdSecProtocolgsi(), XrdSecProtocolpwd::XrdSecProtocolpwd(), XrdSecProtocolgsi::getCredentials(), XrdSecProtocolpwd::getCredentials(), XrdSecProtocolgsi::Init(), and XrdSecProtocolpwd::Init().

Macros

Functions

Variables

Macro Definition Documentation

◆ POPTS

Function Documentation

◆ AuthzFunCheck()

◆ ClientStepStr()

◆ GetCACheck()

◆ GetSrvCertEntCheck()

◆ QueryGMAPCheck()

◆ QueryProxyCheck()

◆ ServerStepStr()

◆ XrdSecProtocolgsiInit()

◆ XrdSecProtocolgsiObject()

◆ XrdVERSIONINFO()

Variable Documentation

◆ gGSErrStr

◆ gNoPadTag

◆ gsiClientSteps

◆ gsiServerSteps

◆ gsiTrace

◆ gUsrPxyDef

◆ kOneDay

◆ Prefix

◆ ProtoID

◆ Version