XrdSecProtocolztn Class Reference

Inheritance diagram for XrdSecProtocolztn:

Collaboration diagram for XrdSecProtocolztn:

Public Member Functions
	XrdSecProtocolztn (const char *hname, XrdNetAddrInfo &endPoint, XrdSciTokensHelper *sthp)
	XrdSecProtocolztn (const char *parms, XrdOucErrInfo *erp, bool &aOK)
	~XrdSecProtocolztn ()
int	Authenticate (XrdSecCredentials *cred, XrdSecParameters **parms, XrdOucErrInfo *einfo=0)
void	Delete ()
	Delete the protocol object. DO NOT use C++ delete() on this object.
XrdSecCredentials *	getCredentials (XrdSecParameters *parms, XrdOucErrInfo *einfo=0)
bool	needTLS ()
	Check if this protocol requires TLS to properly function.
Public Member Functions inherited from XrdSecProtocol
	XrdSecProtocol (const char *pName)
	Constructor.
virtual int	Decrypt (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int	Encrypt (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int	getKey (char *buff=0, int size=0)
virtual int	setKey (char *buff, int size)
virtual int	Sign (const char *inbuff, int inlen, XrdSecBuffer **outbuff)
virtual int	Verify (const char *inbuff, int inlen, const char *sigbuff, int siglen)

Static Public Attributes
static const int	ztnVersion = 0

Additional Inherited Members
Public Attributes inherited from XrdSecProtocol
XrdSecEntity	Entity
Protected Member Functions inherited from XrdSecProtocol
virtual	~XrdSecProtocol ()
	Destructor (prevents use of direct delete).

Detailed Description

Definition at line 182 of file XrdSecProtocolztn.cc.

Constructor & Destructor Documentation

XrdSecProtocolztn() [1/2]

XrdSecProtocolztn::XrdSecProtocolztn	(	const char *	parms,
		XrdOucErrInfo *	erp,
		bool &	aOK )

Definition at line 269 of file XrdSecProtocolztn.cc.

                                    : XrdSecProtocol("ztn"), sthP(0),
                                      tokName(""), ztnInfo(0), maxTSize(0),
                                      cont(false), rtGet(false), verJWT(false)
{
   char *endP;
 
// Assume we will fail
//
   aOK = false;
 
// If there are no parameters then fail as the server must supply them
//
   if (!parms || !(*parms))
      {Fatal(erp, "Client parameters not specified.", EINVAL);
       return;
      }
 
// Server supplied parms: <opts+ver>:<maxtsz>:
 
// The first parameter is the options and version number.
//
   ztnInfo = strtoll(parms, &endP, 10);
   if (*endP != ':')
      {Fatal(erp, "Malformed client parameters.", EINVAL);
       return;
      }
   parms = endP+1;
 
// The second parameter is the maximum token size
//
   maxTSize = strtol(parms, &endP, 10);
   if (maxTSize <= 0 || *endP != ':')
      {Fatal(erp, "Invalid or missing maxtsz parameter.", EINVAL);
       return;
      }
   endP++;
 
// All done here
//
   aOK = true;
}

References XrdSecProtocol::XrdSecProtocol(), and Fatal().

Here is the call graph for this function:

XrdSecProtocolztn() [2/2]

XrdSecProtocolztn::XrdSecProtocolztn ( const char * hname, XrdNetAddrInfo & endPoint, XrdSciTokensHelper * sthp )

inline

Definition at line 204 of file XrdSecProtocolztn.cc.

                         : XrdSecProtocol("ztn"), sthP(sthp), tokName(""),
                           maxTSize(MaxTokSize), cont(false),
                           rtGet(false), verJWT(false)
                         {Entity.host = strdup(hname);
                          Entity.name = strdup("anon");
                          Entity.addrInfo = &endPoint;
                         }

References XrdSecProtocol::XrdSecProtocol(), and XrdSecProtocol::Entity.

Here is the call graph for this function:

~XrdSecProtocolztn()

XrdSecProtocolztn::~XrdSecProtocolztn ( )

inline

Definition at line 214 of file XrdSecProtocolztn.cc.

                            {if (Entity.host) free(Entity.host);
                             if (Entity.name) free(Entity.name);
                             if (Entity.creds)free(Entity.creds);
                            } // via Delete()

References XrdSecProtocol::Entity.

Member Function Documentation

Authenticate()

int XrdSecProtocolztn::Authenticate ( XrdSecCredentials * cred, XrdSecParameters ** parms, XrdOucErrInfo * einfo = 0 )

virtual

Authenticate a client.

Parameters

cred	Credentials supplied by the client.
parms	Place where the address of additional authentication data is to be placed for another autrhentication handshake.
einfo	The error information object where error messages should be placed. The messages are returned to the client. Should einfo be null, messages should be written to stderr.

Returns

> 0 -> parms present (more authentication needed) = 0 -> Entity present (authentication succeeded) < 0 -> einfo present (error has occurred)

Implements XrdSecProtocol.

Definition at line 590 of file XrdSecProtocolztn.cc.

{
   static const int pfxLen = sizeof(TokenHdr) + sizeof(uint16_t);
   TokenResp *tResp;
 
// Check if we have any credentials or if no credentials really needed.
// In either case, use host name as client name
//
   if (cred->size < (int)sizeof(TokenHdr) || !cred->buffer)
      {Fatal(erp, "Invalid ztn credentials", EINVAL, false);
       return -1;
      }
   tResp = (TokenResp *)cred->buffer;
 
// Check if this is our protocol
//
   if (strcmp(tResp->hdr.id, "ztn"))
      {char msg[256];
       snprintf(msg, sizeof(msg),
                "Authentication protocol id mismatch ('ztn' != '%.4s').",
                tResp->hdr.id);
       Fatal(erp, msg, EINVAL, false);
       return -1;
      }
 
// Check if caller wants the list of authorized issuers
//
   if (tResp->hdr.opr == TokenHdr::SndAI) return SendAI(erp, parms);
 
// If this is not a token response then this is an error
//
   if (tResp->hdr.opr != TokenHdr::IsTkn)
      {Fatal(erp, "Invalid ztn response code", EINVAL, false);
       return -1;
      }
 
// Make sure the response is consistent
//
   const char *isBad = 0;
   int tLen = ntohs(tResp->len);
 
        if (tResp->hdr.ver != ztnVersion) isBad = "version mismatch";
   else if (tLen < 1)                     isBad = "token length < 1";
   else if (pfxLen + tLen > cred->size)   isBad = "respdata > credsize";
   else if (!(tResp->tkn[0]))             isBad = "null token";
   else if (*(tResp->tkn+(tLen-1)))       isBad = "missing null byte";
 
   if (isBad)
      {char eText[80];
       snprintf(eText, sizeof(eText), "'ztn' token malformed; %s", isBad);
       Fatal(erp, eText, EINVAL, false);
       return -1;
      }
 
// Validate the token
//
   std::string msgRC;
   long long   eTime;
   bool validated = false;
   if (Entity.name) {free(Entity.name); Entity.name = 0;}
   if (tokenlib && sthP->Validate(tResp->tkn, msgRC, (expiry ? &eTime : 0), &Entity))
      {if (expiry)
          {if (eTime < 0 && expiry > 0)
              {Fatal(erp, "'ztn' token expiry missing", EINVAL, false);
               return -1;
              }
           if ((monotonic_time() - eTime) <= 0)
              {Fatal(erp, "'ztn' token expired", EINVAL, false);
               return -1;
              }
          }
       validated = true;
      }
   if (!tokenlib || validated)
      {
       Entity.credslen = strlen(tResp->tkn);
       if (Entity.creds)
         free(Entity.creds);
       if ((Entity.creds = (char *)malloc(Entity.credslen+1)))
         strcpy(Entity.creds, tResp->tkn);
       else
         Fatal(erp, "'ztn' bad alloc", ENOMEM, false);
       if (!Entity.name) Entity.name = strdup("anon");
       return 0;
      }
 
// Validation failed, generate message and return failure
//
// msgRC.insert(0, "ztn validation failed; ");
   Fatal(erp, msgRC.c_str(), EAUTH, false);
   return -1;
}

References XrdSecBuffer::buffer, EAUTH, XrdSecProtocol::Entity, Fatal(), XrdSecBuffer::size, and ztnVersion.

Here is the call graph for this function:

Delete()

void XrdSecProtocolztn::Delete ( )

inlinevirtual

Delete the protocol object. DO NOT use C++ delete() on this object.

Implements XrdSecProtocol.

Definition at line 190 of file XrdSecProtocolztn.cc.

{delete this;}

getCredentials()

XrdSecCredentials * XrdSecProtocolztn::getCredentials ( XrdSecParameters * parm, XrdOucErrInfo * einfo = 0 )

virtual

Generate client credentials to be used in the authentication process.

Parameters

parm	Pointer to the information returned by the server either in the initial login response or the authmore response.
einfo	The error information object where error messages should be placed. The messages are returned to the client. Should einfo be null, messages should be written to stderr.

Returns

Success: Pointer to credentials to sent to the server. The caller is responsible for deleting the object. Failure: Null pointer with einfo, if supplied, containing the reason for the failure.

Implements XrdSecProtocol.

Definition at line 376 of file XrdSecProtocolztn.cc.

{
   static const char  *dfltLoc[] = {"BEARER_TOKEN",    "BEARER_TOKEN_FILE",
                                    "XDG_RUNTIME_DIR", "/tmp/bt_u%d"};
   static const char **dfltLocEnd = dfltLoc + sizeof(dfltLoc)/sizeof(char*);
   static std::vector<XrdOucString> dfltVec(dfltLoc, dfltLocEnd);
 
   XrdSecCredentials *resp;
   bool isbad;
 
// If this is a continuation, then handle as such
//
   if (cont) return getToken(error, parms);
 
// Handle the default search
//
   resp = findToken(error, dfltVec, isbad);
   if (resp || isbad) return resp;
 
// We do not have a envar value then ask the server for a list of
// token issuers so we can get one, if allowed. Otherwise, it's an error.
//
   if (rtGet)
      {TokenHdr *tHdr = (TokenHdr *)malloc(sizeof(TokenHdr));
       tHdr->Fill(TokenHdr::SndAI);
       cont = true;
       return new XrdSecCredentials((char *)tHdr, sizeof(TokenHdr));
      }
   Fatal(error, "No token found; runtime fetch disallowed.", ENOPROTOOPT);
   return 0;
}

References Fatal().

Here is the call graph for this function:

needTLS()

bool XrdSecProtocolztn::needTLS ( )

inlinevirtual

Check if this protocol requires TLS to properly function.

Reimplemented from XrdSecProtocol.

Definition at line 195 of file XrdSecProtocolztn.cc.

{return true;}

Member Data Documentation

ztnVersion

const int XrdSecProtocolztn::ztnVersion = 0

static

Definition at line 219 of file XrdSecProtocolztn.cc.

Referenced by Authenticate(), and XrdSecProtocolztnInit().

---

The documentation for this class was generated from the following file:

• XrdSecProtocolztn.cc