00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00091
00092
00093
00094 #include "lcas_config.h"
00095 #include <stdio.h>
00096 #include <stdlib.h>
00097 #include <string.h>
00098 #include <pwd.h>
00099 #include <sys/types.h>
00100 #include <sys/stat.h>
00101 #include <unistd.h>
00102 #include <libgen.h>
00103 #include <openssl/x509.h>
00104 #include <errno.h>
00105 #include "gssapi.h"
00106
00107 #include "lcas_modules.h"
00108 #include "lcas_voms_utils.h"
00109 #include "lcas_vo_data.h"
00110 #include "lcas_gridlist.h"
00111
00112 #include "voms_apic.h"
00113 #include "gacl.h"
00114 #include "globus_gss_assist.h"
00115
00116 #undef TESTBIO
00117 #ifdef TESTBIO
00118 # include <openssl/pem.h>
00119 # include <openssl/bio.h>
00120 #endif
00121
00122
00123
00124
00125
00126
00127 #define VOMS_BUFFER_SIZE 1024
00128
00129
00130
00131
00137 typedef enum authformat_e
00138 {
00139 NO_FORMAT,
00140 SIMPLE_FORMAT,
00141 GACL_FORMAT,
00142 XACML_FORMAT,
00143 }
00144 authformat_t;
00145
00146 typedef enum gacl_use_voms_dn_e
00147 {
00148 ALWAYS_USE_VOMS_DN,
00149 USE_VOMS_DN,
00150 DONT_USE_VOMS_DN,
00151 }
00152 gacl_use_voms_dn_t;
00153
00154
00155
00156
00157 static void print_vomsdata(struct vomsdata *);
00158 static void print_vomsdata(struct vomsdata *);
00159 static int lcas_check_gacl(GACLuser *, char *);
00160 static int lcas_gacl_add_dn(GACLuser **, char *);
00161 static int lcas_gacl_add_vomsdata(GACLuser **, lcas_vo_data_t *, char *);
00162
00163 #ifdef TESTBIO
00164 static STACK_OF(X509) *load_chain(char *certfile);
00165 static char *retmsg[] = { "VERR_NONE", "VERR_NOSOCKET", "VERR_NOIDENT", "VERR_COMM",
00166 "VERR_PARAM", "VERR_NOEXT", "VERR_NOINIT",
00167 "VERR_TIME", "VERR_IDCHECK", "VERR_EXTRAINFO",
00168 "VERR_FORMAT", "VERR_NODATA", "VERR_PARSE",
00169 "VERR_DIR", "VERR_SIGN", "VERR_SERVER",
00170 "VERR_MEM", "VERR_VERIFY", "VERR_IDENT",
00171 "VERR_TYPE", "VERR_ORDER" };
00172 #endif
00173
00174
00175
00176
00177
00178
00179 static authformat_t authformat = NO_FORMAT;
00180 static char * authfile = NULL;
00181 static char * certdir = NULL;
00182 static char * vomsdir = NULL;
00183 static char voms_buffer[VOMS_BUFFER_SIZE];
00184 static authformat_t gacl_use_voms_dn = USE_VOMS_DN;
00185 static int use_user_dn = 0;
00186
00187 #ifdef TESTBIO
00188 static STACK_OF(X509) *load_chain(char *certfile)
00189 {
00190 STACK_OF(X509_INFO) *sk=NULL;
00191 STACK_OF(X509) *stack=NULL, *ret=NULL;
00192 BIO *in=NULL;
00193 X509_INFO *xi;
00194 int first = 1;
00195
00196 if(!(stack = sk_X509_new_null()))
00197 {
00198 printf("%s: memory allocation failure\n", logstr);
00199 goto end;
00200 }
00201
00202 if(!(in=BIO_new_file(certfile, "r")))
00203 {
00204 printf("%s: error opening the file, %s\n", logstr,certfile);
00205 goto end;
00206 }
00207
00208
00209 if(!(sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL)))
00210 {
00211 printf("%s: error reading the file, %s\n", logstr,certfile);
00212 goto end;
00213 }
00214
00215
00216 while (sk_X509_INFO_num(sk))
00217 {
00218
00219 if (first)
00220 {
00221 first = 0;
00222 continue;
00223 }
00224 xi=sk_X509_INFO_shift(sk);
00225 if (xi->x509 != NULL)
00226 {
00227 sk_X509_push(stack,xi->x509);
00228 xi->x509=NULL;
00229 }
00230 X509_INFO_free(xi);
00231 }
00232 if(!sk_X509_num(stack))
00233 {
00234 printf("%s: no certificates in file, %s\n", logstr,certfile);
00235 sk_X509_free(stack);
00236 goto end;
00237 }
00238 ret=stack;
00239 end:
00240 BIO_free(in);
00241 sk_X509_INFO_free(sk);
00242 return(ret);
00243 }
00244 #endif
00245
00246
00247
00248
00249
00250
00251
00252
00253
00254
00255
00256
00257
00258 int plugin_initialize(
00259 int argc,
00260 char ** argv
00261 )
00262 {
00263 struct stat buf;
00264 char * logstr = "\tlcas_plugin_voms-plugin_initialize()";
00265 char * authfilecopy = NULL;
00266 char * authfilebase = NULL;
00267 int i;
00268
00269 lcas_log_debug(1,"%s: passed arguments:\n", logstr);
00270 for (i=0; i < argc; i++)
00271 {
00272 lcas_log_debug(2,"%s: arg %d is %s\n", logstr, i, argv[i]);
00273 }
00274
00275
00276
00277
00278
00279
00280
00281
00282
00283 for (i = 1; i < argc; i++)
00284 {
00285 if ( ((strcmp(argv[i], "-vomsdir") == 0) ||
00286 (strcmp(argv[i], "-VOMSDIR") == 0))
00287 && (i + 1 < argc))
00288 {
00289 if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
00290 {
00291 vomsdir = strdup(argv[i + 1]);
00292 }
00293 i++;
00294 }
00295 else if ( ((strcmp(argv[i], "-certdir") == 0) ||
00296 (strcmp(argv[i], "-CERTDIR") == 0))
00297 && (i + 1 < argc))
00298 {
00299 if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
00300 {
00301 certdir = strdup(argv[i + 1]);
00302 }
00303 i++;
00304 }
00305 else if ((strcmp(argv[i], "-authfile") == 0)
00306 && (i + 1 < argc))
00307 {
00308 if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
00309 {
00310 authfile = strdup(argv[i + 1]);
00311 }
00312 i++;
00313 }
00314 else if ((strcmp(argv[i], "-authformat") == 0)
00315 && (i + 1 < argc))
00316 {
00317 if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
00318 {
00319 if ( (strcmp(argv[i + 1], "gacl") == 0) || (strcmp(argv[i + 1], "GACL") == 0) )
00320 {
00321 authformat = GACL_FORMAT;
00322 }
00323 else if ( (strcmp(argv[i + 1], "xacml") == 0) || (strcmp(argv[i + 1], "XACML") == 0) )
00324 {
00325 authformat = XACML_FORMAT;
00326 }
00327 else if ( (strcmp(argv[i + 1], "simple") == 0) || (strcmp(argv[i + 1], "SIMPLE") == 0) )
00328 {
00329 authformat = SIMPLE_FORMAT;
00330 }
00331 else
00332 {
00333 lcas_log(0,"%s: use \"simple/SIMPLE\", \"gacl/GACL\" or \"xacml/XACML\" for option %s\n",
00334 logstr, argv[i]);
00335 goto fail_voms_init;
00336 }
00337 }
00338 i++;
00339 }
00340 else if (strcmp(argv[i], "-use_user_dn") == 0)
00341 {
00342 use_user_dn = 1;
00343 }
00344 else if ((strcmp(argv[i], "-gacl_use_voms_dn") == 0)
00345 && (i + 1 < argc))
00346 {
00347 if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
00348 {
00349 if ( (strcmp(argv[i + 1], "yes") == 0) || (strcmp(argv[i + 1], "YES") == 0) )
00350 {
00351 gacl_use_voms_dn = USE_VOMS_DN;
00352 }
00353 else if ( (strcmp(argv[i + 1], "no") == 0) || (strcmp(argv[i + 1], "NO") == 0) )
00354 {
00355 gacl_use_voms_dn = DONT_USE_VOMS_DN;
00356 }
00357 else if ( (strcmp(argv[i + 1], "always") == 0) || (strcmp(argv[i + 1], "ALWAYS") == 0) )
00358 {
00359 gacl_use_voms_dn = ALWAYS_USE_VOMS_DN;
00360 }
00361 else
00362 {
00363 lcas_log(0,"%s: use \"yes/YES\", \"no/NO\" or \"always/ALWAYS\" for option %s\n",
00364 logstr, argv[i]);
00365 goto fail_voms_init;
00366 }
00367 }
00368 i++;
00369 }
00370 else
00371 {
00372 lcas_log(0,"%s: Error in initialization parameter: %s (failure)\n", logstr,
00373 argv[i]);
00374 return LCAS_MOD_FAIL;
00375 }
00376 }
00377
00378
00379 if (authfile == NULL)
00380 {
00381 lcas_log(0, "%s: authorization file is not specified (failure)\n", logstr);
00382 goto fail_voms_init;
00383 }
00384 if ((stat(authfile, &buf)) != 0)
00385 {
00386 lcas_log(0, "%s: unable to get stat of authorization file: %s\n", logstr, authfile);
00387 lcas_log(0, "%s: %s\n", logstr, strerror(errno));
00388 goto fail_voms_init;
00389 }
00390 if ( !(S_ISREG(buf.st_mode)))
00391 {
00392 lcas_log(0, "%s: specified authorization file (%s) is not a regular file (failure)\n",
00393 logstr, authfile);
00394 goto fail_voms_init;
00395 }
00396
00397
00398 if (authformat == NO_FORMAT)
00399 {
00400 authfilecopy = strdup(authfile);
00401 authfilebase = basename(authfilecopy);
00402 if (strstr(authfilebase, ".gacl") != NULL)
00403 {
00404 authformat = GACL_FORMAT;
00405 }
00406 else if (strstr(authfilebase, ".xacml") != NULL)
00407 {
00408 authformat = XACML_FORMAT;
00409 }
00410 else
00411 {
00412 authformat = SIMPLE_FORMAT;
00413 }
00414 if (authfilecopy)
00415 {
00416 free(authfilecopy);
00417 authfilecopy = NULL;
00418 }
00419 }
00420 lcas_log_debug(1, "%s: authorization file: %s, format: %d\n", logstr, authfile, authformat);
00421
00422
00423
00424 return LCAS_MOD_SUCCESS;
00425
00426
00427 fail_voms_init:
00428 return LCAS_MOD_FAIL;
00429 }
00430
00431
00432
00433
00434
00435
00436
00437
00438
00439
00440
00441
00442
00443
00444
00445
00446
00447
00448
00449
00450
00451
00452
00453
00454
00455
00456
00457
00458
00459
00460
00461
00462
00463
00464
00466
00467
00468
00469
00470
00471
00472
00473
00474
00475
00476
00477
00478
00479
00480
00481
00482
00483
00484
00485
00486
00487
00488
00489
00490
00491 int
00492 plugin_confirm_authorization(lcas_request_t request, lcas_cred_id_t lcas_cred)
00493 {
00494 char * logstr = "\tlcas_plugin_voms-plugin_confirm_authorization()";
00495 char * dn = NULL;
00496 struct vomsdata * vd = NULL;
00497 int errNo = 0;
00498
00499 gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
00500 X509 * px509_cred = NULL;
00501 STACK_OF(X509) * px509_chain = NULL;
00502 GACLuser * gacluser = NULL;
00503 int rc = 0;
00504 char * dummy = NULL;
00505
00506 #ifdef TESTBIO
00507 int err;
00508 int res;
00509 BIO *in = NULL;
00510 X509 *x = NULL;
00511 STACK_OF(X509) *chain;
00512 #endif
00513
00514
00515
00516
00517
00518 lcas_log_debug(1,"%s:\n", logstr);
00519
00520
00521
00522
00523 if ( (dn = lcas_get_dn(lcas_cred)) == NULL)
00524 {
00525 lcas_log(0, "%s: Error, user DN empty\n", logstr);
00526 goto fail_voms;
00527 }
00528 if ( (cred = lcas_get_gss_cred(lcas_cred)) == GSS_C_NO_CREDENTIAL)
00529 {
00530 lcas_log(0, "%s: Error, user gss credential is empty !\n", logstr);
00531 goto fail_voms;
00532 }
00533
00534
00535
00536
00537
00538
00539
00540
00541
00542
00543
00544
00545
00546
00547
00548
00549
00550
00551
00552
00553
00554
00555
00556
00557
00558
00559 #undef EXPORT_CREDENTIAL
00560 #if EXPORT_CREDENTIAL
00561 if (cred)
00562 {
00563 gss_buffer_desc deleg_proxy_filename;
00564 OM_uint32 major_status = 0;
00565 OM_uint32 minor_status = 0;
00566
00567 major_status = gss_export_cred(&minor_status,
00568 cred,
00569 NULL,
00570 1,
00571 &deleg_proxy_filename);
00572
00573 if (major_status == GSS_S_COMPLETE)
00574 {
00575 char * cp;
00576
00577 lcas_log_debug(1,"%s: deleg_proxy_filename.value: %s\n", logstr,
00578 deleg_proxy_filename.value);
00579 cp = strchr((char *)deleg_proxy_filename.value, '=');
00580 *cp = '\0';
00581 cp++;
00582 setenv((char *)deleg_proxy_filename.value, cp, 1);
00583 free(deleg_proxy_filename.value);
00584 }
00585 else
00586 {
00587 char * error_str = NULL;
00588 globus_object_t * error_obj;
00589
00590 error_obj = globus_error_get((globus_result_t) minor_status);
00591
00592 error_str = globus_error_print_chain(error_obj);
00593 lcas_log(0,"%s: Error, gss_export_cred(): %s\n", logstr,error_str);
00594 goto fail_voms;
00595 }
00596 }
00597 #endif
00598
00599
00600
00601
00602 if ( ( px509_cred = lcas_cred_to_x509(cred) ) )
00603 {
00604 lcas_log_debug(1,"%s: found X509 struct inside gss credential\n", logstr);
00605 lcas_log_debug(5,"%s: just for kicks: X509->name %s\n", logstr,px509_cred->name);
00606 }
00607 else
00608 {
00609 lcas_log(0,"%s: could not get X509 cred (exit voms)!\n", logstr);
00610 goto fail_voms;
00611 }
00612 if ( ( px509_chain = lcas_cred_to_x509_chain(cred) ) )
00613 {
00614 lcas_log_debug(1,"%s: found X509 chain inside gss credential\n", logstr);
00615 }
00616 else
00617 {
00618 lcas_log(0,"%s: could not get X509 chain (exit voms)!\n", logstr);
00619 goto fail_voms;
00620 }
00621
00622 lcas_log_debug(1,"%s: vomsdir = %s\n", logstr, vomsdir);
00623 lcas_log_debug(1,"%s: certdir = %s\n", logstr, certdir);
00624 if ((vd = VOMS_Init(vomsdir, certdir)) == NULL)
00625 {
00626 lcas_log(0,"%s: Failed to initialize voms data structure\n", logstr);
00627 lcas_log(0,"%s: This may be because either the specified voms directory (%s)\n",logstr,vomsdir);
00628 lcas_log(0,"%s: or the specified CA certificates directory (%s) does not exist\n", logstr, certdir);
00629 goto fail_voms;
00630 }
00631 lcas_log_debug(1,"%s: voms data structure initialized\n", logstr);
00632
00633 #ifdef TESTBIO
00634 in = BIO_new(BIO_s_file());
00635 chain = load_chain("/home/gridtest/cvs/fabric_mgt/gridification/lcas/modules/voms/x509up_u500");
00636 if (in)
00637 {
00638 if (BIO_read_filename(in, "/home/gridtest/cvs/fabric_mgt/gridification/lcas/modules/voms/x509up_u500") > 0)
00639 {
00640 x = PEM_read_bio_X509(in, NULL, 0, NULL);
00641
00642 res = VOMS_Retrieve(x, chain, RECURSE_CHAIN, vd, &err);
00643
00644 if (res)
00645 print_vomsdata(vd);
00646 else
00647 printf("%s: ERROR!\n", logstr);
00648 }
00649 }
00650
00651 if (!res)
00652 {
00653 printf("%s: err: %s\n", logstr, retmsg[err]);
00654 }
00655 #else
00656 if (VOMS_Retrieve(px509_cred, px509_chain, RECURSE_CHAIN,
00657 vd, &errNo))
00658 #endif
00659 {
00660 lcas_vo_data_t * lcas_vo_data = NULL;
00661 struct voms ** volist = vd->data;
00662 struct voms * vo;
00663 char * bufptr = NULL;
00664 int k = 0;
00665 int j = 0;
00666 int foundmatch = 0;
00667
00668 lcas_log_debug(1,"%s: We got something, errNo = %d\n", logstr, errNo);
00669 print_vomsdata(vd);
00670
00671 if (authformat == GACL_FORMAT)
00672 {
00673
00674 GACLinit();
00675 if (lcas_gacl_add_dn(&gacluser, dn) != 0)
00676 {
00677 lcas_log(0,"%s: error adding dn %s to gacluser\n", logstr, dn);
00678 goto fail_voms;
00679 }
00680 else
00681 {
00682 lcas_log_debug(2,"%s: added dn %s to gacluser\n", logstr, dn);
00683 }
00684 }
00685
00686 while(volist[k])
00687 {
00688 vo = volist[k++];
00689 lcas_log_debug(1,"%s: setting voms data for VO == %s\n", logstr,
00690 vo->voname);
00691 lcas_log_debug(2,"%s: setting voms data for VO server == %s\n", logstr,
00692 vo->server);
00693
00694 switch (vo->type) {
00695 case TYPE_NODATA:
00696 lcas_log_debug(1,"%s: NO DATA\n", logstr);
00697 break;
00698 case TYPE_CUSTOM:
00699 lcas_log_debug(1,"%s: %*s\n", logstr, vo->datalen - 10, vo->custom);
00700 break;
00701 case TYPE_STD:
00702 j = 0;
00703 while (vo->std[j]) {
00704 lcas_vo_data=lcas_createVoData(vo->voname,vo->std[j]->group,
00705 NULL, vo->std[j]->role, vo->std[j]->cap
00706 );
00707 if (! lcas_vo_data)
00708 {
00709 lcas_log(0,"%s: could not create VoData structure (failure)\n", logstr);
00710 goto fail_voms;
00711 }
00712
00713 if ( lcas_stringVoData(lcas_vo_data, voms_buffer, VOMS_BUFFER_SIZE) )
00714 {
00715 lcas_log(0,"%s: error in casting VoData structure into string (failure)\n", logstr);
00716 goto fail_voms;
00717 }
00718
00719
00720
00721
00722
00723 if (authformat == SIMPLE_FORMAT)
00724 {
00725
00726 rc = lcas_gridlist(voms_buffer, &dummy, authfile, MATCH_ONLY_DN|MATCH_WILD_CHARS, NULL, NULL);
00727 if ( rc == LCAS_MOD_ENTRY )
00728 {
00729
00730 lcas_log_debug(1,"%s: entry found for %s\n", logstr, voms_buffer);
00731 foundmatch++;
00732 }
00733 else if ( rc == LCAS_MOD_NOFILE )
00734 {
00735
00736 lcas_log(0, "%s: Error, Cannot find authorization file: %s\n", logstr, authfile);
00737 if (dummy)
00738 {
00739 free(dummy);
00740 dummy = NULL;
00741 }
00742 goto fail_voms;;
00743 }
00744 else
00745 {
00746
00747 lcas_log_debug(1, "%s: no entry for %s in %s\n", logstr, voms_buffer, authfile);
00748 }
00749 if (dummy)
00750 {
00751 free(dummy);
00752 dummy = NULL;
00753 }
00754 }
00755 else if (authformat == GACL_FORMAT)
00756 {
00757
00758 if ( (gacl_use_voms_dn == USE_VOMS_DN) || (gacl_use_voms_dn == ALWAYS_USE_VOMS_DN) )
00759 {
00760 if (!lcas_parseVostring(vo->server))
00761 {
00762 lcas_log(0,"%s: No VOMS server DN found in user cert. (failure)\n", logstr);
00763 goto fail_voms;
00764 }
00765
00766 if (lcas_gacl_add_vomsdata(&gacluser, lcas_vo_data, vo->server) != 0)
00767 {
00768 lcas_log(0,"%s: error adding voms data for %s to gacluser\n", logstr, voms_buffer);
00769 goto fail_voms;
00770 }
00771 else
00772 {
00773 lcas_log_debug(2,"%s: added voms data for %s to gacluser\n", logstr, voms_buffer);
00774 }
00775
00776 if (gacl_use_voms_dn == USE_VOMS_DN)
00777 {
00778 if (lcas_gacl_add_vomsdata(&gacluser, lcas_vo_data, NULL) != 0)
00779 {
00780 lcas_log(0,"%s: error adding voms data for %s to gacluser\n", logstr, voms_buffer);
00781 goto fail_voms;
00782 }
00783 else
00784 {
00785 lcas_log_debug(2,"%s: added voms data for %s to gacluser\n", logstr, voms_buffer);
00786 }
00787 }
00788 }
00789 else if (gacl_use_voms_dn == DONT_USE_VOMS_DN)
00790 {
00791
00792 if (lcas_gacl_add_vomsdata(&gacluser, lcas_vo_data, NULL) != 0)
00793 {
00794 lcas_log(0,"%s: error adding voms data for %s to gacluser\n", logstr, voms_buffer);
00795 goto fail_voms;
00796 }
00797 else
00798 {
00799 lcas_log_debug(2,"%s: added voms data for %s to gacluser\n", logstr, voms_buffer);
00800 }
00801 }
00802 }
00803 else if (authformat == XACML_FORMAT)
00804 {
00805
00806 lcas_log(0,"%s: This (%d) format is not supported yet\n", logstr, authformat);
00807 }
00808 else
00809 {
00810 lcas_log(0,"%s: This (%d) format is not supported\n", logstr, authformat);
00811 }
00812
00813
00814 bufptr = voms_buffer;
00815
00816
00817 if ( lcas_deleteVoData(&lcas_vo_data) )
00818 {
00819 lcas_log(0,"%s: error while deleting VoData structure (failure)\n", logstr);
00820 goto fail_voms;
00821 }
00822 j++;
00823 }
00824 break;
00825 }
00826 }
00827 lcas_log_debug(1,"%s: doing VOMS_Destroy\n", logstr);
00828 VOMS_Destroy(vd);
00829 lcas_log_debug(1,"%s: done\n", logstr);
00830
00831
00832
00833 if (authformat == GACL_FORMAT)
00834 {
00835
00836
00837 rc = lcas_check_gacl(gacluser, authfile);
00838 if (rc == 0)
00839 {
00840 lcas_log_debug(1, "%s: authorization granted based on VOMS info for user %s in %s\n", logstr, dn, authfile);
00841 }
00842 else
00843 {
00844
00845 lcas_log(0, "%s: authorization denied based on VOMS info for user %s in %s\n", logstr, dn, authfile);
00846 goto fail_voms;
00847 }
00848 }
00849 else
00850 {
00851 if (foundmatch)
00852 {
00853 lcas_log_debug(1,"%s: found a matching VO entry in the authorization file\n", logstr);
00854 }
00855 else
00856 {
00857 lcas_log(0,"%s: Did not find a matching VO entry in the authorization file\n", logstr);
00858 goto fail_voms;
00859 }
00860 }
00861
00862 }
00863 #ifdef TESTBIO
00864 #else
00865 else if (errNo == VERR_NOEXT)
00866 {
00867
00868
00869
00870
00871 if (use_user_dn != 0)
00872 {
00873 lcas_log_debug(1,"%s: VOMS extensions missing from certificate, trying\n", logstr);
00874 lcas_log_debug(1,"%s: to find user dn (%s) in authorization file %s\n", logstr, dn, authfile);
00875
00876 if (authformat == SIMPLE_FORMAT)
00877 {
00878
00879 rc = lcas_gridlist(dn, &dummy, authfile, MATCH_ONLY_DN, NULL, NULL);
00880 if ( rc == LCAS_MOD_ENTRY )
00881 {
00882
00883 lcas_log_debug(1,"%s: entry found for %s\n", logstr, dn);
00884 }
00885 else if ( rc == LCAS_MOD_NOFILE )
00886 {
00887
00888 lcas_log(0, "%s: Error, Cannot find authorization file: %s\n", logstr, authfile);
00889 if (dummy)
00890 {
00891 free(dummy);
00892 dummy = NULL;
00893 }
00894 goto fail_voms;;
00895 }
00896 else
00897 {
00898
00899 lcas_log(0, "%s: authorization denied based on DN info for user\n", logstr);
00900 lcas_log(0, "%s: %s in %s\n", logstr, dn, authfile);
00901 lcas_log(0, "%s: (in addition no VOMS info was found in user proxy)\n", logstr);
00902 if (dummy)
00903 {
00904 free(dummy);
00905 dummy = NULL;
00906 }
00907 goto fail_voms;
00908 }
00909 }
00910 else if (authformat == GACL_FORMAT)
00911 {
00912
00913 GACLinit();
00914 if (lcas_gacl_add_dn(&gacluser, dn) != 0)
00915 {
00916 lcas_log(0,"%s: error adding dn %s to gacluser\n", logstr, dn);
00917 goto fail_voms;
00918 }
00919 else
00920 {
00921 lcas_log_debug(2,"%s: added dn %s to gacluser\n", logstr, dn);
00922 }
00923
00924
00925 rc = lcas_check_gacl(gacluser, authfile);
00926 if (rc == 0)
00927 {
00928 lcas_log_debug(1, "%s: authorization granted based on DN info for user %s in %s\n", logstr, dn, authfile);
00929 }
00930 else
00931 {
00932
00933 lcas_log(0, "%s: authorization denied based on DN info for user\n", logstr);
00934 lcas_log(0, "%s: %s in %s\n", logstr, dn, authfile);
00935 lcas_log(0, "%s: (in addition no VOMS info was found in user proxy)\n", logstr);
00936 goto fail_voms;
00937 }
00938 }
00939 else
00940 {
00941 lcas_log(0,"%s: This (%d) format is not supported yet, but this should have been checked earlier in the process! \n", logstr, authformat);
00942 }
00943 }
00944 else
00945 {
00946 lcas_log(0,"%s: VOMS extensions missing from certificate (failure)!\n", logstr);
00947 goto fail_voms;
00948 }
00949 }
00950 else if (errNo == VERR_IDCHECK)
00951 {
00952 lcas_log(0,"%s: VOMS User data in extension different from the real ones (failure)!\n", logstr);
00953 goto fail_voms;
00954 }
00955 else if (errNo == VERR_TIME)
00956 {
00957 lcas_log(0,"%s: VOMS extensions expired for at least one of the VOs (failure)!\n", logstr);
00958 goto fail_voms;
00959 }
00960 else if (errNo == VERR_ORDER)
00961 {
00962 lcas_log(0,"%s: The ordering of the VOMS groups, as required by the client, was not delivered by VOMS (failure)!\n", logstr);
00963 goto fail_voms;
00964 }
00965 else if (errNo == VERR_NOSOCKET)
00966 {
00967 lcas_log(0,"%s: VOMS Socket problem (failure)!\n", logstr);
00968 goto fail_voms;
00969 }
00970 else if (errNo == VERR_NOIDENT)
00971 {
00972 lcas_log(0,"%s: VOMS Cannot identify itself (certificate problem) (failure)!\n", logstr);
00973 goto fail_voms;
00974 }
00975 else if (errNo == VERR_COMM)
00976 {
00977 lcas_log(0,"%s: VOMS server problem (failure)!\n", logstr);
00978 goto fail_voms;
00979 }
00980 else if (errNo == VERR_PARAM)
00981 {
00982 lcas_log(0,"%s: Wrong parameters for VOMS (failure)!\n", logstr);
00983 goto fail_voms;
00984 }
00985 else if (errNo == VERR_NOINIT)
00986 {
00987 lcas_log(0,"%s: VOMS initialization error (failure)!\n", logstr);
00988 goto fail_voms;
00989 }
00990 else if (errNo == VERR_EXTRAINFO)
00991 {
00992 lcas_log(0,"%s: VO name and URI missing (in proxy ?) (failure)!\n", logstr);
00993 goto fail_voms;
00994 }
00995 else if (errNo == VERR_FORMAT)
00996 {
00997 lcas_log(0,"%s: Wrong VOMS data format (in proxy ?) (failure)!\n", logstr);
00998 goto fail_voms;
00999 }
01000 else if (errNo == VERR_NODATA)
01001 {
01002 lcas_log(0,"%s: Empty VOMS extension (failure)!\n", logstr);
01003 goto fail_voms;
01004 }
01005 else if (errNo == VERR_PARSE)
01006 {
01007 lcas_log(0,"%s: VOMS parse error (failure)!\n", logstr);
01008 goto fail_voms;
01009 }
01010 else if (errNo == VERR_DIR)
01011 {
01012 lcas_log(0,"%s: VOMS directory error (failure)!\n", logstr);
01013 goto fail_voms;
01014 }
01015 else if (errNo == VERR_SIGN)
01016 {
01017 lcas_log(0,"%s: VOMS Signature error (failure)!\n", logstr);
01018 goto fail_voms;
01019 }
01020 else if (errNo == VERR_SERVER)
01021 {
01022 lcas_log(0,"%s: Unidentifiable VOMS server (failure)!\n", logstr);
01023 goto fail_voms;
01024 }
01025 else if (errNo == VERR_MEM)
01026 {
01027 lcas_log(0,"%s: Memory problems in VOMS_Retrieve() (failure)!\n", logstr);
01028 goto fail_voms;
01029 }
01030 else if (errNo == VERR_VERIFY)
01031 {
01032 lcas_log(0,"%s: Generic verification error for VOMS (failure)!\n", logstr);
01033 goto fail_voms;
01034 }
01035 else if (errNo == VERR_TYPE)
01036 {
01037 lcas_log(0,"%s: Returned VOMS data of unknown type (failure)!\n", logstr);
01038 goto fail_voms;
01039 }
01040 else
01041 {
01042 lcas_log(0,"%s: VOMS_Retrieve() error --> %d (failure)!\n", logstr, errNo);
01043 goto fail_voms;
01044 }
01045 #endif
01046
01047
01048
01049 if (px509_cred) X509_free(px509_cred);
01050 if (px509_chain) sk_X509_free(px509_chain);
01051 if (authformat == GACL_FORMAT)
01052 {
01053 if (gacluser)
01054 {
01055 GACLfreeUser(gacluser);
01056 gacluser = NULL;
01057 }
01058 }
01059 lcas_log_time(0,"%s: voms plugin succeeded\n", logstr);
01060 return LCAS_MOD_SUCCESS;
01061
01062 fail_voms:
01063 if (px509_cred) X509_free(px509_cred);
01064 if (px509_chain) sk_X509_free(px509_chain);
01065 if (authformat == GACL_FORMAT)
01066 {
01067 if (gacluser)
01068 {
01069 GACLfreeUser(gacluser);
01070 gacluser = NULL;
01071 }
01072 }
01073 lcas_log_time(0,"%s: voms plugin failed\n", logstr);
01074 return LCAS_MOD_FAIL;
01075 }
01076
01077
01078
01079
01080
01081
01082
01083
01084
01085
01086
01087 int plugin_terminate()
01088 {
01089 char * logstr = "\tlcas_plugin_voms-plugin_terminate()";
01090 lcas_log_debug(1,"%s: terminating\n", logstr);
01091 if (vomsdir)
01092 {
01093 free(vomsdir);
01094 vomsdir = NULL;
01095 }
01096 if (certdir)
01097 {
01098 free(certdir);
01099 certdir = NULL;
01100 }
01101 if (authfile)
01102 {
01103 free(authfile);
01104 authfile = NULL;
01105 }
01106
01107 return LCAS_MOD_SUCCESS;
01108 }
01109
01110
01111
01112
01113
01114
01115
01116
01117
01118
01119
01120
01121
01122
01137 static int lcas_gacl_add_dn(
01138 GACLuser ** pgacluser,
01139 char * user_dn
01140 )
01141 {
01142 char * logstr = "\tlcas_plugin_voms-lcas_gacl_add_dn()";
01143 GACLcred * dn_cred = NULL;
01144 GACLuser * gacluser = NULL;
01145
01146 if (user_dn)
01147 {
01148 if ( (dn_cred = GACLnewCred("person")) != NULL )
01149 {
01150 lcas_log_debug(3,"%s: adding dn = %s to dn_cred\n", logstr, user_dn);
01151 GACLaddToCred(dn_cred, "dn", user_dn);
01152 }
01153 else
01154 {
01155 lcas_log_debug(1,"%s: Cannot create new credential\n", logstr);
01156 return 1;
01157 }
01158 }
01159 else
01160 {
01161 lcas_log_debug(1,"%s: empty user DN !, cannot fill GACLuser\n", logstr);
01162 return 1;
01163 }
01164
01165
01166 if (pgacluser == NULL)
01167 {
01168
01169 lcas_log(0, "%s: ptr to gacluser is NULL !, wrong invocation of lcas_gacl_add_dn()\n", logstr);
01170 GACLfreeCred(dn_cred);
01171 return 1;
01172 }
01173 gacluser = *pgacluser;
01174 if (gacluser == NULL)
01175 {
01176 if ( (gacluser = GACLnewUser(dn_cred)) == NULL )
01177 {
01178 lcas_log(0, "%s: Could not create new user\n", logstr);
01179 GACLfreeCred(dn_cred);
01180 return 1;
01181 }
01182 *pgacluser = gacluser;
01183 }
01184 else
01185 {
01186 if (GACLuserAddCred(gacluser, dn_cred) != 1)
01187 {
01188 lcas_log(0, "%s: Could not add credential to user\n", logstr);
01189 return 1;
01190 }
01191 }
01192
01193
01194 if (dn_cred)
01195 {
01196
01197
01198
01199
01200 dn_cred = NULL;
01201 }
01202 return 0;
01203 }
01204
01205
01206
01207
01208
01209
01210
01211
01212
01213
01214
01215
01216
01217
01218
01236 static int lcas_gacl_add_vomsdata(
01237 GACLuser ** pgacluser,
01238 lcas_vo_data_t * lcas_voms_data,
01239 char * voms_server_dn
01240 )
01241 {
01242 char * logstr = "\tlcas_plugin_voms-lcas_gacl_add_vomsdata()";
01243 GACLcred * voms_cred = NULL;
01244 GACLuser * gacluser = NULL;
01245
01246 if (lcas_voms_data)
01247 {
01248 if ( (voms_cred = GACLnewCred("voms-cred")) != NULL )
01249 {
01250 char * strptr = NULL;
01251
01252 if ( (strptr = lcas_parseVostring(voms_server_dn)) )
01253 {
01254 lcas_log_debug(3,"%s: adding voms = %s to voms_cred\n", logstr, strptr);
01255 GACLaddToCred(voms_cred, "voms", strptr);
01256 }
01257 if ( (strptr = lcas_parseVostring(lcas_voms_data->vo)) )
01258 {
01259 lcas_log_debug(3,"%s: adding vo = %s to voms_cred\n", logstr, strptr);
01260 GACLaddToCred(voms_cred, "vo", strptr);
01261 }
01262 if ( (strptr = lcas_parseVostring(lcas_voms_data->group)) )
01263 {
01264 lcas_log_debug(3,"%s: adding group = %s to voms_cred\n", logstr, strptr);
01265 GACLaddToCred(voms_cred, "group", strptr);
01266 }
01267 if ( (strptr = lcas_parseVostring(lcas_voms_data->subgroup)) )
01268 {
01269 lcas_log_debug(3,"%s: adding subgroup = %s to voms_cred\n", logstr, strptr);
01270 GACLaddToCred(voms_cred, "group", strptr);
01271 }
01272 if ( (strptr = lcas_parseVostring(lcas_voms_data->role)) )
01273 {
01274 lcas_log_debug(3,"%s: adding role = %s to voms_cred\n", logstr, strptr);
01275 GACLaddToCred(voms_cred, "role", strptr);
01276 }
01277 if ( (strptr = lcas_parseVostring(lcas_voms_data->capability)) )
01278 {
01279 lcas_log_debug(3,"%s: adding capability = %s to voms_cred\n", logstr, strptr);
01280 GACLaddToCred(voms_cred, "capability", strptr);
01281 }
01282 }
01283 else
01284 {
01285 lcas_log_debug(1,"%s: Cannot create new credential\n", logstr);
01286 return 1;
01287 }
01288 }
01289 else
01290 {
01291 lcas_log_debug(1,"%s: empty VO data !, cannot fill GACLuser\n", logstr);
01292 return 1;
01293 }
01294
01295
01296 if (pgacluser == NULL)
01297 {
01298
01299 lcas_log(0, "%s: ptr to gacluser is NULL !, wrong invocation of lcas_gacl_add_vomsdata()\n", logstr);
01300 GACLfreeCred(voms_cred);
01301 return 1;
01302 }
01303 gacluser = *pgacluser;
01304 if (gacluser == NULL)
01305 {
01306 if ( (gacluser = GACLnewUser(voms_cred)) == NULL )
01307 {
01308 lcas_log(0, "%s: Could not create new user\n", logstr);
01309 GACLfreeCred(voms_cred);
01310 return 1;
01311 }
01312 *pgacluser = gacluser;
01313 }
01314 else
01315 {
01316 if (GACLuserAddCred(gacluser, voms_cred) != 1)
01317 {
01318 lcas_log(0, "%s: Could not add credential to user\n", logstr);
01319 return 1;
01320 }
01321 }
01322
01323
01324 if (voms_cred)
01325 {
01326
01327
01328
01329
01330 voms_cred = NULL;
01331 }
01332 return 0;
01333 }
01334
01335
01336
01337
01338
01339
01340
01341
01342
01343
01344
01345
01346
01347
01362 static int lcas_check_gacl(
01363 GACLuser * gacluser,
01364 char * gaclfile
01365 )
01366 {
01367
01368
01369
01370
01371
01372
01373
01374
01375
01376 char * logstr = "\tlcas_plugin_voms-lcas_check_gacl()";
01377 GACLacl * lcasacl = NULL;
01378 GACLperm lcas_gacl_perm = GACL_PERM_NONE;
01379
01380
01381 lcasacl = GACLloadAcl(gaclfile);
01382 lcas_log_debug(1,"%s: gacl authorization file %s loaded\n", logstr, gaclfile);
01383 if (lcasacl != NULL)
01384 {
01385
01386 }
01387 else
01388 {
01389 lcas_log(0,"%s: lcasacl is NULL\n", logstr);
01390 return 1;
01391 }
01392
01393
01394 lcas_gacl_perm = GACLtestExclAcl(lcasacl, gacluser);
01395 lcas_log_debug(1,"%s: exclusive permission = %d\n", logstr, lcas_gacl_perm);
01396
01397 lcas_gacl_perm = GACLtestUserAcl(lcasacl, gacluser);
01398 lcas_log_debug(1,"%s: permission = %d\n", logstr, lcas_gacl_perm);
01399 if (GACLhasNone(lcas_gacl_perm))
01400 {
01401 if (lcas_get_debug_level() >= 5)
01402 GACLprintAcl(lcasacl, stderr);
01403 GACLfreeAcl(lcasacl);
01404 return 1;
01405 }
01406 else
01407 {
01408 GACLfreeAcl(lcasacl);
01409 return 0;
01410 }
01411 }
01412
01413 static void print_vomsdata(struct vomsdata *d)
01414 {
01415 char * logstr = "\tlcas_plugin_voms-print_vomsdata()";
01416 struct voms **vo = d->data;
01417 struct voms *v;
01418 int k = 0;
01419 int j =0;
01420
01421 while(vo[k])
01422 {
01423 v = vo[k++];
01424 lcas_log_debug(1,"%s: %d *******************************************\n", logstr,k);
01425 lcas_log_debug(1,"%s: SIGLEN: %d\nUSER: %s\n", logstr, v->siglen, v->user);
01426 lcas_log_debug(1,"%s: UCA: %s\nSERVER: %s\n", logstr, v->userca, v->server);
01427 lcas_log_debug(1,"%s: SCA: %s\nVO: %s\n", logstr, v->serverca, v->voname);
01428 lcas_log_debug(1,"%s: URI: %s\nDATE1: %s\n", logstr, v->uri, v->date1);
01429 lcas_log_debug(1,"%s: DATE2: %s\n", logstr, v->date2);
01430
01431 switch (v->type)
01432 {
01433 case TYPE_NODATA:
01434 lcas_log_debug(1,"%s: NO DATA\n", logstr);
01435 break;
01436 case TYPE_CUSTOM:
01437 lcas_log_debug(1,"%s: %*s\n", logstr, v->datalen - 10, v->custom);
01438 break;
01439 case TYPE_STD:
01440 j = 0;
01441 while (v->std[j])
01442 {
01443 lcas_log_debug(1,"%s: GROUP: %s\tROLE: %s\tCAP: %s\n", logstr,v->std[j]->group,
01444 v->std[j]->role,v->std[j]->cap);
01445 j++;
01446 }
01447 break;
01448 }
01449 }
01450
01451 if (d->workvo)
01452 lcas_log_debug(1,"%s: WORKVO: %s\n", logstr, d->workvo);
01453
01454 if (d->extra_data)
01455 lcas_log_debug(1,"%s: EXTRA: %s\n", logstr, d->extra_data);
01456 }
01457
01458
01459
01460
01461
01462
01463
01464