#include <unistd.h>
#include <cctype>
#include <cerrno>
#include <cstdlib>
#include <strings.h>
#include <cstdio>
#include <sys/param.h>
#include <pwd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <dirent.h>
#include <iostream>
#include "XrdVersion.hh"
#include "XrdNet/XrdNetAddr.hh"
#include "XrdSec/XrdSecEntityAttr.hh"
#include "XrdSys/XrdSysHeaders.hh"
#include "XrdSys/XrdSysLogger.hh"
#include "XrdSys/XrdSysError.hh"
#include "XrdOuc/XrdOucPinLoader.hh"
#include "XrdOuc/XrdOucStream.hh"
#include "XrdOuc/XrdOucEnv.hh"
#include "XrdSut/XrdSutAux.hh"
#include "XrdCrypto/XrdCryptoMsgDigest.hh"
#include "XrdCrypto/XrdCryptoX509Chain.hh"
#include "XrdCrypto/XrdCryptoX509Req.hh"
#include "XrdSecgsi/XrdSecProtocolgsi.hh"
#include "XrdSecgsi/XrdSecgsiOpts.hh"

Include dependency graph for XrdSecProtocolgsi.cc:

Macros
#define	POPTS(t, y) {if (t) {std::cerr <<"Secgsi" <<y <<'\n' << std::flush;}}

Functions
static bool	AuthzFunCheck (XrdSutCacheEntry e, void a)

static const char *	ClientStepStr (int kclt)

static bool	GetCACheck (XrdSutCacheEntry e, void a)

static bool	GetSrvCertEntCheck (XrdSutCacheEntry e, void a)

static bool	QueryGMAPCheck (XrdSutCacheEntry e, void a)

static bool	QueryProxyCheck (XrdSutCacheEntry e, void a)

static const char *	ServerStepStr (int ksrv)

char *	XrdSecProtocolgsiInit (const char mode, const char parms, XrdOucErrInfo erp)

XrdSecProtocol *	XrdSecProtocolgsiObject (const char mode, const char hostname, XrdNetAddrInfo &endPoint, const char parms, XrdOucErrInfo *erp)

	XrdVERSIONINFO (XrdSecProtocolgsiObject, secgsi)

Variables
static const char *	gGSErrStr []

static const char *	gNoPadTag = "nopad"

static const char *	gsiClientSteps []

static const char *	gsiServerSteps []

XrdOucTrace *	gsiTrace = 0

static const char *	gUsrPxyDef = "/tmp/x509up_u"

static const int	kOneDay = 86400

static String	Prefix = "xrd"

static String	ProtoID = XrdSecPROTOIDENT

static const kXR_int32	Version = XrdSecgsiVERSION

Macro Definition Documentation

◆ POPTS

#define POPTS	(	t,
		y
	)	{if (t) {std::cerr <<"Secgsi" <<y <<'\n' << std::flush;}}

Definition at line 68 of file XrdSecProtocolgsi.cc.

Function Documentation

◆ AuthzFunCheck()

static bool AuthzFunCheck	(	XrdSutCacheEntry *	e,
		void *	a
	)

static

Definition at line 1721 of file XrdSecProtocolgsi.cc.

                                                         {
  
    int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
    time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
    long to_ref = (*((XrdSutCacheArg_t *)a)).arg3;
    int st_exp = (*((XrdSutCacheArg_t *)a)).arg4;
  
    if (e && (e->status == st_ref)) {
       // Check expiration, if required
       bool expired = 0;
       if (to_ref > 0 && (ts_ref - e->mtime) > to_ref) expired = 1;
       int notafter = *((int *) e->buf2.buf);
       if (to_ref > notafter) expired = 1;
  
       if (expired) {
          // Invalidate the entry, if the case
          e->status = st_exp;
       } else {
          return true;
       }
    }
    return false;
 }

References XrdSutCacheEntryBuf::buf, XrdSutCacheEntry::buf2, XrdSutCacheEntry::mtime, and XrdSutCacheEntry::status.

Referenced by XrdSecProtocolgsi::Authenticate().

Here is the caller graph for this function:

◆ ClientStepStr()

static const char* ClientStepStr ( int kclt )

static

Definition at line 223 of file XrdSecProtocolgsi.cc.

 {
    // Return string with client step  
    static const char *ukn = "Unknown";
  
    kclt = (kclt < 0) ? 0 : kclt;
    kclt = (kclt > kXGC_reserved) ? 0 : kclt;
    kclt = (kclt >= kXGC_certreq) ? (kclt - kXGC_certreq + 1) : kclt;
  
    if (kclt < 0 || kclt > (kXGC_reserved - kXGC_certreq + 1))
       return ukn;  
    else
       return gsiClientSteps[kclt];
 }

References gsiClientSteps, kXGC_certreq, and kXGC_reserved.

Referenced by XrdSecProtocolgsi::Authenticate(), and XrdSecProtocolgsi::getCredentials().

Here is the caller graph for this function:

◆ GetCACheck()

static bool GetCACheck	(	XrdSutCacheEntry *	e,
		void *	a
	)

static

Definition at line 4624 of file XrdSecProtocolgsi.cc.

                                                      {
  
    EPNAME("GetCACheck");
  
    int crl_check = (*((XrdSutCacheArg_t *)a)).arg1;
    int crl_refresh = (*((XrdSutCacheArg_t *)a)).arg2;
    time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg3;
  
    if (!e) return false;
  
    X509Chain *chain = 0;
    // If we had already something, check it, as we may be done
    bool goodca = 0;
    if ((chain = (X509Chain *)(e->buf1.buf))) {
       // Check the validity of the certificates in the chain; if a certificate became invalid,
       // we need to reload a valid one for the same CA.
       if (chain->CheckValidity() == 0) {
          goodca = 1;
       } else {
          PRINT("CA entry for '"<<e->name<<"' needs refreshing: clean the related entry cache first");
          return false;
       }
    }
    if (goodca) {
       XrdCryptoX509Crl *crl = (XrdCryptoX509Crl *)(e->buf2.buf);
       bool goodcrl = 1;
       if ((crl_check == 2 && !crl) || (crl_check == 3 && crl->IsExpired())) goodcrl = 0;
       if (crl_refresh > 0 && ((ts_ref - e->mtime) > crl_refresh)) goodcrl = 0;
       if (goodcrl) {
          return true;
       } else if (crl) {
          PRINT("CRL entry for '"<<e->name<<"' needs refreshing: clean the related entry cache first ("<<e<<")");
       }
    }
    return false;
 }

References XrdSutCacheEntryBuf::buf, XrdSutCacheEntry::buf1, XrdSutCacheEntry::buf2, XrdCryptoX509Chain::CheckValidity(), EPNAME, XrdCryptoX509Crl::IsExpired(), XrdSutCacheEntry::mtime, XrdSutCacheEntry::name, and PRINT.

Here is the call graph for this function:

◆ GetSrvCertEntCheck()

static bool GetSrvCertEntCheck	(	XrdSutCacheEntry *	e,
		void *	a
	)

static

Definition at line 5628 of file XrdSecProtocolgsi.cc.

                                                              {
    int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
    time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
    if (e) {
       if (e->status > st_ref) {
          if (e->mtime >= ts_ref)
             return true;
       }
    }
    return false;
 }

References XrdSutCacheEntry::mtime, and XrdSutCacheEntry::status.

◆ QueryGMAPCheck()

static bool QueryGMAPCheck	(	XrdSutCacheEntry *	e,
		void *	a
	)

static

Definition at line 5208 of file XrdSecProtocolgsi.cc.

                                                          {
    int st_ref = (*((XrdSutCacheArg_t *)a)).arg1;
    time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg2;
    long to_ref = (*((XrdSutCacheArg_t *)a)).arg3;
    if (e) {
       // Check expiration, if required
       if ((e->status != st_ref) ||
           ((e->status == st_ref) &&
            (to_ref > 0) &&
            ((ts_ref - e->mtime) > to_ref))) {
          return false;
       } else {
          return true;
       }
    }
    return false;
 }

References XrdSutCacheEntry::mtime, and XrdSutCacheEntry::status.

◆ QueryProxyCheck()

static bool QueryProxyCheck	(	XrdSutCacheEntry *	e,
		void *	a
	)

static

Definition at line 4985 of file XrdSecProtocolgsi.cc.

                                                           {
  
    time_t ts_ref = (time_t)(*((XrdSutCacheArg_t *)a)).arg1;
  
    if (e && e->buf1.buf) {
       X509Chain *chain = (X509Chain *)(e->buf1.buf);
       if (chain->CheckValidity(1, ts_ref) == 0) return true;
    }
    return false;
 }

References XrdSutCacheEntryBuf::buf, XrdSutCacheEntry::buf1, and XrdCryptoX509Chain::CheckValidity().

Here is the call graph for this function:

◆ ServerStepStr()

static const char* ServerStepStr ( int ksrv )

static

Definition at line 239 of file XrdSecProtocolgsi.cc.

 {
    // Return string with server step  
    static const char *ukn = "Unknown";
  
    ksrv = (ksrv < 0) ? 0 : ksrv;
    ksrv = (ksrv > kXGS_reserved) ? 0 : ksrv;
    ksrv = (ksrv >= kXGS_init) ? (ksrv - kXGS_init + 1) : ksrv;
  
    if (ksrv < 0 || ksrv > (kXGS_reserved - kXGS_init + 1))
       return ukn;  
    else
       return gsiServerSteps[ksrv];
 }

References gsiServerSteps, kXGS_init, and kXGS_reserved.

Referenced by XrdSecProtocolgsi::Authenticate(), and XrdSecProtocolgsi::getCredentials().

Here is the caller graph for this function:

◆ XrdSecProtocolgsiInit()

char* XrdSecProtocolgsiInit	(	const char	mode,
		const char *	parms,
		XrdOucErrInfo *	erp
	)

Definition at line 2374 of file XrdSecProtocolgsi.cc.

 {
    // One-time protocol initialization, filling the static flags and options
    // of the protocol.
    // For clients (mode == 'c') we use values in envs.
    // For servers (mode == 's') the command line options are passed through
    // parms.
    EPNAME("ProtocolgsiInit");
  
    gsiOptions opts;
    char *rc = (char *)"";
    char *cenv = 0;
  
    // Initiate error logging and tracing
    gsiTrace = XrdSecProtocolgsi::EnableTracing();
  
    //
    // Clients first
    if (mode == 'c') {
       //
       // Decode envs:
       //             "XrdSecDEBUG"           debug flag ("0","1","2","3")
       //             "XrdSecGSICADIR"        full path to an alternative path
       //                                     containing the CA info
       //                                     [/etc/grid-security/certificates]
       //             "XrdSecGSICRLDIR"       full path to an alternative path
       //                                     containing the CRL info
       //                                     [/etc/grid-security/certificates]
       //             "XrdSecGSICRLEXT"       default extension of CRL files [.r0]
       //             "XrdSecGSIUSERCERT"     full path to an alternative file
       //                                     containing the user certificate
       //                                     [$HOME/.globus/usercert.pem]
       //             "XrdSecGSIUSERKEY"      full path to an alternative file
       //                                     containing the user key
       //                                     [$HOME/.globus/userkey.pem]
       //             "XrdSecGSIUSERPROXY"    full path to an alternative file
       //                                     containing the user proxy
       //                                     [/tmp/x509up_u<uid>]
       //             "XrdSecGSIPROXYVALID"   validity of proxies in the 
       //                                     grid-proxy-init format
       //                                     ["12:00", i.e. 12 hours]
       //             "XrdSecGSIPROXYDEPLEN"  depth of signature path for proxies;
       //                                     use -1 for unlimited [0]
       //             "XrdSecGSIPROXYKEYBITS" bits in PKI for proxies [default: XrdCryptoDefRSABits]
       //             "XrdSecGSICACHECK"      CA check level [1]:
       //                                      0 do not verify;
       //                                      1 verify if self-signed, warn if not;
       //                                      2 verify in all cases, fail if not possible
       //             "XrdSecGSICRLCHECK"     CRL check level [2]:
       //                                      0 don't care;
       //                                      1 use if available;
       //                                      2 require,
       //                                      3 require non-expired CRL
       //             "XrdSecGSIDELEGPROXY"   Forwarding of credentials option:
       //                                     0 deny; 1 sign request created
       //                                     by server; 2 forward local proxy
       //                                     (include private key) [1]
       //             "XrdSecGSICREATEPROXY"  Controls use of proxy [1]:
       //                                       1 auto-generate proxy from the cert/key pair if no one is not found
       //                                       0 a proxy is used if present; else, the cert/key pair is used if present.
       //             "XrdSecGSISRVNAMES"     Server names allowed: if the server CN
       //                                     does not match any of these, or it is
       //                                     explicitely denied by these, or it is
       //                                     not in the form "*/<hostname>", the
       //                                     handshake fails.
       //             "XrdSecGSIUSEDEFAULTHASH" If this variable is set only the default
       //                                     name hashing algorithm is used
  
       //
       opts.mode = mode;
       // debug
       cenv = getenv("XrdSecDEBUG");
       if (cenv)
          {if (cenv[0] >= 49 && cenv[0] <= 51) opts.debug = atoi(cenv);
              else {PRINT("unsupported debug value from env XrdSecDEBUG: "<<cenv<<" - setting to 1");
                    opts.debug = 1;
                   }
          }
  
       // directory with CA certificates
       cenv = (getenv("XrdSecGSICADIR") ? getenv("XrdSecGSICADIR")
                                        : getenv("X509_CERT_DIR"));
       if (cenv)
          opts.certdir = strdup(cenv);
  
       // directory with CRL info
       cenv = (getenv("XrdSecGSICRLDIR") ? getenv("XrdSecGSICRLDIR")
                                         : getenv("X509_CERT_DIR"));
       if (cenv)
          opts.crldir = strdup(cenv);
  
       // Default extension CRL files
       cenv = getenv("XrdSecGSICRLEXT");
       if (cenv)
          opts.crlext = strdup(cenv);
  
       // CRL refresh or expiration time
       cenv = getenv("XrdSecGSICRLRefresh");
       if (cenv)
          opts.crlrefresh = atoi(cenv);
  
       // file with user cert
       cenv = (getenv("XrdSecGSIUSERCERT") ? getenv("XrdSecGSIUSERCERT")
                                           : getenv("X509_USER_CERT"));
       if (cenv)
          opts.cert = strdup(cenv);
  
       // file with user key
       cenv = (getenv("XrdSecGSIUSERKEY") ? getenv("XrdSecGSIUSERKEY")
                                          : getenv("X509_USER_KEY"));
       if (cenv)
          opts.key = strdup(cenv);
  
       // file with user proxy
       cenv = (getenv("XrdSecGSIUSERPROXY") ? getenv("XrdSecGSIUSERPROXY")
                                            : getenv("X509_USER_PROXY"));
       if (cenv)
          opts.proxy = strdup(cenv);
  
       // file with user proxy
       cenv = getenv("XrdSecGSIPROXYVALID");
       if (cenv)
          opts.valid = strdup(cenv);
  
       // Depth of signature path for proxies
       cenv = getenv("XrdSecGSIPROXYDEPLEN");
       if (cenv)
          opts.deplen = atoi(cenv);
  
       // Key Bit length 
       cenv = getenv("XrdSecGSIPROXYKEYBITS");
       if (cenv)
          opts.bits = atoi(cenv);
  
       // CA verification level 
       cenv = getenv("XrdSecGSICACHECK");
       if (cenv)
          opts.ca = atoi(cenv);
  
       // CRL check level 
       cenv = getenv("XrdSecGSICRLCHECK");
       if (cenv)
          opts.crl = atoi(cenv);
  
       // Delegate proxy
       cenv = getenv("XrdSecGSIDELEGPROXY");
       if (cenv)
          opts.dlgpxy = atoi(cenv);
  
       // No proxy
       cenv = getenv("XrdSecGSICREATEPROXY");
       if (cenv)
          opts.createpxy = atoi(cenv);
  
       // Allowed server name formats
       cenv = getenv("XrdSecGSISRVNAMES");
       if (cenv)
          opts.srvnames = strdup(cenv);
  
       // Name hashing algorithm
       cenv = getenv("XrdSecGSIUSEDEFAULTHASH");
       if (cenv)
          opts.hashcomp = 0;
  
       // DNS trusting control
       if ((cenv = getenv("XrdSecGSITRUSTDNS")))
          opts.trustdns = (!strcmp(cenv, "0")) ? false : true;
  
       //
       // Setup the object with the chosen options
       rc = XrdSecProtocolgsi::Init(opts,erp);
  
       // Notify init options, if required or in case of init errors
       if (!rc) opts.debug = 1;
       opts.Print(gsiTrace);
  
       // Some cleanup
       SafeFree(opts.certdir);
       SafeFree(opts.crldir);
       SafeFree(opts.crlext);
       SafeFree(opts.cert);
       SafeFree(opts.key);
       SafeFree(opts.proxy);
       SafeFree(opts.valid);
       SafeFree(opts.srvnames);
  
       // We are done
       return rc;
    }
  
    // Take into account xrootd debug flag
    cenv = getenv("XRDDEBUG");
    if (cenv && !strcmp(cenv,"1")) opts.debug = 1;
  
    //
    // Server initialization
    if (parms) {
       //
       // Duplicate the parms
       char parmbuff[1024];
       strlcpy(parmbuff, parms, sizeof(parmbuff));
       //
       // The tokenizer
       XrdOucTokenizer inParms(parmbuff);
       //
       // Decode parms:
       // for servers:
       //              [-d:<debug_level>]
       //              [-c:[-]ssl[:[-]<CryptoModuleName]]
       //              [-certdir:<dir_with_CA_info>]
       //              [-crldir:<dir_with_CRL_info>]
       //              [-crlext:<default_extension_CRL_files>]
       //              [-cert:<path_to_server_certificate>]
       //              [-key:<path_to_server_key>]
       //              [-cipher:<list_of_supported_ciphers>]
       //              [-md:<list_of_supported_digests>]
       //              [-ca:<crl_verification_level>]
       //              [-crl:<crl_check_level>]
       //              [-crlrefresh:<crl_refresh_time>]
       //              [-gridmap:<grid_map_file>]
       //              [-gmapfun:<grid_map_function>]
       //              [-gmapfunparms:<grid_map_function_init_parameters>]
       //              [-authzcall:<authz_callopt>]
       //              [-authzfun:<authz_function>]
       //              [-authzfunparms:<authz_function_init_parameters>]
       //              [-authzto:<authz_cache_entry_validity_in_secs>]
       //              [-gmapto:<grid_map_cache_entry_validity_in_secs>]
       //              [-gmapopt:<grid_map_check_option>]
       //              [-dlgpxy:<proxy_req_option>]
       //              [-exppxy:<filetemplate>]
       //              [-authzpxy]
       //              [-vomsat:<voms_option>]
       //              [-vomsfun:<voms_function>]
       //              [-vomsfunparms:<voms_function_init_parameters>]
       //              [-defaulthash]
       //              [-trustdns:<0|1>]
       //
       int debug = -1;
       String clist = "";
       String certdir = "";
       String crldir = "";
       String crlext = "";
       String cert = "";
       String key = "";
       String cipher = "";
       String md = "";
       String gridmap = "";
       String gmapfun = "";
       String gmapfunparms = "";
       String authzfun = "";
       String authzfunparms = "";
       String vomsfun = "";
       String vomsfunparms = "";
       String exppxy = "";
       int ca = 1;
       int crl = 1;
       int crlrefresh = 86400;
       int ogmap = 1;
       int gmapto = 600;
       int authzto = -1;
       int authzcall = 1;
       int dlgpxy = dlgIgnore;
       int authzpxy = 0;
       int vomsat = vatIgnore; // Was 1 or extract
       int moninfo = 0;
       int hashcomp = 1;
       int trustdns = false;
       int showDN = false;
       char *op = 0;
       while (inParms.GetLine()) { 
          while ((op = inParms.GetToken())) {
             if (!strncmp(op, "-d:",3)) {
                debug = atoi(op+3);
             } else if (!strncmp(op, "-c:",3)) {
                clist = (const char *)(op+3);
             } else if (!strncmp(op, "-certdir:",9)) {
                certdir = (const char *)(op+9);
             } else if (!strncmp(op, "-crldir:",8)) {
                crldir = (const char *)(op+8);
             } else if (!strncmp(op, "-crlext:",8)) {
                crlext = (const char *)(op+8);
             } else if (!strncmp(op, "-cert:",6)) {
                cert = (const char *)(op+6);
             } else if (!strncmp(op, "-key:",5)) {
                key = (const char *)(op+5);
             } else if (!strncmp(op, "-cipher:",8)) {
                cipher = (const char *)(op+8);
             } else if (!strncmp(op, "-md:",4)) {
                md = (const char *)(op+4);
             } else if (!strncmp(op, "-ca:",4)) {
                ca = getOptVal(caVerOpts, op+4);
                ca = atoi(op+4);
             } else if (!strncmp(op, "-crl:",5)) {
                crl = getOptVal(crlOpts, op+5);
             } else if (!strncmp(op, "-crlrefresh:",12)) {
                crlrefresh = atoi(op+12);
             } else if (!strncmp(op, "-gmapopt:",9)) {
                ogmap = getOptVal(gmoOpts, op+9);
             } else if (!strncmp(op, "-gridmap:",9)) {
                gridmap = (const char *)(op+9);
             } else if (!strncmp(op, "-gmapfun:",9)) {
                gmapfun = (const char *)(op+9);
             } else if (!strncmp(op, "-gmapfunparms:",14)) {
                gmapfunparms = (const char *)(op+14);
             } else if (!strncmp(op, "-authzcall:",11)) {
                authzcall = getOptVal(azCallOpts, op+11);
             } else if (!strncmp(op, "-authzfun:",10)) {
                authzfun = (const char *)(op+10);
             } else if (!strncmp(op, "-authzfunparms:",15)) {
                authzfunparms = (const char *)(op+15);
             } else if (!strncmp(op, "-authzto:",9)) {
                authzto = atoi(op+9);
             } else if (!strncmp(op, "-gmapto:",8)) {
                gmapto = atoi(op+8);
             } else if (!strncmp(op, "-dlgpxy:",8)) {
                opts.dlgpxy = getOptVal(sDlgOpts, op+8);
             } else if (!strncmp(op, "-exppxy:",8)) {
                exppxy = (const char *)(op+8);
             } else if (!strncmp(op, "-authzpxy:",10)) {
                opts.authzpxy = getOptVal(azPxyOpts, op+10);
             } else if (!strncmp(op, "-authzpxy",9)) {
                authzpxy = 11;
             } else if (!strncmp(op, "-vomsat:",8)) {
                vomsat = getOptVal(vomsatOpts, op+8);
                if (vomsat != vatIgnore && vomsfun.length() == 0)
                   vomsfun = "default";
             } else if (!strncmp(op, "-vomsfun:",9)) {
                vomsfun = (const char *)(op+9);
             } else if (!strncmp(op, "-vomsfunparms:",14)) {
                vomsfunparms = (const char *)(op+14);
             } else if (!strcmp(op, "-moninfo")) {
                moninfo = 1;
             } else if (!strncmp(op, "-moninfo:",9)) {
                moninfo = atoi(op+9);
             } else if (!strcmp(op, "-defaulthash")) {
                hashcomp = 0;
             } else if (!strncmp(op, "-trustdns:",10)) {
                trustdns = getOptVal(tdnsOpts, op+10);
             } else if (!strncmp(op, "-showdn:",8)) {
                showDN = getOptVal(tdnsOpts, op+8);
             } else {
                PRINT("ignoring unknown switch: "<<op);
             }
          }
       }
  
       // If vomsfun is 'default' substitute the default plugin. The go on to
       // resolve conflicts between vomsfun and vomsat options. So, if vomsfun
       // was specified but vomsat is set to 'ignore' then we set vomsat to be
       // 'required'.
       //
       if (vomsfun.length() > 0)
          {if (vomsat == vatIgnore) vomsat = vatExtract;
           if (vomsfun == "default") vomsfun =  LIB_XRDVOMS;
          } else authzcall = azAlways;
  
       //
       // Build the option object
       opts.debug = (debug > -1) ? debug : opts.debug;
       opts.mode = 's';
       opts.ca = ca;
       opts.crl = crl;
       opts.crlrefresh = crlrefresh;
       opts.ogmap = ogmap;
       opts.gmapto = gmapto;
       opts.authzcall = authzcall;
       opts.authzto = authzto;
       opts.dlgpxy = (dlgpxy >= dlgIgnore && dlgpxy <= dlgReqSign) ? dlgpxy : 0;
       opts.authzpxy = authzpxy;
       opts.vomsat = vomsat;
       opts.moninfo = moninfo;
       opts.hashcomp = hashcomp;
       opts.trustdns = (trustdns <= 0) ? false : true;
       opts.showDN = (showDN > 0) ? true : false;
       if (clist.length() > 0)
          opts.clist = (char *)clist.c_str();
       if (certdir.length() > 0)
          opts.certdir = (char *)certdir.c_str();
       if (crldir.length() > 0)
          opts.crldir = (char *)crldir.c_str();
       if (crlext.length() > 0)
          opts.crlext = (char *)crlext.c_str();
       if (cert.length() > 0)
          opts.cert = (char *)cert.c_str();
       if (key.length() > 0)
          opts.key = (char *)key.c_str();
       if (cipher.length() > 0)
          opts.cipher = (char *)cipher.c_str();
       if (md.length() > 0)
          opts.md = (char *)md.c_str();
       if (gridmap.length() > 0)
          opts.gridmap = (char *)gridmap.c_str();
       if (gmapfun.length() > 0)
          opts.gmapfun = (char *)gmapfun.c_str();
       if (gmapfunparms.length() > 0)
          opts.gmapfunparms = (char *)gmapfunparms.c_str();
       if (authzfun.length() > 0)
          opts.authzfun = (char *)authzfun.c_str();
       if (authzfunparms.length() > 0)
          opts.authzfunparms = (char *)authzfunparms.c_str();
       if (exppxy.length() > 0)
          opts.exppxy = (char *)exppxy.c_str();
       if (vomsfun.length() > 0)
          opts.vomsfun = (char *)vomsfun.c_str();
       if (vomsfunparms.length() > 0)
          opts.vomsfunparms = (char *)vomsfunparms.c_str();
  
       // Notify init options, if required
       opts.Print(gsiTrace);
  
       //
       // Setup the plug-in with the chosen options
       return XrdSecProtocolgsi::Init(opts,erp);
    }
  
    // Notify init options, if required
    opts.Print(gsiTrace);
    //
    // Setup the plug-in with the defaults
    return XrdSecProtocolgsi::Init(opts,erp);
 }}

References XrdOucString::c_str(), myOpts::debug, XrdSecProtocolgsi::EnableTracing(), EPNAME, XrdOucTokenizer::GetLine(), XrdOucTokenizer::GetToken(), gsiTrace, XrdSecProtocolgsi::Init(), XrdOucString::length(), LIB_XRDVOMS, opts, PRINT, SafeFree, and strlcpy().

Here is the call graph for this function:

◆ XrdSecProtocolgsiObject()

XrdSecProtocol* XrdSecProtocolgsiObject	(	const char	mode,
		const char *	hostname,
		XrdNetAddrInfo &	endPoint,
		const char *	parms,
		XrdOucErrInfo *	erp
	)

Definition at line 2809 of file XrdSecProtocolgsi.cc.

 {
    XrdSecProtocolgsi *prot;
    int options = XrdSecNOIPCHK;
  
    //
    // Get a new protocol object
    if (!(prot = new XrdSecProtocolgsi(options, hostname, endPoint, parms))) {
       const char *msg = "Secgsi: Insufficient memory for protocol.";
       if (erp) 
          erp->setErrInfo(ENOMEM, msg);
       else 
          std::cerr <<msg <<std::endl;
       return (XrdSecProtocol *)0;
    }
    //
    // We are done
    if (!erp)
       std::cerr << "protocol object instantiated" << std::endl;
    return prot;
 }}

References XrdOucErrInfo::setErrInfo(), and XrdSecNOIPCHK.

Here is the call graph for this function:

◆ XrdVERSIONINFO()

XrdVERSIONINFO	(	XrdSecProtocolgsiObject	,
		secgsi
	)

Variable Documentation

◆ gGSErrStr

const char* gGSErrStr[]

static

Initial value:

= {
   "ErrParseBuffer",               
   "ErrDecodeBuffer",              
   "ErrLoadCrypto",                
   "ErrBadProtocol",               
   "ErrCreateBucket",              
   "ErrDuplicateBucket",           
   "ErrCreateBuffer",              
   "ErrSerialBuffer",              
   "ErrGenCipher",                 
   "ErrExportPuK",                 
   "ErrEncRndmTag",                
   "ErrBadRndmTag",                
   "ErrNoRndmTag",                 
   "ErrNoCipher",                  
   "ErrNoCreds",                   
   "ErrBadOpt",                    
   "ErrMarshal",                   
   "ErrUnmarshal",                 
   "ErrSaveCreds",                 
   "ErrNoBuffer",                  
   "ErrRefCipher",                 
   "ErrNoPublic",                  
   "ErrAddBucket",                 
   "ErrFinCipher",                 
   "ErrInit",                      
   "ErrBadCreds",                  
   "ErrError"                      
}

Definition at line 97 of file XrdSecProtocolgsi.cc.

◆ gNoPadTag

const char* gNoPadTag = "nopad"

static

Definition at line 132 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::getCredentials(), and XrdSecProtocolgsi::Init().

◆ gsiClientSteps

const char* gsiClientSteps[]

static

Initial value:

= {
   "kXGC_none",
   "kXGC_certreq",
   "kXGC_cert",
   "kXGC_sigpxy",
   "kXGC_reserved"
}

Definition at line 81 of file XrdSecProtocolgsi.cc.

Referenced by ClientStepStr().

◆ gsiServerSteps

const char* gsiServerSteps[]

static

Initial value:

= {
   "kXGS_none",
   "kXGS_init",
   "kXGS_cert",
   "kXGS_pxyreq",
   "kXGS_reserved"
}

Definition at line 89 of file XrdSecProtocolgsi.cc.

Referenced by ServerStepStr().

◆ gsiTrace

XrdOucTrace* gsiTrace = 0

Definition at line 217 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::Init(), and XrdSecProtocolgsiInit().

◆ gUsrPxyDef

const char* gUsrPxyDef = "/tmp/x509up_u"

static

Definition at line 130 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::Init(), and gsiOptions::Print().

◆ kOneDay

const int kOneDay = 86400

static

Definition at line 128 of file XrdSecProtocolgsi.cc.

◆ Prefix

String Prefix = "xrd"

static

Definition at line 77 of file XrdSecProtocolgsi.cc.

◆ ProtoID

String ProtoID = XrdSecPROTOIDENT

static

Definition at line 78 of file XrdSecProtocolgsi.cc.

◆ Version

const kXR_int32 Version = XrdSecgsiVERSION

static

Definition at line 79 of file XrdSecProtocolgsi.cc.

Referenced by XrdSecProtocolgsi::XrdSecProtocolgsi(), XrdSecProtocolgsi::getCredentials(), and XrdSecProtocolgsi::Init().

Macros

Functions

Variables

Macro Definition Documentation

◆ POPTS

Function Documentation

◆ AuthzFunCheck()

◆ ClientStepStr()

◆ GetCACheck()

◆ GetSrvCertEntCheck()

◆ QueryGMAPCheck()

◆ QueryProxyCheck()

◆ ServerStepStr()

◆ XrdSecProtocolgsiInit()

◆ XrdSecProtocolgsiObject()

◆ XrdVERSIONINFO()

Variable Documentation

◆ gGSErrStr

◆ gNoPadTag

◆ gsiClientSteps

◆ gsiServerSteps

◆ gsiTrace

◆ gUsrPxyDef

◆ kOneDay

◆ Prefix

◆ ProtoID

◆ Version