lcas_voms.c

Go to the documentation of this file.

/*                                                                                                            
 * Copyright (c) Members of the EGEE Collaboration. 2004.
 * See http://eu-egee.org/partners/ for details on the copyright holders.
 * For license conditions see the license file or
 * http://eu-egee.org/license.html
 */

/*
 * Copyright (c) 2001 EU DataGrid.                                                                             
 * For license conditions see http://www.eu-datagrid.org/license.html                                          
 *
 * Copyright (c) 2001, 2002 by 
 *     Martijn Steenbakkers <martijn@nikhef.nl>,
 *     David Groep <davidg@nikhef.nl>,
 *     NIKHEF Amsterdam, the Netherlands
 */

/*****************************************************************************
                            Include header files
******************************************************************************/
#include "lcas_config.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pwd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <libgen.h>
#include <openssl/x509.h>
#include <errno.h>
#include "gssapi.h"

#include "lcas_modules.h"
#include "lcas_voms_utils.h"
#include "lcas_vo_data.h"
#include "lcas_gridlist.h"

#include <libxml/tree.h>
#include "gridsite.h"
#include "gridsite-gacl.h"

#include "voms_apic.h"
#include "globus_gss_assist.h"

#undef TESTBIO
#ifdef TESTBIO
#    include <openssl/pem.h>
#    include <openssl/bio.h>
#endif


/******************************************************************************
                                Definitions
******************************************************************************/

#define VOMS_BUFFER_SIZE 1024

/******************************************************************************
                               Type definitions
******************************************************************************/
typedef enum authformat_e
{
    NO_FORMAT,     
    SIMPLE_FORMAT, 
    GACL_FORMAT,   
    XACML_FORMAT,  
}
authformat_t;

typedef enum gacl_use_voms_dn_e
{
    ALWAYS_USE_VOMS_DN,  
    USE_VOMS_DN,         
    DONT_USE_VOMS_DN,    
}
gacl_use_voms_dn_t;

/******************************************************************************
                          Module specific prototypes
******************************************************************************/
static void print_vomsdata(struct vomsdata *);
static void print_vomsdata(struct vomsdata *);
static int  lcas_check_gacl(GACLuser *, char *);
static int  lcas_gacl_add_dn(GACLuser **, char *);
static int  lcas_gacl_add_vomsdata(GACLuser **, lcas_vo_data_t *, char *);

#ifdef TESTBIO
static STACK_OF(X509) *load_chain(char *certfile);
static char *retmsg[] = { "VERR_NONE", "VERR_NOSOCKET", "VERR_NOIDENT", "VERR_COMM", 
                          "VERR_PARAM", "VERR_NOEXT", "VERR_NOINIT",
                          "VERR_TIME", "VERR_IDCHECK", "VERR_EXTRAINFO",
                          "VERR_FORMAT", "VERR_NODATA", "VERR_PARSE",
                          "VERR_DIR", "VERR_SIGN", "VERR_SERVER", 
                          "VERR_MEM", "VERR_VERIFY", "VERR_IDENT",
                          "VERR_TYPE", "VERR_ORDER" };
#endif

/******************************************************************************
                       Define module specific variables
******************************************************************************/


static authformat_t authformat       = NO_FORMAT;
static char *       authfile         = NULL;
static char *       certdir          = NULL;
static char *       vomsdir          = NULL;
static char         voms_buffer[VOMS_BUFFER_SIZE];
static authformat_t gacl_use_voms_dn = USE_VOMS_DN;
static int          use_user_dn = 0;

#ifdef TESTBIO
static STACK_OF(X509) *load_chain(char *certfile)
{
    STACK_OF(X509_INFO) *sk=NULL;
    STACK_OF(X509) *stack=NULL, *ret=NULL;
    BIO *in=NULL;
    X509_INFO *xi;
    int first = 1;

    if(!(stack = sk_X509_new_null()))
    {
        printf("%s: memory allocation failure\n", logstr);
        goto end;
    }

    if(!(in=BIO_new_file(certfile, "r")))
    {
        printf("%s: error opening the file, %s\n", logstr,certfile);
        goto end;
    }

    /* This loads from a file, a stack of x509/crl/pkey sets */
    if(!(sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL)))
    {
        printf("%s: error reading the file, %s\n", logstr,certfile);
        goto end;
    }

    /* scan over it and pull out the certs */
    while (sk_X509_INFO_num(sk))
    {
        /* skip first cert */
        if (first)
        {
            first = 0;
            continue;
        }
        xi=sk_X509_INFO_shift(sk);
        if (xi->x509 != NULL)
        {
            sk_X509_push(stack,xi->x509);
            xi->x509=NULL;
        }
        X509_INFO_free(xi);
    }
    if(!sk_X509_num(stack))
    {
        printf("%s: no certificates in file, %s\n", logstr,certfile);
        sk_X509_free(stack);
        goto end;
    }
    ret=stack;
end:
    BIO_free(in);
    sk_X509_INFO_free(sk);
    return(ret);
}
#endif

/******************************************************************************
Function:   plugin_initialize
Description:
    Initialize plugin
Parameters:
    argc, argv
    argv[0]: the name of the plugin
Returns:
    LCAS_MOD_SUCCESS : succes
    LCAS_MOD_FAIL    : failure
    LCAS_MOD_NOFILE  : db file not found (will halt LCAS initialization)
******************************************************************************/
int plugin_initialize(
        int argc,
        char ** argv
)
{
    struct stat  buf;
    char *       logstr = "\tlcas_plugin_voms-plugin_initialize()";
    char *       authfilecopy = NULL;
    char *       authfilebase = NULL;
    int          i;
 
    lcas_log_debug(1,"%s: passed arguments:\n", logstr);
    for (i=0; i < argc; i++)
    {
       lcas_log_debug(2,"%s: arg %d is %s\n", logstr, i, argv[i]);
    }
 
    /*
     * CERTDIR = The directory which contains the CA certificates
     * VOMSDIR = The directory which contains the certificates of the VOMS servers 
     */
 
    /*
     * Parse arguments, argv[0] = name of plugin, so start with i = 1
     */
    for (i = 1; i < argc; i++)
    {
        if ( ((strcmp(argv[i], "-vomsdir") == 0) ||
              (strcmp(argv[i], "-VOMSDIR") == 0))
             && (i + 1 < argc))
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 vomsdir = strdup(argv[i + 1]);
            }
            i++;
        }
        else if ( ((strcmp(argv[i], "-certdir") == 0) ||
                   (strcmp(argv[i], "-CERTDIR") == 0))
                   && (i + 1 < argc))
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 certdir = strdup(argv[i + 1]);
            }
            i++;
        }
        else if ((strcmp(argv[i], "-authfile") == 0)
                   && (i + 1 < argc))
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 authfile = strdup(argv[i + 1]);
            }
            i++;
        }
        else if ((strcmp(argv[i], "-authformat") == 0)
                   && (i + 1 < argc))
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 if ( (strcmp(argv[i + 1], "gacl") == 0) || (strcmp(argv[i + 1], "GACL") == 0) )
                 {
                     authformat = GACL_FORMAT;
                 }
                 else if ( (strcmp(argv[i + 1], "xacml") == 0) || (strcmp(argv[i + 1], "XACML") == 0) )
                 {
                     authformat = XACML_FORMAT;
                 }
                 else if ( (strcmp(argv[i + 1], "simple") == 0) || (strcmp(argv[i + 1], "SIMPLE") == 0) )
                 {
                     authformat = SIMPLE_FORMAT;
                 }
                 else
                 {
                     lcas_log(0,"%s: use  \"simple/SIMPLE\", \"gacl/GACL\" or \"xacml/XACML\" for option %s\n",
                                logstr, argv[i]);
                     goto fail_voms_init;
                 }
            }
            i++;
        }
        else if (strcmp(argv[i], "-use_user_dn") == 0)
        {
            use_user_dn = 1;
        }
        else if ((strcmp(argv[i], "-gacl_use_voms_dn") == 0)
                   && (i + 1 < argc))
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 if ( (strcmp(argv[i + 1], "yes") == 0) || (strcmp(argv[i + 1], "YES") == 0) )
                 {
                     gacl_use_voms_dn = USE_VOMS_DN;
                 }
                 else if ( (strcmp(argv[i + 1], "no") == 0) || (strcmp(argv[i + 1], "NO") == 0) )
                 {
                     gacl_use_voms_dn = DONT_USE_VOMS_DN;
                 }
                 else if ( (strcmp(argv[i + 1], "always") == 0) || (strcmp(argv[i + 1], "ALWAYS") == 0) )
                 {
                     gacl_use_voms_dn = ALWAYS_USE_VOMS_DN;
                 }
                 else
                 {
                     lcas_log(0,"%s: use  \"yes/YES\", \"no/NO\" or \"always/ALWAYS\" for option %s\n",
                                logstr, argv[i]);
                     goto fail_voms_init;
                 }
            }
            i++;
        }
        else
        {
            lcas_log(0,"%s: Error in initialization parameter: %s (failure)\n", logstr,
                       argv[i]);
            return LCAS_MOD_FAIL;
        }
    }

    /* Check if authfile is filled */
    if (authfile == NULL)
    {
        lcas_log(0, "%s: authorization file is not specified (failure)\n", logstr);
        goto fail_voms_init;
    }
    if ((stat(authfile, &buf)) != 0)
    {
        lcas_log(0, "%s: unable to get stat of authorization file: %s\n", logstr, authfile);
        lcas_log(0, "%s: %s\n", logstr, strerror(errno));
        goto fail_voms_init;
    }
    if ( !(S_ISREG(buf.st_mode)))
    {
        lcas_log(0, "%s: specified authorization file (%s) is not a regular file (failure)\n",
                   logstr, authfile);
        goto fail_voms_init;
    }

    /* If necessary, try to establish the authorization file format from suffix */
    if (authformat == NO_FORMAT)
    {
        authfilecopy = strdup(authfile);
        authfilebase = basename(authfilecopy);
        if (strstr(authfilebase, ".gacl") != NULL)
        {
            authformat = GACL_FORMAT;
        }
        else if (strstr(authfilebase, ".xacml") != NULL)
        {
            authformat = XACML_FORMAT;
        }
        else
        {
            authformat = SIMPLE_FORMAT;
        }
        if (authfilecopy)
        {
            free(authfilecopy);
            authfilecopy = NULL;
        }
    }
    lcas_log_debug(1, "%s: authorization file: %s, format: %d\n", logstr, authfile, authformat);

    /* success */
// success_voms_init:
    return LCAS_MOD_SUCCESS;

    /* failure */
 fail_voms_init:
    return LCAS_MOD_FAIL;
} 




/******************************************************************************
Function:   plugin_confirm_authorization
Description:
    Ask for authorization by passing RSL and user credential
Parameters:
    request:   RSL request
    user_cred: user credential
Returns:
    LCAS_MOD_SUCCESS : succes
    LCAS_MOD_FAIL    : failure
******************************************************************************/
int
plugin_confirm_authorization(lcas_request_t request, lcas_cred_id_t lcas_cred)
{
    char * logstr = "\tlcas_plugin_voms-plugin_confirm_authorization()";
    char *              dn          = NULL; 
    struct vomsdata *   vd          = NULL;
    int                 errNo       = 0;
    gss_cred_id_t       cred        = GSS_C_NO_CREDENTIAL;
    X509 *              px509_cred  = NULL;
    STACK_OF(X509) *    px509_chain = NULL;
    GACLuser *          gacluser = NULL;
    int                 rc = 0;
    char *              dummy = NULL;

#ifdef TESTBIO
    int err;
    int res;
    BIO *in = NULL;
    X509 *x = NULL;
    STACK_OF(X509) *chain;
#endif


    /*
     * The beginning
     */
    lcas_log_debug(1,"%s:\n", logstr);

    /*
     * Get the gss_cred_t credential and get the globus name
     */
    if ( (dn = lcas_get_dn(lcas_cred)) == NULL)
    {
        lcas_log(0, "%s: Error, user DN empty\n", logstr);
        goto fail_voms;
    }
    if ( (cred = lcas_get_gss_cred(lcas_cred)) == GSS_C_NO_CREDENTIAL)
    {
        lcas_log(0, "%s: Error, user gss credential is empty !\n", logstr);
        goto fail_voms;
    }

#undef EXPORT_CREDENTIAL
#if EXPORT_CREDENTIAL
    if (cred)
    {
        gss_buffer_desc                 deleg_proxy_filename;
        OM_uint32         major_status = 0;
        OM_uint32         minor_status = 0;
        
        major_status = gss_export_cred(&minor_status,
                                       cred,
                                       NULL,
                                       1,
                                       &deleg_proxy_filename);

        if (major_status == GSS_S_COMPLETE)
        {
            char *                      cp;

            lcas_log_debug(1,"%s: deleg_proxy_filename.value: %s\n", logstr,
                               deleg_proxy_filename.value);
            cp = strchr((char *)deleg_proxy_filename.value, '=');
            *cp = '\0';
            cp++;
            setenv((char *)deleg_proxy_filename.value, cp, 1);
            free(deleg_proxy_filename.value);
        }
        else
        {
            char *                      error_str = NULL;
            globus_object_t *           error_obj;

            error_obj = globus_error_get((globus_result_t) minor_status);
            
            error_str = globus_error_print_chain(error_obj);
            lcas_log(0,"%s: Error, gss_export_cred(): %s\n", logstr,error_str);
            goto fail_voms;
        }
    }
#endif /* EXPORT_CREDENTIAL */

    /*
     * Retrieve a newly created X509 struct and X509 chain from gss credential (should be freed)
     */
    if ( ( px509_cred = lcas_cred_to_x509(cred) ) )
    {
        lcas_log_debug(1,"%s: found X509 struct inside gss credential\n", logstr);
        lcas_log_debug(5,"%s: just for kicks: X509->name %s\n", logstr,px509_cred->name);
    }
    else
    {
        lcas_log(0,"%s: could not get X509 cred (exit voms)!\n", logstr);
        goto fail_voms;
    }
    if ( ( px509_chain = lcas_cred_to_x509_chain(cred) ) )
    {
        lcas_log_debug(1,"%s: found X509 chain inside gss credential\n", logstr);
    }
    else
    {
        lcas_log(0,"%s: could not get X509 chain (exit voms)!\n", logstr);
        goto fail_voms;
    }

    lcas_log_debug(1,"%s: vomsdir = %s\n", logstr, vomsdir);
    lcas_log_debug(1,"%s: certdir = %s\n", logstr, certdir);
    if ((vd = VOMS_Init(vomsdir, certdir)) == NULL)
    {
        lcas_log(0,"%s: Failed to initialize voms data structure\n", logstr);
        lcas_log(0,"%s:  This may be because either the specified voms directory (%s)\n",logstr,vomsdir);
        lcas_log(0,"%s:  or the specified CA certificates directory (%s) does not exist\n", logstr, certdir);
        goto fail_voms;
    }
    lcas_log_debug(1,"%s: voms data structure initialized\n", logstr);

#ifdef TESTBIO
    in = BIO_new(BIO_s_file());
    chain = load_chain("/home/gridtest/cvs/fabric_mgt/gridification/lcas/modules/voms/x509up_u500");
    if (in)
    {
        if (BIO_read_filename(in, "/home/gridtest/cvs/fabric_mgt/gridification/lcas/modules/voms/x509up_u500") > 0)
        {
            x = PEM_read_bio_X509(in, NULL, 0, NULL);

            res = VOMS_Retrieve(x, chain, RECURSE_CHAIN, vd, &err);

            if (res)
                print_vomsdata(vd);
            else
                printf("%s: ERROR!\n", logstr);
        }
    }

    if (!res)
    {
        printf("%s: err: %s\n", logstr, retmsg[err]);
    }
#else
    if (VOMS_Retrieve(px509_cred, px509_chain, RECURSE_CHAIN, 
                         vd, &errNo))
#endif
    {
        lcas_vo_data_t *   lcas_vo_data = NULL;
        struct voms **     volist = vd->data;
        struct voms *      vo;
        char *             bufptr = NULL;
        int                k = 0;
        int                j = 0;
        int                foundmatch = 0;

        lcas_log_debug(1,"%s: We got something, errNo = %d\n", logstr, errNo);
        print_vomsdata(vd);

        if (authformat == GACL_FORMAT)
        {
            /* initialize gacl */
            GACLinit();
            if (lcas_gacl_add_dn(&gacluser, dn) != 0)
            {
                lcas_log(0,"%s: error adding dn %s to gacluser\n", logstr, dn);
                goto fail_voms;
            }
            else
            {
                lcas_log_debug(2,"%s: added dn %s to gacluser\n", logstr, dn);
            }
        }

        while(volist[k])
        {
            vo = volist[k++];
            lcas_log_debug(1,"%s: setting voms data for VO == %s\n", logstr,
                             vo->voname);
            lcas_log_debug(2,"%s: setting voms data for VO server == %s\n", logstr,
                             vo->server);

            switch (vo->type) {
                case TYPE_NODATA:
                    lcas_log_debug(1,"%s: NO DATA\n", logstr);
                    break;
                case TYPE_CUSTOM:
                    lcas_log_debug(1,"%s: %*s\n", logstr, vo->datalen - 10, vo->custom);
                    break;
                case TYPE_STD:
                    j = 0;
                    while (vo->std[j]) {
                        char *  fqan = NULL;
                        int     ifqan = 0;
                        int     found_fqan = 0;

                        lcas_vo_data=lcas_createVoData(vo->voname,vo->std[j]->group,
                                                           NULL, vo->std[j]->role, vo->std[j]->cap
                        );
                        if (! lcas_vo_data)
                        {
                            lcas_log(0,"%s: could not create VoData structure (failure)\n", logstr);
                            goto fail_voms;
                        }
                        if ( lcas_stringVoData(lcas_vo_data, voms_buffer, VOMS_BUFFER_SIZE) )
                        {
                            lcas_log(0,"%s: error in casting VoData structure into string (failure)\n", logstr);
                            goto fail_voms;
                        }
                        /*
                         * Now that we have the VO-GROUP-ROLE combination as a string it has to be matched in the
                         * authorization file. Check the format.
                         */
                        /*
                         * From version 1.2.x we support also FQANs. These are available in the as a NULL terminated
                         * list of strings: vo->fqan
                         * We're going to increment the counter of this array along with the counter of the triplet
                         * and check if the fqan is found when using the SIMPLE_FORMAT
                         */
                        if (vo->fqan)
                        {
                            while ((vo->fqan)[ifqan] != NULL)
                            {
                                if (ifqan == j) /* found the corresponding fqan */
                                {
                                    fqan = (vo->fqan)[ifqan];
                                    lcas_log_debug(1, "%s: fqan:   %s\n", logstr, fqan);
                                    break;
                                }
                                ifqan++;
                            }
                        }
                        if (fqan == NULL)
                        {
                            lcas_log(0, "%s: WARNING could not find fqan inside VOMS structure, only VOMS triplet\n", logstr);
                        }
                        if (authformat == SIMPLE_FORMAT)
                        {
                            /* check with gridlist, first try it with the fqan */
                            rc = lcas_gridlist(fqan, &dummy, authfile, MATCH_ONLY_DN|MATCH_WILD_CHARS, NULL, NULL);
                            if ( rc == LCAS_MOD_ENTRY )
                            {
                                /* Entry found for VO combi */
                                lcas_log_debug(1,"%s: entry found for fqan %s\n", logstr, fqan);
                                foundmatch++;
                            }
                            else if ( rc == LCAS_MOD_NOFILE )
                            {
                                /* file not found */
                                lcas_log(0, "%s: Error, Cannot find authorization file: %s\n", logstr, authfile);
                                if (dummy)
                                {
                                    free(dummy);
                                    dummy = NULL;
                                }
                                goto fail_voms;;
                            }
                            else
                            {
                                /* no entry found, not fatal */
                                lcas_log_debug(1, "%s: no entry for fqan %s in %s\n", logstr, fqan, authfile);
                            }
                            if (dummy)
                            {
                                free(dummy);
                                dummy = NULL;
                            }

                            /* If no entry found for the FQAN try it with the VO string (in voms_buffer) */
                            if (foundmatch == 0)
                            {
                                lcas_log_debug(1, "%s: Trying old format: %s instead of %s\n", logstr, voms_buffer, fqan);
                                rc = lcas_gridlist(voms_buffer, &dummy, authfile, MATCH_ONLY_DN|MATCH_WILD_CHARS, NULL, NULL);
                                if ( rc == LCAS_MOD_ENTRY )
                                {
                                    /* Entry found for VO combi */
                                    lcas_log_debug(1,"%s: entry found for VOMS triplet %s\n", logstr, voms_buffer);
                                    foundmatch++;
                                }
                                else if ( rc == LCAS_MOD_NOFILE )
                                {
                                    /* file not found */
                                    lcas_log(0, "%s: Error, Cannot find authorization file: %s\n", logstr, authfile);
                                    if (dummy)
                                    {
                                        free(dummy);
                                        dummy = NULL;
                                    }
                                    goto fail_voms;;
                                }
                                else
                                {
                                    /* no entry found, not fatal */
                                    lcas_log_debug(1, "%s: no entry for VOMS triplet %s in %s\n", logstr, voms_buffer, authfile);
                                }
                                if (dummy)
                                {
                                    free(dummy);
                                    dummy = NULL;
                                }
                            }
                        }
                        else if (authformat == GACL_FORMAT)
                        {
                            /* Fill the gacluser with another VOMS credential, do the ACL checking afterwards */
                            if ( (gacl_use_voms_dn == USE_VOMS_DN) || (gacl_use_voms_dn == ALWAYS_USE_VOMS_DN) )
                            {
                                if (!lcas_parseVostring(vo->server))
                                {
                                    lcas_log(0,"%s: No VOMS server DN found in user cert. (failure)\n", logstr);
                                    goto fail_voms;
                                }
                                /* First create a credential with the VOMS DN */
                                if (lcas_gacl_add_vomsdata(&gacluser, lcas_vo_data, vo->server) != 0)
                                {
                                    lcas_log(0,"%s: error adding voms data for %s to gacluser\n", logstr, voms_buffer);
                                    goto fail_voms;
                                }
                                else
                                {
                                    lcas_log_debug(2,"%s: added voms data for %s to gacluser\n", logstr, voms_buffer);
                                }
                                /* Then create a credential without the VOMS DN if (gacl_use_voms_dn == USE_VOMS_DN) */
                                if (gacl_use_voms_dn == USE_VOMS_DN)
                                {
                                    if (lcas_gacl_add_vomsdata(&gacluser, lcas_vo_data, NULL) != 0)
                                    {
                                        lcas_log(0,"%s: error adding voms data for %s to gacluser\n", logstr, voms_buffer);
                                        goto fail_voms;
                                    }
                                    else
                                    {
                                        lcas_log_debug(2,"%s: added voms data for %s to gacluser\n", logstr, voms_buffer);
                                    }
                                }
                            }
                            else if (gacl_use_voms_dn == DONT_USE_VOMS_DN)
                            {
                                /* Create a credential without the VOMS DN */
                                if (lcas_gacl_add_vomsdata(&gacluser, lcas_vo_data, NULL) != 0)
                                {
                                    lcas_log(0,"%s: error adding voms data for %s to gacluser\n", logstr, voms_buffer);
                                    goto fail_voms;
                                }
                                else
                                {
                                    lcas_log_debug(2,"%s: added voms data for %s to gacluser\n", logstr, voms_buffer);
                                }
                            }
                        }
                        else if (authformat == XACML_FORMAT)
                        {
                            /* check with xacml */
                            lcas_log(0,"%s: This (%d) format is not supported yet\n", logstr, authformat);
                        }
                        else
                        {
                            lcas_log(0,"%s: This (%d) format is not supported\n", logstr, authformat);
                        }
                        /* Add credential */
                        /* copy address of voms_buffer[0] in bufptr, because you cannot take the address of the array voms_buffer */
                        bufptr = voms_buffer;
//                        addCredentialData(LCAS_VO_CRED_STRING, (void *) &bufptr);
//                        addCredentialData(LCAS_VO_CRED, (void *) lcas_vo_data);
                        if ( lcas_deleteVoData(&lcas_vo_data) )
                        {
                            lcas_log(0,"%s: error while deleting VoData structure (failure)\n", logstr);
                            goto fail_voms;
                        }
                        j++;
                    }
                    break;
            }
        }
        lcas_log_debug(1,"%s: doing VOMS_Destroy\n", logstr);
        VOMS_Destroy(vd);
        lcas_log_debug(1,"%s: done\n", logstr);

        /* evaluate the matching, may become more elaborate */
        
        if (authformat == GACL_FORMAT)
        {
            /* check with gacl */
            /* Perhaps do something with fatalness, if deny found always quit */
            rc = lcas_check_gacl(gacluser, authfile);
            if (rc == 0)
            {
                lcas_log_debug(1, "%s: authorization granted based on VOMS info for user %s in %s\n", logstr, dn, authfile);
            }
            else
            {
                /* no authorization --> failure */
                lcas_log(0, "%s: authorization denied based on VOMS info for user %s in %s\n", logstr, dn, authfile);
                goto fail_voms;
            }
        }
        else
        {
            if (foundmatch)
            {
                lcas_log_debug(1,"%s: found a matching VO entry in the authorization file\n", logstr);
            }
            else
            {
                lcas_log(0,"%s: Did not find a matching VO entry in the authorization file\n", logstr);
                goto fail_voms;
            }
        }
        
    }
#ifdef TESTBIO
#else
    else if (errNo == VERR_NOEXT)
    {
        /*
         * If no voms info is found in user proxy: try with the user dn if
         * use_user_dn flag is specified
         */
        if (use_user_dn != 0)
        {
            lcas_log_debug(1,"%s: VOMS extensions missing from certificate, trying\n", logstr);
            lcas_log_debug(1,"%s: to find user dn (%s) in authorization file %s\n", logstr, dn, authfile);

            if (authformat == SIMPLE_FORMAT)
            {
                /* check with gridlist */
                rc = lcas_gridlist(dn, &dummy, authfile, MATCH_ONLY_DN, NULL, NULL);
                if ( rc == LCAS_MOD_ENTRY )
                {
                    /* Entry found for user DN */
                    lcas_log_debug(1,"%s: entry found for %s\n", logstr, dn);
                }
                else if ( rc == LCAS_MOD_NOFILE )
                {
                    /* file not found */
                    lcas_log(0, "%s: Error, Cannot find authorization file: %s\n", logstr, authfile);
                    if (dummy)
                    {
                        free(dummy);
                        dummy = NULL;
                    }
                    goto fail_voms;;
                }
                else
                {
                    /* no entry found --> failure */
                    lcas_log(0, "%s: authorization denied based on DN info for user\n", logstr);
                    lcas_log(0, "%s: %s in %s\n", logstr, dn, authfile);
                    lcas_log(0, "%s: (in addition no VOMS info was found in user proxy)\n", logstr);
                    if (dummy)
                    {
                        free(dummy);
                        dummy = NULL;
                    }
                    goto fail_voms;
                }
            }
            else if (authformat == GACL_FORMAT)
            {
                /* initialize gacl */
                GACLinit();
                if (lcas_gacl_add_dn(&gacluser, dn) != 0)
                {
                    lcas_log(0,"%s: error adding dn %s to gacluser\n", logstr, dn);
                    goto fail_voms;
                }
                else
                {
                    lcas_log_debug(2,"%s: added dn %s to gacluser\n", logstr, dn);
                }
                /* check with gacl */
                /* Perhaps do something with fatalness, if deny found always quit */
                rc = lcas_check_gacl(gacluser, authfile);
                if (rc == 0)
                {
                    lcas_log_debug(1, "%s: authorization granted based on DN info for user %s in %s\n", logstr, dn, authfile);
                }
                else
                {
                    /* no authorization --> failure */
                    lcas_log(0, "%s: authorization denied based on DN info for user\n", logstr);
                    lcas_log(0, "%s: %s in %s\n", logstr, dn, authfile);
                    lcas_log(0, "%s: (in addition no VOMS info was found in user proxy)\n", logstr);
                    goto fail_voms;
                }
            }
            else
            {
                lcas_log(0,"%s: This (%d) format is not supported yet, but this should have been checked earlier in the process! \n", logstr, authformat);
            }
        }
        else
        {
            lcas_log(0,"%s: VOMS extensions missing from certificate (failure)!\n", logstr);
            goto fail_voms;
        }
    }
    else if (errNo == VERR_IDCHECK)
    {
        lcas_log(0,"%s: VOMS User data in extension different from the real ones (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_TIME)
    {
        lcas_log(0,"%s: VOMS extensions expired for at least one of the VOs (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_ORDER)
    {
        lcas_log(0,"%s: The ordering of the VOMS groups, as required by the client, was not delivered by VOMS (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_NOSOCKET)
    {
        lcas_log(0,"%s: VOMS Socket problem (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_NOIDENT)
    {
        lcas_log(0,"%s: VOMS Cannot identify itself (certificate problem) (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_COMM)
    {
        lcas_log(0,"%s: VOMS server problem (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_PARAM)
    {
        lcas_log(0,"%s: Wrong parameters for VOMS (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_NOINIT)
    {
        lcas_log(0,"%s: VOMS initialization error (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_EXTRAINFO)
    {
        lcas_log(0,"%s: VO name and URI missing (in proxy ?) (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_FORMAT)
    {
        lcas_log(0,"%s: Wrong VOMS data format (in proxy ?) (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_NODATA)
    {
        lcas_log(0,"%s: Empty VOMS extension (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_PARSE)
    {
        lcas_log(0,"%s: VOMS parse error (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_DIR)
    {
        lcas_log(0,"%s: VOMS directory error (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_SIGN)
    {
        lcas_log(0,"%s: VOMS Signature error (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_SERVER)
    {
        lcas_log(0,"%s: Unidentifiable VOMS server (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_MEM)
    {
        lcas_log(0,"%s: Memory problems in VOMS_Retrieve() (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_VERIFY)
    {
        lcas_log(0,"%s: Generic verification error for VOMS (failure)!\n", logstr);
        goto fail_voms;
    }
    else if (errNo == VERR_TYPE)
    {
        lcas_log(0,"%s: Returned VOMS data of unknown type (failure)!\n", logstr);
        goto fail_voms;
    }
    else
    {
        lcas_log(0,"%s: VOMS_Retrieve() error --> %d (failure)!\n", logstr, errNo);
        goto fail_voms;
    }
#endif

    /* succes */
// success_voms:
    if (px509_cred) X509_free(px509_cred);
    if (px509_chain) sk_X509_free(px509_chain);
    if (authformat == GACL_FORMAT)
    {
        if (gacluser)
        {
            GACLfreeUser(gacluser);
            gacluser = NULL;
        }
    }
    lcas_log_time(0,"%s: voms plugin succeeded\n", logstr);
    return LCAS_MOD_SUCCESS;

 fail_voms:
    if (px509_cred) X509_free(px509_cred);
    if (px509_chain) sk_X509_free(px509_chain);
    if (authformat == GACL_FORMAT)
    {
        if (gacluser)
        {
            GACLfreeUser(gacluser);
            gacluser = NULL;
        }
    }
    lcas_log_time(0,"%s: voms plugin failed\n", logstr);
    return LCAS_MOD_FAIL;
}

/******************************************************************************
Function:   plugin_terminate
Description:
    Terminate plugin
Parameters:

Returns:
    LCAS_MOD_SUCCESS : succes
    LCAS_MOD_FAIL    : failure
******************************************************************************/
int plugin_terminate()
{
    char * logstr = "\tlcas_plugin_voms-plugin_terminate()";
    lcas_log_debug(1,"%s: terminating\n", logstr);
    if (vomsdir)
    {
        free(vomsdir);
        vomsdir = NULL;
    }
    if (certdir)
    {
        free(certdir);
        certdir = NULL;
    }
    if (authfile)
    {
        free(authfile);
        authfile = NULL;
    }

    return LCAS_MOD_SUCCESS;
}


/******************************************************************************
Function:   lcas_gacl_add_dn
Description:
    Add the user DN to the gacl user credential
Parameters:
    pgacluser:      pointer to the gacl user
    user_dn:        the DN of the user

Returns:
    0 : succes
    1 : failure
******************************************************************************/
static int lcas_gacl_add_dn(
        GACLuser ** pgacluser,
        char *      user_dn
)
{
    char *      logstr = "\tlcas_plugin_voms-lcas_gacl_add_dn()";
    GACLcred *  dn_cred = NULL;
    GACLuser *  gacluser = NULL;
    
    if (user_dn)
    {
        if ( (dn_cred = GACLnewCred("person")) != NULL )
        {
            lcas_log_debug(3,"%s: adding dn = %s to dn_cred\n", logstr, user_dn);
            GACLaddToCred(dn_cred, "dn", user_dn);
        }
        else
        {
            lcas_log_debug(1,"%s: Cannot create new credential\n", logstr);
            return 1;
        }
    }
    else
    {
        lcas_log_debug(1,"%s: empty user DN !, cannot fill GACLuser\n", logstr);
        return 1;
    }

    /* if necessary create user and add credential to user */
    if (pgacluser == NULL)
    {
        /* This should not happen ! */
        lcas_log(0, "%s: ptr to gacluser is NULL !, wrong invocation of lcas_gacl_add_dn()\n", logstr);
        GACLfreeCred(dn_cred);
        return 1;
    }
    gacluser = *pgacluser;
    if (gacluser == NULL) /* create new user */
    {
        if ( (gacluser = GACLnewUser(dn_cred)) == NULL )
        {
            lcas_log(0, "%s: Could not create new user\n", logstr);
            GACLfreeCred(dn_cred);
            return 1;
        }
        *pgacluser = gacluser;
    }
    else
    {
        if (GACLuserAddCred(gacluser, dn_cred) != 1)
        {
            lcas_log(0, "%s: Could not add credential to user\n", logstr);
            return 1;
        }
    } 

    /* clean credential */
    if (dn_cred)
    {
        /* Cannot free credential, because it's used in the gacluser
           structure (only a copy of the credential pointer is made)
        GACLfreeCred(dn_cred);
        */
        dn_cred = NULL;
    }
    return 0;
}


/******************************************************************************
Function:   lcas_gacl_add_vomsdata
Description:
    Add the VOMS data to the gacl user
Parameters:
    pgacluser:       pointer to the gacl user
    lcas_voms_data:  the gathered VOMS data structure
    voms_server_dn:  the DN of the VOMS server that signed the VOMS certificate

Returns:
    0 : succes
    1 : failure
******************************************************************************/
static int lcas_gacl_add_vomsdata(
        GACLuser **       pgacluser,
        lcas_vo_data_t *  lcas_voms_data,
        char *            voms_server_dn
)
{
    char *      logstr = "\tlcas_plugin_voms-lcas_gacl_add_vomsdata()";
    GACLcred *  voms_cred = NULL;
    GACLuser *  gacluser = NULL;
    
    if (lcas_voms_data)
    {
        if ( (voms_cred = GACLnewCred("voms-cred")) != NULL )
        {
            char * strptr = NULL;

            if ( (strptr = lcas_parseVostring(voms_server_dn)) )
            {
                lcas_log_debug(3,"%s: adding voms       = %s to voms_cred\n", logstr, strptr);
                GACLaddToCred(voms_cred, "voms", strptr);
            }
            if ( (strptr = lcas_parseVostring(lcas_voms_data->vo)) )
            {
                lcas_log_debug(3,"%s: adding vo         = %s to voms_cred\n", logstr, strptr);
                GACLaddToCred(voms_cred, "vo", strptr);
            }
            if ( (strptr = lcas_parseVostring(lcas_voms_data->group)) )
            {
                lcas_log_debug(3,"%s: adding group      = %s to voms_cred\n", logstr, strptr);
                GACLaddToCred(voms_cred, "group", strptr);
            }
            if ( (strptr = lcas_parseVostring(lcas_voms_data->subgroup)) )
            {
                lcas_log_debug(3,"%s: adding subgroup   = %s to voms_cred\n", logstr, strptr);
                GACLaddToCred(voms_cred, "group", strptr);
            }
            if ( (strptr = lcas_parseVostring(lcas_voms_data->role)) )
            {
                lcas_log_debug(3,"%s: adding role       = %s to voms_cred\n", logstr, strptr);
                GACLaddToCred(voms_cred, "role", strptr);
            }
            if ( (strptr = lcas_parseVostring(lcas_voms_data->capability)) )
            {
                lcas_log_debug(3,"%s: adding capability = %s to voms_cred\n", logstr, strptr);
                GACLaddToCred(voms_cred, "capability", strptr);
            }
        }
        else
        {
            lcas_log_debug(1,"%s: Cannot create new credential\n", logstr);
            return 1;
        }
    }
    else
    {
        lcas_log_debug(1,"%s: empty VO data !, cannot fill GACLuser\n", logstr);
        return 1;
    }

    /* if necessary create user and add credential to user */
    if (pgacluser == NULL)
    {
        /* This should not happen ! */
        lcas_log(0, "%s: ptr to gacluser is NULL !, wrong invocation of lcas_gacl_add_vomsdata()\n", logstr);
        GACLfreeCred(voms_cred);
        return 1;
    }
    gacluser = *pgacluser;
    if (gacluser == NULL) /* create new user */
    {
        if ( (gacluser = GACLnewUser(voms_cred)) == NULL )
        {
            lcas_log(0, "%s: Could not create new user\n", logstr);
            GACLfreeCred(voms_cred);
            return 1;
        }
        *pgacluser = gacluser;
    }
    else
    {
        if (GACLuserAddCred(gacluser, voms_cred) != 1)
        {
            lcas_log(0, "%s: Could not add credential to user\n", logstr);
            return 1;
        }
    } 

    /* clean credential */
    if (voms_cred)
    {
        /* Cannot free credential, because it's used in the gacluser
           structure (only a copy of the credential pointer is made)
        GACLfreeCred(voms_cred);
        */
        voms_cred = NULL;
    }
    return 0;
}


/******************************************************************************
Function:   lcas_check_gacl
Description:
    Apply the LCAS authorization GACL to the GACL user
Parameters:
    gacluser:  the gacluser, which consists of his DN and VOMS entries
    gaclfile:  the file containing the LCAS GACL.

Returns:
    0 : succes
    1 : failure
******************************************************************************/
static int lcas_check_gacl(
        GACLuser *  gacluser,
        char *      gaclfile
)
{
    /*
     * Procedure:
     * 1. initialize gacl
     * 2. load the gacl file
     * 3. create an GACLuser (list of credentials)
     * 4. check the premissions for the user
     *    (for the moment if the result is none --> deny, otherwise allow)
     */

    char *      logstr = "\tlcas_plugin_voms-lcas_check_gacl()";
    GACLacl *   lcasacl = NULL;
    GACLperm    lcas_gacl_perm = GACL_PERM_NONE;

    /* load the gacl file */
    lcasacl = GACLloadAcl(gaclfile);
    lcas_log_debug(1,"%s: gacl authorization file %s loaded\n", logstr, gaclfile);
    if (lcasacl != NULL)
    {
//        GACLprintAcl(lcasacl, stderr);
    }
    else
    {
        lcas_log(0,"%s: lcasacl is NULL\n", logstr);
        return 1;
    }

    /* check the premissions for the user */
    lcas_gacl_perm = GACLtestExclAcl(lcasacl, gacluser);
    lcas_log_debug(1,"%s: exclusive permission = %d\n", logstr, lcas_gacl_perm);

    lcas_gacl_perm = GACLtestUserAcl(lcasacl, gacluser);
    lcas_log_debug(1,"%s: permission = %d\n", logstr, lcas_gacl_perm);
    if (GACLhasNone(lcas_gacl_perm))
    {
        if (lcas_get_debug_level() >= 5)
            GACLprintAcl(lcasacl, stderr);
        GACLfreeAcl(lcasacl);
        return 1;
    }
    else
    {
        GACLfreeAcl(lcasacl);
        return 0;
    }
}

static void print_vomsdata(struct vomsdata *d)
{
    char * logstr = "\tlcas_plugin_voms-print_vomsdata()";
    struct voms **vo = d->data;
    struct voms *v;
    int k = 0;
    int j =0;
  
    while(vo[k])
    {
        v = vo[k++];
        lcas_log_debug(1,"%s: %d *******************************************\n", logstr,k);
        lcas_log_debug(1,"%s: SIGLEN: %d\n", logstr, v->siglen);
        lcas_log_a_string_debug(1, "\tlcas_plugin_voms-print_vomsdata(): USER:   %s\n", v->user);
        lcas_log_a_string_debug(1, "\tlcas_plugin_voms-print_vomsdata(): UCA:    %s\n", v->userca);
        lcas_log_a_string_debug(1, "\tlcas_plugin_voms-print_vomsdata(): SERVER: %s\n", v->server);
        lcas_log_a_string_debug(1, "\tlcas_plugin_voms-print_vomsdata(): SCA:    %s\n", v->serverca);
        lcas_log_a_string_debug(1, "\tlcas_plugin_voms-print_vomsdata(): VO:     %s\n", v->voname);
        lcas_log_a_string_debug(1, "\tlcas_plugin_voms-print_vomsdata(): URI:    %s\n", v->uri);
        lcas_log_a_string_debug(1, "\tlcas_plugin_voms-print_vomsdata(): DATE1:  %s\n", v->date1);
        lcas_log_a_string_debug(1, "\tlcas_plugin_voms-print_vomsdata(): DATE2:  %s\n", v->date2);

        switch (v->type)
        {
        case TYPE_NODATA:
            lcas_log_debug(1,"%s: NO DATA\n", logstr);
            break;
        case TYPE_CUSTOM:
            lcas_log_debug(1,"%s: VOMS custom type. Wont print.\n", logstr);
            break;
        case TYPE_STD:
            j = 0;
            if (v->fqan)
            {
                while ((v->fqan)[j] != NULL)
                {
                    lcas_log_a_string_debug(1,
                        "\tlcas_plugin_voms-print_vomsdata(): fqan:   %s\n",
                        (v->fqan)[j]);
                    j++;
                }
            }
            j = 0;
            if (v->std)
            {
                while (v->std[j])
                {
                    lcas_log_a_string_debug(1,
                        "\tlcas_plugin_voms-print_vomsdata(): GROUP:  %s\n", v->std[j]->group);
                    lcas_log_a_string_debug(1,
                        "\tlcas_plugin_voms-print_vomsdata(): ROLE:   %s\n", v->std[j]->role);
                    lcas_log_a_string_debug(1,
                        "\tlcas_plugin_voms-print_vomsdata(): CAP:    %s\n", v->std[j]->cap);
                    j++;
                }
            }
            break;
        }
        lcas_log_debug(1,"%s: %d *******************************************\n", logstr,k);
    }

    if (d->workvo)
    {
        lcas_log_a_string_debug(1,
            "\tlcas_plugin_voms-print_vomsdata(): WORKVO: %s\n", d->workvo);
    }

    if (d->extra_data)
    {
        lcas_log_a_string_debug(1,
            "\tlcas_plugin_voms-print_vomsdata(): EXTRA: %s\n", d->extra_data);
    }
}

/******************************************************************************
CVS Information:
    $Source: /cvs/jra1mw/org.glite.security.lcas-plugins-voms/src/voms/lcas_voms.c,v $
    $Date: 2005/02/28 11:45:52 $
    $Revision: 1.8 $
    $Author: msteenba $
******************************************************************************/

---