lcmaps_voms_attributes.c

Go to the documentation of this file.

/*                                                                                                            
 * Copyright (c) Members of the EGEE Collaboration. 2004.
 * See http://eu-egee.org/partners/ for details on the copyright holders.
 * For license conditions see the license file or
 * http://eu-egee.org/license.html
 */

/*
 * Copyright (c) 2001 EU DataGrid.                                                                             
 * For license conditions see http://www.eu-datagrid.org/license.html                                          
 *
 * Copyright (c) 2001, 2002 by 
 *     Martijn Steenbakkers <martijn@nikhef.nl>,
 *     David Groep <davidg@nikhef.nl>,
 *     NIKHEF Amsterdam, the Netherlands
 */

/*****************************************************************************
                            Include header files
******************************************************************************/
#include "lcmaps_config.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pwd.h>
#include <openssl/x509.h>
#include "gssapi.h"

#include "lcmaps_log.h"
#include "_lcmaps_gsi_utils.h"
#include "_lcmaps_voms_attributes.h"

#include "voms_apic.h"

/******************************************************************************
                                Definitions
******************************************************************************/

#define VOMS_BUFFER_SIZE 1024
#define DEFAULT_CERT_DIR "/etc/grid-security/certificates"
#define DEFAULT_VOMS_DIR "/etc/grid-security/vomsdir"

/******************************************************************************
                          Module specific prototypes
******************************************************************************/
static void print_vomsdata(struct vomsdata *);

/******************************************************************************
                       Define module specific variables
******************************************************************************/


static char * certdir = NULL;
static char * vomsdir = NULL;

/******************************************************************************
Function:    lcmaps_gss_cred_to_voms_fqans
Description:
    Extract from a gsi credential (of type gss_cred_id_t) a list of VOMS
    fully qualified attribute names (FQANs)
Parameters:
    gss_credential: gsi credential (of type gss_cred_id_t)
    pnfqan:         the number of fqans found. If the proxy is empty (VERR_NOEXT),
                    this will be set to zero. Not an immediate error !
Returns:
    A list of fqans or NULL
******************************************************************************/
char ** lcmaps_gss_cred_to_voms_fqans(
        gss_cred_id_t gss_credential,
        int * pnfqan
)
{
    char * logstr = "\tlcmaps_gss_cred_to_voms_fqans()";
    struct vomsdata *   vd          = NULL;
    int                 errNo       = 0;
    X509 *              px509_cred  = NULL;
    STACK_OF(X509) *    px509_chain = NULL;
    char **             fqans       = NULL;
    int                 nfqan       = -1;


    if (gss_credential == GSS_C_NO_CREDENTIAL)
    {
        lcmaps_log(0,"%s: user gss credential is empty ! (exit voms)\n", logstr);
        return NULL;
    }

#undef EXPORT_CREDENTIAL
#if EXPORT_CREDENTIAL
    if (gss_credential)
    {
        gss_buffer_desc                 deleg_proxy_filename;
        OM_uint32         major_status = 0;
        OM_uint32         minor_status = 0;
        
        major_status = gss_export_cred(&minor_status,
                                       gss_credential,
                                       NULL,
                                       1,
                                       &deleg_proxy_filename);

        if (major_status == GSS_S_COMPLETE)
        {
            char *                      cp;

            lcmaps_log_debug(1,"%s: deleg_proxy_filename.value: %s\n", logstr,
                               deleg_proxy_filename.value);
            cp = strchr((char *)deleg_proxy_filename.value, '=');
            *cp = '\0';
            cp++;
            setenv((char *)deleg_proxy_filename.value, cp, 1);
            free(deleg_proxy_filename.value);
        }
        else
        {
            char *                      error_str = NULL;
            globus_object_t *           error_obj;

            error_obj = globus_error_get((globus_result_t) minor_status);
            
            error_str = globus_error_print_chain(error_obj);
            lcmaps_log(0,"%s: Error, gss_export_cred(): %s\n", logstr,error_str);
            goto fail_lcmaps_gss_cred_to_voms_fqans;
        }
    }
#endif /* EXPORT_CREDENTIAL */

    /*
     * Retrieve a newly created X509 struct and X509 chain from gss credential (should be freed)
     */
    if ( ( px509_cred = lcmaps_cred_to_x509(gss_credential) ) )
    {
        lcmaps_log_debug(1,"%s: found X509 struct inside gss credential\n", logstr);
        lcmaps_log_debug(5,"%s: just for kicks: X509->name %s\n", logstr,px509_cred->name);
    }
    else
    {
        lcmaps_log(0,"%s: could not get X509 cred (exit voms)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    if ( ( px509_chain = lcmaps_cred_to_x509_chain(gss_credential) ) )
    {
        lcmaps_log_debug(1,"%s: found X509 chain inside gss credential\n", logstr);
    }
    else
    {
        lcmaps_log(0,"%s: could not get X509 chain (exit voms)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }

    /* Retrieve the vomsdir and certdir */
    vomsdir = getenv("LCMAPS_X509_VOMS_DIR");
    vomsdir = (vomsdir ? vomsdir : getenv("X509_VOMS_DIR"));
    vomsdir = (vomsdir ? vomsdir : DEFAULT_VOMS_DIR);
    lcmaps_log_debug(1,"%s: vomsdir = %s\n", logstr, vomsdir);

    certdir = getenv("LCMAPS_X509_CERT_DIR");
    certdir = (certdir ? certdir : getenv("X509_CERT_DIR"));
    certdir = (certdir ? certdir : DEFAULT_CERT_DIR);
    lcmaps_log_debug(1,"%s: certdir = %s\n", logstr, certdir);
    
    /*
     * Initialize a VOMS structure (struct vomsdata *)
     */
    if ((vd = VOMS_Init(vomsdir, certdir)) == NULL)
    {
        lcmaps_log(0,"%s: failed to initialize voms data structure\n", logstr);
        lcmaps_log(0,"%s:  This may be because either the specified voms directory (%s)\n",logstr,vomsdir);
        lcmaps_log(0,"%s:  or the specified CA certificates directory (%s) does not exist\n", logstr, certdir);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    lcmaps_log_debug(1,"%s: voms data structure initialized\n", logstr);

    /*
     * Find all VOMS attributes in this X509 proxy
     */ 
    if (VOMS_Retrieve(px509_cred, px509_chain, RECURSE_CHAIN, 
                         vd, &errNo))
    {
        struct voms **     volist         = vd->data;
        struct voms *      vo             = NULL;
        int                k              = 0;
        int                j              = 0;

        lcmaps_log_debug(1,"%s: We got something, errNo = %d\n", logstr, errNo);
        print_vomsdata(vd);
  
        while(volist[k]) {
            vo = volist[k++];
            lcmaps_log_debug(1,"%s: setting voms data for VO == %s\n", logstr,
                             vo->voname);

            switch (vo->type) {
                case TYPE_NODATA:
                    lcmaps_log_debug(1,"%s: NO DATA\n", logstr);
                    break;
                case TYPE_CUSTOM:
                    lcmaps_log_debug(1,"%s: %*s\n", logstr, vo->datalen - 10, vo->custom);
                    break;
                case TYPE_STD:
                    /* retrieve the list of FQANs contained in the user's proxy for this VO */
                    lcmaps_log_debug(1, "%s Trying to fetch the fqan list\n", logstr);
                    if (vo->fqan)
                    {
                        j = 0;
                        while ((vo->fqan)[j] != NULL)
                        {
                            if (fqans == NULL) /* Create the list pointer */
                            {
                                fqans = (char **)malloc(sizeof(char *));
                                *fqans = NULL;
                                nfqan = 0;
                            }
                            lcmaps_log_debug(2, "%s fqan nr %d of voms fqan list = %s\n", logstr, j, (vo->fqan)[j]);
                            if (*fqans == NULL) /* Create the first element */
                            {
                                *fqans = strdup((vo->fqan)[j]);
                                nfqan++;
                            }
                            else /* do a realloc and add it to the end */
                            {
                                fqans = (char **) realloc(fqans, (nfqan+1)*sizeof(char *));
                                fqans[nfqan] = strdup((vo->fqan)[j]);
                                nfqan++;
                            }
                            j++;
                        }
                    }
//                    j = 0;
//                    while (vo->std[j]) {
//                        lcmaps_vo_data=lcmaps_createVoData(vo->voname,vo->std[j]->group,
//                                                           NULL, vo->std[j]->role, vo->std[j]->cap
//                        );
//                        if (! lcmaps_vo_data)
//                        {
//                            lcmaps_log(0,"%s: could not create VoData structure (failure)\n", logstr);
//                            goto fail_lcmaps_gss_cred_to_voms_fqans;
//                        }
//                        if ( lcmaps_stringVoData(lcmaps_vo_data, voms_buffer, VOMS_BUFFER_SIZE) )
//                        {
//                            lcmaps_log(0,"%s: error in casting VoData structure into string (failure)\n", logstr);
//                            goto fail_lcmaps_gss_cred_to_voms_fqans;
//                        }
//                        /* Add credential */
//                        /* copy address of voms_buffer[0] in bufptr, because you cannot take the address of the array voms_buffer */
//                        bufptr = voms_buffer;
//                        addCredentialData(LCMAPS_VO_CRED_STRING, (void *) &bufptr);
//                        addCredentialData(LCMAPS_VO_CRED, (void *) lcmaps_vo_data);
//                        if ( lcmaps_deleteVoData(&lcmaps_vo_data) )
//                        {
//                            lcmaps_log(0,"%s: error while deleting VoData structure (failure)\n", logstr);
//                            goto fail_lcmaps_gss_cred_to_voms_fqans;
//                        }
//                        j++;
//                    }
                    break;
            }
        }
        lcmaps_log_debug(1,"%s: doing VOMS_Destroy\n", logstr);
        VOMS_Destroy(vd);
        lcmaps_log_debug(1,"%s: done\n", logstr);
    }
    else if (errNo == VERR_NOEXT) /* Non voms proxies will fall into this error */
    {
        /* Non voms proxies go here: set the number of fqans to zero. Not an error */
        lcmaps_log_debug(1,"%s: VOMS extensions missing from certificate\n", logstr);
        nfqan = 0;
    }
    else if (errNo == VERR_IDCHECK)
    {
        lcmaps_log(0,"%s: VOMS User data in extension different from the real ones (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_TIME)
    {
        lcmaps_log(0,"%s: VOMS extensions expired for at least one of the VOs (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_ORDER)
    {
        lcmaps_log(0,"%s: The ordering of the VOMS groups, as required by the client, was not delivered by VOMS (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_NOSOCKET)
    {
        lcmaps_log(0,"%s: VOMS Socket problem (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_NOIDENT)
    {
        lcmaps_log(0,"%s: VOMS Cannot identify itself (certificate problem) (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_COMM)
    {
        lcmaps_log(0,"%s: VOMS server problem (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_PARAM)
    {
        lcmaps_log(0,"%s: Wrong parameters for VOMS (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_NOINIT)
    {
        lcmaps_log(0,"%s: VOMS initialization error (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_EXTRAINFO)
    {
        lcmaps_log(0,"%s: VO name and URI missing (in proxy ?) (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_FORMAT)
    {
        lcmaps_log(0,"%s: Wrong VOMS data format (in proxy ?) (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_NODATA)
    {
        lcmaps_log(0,"%s: Empty VOMS extension (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_PARSE)
    {
        lcmaps_log(0,"%s: VOMS parse error (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_DIR)
    {
        lcmaps_log(0,"%s: VOMS directory error (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_SIGN)
    {
        lcmaps_log(0,"%s: VOMS Signature error (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_SERVER)
    {
        lcmaps_log(0,"%s: Unidentifiable VOMS server (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_MEM)
    {
        lcmaps_log(0,"%s: Memory problems in VOMS_Retrieve() (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_VERIFY)
    {
        lcmaps_log(0,"%s: Generic verification error for VOMS (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else if (errNo == VERR_TYPE)
    {
        lcmaps_log(0,"%s: Returned VOMS data of unknown type (failure)!\n", logstr);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }
    else
    {
        lcmaps_log(0,"%s: VOMS_Retrieve() error --> %d (failure)!\n", logstr, errNo);
        goto fail_lcmaps_gss_cred_to_voms_fqans;
    }

    /* succes */
    if (px509_cred) X509_free(px509_cred);
    if (px509_chain) sk_X509_free(px509_chain);
    *pnfqan = nfqan;
    return fqans;

 fail_lcmaps_gss_cred_to_voms_fqans:
    if (px509_cred) X509_free(px509_cred);
    if (px509_chain) sk_X509_free(px509_chain);
    return NULL;
}

static void print_vomsdata(struct vomsdata *d)
{
    char * logstr = "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata()";
    struct voms **vo = d->data;
    struct voms *v;
    int k = 0;
    int j =0;
  
    while(vo[k])
    {
        v = vo[k++];
        lcmaps_log_debug(1,"%s: %d *******************************************\n", logstr,k);
        lcmaps_log_debug(1,"%s: SIGLEN: %d\n", logstr, v->siglen);
        lcmaps_log_a_string_debug(1, "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): USER:   %s\n", v->user);
        lcmaps_log_a_string_debug(1, "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): UCA:    %s\n", v->userca);
        lcmaps_log_a_string_debug(1, "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): SERVER: %s\n", v->server);
        lcmaps_log_a_string_debug(1, "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): SCA:    %s\n", v->serverca);
        lcmaps_log_a_string_debug(1, "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): VO:     %s\n", v->voname);
        lcmaps_log_a_string_debug(1, "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): URI:    %s\n", v->uri);
        lcmaps_log_a_string_debug(1, "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): DATE1:  %s\n", v->date1);
        lcmaps_log_a_string_debug(1, "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): DATE2:  %s\n", v->date2);

        switch (v->type)
        {
        case TYPE_NODATA:
            lcmaps_log_debug(1,"%s: NO DATA\n", logstr);
            break;
        case TYPE_CUSTOM:
            lcmaps_log_debug(1,"%s: VOMS custom type. Wont print.\n", logstr);
            break;
        case TYPE_STD:
            j = 0;
            if (v->fqan)
            {
                while ((v->fqan)[j] != NULL)
                {
                    lcmaps_log_a_string_debug(1,
                        "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): fqan:   %s\n",
                        (v->fqan)[j]);
                    j++;
                }
            }
            j = 0;
            if (v->std)
            {
                while (v->std[j])
                {
                    lcmaps_log_a_string_debug(1,
                        "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): GROUP:  %s\n", v->std[j]->group);
                    lcmaps_log_a_string_debug(1,
                        "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): ROLE:   %s\n", v->std[j]->role);
                    lcmaps_log_a_string_debug(1,
                        "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): CAP:    %s\n", v->std[j]->cap);
                    j++;
                }
            }
            break;
        }
        lcmaps_log_debug(1,"%s: %d *******************************************\n", logstr,k);
    }

    if (d->workvo)
    {
        lcmaps_log_a_string_debug(1,
            "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): WORKVO: %s\n", d->workvo);
    }

    if (d->extra_data)
    {
        lcmaps_log_a_string_debug(1,
            "\tlcmaps_gss_cred_to_voms_fqans-print_vomsdata(): EXTRA: %s\n", d->extra_data);
    }
}

/******************************************************************************
CVS Information:
    $Source: /cvs/jra1mw/org.glite.security.lcmaps/src/grid_credential_handling/gsi_handling/lcmaps_voms_attributes.c,v $
    $Date: 2004/12/09 16:25:57 $
    $Revision: 1.4 $
    $Author: msteenba $
******************************************************************************/

---