00001 #ifndef XRDSECTLAYER_HH 00002 #define XRDSECTLAYER_HH 00003 /******************************************************************************/ 00004 /* */ 00005 /* X r d S e c T L a y e r . h h */ 00006 /* */ 00007 /* */ 00008 /* (c) 2008 by the Board of Trustees of the Leland Stanford, Jr., University */ 00009 /* All Rights Reserved */ 00010 /* Produced by Andrew Hanushevsky for Stanford University under contract */ 00011 /* DE-AC02-76-SFO0515 with the Department of Energy */ 00012 /* */ 00013 /* This file is part of the XRootD software suite. */ 00014 /* */ 00015 /* XRootD is free software: you can redistribute it and/or modify it under */ 00016 /* the terms of the GNU Lesser General Public License as published by the */ 00017 /* Free Software Foundation, either version 3 of the License, or (at your */ 00018 /* option) any later version. */ 00019 /* */ 00020 /* XRootD is distributed in the hope that it will be useful, but WITHOUT */ 00021 /* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or */ 00022 /* FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public */ 00023 /* License for more details. */ 00024 /* */ 00025 /* You should have received a copy of the GNU Lesser General Public License */ 00026 /* along with XRootD in a file called COPYING.LESSER (LGPL license) and file */ 00027 /* COPYING (GPL license). If not, see <http://www.gnu.org/licenses/>. */ 00028 /* */ 00029 /* The copyright holder's institutional names and contributor's names may not */ 00030 /* be used to endorse or promote products derived from this software without */ 00031 /* specific prior written permission of the institution or contributor. */ 00032 /******************************************************************************/ 00033 00034 #include "XrdSec/XrdSecInterface.hh" 00035 #include "XrdSys/XrdSysPthread.hh" 00036 00037 /* The XrdSecTLayer class is meant to be used as a wrapper for security 00038 protocols that require transport-layer interactions to complete the 00039 authentication exchange (e.g., native ssl). This class virtualizes a 00040 transport-layer socket and provides the proper framing to allow stream 00041 socket level interactions to occur across an existing client/xrootd 00042 connection. To that extent, there are certain limitations in this 00043 virtualization: 00044 1) Interactions must complete within a window whose upper bound is set to 00045 CPU 10 seconds (i.e., Network RTT and artificial delays do not apply). 00046 The window has no lower bound so that an interaction may complete as fast 00047 as conditions allow. An interaction is whatever bytes produce a single 00048 request/response. These bytes need not be produced all at once but the 00049 last required byte of an interaction must be produced within 10 CPU 00050 seconds of the 1st byte. There is no limit on the number of interactions. 00051 2) The use of the supplied socket must use standard and common socket 00052 operations (e.g., read(), write(), send(), recv(), close()). 00053 3) The protocol must not be sensitive to the fact that the socket will 00054 identify itself as a local socket with an IPV4 address of 127.0.0.1. 00055 00056 For more information, see pure abstract methods secClient() and secServer() 00057 which must be implemented by the derived class (in addition to delete()). 00058 Finally, consider the parameters you may need to pass to the constructor of 00059 this class. 00060 */ 00061 00062 class XrdOucErrInfo; 00063 00064 class XrdSecTLayer : public XrdSecProtocol 00065 { 00066 public: 00067 00068 // The object inheriting this class should call the initializer indicating 00069 // the true name of the protocol (no more that 7 characters). To optimize the 00070 // start-up, indicate who is the initiator (i.e., first one to send data). Using 00071 // the enum below, specify isClient (the default) or isServer. If the initiator 00072 // is not known, use the default and the class will dynamically determine it. 00073 // 00074 enum Initiator {isClient = 0, isServer}; 00075 00076 XrdSecTLayer(const char *pName, Initiator who1st=isClient); 00077 00078 // This is a symmetric wrapper. At the start on each end, secClient() is 00079 // called on the client-side and secServer() is called on the server side. 00080 // The 1st parameter is the filedescriptor to be used for the security exchange. 00081 // It is the responsibility of each routine to close the file descriptor prior 00082 // to returning to the caller! No return value is expected as success or failure 00083 // is communicated via the esecond paramter, the XrdOucErrInfo object. 00084 00085 // Upon success, the error code must be set to zero (the initial value) and 00086 // for secServer() the Entity object defined in the topmost 00087 // XrdSecProtocol object must contain the client's identity. 00088 00089 // Upon failure, the error code must be set to a positive error number (usually 00090 // some errno value) as well as text explaining the problem. 00091 00092 // Client: theFD - file descriptor to be used 00093 // einfo - the error object where ending status must be returned 00094 // 00095 virtual void secClient(int theFD, XrdOucErrInfo *einfo)=0; 00096 00097 // Server: theFD - file descriptor to be used 00098 // einfo - the error object where ending status must be returned 00099 // 00100 virtual void secServer(int theFD, XrdOucErrInfo *einfo)=0; 00101 00102 // You must implete the proper delete(). Normally, do a "delete this" and join 00103 // the secTid thread: "if (secTid) {XrdSysThread::Join(secTid,NULL);secTid=0;}". 00104 // 00105 virtual void Delete()=0; 00106 00107 // Classes that must be public are only internally used 00108 // 00109 00110 virtual int Authenticate (XrdSecCredentials *cred, 00111 XrdSecParameters **parms, 00112 XrdOucErrInfo *einfo=0); 00113 00114 virtual XrdSecCredentials *getCredentials(XrdSecParameters *parm=0, 00115 XrdOucErrInfo *einfo=0); 00116 00117 void secXeq(); 00118 00119 protected: 00120 pthread_t secTid; 00121 00122 virtual ~XrdSecTLayer() {if (eText) {free(eText);eText=0;} 00123 if (myFD>0) {close(myFD);myFD=-1;} 00124 } 00125 00126 private: 00127 00128 int bootUp(Initiator Who); 00129 int Read(int FD, char *Buff, int rdLen); 00130 int secDone(); 00131 void secDrain(); 00132 const char *secErrno(int rc, char *buff); 00133 void secError(const char *Msg, int rc, int iserrno=1); 00134 00135 XrdSysSemaphore mySem; 00136 Initiator Starter; 00137 Initiator Responder; 00138 int myFD; 00139 int urFD; 00140 int Tmax; // Maximum timeslices per interaction 00141 int Tcur; // Current timeslice 00142 int eCode; 00143 char *eText; 00144 XrdOucErrInfo *eDest; 00145 00146 struct TLayerRR 00147 { 00148 char protName[8]; // via Constructor 00149 char protCode; // One of the below 00150 static const char endData = 0x00; 00151 static const char xfrData = 0x01; 00152 char protRsvd[7]; // Reserved 00153 } Hdr; 00154 00155 static const int buffSz = 8192; 00156 static const int hdrSz = sizeof(TLayerRR); 00157 static const int dataSz = buffSz - hdrSz; 00158 }; 00159 #endif