36 #ifndef HEADER_GRIDSITE_H
37 #define HEADER_GRIDSITE_H
40 #define GRST_VERSION 010500
47 #ifndef GRST_NO_OPENSSL
50 #include <openssl/ssl.h>
53 #ifndef HEADER_CRYPTO_H
54 #include <openssl/crypto.h>
82 #define GRST_RET_FAILED 1000
85 #define GRST_RET_CERT_NOT_FOUND 1001
88 #define GRST_RET_BAD_SIGNATURE 1002
91 #define GRST_RET_NO_SUCH_FILE 1003
95 #define GRSTerrorLog(GRSTerrorLevel, ...) ((GRSTerrorLogFunc != NULL) && ((GRSTerrorLogFunc)(__FILE__, __LINE__, GRSTerrorLevel, __VA_ARGS__)))
101 #define GRST_LOG_EMERG 0
102 #define GRST_LOG_ALERT 1
103 #define GRST_LOG_CRIT 2
104 #define GRST_LOG_ERR 3
105 #define GRST_LOG_WARNING 4
106 #define GRST_LOG_NOTICE 5
107 #define GRST_LOG_INFO 6
108 #define GRST_LOG_DEBUG 7
110 #define GRST_MAX_TIME_T INT32_MAX
121 typedef struct {
char *name;
137 #define GRST_PERM_NONE 0
138 #define GRST_PERM_READ 1
139 #define GRST_PERM_EXEC 2
140 #define GRST_PERM_LIST 4
141 #define GRST_PERM_WRITE 8
142 #define GRST_PERM_ADMIN 16
143 #define GRST_PERM_ALL 31
146 #define GRSTgaclPermIsNone(perm) ((perm) == 0)
148 #define GRSTgaclPermHasNone(perm) ((perm) == 0)
149 #define GRSTgaclPermHasRead(perm) (((perm) & GRST_PERM_READ ) != 0)
150 #define GRSTgaclPermHasExec(perm) (((perm) & GRST_PERM_EXEC ) != 0)
151 #define GRSTgaclPermHasList(perm) (((perm) & GRST_PERM_LIST ) != 0)
152 #define GRSTgaclPermHasWrite(perm) (((perm) & GRST_PERM_WRITE) != 0)
153 #define GRSTgaclPermHasAdmin(perm) (((perm) & GRST_PERM_ADMIN) != 0)
155 #define GRST_ACTION_ALLOW 0
156 #define GRST_ACTION_DENY 1
158 #define GRST_HIST_PREFIX ".grsthist"
159 #define GRST_ACL_FILE ".gacl"
160 #define GRST_DN_LISTS "/etc/grid-security/dn-lists"
161 #define GRST_RECURS_LIMIT 9
163 #define GRST_PROXYCERTINFO_OLD_OID "1.3.6.1.4.1.3536.1.222"
164 #define GRST_PROXYCERTINFO_OID "1.3.6.1.5.5.7.1.14"
165 #define GRST_VOMS_OID "1.3.6.1.4.1.8005.100.100.5"
166 #define GRST_VOMS_PK_CERT_LIST_OID "1.3.6.1.4.1.8005.100.100.10"
167 #define GRST_VOMS_DIR "/etc/grid-security/vomsdir"
168 #define GRST_KEYUSAGE_OID "2.5.29.15"
170 #define GRST_ASN1_MAXCOORDLEN 50
171 #define GRST_ASN1_MAXTAGS 500
179 #define GRST_X509_SERIAL_DIGITS 49
189 char serial[GRST_X509_SERIAL_DIGITS+1];
194 #define GRST_CERT_BAD_FORMAT 1
195 #define GRST_CERT_BAD_CHAIN 2
196 #define GRST_CERT_BAD_SIG 4
197 #define GRST_CERT_BAD_TIME 8
198 #define GRST_CERT_BAD_OCSP 16
200 #define GRST_CERT_TYPE_CA 1
201 #define GRST_CERT_TYPE_EEC 2
202 #define GRST_CERT_TYPE_PROXY 3
203 #define GRST_CERT_TYPE_VOMS 4
204 #define GRST_CERT_TYPE_ROBOT 5
209 #ifndef GRST_NO_OPENSSL
212 STACK_OF(X509) *certstack, X509 *lastcert,
213 char *capath,
char *vomsdir);
218 #define GRST_HTTP_PORT 777
219 #define GRST_HTTPS_PORT 488
220 #define GRST_HTCP_PORT 777
221 #define GRST_GSIFTP_PORT 2811
223 #define GRSThtcpNOPop 0
224 #define GRSThtcpTSTop 1
230 #define GRSThtcpCountstrLen(string) (256*((string)->length_msb) + (string)->length_lsb)
238 unsigned int response : 4;
239 unsigned int opcode : 4;
242 unsigned int reserved : 6;
262 #define GRSTgaclCredGetAuri(cred) ((cred)->auri)
264 #define GRSTgaclCredSetNotBefore(cred, time) ((cred)->notbefore = (time))
265 #define GRSTgaclCredGetNotBefore(cred) ((cred)->notbefore)
267 #define GRSTgaclCredSetNotAfter(cred, time) ((cred)->notafter = (time))
268 #define GRSTgaclCredGetNotAfter(cred) ((cred)->notafter)
270 #define GRSTgaclCredSetDelegation(cred, level) ((cred)->delegation = (level))
271 #define GRSTgaclCredGetDelegation(cred) ((cred)->delegation)
273 #define GRSTgaclCredSetNistLoa(cred, level) ((cred)->nist_loa = (level))
274 #define GRSTgaclCredGetNistLoa(cred) ((cred)->nist_loa)
390 #ifndef GRST_NO_OPENSSL
410 #ifndef GRST_NO_OPENSSL
421 char *delegation_id,
char *user_dn,
int keysize);
425 #ifndef GRST_NO_OPENSSL
433 #define GRST_HEADFILE "gridsitehead.txt"
434 #define GRST_FOOTFILE "gridsitefoot.txt"
435 #define GRST_ADMIN_FILE "gridsite-admin.cgi"
455 #ifndef GRST_NO_OPENSSL
468 #ifndef GRST_PASSCODE_JS
470 #define GRST_PASSCODE_JS "<script type=\"text/javascript\" language=\"Javascript\"><!--\nfunction changeValue(formName){ if( document.forms[formName].passcode.value==\"\" ) document.forms[formName].passcode.value=getCookie(\"GRIDHTTP_PASSCODE\"); return true; } \nfunction getCookie(c_name){ if (document.cookie.length>0) { c_start=document.cookie.indexOf(c_name + \"=\"); if (c_start!=-1) { c_start=c_start + c_name.length+1; c_end=document.cookie.indexOf(\";\",c_start); if (c_end==-1) c_end=document.cookie.length; return unescape(document.cookie.substring(c_start,c_end)); }} return \"\"; } \n -->\n</script>"
477 #endif // HEADER_GRIDSITE_H
void * next
Definition: gridsite.h:192
time_t notbefore
Definition: gridsite.h:186
int GRSThtcpNOPrequestMake(char **request, int *request_length, unsigned int trans_id)
Definition: grst_htcp.c:47
int headerlength
Definition: gridsite.h:175
int delegation
Definition: gridsite.h:113
GRSTgaclCred * GRSTgaclCredNew(char *type)
Definition: grst_gacl.c:137
void * next
Definition: gridsite.h:131
int GRSTgaclEntryPrint(GRSTgaclEntry *entry, FILE *fp)
Definition: grst_gacl.c:449
int GRSTgaclUserHasCred(GRSTgaclUser *user, GRSTgaclCred *cred)
Definition: grst_gacl.c:982
int GRSThtcpMessageParse(GRSThtcpMessage *parsed, char *raw, int length)
Definition: grst_htcp.c:226
int GRSTx509CompactCreds(int *lastcred, int maxcreds, size_t credlen, char *creds, STACK_OF(X509)*certstack, char *vomsdir, X509 *peercert)
Get the credentials in an X509 cert/GSI proxy, including any VOMS.
Definition: grst_canl_x509.c:1647
char * GRSTx509CachedProxyKeyFind(char *proxydir, char *delegation_id, char *user_dn, STACK_OF(X509)*certstack)
Find a temporary proxy private key file in the proxy cache.
Definition: grst_canl_x509.c:2081
GRSTgaclPerm GRSTgaclAclTestUser(GRSTgaclAcl *acl, GRSTgaclUser *user)
Definition: grst_gacl.c:1298
int GRSThtcpTSTrequestMake(char **request, int *request_length, unsigned int trans_id, char *method, char *uri, char *req_hdrs)
Definition: grst_htcp.c:116
void GRSThttpPrintf(GRSThttpBody *thisbody, char *fmt,...)
Definition: grst_http.c:58
int type
Definition: gridsite.h:181
char * GRSTx509FindProxyFileName(void)
Find proxy file name of the current user.
Definition: grst_canl_x509.c:1730
GRSTgaclPerm denied
Definition: gridsite.h:130
int GRSTgaclEntryAllowPerm(GRSTgaclEntry *entry, GRSTgaclPerm perm)
Definition: grst_gacl.c:503
unsigned char total_length_msb
Definition: gridsite.h:232
GRSThtcpCountstr * req_hdrs
Definition: gridsite.h:247
int GRSTgaclEntryFree(GRSTgaclEntry *entry)
Definition: grst_gacl.c:386
unsigned char total_length_lsb
Definition: gridsite.h:233
int GRSTgaclAclSave(GRSTgaclAcl *acl, char *filename)
Definition: grst_gacl.c:605
int GRSTgaclEntryDenyPerm(GRSTgaclEntry *entry, GRSTgaclPerm perm)
Definition: grst_gacl.c:517
int GRSTgaclDNlistHasUser(char *listurl, GRSTgaclUser *user)
Definition: grst_gacl.c:1279
GRSTgaclUser * GRSTgaclUserNew(GRSTgaclCred *cred)
Definition: grst_gacl.c:929
char * GRSThttpGetCGI(char *name)
Definition: grst_http.c:237
GRSTgaclAcl * GRSTgaclAclLoadforFile(char *pathandfile)
Definition: grst_gacl.c:906
int GRSTx509StringToChain(STACK_OF(X509)**certstack, char *certstring)
Create a stack of X509 certificate from a PEM-encoded string.
Definition: grst_canl_x509.c:2583
int GRSTx509ChainLoad(GRSTx509Chain **chain, STACK_OF(X509)*certstack, X509 *lastcert, char *capath, char *vomsdir)
Definition: grst_canl_x509.c:1005
int GRSTgaclUserAddCred(GRSTgaclUser *user, GRSTgaclCred *cred)
Definition: grst_gacl.c:959
int GRSTgaclEntryUndenyPerm(GRSTgaclEntry *entry, GRSTgaclPerm perm)
Definition: grst_gacl.c:524
unsigned int GRSTgaclPerm
Definition: gridsite.h:126
unsigned int trans_id
Definition: gridsite.h:243
int GRSTgaclCredCmpAuri(GRSTgaclCred *cred1, GRSTgaclCred *cred2)
Definition: grst_gacl.c:342
int GRSTx509CreateProxyRequestKS(char **reqtxt, char **keytxt, char *ocspurl, int keysize)
Definition: grst_canl_x509.c:2215
unsigned char data_length_msb
Definition: gridsite.h:236
GRSTgaclNamevalue
Definition: gridsite.h:123
GRSTgaclEntry * firstentry
Definition: gridsite.h:133
int GRSTgaclEntryAddCred(GRSTgaclEntry *entry, GRSTgaclCred *cred)
Definition: grst_gacl.c:267
int GRSTx509CheckChain(int *first_non_ca, X509_STORE_CTX *store_ctx)
Definition: grst_canl_x509.c:1345
int
Definition: gridsite.h:398
char * text
Definition: gridsite.h:437
GRSTgaclCred * GRSTx509CompactToCred(char *grst_cred)
Turn a Compact Cred line into a GRSTgaclCred object.
Definition: grst_canl_x509.c:1586
int GRSTx509VerifyCallback(int ok, X509_STORE_CTX *ctx)
Example VerifyCallback routine.
Definition: grst_canl_x509.c:1371
int start
Definition: gridsite.h:174
char * ocsp
Definition: gridsite.h:190
unsigned char version_msb
Definition: gridsite.h:234
char * value
Definition: gridsite.h:185
time_t GRSTasn1TimeToTimeT(char *asn1time, size_t len)
ASN1 time string (in a char *) to time_t.
Definition: grst_asn1.c:24
char * GRSThttpUrlEncode(char *in)
Definition: grst_http.c:369
GRSTgaclAcl * GRSTgaclAclLoadFile(char *filename)
Definition: grst_gacl.c:758
Definition: gridsite.h:133
int GRSTx509GetVomsCreds(int *lastcred, int maxcreds, size_t credlen, char *creds, X509 *usercert, STACK_OF(X509)*certstack, char *vomsdir)
Get the VOMS attributes in the extensions to the given cert stack.
Definition: grst_canl_x509.c:1528
char * GRSTx509MakeProxyFileName(char *delegation_id, STACK_OF(X509)*certstack)
Return the short file name for the given delegation_id and user_dn.
Definition: grst_canl_x509.c:2673
GRSTgaclPerm allowed
Definition: gridsite.h:129
int GRSTx509IsCA(X509 *cert)
Check if certificate can be used as a CA to sign standard X509 certs.
Definition: grst_canl_x509.c:293
int GRSTgaclUserLoadDNlists(GRSTgaclUser *user, char *dnlists)
Definition: grst_gacl.c:1185
Definition: gridsite.h:173
GRSThtcpCountstr * version
Definition: gridsite.h:246
char * GRSTx509CachedProxyFind(char *proxydir, char *delegation_id, char *user_dn)
Find a proxy file in the proxy cache.
Definition: grst_canl_x509.c:2046
Definition: gridsite.h:112
int GRSTgaclFileIsAcl(char *pathandfile)
Definition: grst_gacl.c:835
time_t notafter
Definition: gridsite.h:187
int GRSTgaclEntryUnallowPerm(GRSTgaclEntry *entry, GRSTgaclPerm perm)
Definition: grst_gacl.c:510
int GRSTgaclPermPrint(GRSTgaclPerm perm, FILE *fp)
Definition: grst_gacl.c:489
int GRSTx509CreateProxyRequest(char **reqtxt, char **keytxt, char *ocspurl)
Create a X.509 request for a GSI proxy and its private key.
Definition: grst_canl_x509.c:2226
char * GRSTx509MakeDelegationID(void)
Returns a Delegation ID based on hash of GRST_CRED_0, ...
Definition: grst_canl_x509.c:2633
time_t notbefore
Definition: gridsite.h:115
int GRSTx509MakeProxyCert(char **proxychain, FILE *debugfp, char *reqtxt, char *cert, char *key, int minutes)
Make a GSI Proxy chain from a request, certificate and private key.
Definition: grst_canl_x509.c:1758
void GRSThttpWriteOut(GRSThttpBody *thisbody)
Definition: grst_http.c:150
int tag
Definition: gridsite.h:177
char X509 STACK_OF(X509)*
size_t size
Definition: gridsite.h:440
char * GRSTgaclPermToChar(GRSTgaclPerm perm)
Definition: grst_gacl.c:531
GRSThtcpCountstr * entity_hdrs
Definition: gridsite.h:249
GRSTgaclCred * GRSTgaclCredCreate(char *auri_prefix, char *auri_suffix)
Definition: grst_gacl.c:97
int GRSTx509NameCmp(char *a, char *b)
Compare X509 Distinguished Name strings.
Definition: grst_canl_x509.c:217
char * dn
Definition: gridsite.h:184
int GRSTgaclCredCredPrint(GRSTgaclCred *, FILE *)
int GRSTx509MakeProxyRequest(char **reqtxt, char *proxydir, char *delegation_id, char *user_dn)
Create a X.509 request for a GSI proxy and its private key.
Definition: grst_canl_x509.c:2342
char * GRSThttpUrlMildencode(char *in)
Definition: grst_http.c:402
char * auri
Definition: gridsite.h:112
int length
Definition: gridsite.h:176
int GRSThttpPrintHeaderFooter(GRSThttpBody *bp, char *file, char *headfootname)
Definition: grst_http.c:168
int GRSTx509ChainFree(GRSTx509Chain *chain)
Definition: grst_canl_x509.c:308
int GRSTx509CacheProxy(char *proxydir, char *delegation_id, char *user_dn, char *proxychain)
Store a GSI proxy chain in the proxy cache, along with the private key.
Definition: grst_canl_x509.c:2760
int GRSTgaclUserFree(GRSTgaclUser *user)
Definition: grst_gacl.c:946
GRSThttpCharsList * last
Definition: gridsite.h:442
int GRSTgaclCredAddValue(GRSTgaclCred *cred, char *name, char *rawvalue)
Definition: grst_gacl.c:160
Definition: gridsite.h:135
int delegation
Definition: gridsite.h:188
unsigned char data_length_lsb
Definition: gridsite.h:237
int GRSTx509CertLoad(GRSTx509Cert *, X509 *)
Definition: gridsite.h:440
GRSThttpCharsList * first
Definition: gridsite.h:441
int nist_loa
Definition: gridsite.h:114
unsigned char version_lsb
Definition: gridsite.h:235
Definition: gridsite.h:207
GRSTx509Cert * firstcert
Definition: gridsite.h:207
void * raw
Definition: gridsite.h:191
GRSTgaclPerm GRSTgaclPermFromChar(char *s)
Definition: grst_gacl.c:546
__attribute__((deprecated)) typedef struct
Definition: gridsite.h:120
GRSThtcpCountstr * resp_hdrs
Definition: gridsite.h:248
int(* GRSTerrorLogFunc)(char *, int, int, char *,...)
Definition: grst_err.c:40
int GRSThttpCopy(GRSThttpBody *thisbody, char *file)
Definition: grst_http.c:95
int GRSTgaclUserHasAURI(GRSTgaclUser *user, char *auri)
Definition: grst_gacl.c:1284
GRSThtcpCountstr * method
Definition: gridsite.h:244
unsigned char length_lsb
Definition: gridsite.h:227
void * next
Definition: gridsite.h:438
int GRSTgaclEntryDelCred(GRSTgaclEntry *entry, GRSTgaclCred *cred)
Definition: grst_gacl.c:296
void * next
Definition: gridsite.h:117
GRSTgaclEntry * GRSTgaclEntryNew(void)
Definition: grst_gacl.c:367
Definition: gridsite.h:128
GRSTgaclAcl * GRSTgaclAclNew(void)
Definition: grst_gacl.c:563
char * GRSTgaclFileFindAclname(char *pathandfile)
Definition: grst_gacl.c:848
int GRSTgaclUserSetDNlists(GRSTgaclUser *user, char *dnlists)
Definition: grst_gacl.c:1076
Definition: gridsite.h:437
int GRSTx509KnownCriticalExts(X509 *cert)
Check critical extensions.
Definition: grst_canl_x509.c:256
int errors
Definition: gridsite.h:182
GRSThtcpCountstr * uri
Definition: gridsite.h:245
GRSThtcpCountstr * cache_hdrs
Definition: gridsite.h:250
int GRSTasn1GetX509Name(char *x509name, int maxlength, char *coords, char *asn1string, struct GRSTasn1TagList taglist[], int lasttag)
Definition: grst_asn1.c:498
time_t notafter
Definition: gridsite.h:116
char treecoords[GRST_ASN1_MAXCOORDLEN+1]
Definition: gridsite.h:173
int GRSTx509MakeProxyRequestKS(char **reqtxt, char *proxydir, char *delegation_id, char *user_dn, int keysize)
Definition: grst_canl_x509.c:2328
int GRSTgaclInit(void)
Definition: grst_gacl.c:77
char * issuer
Definition: gridsite.h:183
int GRSTx509ProxyDestroy(char *proxydir, char *delegation_id, char *user_dn)
Destroy stored GSI proxy files.
Definition: grst_canl_x509.c:2493
int GRST_is_id_safe(const char *str)
Definition: grst_canl_x509.c:2857
Definition: gridsite.h:232
int GRSTgaclAclPrint(GRSTgaclAcl *acl, FILE *fp)
Definition: grst_gacl.c:591
int GRSThtcpTSTresponseMake(char **message, int *message_length, unsigned int trans_id, char *resp_hdrs, char *entity_hdrs, char *cache_hdrs)
Definition: grst_htcp.c:162
Definition: gridsite.h:226
int GRSTgaclAclFree(GRSTgaclAcl *acl)
Definition: grst_gacl.c:579
GRSTgaclCred * GRSTgaclUserFindCredtype(GRSTgaclUser *user, char *type)
Definition: grst_gacl.c:1046
int GRSThttpPrintFooter(GRSThttpBody *bp, char *file)
Definition: grst_http.c:221
int GRSTx509ProxyGetTimes(char *proxydir, char *delegation_id, char *user_dn, time_t *start, time_t *finish)
Get start and finish validity times of stored GSI proxy file.
Definition: grst_canl_x509.c:2541
unsigned char length_msb
Definition: gridsite.h:226
int GRSThtcpNOPresponseMake(char **message, int *message_length, unsigned int trans_id)
Definition: grst_htcp.c:81
int GRSThttpPrintHeader(GRSThttpBody *bp, char *file)
Definition: grst_http.c:205
int GRSTasn1SearchTaglist(struct GRSTasn1TagList taglist[], int lasttag, char *treecoords)
Definition: grst_asn1.c:119
GRSTgaclCred * firstcred
Definition: gridsite.h:128
int GRSTgaclAction
Definition: gridsite.h:125
char * GRSThttpUrlDecode(char *in)
Definition: grst_http.c:330
int GRSTgaclCredFree(GRSTgaclCred *cred)
Definition: grst_gacl.c:223
int GRSTx509ChainLoadCheck(GRSTx509Chain **chain, STACK_OF(X509)*certstack, X509 *lastcert, char *capath, char *vomsdir)
Check certificate chain for GSI proxy acceptability.
Definition: grst_canl_x509.c:1313
GRSTgaclCred * firstcred
Definition: gridsite.h:135
int GRSTasn1ParseDump(BIO *bp, unsigned char *pp, long len, struct GRSTasn1TagList taglist[], int maxtag, int *lasttag)
Definition: grst_asn1.c:458
GRSTgaclPerm GRSTgaclAclTestexclUser(GRSTgaclAcl *acl, GRSTgaclUser *user)
Definition: grst_gacl.c:1343
Definition: gridsite.h:181
int GRSTgaclAclAddEntry(GRSTgaclAcl *acl, GRSTgaclEntry *entry)
Definition: grst_gacl.c:433
void GRSThttpBodyInit(GRSThttpBody *thisbody)
Definition: grst_http.c:53