tags/llrun_R_0_1_0_1/llrun.c

/*
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * Authors: Mischa Sall\'e, Dennis van Dok, Oscar Koeroo
 *      NIKHEF Amsterdam, the Netherlands
 *      <grid-mw-security@nikhef.nl>
 */

/*
 * Command line interface program to interact with LCAS and LCMAPS, e.g. to
 * follow from userspace the steps gLExec takes. Compile with e.g.
 *  gcc -ldl -rdynamic -o llrun llrun.c
 * or
 *  gcc -ldl -L. -lvomsfix -o llrun llrun.c
 * to solve a missing symbol problem with libvomsapi / liblcmaps. The first
 * version uses the functions defined inside this file, the second gets them
 * from the dummy library libvomsfix.so
 */

#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>

#include <string.h>
#include <errno.h>

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>

#include <pwd.h>
#include <grp.h>

#include <dlfcn.h>

#include <syslog.h>

#define VERSION     "0.1.0-1"

/* Define to have getopt() behave POSIX correctly */
#define POSIXLY_CORRECT

/* Dirty hack to fix the missing functions from VOMS API: VOMS API should have
 * defined these extern "C". LCMAPS needs these functions, and if not using the
 * ones from LCAS, you can use these (trivial ones) instead. By compiling with
 * -rdynamic i.e. by linking with -export-dynamic, the following symbols are
 * used instead. */
int getMajorVersionNumber(void) { return 0; }
int getPatchVersionNumber(void) { return 0; }
int getMinorVersionNumber(void) { return 0; }

/************************************************************************/
/* TYPEDEFS                                                             */
/************************************************************************/

/* Global options */
typedef struct {
    int verbose;        /* Whether to print extra warnings */
    int do_lcas;        /* Whether to do LCAS */
    int do_lcmaps;      /* Whether to run LCMAPS */
    char *syslog_fac;   /* which syslog facility to use */
} opts_t;

/* Credentials */
typedef struct {
    char *pemstring;    /* Will contain a full pemstring */
    char *dn;           /* Will contain a DN */
    int nfqan;          /* Number of specified FQANs */
    char **fqans;       /* Specified FQANs */
} cred_t;

/* lcas_request_t is defined in lcas_types.h, can just re-typedef it here. */
#if 0
/*#include "lcas_types.h"*/
#else
typedef char *lcas_request_t;
#endif

/* lcmaps_account_info_t is defined in lcmaps_account.h,
 * can just re-typedef it here. */
#if 0
#include "lcmaps_account.h"
#else
typedef struct lcmaps_account_info_s
{
    uid_t          uid;         /* the uid of the local account */
    gid_t *        pgid_list;   /* the list of primary gids */
    int            npgid;       /* the number of primary gids found */
    gid_t *        sgid_list;   /* the list of secondary gids */
    int            nsgid;       /* the number of secondary gids found */
    char *         poolindex;   /* the pool index */
} lcmaps_account_info_t;
#endif

/* LCMAPS mode type: determines the LCMAPS interface to be used */
typedef enum {
    LCMAPS_RETURN_ACCOUNT_FROM_PEM,
    LCMAPS_RETURN_ACCOUNT_WITHOUT_GSI,
    LCMAPS_RETURN_POOLINDEX_WITHOUT_GSI,
} lcmaps_mode_t;


/* Struct containing all the lcmaps related variables, handles and functions,
 * will be filled using dlsym() */
/* List extended with Without-GSI specific functions */
typedef struct {
    /* Variables */
    int new;                        /* new API */
    int dovoms;                     /* whether to run voms */
    lcmaps_mode_t mode;             /* type of LCMAPS mode */
    FILE *logfile;                  /* logfile or NULL for stdout */
    opts_t *opts;                   /* global credentials */
    cred_t *cred;                   /* global credentials */
    lcmaps_account_info_t account; /* resulting account info */
    /* Library handles */
    void *handle,*helper; /* Needed for dlclose() */
    /* Functions */
    int (*lcmaps_init)(FILE*);
    int (*lcmaps_account_info_init)(lcmaps_account_info_t*);
    int (*lcmaps_return_account_from_pem)(char*,int,lcmaps_account_info_t*);
    int (*lcmaps_return_poolindex_without_gsi)(char*,char**,int,
                                               lcmaps_account_info_t*);
/*  int (*lcmaps_return_poolindex_with_mapcounter)(char*,char**,int,int,
                                                   lcmaps_account_info_t); */
    int (*lcmaps_return_account_without_gsi)(char*,char**,int,int,
                                             lcmaps_account_info_t*);
    int (*lcmaps_term)(void);
    int (*lcmaps_account_info_clean)(lcmaps_account_info_t*);
    int (*lcmaps_get_major_version)(void);
    int (*lcmaps_get_minor_version)(void);
    int (*lcmaps_get_patch_version)(void);
    void (*lcmaps_disable_voms_attributes_verification)(void);
    void (*lcmaps_enable_voms_attributes_verification)(void);
    int (*lcmaps_is_set_to_verify_voms_attributes)(void);
} lcmaps_t;


/* Struct containing all the lcas functions, will be filled using dlsym() */
typedef struct {
    /* Variables */
    char *rsl;
    FILE *logfile;  /* logfile or NULL for stdout */ 
    opts_t *opts;   /* global credentials */
    cred_t *cred;   /* global credentials */
    /* Library handles */
    void *handle; /* Needed for dlclose() */
    /* Functions */
    int (*lcas_init)(FILE*);
    int (*lcas_pem)(char*,lcas_request_t);
    int (*lcas_term)(void);
} lcas_t;


/************************************************************************/
/* GLOBAL VARIABLE                                                      */
/************************************************************************/

/* Short program name, set in main() */
static const char *prog=NULL;


/************************************************************************/
/* FUNCTIONS                                                            */
/************************************************************************/

/* Prints a notice on stdout */
void llnotice(char *format, ...)        {
    va_list args;

    fprintf(stdout,"[%s]: ", prog);
    va_start(args,format);
    vfprintf(stdout,format,args);
}

/* Prints a warning on stderr */
void llwarn(char *format, ...)  {
    va_list args;

    fprintf(stderr,"[%s]: WARNING: ", prog);
    va_start(args,format);
    vfprintf(stderr,format,args);
}

/* Prints an error on stderr */
void llerr(char *format, ...)   {
    va_list args;

    fprintf(stderr,"[%s]: ERROR: ", prog);
    va_start(args,format);
    vfprintf(stderr,format,args);
}

/* Opens the correct syslog facility. Note that the actual opening does not
 * happen until the first message is logged, see openlog(3)
 * Return syslog_fac or -1 on error */
int opensyslog(const char *name)   {
    int syslog_fac=-1;

    /* Now go over all the possibilities */
    if (strcmp(name,"LOG_KERN")==0)
        syslog_fac=LOG_KERN;
    else if (strcmp(name,"LOG_USER")==0)
        syslog_fac=LOG_USER;
    else if (strcmp(name,"LOG_MAIL")==0)
        syslog_fac=LOG_MAIL;
    else if (strcmp(name,"LOG_NEWS")==0)
        syslog_fac=LOG_NEWS;
    else if (strcmp(name,"LOG_UUCP")==0)
        syslog_fac=LOG_UUCP;
    else if (strcmp(name,"LOG_DAEMON")==0)
        syslog_fac=LOG_DAEMON;
    else if (strcmp(name,"LOG_AUTH")==0)
        syslog_fac=LOG_AUTH;
    else if (strcmp(name,"LOG_CRON")==0)
        syslog_fac=LOG_CRON;
    else if (strcmp(name,"LOG_LPR")==0)
        syslog_fac=LOG_LPR;
    else if (strcmp(name,"LOG_LOCAL0")==0)
        syslog_fac=LOG_LOCAL0;
    else if (strcmp(name,"LOG_LOCAL1")==0)
        syslog_fac=LOG_LOCAL1;
    else if (strcmp(name,"LOG_LOCAL2")==0)
        syslog_fac=LOG_LOCAL2;
    else if (strcmp(name,"LOG_LOCAL3")==0)
        syslog_fac=LOG_LOCAL3;
    else if (strcmp(name,"LOG_LOCAL4")==0)
        syslog_fac=LOG_LOCAL4;
    else if (strcmp(name,"LOG_LOCAL5")==0)
        syslog_fac=LOG_LOCAL5;
    else if (strcmp(name,"LOG_LOCAL6")==0)
        syslog_fac=LOG_LOCAL6;
    else if (strcmp(name,"LOG_LOCAL7")==0)
        syslog_fac=LOG_LOCAL7;
    /* Now the non-standard ones... */
#ifdef LOG_SYSLOG
    else if (strcmp(name,"LOG_SYSLOG")==0)
        syslog_fac=LOG_SYSLOG;
#endif
#ifdef LOG_FTP
    else if (strcmp(name,"LOG_FTP")==0)
        syslog_fac=LOG_FTP;
#endif
#ifdef LOG_AUTHPRIV
    else if (strcmp(name,"LOG_AUTHPRIV")==0)
        syslog_fac=LOG_AUTHPRIV;
#endif
#ifdef LOG_AUDIT
    else if (strcmp(name,"LOG_AUDIT")==0)
        syslog_fac=LOG_AUDIT;
#endif

    /* Is it valid? */
    if (syslog_fac==-1)
        llerr("Unknown syslog facility '%s' specified.\n",name);
    else
        openlog(prog,(LOG_CONS|LOG_PID),syslog_fac);

    return syslog_fac;
}

/* Reads in user proxy (on which mapping is based) from filename or NULL on
 * error */
char *readproxy(const char *filename)   {
    int fd,size;
    char *pemstring;
    struct stat st;

    /* Open file and get size */
    if ((fd=open(filename,O_RDONLY))==-1 || fstat(fd,&st)==-1)  {
        llerr("Cannot open or stat file %s: %s\n", filename, strerror(errno));
        return NULL;
    }

    /* Reserve memory */
    if ((pemstring=(char *)malloc((size_t)(st.st_size+sizeof(char))))==NULL) {
        llerr("Cannot malloc %d bytes for pemstring\n", (int)st.st_size);
        return NULL;
    }
    
    /* Read file */
    size=read(fd,pemstring,(size_t)st.st_size);
    if (size!=st.st_size)   {
        llerr("Number of bytes read %d != size %d\n", size,(int)st.st_size);
        return NULL;
    }

    /* Close file */
    close(fd);
    /* Add '\0' and return */
    pemstring[size]='\0';

    return pemstring;
}

/************************************************************************/
/* LCMAPS FUNCTIONS                                                     */
/************************************************************************/

/* Parses the options for LCMAPS and opens the logfile when needed */
int lcmaps_set_vars(char *options, lcmaps_t *lcmaps)  {
    char *var=options,*value,*end,*pos;
   
    /* Set defaults */
    lcmaps->new=0;      /* assume old when unspecified */
    lcmaps->dovoms=-1;  /* unspecified */
    lcmaps->mode=LCMAPS_RETURN_ACCOUNT_FROM_PEM;

    /* If first char of options is a - it's actually the next main option */
    if (options==NULL || options[0]=='-')
        return 0;

    do  {
        /* Find end of current var=value pair */
        end=strchr(var, ',');
        if (end!=NULL) end[0]='\0';
        /* Find end of variable name */
        pos=strchr(var,'=');
        if (pos==NULL)
            llwarn("Unrecognized element '%s'\n",var);
        else    {
            pos[0]='\0';
            value=pos+1;
            /* Find the variable */
            if (strcmp(var,"debug")==0)
                setenv("LCMAPS_DEBUG_LEVEL",value,1);
            else if (strcmp(var,"policy")==0)
                setenv("LCMAPS_POLICY_NAME",value,1);
            else if (strcmp(var,"db")==0)
                setenv("LCMAPS_DB_FILE",value,1);
            else if (strcmp(var,"file")==0) {
                /* Only open when not already linked to stderr */
                if (lcmaps->logfile==NULL)      {
                    if ( (lcmaps->logfile=fopen(value,"a"))==NULL)
                        llwarn("Cannot open %s: %s\n", value,strerror(errno));
                }
            } else if (strcmp(var,"mode")==0)   {
                if (strcmp(value, "pem") == 0) {
                    lcmaps->mode = LCMAPS_RETURN_ACCOUNT_FROM_PEM;
                } else if (strcmp(value, "nogsi_pi") == 0) {
                    lcmaps->mode = LCMAPS_RETURN_POOLINDEX_WITHOUT_GSI;
                } else if (strcmp(value, "nogsi_ga") == 0) {
                    lcmaps->mode = LCMAPS_RETURN_ACCOUNT_WITHOUT_GSI;
                } else {
                    llerr("LCMAPS mode should be pem, nogsi_pi or nogsi_ga.\n");
                    return 1;
                }
            } else if (strcmp(var,"voms")==0)   {
                if (strcmp(value, "0")==0)  {
                    lcmaps->dovoms=0;
                } else if (strcmp(value, "1") == 0) {
                    lcmaps->dovoms=1;
                } else {
                    llerr("Invalid value %s for option voms.\n", value);
                    return 1;
                }
            } else
                llwarn("Unrecognized option '%s'\n",var);
            /* reset value at pos */
            pos[0]='=';
        }
        if (end!=NULL)  {
            /* reset value at end */
            end[0]=',';
            /* advance to next option */
            var=end+1;
        }
    } while (end!=NULL);
    return 0;
}

/* Prints contents of account */
void lcmaps_print_account(lcmaps_account_info_t* account)  {
    int i;
    struct passwd *pw;
    struct group *gr;

    /* Check if there is anything */
    if (account->uid==-1)   {
        llnotice("Account info is empty.\n");
        return;
    }
    /* UID / username */
    pw=getpwuid(account->uid);
    llnotice("uid=%d(%s)\n",account->uid,pw ? pw->pw_name : "undefined");
    /* Primary groups */
    llnotice("primary gids: %d\n",account->npgid);
    for (i=0; i<account->npgid; i++)    {
        gr=getgrgid(account->pgid_list[i]);
        llnotice("pgid[%d]=%d(%s)\n",i,
                account->pgid_list[i],
                gr ? gr->gr_name : "undefined");
    }
    /* Secondary groups */
    llnotice("secondary gids: %d\n",account->nsgid);
    for (i=0; i<account->nsgid; i++)    {
        gr=getgrgid(account->sgid_list[i]);
        llnotice("sgid[%d]=%d(%s)\n",i,
                account->sgid_list[i],
                gr ? gr->gr_name : "undefined");
    }
    /* Poolindex */
    llnotice("poolindex=%s\n",
        (account->poolindex)!=NULL ? account->poolindex : "undefined");
}

/* Dynamically loads LCMAPS library */
int lcmaps_loadlib(lcmaps_t *lcmaps,opts_t *opts) {
    const char *libname;

    switch (lcmaps->mode) {
        case LCMAPS_RETURN_ACCOUNT_FROM_PEM:
            libname="liblcmaps_return_account_from_pem.so";
            break;
        case LCMAPS_RETURN_POOLINDEX_WITHOUT_GSI:
            libname="liblcmaps_return_poolindex_without_gsi.so";
            break;
        case LCMAPS_RETURN_ACCOUNT_WITHOUT_GSI:
            libname="liblcmaps_return_poolindex_without_gsi.so";
            break;
        default:
            llerr("Unknown LCMAPS mode.\n");
            return 1;
    }

    /* Make sure lib->handle has welldefined value */
    lcmaps->handle=lcmaps->helper=NULL;

    /* Load the library lazily: this allows checking for missing symbols */
    if ( (lcmaps->handle=dlopen(libname, RTLD_LAZY | RTLD_GLOBAL))==NULL )  {
        llerr("Cannot open LCMAPS lib: %s\n", dlerror());
        return 1;
    }
    
    /* Clear dlerror() */
    dlerror();

    /* See if we have lcmaps_get*version() functions */
    lcmaps->lcmaps_get_major_version=
        (int(*)(void))dlsym(lcmaps->handle,"lcmaps_get_major_version");
    if (dlerror()==NULL) /* New LCMAPS: no need for get*VersionNumber() */
        lcmaps->new=1;
    else {      /* Old LCMAPS version */
        lcmaps->new=0;
        if (opts->verbose)
            llwarn("Old LCMAPS version, "\
                "need to provide missing get*VersionNumber() functions.\n");

        /* Load global symbols, in order to look for getMajorVersionNumber */
        if ((lcmaps->helper=dlopen(NULL,RTLD_NOW | RTLD_GLOBAL))==NULL) {
            llerr("Cannot load global symbols: %s\n",dlerror());
            return 1;
        }

        /* Now look for getMajorVersionNumber: first look in global symbols, if
         * not there, try loading vomsfix library, if that fails too, load lcas
         * instead. */
        dlsym(lcmaps->helper,"getMajorVersionNumber");
        if (dlerror()!=NULL)    { /* Not in global: try vomsfix lib */
            dlclose(lcmaps->helper); /* No longer needed, doesn't provide...*/
            if (opts->verbose)
                llwarn("trying libvomsfix.so for missing "\
                        "get*VersionNumber() functions.\n");
            if ( (lcmaps->helper=
                    dlopen("libvomsfix.so",RTLD_NOW | RTLD_GLOBAL))==NULL ) {
                /* libvomsfix.so doesn't exist or isn't found. Now use lcas as
                 * a backup */
                if (opts->verbose)
                    llwarn("loading LCAS to provide missing "\
                            "get*VersionNumber() functions.\n");
                if ( (lcmaps->helper=
                        dlopen("liblcas.so",RTLD_NOW | RTLD_GLOBAL))==NULL) {
                    llerr("%s\n",dlerror());
                    return 1;
                }
            }
        }
    }

    /* Reopening lcmaps with RTLD_NOW to force loading of secondary dependencies
     * (e.g. VOMSAPI) */
    if (dlclose(lcmaps->handle))    {
        llerr("Cannot close LCMAPS lib: %s\n",dlerror());
        return 1;
    }
    if ( (lcmaps->handle=dlopen(libname, RTLD_NOW | RTLD_GLOBAL))==NULL )   {
        llerr("%s\n",dlerror());
        return 1;
    }

    return 0;
}

/* Dynamically loads LCMAPS library symbols */
int lcmaps_loadfcies(lcmaps_t *lcmaps) {
    char *err;

    /* Load functions */
    lcmaps->lcmaps_init=(int (*)(FILE*))
        dlsym(lcmaps->handle,"lcmaps_init");
    if ( (err=dlerror())!=NULL)
        goto lcmapsfcies_failed;
    lcmaps->lcmaps_account_info_init=(int (*)(lcmaps_account_info_t*))
        dlsym(lcmaps->handle,"lcmaps_account_info_init");
    if ( (err=dlerror())!=NULL)
        goto lcmapsfcies_failed;
    lcmaps->lcmaps_term= (int (*)(void))
        dlsym(lcmaps->handle,"lcmaps_term");
    if ( (err=dlerror())!=NULL)
        goto lcmapsfcies_failed;
    lcmaps->lcmaps_account_info_clean=(int (*)(lcmaps_account_info_t*))
            dlsym(lcmaps->handle,"lcmaps_account_info_clean");
    if ( (err=dlerror())!=NULL)
        goto lcmapsfcies_failed;

    /* Load LCMAPS runmode specific function (account mapping function) */
    switch (lcmaps->mode) {
        case  LCMAPS_RETURN_ACCOUNT_FROM_PEM:
            lcmaps->lcmaps_return_account_from_pem=
                (int (*)(char*,int,lcmaps_account_info_t*))
                    dlsym(lcmaps->handle,"lcmaps_return_account_from_pem");
            if ( (err=dlerror())!=NULL)
                goto lcmapsfcies_failed;
            break;
        case  LCMAPS_RETURN_POOLINDEX_WITHOUT_GSI:
            lcmaps->lcmaps_return_poolindex_without_gsi=
                (int (*)(char*,char**,int,lcmaps_account_info_t*))
                    dlsym(lcmaps->handle,"lcmaps_return_poolindex_without_gsi");
            if ( (err=dlerror())!=NULL)
                goto lcmapsfcies_failed;
            break;
        case LCMAPS_RETURN_ACCOUNT_WITHOUT_GSI:
            lcmaps->lcmaps_return_account_without_gsi=
                (int (*)(char*,char**,int,int,lcmaps_account_info_t*))
                    dlsym(lcmaps->handle,"lcmaps_return_account_without_gsi");
            if ( (err=dlerror())!=NULL)
                goto lcmapsfcies_failed;
            break;
    }

    /* When we specified to either enable or disable VOMS, load both symbols */
    if (lcmaps->dovoms!=-1)  {
        lcmaps->lcmaps_enable_voms_attributes_verification=
            (void (*)(void))
                dlsym(lcmaps->handle,
                      "lcmaps_enable_voms_attributes_verification");
        if ( (err=dlerror())!=NULL)     {
            llerr("Requested API call for disabling voms is not present in "
                  "this LCMAPS.\n");
            goto lcmapsfcies_failed;
        }
        lcmaps->lcmaps_disable_voms_attributes_verification=
            (void (*)(void))
                dlsym(lcmaps->handle,
                      "lcmaps_disable_voms_attributes_verification");
        if ( (err=dlerror())!=NULL)     {
            llerr("Requested API call for disabling voms is not present in "
                  "this LCMAPS.\n");
            goto lcmapsfcies_failed;
        }
    }

    return 0;

lcmapsfcies_failed:
    llerr("%s\n",err);
    dlclose(lcmaps->handle);
    if (lcmaps->helper)
        dlclose(lcmaps->helper);
    return 1;
}

/* Does an lcmaps run, for given credentials and to logfile or syslog when
 * logfile is NULL. */
int lcmaps_run(lcmaps_t *lcmaps)    {
    int rc=0,rc2=0;

    /* init lcmaps */
    if ( (rc=lcmaps->lcmaps_init(lcmaps->logfile))      )   {
        llerr("lcmaps_init() failed\n");
        goto lcmapsrun_closelib;
    }
    /* init lcmaps account struct */
    if ( (rc=lcmaps->lcmaps_account_info_init(&lcmaps->account)) )    {
        llerr("lcmaps_account_info_init() failed.\n");
        goto lcmapsrun_closelib;
    }

    /* Optionally enable/disable voms checking */
    if (lcmaps->dovoms==0)
        lcmaps->lcmaps_disable_voms_attributes_verification();
    else if (lcmaps->dovoms==1)
        lcmaps->lcmaps_enable_voms_attributes_verification();
    
    /* Do actual mapping call */ 
    switch (lcmaps->mode) {
        case  LCMAPS_RETURN_ACCOUNT_FROM_PEM:
            if ( (rc=lcmaps->lcmaps_return_account_from_pem(
                            lcmaps->cred->pemstring,-1,&lcmaps->account)) )  {
                llerr("lcmaps_return_account_from_pem() failed.\n");
                goto lcmapsrun_clean;
            }
            break;
        case  LCMAPS_RETURN_POOLINDEX_WITHOUT_GSI:
            if ( (rc=lcmaps->lcmaps_return_poolindex_without_gsi(
                            lcmaps->cred->dn, lcmaps->cred->fqans, 
                            lcmaps->cred->nfqan, &lcmaps->account)) )  {
                llerr("lcmaps_return_poolindex_without_gsi() failed.\n");
                goto lcmapsrun_clean;
            }
            break;
        case LCMAPS_RETURN_ACCOUNT_WITHOUT_GSI:
            if ( (rc=lcmaps->lcmaps_return_account_without_gsi(
                            lcmaps->cred->dn, lcmaps->cred->fqans,
                            lcmaps->cred->nfqan, 0, &lcmaps->account)) )  {
                llerr("lcmaps_return_account_without_gsi() failed.\n");
                goto lcmapsrun_clean;
            }
            break;
    }
    /* terminate lcmaps */
    if ( (rc=lcmaps->lcmaps_term()) )  {
        llerr("lcmaps_term() failed.\n");
        goto lcmapsrun_clean;
    }
    /* LCMAPS finished succesfully */
    rc=0;
    llnotice("LCMAPS succeeded.\n");

    /* Print contents of account */
    lcmaps_print_account(&lcmaps->account);

lcmapsrun_clean:
    /* Cleaning and freeing the account structure */
    if ( (rc2=lcmaps->lcmaps_account_info_clean(&lcmaps->account)) )
        llerr("lcmaps_account_info_clean() failed.\n");

lcmapsrun_closelib:
    /* Close library */
    dlclose(lcmaps->handle);
    if (lcmaps->helper)
        dlclose(lcmaps->helper);
    /* when non-clean function failed: return its rc, otherwise that of clean */
    return (rc ? rc : rc2);
}

/************************************************************************/
/* LCAS FUNCTIONS                                                       */
/************************************************************************/

/* Parses the options for LCAS and opens the logfile when needed */
int lcas_set_vars(char *options,lcas_t *lcas)  {
    char *var=options,*value,*end,*pos;

    /* set defaults */
    lcas->rsl=NULL;

    /* If first char of options is a - it's actually the next main option */
    if (options==NULL || options[0]=='-')
        return 0;

    do  {
        /* Find end of current var=value pair */
        end=strchr(var, ',');
        if (end!=NULL) end[0]='\0';
        /* Find end of variable name */
        pos=strchr(var,'=');
        if (pos==NULL)
            llerr("Unrecognized element '%s'\n", var);
        else    {
            pos[0]='\0';
            value=pos+1;
            /* Find the variable */
            if (strcmp(var,"debug")==0)
                setenv("LCAS_DEBUG_LEVEL",value,1);
            else if (strcmp(var,"db")==0)
                setenv("LCAS_DB_FILE",value,1);
            else if (strcmp(var,"rsl")==0)  {
                if ((lcas->rsl=strdup(value))==NULL)    {
                    llerr("Cannot strdup() RSL string for LCAS\n");
                    return 1;
                }
            }
            else if (strcmp(var,"file")==0) {
                /* Only open when not already linked to stderr */
                if (lcas->logfile==NULL)        {
                    if ( (lcas->logfile=fopen(value,"a"))==NULL)
                        llwarn("Cannot open %s: %s\n", value,strerror(errno));
                }
            }
            else
                llwarn("Unrecognized option '%s'\n",var);
            /* reset value at pos */
            pos[0]='=';
        }
        if (end!=NULL)  {
            /* reset value at end */
            end[0]=',';
            /* advance to next option */
            var=end+1;
        }
    } while (end!=NULL);

    return 0;
}

/* Dynamically loads LCAS library and all needed symbols */
int lcas_loadlib(lcas_t *lcas,opts_t *flags) {
    /* Load the library */
    if ( (lcas->handle=
                dlopen("liblcas.so",RTLD_NOW | RTLD_GLOBAL))==NULL )    {
        llerr("%s\n",dlerror());
        return 1;
    }
    return 0;
}

/* Dynamically loads LCAS library symbols */
int lcas_loadfcies(lcas_t *lcas) {
    char *err;

    /* Clean dlerror() */
    dlerror();

    /* Load functions */
    lcas->lcas_init=(int (*)(FILE*))
        dlsym(lcas->handle,"lcas_init");
    if ( (err=dlerror())!=NULL)
        goto lcasfcies_failed;
    lcas->lcas_pem= (int (*)(char*,lcas_request_t))
        dlsym(lcas->handle,"lcas_pem");
    if ( (err=dlerror())!=NULL)
        goto lcasfcies_failed;
    lcas->lcas_term=(int (*)(void))
        dlsym(lcas->handle,"lcas_term");
    if ( (err=dlerror())!=NULL)
        goto lcasfcies_failed;

    return 0;

lcasfcies_failed:
    llerr("%s\n",err);
    dlclose(lcas->handle);
    return 1;
}

/* Loads LCAS library and does a run, for given pemstring and to logfile or
 * syslog when logfile is NULL and given rsl (=cmd + arguments) */
int lcas_run(lcas_t *lcas)  {
    int rc;

    /* Do a run */
    if ((rc=lcas->lcas_init(lcas->logfile)))   {
        llerr("lcas_init() failed\n");
        goto lcasrun_closelib;
    }
    if ((rc=lcas->lcas_pem(lcas->cred->pemstring,(lcas_request_t)(lcas->rsl)))){
        llerr("lcas_pem() failed.\n");
        goto lcasrun_closelib;
    }
    if ( (rc=lcas->lcas_term()) )  {
        llerr("lcas_term() failed.\n");
        goto lcasrun_closelib;
    }
    llnotice("LCAS succeeded.\n");

lcasrun_closelib:
    /* Close library */
    dlclose(lcas->handle);

    return rc;
}

/* Print the version */
void version(void)      {
    printf("%s version: %s\n",prog,VERSION);
    exit (0);
}

/* Prints out usage information */
void usage(void)   {
    int uid=(int)getuid();

    printf("Usage: %s [options]\n\n",prog);
    printf("Valid options are:\n"
           " -h              print this help text.\n"
           " -v              print version.\n\n"
           " -s              send output to stderr instead of syslog or file.\n"
           " -S<facility>    use specified syslog facility in case of logging "
           "to syslog.\n"
           " -q              quiet output (no warnings).\n"
           " -p<file>        read pemstring from given file.\n"
           " -x<file>        set or override X509_USER_PROXY to given file.\n\n"
           " -V<dir>         set or override X509_VOMS_DIR to given dir.\n"
           " -C<dir>         set or override X509_CERT_DIR to given dir.\n\n"
           " -L[opts]        run LCAS with given options: "
           "<var>=<value>,<var=value>,...\n"
           "   db=<file>      set or override LCAS_DB_FILE.\n"
           "   debug=<level>  set or override LCAS_DEBUG_LEVEL.\n"
           "   rsl=<string>   set rsl string (needs to be quoted).\n"
           "   file=<file>    send debug/log output to file instead of "
           "syslog, ignored\n                  when -s is specified.\n"
           "\n -l[opts]        run LCMAPS with given options: "
           "<var>=<value>,<var=value>,...\n"
           "   db=<file>      set or override LCMAPS_DB_FILE.\n"
           "   policy=<name>  set or override LCMAPS_POLICY_NAME.\n"
           "   debug=<level>  set or override LCMAPS_DEBUG_LEVEL.\n"
           "   file=<file>    send debug/log output to file instead of "
           "syslog, ignored\n                  when -s is specified.\n"
           "   voms={0,1}     disable/enable VOMS verification.\n"
           "   mode=<mode>    LCMAPS normally extracts all information from "
           "a PEM string\n"
           "                  (i.e. a proxy certificate), but it can be run "
           "in a mode\n"
           "                  \"without_gsi\" where the data such as the DN "
           "and FQAN are\n"
           "                  passed as plain strings, as set on the command "
           "line.\n"
           "                  with -d and -f. Valid modes are:\n"
           "                    pem       run LCMAPS get_account with pem "
           "string (default).\n"
           "                    nogsi_pi  run LCMAPS "
           "return_poolindex_without_gsi\n"
           "                    nogsi_ga  run LCMAPS "
           "return_account_without_gsi\n"
           " -d<DN>          use DN (in without_gsi mode)\n"
           " -f<FQAN>        use FQAN (in without_gsi mode)\n"
           );
    printf("\nExample:\n");
    printf(" %s -s -p/tmp/x509up_u%d -x/tmp/x509up_u%d \\\n",prog,uid,uid);
    printf("    -L debug=5,db=/tmp/lcas.db \\\n");
    printf("    -l policy=glexec_get_account,debug=5,db=/tmp/lcmaps.db\n");
    printf("\nNotes on reproducing gLExec behaviour:\n");
    printf("- gLExec uses an LCMAPS policy named 'glexec_get_account'\n");
    printf("- the proxy specified with -p is the analog of the ");
    printf("GLEXEC_CLIENT_CERT.\n");

    exit(0);
}

/*
 * Initializes the structs, then fills them based on the cmdline args, finally
 * does some basic checking of the supplied input.
 */
void parse_options(int argc, char *argv[],
                   cred_t *cred, opts_t *opts,
                   lcmaps_t *lcmaps, lcas_t *lcas)  {
    extern char *optarg;
    extern int optind, optopt;
    int opt,i,fqan_idx;
    size_t size;
    char *dummy;

    /* Get basename, don't rely on basename(3). argv[0] will not contain a
     * trailing / and will also not be empty... */
    dummy=strrchr(argv[0],'/');
    prog=( dummy==NULL ? argv[0] : &(dummy[1]) );

    /* Set other defaults */
    opts->verbose=1;
    opts->do_lcas=0;
    opts->do_lcmaps=0;
    opts->syslog_fac=NULL;

    cred->nfqan=0;
    cred->fqans=NULL;
    cred->pemstring=NULL;
    cred->dn=NULL;

    lcmaps->logfile=lcas->logfile=NULL;

    /* Look for number of FQAN options such that we can initialize the array */
    for (i=1; i<argc; i++)  {
        if (strcmp(argv[i],"-f")==0)    {
            cred->nfqan++;
            i++; /* skip next argument: it's the FQAN */
        }
    }
    /* Malloc memory for them... */
    if (cred->nfqan>0)  {
        size=sizeof(char*)*(cred->nfqan+1);
        if ( (cred->fqans=malloc(size))==NULL ) {
            llerr("Cannot malloc %d bytes for fqans\n",(int)size);
            exit(1);
        }
        cred->fqans[cred->nfqan]=NULL; /* NULL-terminate list */
    }

    /* Parse the commandline options */
    while ((opt = getopt(argc, argv, ":hvsS:qp:x:V:C:l:L:d:f:")) != -1) {
        switch (opt) {
            case 'h':
                usage();
            case 'v':
                version();
            case 's': /* Do not log to file but to stderr */
                if (lcmaps->logfile && lcmaps->logfile!=stderr)
                    fclose(lcmaps->logfile);
                if (lcas->logfile && lcas->logfile!=stderr)
                    fclose(lcas->logfile);
                lcmaps->logfile=lcas->logfile=stderr;
                break;
            case 'S':
                opts->syslog_fac=optarg;
                if (opensyslog(opts->syslog_fac)==-1)
                    exit(1);
                break;
            case 'q':
                opts->verbose=0;
                break;
            case 'p':
                if ((cred->pemstring=readproxy(optarg))==NULL)
                    exit(1);
                break;
            case 'x':
                setenv("X509_USER_PROXY",optarg,1);
                break;
            case 'V':
                setenv("X509_VOMS_DIR",optarg,1);
                break;
            case 'C':
                setenv("X509_CERT_DIR",optarg,1);
                break;
            case 'l':
                opts->do_lcmaps=lcmaps_set_vars(optarg,lcmaps)==0 ? 1 : 0;
                if (optarg[0]=='-') optind--;
                break;
            case 'L':
                opts->do_lcas=lcas_set_vars(optarg,lcas)==0 ? 1 : 0;
                if (optarg[0]=='-') optind--;
                break;
            case 'd':
                cred->dn = optarg;
                break;
            case 'f':
                cred->fqans[fqan_idx++]=optarg;
                break;
            case ':':
                /* Option did not receive an expected argument (only when last
                 * of line get here, otherwise next option is used as argument),
                 * includes those with optional arguments, i.e. -l and -L */
                switch(optopt)  {
                    case 'l':
                        lcmaps_set_vars(NULL,lcmaps);
                        opts->do_lcmaps=1;
                        break;
                    case 'L':
                        lcas_set_vars(NULL,lcas);
                        opts->do_lcas=1;
                        break;
                    default:
                        fprintf(stderr,
                                "%s: option requires an argument -- '%c'\n",
                                prog,optopt);
                        fprintf(stderr,"Try `%s -h` for more information.\n",
                                prog);
                        exit(1);
                }
                break;
            case '?':
                fprintf(stderr,"%s: invalid option -- '%c'\n", prog, optopt);
                fprintf(stderr,"Try `%s -h` for more information.\n",prog);
                exit(1);
        }
    }

    /* Print warnings when verbose */
    if (opts->verbose)    {
        if (cred->pemstring==NULL)
            llwarn("Empty pemstring for proxy.\n");
        if (getenv("X509_USER_PROXY")==NULL)
            llwarn("X509_USER_PROXY is not set.\n");
        if (opts->do_lcas)      {
            if (lcas->logfile==NULL) {
                llwarn("LCAS logging will go to syslog");
                if (opts->syslog_fac==NULL)
                    fprintf(stderr,".\n");
                else
                    fprintf(stderr,", using facility %s.\n",opts->syslog_fac);
            }
            if (getenv("LCAS_DB_FILE")==NULL)
                llwarn("using LCAS default db file.\n");
        }
        if (opts->do_lcmaps)    {
            if (lcmaps->logfile==NULL)  {
                llwarn("LCMAPS logging will go to syslog");
                if (opts->syslog_fac==NULL)
                    fprintf(stderr,".\n");
                else
                    fprintf(stderr,", using facility %s.\n",opts->syslog_fac);
            }
            if (getenv("LCMAPS_DB_FILE")==NULL)
                llwarn("using LCMAPS default db file.\n");
            if (getenv("LCMAPS_POLICY_NAME")==NULL)
                llwarn("using LCMAPS default policy name.\n");
            if ( (lcmaps->mode == LCMAPS_RETURN_ACCOUNT_WITHOUT_GSI || 
                  lcmaps->mode == LCMAPS_RETURN_POOLINDEX_WITHOUT_GSI) &&
                 cred->dn == NULL) 
                llwarn("running without GSI with NULL DN string.\n");
        }
    }
}

/************************************************************************/
/* MAIN() FUNCTION                                                      */
/************************************************************************/

/* Main() */
int main(int argc, char *argv[])        {
    int rc=0;

    lcas_t lcas;
    lcmaps_t lcmaps;
    opts_t opts;
    cred_t cred;

    /* Initialize LCMAPS and LCAS structs */
    lcmaps.opts=lcas.opts=&opts;
    lcmaps.cred=lcas.cred=&cred;

    /* Parse cmdline input and fill cred, opts and lcmaps/lcas structs */
    parse_options(argc,argv,&cred,&opts,&lcmaps,&lcas);
    
    /* Check if we have something to do... */
    if (opts.do_lcas==0 && opts.do_lcmaps==0) {
        llnotice("Nothing to do, see %s -h for valid options.\n",prog);
        return 0;
    }

    /* Do LCAS when requested */
    if (opts.do_lcas)    {
        rc=(lcas_loadlib(&lcas,&opts) ||
            lcas_loadfcies(&lcas) ||
            lcas_run(&lcas));
        if (rc!=0)
            llerr("LCAS failed.\n");
        if (lcas.rsl)
            free(lcas.rsl);
    }

    /* Do LCMAPS when requested */
    if (opts.do_lcmaps)  {
        rc=(lcmaps_loadlib(&lcmaps, &opts) ||
            lcmaps_loadfcies(&lcmaps) ||
            lcmaps_run(&lcmaps));
        if (rc!=0)
            llerr("LCMAPS failed.\n");
    }

    free(cred.pemstring);
    free(cred.fqans);

    return rc;
}
grid.support@nikhef.nl	ViewVC Help
Powered by ViewVC 1.1.28