Common interface for server security objects

Add an interface for creating arrays of server security objects.
This collects all of the various daemon code for initialising
security objects into one place, reducing duplication and making
it easier to add new objects in the future.

Change-Id: I9df20afccdbac4a610cb5bde32f01069272f27a2
Reviewed-on: http://gerrit.openafs.org/1177
Reviewed-by: Derrick Brashear <shadow@dementia.org>
Tested-by: Derrick Brashear <shadow@dementia.org>

diff --git a/src/auth/authcon.c b/src/auth/authcon.c
index f18311c960c82b96e1881c26c87821a6c2fb42d0..006fd232569b892516060a28a26b34dceb8e6f1e 100644 (file)
--- a/src/auth/authcon.c
+++ b/src/auth/authcon.c
@@ -171,3 +171,31 @@ afsconf_ClientAuthSecure(void *arock,
     UNLOCK_GLOBAL_MUTEX;
     return rc;
 }
+
+/*!
+ * Build a set of security classes suitable for a server accepting
+ * incoming connections
+ */
+#if !defined(UKERNEL)
+void
+afsconf_BuildServerSecurityObjects(struct afsconf_dir *dir,
+                                  afs_uint32 flags,
+                                  struct rx_securityClass ***classes,
+                                  afs_int32 *numClasses)
+{
+    if (flags & AFSCONF_SEC_OBJS_RXKAD_CRYPT)
+       *numClasses = 4;
+    else
+       *numClasses = 3;
+
+    *classes = calloc(*numClasses, sizeof(**classes));
+
+    (*classes)[0] = rxnull_NewServerSecurityObject();
+    (*classes)[1] = NULL;
+    (*classes)[2] = rxkad_NewServerSecurityObject(0, dir,
+                                                 afsconf_GetKey, NULL);
+    if (flags & AFSCONF_SEC_OBJS_RXKAD_CRYPT)
+       (*classes)[3] = rxkad_NewServerSecurityObject(rxkad_crypt, dir,
+                                                     afsconf_GetKey, NULL);
+}
+#endif

diff --git a/src/auth/cellconfig.p.h b/src/auth/cellconfig.p.h
index 72a0e0ee49068f68003fb79a58b7fa20ff1f8198..e0d86b1adc515f676b29fa892ed2d386456ebae3 100644 (file)
--- a/src/auth/cellconfig.p.h
+++ b/src/auth/cellconfig.p.h
@@ -145,6 +145,13 @@ extern afs_int32 afsconf_ClientAuthSecure(void *arock,
                                          struct rx_securityClass **astr,
                                          afs_int32 * aindex);
 
+/* Flags for this function */
+#define AFSCONF_SEC_OBJS_RXKAD_CRYPT 1
+extern void afsconf_BuildServerSecurityObjects(struct afsconf_dir *,
+                                              afs_uint32,
+                                              struct rx_securityClass ***,
+                                              afs_int32 *);
+
 /* writeconfig.c */
 int afsconf_SetExtendedCellInfo(struct afsconf_dir *adir, const char *apath, 
                                struct afsconf_cell *acellInfo, char clones[]);

diff --git a/src/bozo/bosserver.c b/src/bozo/bosserver.c
index 6dc5e93b44ec206336b8e753806b1e8361bd1d21..52b9088f990704be88143956e53cf8903f04fe93 100644 (file)
--- a/src/bozo/bosserver.c
+++ b/src/bozo/bosserver.c
@@ -58,7 +58,6 @@ extern struct bnode_ops fsbnode_ops, dafsbnode_ops, ezbnode_ops, cronbnode_ops;
 
 struct afsconf_dir *bozo_confdir = 0;  /* bozo configuration dir */
 static PROCESS bozo_pid;
-struct rx_securityClass *bozo_rxsc[3];
 const char *bozo_fileName;
 FILE *bozo_logFile;
 
@@ -722,6 +721,8 @@ main(int argc, char **argv, char **envp)
     int rxMaxMTU = -1;
     afs_uint32 host = htonl(INADDR_ANY);
     char *auditFileName = NULL;
+    struct rx_securityClass **securityClasses;
+    afs_int32 numClasses;
 #ifndef AFS_NT40_ENV
     int nofork = 0;
     struct stat sb;
@@ -1002,14 +1003,8 @@ main(int argc, char **argv, char **envp)
     /* allow super users to manage RX statistics */
     rx_SetRxStatUserOk(bozo_rxstat_userok);
 
-    /* have bcrypt key now */
-
     afsconf_SetNoAuthFlag(tdir, noAuth);
-
-    bozo_rxsc[0] = rxnull_NewServerSecurityObject();
-    bozo_rxsc[1] = (struct rx_securityClass *)0;
-    bozo_rxsc[2] =
-       rxkad_NewServerSecurityObject(0, tdir, afsconf_GetKey, NULL);
+    afsconf_BuildServerSecurityObjects(tdir, 0, &securityClasses, &numClasses);
 
     /* Disable jumbograms */
     rx_SetNoJumbo();
@@ -1035,11 +1030,9 @@ main(int argc, char **argv, char **envp)
             host = SHostAddrs[0];
     }
 
-    tservice = rx_NewServiceHost(host,  /* port */ 0, /* service id */ 1,
-                            /*service name */ "bozo",
-                            /* security classes */
-                            bozo_rxsc,
-                            /* numb sec classes */ 3, BOZO_ExecuteRequest);
+    tservice = rx_NewServiceHost(host, 0, /* service id */ 1,
+                                "bozo", securityClasses, numClasses,
+                                BOZO_ExecuteRequest);
     rx_SetMinProcs(tservice, 2);
     rx_SetMaxProcs(tservice, 4);
     rx_SetStackSize(tservice, BOZO_LWP_STACKSIZE);     /* so gethostbyname works (in cell stuff) */
@@ -1049,8 +1042,8 @@ main(int argc, char **argv, char **envp)
     }
 
     tservice =
-       rx_NewServiceHost(host, 0, RX_STATS_SERVICE_ID, "rpcstats", bozo_rxsc,
-                         3, RXSTATS_ExecuteRequest);
+       rx_NewServiceHost(host, 0, RX_STATS_SERVICE_ID, "rpcstats",
+                         securityClasses, numClasses, RXSTATS_ExecuteRequest);
     rx_SetMinProcs(tservice, 2);
     rx_SetMaxProcs(tservice, 4);
     rx_StartServer(1);         /* donate this process */

diff --git a/src/budb/server.c b/src/budb/server.c
index 63e538ac411ddc4b53cff44e3e18820a1e7423c9..a165403033599986dbf28251d53b7d907014d7fc 100644 (file)
--- a/src/budb/server.c
+++ b/src/budb/server.c
@@ -377,7 +377,8 @@ main(int argc, char **argv)
     char  clones[MAXHOSTSPERCELL];
 
     struct rx_service *tservice;
-    struct rx_securityClass *sca[3];
+    struct rx_securityClass **securityClasses;
+    afs_int32 numClasses;
 
     extern int rx_stackSize;
 
@@ -559,18 +560,16 @@ main(int argc, char **argv)
        ERROR(code);
     }
 
-    sca[RX_SCINDEX_NULL] = rxnull_NewServerSecurityObject();
-    sca[RX_SCINDEX_VAB] = 0;
-    sca[RX_SCINDEX_KAD] =
-       rxkad_NewServerSecurityObject(rxkad_clear, BU_conf, afsconf_GetKey,
-                                     NULL);
+    afsconf_BuildServerSecurityObjects(BU_conf, 0,
+                                      &securityClasses, &numClasses);
 
     /* Disable jumbograms */
     rx_SetNoJumbo();
 
     tservice =
-       rx_NewServiceHost(host, 0, BUDB_SERVICE, "BackupDatabase", sca, 3,
-                     BUDB_ExecuteRequest);
+       rx_NewServiceHost(host, 0, BUDB_SERVICE, "BackupDatabase",
+                         securityClasses, numClasses, BUDB_ExecuteRequest);
+
     if (tservice == (struct rx_service *)0) {
        LogError(0, "Could not create backup database rx service\n");
        printf("Could not create backup database rx service\n");

diff --git a/src/ptserver/ptserver.c b/src/ptserver/ptserver.c
index f347ec567f514e5bbe30de18a009fea1473b2dc8..2f4114c73645c182fb9826aa16dcd16186c1144c 100644 (file)
--- a/src/ptserver/ptserver.c
+++ b/src/ptserver/ptserver.c
@@ -209,10 +209,8 @@ main(int argc, char **argv)
     register struct hostent *th;
     char hostname[64];
     struct rx_service *tservice;
-    struct rx_securityClass *sc[3];
-#if 0
-    struct ktc_encryptionKey tkey;
-#endif
+    struct rx_securityClass **securityClasses;
+    afs_int32 numClasses;
     int kerberosKeys;          /* set if found some keys */
     int lwps = 3;
     char clones[MAXHOSTSPERCELL];
@@ -461,14 +459,6 @@ main(int argc, char **argv)
     pr_realmName = info.name;
     pr_realmNameLen = strlen(pr_realmName);
 
-#if 0
-    /* get keys */
-    code = afsconf_GetKey(prdir, 999, &tkey);
-    if (code) {
-       afs_com_err(whoami, code,
-               "couldn't get bcrypt keys from key file, ignoring.");
-    }
-#endif
     {
        afs_int32 kvno;         /* see if there is a KeyFile here */
        struct ktc_encryptionKey key;
@@ -532,12 +522,8 @@ main(int argc, char **argv)
     pt_hook_write();
 #endif
 
-    sc[0] = rxnull_NewServerSecurityObject();
-    sc[1] = 0;
-    if (kerberosKeys) {
-       sc[2] = rxkad_NewServerSecurityObject(0, prdir, afsconf_GetKey, NULL);
-    } else
-       sc[2] = sc[0];
+    afsconf_BuildServerSecurityObjects(prdir, 0, &securityClasses,
+                                      &numClasses);
 
     /* Disable jumbograms */
     rx_SetNoJumbo();
@@ -547,8 +533,8 @@ main(int argc, char **argv)
     }
 
     tservice =
-       rx_NewServiceHost(host, 0, PRSRV, "Protection Server", sc, 3,
-                     PR_ExecuteRequest);
+       rx_NewServiceHost(host, 0, PRSRV, "Protection Server", securityClasses,
+                         numClasses, PR_ExecuteRequest);
     if (tservice == (struct rx_service *)0) {
        fprintf(stderr, "ptserver: Could not create new rx service.\n");
        PT_EXIT(3);
@@ -561,8 +547,8 @@ main(int argc, char **argv)
     }
 
     tservice =
-       rx_NewServiceHost(host, 0, RX_STATS_SERVICE_ID, "rpcstats", sc, 3,
-                     RXSTATS_ExecuteRequest);
+       rx_NewServiceHost(host, 0, RX_STATS_SERVICE_ID, "rpcstats",
+                         securityClasses, numClasses, RXSTATS_ExecuteRequest);
     if (tservice == (struct rx_service *)0) {
        fprintf(stderr, "ptserver: Could not create new rx service.\n");
        PT_EXIT(3);

diff --git a/src/update/server.c b/src/update/server.c
index 67ac54e88e20dff29eb794b0acc3f7102026f22a..c139e0744cbb78de0c6ad875db015513c1efc821 100644 (file)
--- a/src/update/server.c
+++ b/src/update/server.c
@@ -180,7 +180,8 @@ osi_audit(void)
 int
 main(int argc, char *argv[])
 {
-    struct rx_securityClass *securityObjects[3];
+    struct rx_securityClass **securityClasses;
+    afs_int32 numClasses;
     struct rx_service *service;
     afs_uint32 host = htonl(INADDR_ANY);
 
@@ -297,29 +298,17 @@ main(int argc, char *argv[])
     if (rx_InitHost(host, htons(AFSCONF_UPDATEPORT)) < 0)
        Quit("rx_init");
 
-    /* Create a single security object, in this case the null security object,
-     * for unauthenticated connections, which will be used to control security
-     * on connections made to this server. */
+    afsconf_BuildServerSecurityObjects(cdir, 0, &securityClasses, &numClasses);
 
-    /* WHAT A JOKE!  Let's use rxkad at least so we know who we're talking to,
-     * then sometimes require full encryption. */
-
-    /* rxnull and rxvab are no longer supported */
-    securityObjects[0] = rxnull_NewServerSecurityObject();
-
-    securityObjects[1] = (struct rx_securityClass *)0;
-
-    securityObjects[2] =
-       rxkad_NewServerSecurityObject(rxkad_clear, cdir, afsconf_GetKey, 0);
-    if (securityObjects[2] == (struct rx_securityClass *)0)
+    if (securityClasses[2] == NULL)
        Quit("rxkad_NewServerSecurityObject");
 
     /* Instantiate a single UPDATE service.  The rxgen-generated procedure
      * which is called to decode requests is passed in here
      * (UPDATE_ExecuteRequest). */
     service =
-       rx_NewServiceHost(host, 0, UPDATE_SERVICEID, "UPDATE", securityObjects,
-                         3, UPDATE_ExecuteRequest);
+       rx_NewServiceHost(host, 0, UPDATE_SERVICEID, "UPDATE", securityClasses,
+                         numClasses, UPDATE_ExecuteRequest);
     if (service == (struct rx_service *)0)
        Quit("rx_NewService");
     rx_SetMaxProcs(service, 2);

diff --git a/src/viced/viced.c b/src/viced/viced.c
index 80c3a9478eebcbdaf07d21de545cd655835f7ff2..6e9bfeac1d6d7cc892c09605eabfa65e047c0ce8 100644 (file)
--- a/src/viced/viced.c
+++ b/src/viced/viced.c
@@ -367,27 +367,6 @@ threadNum(void)
 }
 #endif
 
-/* proc called by rxkad module to get a key */
-static int
-get_key(void *arock, register afs_int32 akvno, struct ktc_encryptionKey *akey)
-{
-    /* find the key */
-    static struct afsconf_key tkey;
-    register afs_int32 code;
-
-    if (!confDir) {
-       ViceLog(0, ("conf dir not open\n"));
-       return 1;
-    }
-    code = afsconf_GetKey(confDir, akvno, (struct ktc_encryptionKey *)tkey.key);
-    if (code) {
-       ViceLog(0, ("afsconf_GetKey failure: kvno %d code %d\n", akvno, code));
-       return code;
-    }
-    memcpy(akey, tkey.key, sizeof(tkey.key));
-    return 0;
-}                              /*get_key */
-
 #ifndef AFS_NT40_ENV
 int
 viced_syscall(afs_uint32 a3, afs_uint32 a4, void *a5)
@@ -1932,7 +1911,8 @@ main(int argc, char *argv[])
 {
     afs_int32 code;
     char tbuffer[32];
-    struct rx_securityClass *sc[4];
+    struct rx_securityClass **securityClasses;
+    afs_int32 numClasses;
     struct rx_service *tservice;
 #ifdef AFS_PTHREAD_ENV
     pthread_t serverPid;
@@ -2143,16 +2123,14 @@ main(int argc, char *argv[])
     }
     rx_GetIFInfo();
     rx_SetRxDeadTime(30);
-    sc[0] = rxnull_NewServerSecurityObject();
-    sc[1] = 0;                 /* rxvab_NewServerSecurityObject(key1, 0) */
-    sc[2] = rxkad_NewServerSecurityObject(rxkad_clear, NULL, get_key, NULL);
-    sc[3] = rxkad_NewServerSecurityObject(rxkad_crypt, NULL, get_key, NULL);
+    afsconf_BuildServerSecurityObjects(confDir, AFSCONF_SEC_OBJS_RXKAD_CRYPT,
+                                      &securityClasses, &numClasses);
+
     tservice = rx_NewServiceHost(rx_bindhost,  /* port */ 0, /* service id */ 
                                 1,     /*service name */
                                 "AFS",
-                                /* security classes */ sc,
-                                /* numb sec classes */
-                                4, RXAFS_ExecuteRequest);
+                                securityClasses, numClasses,
+                                RXAFS_ExecuteRequest);
     if (!tservice) {
        ViceLog(0,
                ("Failed to initialize RX, probably two servers running.\n"));
@@ -2168,8 +2146,8 @@ main(int argc, char *argv[])
     rx_SetServerIdleDeadErr(tservice, VNOSERVICE);
 
     tservice =
-       rx_NewService(0, RX_STATS_SERVICE_ID, "rpcstats", sc, 4,
-                     RXSTATS_ExecuteRequest);
+       rx_NewService(0, RX_STATS_SERVICE_ID, "rpcstats", securityClasses,
+                     numClasses, RXSTATS_ExecuteRequest);
     if (!tservice) {
        ViceLog(0, ("Failed to initialize rpc stat service.\n"));
        exit(-1);

diff --git a/src/vlserver/vlserver.c b/src/vlserver/vlserver.c
index b86eafe5edd908c93c36e991544a3d0bbfaea11e..25c6397f3e3cc5c4085e4d13ee2600cb2cbfb9fd 100644 (file)
--- a/src/vlserver/vlserver.c
+++ b/src/vlserver/vlserver.c
@@ -131,7 +131,8 @@ main(int argc, char **argv)
     register afs_int32 code;
     afs_int32 myHost;
     struct rx_service *tservice;
-    struct rx_securityClass *sc[3];
+    struct rx_securityClass **securityClasses;
+    afs_int32 numClasses;
     struct afsconf_dir *tdir;
     struct ktc_encryptionKey tkey;
     struct afsconf_cell info;
@@ -363,13 +364,12 @@ main(int argc, char **argv)
     memset(HostAddress, 0, sizeof(HostAddress));
     initialize_dstats();
 
-    sc[0] = rxnull_NewServerSecurityObject();
-    sc[1] = (struct rx_securityClass *)0;
-    sc[2] = rxkad_NewServerSecurityObject(0, tdir, afsconf_GetKey, NULL);
+    afsconf_BuildServerSecurityObjects(tdir, 0, &securityClasses, &numClasses);
 
     tservice =
-       rx_NewServiceHost(host, 0, USER_SERVICE_ID, "Vldb server", sc, 3,
-                     VL_ExecuteRequest);
+       rx_NewServiceHost(host, 0, USER_SERVICE_ID, "Vldb server",
+                         securityClasses, numClasses,
+                         VL_ExecuteRequest);
     if (tservice == (struct rx_service *)0) {
        printf("vlserver: Could not create VLDB_SERVICE rx service\n");
        exit(3);
@@ -385,8 +385,9 @@ main(int argc, char **argv)
     }
 
     tservice =
-       rx_NewServiceHost(host, 0, RX_STATS_SERVICE_ID, "rpcstats", sc, 3,
-                     RXSTATS_ExecuteRequest);
+       rx_NewServiceHost(host, 0, RX_STATS_SERVICE_ID, "rpcstats",
+                         securityClasses, numClasses,
+                         RXSTATS_ExecuteRequest);
     if (tservice == (struct rx_service *)0) {
        printf("vlserver: Could not create rpc stats rx service\n");
        exit(3);

diff --git a/src/volser/volmain.c b/src/volser/volmain.c
index f9024f68eda00212085696f737d5645699a1da94..459550b257696b0096402994a7a306ee76c8b375 100644 (file)
--- a/src/volser/volmain.c
+++ b/src/volser/volmain.c
@@ -240,7 +240,8 @@ int
 main(int argc, char **argv)
 {
     register afs_int32 code;
-    struct rx_securityClass *(securityObjects[3]);
+    struct rx_securityClass **securityClasses;
+    afs_int32 numClasses;
     struct rx_service *service;
     struct ktc_encryptionKey tkey;
     int rxpackets = 100;
@@ -502,15 +503,12 @@ main(int argc, char **argv)
        VS_EXIT(1);
     }
     afsconf_GetKey(tdir, 999, &tkey);
-    securityObjects[0] = rxnull_NewServerSecurityObject();
-    securityObjects[1] = (struct rx_securityClass *)0; /* don't bother with rxvab */
-    securityObjects[2] =
-       rxkad_NewServerSecurityObject(0, tdir, afsconf_GetKey, NULL);
-    if (securityObjects[0] == (struct rx_securityClass *)0)
+    afsconf_BuildServerSecurityObjects(tdir, 0, &securityClasses, &numClasses);
+    if (securityClasses[0] == NULL)
        Abort("rxnull_NewServerSecurityObject");
     service =
-       rx_NewServiceHost(host, 0, VOLSERVICE_ID, "VOLSER", securityObjects, 3,
-                     AFSVolExecuteRequest);
+       rx_NewServiceHost(host, 0, VOLSERVICE_ID, "VOLSER", securityClasses,
+                         numClasses, AFSVolExecuteRequest);
     if (service == (struct rx_service *)0)
        Abort("rx_NewService");
     rx_SetBeforeProc(service, MyBeforeProc);
@@ -533,8 +531,8 @@ main(int argc, char **argv)
     }
 
     service =
-       rx_NewService(0, RX_STATS_SERVICE_ID, "rpcstats", securityObjects, 3,
-                     RXSTATS_ExecuteRequest);
+       rx_NewService(0, RX_STATS_SERVICE_ID, "rpcstats", securityClasses,
+                     numClasses, RXSTATS_ExecuteRequest);
     if (service == (struct rx_service *)0)
        Abort("rx_NewService");
     rx_SetMinProcs(service, 2);