From 3b59db3c5565b707e745d58f7ec1df1bdc7c1895 Mon Sep 17 00:00:00 2001 From: Jennifer Richards Date: Fri, 13 Apr 2018 16:03:52 -0400 Subject: [PATCH] Further work on tids and monitoring, tids appears to work again * Actually encode the TID response! * Do not directly send responses from tids_req_handler(), set the properties in the response and return with an error code * Add hostname to MONS_INSTANCE * Update tids hostname after configuration change * Add a tid_resp_cpy() function to duplicate a TID_RESP into a struct that already exists --- include/mon_internal.h | 6 +++--- include/tid_internal.h | 1 + mon/mons.c | 10 +++------ tid/tid_resp.c | 44 +++++++++++++++++++++++++++++++-------- tid/tids.c | 17 ++++++++------- tr/tr_mon.c | 7 +++---- tr/tr_tid.c | 56 +++++++++++++++++++++++++++++++++----------------- tr/tr_trp.c | 4 ++++ 8 files changed, 94 insertions(+), 51 deletions(-) diff --git a/include/mon_internal.h b/include/mon_internal.h index d19e2a5..171ce18 100644 --- a/include/mon_internal.h +++ b/include/mon_internal.h @@ -118,7 +118,7 @@ struct mon_resp { /* Monitoring server instance */ struct mons_instance { - char *hostname; + const char *hostname; unsigned int port; TR_GSS_NAMES *authorized_gss_names; TIDS_INSTANCE *tids; @@ -161,8 +161,8 @@ json_t *mon_resp_encode(MON_RESP *resp); /* mons.c */ MONS_INSTANCE *mons_new(TALLOC_CTX *mem_ctx); -int mons_get_listener(MONS_INSTANCE *mons, MONS_REQ_FUNC *req_handler, MONS_AUTH_FUNC *auth_handler, unsigned int port, - void *cookie, int *fd_out, size_t max_fd); +int mons_get_listener(MONS_INSTANCE *mons, MONS_REQ_FUNC *req_handler, MONS_AUTH_FUNC *auth_handler, const char *hostname, + unsigned int port, void *cookie, int *fd_out, size_t max_fd); int mons_accept(MONS_INSTANCE *mons, int listen); #endif //TRUST_ROUTER_MON_REQ_H diff --git a/include/tid_internal.h b/include/tid_internal.h index b6bd8fc..c5ecdc8 100644 --- a/include/tid_internal.h +++ b/include/tid_internal.h @@ -115,6 +115,7 @@ TID_SRVR_BLK *tid_srvr_blk_add_func(TID_SRVR_BLK *head, TID_SRVR_BLK *new); #define tid_srvr_blk_add(head, new) ((head)=tid_srvr_blk_add_func((head),(new))) void tid_srvr_blk_set_path(TID_SRVR_BLK *block, TID_PATH *path); +TID_RC tid_resp_cpy(TID_RESP *dst, TID_RESP *src); void tid_resp_set_cons(TID_RESP *resp, TR_CONSTRAINT_SET *cons); void tid_resp_set_error_path(TID_RESP *resp, json_t *ep); diff --git a/mon/mons.c b/mon/mons.c index f32c531..d79cbcb 100644 --- a/mon/mons.c +++ b/mon/mons.c @@ -98,13 +98,8 @@ static char *mons_req_cb(TALLOC_CTX *mem_ctx, const char *req_str, void *data) * @param max_fd * @return */ -int mons_get_listener(MONS_INSTANCE *mons, - MONS_REQ_FUNC *req_handler, - MONS_AUTH_FUNC *auth_handler, - unsigned int port, - void *cookie, - int *fd_out, - size_t max_fd) +int mons_get_listener(MONS_INSTANCE *mons, MONS_REQ_FUNC *req_handler, MONS_AUTH_FUNC *auth_handler, const char *hostname, + unsigned int port, void *cookie, int *fd_out, size_t max_fd) { size_t n_fd=0; size_t ii=0; @@ -135,6 +130,7 @@ int mons_get_listener(MONS_INSTANCE *mons, /* store the caller's request handler & cookie */ mons->req_handler = req_handler; mons->auth_handler = auth_handler; + mons->hostname = hostname; mons->cookie = cookie; } diff --git a/tid/tid_resp.c b/tid/tid_resp.c index e75571b..dbbc906 100644 --- a/tid/tid_resp.c +++ b/tid/tid_resp.c @@ -80,6 +80,13 @@ void tid_resp_free(TID_RESP *resp) talloc_free(resp); } +/** + * Allocate a new copy of a TID_RESP + * + * @param mem_ctx + * @param resp + * @return + */ TID_RESP *tid_resp_dup(TALLOC_CTX *mem_ctx, TID_RESP *resp) { TID_RESP *newresp=NULL; @@ -90,19 +97,38 @@ TID_RESP *tid_resp_dup(TALLOC_CTX *mem_ctx, TID_RESP *resp) newresp=tid_resp_new(mem_ctx); if (NULL!=newresp) { - newresp->result=resp->result; - newresp->err_msg=tr_dup_name(resp->err_msg); - newresp->rp_realm=tr_dup_name(resp->rp_realm); - newresp->realm=tr_dup_name(resp->realm); - newresp->comm=tr_dup_name(resp->comm); - newresp->orig_coi=tr_dup_name(resp->orig_coi); - newresp->servers=tid_srvr_blk_dup(newresp, resp->servers); - tid_resp_set_cons(newresp, resp->cons); - tid_resp_set_error_path(newresp, resp->error_path); + tid_resp_cpy(newresp, resp); } return newresp; } +/** + * Copy contents of one TID_RESP to an existing TID_RESP + * + * @param dst + * @param src + * @return TID_SUCCESS on success, error code on error + */ +TID_RC tid_resp_cpy(TID_RESP *dst, TID_RESP *src) +{ + tid_resp_set_result(dst, tid_resp_get_result(src)); + tid_resp_set_err_msg(dst, + tr_dup_name(tid_resp_get_err_msg(src))); + tid_resp_set_rp_realm(dst, + tr_dup_name(tid_resp_get_rp_realm(src))); + tid_resp_set_realm(dst, + tr_dup_name(tid_resp_get_realm(src))); + tid_resp_set_comm(dst, + tr_dup_name(tid_resp_get_comm(src))); + tid_resp_set_cons(dst, src->cons); + tid_resp_set_orig_coi(dst, + tr_dup_name(tid_resp_get_orig_coi(src))); + dst->servers = tid_srvr_blk_dup(dst, src->servers); + tid_resp_set_error_path(dst, src->error_path); + + return TID_SUCCESS; +} + TR_EXPORT int tid_resp_get_result(TID_RESP *resp) { return(resp->result); diff --git a/tid/tids.c b/tid/tids.c index 2ec7dc1..4abc6ca 100644 --- a/tid/tids.c +++ b/tid/tids.c @@ -101,8 +101,8 @@ static int tids_handle_request(TIDS_INSTANCE *tids, TID_REQ *req, TID_RESP *resp (!(req->realm)) || (!(req->comm))) { tr_notice("tids_handle_request(): Not a valid TID Request."); - resp->result = TID_ERROR; - resp->err_msg = tr_new_name("Bad request format"); + tid_resp_set_result(resp, TID_ERROR); + tid_resp_set_err_msg(resp, tr_new_name("Bad request format")); return -1; } @@ -114,14 +114,13 @@ static int tids_handle_request(TIDS_INSTANCE *tids, TID_REQ *req, TID_RESP *resp if (0 > (rc = (*tids->req_handler)(tids, req, resp, tids->cookie))) { /* set-up an error response */ tr_debug("tids_handle_request: req_handler returned error."); - resp->result = TID_ERROR; - if (!resp->err_msg) /* Use msg set by handler, if any */ - resp->err_msg = tr_new_name("Internal processing error"); - } - else { + tid_resp_set_result(resp, TID_ERROR); + if (!tid_resp_get_err_msg(resp)) /* Use msg set by handler, if any */ + tid_resp_set_err_msg(resp, tr_new_name("Internal processing error")); + } else { /* set-up a success response */ tr_debug("tids_handle_request: req_handler returned success."); - resp->result = TID_SUCCESS; + tid_resp_set_result(resp, TID_SUCCESS); resp->err_msg = NULL; /* No error msg on successful return */ } @@ -300,7 +299,7 @@ static char *tids_req_cb(TALLOC_CTX *mem_ctx, const char *req_str, void *data) } /* Convert the completed response into an encoded response */ - resp_str = tids_encode_response(mem_ctx, NULL); + resp_str = tids_encode_response(mem_ctx, resp); /* Finished; free the request and return */ tr_msg_free_decoded(mreq); // this frees req and resp, too diff --git a/tr/tr_mon.c b/tr/tr_mon.c index 01dab41..8138198 100644 --- a/tr/tr_mon.c +++ b/tr/tr_mon.c @@ -158,12 +158,11 @@ int tr_mons_event_init(struct event_base *base, talloc_steal(mons, cookie); /* get a monitoring interface listener */ - mons_ev->n_sock_fd = mons_get_listener(mons, - tr_mons_req_handler, + mons_ev->n_sock_fd = mons_get_listener(mons, tr_mons_req_handler, tr_mons_auth_handler, + cfg_mgr->active->internal->hostname, cfg_mgr->active->internal->monitoring_port, - (void *)cookie, - mons_ev->sock_fd, + (void *) cookie, mons_ev->sock_fd, TR_MAX_SOCKETS); if (mons_ev->n_sock_fd==0) { tr_crit("Error opening monitoring interface socket."); diff --git a/tr/tr_tid.c b/tr/tr_tid.c index 6cd0eb5..89fe994 100644 --- a/tr/tr_tid.c +++ b/tr/tr_tid.c @@ -230,6 +230,18 @@ static TID_RC tr_tids_merge_resps(TID_RESP *r1, TID_RESP *r2) return TID_SUCCESS; } +/** + * Process a TID request + * + * Return value of -1 means to send a TID_ERROR response. Fill in resp->err_msg or it will + * be returned as a generic error. + * + * @param tids + * @param orig_req + * @param resp + * @param cookie_in + * @return + */ static int tr_tids_req_handler(TIDS_INSTANCE *tids, TID_REQ *orig_req, TID_RESP *resp, @@ -280,14 +292,14 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, /* Duplicate the request, so we can modify and forward it */ if (NULL == (fwd_req=tid_dup_req(orig_req))) { tr_debug("tr_tids_req_handler: Unable to duplicate request."); - retval=-1; + retval=-1; /* response will be a generic internal error */ goto cleanup; } talloc_steal(tmp_ctx, fwd_req); if (NULL == (cfg_comm=tr_comm_table_find_comm(cfg_mgr->active->ctable, orig_req->comm))) { tr_notice("tr_tids_req_hander: Request for unknown comm: %s.", orig_req->comm->buf); - tids_send_err_response(tids, orig_req, "Unknown community"); + tid_resp_set_err_msg(resp, tr_new_name("Unknown community")); retval=-1; goto cleanup; } @@ -300,7 +312,7 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, if (!tids->gss_name) { tr_notice("tr_tids_req_handler: No GSS name for incoming request."); - tids_send_err_response(tids, orig_req, "No GSS name for request"); + tid_resp_set_err_msg(resp, tr_new_name("No GSS name for request")); retval=-1; goto cleanup; } @@ -312,7 +324,7 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, target=tr_filter_target_tid_req(tmp_ctx, orig_req); if (target==NULL) { tr_crit("tid_req_handler: Unable to allocate filter target, cannot apply filter!"); - tids_send_err_response(tids, orig_req, "Incoming TID request filter error"); + tid_resp_set_err_msg(resp, tr_new_name("Incoming TID request filter error")); retval=-1; goto cleanup; } @@ -342,7 +354,7 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, * a default action of reject, so we don't have to check why we exited the loop. */ if (oaction != TR_FILTER_ACTION_ACCEPT) { tr_notice("tr_tids_req_handler: Incoming TID request rejected by filter for GSS name", orig_req->rp_realm->buf); - tids_send_err_response(tids, orig_req, "Incoming TID request filter error"); + tid_resp_set_err_msg(resp, tr_new_name("Incoming TID request filter error")); retval = -1; goto cleanup; } @@ -350,7 +362,7 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, /* Check that the rp_realm is a member of the community in the request */ if (NULL == tr_comm_find_rp(cfg_mgr->active->ctable, cfg_comm, orig_req->rp_realm)) { tr_notice("tr_tids_req_handler: RP Realm (%s) not member of community (%s).", orig_req->rp_realm->buf, orig_req->comm->buf); - tids_send_err_response(tids, orig_req, "RP COI membership error"); + tid_resp_set_err_msg(resp, tr_new_name("RP COI membership error")); retval=-1; goto cleanup; } @@ -360,7 +372,7 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, if (orig_req->orig_coi!=NULL) { tr_notice("tr_tids_req_handler: community %s is COI but COI to APC mapping already occurred. Dropping request.", orig_req->comm->buf); - tids_send_err_response(tids, orig_req, "Second COI to APC mapping would result, permitted only once."); + tid_resp_set_err_msg(resp, tr_new_name("Second COI to APC mapping would result, permitted only once.")); retval=-1; goto cleanup; } @@ -369,7 +381,7 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, /* TBD -- In theory there can be more than one? How would that work? */ if ((!cfg_comm->apcs) || (!cfg_comm->apcs->id)) { tr_notice("No valid APC for COI %s.", orig_req->comm->buf); - tids_send_err_response(tids, orig_req, "No valid APC for community"); + tid_resp_set_err_msg(resp, tr_new_name("No valid APC for community")); retval=-1; goto cleanup; } @@ -378,7 +390,7 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, /* Check that the APC is configured */ if (NULL == (cfg_apc = tr_comm_table_find_comm(cfg_mgr->active->ctable, apc))) { tr_notice("tr_tids_req_hander: Request for unknown comm: %s.", apc->buf); - tids_send_err_response(tids, orig_req, "Unknown APC"); + tid_resp_set_err_msg(resp, tr_new_name("Unknown APC")); retval=-1; goto cleanup; } @@ -389,7 +401,7 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, /* Check that rp_realm is a member of this APC */ if (NULL == (tr_comm_find_rp(cfg_mgr->active->ctable, cfg_apc, orig_req->rp_realm))) { tr_notice("tr_tids_req_hander: RP Realm (%s) not member of community (%s).", orig_req->rp_realm->buf, orig_req->comm->buf); - tids_send_err_response(tids, orig_req, "RP APC membership error"); + tid_resp_set_err_msg(resp, tr_new_name("RP APC membership error")); retval=-1; goto cleanup; } @@ -404,7 +416,7 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, if (NULL == (aaa_servers = tr_default_server_lookup(cfg_mgr->active->default_servers, orig_req->comm))) { tr_notice("tr_tids_req_handler: No default AAA servers, discarded."); - tids_send_err_response(tids, orig_req, "No path to AAA Server(s) for realm"); + tid_resp_set_err_msg(resp, tr_new_name("No path to AAA Server(s) for realm")); retval = -1; goto cleanup; } @@ -427,13 +439,13 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, /* Since we aren't defaulting, check idp coi and apc membership */ if (NULL == (tr_comm_find_idp(cfg_mgr->active->ctable, cfg_comm, fwd_req->realm))) { tr_notice("tr_tids_req_handler: IDP Realm (%s) not member of community (%s).", orig_req->realm->buf, orig_req->comm->buf); - tids_send_err_response(tids, orig_req, "IDP community membership error"); + tid_resp_set_err_msg(resp, tr_new_name("IDP community membership error")); retval=-1; goto cleanup; } if ( cfg_apc && (NULL == (tr_comm_find_idp(cfg_mgr->active->ctable, cfg_apc, fwd_req->realm)))) { tr_notice("tr_tids_req_handler: IDP Realm (%s) not member of APC (%s).", orig_req->realm->buf, orig_req->comm->buf); - tids_send_err_response(tids, orig_req, "IDP APC membership error"); + tid_resp_set_err_msg(resp, tr_new_name("IDP APC membership error")); retval=-1; goto cleanup; } @@ -443,7 +455,7 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, if (NULL == aaa_servers) { tr_notice("tr_tids_req_handler: no route or AAA server for realm (%s) in community (%s).", orig_req->realm->buf, orig_req->comm->buf); - tids_send_err_response(tids, orig_req, "Missing trust route error"); + tid_resp_set_err_msg(resp, tr_new_name("Missing trust route error")); retval = -1; goto cleanup; } @@ -608,13 +620,19 @@ static int tr_tids_req_handler(TIDS_INSTANCE *tids, } if (n_responses==0) { - /* No requests succeeded. Forward an error if we got any error responses. */ + /* No requests succeeded, so this will be an error */ + retval = -1; + + /* If we got any error responses, send an arbitrarily chosen one. */ for (ii=0; iicfgwatch->settling_time.tv_sec=new_cfg->internal->cfg_settling_time; tr->cfgwatch->settling_time.tv_usec=0; + /* These need to be updated */ + tr->tids->hostname = new_cfg->internal->hostname; + tr->mons->hostname = new_cfg->internal->hostname; + trps_set_connect_interval(trps, new_cfg->internal->trp_connect_interval); trps_set_update_interval(trps, new_cfg->internal->trp_update_interval); trps_set_sweep_interval(trps, new_cfg->internal->trp_sweep_interval); -- 2.1.4