diff --git a/opal/mca/sec/munge/Makefile.am b/opal/mca/sec/munge/Makefile.am new file mode 100644 index 0000000000..77ee898395 --- /dev/null +++ b/opal/mca/sec/munge/Makefile.am @@ -0,0 +1,38 @@ +# +# Copyright (c) 2015 Intel, Inc. All rights reserved. +# $COPYRIGHT$ +# +# Additional copyrights may follow +# +# $HEADER$ +# + +sources = \ + sec_munge.h \ + sec_munge_component.c \ + sec_munge.c + +# Make the output library in this directory, and name it either +# mca__.la (for DSO builds) or libmca__.la +# (for static builds). + +if MCA_BUILD_opal_sec_munge_DSO +component_noinst = +component_install = mca_sec_munge.la +else +component_noinst = libmca_sec_munge.la +component_install = +endif + +mcacomponentdir = $(opallibdir) +mcacomponent_LTLIBRARIES = $(component_install) +mca_sec_munge_la_SOURCES = $(sources) +mca_sec_munge_la_CPPFLAGS = $(sec_munge_CPPFLAGS) +mca_sec_munge_la_LDFLAGS = -module -avoid-version $(sec_munge_LDFLAGS) +mca_sec_munge_la_LIBADD = $(sec_munge_LIBS) + +noinst_LTLIBRARIES = $(component_noinst) +libmca_sec_munge_la_SOURCES =$(sources) +libmca_sec_munge_la_CPPFLAGS = $(sec_munge_CPPFLAGS) +libmca_sec_munge_la_LDFLAGS = -module -avoid-version $(sec_munge_LDFLAGS) +libmca_sec_munge_la_LIBADD = $(sec_munge_LIBS) diff --git a/opal/mca/sec/munge/configure.m4 b/opal/mca/sec/munge/configure.m4 new file mode 100644 index 0000000000..ce7057aa54 --- /dev/null +++ b/opal/mca/sec/munge/configure.m4 @@ -0,0 +1,86 @@ +# -*- shell-script -*- +# +# Copyright (c) 2015 Intel, Inc. All rights reserved +# $COPYRIGHT$ +# +# Additional copyrights may follow +# +# $HEADER$ +# + +# MCA_sec_munge_CONFIG([action-if-found], [action-if-not-found]) +# -------------------------------------------------------------------- +AC_DEFUN([MCA_opal_sec_munge_CONFIG],[ + AC_CONFIG_FILES([opal/mca/sec/munge/Makefile]) + + OPAL_VAR_SCOPE_PUSH([sec_munge_support sec_munge_dir sec_munge_libdir save_cpp save_ld]) + + AC_ARG_WITH([munge], + [AC_HELP_STRING([--with-munge=DIR], + [Search for munge headers and libraries in DIR ])]) + + AC_ARG_WITH([munge-libdir], + [AC_HELP_STRING([--with-munge-libdir=DIR], + [Search for munge libraries in DIR ])]) + + sec_munge_support=0 + if test "$with_munge" != "no"; then + AC_MSG_CHECKING([for munge in]) + if test ! -z "$with_munge" -a "$with_munge" != "yes"; then + if test -d $with_munge/include/munge; then + sec_munge_dir=$with_munge/include/munge + else + sec_munge_dir=$with_munge + fi + if test -d $with_munge/lib; then + sec_munge_libdir=$with_munge/lib + elif -d $with_munge/lib64; then + sec_munge_libdir=$with_munge/lib64 + else + AC_MSG_RESULT([Could not find $with_munge/lib or $with_munge/lib64]) + AC_MSG_ERROR([Can not continue]) + fi + AC_MSG_RESULT([$sec_munge_dir and $sec_munge_libdir]) + else + AC_MSG_RESULT([(default search paths)]) + sec_munge_dir= + fi + AS_IF([test ! -z "$with_munge_libdir" && test "$with_munge_libdir" != "yes"], + [sec_munge_libdir="$with_munge_libdir"]) + + save_cpp=$CPPFLAGS + save_ld=$LDFLAGS + + OPAL_CHECK_PACKAGE([sec_munge], + [munge.h], + [munge], + [munge_encode], + [-lmunge], + [$sec_munge_dir], + [$sec_munge_libdir], + [sec_munge_support=1], + [sec_munge_support=0]) + + CPPFLAGS=$save_cpp + LDFLAGS=$save_ld + fi + + if test ! -z "$with_munge" && test "$with_munge" != "no" && test "$sec_munge_support" != "1"; then + AC_MSG_WARN([MUNGE SUPPORT REQUESTED AND NOT FOUND.]) + AC_MSG_ERROR([CANNOT CONTINUE]) + fi + + AC_MSG_CHECKING([will munge support be built]) + AS_IF([test "$sec_munge_support" != "1"], + [AC_MSG_RESULT([no]) + $2], + [AC_MSG_RESULT([yes]) + $1]) + + # set build flags to use in makefile + AC_SUBST([sec_munge_CPPFLAGS]) + AC_SUBST([sec_munge_LDFLAGS]) + AC_SUBST([sec_munge_LIBS]) + + OPAL_VAR_SCOPE_POP +])dnl diff --git a/opal/mca/sec/munge/sec_munge.c b/opal/mca/sec/munge/sec_munge.c new file mode 100644 index 0000000000..d54269f160 --- /dev/null +++ b/opal/mca/sec/munge/sec_munge.c @@ -0,0 +1,107 @@ +/* + * Copyright (c) 2015 Intel, Inc. All rights reserved. + * $COPYRIGHT$ + * + * Additional copyrights may follow + * + * $HEADER$ + * + */ + +#include "opal_config.h" +#include "opal/constants.h" + +#ifdef HAVE_STRING_H +#include +#endif +#include + +#include "opal_stdint.h" +#include "opal/dss/dss_types.h" +#include "opal/util/error.h" +#include "opal/util/output.h" +#include "opal/util/show_help.h" +#include "opal/mca/dstore/dstore.h" + +#include "opal/mca/sec/base/base.h" +#include "sec_munge.h" + +static int init(void); +static void finalize(void); +static int get_my_cred(int dstorehandle, + opal_process_name_t *my_id, + opal_sec_cred_t **cred); +static int authenticate(opal_sec_cred_t *cred); + +opal_sec_base_module_t opal_sec_munge_module = { + init, + finalize, + get_my_cred, + authenticate +}; + +static opal_sec_cred_t my_cred; +static bool initialized = false; + +static int init(void) +{ + int rc; + + opal_output_verbose(2, opal_sec_base_framework.framework_output, + "sec: munge init"); + + /* attempt to get a credential as a way of checking that + * the munge server is available - cache the credential + * for later use */ + + if (EMUNGE_SUCCESS != (rc = munge_encode(&my_cred.credential, NULL, NULL, 0))) { + opal_output_verbose(2, opal_sec_base_framework.framework_output, + "sec: munge failed to create credential: %s", + munge_strerror(rc)); + return OPAL_ERR_SERVER_NOT_AVAIL; + } + initialized = true; + + return OPAL_SUCCESS; +} + +static void finalize(void) +{ + if (initialized) { + free(my_cred.credential); + } +} + +static int get_my_cred(int dstorehandle, + opal_process_name_t *my_id, + opal_sec_cred_t **cred) +{ + if (initialized) { + *cred = &my_cred; + } else { + *cred = NULL; + } + + return OPAL_SUCCESS; +} + +static int authenticate(opal_sec_cred_t *cred) +{ + munge_err_t rc; + + opal_output_verbose(2, opal_sec_base_framework.framework_output, + "sec: munge validate_cred %s", cred->credential); + + /* parse the inbound string */ + if (EMUNGE_SUCCESS != (rc = munge_decode(cred->credential, NULL, NULL, NULL, NULL, NULL))) { + opal_output_verbose(2, opal_sec_base_framework.framework_output, + "sec: munge failed to decode credential: %s", + munge_strerror(rc)); + return OPAL_ERR_AUTHENTICATION_FAILED; + } + + opal_output_verbose(2, opal_sec_base_framework.framework_output, + "sec: munge credential valid"); + return OPAL_SUCCESS; +} + diff --git a/opal/mca/sec/munge/sec_munge.h b/opal/mca/sec/munge/sec_munge.h new file mode 100644 index 0000000000..6d3e103b9c --- /dev/null +++ b/opal/mca/sec/munge/sec_munge.h @@ -0,0 +1,23 @@ +/* + * Copyright (c) 2015 Intel, Inc. All rights reserved. + * $COPYRIGHT$ + * + * Additional copyrights may follow + * + * $HEADER$ + */ + +#ifndef OPAL_SEC_MUNGE_H +#define OPAL_SEC_MUNGE_H + +#include "opal/mca/sec/sec.h" + +BEGIN_C_DECLS + + +OPAL_MODULE_DECLSPEC extern opal_sec_base_component_t mca_sec_munge_component; +OPAL_DECLSPEC extern opal_sec_base_module_t opal_sec_munge_module; + +END_C_DECLS + +#endif /* OPAL_SEC_MUNGE_H */ diff --git a/opal/mca/sec/munge/sec_munge_component.c b/opal/mca/sec/munge/sec_munge_component.c new file mode 100644 index 0000000000..f29016b2ad --- /dev/null +++ b/opal/mca/sec/munge/sec_munge_component.c @@ -0,0 +1,64 @@ +/* + * Copyright (c) 2015 Intel, Inc. All rights reserved. + * $COPYRIGHT$ + * + * Additional copyrights may follow + * + * $HEADER$ + */ + +#include "opal_config.h" +#include "opal/constants.h" + +#include "opal/mca/base/base.h" + +#include "opal/mca/sec/sec.h" +#include "sec_munge.h" + +static int sec_munge_component_open(void); +static int sec_munge_component_query(mca_base_module_t **module, int *priority); +static int sec_munge_component_close(void); + +/* + * Instantiate the public struct with all of our public information + * and pointers to our public functions in it + */ +opal_sec_base_component_t mca_sec_munge_component = { + { + OPAL_SEC_BASE_VERSION_1_0_0, + + /* Component name and version */ + "munge", + OPAL_MAJOR_VERSION, + OPAL_MINOR_VERSION, + OPAL_RELEASE_VERSION, + + /* Component open and close functions */ + sec_munge_component_open, + sec_munge_component_close, + sec_munge_component_query, + NULL + }, + { + /* The component is checkpoint ready */ + MCA_BASE_METADATA_PARAM_CHECKPOINT + } +}; + +static int sec_munge_component_open(void) +{ + return OPAL_SUCCESS; +} + +static int sec_munge_component_query(mca_base_module_t **module, int *priority) +{ + *priority = 10; + *module = (mca_base_module_t*)&opal_sec_munge_module; + return OPAL_SUCCESS; +} + + +static int sec_munge_component_close(void) +{ + return OPAL_SUCCESS; +}