Details
-
Improvement
-
Status: Closed
-
Minor
-
Resolution: Fixed
-
qpid-cpp-0.34
-
Fedora 21 Linux
-
Patch
Description
When using Qpid C++ without SASL or with authentication disabled you can do:
qpid_message.setUserId(qpid_connection_.getAuthenticatedUsername());
and message can be received on remote location.
Without SASL "ANONYMOUS" string is returned.
With SASL but without authentication "anonymous" string is returned.
In both cases message isn't rejected by broker.
With SASL and SLL authentication "dummy" is returned. This string is rejected by broker and also doesn't help with identifying who sent the message.
First patch fixes this by reading local certificate authentication id the same way as SslSocket::getClientAuthId does but for local instead of peer certificate.
Second patch adds getLocalAuthId to all other classes derived from Socket (not certain if this is necessary that's why it's in a separate patch).
Third patch adds virtual keyword to BSDSocket getKeyLen, getClientAuthId and ~BSDSocket() functions since this class is parent class of SslSocket. (Since with C++11 and later compilers final and override keywords can be used to find such errors perhaps two macros should be defined and used throughout the code e.g.:
create file qpid_cpp.hpp
#if __cplusplus <= 199711L
#define QPID_CPP_OVERRIDE
#define QPID_CPP_FINAL
#else
#define QPID_CPP_OVERRIDE override
#define QPID_CPP_FINAL final
#endif
and then used somewhere:
#include "qpid_cpp.hpp"
struct A {
virtual void foo() QPID_CPP_FINAL; // A::foo is final
virtual void bar();
virtual void bas();
};
struct B QPID_CPP_FINAL : A { // struct B is final
void foo(); // Error: foo cannot be overridden as it's final in A
void bar() QPID_CPP_OVERRIDE;
int bas() QPID_CPP_OVERRIDE; // Error: wrong bar signature used
void baf() QPID_CPP_OVERRIDE; // Error: function doesn't override anything
};
struct C : B { // Error: B is final
};
)
Fourth patch adds getPeerAuthId as alias for getClientAuthId since current name is meaningful only on broker side (on client side it returns broker authentication id).
Fifth patch removes getClientAuthId altogether (split into a separate patch as I am not certain if this function can be accessed from outside Qpid internal implementation and should remain as is).
How to test:
Build qpid with SASL and SSL.
Create ssl certificate store.
Run qpid with:
qpidd --ssl-cert-db ${CERT_DB_DIR} --ssl-cert-password-file /tmp/password.txt --ssl-cert-name 127.0.0.1 --ssl-require-client-authentication --acl-file ${ACL_DIR}/acl_file.acl --auth yes
ACL file should contain:
acl allow send@QPID all # sender cert
acl allow receive@QPID all # receiver cert
acl deny all all
On sending client use:
qpid_message.setUserId(qpid_connection_.getAuthenticatedUsername());
On receiving client use:
qpid_message.getUserId();
Message should be delivered and Id's should be the same and matching sender certificate nickname.