QPID-2412: Support for EXTERNAL mechanism on client-authenticated SSL connections.

On SSL connection where the clients certificate is authenticated (requires the --ssl-require-client-authentication option at present), the clients identity will be taken from that certificate (it will be the CN with any DCs present appended as the domain, e.g. CN=bob,DC=acme,DC=com would result in an identity of bob@acme.com). This will enable the EXTERNAL mechanism when cyrus sasl is in use.

The client can still negotiate their desired mechanism. There is a new option on the ssl module (--ssl-sasl-no-dict) that allows the options on ssl connections to be restricted to those that are not vulnerable to dictionary attacks (EXTERNAL being the primary example).



git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk/qpid@919487 13f79535-47bb-0310-9956-ffa450edef68

5 files changed, 39 insertions, 28 deletions

diff --git a/cpp/src/qpid/cluster/Cluster.cpp b/cpp/src/qpid/cluster/Cluster.cpp
index 460f974b36..9da183a14d 100644
--- a/cpp/src/qpid/cluster/Cluster.cpp
+++ b/cpp/src/qpid/cluster/Cluster.cpp
@@ -510,8 +510,13 @@ ConnectionPtr Cluster::getConnection(const EventFrame& e, Lock&) {
             assert(cp);
         }
         else {              // New remote connection, create a shadow.
-            unsigned int ssf = (announce && announce->hasSsf()) ? announce->getSsf() : 0;
-            cp = new Connection(*this, shadowOut, announce->getManagementId(), id, ssf);
+            qpid::sys::SecuritySettings secSettings;
+            if (announce) {
+                secSettings.ssf = announce->getSsf();
+                secSettings.authid = announce->getAuthid();
+                secSettings.nodict = announce->getNodict();
+            }
+            cp = new Connection(*this, shadowOut, announce->getManagementId(), id, secSettings);
         }
         connections.insert(ConnectionMap::value_type(id, cp));
     }
diff --git a/cpp/src/qpid/cluster/Connection.cpp b/cpp/src/qpid/cluster/Connection.cpp
index 909ff68d92..6385729a09 100644
--- a/cpp/src/qpid/cluster/Connection.cpp
+++ b/cpp/src/qpid/cluster/Connection.cpp
@@ -77,9 +77,9 @@ const std::string shadowPrefix("[shadow]");
 // Shadow connection
 Connection::Connection(Cluster& c, sys::ConnectionOutputHandler& out,
                        const std::string& mgmtId,
-                       const ConnectionId& id, unsigned int ssf)
+                       const ConnectionId& id, const qpid::sys::SecuritySettings& external)
     : cluster(c), self(id), catchUp(false), output(*this, out),
-      connectionCtor(&output, cluster.getBroker(), mgmtId, ssf, false, 0, true),
+      connectionCtor(&output, cluster.getBroker(), mgmtId, external, false, 0, true),
       expectProtocolHeader(false),
       mcastFrameHandler(cluster.getMulticast(), self),
       updateIn(c.getUpdateReceiver())
@@ -88,11 +88,11 @@ Connection::Connection(Cluster& c, sys::ConnectionOutputHandler& out,
 // Local connection
 Connection::Connection(Cluster& c, sys::ConnectionOutputHandler& out,
                        const std::string& mgmtId, MemberId member,
-                       bool isCatchUp, bool isLink, unsigned int ssf
+                       bool isCatchUp, bool isLink, const qpid::sys::SecuritySettings& external
 ) : cluster(c), self(member, ++idCounter), catchUp(isCatchUp), output(*this, out),
     connectionCtor(&output, cluster.getBroker(),
                    mgmtId,
-                   ssf,
+                   external,
                    isLink,
                    isCatchUp ? ++catchUpId : 0,
                    isCatchUp),  // isCatchUp => shadow
@@ -107,7 +107,10 @@ Connection::Connection(Cluster& c, sys::ConnectionOutputHandler& out,
         QPID_LOG(info, "new client connection " << *this);
         giveReadCredit(cluster.getSettings().readMax);
         cluster.getMulticast().mcastControl(
-            ClusterConnectionAnnounceBody(ProtocolVersion(), mgmtId, getSsf()), getId());
+            ClusterConnectionAnnounceBody(ProtocolVersion(), mgmtId,
+                                          connectionCtor.external.ssf,
+                                          connectionCtor.external.authid,
+                                          connectionCtor.external.nodict), getId());
     }
     else {
         // Catch-up shadow connections initialized using nextShadow id.
@@ -122,7 +125,7 @@ Connection::Connection(Cluster& c, sys::ConnectionOutputHandler& out,
 void Connection::init() {
     connection = connectionCtor.construct();
     QPID_LOG(debug, cluster << " initialized connection: " << *this
-             << " ssf=" << connection->getSSF());
+             << " ssf=" << connection->getExternalSecuritySettings().ssf);
     if (isLocalClient()) {  
         // Actively send cluster-order frames from local node
         connection->setClusterOrderOutput(mcastFrameHandler);
@@ -142,9 +145,11 @@ void Connection::giveReadCredit(int credit) {
         output.giveReadCredit(credit);
 }
 
-void Connection::announce(const std::string& mgmtId, uint32_t ssf) {
+void Connection::announce(const std::string& mgmtId, uint32_t ssf, const std::string& authid, bool nodict) {
     QPID_ASSERT(mgmtId == connectionCtor.mgmtId);
-    QPID_ASSERT(ssf == connectionCtor.ssf);
+    QPID_ASSERT(ssf == connectionCtor.external.ssf);
+    QPID_ASSERT(authid == connectionCtor.external.authid);
+    QPID_ASSERT(nodict == connectionCtor.external.nodict);
     init();
 }
 
diff --git a/cpp/src/qpid/cluster/Connection.h b/cpp/src/qpid/cluster/Connection.h
index 85fad72948..2f72783418 100644
--- a/cpp/src/qpid/cluster/Connection.h
+++ b/cpp/src/qpid/cluster/Connection.h
@@ -34,6 +34,7 @@
 #include "qpid/sys/AtomicValue.h"
 #include "qpid/sys/ConnectionInputHandler.h"
 #include "qpid/sys/ConnectionOutputHandler.h"
+#include "qpid/sys/SecuritySettings.h"
 #include "qpid/framing/SequenceNumber.h"
 #include "qpid/framing/FrameDecoder.h"
 
@@ -66,10 +67,10 @@ class Connection :
     
     /** Local connection. */
     Connection(Cluster&, sys::ConnectionOutputHandler& out, const std::string& mgmtId, MemberId, bool catchUp, bool isLink,
-               unsigned int ssf);
+               const qpid::sys::SecuritySettings& external);
     /** Shadow connection. */
     Connection(Cluster&, sys::ConnectionOutputHandler& out, const std::string& mgmtId, const ConnectionId& id,
-               unsigned int ssf);
+               const qpid::sys::SecuritySettings& external);
     ~Connection();
     
     ConnectionId getId() const { return self; }
@@ -163,7 +164,7 @@ class Connection :
     void exchange(const std::string& encoded);
 
     void giveReadCredit(int credit);
-    void announce(const std::string& mgmtId, uint32_t ssf);
+    void announce(const std::string& mgmtId, uint32_t ssf, const std::string& authid, bool nodict);
     void abort();
     void deliverClose();
 
@@ -174,7 +175,7 @@ class Connection :
     void managementAgents(const std::string& data);
     void managementSetupState(uint64_t objectNum, uint16_t bootSequence);
 
-    uint32_t getSsf() const { return connectionCtor.ssf; }
+    //uint32_t getSsf() const { return connectionCtor.external.ssf; }
 
   private:
     struct NullFrameHandler : public framing::FrameHandler {
@@ -186,7 +187,7 @@ class Connection :
         sys::ConnectionOutputHandler* out;
         broker::Broker& broker;
         std::string mgmtId;
-        unsigned int ssf;
+        qpid::sys::SecuritySettings external;
         bool isLink;
         uint64_t objectId;
         bool shadow;
@@ -195,17 +196,17 @@ class Connection :
             sys::ConnectionOutputHandler* out_,
             broker::Broker& broker_,
             const std::string& mgmtId_,
-            unsigned int ssf_,
+            const qpid::sys::SecuritySettings& external_,
             bool isLink_=false,
             uint64_t objectId_=0,
             bool shadow_=false
-        ) : out(out_), broker(broker_), mgmtId(mgmtId_), ssf(ssf_),
+        ) : out(out_), broker(broker_), mgmtId(mgmtId_), external(external_),
             isLink(isLink_), objectId(objectId_), shadow(shadow_)
         {}
 
         std::auto_ptr<broker::Connection> construct() {
             return std::auto_ptr<broker::Connection>(
-                new broker::Connection(out, broker, mgmtId, ssf, isLink, objectId, shadow));
+                new broker::Connection(out, broker, mgmtId, external, isLink, objectId, shadow));
         }
     };
 
diff --git a/cpp/src/qpid/cluster/ConnectionCodec.cpp b/cpp/src/qpid/cluster/ConnectionCodec.cpp
index 8f6f1d9ad5..931cda4893 100644
--- a/cpp/src/qpid/cluster/ConnectionCodec.cpp
+++ b/cpp/src/qpid/cluster/ConnectionCodec.cpp
@@ -37,26 +37,26 @@ using namespace framing;
 
 sys::ConnectionCodec*
 ConnectionCodec::Factory::create(ProtocolVersion v, sys::OutputControl& out, const std::string& id,
-                                 unsigned int ssf) {
+                                 const qpid::sys::SecuritySettings& external) {
     if (v == ProtocolVersion(0, 10))
-        return new ConnectionCodec(v, out, id, cluster, false, false, ssf);
+        return new ConnectionCodec(v, out, id, cluster, false, false, external);
     else if (v == ProtocolVersion(0x80 + 0, 0x80 + 10)) // Catch-up connection
-        return new ConnectionCodec(v, out, id, cluster, true, false, ssf); 
+        return new ConnectionCodec(v, out, id, cluster, true, false, external); 
     return 0;
 }
 
 // Used for outgoing Link connections
 sys::ConnectionCodec*
 ConnectionCodec::Factory::create(sys::OutputControl& out, const std::string& logId,
-                                 unsigned int ssf) {
-    return new ConnectionCodec(ProtocolVersion(0,10), out, logId, cluster, false, true, ssf);
+                                 const qpid::sys::SecuritySettings& external) {
+    return new ConnectionCodec(ProtocolVersion(0,10), out, logId, cluster, false, true, external);
 }
 
 ConnectionCodec::ConnectionCodec(
     const ProtocolVersion& v, sys::OutputControl& out,
-    const std::string& logId, Cluster& cluster, bool catchUp, bool isLink, unsigned int ssf
+    const std::string& logId, Cluster& cluster, bool catchUp, bool isLink, const qpid::sys::SecuritySettings& external
 ) : codec(out, logId, isLink),
-    interceptor(new Connection(cluster, codec, logId, cluster.getId(), catchUp, isLink, ssf))
+    interceptor(new Connection(cluster, codec, logId, cluster.getId(), catchUp, isLink, external))
 {
     std::auto_ptr<sys::ConnectionInputHandler> ih(new ProxyInputHandler(interceptor));
     codec.setInputHandler(ih);
diff --git a/cpp/src/qpid/cluster/ConnectionCodec.h b/cpp/src/qpid/cluster/ConnectionCodec.h
index 74cb3c507d..4b919ed351 100644
--- a/cpp/src/qpid/cluster/ConnectionCodec.h
+++ b/cpp/src/qpid/cluster/ConnectionCodec.h
@@ -53,14 +53,14 @@ class ConnectionCodec : public sys::ConnectionCodec {
         Factory(boost::shared_ptr<sys::ConnectionCodec::Factory> f, Cluster& c)
             : next(f), cluster(c) {}
         sys::ConnectionCodec* create(framing::ProtocolVersion, sys::OutputControl&, const std::string& id,
-                                     unsigned int conn_ssf);
+                                     const qpid::sys::SecuritySettings& external);
         sys::ConnectionCodec* create(sys::OutputControl&, const std::string& id,
-                                     unsigned int conn_ssf);
+                                     const qpid::sys::SecuritySettings& external);
     };
 
     ConnectionCodec(const framing::ProtocolVersion&, sys::OutputControl& out,
                     const std::string& logId, Cluster& c, bool catchUp, bool isLink,
-                    unsigned int ssf);
+                    const qpid::sys::SecuritySettings& external);
     ~ConnectionCodec();
 
     // ConnectionCodec functions.