diff options
| author | Kenneth Anthony Giusti <kgiusti@apache.org> | 2010-01-28 23:01:12 +0000 |
|---|---|---|
| committer | Kenneth Anthony Giusti <kgiusti@apache.org> | 2010-01-28 23:01:12 +0000 |
| commit | 2d5dc11e2f401852980cf3c5627926312b038767 (patch) | |
| tree | daaaf6e461864d3c0a3fd88c9721fa4c6623725f /cpp/src | |
| parent | 9ba42cc7b5b593a94d879894d0d13276d56490aa (diff) | |
| download | qpid-python-2d5dc11e2f401852980cf3c5627926312b038767.tar.gz | |
QPID-2374: Null authenticator now checks for SSL if --encryption-required specified
git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk/qpid@904293 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'cpp/src')
| -rw-r--r-- | cpp/src/qpid/broker/SaslAuthenticator.cpp | 9 | ||||
| -rwxr-xr-x | cpp/src/tests/ssl_test | 2 |
2 files changed, 8 insertions, 3 deletions
diff --git a/cpp/src/qpid/broker/SaslAuthenticator.cpp b/cpp/src/qpid/broker/SaslAuthenticator.cpp index 0e509c8d93..4769789bff 100644 --- a/cpp/src/qpid/broker/SaslAuthenticator.cpp +++ b/cpp/src/qpid/broker/SaslAuthenticator.cpp @@ -148,8 +148,13 @@ void NullAuthenticator::getMechanisms(Array& mechanisms) void NullAuthenticator::start(const string& mechanism, const string& response) { if (encrypt) { - QPID_LOG(error, "Rejected un-encrypted connection."); - throw ConnectionForcedException("Connection must be encrypted."); + // encryption required - check to see if we are running over an + // encrypted SSL connection. + sasl_ssf_t external_ssf = (sasl_ssf_t) connection.getSSF(); + if (external_ssf < 1) { // < 1 == unencrypted + QPID_LOG(error, "Rejected un-encrypted connection."); + throw ConnectionForcedException("Connection must be encrypted."); + } } if (mechanism == "PLAIN") { // Old behavior if (response.size() > 0) { diff --git a/cpp/src/tests/ssl_test b/cpp/src/tests/ssl_test index 528833076e..36b332f868 100755 --- a/cpp/src/tests/ssl_test +++ b/cpp/src/tests/ssl_test @@ -46,7 +46,7 @@ delete_certs() { } start_broker() { - PORT=`../qpidd --daemon --transport ssl --port 0 --ssl-port 0 --no-data-dir --no-module-dir --auth no --config $CONFIG --load-module $SSL_LIB --ssl-cert-db $CERT_DIR --ssl-cert-password-file $CERT_PW_FILE --ssl-cert-name $TEST_HOSTNAME` + PORT=`../qpidd --daemon --transport ssl --port 0 --ssl-port 0 --no-data-dir --no-module-dir --auth no --config $CONFIG --load-module $SSL_LIB --ssl-cert-db $CERT_DIR --ssl-cert-password-file $CERT_PW_FILE --ssl-cert-name $TEST_HOSTNAME --require-encryption` } stop_broker() { |