From f5e41be93bec9b5556a65292516db07ff845f7d4 Mon Sep 17 00:00:00 2001 From: Gordon Sim Date: Fri, 5 Mar 2010 16:51:22 +0000 Subject: QPID-2412: Support for EXTERNAL mechanism on client-authenticated SSL connections. On SSL connection where the clients certificate is authenticated (requires the --ssl-require-client-authentication option at present), the clients identity will be taken from that certificate (it will be the CN with any DCs present appended as the domain, e.g. CN=bob,DC=acme,DC=com would result in an identity of bob@acme.com). This will enable the EXTERNAL mechanism when cyrus sasl is in use. The client can still negotiate their desired mechanism. There is a new option on the ssl module (--ssl-sasl-no-dict) that allows the options on ssl connections to be restricted to those that are not vulnerable to dictionary attacks (EXTERNAL being the primary example). git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk/qpid@919487 13f79535-47bb-0310-9956-ffa450edef68 --- cpp/src/qpid/cluster/ConnectionCodec.cpp | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'cpp/src/qpid/cluster/ConnectionCodec.cpp') diff --git a/cpp/src/qpid/cluster/ConnectionCodec.cpp b/cpp/src/qpid/cluster/ConnectionCodec.cpp index 8f6f1d9ad5..931cda4893 100644 --- a/cpp/src/qpid/cluster/ConnectionCodec.cpp +++ b/cpp/src/qpid/cluster/ConnectionCodec.cpp @@ -37,26 +37,26 @@ using namespace framing; sys::ConnectionCodec* ConnectionCodec::Factory::create(ProtocolVersion v, sys::OutputControl& out, const std::string& id, - unsigned int ssf) { + const qpid::sys::SecuritySettings& external) { if (v == ProtocolVersion(0, 10)) - return new ConnectionCodec(v, out, id, cluster, false, false, ssf); + return new ConnectionCodec(v, out, id, cluster, false, false, external); else if (v == ProtocolVersion(0x80 + 0, 0x80 + 10)) // Catch-up connection - return new ConnectionCodec(v, out, id, cluster, true, false, ssf); + return new ConnectionCodec(v, out, id, cluster, true, false, external); return 0; } // Used for outgoing Link connections sys::ConnectionCodec* ConnectionCodec::Factory::create(sys::OutputControl& out, const std::string& logId, - unsigned int ssf) { - return new ConnectionCodec(ProtocolVersion(0,10), out, logId, cluster, false, true, ssf); + const qpid::sys::SecuritySettings& external) { + return new ConnectionCodec(ProtocolVersion(0,10), out, logId, cluster, false, true, external); } ConnectionCodec::ConnectionCodec( const ProtocolVersion& v, sys::OutputControl& out, - const std::string& logId, Cluster& cluster, bool catchUp, bool isLink, unsigned int ssf + const std::string& logId, Cluster& cluster, bool catchUp, bool isLink, const qpid::sys::SecuritySettings& external ) : codec(out, logId, isLink), - interceptor(new Connection(cluster, codec, logId, cluster.getId(), catchUp, isLink, ssf)) + interceptor(new Connection(cluster, codec, logId, cluster.getId(), catchUp, isLink, external)) { std::auto_ptr ih(new ProxyInputHandler(interceptor)); codec.setInputHandler(ih); -- cgit v1.2.1