QPID-2412: Support for EXTERNAL mechanism on client-authenticated SSL connections.

On SSL connection where the clients certificate is authenticated (requires the --ssl-require-client-authentication option at present), the clients identity will be taken from that certificate (it will be the CN with any DCs present appended as the domain, e.g. CN=bob,DC=acme,DC=com would result in an identity of bob@acme.com). This will enable the EXTERNAL mechanism when cyrus sasl is in use.

The client can still negotiate their desired mechanism. There is a new option on the ssl module (--ssl-sasl-no-dict) that allows the options on ssl connections to be restricted to those that are not vulnerable to dictionary attacks (EXTERNAL being the primary example).



git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk/qpid@919487 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 13 insertions, 8 deletions

diff --git a/cpp/src/qpid/cluster/Connection.cpp b/cpp/src/qpid/cluster/Connection.cpp
index 909ff68d92..6385729a09 100644
--- a/cpp/src/qpid/cluster/Connection.cpp
+++ b/cpp/src/qpid/cluster/Connection.cpp
@@ -77,9 +77,9 @@ const std::string shadowPrefix("[shadow]");
 // Shadow connection
 Connection::Connection(Cluster& c, sys::ConnectionOutputHandler& out,
                        const std::string& mgmtId,
-                       const ConnectionId& id, unsigned int ssf)
+                       const ConnectionId& id, const qpid::sys::SecuritySettings& external)
     : cluster(c), self(id), catchUp(false), output(*this, out),
-      connectionCtor(&output, cluster.getBroker(), mgmtId, ssf, false, 0, true),
+      connectionCtor(&output, cluster.getBroker(), mgmtId, external, false, 0, true),
       expectProtocolHeader(false),
       mcastFrameHandler(cluster.getMulticast(), self),
       updateIn(c.getUpdateReceiver())
@@ -88,11 +88,11 @@ Connection::Connection(Cluster& c, sys::ConnectionOutputHandler& out,
 // Local connection
 Connection::Connection(Cluster& c, sys::ConnectionOutputHandler& out,
                        const std::string& mgmtId, MemberId member,
-                       bool isCatchUp, bool isLink, unsigned int ssf
+                       bool isCatchUp, bool isLink, const qpid::sys::SecuritySettings& external
 ) : cluster(c), self(member, ++idCounter), catchUp(isCatchUp), output(*this, out),
     connectionCtor(&output, cluster.getBroker(),
                    mgmtId,
-                   ssf,
+                   external,
                    isLink,
                    isCatchUp ? ++catchUpId : 0,
                    isCatchUp),  // isCatchUp => shadow
@@ -107,7 +107,10 @@ Connection::Connection(Cluster& c, sys::ConnectionOutputHandler& out,
         QPID_LOG(info, "new client connection " << *this);
         giveReadCredit(cluster.getSettings().readMax);
         cluster.getMulticast().mcastControl(
-            ClusterConnectionAnnounceBody(ProtocolVersion(), mgmtId, getSsf()), getId());
+            ClusterConnectionAnnounceBody(ProtocolVersion(), mgmtId,
+                                          connectionCtor.external.ssf,
+                                          connectionCtor.external.authid,
+                                          connectionCtor.external.nodict), getId());
     }
     else {
         // Catch-up shadow connections initialized using nextShadow id.
@@ -122,7 +125,7 @@ Connection::Connection(Cluster& c, sys::ConnectionOutputHandler& out,
 void Connection::init() {
     connection = connectionCtor.construct();
     QPID_LOG(debug, cluster << " initialized connection: " << *this
-             << " ssf=" << connection->getSSF());
+             << " ssf=" << connection->getExternalSecuritySettings().ssf);
     if (isLocalClient()) {  
         // Actively send cluster-order frames from local node
         connection->setClusterOrderOutput(mcastFrameHandler);
@@ -142,9 +145,11 @@ void Connection::giveReadCredit(int credit) {
         output.giveReadCredit(credit);
 }
 
-void Connection::announce(const std::string& mgmtId, uint32_t ssf) {
+void Connection::announce(const std::string& mgmtId, uint32_t ssf, const std::string& authid, bool nodict) {
     QPID_ASSERT(mgmtId == connectionCtor.mgmtId);
-    QPID_ASSERT(ssf == connectionCtor.ssf);
+    QPID_ASSERT(ssf == connectionCtor.external.ssf);
+    QPID_ASSERT(authid == connectionCtor.external.authid);
+    QPID_ASSERT(nodict == connectionCtor.external.nodict);
     init();
 }