From 0a5695e906f1a1c74e86d1445bed3239317150e0 Mon Sep 17 00:00:00 2001 From: evoskuil Date: Sun, 5 Jun 2016 03:31:19 -0700 Subject: [PATCH 1/4] Comments. --- include/bitcoin/protocol/zmq/authenticator.hpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/include/bitcoin/protocol/zmq/authenticator.hpp b/include/bitcoin/protocol/zmq/authenticator.hpp index e5cbf905..0b5acbd9 100644 --- a/include/bitcoin/protocol/zmq/authenticator.hpp +++ b/include/bitcoin/protocol/zmq/authenticator.hpp @@ -62,9 +62,10 @@ class BCP_API authenticator /// Stop the router (optional). virtual bool stop(); - // This must be called on the socket thread. + /// This must be called on the socket thread. /// Apply authentication to the socket for the given arbitrary domain. - /// Set secure false to enable null security, otherwise curve is required. + /// Set secure false to enable NULL mechanism, otherwise curve is required. + /// By not applying this method authentication is bypassed altogether. virtual bool apply(socket& socket, const std::string& domain, bool secure); /// Set the server private key (required for curve security). From 7ef0219087ed7629f9da11cc87f4f8f1b3ac9e18 Mon Sep 17 00:00:00 2001 From: evoskuil Date: Sun, 5 Jun 2016 03:32:08 -0700 Subject: [PATCH 2/4] Add constructor override for pre-applied authenticated socket. --- include/bitcoin/protocol/zmq/socket.hpp | 8 +++++++- src/zmq/socket.cpp | 8 ++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/include/bitcoin/protocol/zmq/socket.hpp b/include/bitcoin/protocol/zmq/socket.hpp index baee37e4..713afc65 100644 --- a/include/bitcoin/protocol/zmq/socket.hpp +++ b/include/bitcoin/protocol/zmq/socket.hpp @@ -33,6 +33,7 @@ namespace protocol { namespace zmq { class message; +class authenticator; /// This class is thread safe except as noted. /// Because the socket is only set on construct, sockets are not restartable. @@ -60,10 +61,15 @@ class BCP_API socket /// A shared socket pointer. typedef std::shared_ptr ptr; - /// Construct a socket. + /// Construct a socket from an existing zeromq socket. socket(void* zmq_socket); + + /// Construct a socket of the given context and role. socket(context& context, role socket_role); + /// Construct a socket of the given context, role and CURVE authentication. + socket(authenticator& context, role socket_role, std::string domain); + /// This class is not copyable. socket(const socket&) = delete; void operator=(const socket&) = delete; diff --git a/src/zmq/socket.cpp b/src/zmq/socket.cpp index 9a04c6ce..05bd3581 100644 --- a/src/zmq/socket.cpp +++ b/src/zmq/socket.cpp @@ -23,6 +23,7 @@ #include #include #include +#include #include #include #include @@ -83,6 +84,13 @@ socket::socket(context& context, role socket_role) { } +socket::socket(authenticator& context, role socket_role, std::string domain) + : socket(context, socket_role) +{ + if (!context.apply(*this, domain, true)) + stop(); +} + socket::~socket() { stop(); From 9d60fa637f54641893c9ee69cbcf048894335603 Mon Sep 17 00:00:00 2001 From: evoskuil Date: Sun, 5 Jun 2016 20:05:33 -0700 Subject: [PATCH 3/4] Remove socket auth constructor. --- include/bitcoin/protocol/zmq/socket.hpp | 3 --- src/zmq/socket.cpp | 7 ------- 2 files changed, 10 deletions(-) diff --git a/include/bitcoin/protocol/zmq/socket.hpp b/include/bitcoin/protocol/zmq/socket.hpp index 713afc65..d33ab787 100644 --- a/include/bitcoin/protocol/zmq/socket.hpp +++ b/include/bitcoin/protocol/zmq/socket.hpp @@ -67,9 +67,6 @@ class BCP_API socket /// Construct a socket of the given context and role. socket(context& context, role socket_role); - /// Construct a socket of the given context, role and CURVE authentication. - socket(authenticator& context, role socket_role, std::string domain); - /// This class is not copyable. socket(const socket&) = delete; void operator=(const socket&) = delete; diff --git a/src/zmq/socket.cpp b/src/zmq/socket.cpp index 05bd3581..489b7ea7 100644 --- a/src/zmq/socket.cpp +++ b/src/zmq/socket.cpp @@ -84,13 +84,6 @@ socket::socket(context& context, role socket_role) { } -socket::socket(authenticator& context, role socket_role, std::string domain) - : socket(context, socket_role) -{ - if (!context.apply(*this, domain, true)) - stop(); -} - socket::~socket() { stop(); From c4199f5abcac5d6bbefa71ed3ef1665f9d064cd3 Mon Sep 17 00:00:00 2001 From: evoskuil Date: Sun, 5 Jun 2016 20:06:36 -0700 Subject: [PATCH 4/4] Revise auth apply using ip address config and optimize out as applicable. --- .../bitcoin/protocol/zmq/authenticator.hpp | 4 ++-- src/zmq/authenticator.cpp | 23 ++++++++++++------- 2 files changed, 17 insertions(+), 10 deletions(-) diff --git a/include/bitcoin/protocol/zmq/authenticator.hpp b/include/bitcoin/protocol/zmq/authenticator.hpp index 0b5acbd9..45dba260 100644 --- a/include/bitcoin/protocol/zmq/authenticator.hpp +++ b/include/bitcoin/protocol/zmq/authenticator.hpp @@ -62,10 +62,10 @@ class BCP_API authenticator /// Stop the router (optional). virtual bool stop(); - /// This must be called on the socket thread. - /// Apply authentication to the socket for the given arbitrary domain. + /// This must be called on the socket thread, empty domain allowed. /// Set secure false to enable NULL mechanism, otherwise curve is required. /// By not applying this method authentication is bypassed altogether. + /// Apply authentication to the socket for the given arbitrary domain. virtual bool apply(socket& socket, const std::string& domain, bool secure); /// Set the server private key (required for curve security). diff --git a/src/zmq/authenticator.cpp b/src/zmq/authenticator.cpp index 9a1af4ef..e2a4fca8 100644 --- a/src/zmq/authenticator.cpp +++ b/src/zmq/authenticator.cpp @@ -229,18 +229,17 @@ void authenticator::work() } // This must be called on the socket thread. +// Addresses and client keys may be updated after this is applied. +// The configuration at the time of this call determines the mode of security. bool authenticator::apply(socket& socket, const std::string& domain, bool secure) { - // ZAP authentication will not occur with an empty domain. - if (domain.empty() || !socket.set_authentication_domain(domain)) - return false; - /////////////////////////////////////////////////////////////////////////// // Critical Section mutex_.lock_shared(); const auto private_key = private_key_; const auto have_public_keys = !keys_.empty(); + const auto require_address = require_address_; mutex_.unlock_shared(); /////////////////////////////////////////////////////////////////////////// @@ -250,15 +249,23 @@ bool authenticator::apply(socket& socket, const std::string& domain, if (!secure) { - // This persists after a socket closes so don't reuse domain names. - weak_domains_.emplace(domain); + if (require_address) + { + // These persist after a socket closes so don't reuse domain names. + weak_domains_.emplace(domain); + return socket.set_authentication_domain(domain); + } + + // There are no address or curve rules to apply so bypass ZAP. return true; } if (private_key) { - return socket.set_private_key(private_key) && - socket.set_curve_server(); + return + socket.set_private_key(private_key) && + socket.set_curve_server() && + socket.set_authentication_domain(domain); } // We do not have a private key to set so we cannot set secure.