Add bindings for CZMQ security primitives #125

phuedx · 2014-05-04T14:11:53Z

Add bindings for CZMQ security primitives

This PR adds bindings for the ZeroMQ security primitives, zcert, and zauth (exposed as ZMQCert and ZMQAuth respectively), which are introduced in @hintjens' Using ZeroMQ Security part 1 and part 2.

I've also converted all but the last of the examples from part 2 to PHP (see grasslands.php, strawhouse.php, woodhouse.php, stonehouse.php, and ironhouse.php in the examples directory).

Breaking changes

None.

Notes

The bindings will only be available if php-zmq is built with CZMQ, which requires libsodium
~~CZMQ's zconfig_save function currently segfaults when the filename isn't writeable. I'm going to send a PR shortly~~ See Fix trying to save zconfig_t to non-existant path czmq#468

mkoppanen · 2014-05-04T22:42:50Z

php_zmq_private.h

@@ -36,6 +36,7 @@
 #include "main/php_ini.h"

 #include <zmq.h>
+#include <czmq.h>


Maybe this should be a conditional dependency?

Absolutely. I wouldn't remove the WIP tag without that being the case. First though, I'm going to focus on the ZMQAuth and ZMQCurve classes.

mkoppanen · 2014-05-04T22:49:20Z

Added some comments!

phuedx · 2014-05-20T14:20:11Z

I'll remove the WIP status when I've documented the ZMQCert and ZMQAuth classes in api.php and answered your question about the return value of zcert_public_txt (and similar functions in CZMQ).

phuedx · 2014-05-28T07:03:12Z

ZMQCert#__construct now throws when zcert_new returns NULL, which is indicative of libsodium not being installed.

phuedx · 2014-06-27T06:57:10Z

git merge authApiExperiment WFM. Where are the merge conflicts? Show 'em to me!

wysman · 2014-06-30T11:35:35Z

Merge conflicts are in zmq.c at the top of the file, near

#ifdef PHP_ZMQ_PTHREADS
#ifdef HAVE_CZMQ_2

Maybe add a empty line can help

phuedx · 2014-06-30T14:03:11Z

Thanks @wysman!

wysman · 2014-07-01T07:32:54Z

Why do you use shadow context in ZMQAuth, and not directly the real context ?

wysman · 2014-07-01T08:28:27Z

I have a issue on PHP 5.3.10
The macro "#define object_properties_init(zo, class_type)" is define after the use of it in :

php_zmq_cert_new
php_zmq_auth_new

It's produce a "undefined symbol: object_properties_init" at execution time.
Move the macro just after #include on the top of file will fix it

wysman · 2014-07-01T08:42:16Z

In the private header,
You test that the major version is upper 2, but the actual version of CZMQ is 2, so ZMQCert & ZMQAuth are not compiled

phuedx · 2014-07-04T20:45:06Z

Thank you for your review @wysman. I think that I've addressed your last two points.

phuedx · 2014-07-04T21:03:36Z

@wysman As for your first point: rather than acting on typeless pointers, which libzmq uses, the zauth API accepts only zctx_t* (see the zctx API). At the time of writing, creating a shadow context with the zctx_shadow_zmq_ctx function was the only method I saw of bridging the APIs.

mkoppanen · 2014-07-15T23:49:24Z

tests/042-cert-save.phpt

+<?php
+
+$cert = new ZMQCert();
+$cert->save('/tmp/cert');


This would not be portable. Can you use DIR instead?

mkoppanen · 2014-08-30T20:46:17Z

zmq.c

+	this = (php_zmq_cert *) zend_object_store_get_object(getThis() TSRMLS_CC);
+	public_key = zcert_public_key(this->zcert);
+
+	RETURN_STRINGL((char *) public_key, 32, 1);


does public_key need to be freed here as well?

zcert_public_key returns a pointer to the associated property of the zcert_t struct. With that in mind, I don't think public_key should be freed (and RETURN_STRINGL(..., 1) is correct). This is also the case for zcert_secret_key, zcert_public_txt, and zcert_secret_txt.

phuedx · 2014-09-29T09:12:34Z

Sorry for the delay in addressing your review @mkoppanen. I think I've covered it all.

mkoppanen · 2014-10-06T09:53:28Z

zmq.c

+		// TODO (phuedx, 2014-05-16): CZMQ now supports GSSAPI (see
+		// zauth_configure_gssapi).
+
+		default:


Unknown auth type should probably throw an exception?

mkoppanen · 2014-10-06T09:54:40Z

Added two comments. Minor changes and after that I am happy to merge! Amazing work

The ZMQCert class wraps the CZMQ zcert API. Instances of the ZMQCert class can: * have their public and private text inspected, either as 32-byte binary strings or Z85 armoured strings * be tested for equality * be cloned * store and retrieve metadata * have their public and private test saved to and loaded from disk be applied to a ZMQSocket

The ZMQAuth class wraps the CZMQ zauth API. Instances of the ZMQAuth class can: * install a ZAP handler for a ZMQContext * whitelist/blacklist IP addresses * use plain or curve authentication for one or more domains

grasslands.php, strawhouse.php, woodhouse.php, stonehouse.php, and ironhouse.php are faithful translations of Pieter Hintjens' examples of the same names, which he originally published as part of his blog post Using ZeroMQ Security (part 2)[0]. [0] http://hintjens.com/blog:49

phuedx · 2014-10-08T12:59:43Z

Thanks @mkoppanen! I also removed a few erroneous errnos – say that three times fast – that were still in the ZMQCert and ZMQAuth code.

mkoppanen · 2014-10-08T13:09:30Z

Waiting for travis to finish and then merging. Looking all green this far!

mkoppanen · 2014-10-08T13:21:51Z

travis/script.sh: line 187: test: =: unary operator expected

mkoppanen · 2014-10-08T13:22:55Z

Seems like we have one failure:

https://travis-ci.org/mkoppanen/php-zmq/builds/37392813

phuedx · 2014-10-08T13:38:13Z

I'll fix up travis/script.sh in another PR as it's not affecting the build result, it's just warning that = "true" isn't valid syntax.

Add bindings for CZMQ security primitives

mkoppanen · 2014-10-08T13:38:52Z

Merged. Thanks!

wysman · 2014-10-08T13:47:57Z

Congrats !

phuedx · 2014-10-08T13:49:42Z

mkoppanen reviewed May 4, 2014
View reviewed changes

phuedx changed the title ~~[WIP] Add bindings for ZeroMQ security primitives~~ [WIP] Add bindings for CZMQ security primitives May 21, 2014

phuedx changed the title ~~[WIP] Add bindings for CZMQ security primitives~~ Add bindings for CZMQ security primitives May 25, 2014

mkoppanen reviewed Jul 15, 2014
View reviewed changes

mkoppanen reviewed Aug 30, 2014
View reviewed changes

mkoppanen reviewed Oct 6, 2014
View reviewed changes

phuedx added 5 commits October 8, 2014 13:55

Document the ZMQCert and ZMQAuth classes

fb0dbc7

Add the ZMQAuth class

bcd105c

The ZMQAuth class wraps the CZMQ zauth API. Instances of the ZMQAuth class can: * install a ZAP handler for a ZMQContext * whitelist/blacklist IP addresses * use plain or curve authentication for one or more domains

Build ØMQ 4.0.1 with and without CZMQ 2.2.0

1090d82

mkoppanen added a commit that referenced this pull request Oct 8, 2014

Merge pull request #125 from phuedx/authApiExperiment

644fa8e

Add bindings for CZMQ security primitives

mkoppanen merged commit 644fa8e into zeromq:master Oct 8, 2014

phuedx deleted the authApiExperiment branch October 8, 2014 13:49

phuedx mentioned this pull request Oct 8, 2014

Fix errors in travis/script.sh #140

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add bindings for CZMQ security primitives #125

Add bindings for CZMQ security primitives #125

phuedx commented May 4, 2014

mkoppanen May 4, 2014

phuedx May 5, 2014

mkoppanen commented May 4, 2014

phuedx commented May 20, 2014

phuedx commented May 28, 2014

phuedx commented Jun 27, 2014

wysman commented Jun 30, 2014

phuedx commented Jun 30, 2014

wysman commented Jul 1, 2014

wysman commented Jul 1, 2014

wysman commented Jul 1, 2014

phuedx commented Jul 4, 2014

phuedx commented Jul 4, 2014

mkoppanen Jul 15, 2014

mkoppanen Aug 30, 2014

phuedx Sep 23, 2014

phuedx commented Sep 29, 2014

mkoppanen Oct 6, 2014

phuedx Oct 8, 2014

mkoppanen commented Oct 6, 2014

phuedx commented Oct 8, 2014

mkoppanen commented Oct 8, 2014

mkoppanen commented Oct 8, 2014

mkoppanen commented Oct 8, 2014

phuedx commented Oct 8, 2014

mkoppanen commented Oct 8, 2014

wysman commented Oct 8, 2014

phuedx commented Oct 8, 2014

Add bindings for CZMQ security primitives #125

Add bindings for CZMQ security primitives #125

Conversation

phuedx commented May 4, 2014