Modified: qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestTest.java URL: http://svn.apache.org/viewvc/qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestTest.java?rev=1461870&r1=1461869&r2=1461870&view=diff ============================================================================== --- qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestTest.java (original) +++ qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestTest.java Wed Mar 27 21:58:51 2013 @@ -20,8 +20,10 @@ */ package org.apache.qpid.systest.rest; +import java.io.File; import java.util.Arrays; import java.util.Collection; +import java.util.HashMap; import java.util.HashSet; import java.util.List; import java.util.Map; @@ -32,7 +34,10 @@ import org.apache.qpid.server.model.Life import org.apache.qpid.server.model.Port; import org.apache.qpid.server.model.State; import org.apache.qpid.server.model.VirtualHost; +import org.apache.qpid.server.model.adapter.BrokerAdapter; +import org.apache.qpid.test.utils.QpidTestCase; import org.apache.qpid.test.utils.TestBrokerConfiguration; +import org.apache.qpid.test.utils.TestSSLConstants; public class BrokerRestTest extends QpidRestTestCase { @@ -86,6 +91,107 @@ public class BrokerRestTest extends Qpid new HashSet<String>(port2Protocols)); } + public void testPutToUpdateWithValidAttributeValues() throws Exception + { + Map<String, Object> brokerAttributes = getValidBrokerAttributes(); + + int response = getRestTestHelper().submitRequest("/rest/broker", "PUT", brokerAttributes); + assertEquals("Unexpected update response", 200, response); + + restartBroker(); + Map<String, Object> brokerDetails = getRestTestHelper().getJsonAsSingletonList("/rest/broker"); + assertBrokerAttributes(brokerAttributes, brokerDetails); + } + + public void testPutToUpdateWithInvalidAttributeValues() throws Exception + { + Map<String, Object> invalidAttributes = new HashMap<String, Object>(); + invalidAttributes.put(Broker.DEFAULT_AUTHENTICATION_PROVIDER, "non-existing-provider"); + invalidAttributes.put(Broker.DEFAULT_VIRTUAL_HOST, "non-existing-host"); + invalidAttributes.put(Broker.ALERT_THRESHOLD_MESSAGE_AGE, -1000); + invalidAttributes.put(Broker.ALERT_THRESHOLD_MESSAGE_COUNT, -2000); + invalidAttributes.put(Broker.ALERT_THRESHOLD_QUEUE_DEPTH, -3000); + invalidAttributes.put(Broker.ALERT_THRESHOLD_MESSAGE_SIZE, -4000); + invalidAttributes.put(Broker.ALERT_REPEAT_GAP, -5000); + invalidAttributes.put(Broker.FLOW_CONTROL_SIZE_BYTES, -7000); + invalidAttributes.put(Broker.FLOW_CONTROL_RESUME_SIZE_BYTES, -16000); + invalidAttributes.put(Broker.MAXIMUM_DELIVERY_ATTEMPTS, -8); + invalidAttributes.put(Broker.HOUSEKEEPING_CHECK_PERIOD, -90000); + invalidAttributes.put(Broker.SESSION_COUNT_LIMIT, -10); + invalidAttributes.put(Broker.HEART_BEAT_DELAY, -11000); + invalidAttributes.put(Broker.STATISTICS_REPORTING_PERIOD, -12000); + invalidAttributes.put(Broker.ACL_FILE, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "non-existing-acl.acl"); + invalidAttributes.put(Broker.KEY_STORE_PATH, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "non-existing-keystore.jks"); + invalidAttributes.put(Broker.KEY_STORE_PASSWORD, "password1"); + invalidAttributes.put(Broker.KEY_STORE_CERT_ALIAS, "java-broker1"); + invalidAttributes.put(Broker.TRUST_STORE_PATH, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "non-existing-truststore.jks"); + invalidAttributes.put(Broker.TRUST_STORE_PASSWORD, "password2"); + invalidAttributes.put(Broker.PEER_STORE_PATH, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "non-existing-peerstore.jks"); + invalidAttributes.put(Broker.PEER_STORE_PASSWORD, "password3"); + invalidAttributes.put(Broker.GROUP_FILE, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "groups-non-existing"); + + for (Map.Entry<String, Object> entry : invalidAttributes.entrySet()) + { + Map<String, Object> brokerAttributes = getValidBrokerAttributes(); + brokerAttributes.put(entry.getKey(), entry.getValue()); + int response = getRestTestHelper().submitRequest("/rest/broker", "PUT", brokerAttributes); + assertEquals("Unexpected update response for invalid attribute " + entry.getKey() + "=" + entry.getValue(), 409, response); + } + + // a special case when FLOW_CONTROL_RESUME_SIZE_BYTES > FLOW_CONTROL_SIZE_BYTES + Map<String, Object> brokerAttributes = getValidBrokerAttributes(); + brokerAttributes.put(Broker.FLOW_CONTROL_SIZE_BYTES, 1000); + brokerAttributes.put(Broker.FLOW_CONTROL_RESUME_SIZE_BYTES, 2000); + int response = getRestTestHelper().submitRequest("/rest/broker", "PUT", brokerAttributes); + assertEquals("Unexpected update response for flow resume size > flow size", 409, response); + } + + private Map<String, Object> getValidBrokerAttributes() + { + Map<String, Object> brokerAttributes = new HashMap<String, Object>(); + brokerAttributes.put(Broker.DEFAULT_AUTHENTICATION_PROVIDER, ANONYMOUS_AUTHENTICATION_PROVIDER); + brokerAttributes.put(Broker.DEFAULT_VIRTUAL_HOST, TEST3_VIRTUALHOST); + brokerAttributes.put(Broker.ALERT_THRESHOLD_MESSAGE_AGE, 1000); + brokerAttributes.put(Broker.ALERT_THRESHOLD_MESSAGE_COUNT, 2000); + brokerAttributes.put(Broker.ALERT_THRESHOLD_QUEUE_DEPTH, 3000); + brokerAttributes.put(Broker.ALERT_THRESHOLD_MESSAGE_SIZE, 4000); + brokerAttributes.put(Broker.ALERT_REPEAT_GAP, 5000); + brokerAttributes.put(Broker.FLOW_CONTROL_SIZE_BYTES, 7000); + brokerAttributes.put(Broker.FLOW_CONTROL_RESUME_SIZE_BYTES, 6000); + brokerAttributes.put(Broker.MAXIMUM_DELIVERY_ATTEMPTS, 8); + brokerAttributes.put(Broker.DEAD_LETTER_QUEUE_ENABLED, true); + brokerAttributes.put(Broker.HOUSEKEEPING_CHECK_PERIOD, 90000); + brokerAttributes.put(Broker.SESSION_COUNT_LIMIT, 10); + brokerAttributes.put(Broker.HEART_BEAT_DELAY, 11000); + brokerAttributes.put(Broker.STATISTICS_REPORTING_PERIOD, 12000); + brokerAttributes.put(Broker.STATISTICS_REPORTING_RESET_ENABLED, true); + brokerAttributes.put(Broker.ACL_FILE, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "broker_example.acl"); + brokerAttributes.put(Broker.KEY_STORE_PATH, TestSSLConstants.BROKER_KEYSTORE); + brokerAttributes.put(Broker.KEY_STORE_PASSWORD, TestSSLConstants.BROKER_KEYSTORE_PASSWORD); + brokerAttributes.put(Broker.KEY_STORE_CERT_ALIAS, "java-broker"); + brokerAttributes.put(Broker.TRUST_STORE_PATH, TestSSLConstants.TRUSTSTORE); + brokerAttributes.put(Broker.TRUST_STORE_PASSWORD, TestSSLConstants.TRUSTSTORE_PASSWORD); + brokerAttributes.put(Broker.PEER_STORE_PATH, TestSSLConstants.TRUSTSTORE); + brokerAttributes.put(Broker.PEER_STORE_PASSWORD, TestSSLConstants.TRUSTSTORE_PASSWORD); + brokerAttributes.put(Broker.GROUP_FILE, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "groups"); + return brokerAttributes; + } + + private void assertBrokerAttributes(Map<String, Object> expectedAttributes, Map<String, Object> actualAttributes) + { + for (Map.Entry<String, Object> entry : expectedAttributes.entrySet()) + { + String attributeName = entry.getKey(); + Object attributeValue = entry.getValue(); + if (attributeName.equals(Broker.KEY_STORE_PASSWORD) || attributeName.equals(Broker.TRUST_STORE_PASSWORD) || attributeName.equals(Broker.PEER_STORE_PASSWORD)) + { + attributeValue = "********"; + } + Object currentValue = actualAttributes.get(attributeName); + assertEquals("Unexpected attribute " + attributeName + " value:", attributeValue, currentValue); + } + } + protected void assertBrokerAttributes(Map<String, Object> brokerDetails) { Asserts.assertAttributesPresent(brokerDetails, Broker.AVAILABLE_ATTRIBUTES,
Modified: qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/QpidRestTestCase.java URL: http://svn.apache.org/viewvc/qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/QpidRestTestCase.java?rev=1461870&r1=1461869&r2=1461870&view=diff ============================================================================== --- qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/QpidRestTestCase.java (original) +++ qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/QpidRestTestCase.java Wed Mar 27 21:58:51 2013 @@ -21,14 +21,21 @@ package org.apache.qpid.systest.rest; import java.io.IOException; +import java.util.HashMap; +import java.util.Map; import org.apache.commons.configuration.ConfigurationException; +import org.apache.qpid.server.model.AuthenticationProvider; import org.apache.qpid.server.model.Port; +import org.apache.qpid.server.plugin.AuthenticationManagerFactory; +import org.apache.qpid.server.security.auth.manager.AnonymousAuthenticationManagerFactory; +import org.apache.qpid.server.security.auth.manager.ExternalAuthenticationManagerFactory; import org.apache.qpid.test.utils.TestBrokerConfiguration; import org.apache.qpid.test.utils.QpidBrokerTestCase; public class QpidRestTestCase extends QpidBrokerTestCase { + public static final String ANONYMOUS_AUTHENTICATION_PROVIDER = "testAnonymous"; public static final String TEST1_VIRTUALHOST = "test"; public static final String TEST2_VIRTUALHOST = "test2"; public static final String TEST3_VIRTUALHOST = "test3"; @@ -77,6 +84,11 @@ public class QpidRestTestCase extends Qp config.setObjectAttribute(TestBrokerConfiguration.ENTRY_NAME_HTTP_PORT, Port.PORT, _restTestHelper.getHttpPort()); config.removeObjectConfiguration(TestBrokerConfiguration.ENTRY_NAME_JMX_PORT); config.removeObjectConfiguration(TestBrokerConfiguration.ENTRY_NAME_RMI_PORT); + + Map<String, Object> anonymousProviderAttributes = new HashMap<String, Object>(); + anonymousProviderAttributes.put(AuthenticationProvider.TYPE, AnonymousAuthenticationManagerFactory.PROVIDER_TYPE); + anonymousProviderAttributes.put(AuthenticationProvider.NAME, ANONYMOUS_AUTHENTICATION_PROVIDER); + config.addAuthenticationProviderConfiguration(anonymousProviderAttributes); } public RestTestHelper getRestTestHelper() Modified: qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/StructureRestTest.java URL: http://svn.apache.org/viewvc/qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/StructureRestTest.java?rev=1461870&r1=1461869&r2=1461870&view=diff ============================================================================== --- qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/StructureRestTest.java (original) +++ qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/StructureRestTest.java Wed Mar 27 21:58:51 2013 @@ -45,7 +45,7 @@ public class StructureRestTest extends Q @SuppressWarnings("unchecked") List<Map<String, Object>> providers = (List<Map<String, Object>>) structure.get("authenticationproviders"); - assertEquals("Unexpected number of authentication providers", 1, providers.size()); + assertEquals("Unexpected number of authentication providers", 2, providers.size()); for (String hostName : EXPECTED_VIRTUALHOSTS) { Propchange: qpid/branches/QPID-4659/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/QpidBrokerTestCase.java ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/QpidBrokerTestCase.java:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/ ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/CPPExcludes ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/CPPExcludes:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/Excludes ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/Excludes:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/JavaBDBExcludes ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/JavaBDBExcludes:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/JavaExcludes ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/JavaExcludes:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/JavaPre010Excludes ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/JavaPre010Excludes:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/JavaTransientExcludes ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/JavaTransientExcludes:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/XAExcludes ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/XAExcludes:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/cpp.async.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/cpp.async.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/cpp.cluster.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/cpp.cluster.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/cpp.noprefetch.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/cpp.noprefetch.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/cpp.ssl.excludes ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/cpp.ssl.excludes:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/cpp.ssl.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/cpp.ssl.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/cpp.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/cpp.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/java-bdb-spawn.0-9-1.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/java-bdb-spawn.0-9-1.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/java-bdb.0-9-1.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/java-bdb.0-9-1.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/java-dby-spawn.0-9-1.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/java-dby-spawn.0-9-1.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/java-dby.0-9-1.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/java-dby.0-9-1.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/java-mms-spawn.0-10.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/java-mms-spawn.0-10.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/java-mms-spawn.0-9-1.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/java-mms-spawn.0-9-1.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/java-mms.0-9-1.testprofile ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/java-mms.0-9-1.testprofile:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/log4j-test.xml ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/log4j-test.xml:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/test-provider.properties ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/test-provider.properties:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/test_resources/ ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/test_resources:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/java/test-profiles/testprofile.defaults ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/java/test-profiles/testprofile.defaults:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/packaging/windows/ ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/packaging/windows:r1458037-1461856 Modified: qpid/branches/QPID-4659/qpid/packaging/windows/INSTALL_NOTES.html URL: http://svn.apache.org/viewvc/qpid/branches/QPID-4659/qpid/packaging/windows/INSTALL_NOTES.html?rev=1461870&r1=1461869&r2=1461870&view=diff ============================================================================== --- qpid/branches/QPID-4659/qpid/packaging/windows/INSTALL_NOTES.html (original) +++ qpid/branches/QPID-4659/qpid/packaging/windows/INSTALL_NOTES.html Wed Mar 27 21:58:51 2013 @@ -1,11 +1,11 @@ <html> <head> -<title>Apache Qpid C++ 0.21 Installation Notes</title> +<title>Apache Qpid C++ 0.23 Installation Notes</title> </head> <body> -<H1>Apache Qpid C++ 0.21 Installation Notes</H1> +<H1>Apache Qpid C++ 0.23 Installation Notes</H1> -<p>Thank you for installing Apache Qpid version 0.21 for Windows. +<p>Thank you for installing Apache Qpid version 0.23 for Windows. If the requisite features were installed, you can now run a broker, use the example programs, and design your own messaging programs while reading the Qpid C++ API reference documentation.</p> @@ -83,7 +83,7 @@ default; therefore, to gain support for must be loaded into the broker. This can be done using the <code>--load-module</code> option to load the needed plugins. For example: <pre> -cd "C:\Program Files\Apache\qpidc-0.21" +cd "C:\Program Files\Apache\qpidc-0.23" qpidd.exe --load-module plugins\broker\store.dll --load-module plugins\broker\msclfs_store.dll </pre> The <code>--load-module</code> option can also take a full path. The option Modified: qpid/branches/QPID-4659/qpid/packaging/windows/installer.proj URL: http://svn.apache.org/viewvc/qpid/branches/QPID-4659/qpid/packaging/windows/installer.proj?rev=1461870&r1=1461869&r2=1461870&view=diff ============================================================================== --- qpid/branches/QPID-4659/qpid/packaging/windows/installer.proj (original) +++ qpid/branches/QPID-4659/qpid/packaging/windows/installer.proj Wed Mar 27 21:58:51 2013 @@ -32,7 +32,7 @@ <source_root>$(MSBuildProjectDirectory)\..\..</source_root> <staging_dir>$(MSBuildProjectDirectory)\stage</staging_dir> <bits Condition="'$(bits)' == ''">32</bits> - <qpid_version>0.21</qpid_version> + <qpid_version>0.23</qpid_version> <OutputName>qpidc</OutputName> <OutputType>Package</OutputType> <WixToolPath>C:\Program Files (x86)\Windows Installer XML v3.5\bin</WixToolPath> Propchange: qpid/branches/QPID-4659/qpid/packaging/windows/installer.proj ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/packaging/windows/installer.proj:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/python/ ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/python:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/python/examples/api/spout ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/python/examples/api/spout:r1458037-1461856 Propchange: qpid/branches/QPID-4659/qpid/python/qpid/concurrency.py ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/python/qpid/concurrency.py:r1458037-1461856 Modified: qpid/branches/QPID-4659/qpid/python/qpid/messaging/endpoints.py URL: http://svn.apache.org/viewvc/qpid/branches/QPID-4659/qpid/python/qpid/messaging/endpoints.py?rev=1461870&r1=1461869&r2=1461870&view=diff ============================================================================== --- qpid/branches/QPID-4659/qpid/python/qpid/messaging/endpoints.py (original) +++ qpid/branches/QPID-4659/qpid/python/qpid/messaging/endpoints.py Wed Mar 27 21:58:51 2013 @@ -122,6 +122,10 @@ class Connection(Endpoint): @param ssl_certfile: file with client's public (eventually priv+pub) key (PEM format) @type ssl_trustfile: str @param ssl_trustfile: file trusted certificates to validate the server + @type ssl_skip_hostname_check: bool + @param ssl_skip_hostname_check: disable verification of hostname in + certificate. Use with caution - disabling hostname checking leaves you + vulnerable to Man-in-the-Middle attacks. @rtype: Connection @return: a disconnected Connection @@ -170,6 +174,7 @@ class Connection(Endpoint): self.ssl_keyfile = options.get("ssl_keyfile", None) self.ssl_certfile = options.get("ssl_certfile", None) self.ssl_trustfile = options.get("ssl_trustfile", None) + self.ssl_skip_hostname_check = options.get("ssl_skip_hostname_check", False) self.client_properties = options.get("client_properties", {}) self.options = options Modified: qpid/branches/QPID-4659/qpid/python/qpid/messaging/transports.py URL: http://svn.apache.org/viewvc/qpid/branches/QPID-4659/qpid/python/qpid/messaging/transports.py?rev=1461870&r1=1461869&r2=1461870&view=diff ============================================================================== --- qpid/branches/QPID-4659/qpid/python/qpid/messaging/transports.py (original) +++ qpid/branches/QPID-4659/qpid/python/qpid/messaging/transports.py Wed Mar 27 21:58:51 2013 @@ -53,7 +53,7 @@ TRANSPORTS["tcp"] = tcp try: from ssl import wrap_socket, SSLError, SSL_ERROR_WANT_READ, \ - SSL_ERROR_WANT_WRITE + SSL_ERROR_WANT_WRITE, CERT_REQUIRED, CERT_NONE except ImportError: ## try the older python SSL api: @@ -69,6 +69,15 @@ except ImportError: ssl_certfile = conn.ssl_certfile if ssl_certfile and not ssl_keyfile: ssl_keyfile = ssl_certfile + + # this version of SSL does NOT perform certificate validation. If the + # connection has been configured with CA certs (via ssl_trustfile), then + # the application expects the certificate to be validated against the + # supplied CA certs. Since this version cannot validate, the peer cannot + # be trusted. + if conn.ssl_trustfile: + raise SSLError("This version of Python does not support verification of the peer's certificate.") + self.ssl = ssl(self.socket, keyfile=ssl_keyfile, certfile=ssl_certfile) self.socket.setblocking(1) @@ -95,7 +104,39 @@ else: def __init__(self, conn, host, port): SocketTransport.__init__(self, conn, host, port) - self.tls = wrap_socket(self.socket, keyfile=conn.ssl_keyfile, certfile=conn.ssl_certfile, ca_certs=conn.ssl_trustfile) + if conn.ssl_trustfile: + validate = CERT_REQUIRED + else: + validate = CERT_NONE + + self.tls = wrap_socket(self.socket, keyfile=conn.ssl_keyfile, + certfile=conn.ssl_certfile, + ca_certs=conn.ssl_trustfile, + cert_reqs=validate) + + if validate == CERT_REQUIRED and not conn.ssl_skip_hostname_check: + match_found = False + peer_cert = self.tls.getpeercert() + if peer_cert: + peer_names = [] + if 'subjectAltName' in peer_cert: + for san in peer_cert['subjectAltName']: + if san[0] == 'DNS': + peer_names.append(san[1].lower()) + if 'subject' in peer_cert: + for sub in peer_cert['subject']: + while isinstance(sub, tuple) and isinstance(sub[0],tuple): + sub = sub[0] # why the extra level of indirection??? + if sub[0] == 'commonName': + peer_names.append(sub[1].lower()) + for pattern in peer_names: + if _match_dns_pattern( host.lower(), pattern ): + #print "Match found %s" % pattern + match_found = True + break + if not match_found: + raise SSLError("Connection hostname '%s' does not match names from peer certificate: %s" % (host, peer_names)) + self.socket.setblocking(0) self.state = None @@ -146,5 +187,31 @@ else: # this closes the underlying socket self.tls.close() + def _match_dns_pattern( hostname, pattern ): + """ For checking the hostnames provided by the peer's certificate + """ + if pattern.find("*") == -1: + return hostname == pattern + + # DNS wildcarded pattern - see RFC2818 + h_labels = hostname.split(".") + p_labels = pattern.split(".") + + while h_labels and p_labels: + if p_labels[0].find("*") == -1: + if p_labels[0] != h_labels[0]: + return False + else: + p = p_labels[0].split("*") + if not h_labels[0].startswith(p[0]): + return False + if not h_labels[0].endswith(p[1]): + return False + h_labels.pop(0) + p_labels.pop(0) + + return not h_labels and not p_labels + + TRANSPORTS["ssl"] = tls TRANSPORTS["tcp+tls"] = tls Modified: qpid/branches/QPID-4659/qpid/python/setup.py URL: http://svn.apache.org/viewvc/qpid/branches/QPID-4659/qpid/python/setup.py?rev=1461870&r1=1461869&r2=1461870&view=diff ============================================================================== --- qpid/branches/QPID-4659/qpid/python/setup.py (original) +++ qpid/branches/QPID-4659/qpid/python/setup.py Wed Mar 27 21:58:51 2013 @@ -298,7 +298,7 @@ class install_lib(_install_lib): return outfiles + extra setup(name="qpid-python", - version="0.21", + version="0.23", author="Apache Qpid", author_email="[email protected]", packages=["mllib", "qpid", "qpid.messaging", "qpid.tests", Modified: qpid/branches/QPID-4659/qpid/tests/setup.py URL: http://svn.apache.org/viewvc/qpid/branches/QPID-4659/qpid/tests/setup.py?rev=1461870&r1=1461869&r2=1461870&view=diff ============================================================================== --- qpid/branches/QPID-4659/qpid/tests/setup.py (original) +++ qpid/branches/QPID-4659/qpid/tests/setup.py Wed Mar 27 21:58:51 2013 @@ -20,7 +20,7 @@ from distutils.core import setup setup(name="qpid-tests", - version="0.21", + version="0.23", author="Apache Qpid", author_email="[email protected]", packages=["qpid_tests", "qpid_tests.broker_0_10", "qpid_tests.broker_0_9", Propchange: qpid/branches/QPID-4659/qpid/tests/src/py/qpid_tests/broker_0_9/queue.py ------------------------------------------------------------------------------ Merged /qpid/trunk/qpid/tests/src/py/qpid_tests/broker_0_9/queue.py:r1458037-1461856 Modified: qpid/branches/QPID-4659/qpid/tools/setup.py URL: http://svn.apache.org/viewvc/qpid/branches/QPID-4659/qpid/tools/setup.py?rev=1461870&r1=1461869&r2=1461870&view=diff ============================================================================== --- qpid/branches/QPID-4659/qpid/tools/setup.py (original) +++ qpid/branches/QPID-4659/qpid/tools/setup.py Wed Mar 27 21:58:51 2013 @@ -20,7 +20,7 @@ from distutils.core import setup setup(name="qpid-tools", - version="0.21", + version="0.23", author="Apache Qpid", author_email="[email protected]", package_dir={'' : 'src/py'}, --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
