Mailing-List: contact users-help@qpid.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@qpid.apache.org
Received-SPF: pass (nike.apache.org: domain of gsim@redhat.com designates
 66.187.233.31 as permitted sender)
Message-ID: <4A851397.9040803@redhat.com>
Date: Fri, 14 Aug 2009 08:34:47 +0100
From: Gordon Sim <gsim@redhat.com>
Organization: Registered Address: Red Hat UK Ltd, Amberley Place, 107-111
 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom.,Registered in
 England and Wales under Company Registration No. 3798903,Directors: Michael
 Cunningham (USA), Charlie Peters (USA) and David Owens (Ireland)
User-Agent: Thunderbird 1.5.0.2 (X11/20060501)
MIME-Version: 1.0
To: users@qpid.apache.org
Subject: Re: Question about C++ broker, C++ client, and SSL encryption
References: 
 <951EAAA951E3AD4B82B5B30AA2A0AF2BC6DC41866C@Commitchs1.commitent.com>
In-Reply-To: 
 <951EAAA951E3AD4B82B5B30AA2A0AF2BC6DC41866C@Commitchs1.commitent.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Cullen Davis wrote:
> I have two questions regarding SSL and the C++ broker / C++ client running qpidd (qpidc) version 0.5 from a trunk build.
> 
> 1) Start c++ qpid broker as follows
>    qpidd --log-enable debug:ssl --log-source yes \
>       --log-function yes \
>       --auth no \
>       --load-module src/.libs/ssl.so \
>       --ssl-cert-db /etc/pki/tls/qpid/test_cert_db 
>       --ssl-cert-password-file /etc/pki/tls/private/qpid_ssl.pass \
>       --ssl-cert-name commit.CjD \
>       --ssl-require-client-authentication \
>       --require-encryption
> 
> 2) Run the c++ direct example on port 5672 
>    ./examples/direct/declare_queues localhost 5672  
>    ./examples/direct/direct_producer localhost 5672
>    ./examples/direct/listener localhost 5672
> The queue is created, populated, and read with no problems.
> 
> 3) Run the c++ direct example on port 5671 (first set-up env variables) 
>    QPID_LOAD_MODULE=./src/.libs/sslconnector.so
>    QPID_SSL_CERT_DB=/etc/pki/tls/qpid/test_cert_db 
>    ./examples/direct/declare_queues localhost 5671
> 
> At this point, the declare_queues example hangs until CTRL C is pressed.  When declare_queues terminates, the broker outputs: 
> debug qpid/sys/ssl/SslHandler.cpp:143:void qpid::sys::ssl::SslHandler::eof(qpid::sys::ssl::SslIO&): DISCONNECTED [127.0.0.1:57801]
> 
> 
> Question 1 - Why did the examples on port 5672 (#2) succeed?  I thought --load-module src/.libs/ssl.so and --require-encryption would cause the connection to be rejected.

That is because the of the auth=no option, this is a known issue and 
should be fixed in the next release.

https://issues.apache.org/jira/browse/QPID-1899

> Question 2 - What is the declare_queue code from #3 blocking on?  

To use ssl in the client you have to select 'ssl' as the protocol. The 
examples don't currently allow you to do that at present. However if you 
make the following modifications then you can specify 'ssl' after host 
and port and it should work:

Index: examples/direct/declare_queues.cpp
===================================================================
--- examples/direct/declare_queues.cpp  (revision 797423)
+++ examples/direct/declare_queues.cpp  (working copy)
@@ -53,12 +53,14 @@


  int main(int argc, char** argv) {
-    const char* host = argc>1 ? argv[1] : "127.0.0.1";
-    int port = argc>2 ? atoi(argv[2]) : 5672;
+    ConnectionSettings settings;
+    if (argc>1) settings.host = argv[1];
+    if (argc>2) settings.port = atoi(argv[2]);
+    if (argc>3) settings.protocol = argv[3];
      Connection connection;

      try {
-      connection.open(host, port);
+      connection.open(settings);
        Session session =  connection.newSession();

The same change would be required on the other example programs. We 
should get this changed for the next release also. I've raised a Jira to 
track it:

https://issues.apache.org/jira/browse/QPID-2049


---------------------------------------------------------------------
Apache Qpid - AMQP Messaging Implementation
Project:      http://qpid.apache.org
Use/Interact: mailto:users-subscribe@qpid.apache.org