TAO::SSLIOP::Server_Invocation_Interceptor Class Reference

Secure invocation server request interceptor. More...

#include <SSLIOP_Invocation_Interceptor.h>

Inheritance diagram for TAO::SSLIOP::Server_Invocation_Interceptor:

[legend]Collaboration diagram for TAO::SSLIOP::Server_Invocation_Interceptor:

[legend]List of all members.

Public Member Functions
	Server_Invocation_Interceptor (PortableInterceptor::ORBInitInfo_ptr info,::Security::QOP default_qop, size_t tss_slot)
	Constructor.
PortableInterceptor::ServerRequestInterceptor Methods
Methods required by the PortableInterceptor::ServerRequestInterceptor interface.
virtual char *	name (void)
virtual void	destroy (void)
virtual void	receive_request_service_contexts (PortableInterceptor::ServerRequestInfo_ptr ri)
virtual void	receive_request (PortableInterceptor::ServerRequestInfo_ptr ri)
virtual void	send_reply (PortableInterceptor::ServerRequestInfo_ptr ri)
virtual void	send_exception (PortableInterceptor::ServerRequestInfo_ptr ri)
virtual void	send_other (PortableInterceptor::ServerRequestInfo_ptr ri)
Protected Member Functions
	~Server_Invocation_Interceptor (void)
	Destructor.
Private Member Functions
Copying and Assignment
Protected to prevent copying through the copy constructor and the assignment operator.
	Server_Invocation_Interceptor (const Server_Invocation_Interceptor &)
void	operator= (const Server_Invocation_Interceptor &)
Private Attributes
::SSLIOP::Current_var	ssliop_current_
	Reference to the current SSLIOP execution context.
PortableServer::Current_var	poa_current_
	Reference to the POA current.
::Security::QOP	qop_
	The default quality-of-protection settings in use.
SecurityLevel2::SecurityManager_var	sec2manager_
	SecurityLevel2 security manager reference.
SecurityLevel2::Current_var	sec2_current_

---

Detailed Description

Secure invocation server request interceptor.

This server request interceptor rejects insecure request invocations if the effective target object policy requires secure invocations.

Definition at line 55 of file SSLIOP_Invocation_Interceptor.h.

---

Constructor & Destructor Documentation

TAO_BEGIN_VERSIONED_NAMESPACE_DECL TAO::SSLIOP::Server_Invocation_Interceptor::Server_Invocation_Interceptor	(	PortableInterceptor::ORBInitInfo_ptr	info,
		::Security::QOP	default_qop,
		size_t	tss_slot
	)

Constructor.

Parameters:

	info	reference to the ORBInitInfo object so that the interceptor can get access to initial references, etc.
	default_qop	the default Quality of Protection
	tss_slot	the TSS slot used by the various security features.

Definition at line 23 of file SSLIOP_Invocation_Interceptor.cpp.

References ACE_DEBUG, TAO_Pseudo_Var_T< T >::in(), CORBA::is_nil(), LM_DEBUG, TAO_debug_level, and TAO::SSLIOP::Current::tss_slot().

: qop_ (default_qop)
{
  /*
   * Cache references to the "Current" objects that we'll need during
   * during invocations.
   */

  CORBA::Object_var obj =
    info->resolve_initial_references ("SSLIOPCurrent");

  this->ssliop_current_ = ::SSLIOP::Current::_narrow (obj.in ());

  if (!CORBA::is_nil (this->ssliop_current_.in ()))
    {
      TAO::SSLIOP::Current *tao_current =
        dynamic_cast<TAO::SSLIOP::Current *> (this->ssliop_current_.in ());

      if (tao_current != 0)
        {
          if (TAO_debug_level > 3)
            ACE_DEBUG ((LM_DEBUG, "TAO (%P|%t) SSLIOP_Invocation_Interceptor::CTOR--setting up SSLIOP Current with slot %d\n", tss_slot));
          tao_current->tss_slot (tss_slot);
        }
      else
        throw CORBA::INTERNAL ();
    }

  obj = info->resolve_initial_references ("SecurityLevel2:SecurityManager");
  this->sec2manager_ = SecurityLevel2::SecurityManager::_narrow (obj.in ());

  if (! CORBA::is_nil (this->sec2manager_.in ()))
    {
      // set the slot id?  things seem to work without doing this
    }

#if 0
  // Don't need this now that we're not using access_allowed(), but
  // I'm leaving the code here just in case it would become convenient
  // for some other use.
  obj = info->resolve_initial_references ("POACurrent");
  this->poa_current_ = PortableServer::Current::_narrow (obj.in ());
#endif
}

TAO::SSLIOP::Server_Invocation_Interceptor::~Server_Invocation_Interceptor

(

void

)

[protected]

Destructor.

Protected destructor to force deallocation by the reference counting mechanism.

Definition at line 72 of file SSLIOP_Invocation_Interceptor.cpp.

{
}

TAO::SSLIOP::Server_Invocation_Interceptor::Server_Invocation_Interceptor

(

const Server_Invocation_Interceptor &

)

[private]

---

Member Function Documentation

void TAO::SSLIOP::Server_Invocation_Interceptor::destroy

(

void

)

[virtual]

Definition at line 84 of file SSLIOP_Invocation_Interceptor.cpp.

{
}

char * TAO::SSLIOP::Server_Invocation_Interceptor::name

(

void

)

[virtual]

Definition at line 78 of file SSLIOP_Invocation_Interceptor.cpp.

References CORBA::string_dup().

{
  return CORBA::string_dup ("TAO::SSLIOP::Server_Invocation_Interceptor");
}

void TAO::SSLIOP::Server_Invocation_Interceptor::operator=

(

const Server_Invocation_Interceptor &

)

[private]

void TAO::SSLIOP::Server_Invocation_Interceptor::receive_request

(

PortableInterceptor::ServerRequestInfo_ptr

ri

)

[virtual]

Definition at line 96 of file SSLIOP_Invocation_Interceptor.cpp.

References ACE_DEBUG, LM_DEBUG, sec2_current_, sec2manager_, Security::SecQOPNoProtection, ssliop_current_, and TAO_debug_level.

{
  SecurityLevel2::AccessDecision_var ad_tmp =
    this->sec2manager_->access_decision ();
  TAO::SL2::AccessDecision_var ad =
    TAO::SL2::AccessDecision::_narrow (ad_tmp.in ());

  CORBA::Boolean const no_ssl =
    this->ssliop_current_->no_context ();

  if (TAO_debug_level >= 3)
    ACE_DEBUG ((LM_DEBUG, "SSLIOP (%P|%t) Interceptor (context), ssl=%d\n", !(no_ssl)));

  // if
  // (1) no SSL session state is available (which means that the
  //     invocation is received across a non-SSL transport)
  // AND
  // (2) the required Quality of Protection is something other
  //     than SecQOPNoProtection (set via -SSLNoProtection)
  if (no_ssl && this->qop_ != ::Security::SecQOPNoProtection)
    {
      /*
       * Set up all the arguments needed by the call
       * to AccessDecision::access_allowed()
       */

      /* Get the credentials from SSLIOP */
      SecurityLevel2::CredentialsList cred_list; // initial empty?
#if 0
      try {
        SecurityLevel2::ReceivedCredentials_var rcvd_creds =
          this->sec2_current_->received_credentials ();
        // this gets the credentials received from the other side.  We
        // should be able to put this into a CredentialsList with no
        // problem.
        //
        // Do I really need to implement a sec2_current, or can I hack
        // the conversion at this level?  I probably ought to do it as
        // a real sec2_current with the conversion from sec3->sec2
        // happening at a lower level.

    cred_list.length(1);
    cred_list[0] = rcvd_creds.in ();
    /*
      So, in looking for how we can do this, I find that the
      SL3_SecurityCurrent::client_credentials() delegates to SL3_SecurityCurrent_Impl::client_credentials(), which is pure virtual.
    */
      }
      catch (...) {
      }
#endif

      /* Gather the elements that uniquely identify the target object */
      CORBA::ORBid_var orb_id = ri->orb_id ();
      CORBA::OctetSeq_var adapter_id = ri->adapter_id ();
      CORBA::OctetSeq_var object_id = ri->object_id ();
      CORBA::String_var operation_name = ri->operation ();

      CORBA::Boolean it_should_happen = false;
      it_should_happen = ad->access_allowed_ex (orb_id.in (),
                        adapter_id.in (),
                        object_id.in (),
                        cred_list,
                        operation_name.in());
      if (TAO_debug_level >= 3)
        {
          ACE_DEBUG ((LM_DEBUG,
            "TAO (%P|%t) SL2::access_allowed_ex returned %s\n",
            it_should_happen ? "true" : "false"));
        }

      if (! it_should_happen)
        throw CORBA::NO_PERMISSION ();
    }
}

void TAO::SSLIOP::Server_Invocation_Interceptor::receive_request_service_contexts

(

PortableInterceptor::ServerRequestInfo_ptr

ri

)

[virtual]

Definition at line 89 of file SSLIOP_Invocation_Interceptor.cpp.

{
}

void TAO::SSLIOP::Server_Invocation_Interceptor::send_exception

(

PortableInterceptor::ServerRequestInfo_ptr

ri

)

[virtual]

Definition at line 180 of file SSLIOP_Invocation_Interceptor.cpp.

{
}

void TAO::SSLIOP::Server_Invocation_Interceptor::send_other

(

PortableInterceptor::ServerRequestInfo_ptr

ri

)

[virtual]

Definition at line 186 of file SSLIOP_Invocation_Interceptor.cpp.

{
}

void TAO::SSLIOP::Server_Invocation_Interceptor::send_reply

(

PortableInterceptor::ServerRequestInfo_ptr

ri

)

[virtual]

Definition at line 174 of file SSLIOP_Invocation_Interceptor.cpp.

{
}

---

Member Data Documentation

PortableServer::Current_var TAO::SSLIOP::Server_Invocation_Interceptor::poa_current_ [private]

Reference to the POA current.

Definition at line 127 of file SSLIOP_Invocation_Interceptor.h.

::Security::QOP TAO::SSLIOP::Server_Invocation_Interceptor::qop_ [private]

The default quality-of-protection settings in use.

Definition at line 130 of file SSLIOP_Invocation_Interceptor.h.

SecurityLevel2::Current_var TAO::SSLIOP::Server_Invocation_Interceptor::sec2_current_ [private]

Definition at line 134 of file SSLIOP_Invocation_Interceptor.h.

Referenced by receive_request().

SecurityLevel2::SecurityManager_var TAO::SSLIOP::Server_Invocation_Interceptor::sec2manager_ [private]

SecurityLevel2 security manager reference.

Definition at line 133 of file SSLIOP_Invocation_Interceptor.h.

Referenced by receive_request().

::SSLIOP::Current_var TAO::SSLIOP::Server_Invocation_Interceptor::ssliop_current_ [private]

Reference to the current SSLIOP execution context.

Definition at line 124 of file SSLIOP_Invocation_Interceptor.h.

Referenced by receive_request().

---

The documentation for this class was generated from the following files:

• SSLIOP_Invocation_Interceptor.h
• SSLIOP_Invocation_Interceptor.cpp

---