TAO_SSLIOP_Endpoint Class Reference

#include <SSLIOP_Endpoint.h>

Inheritance diagram for TAO_SSLIOP_Endpoint:

[legend]Collaboration diagram for TAO_SSLIOP_Endpoint:

[legend]List of all members.

Public Member Functions
	TAO_SSLIOP_Endpoint (const ::SSLIOP::SSL *ssl_component, TAO_IIOP_Endpoint *iiop_endp)
	Constructor.
virtual	~TAO_SSLIOP_Endpoint (void)
	Destructor.
TAO_SSLIOP_Endpoint &	operator= (const TAO_SSLIOP_Endpoint &other)
int	credentials_set (void) const
TAO_Endpoint Methods
See Endpoint.h for their documentation.
virtual TAO_Endpoint *	next (void)
virtual int	addr_to_string (char *buffer, size_t length)
CORBA::Boolean	is_equivalent (const TAO_Endpoint *other_endpoint)
virtual TAO_Endpoint *	duplicate (void)
virtual CORBA::ULong	hash (void)
SSLIOP_Endpoint-specific Methods
const ::SSLIOP::SSL &	ssl_component (void) const
	Return SSL component corresponding to this endpoint.
TAO_IIOP_Endpoint *	iiop_endpoint (void) const
	Accessor to our IIOP counterpart.
void	iiop_endpoint (TAO_IIOP_Endpoint *endpoint, bool destroy)
	Mutator to our IIOP counterpart.
const ACE_INET_Addr &	object_addr (void) const
	Return the SSLIOP-specific ACE_INET_Addr.
void	set_sec_attrs (::Security::QOP qop, const ::Security::EstablishTrust &trust, const TAO::SSLIOP::OwnCredentials_ptr creds)
::Security::QOP	qop (void) const
	Get the Quality-of-Protection settings for this endpoint.
::Security::EstablishTrust	trust (void) const
	Get the establishment of trust settings for this endpoint.
TAO::SSLIOP::OwnCredentials *	credentials (void) const
	Get the credentials for this endpoint.
Protected Attributes
::SSLIOP::SSL	ssl_component_
Private Attributes
ACE_INET_Addr	object_addr_
TAO_SSLIOP_Endpoint *	next_
TAO_IIOP_Endpoint *	iiop_endpoint_
	IIOP counterpart.
bool	destroy_iiop_endpoint_
::Security::QOP	qop_
	Quailty-of-Protection settings for this endpoint object.
::Security::EstablishTrust	trust_
	Establishment of trust settings for this endpoint object.
TAO::SSLIOP::OwnCredentials_var	credentials_
	SSLIOP-specific credentials for this endpoint object.
int	credentials_set_
	A flag indicating that credentials_ was explicitly initialized.
Friends
class	TAO_SSLIOP_Profile

---

Detailed Description

Definition at line 55 of file SSLIOP_Endpoint.h.

---

Constructor & Destructor Documentation

TAO_BEGIN_VERSIONED_NAMESPACE_DECL TAO_SSLIOP_Endpoint::TAO_SSLIOP_Endpoint	(	const ::SSLIOP::SSL *	ssl_component,
		TAO_IIOP_Endpoint *	iiop_endp
	)

Constructor.

Definition at line 22 of file SSLIOP_Endpoint.cpp.

References ACE_SET_BITS, Security::Confidentiality, Security::EstablishTrustInTarget, Security::Integrity, Security::NoDelegation, Security::NoProtection, object_addr_, SSLIOP::SSL::port, ACE_Addr::set_type(), ssl_component_, SSLIOP::SSL::target_requires, SSLIOP::SSL::target_supports, and trust_.

  : TAO_Endpoint (IOP::TAG_INTERNET_IOP),
    object_addr_ (),
    next_ (0),
    iiop_endpoint_ (iiop_endp),
    destroy_iiop_endpoint_ (false),
    qop_ (::Security::SecQOPIntegrityAndConfidentiality),
#if !defined (VXWORKS) && !defined (__QNX__)
    // Some compilers don't like the initialization
    trust_ (),
#endif /* !VXWORKS && !__QNX__ */
    credentials_ (),
    credentials_set_ (0)
{
  if (ssl_component != 0)
    {
      // Copy the security association options in the IOR's SSL tagged
      // component.
      this->ssl_component_.target_supports = ssl_component->target_supports;
      this->ssl_component_.target_requires = ssl_component->target_requires;
      this->ssl_component_.port = ssl_component->port;
    }
  else
    {
      // No SSL tagged component is available so construct a default
      // set of security association options, in addition to the IANA
      // assigned IIOP over SSL port (684).  This is generally a
      // client side issue.

      // Clear all bits in the SSLIOP::SSL association option fields.
      this->ssl_component_.target_supports = 0;
      this->ssl_component_.target_requires = 0;

      // SSLIOP requires these Security::AssociationOptions by default.
      ACE_SET_BITS (this->ssl_component_.target_requires,
                    ::Security::Integrity
                    | ::Security::Confidentiality
                    | ::Security::NoDelegation);

      // SSLIOP supports these Security::AssociationOptions by
      // default.
      //
      // Note that the Security::NoProtection bit is set since we
      // can't be sure if the server supports SSL, and TAO's SSLIOP
      // implementation must support IIOP over SSL and plain IIOP.
      ACE_SET_BITS (this->ssl_component_.target_supports,
                    ::Security::Integrity
                    | ::Security::Confidentiality
                    | ::Security::EstablishTrustInTarget
                    | ::Security::NoProtection
                    | ::Security::NoDelegation);

      // Initialize the default SSL port to zero, not the IANA
      // assigned IIOP over SSL port (684).  We usually only get here
      // if we're creating a profile on the client side using an IOR
      // that does not contain an SSLIOP tagged component.
      this->ssl_component_.port = 0;
    }

  // Invalidate the Addr until the first attempt to use it is made.
  this->object_addr_.set_type (-1);

  this->trust_.trust_in_target = 1;
  this->trust_.trust_in_client = 1;
}

TAO_SSLIOP_Endpoint::~TAO_SSLIOP_Endpoint

(

void

)

[virtual]

Destructor.

Definition at line 105 of file SSLIOP_Endpoint.cpp.

References iiop_endpoint_.

{
  if (this->destroy_iiop_endpoint_)
    delete this->iiop_endpoint_;
}

---

Member Function Documentation

int TAO_SSLIOP_Endpoint::addr_to_string	(	char *	buffer,
		size_t	length
	)			[virtual]

Implements TAO_Endpoint.

Definition at line 147 of file SSLIOP_Endpoint.cpp.

References SSLIOP::SSL::port, ACE_OS::sprintf(), ssl_component_, and ACE_OS::strlen().

Referenced by TAO::SSLIOP::Connector::ssliop_connect().

{
  size_t actual_len =
    ACE_OS::strlen (this->iiop_endpoint_->host ()) // chars in host name
    + sizeof (':')                                 // delimiter
    + ACE_OS::strlen ("65536")                     // max port
    + sizeof ('\0');

  if (length < actual_len)
    return -1;

  ACE_OS::sprintf (buffer,
                   "%s:%d",
                   this->iiop_endpoint_->host (),
                   this->ssl_component_.port);

  return 0;
}

ACE_INLINE TAO::SSLIOP::OwnCredentials * TAO_SSLIOP_Endpoint::credentials

(

void

)

const

Get the credentials for this endpoint.

Note:

This method does not follow C++ mapping memory management rules. Specifically, no duplication or reference counting occurs in this method. This is so that no additional locks occur when checking the transport cache.

Definition at line 59 of file SSLIOP_Endpoint.inl.

References credentials_, and TAO_Pseudo_Var_T< T >::in().

Referenced by TAO_SSLIOP_Synthetic_Endpoint::duplicate().

{
  return this->credentials_.in ();
}

ACE_INLINE int TAO_SSLIOP_Endpoint::credentials_set

(

void

)

const

Credentials are not supplied by the constructor, and it is valid to have a nil credential, for instance if the SSL_use_certificate() method returns 0. Therefore it is necessary to have a new method to distinguish between a credential that is nil because it has not been set, vs one that was set to nil explicitly.

Definition at line 65 of file SSLIOP_Endpoint.inl.

References credentials_set_.

Referenced by TAO::SSLIOP::Connector::ssliop_connect().

{
  return this->credentials_set_;
}

TAO_Endpoint * TAO_SSLIOP_Endpoint::duplicate

(

void

)

[virtual]

Return a copy of the corresponding endpoints by allocating memory.

Implements TAO_Endpoint.

Reimplemented in TAO_SSLIOP_Synthetic_Endpoint.

Definition at line 213 of file SSLIOP_Endpoint.cpp.

References ACE_NEW_RETURN, TAO_Endpoint::hash_val_, iiop_endpoint(), and set_sec_attrs().

{
  TAO_SSLIOP_Endpoint *endpoint = 0;

  // @@ We need to set the priority of the newly formed endpoint. It
  // shouldnt be a problem as long as SSL is not used with RTCORBA.
  ACE_NEW_RETURN (endpoint,
                  TAO_SSLIOP_Endpoint (&this->ssl_component_,
                                         0),
                  0);

  if (this->credentials_set_)
    endpoint->set_sec_attrs (this->qop_,this->trust_, this->credentials_.in());

  endpoint->iiop_endpoint (this->iiop_endpoint_, true);
  endpoint->hash_val_ = this->hash_val_;
  return endpoint;
}

CORBA::ULong TAO_SSLIOP_Endpoint::hash

(

void

)

[virtual]

Return a hash value for this object. Note that only the IP address and port are used to generate the hash value. This may cause a few more hash table collisions in the transport cache, because a synthesized SSLIOP endpoints for an address will have the same hash value as a fully qualified one. The redeeming feature is that it makes / bi-directional SSLIOP work by allowing descendent class (Synthetic_Endpoint) instances to be used as keys in the cache manager and match other fully qualified endpoint. (which were used earlier to cache a particular transport)

Implements TAO_Endpoint.

Definition at line 233 of file SSLIOP_Endpoint.cpp.

References ACE_GUARD_RETURN, ACE_INET_Addr::hash(), TAO_Endpoint::hash_val_, object_addr(), SSLIOP::SSL::port, ssl_component_, and TAO_SYNCH_MUTEX.

Referenced by TAO_SSLIOP_Synthetic_Endpoint::duplicate().

{
  // there is actually the potential for a race of the inverse case,
  // since setting the security attributes will reset the hash_val_,
  // it is possible this test to pass, but then have the hash reset
  // before the value is returned.
  if (this->hash_val_ != 0)
    return this->hash_val_;

  // Do this with no locks held, as it may try to acquire it, too.
  const ACE_INET_Addr &oaddr = this->object_addr();

  { // nested scope for the lock
    ACE_GUARD_RETURN (TAO_SYNCH_MUTEX,
                      guard,
                      this->addr_lookup_lock_,
                      this->hash_val_);
    // .. DCL
    if (this->hash_val_ != 0)
      return this->hash_val_;


    // Note that we are not using the underlying IIOP endpoint's hash
    // value in order to avoid the influence of the IIOP port number,
    // since it is ignored anyway. When it features a
    // purely fictional port number, as when accepting an SSL
    // connection, the unsecured port is undefined and
    // had we used it in computing the hash it would have broken the
    // bi-directional support - as the 'guessed' IIOP port value will
    // hardly match the one specified in the bi-dir service context.
    this->hash_val_ =
      oaddr.hash ()
      + this->ssl_component_.port;
  }

  return this->hash_val_;
}

ACE_INLINE void TAO_SSLIOP_Endpoint::iiop_endpoint	(	TAO_IIOP_Endpoint *	endpoint,
		bool	destroy
	)

Mutator to our IIOP counterpart.

Parameters:

	endpoint	The new endpoint
	destroy	If set to true, the TAO::SSLIOP::Endpoint object retains ownership of the given TAO_IIOP_Endpoint.

Definition at line 15 of file SSLIOP_Endpoint.inl.

References destroy_iiop_endpoint_, TAO_IIOP_Endpoint::duplicate(), iiop_endpoint(), and iiop_endpoint_.

{
  if (iiop_endpoint != 0)
    {
      TAO_IIOP_Endpoint *new_endpoint = 0;

      if (destroy)
        {
          TAO_Endpoint *endpoint = iiop_endpoint->duplicate ();

          new_endpoint = dynamic_cast<TAO_IIOP_Endpoint *> (endpoint);

        }
      else
        new_endpoint = iiop_endpoint;

      if (this->destroy_iiop_endpoint_)
        delete this->iiop_endpoint_;

      this->iiop_endpoint_ = new_endpoint;
      this->destroy_iiop_endpoint_ = destroy;
    }
}

TAO_BEGIN_VERSIONED_NAMESPACE_DECL ACE_INLINE TAO_IIOP_Endpoint * TAO_SSLIOP_Endpoint::iiop_endpoint

(

void

)

const

Accessor to our IIOP counterpart.

Definition at line 9 of file SSLIOP_Endpoint.inl.

References iiop_endpoint_.

Referenced by TAO_SSLIOP_Profile::add_endpoint(), TAO_SSLIOP_Profile::decode(), TAO_SSLIOP_Synthetic_Endpoint::duplicate(), duplicate(), TAO::SSLIOP::Connector::iiop_connect(), iiop_endpoint(), TAO::SSLIOP::Acceptor::is_collocated(), operator=(), TAO_SSLIOP_Profile::parse_string(), TAO_SSLIOP_Profile::remove_endpoint(), and TAO_SSLIOP_Profile::TAO_SSLIOP_Profile().

{
  return this->iiop_endpoint_;
}

CORBA::Boolean TAO_SSLIOP_Endpoint::is_equivalent

(

const TAO_Endpoint *

other_endpoint

)

[virtual]

Return true if this endpoint is equivalent to other_endpoint The relationship is defined as equivalency of their qop, hostname and ssl ports (if non-zero). Two endpoints may be equivalent even if their iiop counterparts are not. In fact, there are cases (as with the LPL processing) when those counterparts are not known at all.

Implements TAO_Endpoint.

Reimplemented in TAO_SSLIOP_Synthetic_Endpoint.

Definition at line 174 of file SSLIOP_Endpoint.cpp.

References CORBA::is_nil(), ACE_OS::strcmp(), and trust_.

{
  TAO_Endpoint *endpt = const_cast<TAO_Endpoint *> (other_endpoint);

  TAO_SSLIOP_Endpoint *endpoint =
    dynamic_cast<TAO_SSLIOP_Endpoint *> (endpt);

  if (endpoint == 0)
    return 0;

  ::Security::EstablishTrust t = endpoint->trust ();

  if ((this->ssl_component_.port != 0
       && endpoint->ssl_component_.port != 0
       && this->ssl_component_.port != endpoint->ssl_component_.port)
      || this->qop_ != endpoint->qop ()
      || this->trust_.trust_in_target != t.trust_in_target
      || this->trust_.trust_in_client != t.trust_in_client
      || (!CORBA::is_nil (this->credentials_.in ())
          && !(*this->credentials_.in () == *endpoint->credentials ())))
  {
    return 0;
  }

  // Comparing the underlying iiop endpoints is wrong, as their port
  // numbers often may not make sense. Or may not being used anyway.
  // Therefore, we only need to directly compare the hosts. See also the
  // comments in the hash() method.
  if (this->iiop_endpoint() == 0 || endpoint->iiop_endpoint() == 0)
    return 0;

  if ((ACE_OS::strcmp (this->iiop_endpoint()->host (),
                       endpoint->iiop_endpoint()->host ()) != 0))
    return 0;

  return 1;
}

TAO_Endpoint * TAO_SSLIOP_Endpoint::next

(

void

)

[virtual]

Implements TAO_Endpoint.

Definition at line 168 of file SSLIOP_Endpoint.cpp.

References next_.

{
  return this->next_;
}

const ACE_INET_Addr & TAO_SSLIOP_Endpoint::object_addr

(

void

)

const

Return the SSLIOP-specific ACE_INET_Addr.

Definition at line 273 of file SSLIOP_Endpoint.cpp.

References ACE_GUARD_RETURN, AF_INET, ACE_Addr::get_type(), object_addr_, and TAO_SYNCH_MUTEX.

Referenced by hash(), and TAO::SSLIOP::Connector::ssliop_connect().

{
  // The object_addr_ is initialized here, rather than at IOR decode
  // time for several reasons:
  //   1. A request on the object may never be invoked.
  //   2. The DNS setup may have changed dynamically.
  //   ...etc..

  // Double checked locking optimization.
  if (this->object_addr_.get_type () != AF_INET
#if defined (ACE_HAS_IPV6)
      && this->object_addr_.get_type () != AF_INET6
#endif /* ACE_HAS_IPV6 */
     )
    {
      const ACE_INET_Addr &iiop_addr = this->iiop_endpoint_->object_addr ();

      ACE_GUARD_RETURN (TAO_SYNCH_MUTEX,
                        guard,
                        this->addr_lookup_lock_,
                        this->object_addr_);

      if (this->object_addr_.get_type () != AF_INET
#if defined (ACE_HAS_IPV6)
          && this->object_addr_.get_type () != AF_INET6
#endif /* ACE_HAS_IPV6 */
     )
        {
          this->object_addr_ = iiop_addr;
          this->object_addr_.set_port_number (this->ssl_component_.port);
        }
    }

  return this->object_addr_;
}

TAO_SSLIOP_Endpoint & TAO_SSLIOP_Endpoint::operator=

(

const TAO_SSLIOP_Endpoint &

other

)

Need to have an assignment operator since the SSLIOP_Profile class may have to reorder its list of endpoints based on filtering by the EndpointPolicy.

Definition at line 91 of file SSLIOP_Endpoint.cpp.

References destroy_iiop_endpoint_, iiop_endpoint(), iiop_endpoint_, next_, object_addr_, qop_, ssl_component_, and trust_.

{
  this->object_addr_ = other.object_addr_;
  this->qop_ = other.qop_;
  this->trust_ = other.trust_;
  this->ssl_component_ = other.ssl_component_;

  this->next_ = 0; // do not copy list membership, since we are only cloning the values

  this->iiop_endpoint(other.iiop_endpoint_,
                      other.destroy_iiop_endpoint_);
  return *this;
}

ACE_INLINE::Security::QOP TAO_SSLIOP_Endpoint::qop

(

void

)

const

Get the Quality-of-Protection settings for this endpoint.

Definition at line 47 of file SSLIOP_Endpoint.inl.

References qop_.

{
  return this->qop_;
}

void TAO_SSLIOP_Endpoint::set_sec_attrs	(	::Security::QOP	qop,
		const ::Security::EstablishTrust &	trust,
		const TAO::SSLIOP::OwnCredentials_ptr	creds
	)

Set the Quality-of-Protection, establishment of trust, and credentials for this endpoint. This is all done in one function so that the guard may be used uniformly.

Definition at line 310 of file SSLIOP_Endpoint.cpp.

References TAO::SSLIOP::OwnCredentials::_duplicate(), ACE_GUARD, credentials_, credentials_set_, TAO_Endpoint::hash_val_, qop_, TAO_SYNCH_MUTEX, and trust_.

Referenced by TAO_SSLIOP_Synthetic_Endpoint::duplicate(), duplicate(), and TAO::SSLIOP::Connector::ssliop_connect().

{
  if (this->credentials_set_)
    return;

  ACE_GUARD (TAO_SYNCH_MUTEX,
             guard,
             this->addr_lookup_lock_);

  // double-check
  if (this->credentials_set_)
    return;

  this->qop_ = q;
  this->trust_ = t;
  this->credentials_ = TAO::SSLIOP::OwnCredentials::_duplicate (c);
  this->credentials_set_ = 1;

  // reset the hash value to force a recomputation.
  this->hash_val_ = 0;
}

ACE_INLINEconst ::SSLIOP::SSL & TAO_SSLIOP_Endpoint::ssl_component

(

void

)

const

Return SSL component corresponding to this endpoint.

Definition at line 41 of file SSLIOP_Endpoint.inl.

References ssl_component_.

Referenced by TAO::SSLIOP::Connector::connect(), TAO::SSLIOP::Connector::iiop_connect(), TAO_SSLIOP_Synthetic_Endpoint::is_equivalent(), and TAO::SSLIOP::Connector::ssliop_connect().

{
  return this->ssl_component_;
}

ACE_INLINE::Security::EstablishTrust TAO_SSLIOP_Endpoint::trust

(

void

)

const

Get the establishment of trust settings for this endpoint.

Definition at line 53 of file SSLIOP_Endpoint.inl.

References trust_.

Referenced by TAO_SSLIOP_Synthetic_Endpoint::duplicate().

{
  return this->trust_;
}

---

Friends And Related Function Documentation

friend class TAO_SSLIOP_Profile [friend]

Definition at line 59 of file SSLIOP_Endpoint.h.

---

Member Data Documentation

TAO::SSLIOP::OwnCredentials_var TAO_SSLIOP_Endpoint::credentials_ [private]

SSLIOP-specific credentials for this endpoint object.

Definition at line 198 of file SSLIOP_Endpoint.h.

Referenced by credentials(), and set_sec_attrs().

int TAO_SSLIOP_Endpoint::credentials_set_ [private]

A flag indicating that credentials_ was explicitly initialized.

Definition at line 201 of file SSLIOP_Endpoint.h.

Referenced by credentials_set(), and set_sec_attrs().

bool TAO_SSLIOP_Endpoint::destroy_iiop_endpoint_ [private]

Flag that determines whether or not the iiop_endpoint_ member is deallocated with delete().

Definition at line 189 of file SSLIOP_Endpoint.h.

Referenced by iiop_endpoint(), and operator=().

TAO_IIOP_Endpoint* TAO_SSLIOP_Endpoint::iiop_endpoint_ [private]

IIOP counterpart.

Since SSLIOP is an 'extension' of IIOP, each SSLIOP_Endpoint contains SSL-specific information plus a pointer to the IIOP_Endpoint containing the IIOP portion of our address.

Definition at line 185 of file SSLIOP_Endpoint.h.

Referenced by iiop_endpoint(), operator=(), and ~TAO_SSLIOP_Endpoint().

TAO_SSLIOP_Endpoint* TAO_SSLIOP_Endpoint::next_ [private]

IIOP Endpoints can be stringed into a list. Return the next endpoint in the list, if any.

Definition at line 177 of file SSLIOP_Endpoint.h.

Referenced by TAO_SSLIOP_Profile::add_endpoint(), TAO_SSLIOP_Profile::do_is_equivalent(), TAO_SSLIOP_Profile::encode_endpoints(), next(), operator=(), and TAO_SSLIOP_Profile::remove_endpoint().

ACE_INET_Addr TAO_SSLIOP_Endpoint::object_addr_ [mutable, private]

Cached instance of ACE_INET_Addr for use in making invocations, etc.

Definition at line 173 of file SSLIOP_Endpoint.h.

Referenced by object_addr(), operator=(), and TAO_SSLIOP_Endpoint().

::Security::QOP TAO_SSLIOP_Endpoint::qop_ [private]

Quailty-of-Protection settings for this endpoint object.

Definition at line 192 of file SSLIOP_Endpoint.h.

Referenced by operator=(), qop(), and set_sec_attrs().

::SSLIOP::SSL TAO_SSLIOP_Endpoint::ssl_component_ [protected]

Cache the SSL tagged component in a decoded format. Notice that we do not need to marshal this object!

Definition at line 167 of file SSLIOP_Endpoint.h.

Referenced by addr_to_string(), hash(), operator=(), TAO_SSLIOP_Profile::parse_string(), ssl_component(), TAO_SSLIOP_Endpoint(), and TAO_SSLIOP_Synthetic_Endpoint::TAO_SSLIOP_Synthetic_Endpoint().

::Security::EstablishTrust TAO_SSLIOP_Endpoint::trust_ [private]

Establishment of trust settings for this endpoint object.

Definition at line 195 of file SSLIOP_Endpoint.h.

Referenced by is_equivalent(), operator=(), set_sec_attrs(), TAO_SSLIOP_Endpoint(), and trust().

---

The documentation for this class was generated from the following files:

• SSLIOP_Endpoint.h
• SSLIOP_Endpoint.cpp
• SSLIOP_Endpoint.inl

---