Mads::ZapAuth Class Reference

In-process ZAP (ZeroMQ Authentication Protocol, RFC 27) handler. More...

#include <zap_auth.hpp>

Public Member Functions
	ZapAuth (zmq::context_t &context)
	Construct a handler for the given context. Does not bind yet.
	~ZapAuth ()
	ZapAuth (const ZapAuth &)=delete
ZapAuth &	operator= (const ZapAuth &)=delete
	ZapAuth (ZapAuth &&)=delete
ZapAuth &	operator= (ZapAuth &&)=delete
void	start ()
	Bind the ZAP endpoint and start servicing requests.
void	stop ()
	Stop servicing requests and join the worker thread.
void	set_verbose (bool verbose)
	Log every authentication decision to stdout.
void	configure_domain (const std::string &domain)
	Restrict the handler to one ZAP domain.
void	allow (const std::string &address)
	Add an address to the whitelist.
void	configure_curve (const std::string &z85_public_key)
	Add a client public key to the CURVE allowlist.
int	granted () const
	Number of requests granted so far (test/diagnostic aid).
int	denied () const
	Number of requests denied so far (test/diagnostic aid).

Static Public Attributes
static constexpr const char *	endpoint = "inproc://zeromq.zap.01"
	The well-known ZAP endpoint mandated by RFC 27.

Detailed Description

In-process ZAP (ZeroMQ Authentication Protocol, RFC 27) handler.

libzmq delegates every incoming connection on a socket that has a security mechanism enabled to a REP socket bound to inproc://zeromq.zap.01 inside the same context. This class owns that socket and the thread servicing it.

This replaces zmqpp::auth, which cppzmq has no equivalent for. It is deliberately limited to what MADS actually needs: an address whitelist and a CURVE client-key allowlist.

Ordering matters for security: libzmq only enforces authentication while a handler is bound, so start() completes the bind() before it returns and before any protected socket is bound or connected. Configuration calls are safe after start(); they are mutex-protected against the worker thread.

Only one handler may exist per zmq::context_t (the ZAP endpoint is a single well-known inproc address).

Definition at line 54 of file zap_auth.hpp.

Constructor & Destructor Documentation

ZapAuth() [1/3]

Mads::ZapAuth::ZapAuth ( zmq::context_t &  context )

inlineexplicit

Construct a handler for the given context. Does not bind yet.

Parameters

context

The context whose sockets this handler will authenticate.

Definition at line 61 of file zap_auth.hpp.

~ZapAuth()

Mads::ZapAuth::~ZapAuth ( )

inline

Definition at line 63 of file zap_auth.hpp.

References stop().

ZapAuth() [2/3]

Mads::ZapAuth::ZapAuth ( const ZapAuth &  )

delete

ZapAuth() [3/3]

Mads::ZapAuth::ZapAuth ( ZapAuth &&  )

delete

Member Function Documentation

allow()

void Mads::ZapAuth::allow

(

const std::string &

address

)

Add an address to the whitelist.

While the whitelist is empty every peer address is acceptable. As soon as one address is added, any peer not on the list is rejected.

Parameters

address

The peer IP address to allow, e.g. "127.0.0.1".

Referenced by Mads::CurveAuth::setup_auth().

configure_curve()

void Mads::ZapAuth::configure_curve

(

const std::string &

z85_public_key

)

Add a client public key to the CURVE allowlist.

While the allowlist is empty every CURVE client is acceptable. As soon as one key is added, only those clients are accepted. The special value "*" accepts any CURVE client regardless of the rest of the list.

Parameters

z85_public_key

The client public key, Z85-encoded (40 characters).

Referenced by Mads::CurveAuth::setup_curve_server().

configure_domain()

void Mads::ZapAuth::configure_domain

(

const std::string &

domain

)

Restrict the handler to one ZAP domain.

Parameters

domain

The domain to serve; "*" (the default) serves every domain, matching how MADS configures it.

Referenced by Mads::CurveAuth::setup_auth().

denied()

int Mads::ZapAuth::denied ( ) const

inline

Number of requests denied so far (test/diagnostic aid).

Definition at line 127 of file zap_auth.hpp.

granted()

int Mads::ZapAuth::granted ( ) const

inline

Number of requests granted so far (test/diagnostic aid).

Definition at line 124 of file zap_auth.hpp.

operator=() [1/2]

ZapAuth & Mads::ZapAuth::operator= ( const ZapAuth &  )

delete

operator=() [2/2]

ZapAuth & Mads::ZapAuth::operator= ( ZapAuth &&  )

delete

set_verbose()

void Mads::ZapAuth::set_verbose ( bool  verbose )

inline

Log every authentication decision to stdout.

Definition at line 92 of file zap_auth.hpp.

Referenced by Mads::CurveAuth::setup_auth().

start()

void Mads::ZapAuth::start

(

)

Bind the ZAP endpoint and start servicing requests.

Blocks until the endpoint is bound, so that no unauthenticated connection can slip through before the handler is listening. Calling it more than once is a no-op.

Exceptions

zmq::error_t

if the ZAP endpoint cannot be bound (typically because another handler already owns it in this context).

Referenced by Mads::CurveAuth::setup_auth().

stop()

void Mads::ZapAuth::stop

(

)

Stop servicing requests and join the worker thread.

Idempotent; also called by the destructor. Unlike zmqpp's actor-based authenticator, teardown is deterministic and leaves no process-lifetime state behind.

Referenced by ~ZapAuth().

Member Data Documentation

endpoint

constexpr const char* Mads::ZapAuth::endpoint = "inproc://zeromq.zap.01"

staticconstexpr

The well-known ZAP endpoint mandated by RFC 27.

Definition at line 130 of file zap_auth.hpp.

---

The documentation for this class was generated from the following file:

• src/zap_auth.hpp