#include <QtCrypto>
Inheritance diagram for QCA::SASL:
Public Types | |
enum | Error { ErrorInit, ErrorHandshake, ErrorCrypt } |
enum | AuthCondition { AuthFail, NoMechanism, BadProtocol, BadServer, BadAuth, NoAuthzid, TooWeak, NeedEncrypt, Expired, Disabled, NoUser, RemoteUnavailable } |
enum | AuthFlags { AuthFlagsNone = 0x00, AllowPlain = 0x01, AllowAnonymous = 0x02, RequireForwardSecrecy = 0x04, RequirePassCredentials = 0x08, RequireMutualAuth = 0x10, RequireAuthzidSupport = 0x20 } |
enum | ClientSendMode { AllowClientSendFirst, DisableClientSendFirst } |
enum | ServerSendMode { AllowServerSendLast, DisableServerSendLast } |
Public Member Functions | |
SASL (QObject *parent=0, const QString &provider=QString()) | |
void | reset () |
void | setConstraints (AuthFlags f, SecurityLevel s=SL_None) |
void | setConstraints (AuthFlags f, int minSSF, int maxSSF) |
void | setLocalAddress (const QString &addr, quint16 port) |
void | setRemoteAddress (const QString &addr, quint16 port) |
void | setExternalAuthId (const QString &authid) |
void | setExternalSSF (int strength) |
void | startClient (const QString &service, const QString &host, const QStringList &mechlist, ClientSendMode mode=AllowClientSendFirst) |
void | startServer (const QString &service, const QString &host, const QString &realm, ServerSendMode mode=DisableServerSendLast) |
void | putServerFirstStep (const QString &mech) |
void | putServerFirstStep (const QString &mech, const QByteArray &clientInit) |
void | putStep (const QByteArray &stepData) |
QString | mechanism () const |
QStringList | mechanismList () const |
QStringList | realmList () const |
int | ssf () const |
Error | errorCode () const |
AuthCondition | authCondition () const |
void | setUsername (const QString &user) |
void | setAuthzid (const QString &auth) |
void | setPassword (const SecureArray &pass) |
void | setRealm (const QString &realm) |
void | continueAfterParams () |
void | continueAfterAuthCheck () |
virtual int | bytesAvailable () const |
virtual int | bytesOutgoingAvailable () const |
virtual void | write (const QByteArray &a) |
virtual QByteArray | read () |
virtual void | writeIncoming (const QByteArray &a) |
virtual QByteArray | readOutgoing (int *plainBytes=0) |
virtual int | convertBytesWritten (qint64 encryptedBytes) |
void | serverStarted () |
void | nextStep (const QByteArray &stepData) |
void | needParams (const QCA::SASL::Params ¶ms) |
void | authCheck (const QString &user, const QString &authzid) |
void | authenticated () |
Public Attributes | |
Q_SIGNALS | __pad0__: void clientStarted(bool clientInit |
Q_SIGNALS const QByteArray & | clientInitData |
Friends | |
class | Private |
Classes | |
class | Params |
Parameter flags for the SASL authentication. More... |
This class implements the Simple Authenication and Security Layer protocol, which is described in RFC2222 - see http://www.ietf.org/rfc/rfc2222.txt.
As the name suggests, SASL provides authentication (eg, a "login" of some form), for a connection oriented protocol, and can also provide protection for the subsequent connection.
The SASL protocol is designed to be extensible, through a range of "mechanisms", where a mechanism is the actual authentication method. Example mechanisms include Anonymous, LOGIN, Kerberos V4, and GSSAPI. Mechanisms can be added (potentially without restarting the server application) by the system administrator.
It is important to understand that SASL is neither "network aware" nor "protocol aware". That means that SASL does not understand how the client connects to the server, and SASL does not understand the actual application protocol.
saslservtest.cpp, and sasltest.cpp.
|
Possible errors that may occur when using SASL.
|
|
|
Authentication requirement flag values.
|
|
Mode options for client side sending.
|
|
Mode options for server side sending.
|
|
Standard constructor.
|
|
Reset the SASL mechanism.
|
|
Specify connection constraints. SASL supports a range of authentication requirements, and a range of security levels. This method allows you to specify the requirements for your connection.
|
|
This is an overloaded member function, provided for convenience. It differs from the above function only in what argument(s) it accepts. Unless you have a specific reason for directly specifying a strength factor, you probably should use the method above.
|
|
Specify the local address.
|
|
Specify the peer address.
|
|
Specify the id of the externally secured connection.
|
|
Specify a security strength factor for an externally secured connection.
|
|
Initialise the client side of the connection. startClient must be called on the client side of the connection. clientStarted will be emitted when the operation is completed.
|
|
Initialise the server side of the connection. startServer must be called on the server side of the connection. serverStarted will be emitted when the operation is completed.
|
|
Process the first step in server mode (server). Call this with the mechanism selected by the client. If there is initial client data, call the other version of this function instead.
|
|
Process the first step in server mode (server). Call this with the mechanism selected by the client, and initial client data. If there is no initial client data, call the other version of this function instead. |
|
Process an authentication step. Call this with authentication data received from the network. The only exception is the first step in server mode, in which case putServerFirstStep must be called.
|
|
Return the mechanism selected (client).
|
|
Return the mechanism list (server).
|
|
Return the realm list, if available (client).
|
|
Return the security strength factor of the connection.
|
|
Return the error code.
|
|
Return the reason for authentication failure.
|
|
Specify the username to use in authentication.
|
|
Specify the authorization identity to use in authentication.
|
|
Specify the password to use in authentication.
|
|
Specify the realm to use in authentication.
|
|
Continue negotiation after parameters have been set (client).
|
|
Continue negotiation after auth ids have been checked (server).
|
|
Returns the number of bytes available to be read() on the application side.
Implements QCA::SecureLayer. |
|
Returns the number of bytes available to be readOutgoing() on the network side.
Implements QCA::SecureLayer. |
|
This method writes unencrypted (plain) data to the SecureLayer implementation. You normally call this function on the application side. Implements QCA::SecureLayer.
|
|
This method reads decrypted (plain) data from the SecureLayer implementation. You normally call this function on the application side after receiving the readyRead() signal. Implements QCA::SecureLayer.
|
|
This method accepts encoded (typically encrypted) data for processing. You normally call this function using data read from the network socket (e.g. using QTcpSocket::readAll()) after receiving a signal that indicates that the socket has data to read. Implements QCA::SecureLayer.
|
|
This method provides encoded (typically encrypted) data. You normally call this function to get data to write out to the network socket (e.g. using QTcpSocket::write()) after receiving the readyReadOutgoing() signal. Implements QCA::SecureLayer.
|
|
Convert encrypted bytes written to plain text bytes written.
Implements QCA::SecureLayer. |
|
This signal is emitted after the server has been successfully started.
|
|
This signal is emitted when there is data required to be sent over the network to complete the next step in the authentication process.
|
|
This signal is emitted when the client needs additional parameters. Set parameter values as necessary and then call continueAfterParams(). |
|
This signal is emitted when the server needs to perform the authentication check. If the user and authzid are valid, call continueAfterAuthCheck(). |
|
This signal is emitted when authentication is complete.
|