Skip to content

Commit 8f4886f

Browse files
phuedxphuedx
committed
Add examples for the ZMQCert and ZMQAuth classes
grasslands.php, strawhouse.php, woodhouse.php, stonehouse.php, and ironhouse.php are faithful translations of Pieter Hintjens' examples of the same names, which he originally published as part of his blog post Using ZeroMQ Security (part 2)[0]. [0] http://hintjens.com/blog:49
1 parent bcd105c commit 8f4886f

File tree

7 files changed

+179
-0
lines changed

7 files changed

+179
-0
lines changed

‎examples/README

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
grasslands.php, strawhouse.php, woodhouse.php, stonehouse.php, and
2+
ironhouse.php are faithful translations of Pieter Hintjens' examples of
3+
the same names, which he originally published as part of his blog post
4+
Using ZeroMQ Security (part 2)[0].
5+
6+
[0] http://hintjens.com/blog:49

‎examples/grasslands.php

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<?php
2+
3+
// The Grasslands Pattern
4+
//
5+
// The Classic ZeroMQ model, plain text with no protection at all.
6+
7+
// Create context
8+
$ctx = new ZMQContext();
9+
10+
// Create and bind server socket
11+
$server = $ctx->getSocket(ZMQ::SOCKET_PUSH);
12+
$server->bind('tcp://*:9000');
13+
14+
// Create and connect client socket
15+
$client = $ctx->getSocket(ZMQ::SOCKET_PULL);
16+
$client->connect('tcp://127.0.0.1:9000');
17+
18+
// Send a single message from server to client
19+
$server->send( 'Hello' );
20+
$message = $client->recv();
21+
assert($message === 'Hello');
22+
echo "Grasslands test OK\n";

‎examples/ironhouse.php

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?php
2+
3+
// The Ironhouse Pattern
4+
//
5+
// Security doesn't get any stronger than this. An attacker is going to
6+
// have to break into your systems to see data before/after encryption.
7+
8+
// Create context and start authentication engine
9+
$ctx = new ZMQContext();
10+
$auth = new ZMQAuth($ctx);
11+
$auth->allow('127.0.0.1');
12+
13+
// Tell the authenticator how to handle CURVE requests
14+
$auth->configure(ZMQAuth::AUTH_TYPE_CURVE, '*', '.curve');
15+
16+
// We'll generate a new client certificate and save the public part
17+
// in the certificate store (in practice this would be done by hand
18+
// or some out-of-band process).
19+
$clientCert = new ZMQCert();
20+
mkdir('.curve');
21+
$clientCert->setMeta('name', 'Client test certificate');
22+
$clientCert->savePublic('.curve/testcert.pub');
23+
24+
// Prepare the server certificate as we did in Stonehouse
25+
$serverCert = new ZMQCert();
26+
$serverKey = $serverCert->getPublicTxt();
27+
28+
// Create and bind server socket
29+
$server = $ctx->getSocket(ZMQ::SOCKET_PUSH);
30+
$serverCert->apply($server);
31+
$server->setSockOpt(ZMQ::SOCKOPT_CURVE_SERVER, true);
32+
$server->bind('tcp://127.0.0.1:9000');
33+
34+
// Create and connect client socket
35+
$client = $ctx->getSocket(ZMQ::SOCKET_PULL);
36+
$clientCert->apply($client);
37+
$client->setSockOpt(ZMQ::SOCKOPT_CURVE_SERVERKEY, $serverKey);
38+
$client->connect('tcp://127.0.0.1:9000');
39+
40+
// Send a single message from server to client
41+
$server->send('Hello');
42+
$message = $client->recv();
43+
assert($message === 'Hello');
44+
echo "Ironhouse test OK\n";

‎examples/passwords

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
guest=guest
2+
tourist=1234
3+
admin=secret

‎examples/stonehouse.php

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?php
2+
3+
// The Stonehouse Pattern
4+
//
5+
// Where we allow any clients to connect, but we promise clients
6+
// that we are who we claim to be, and our conversations won't be
7+
// tampered with or modified, or spied on.
8+
9+
// Create context and start authentication engine
10+
$ctx = new ZMQContext();
11+
$auth = new ZMQAuth($ctx);
12+
$auth->allow('127.0.0.1');
13+
14+
// Tell the authenticator how to handle CURVE requests
15+
$auth->configure(ZMQAuth::AUTH_TYPE_CURVE, '*', ZMQ::CURVE_ALLOW_ANY);
16+
17+
// We need two certificates, one for the client and one for
18+
// the server. The client must know the server's public key
19+
// to make a CURVE connection.
20+
$clientCert = new ZMQCert();
21+
$serverCert = new ZMQCert();
22+
$serverKey = $serverCert->getPublicTxt();
23+
24+
// Create and bind server socket
25+
$server = $ctx->getSocket(ZMQ::SOCKET_PUSH);
26+
$serverCert->apply($server);
27+
$server->setSockOpt(ZMQ::SOCKOPT_CURVE_SERVER, true);
28+
$server->bind('tcp://*:9000');
29+
30+
// Create and connect client socket
31+
$client = $ctx->getSocket(ZMQ::SOCKET_PULL);
32+
$clientCert->apply($client);
33+
$client->setSockOpt(ZMQ::SOCKOPT_CURVE_SERVERKEY, $serverKey);
34+
$client->connect('tcp://127.0.0.1:9000');
35+
36+
// Send a single message from server to client
37+
$server->send('Hello');
38+
$message = $client->recv();
39+
assert($message === 'Hello');
40+
echo "Stonehouse test OK\n";

‎examples/strawhouse.php

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<?php
2+
3+
// The Strawhouse Pattern
4+
//
5+
// We allow or deny clients according to their IP address. It may keep
6+
// spammers and itiots away, but won't stop a real attacker for more
7+
// than a heartbeat.
8+
9+
// Create context
10+
$ctx = new ZMQContext();
11+
12+
// Start an authentication engine for this context. This engine
13+
// allows or denies incoming connections (talking to the libzmq
14+
// core over a protocol called ZAP).
15+
$auth = new ZMQAuth($ctx);
16+
17+
// Whitelist our address; any other address will be rejected
18+
$auth->allow('127.0.0.1');
19+
20+
// Create and bind server socket
21+
$server = $ctx->getSocket(ZMQ::SOCKET_PUSH);
22+
$server->setSockOpt(ZMQ::SOCKOPT_ZAP_DOMAIN, 'global');
23+
$server->bind('tcp://*:9000');
24+
25+
// Create and connect client socket
26+
$client = $ctx->getSocket(ZMQ::SOCKET_PULL);
27+
$client->connect('tcp://127.0.0.1:9000');
28+
29+
// Send a single message from server to client
30+
$server->send('Hello');
31+
$message = $client->recv();
32+
assert($message === 'Hello');
33+
echo "Strawhouse test OK\n";

‎examples/woodhouse.php

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<?php
2+
3+
// The Woodhouse Pattern
4+
//
5+
// It may keep some malicious people out but all it takes is a bit
6+
// of network sniffing, and they'll be able to fake their way in.
7+
8+
// Create context and start authentication engine
9+
$ctx = new ZMQContext();
10+
$auth = new ZMQAuth($ctx);
11+
$auth->allow('127.0.0.1');
12+
13+
// Tell the authenticator how to handle PLAIN requests
14+
$auth->configure(ZMQAuth::AUTH_TYPE_PLAIN, '*', __DIR__ . '/passwords');
15+
16+
// Create and bind server socket
17+
$server = $ctx->getSocket(ZMQ::SOCKET_PUSH);
18+
$server->setSockOpt(ZMQ::SOCKOPT_PLAIN_SERVER, true);
19+
$server->bind('tcp://*:9000');
20+
21+
// Create and connect client socket
22+
$client = $ctx->getSocket(ZMQ::SOCKET_PULL);
23+
$client->setSockOpt(ZMQ::SOCKOPT_PLAIN_USERNAME, 'admin');
24+
$client->setSockOpt(ZMQ::SOCKOPT_PLAIN_PASSWORD, 'secret');
25+
$client->connect('tcp://127.0.0.1:9000');
26+
27+
// Send a single message from server to client
28+
$server->send('Hello');
29+
$message = $client->recv();
30+
assert($message === 'Hello');
31+
echo "Woodhouse test OK\n";

0 commit comments

Comments
 (0)