View All Attachments for Bug 195644

Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Obsolete attachments are hidden. To view all attachments (including obsolete) click here.

Attachment #77241
updated platform.execution patch	patch	2007-08-29 08:25:15 EDT	98.61 KB	no flags	Details

Attachment #77242
updated platform.common.ui patch	patch	2007-08-29 08:26:16 EDT	7.11 KB	no flags	Details

Attachment #77243
updated AC patch	patch	2007-08-29 08:26:42 EDT	31.48 KB	no flags	Details

Attachment #80051
Feature description document	text/html	2007-10-10 10:47:30 EDT	4.61 KB	no flags	Details

<!-- ----------------------------------------------------------------------------- -->
<!-- 
Project: Eclipse Test and Performance Tools Platform Project
-->
<!-- ----------------------------------------------------------------------------- -->

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
  <head>
    <title>TPTP feature bugzilla_number 195644</title>
    <meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
    <link rel="stylesheet" type="text/css" href="http://www.eclipse.org/tptp/eclipse_style.css" >   
  	<style>
</style>
  </head>
  <body>

<h1>TPTP feature: <a href="https://bugs.eclipse.org/bugs/show_bug.cgi?id=195644">195644</a></h1>
<table border="0" cellpadding="2" cellspacing="2">
	<tbody>
		<tr>
			<td width="100">Author:</td>
			<td>Igor Alelekov</td>
		</tr>
		<tr>
			<td width="100">email:</td>
			<td><a href="mailto:igor.alelekov@intel.com">igor.alelekov@intel.com</a></td>
		</tr>
		<tr>
			<td width="100">Last updated:</td>
			<td>
				<!--webbot bot="Timestamp" S-Type="EDITED" S-Format="%m/%d/%Y %H:%M:%S %Z" startspan -->10/08/2007 20:14:05 +0400<!--webbot bot="Timestamp" endspan i-checksum="37929" --></td>
		</tr>
	</tbody>
</table>
<br/>
<font color="red">Rough workload estimate in person weeks:</font>
<br/>
<table border="1">
	<tbody>
	<tr>
		<th>Process</th>
		<th>Sizing for openssl</th>
		<th>Sizing for JSSE</th>
		<th>Names of people doing the work</th>
	</tr>
	<tr>
		<td>Design</td>
		<td>done</td>
		<td>2</td>
		<td rowspan="4">&nbsp;</td>
	</tr>
	<tr>
		<td>Code</td>
		<td>0.5 for Windows</td>
		<td>8</td>
	</tr>
	<tr>
		<td>Test</td>
		<td>0.5 for Windows</td>
		<td>1</td>
	</tr>
	<tr>
		<td>Documentation</td>
		<td>&nbsp;</td>
		<td>&nbsp;</td>
	</tr>
	<tr>
		<td>Build and infrastructure</td>
		<td>&nbsp;</td>
		<td>&nbsp;</td>
		<td>&nbsp;</td>
	</tr>
	<tr>
		<td>Code review &amp; other committer work <br/>
			(e.g. check-in, contribution tracking) <br/>
			if this is to be contributed by someone who <br/>
			is not a committer in the component
		</td>
		<td>&nbsp;</td>
		<td>&nbsp;</td>
		<td>N/A - will be done by committer</td>
	</tr>
	<tr>
		<td><b><font color="red">Total</font></b></td>
		<td><b><font color="red">1</font></b></td>
		<td colspan="2"><b><font color="red">11</font></b></td>
	</tr>
	</tbody>
</table>
<br>
<h2>Requirement summary</h2>
<p>This feature should cover the work required to enhance TPTP to support 
secured connections.</p>

<h2>User interactions</h2>
<h4><i>User interface</i></h4>
<p>Should not change UI. For input of credentials, existing hyades forms could be used.</p>

<h4><i>Code interfaces</i></h4>
<p>Suggested minimal changes in API in client code in org.eclipse.tptp.platform.execution plugin:</p>
<p>- add method <i>boolean isAuthenticated()</i> to<i> 
org.eclipse.tptp.platform.execution.client.core.IAgentController</i></p>

<h2>Design summary</h2>
<p>Security features could be implemented by two ways: native implementation, using external ssl 
library and Java implementation, using JSSE.<p><u>1. Native implementation.</u><br>To 
support ssl connections, it is suggested to use an external library openssl. 
This library is preinstalled on most Linux builds and is available in source and 
binaries for Linux and Windows. Dynamic lazy loading of this library 
(implemented in the <a href="https://bugs.eclipse.org/bugs/show_bug.cgi?id=202638">202638</a>) will allow 
to use AC if the library is absent and 
security features are not required. On Windows, the same decision can be used: 
To activate security user just need to install openssl package. Other option is 
to use Win API to support ssl connections. Although, different 
implementation for each platform requires additional efforts for support.
<br>
This, native, implementation is already done and tested for Linux and has 
been checked into the CVS. Together with the native implementation of file 
services (<a href="https://bugs.eclipse.org/bugs/show_bug.cgi?id=196435">196435</a>), 
native implementation of security could give significant gain in 
performance.<p><u>2. Java implementation. </u><br>
Intended to use JSSE via JNI calls. This implementation has significant overhead: in memory - 280-440% (see the
<a href="https://bugs.eclipse.org/bugs/show_bug.cgi?id=196435">196435</a>) and in performance. JNI implementation is more difficult to debug. 
Implementation on AC side might be the same as in the old RAC, which uses JSSE. 
For client side code implemented in (1) might be used.</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
	</div>    
</div>

  </body>
</html>

Attachment #80132
patch to remove openssl dependency from 441	patch	2007-10-11 08:16:11 EDT	19.30 KB	no flags	Details

Attachment #80870
FDD for Pluggable Layer	text/html	2007-10-22 07:53:33 EDT	3.58 KB	no flags	Details

<!-- ----------------------------------------------------------------------------- -->
<!-- 
Project: Eclipse Test and Performance Tools Platform Project
-->
<!-- ----------------------------------------------------------------------------- -->

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
  <head>
    <title>TPTP feature bugzilla_number 165409</title>
    <meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
    <link rel="stylesheet" type="text/css" href="http://www.eclipse.org/tptp/eclipse_style.css" >   
  	<style>
</style>
  </head>
  <body>

<h1>TPTP feature: <a href="https://bugs.eclipse.org/bugs/show_bug.cgi?id=195644">195644</a></h1>
<table border="0" cellpadding="2" cellspacing="2">
	<tbody>
		<tr>
			<td width="100">Author:</td>
			<td>Igor Alelekov</td>
		</tr>
		<tr>
			<td width="100">email:</td>
			<td><a href="mailto:youremail@company.com">igor.alelekov@intel.com</a></td>
		</tr>
		<tr>
			<td width="100">Last updated:</td>
			<td>
				<!--webbot bot="Timestamp" S-Type="EDITED" S-Format="%m/%d/%Y %H:%M %Z" startspan -->10/22/2007 15:24 +0400<!--webbot bot="Timestamp" endspan i-checksum="28649" --></td>
		</tr>
	</tbody>
</table>
<br/>
<font color="red">Rough workload estimate in person weeks:</font>
<br/>
<table border="1">
	<tbody>
	<tr>
		<th>Process</th>
		<th>Sizing</th>
		<th>Names of people doing the work</th>
	</tr>
	<tr>
		<td>Design</td>
		<td>0.5</td>
		<td rowspan="4">&nbsp;</td>
	</tr>
	<tr>
		<td>Code</td>
		<td>1</td>
	</tr>
	<tr>
		<td>Test</td>
		<td>0.5</td>
	</tr>
	<tr>
		<td>Documentation</td>
		<td>0.2</td>
	</tr>
	<tr>
		<td>Build and infrastructure</td>
		<td>0</td>
		<td>&nbsp;</td>
	</tr>
	<tr>
		<td>Code review &amp; other committer work <br/>
			(e.g. check-in, contribution tracking) <br/>
			if this is to be contributed by someone who <br/>
			is not a committer in the component
		</td>
		<td>0</td>
		<td>N/A - will be done by committer</td>
	</tr>
	<tr>
		<td><b><font color="red">Total</font></b></td>
		<td colspan="2"><font color="#FF0000"><b>2.2</b></font></td>
	</tr>
	</tbody>
</table>
<br>
<h2>Requirement summary</h2>
<p>This feature should cover the work required to enhance TPTP Agent Controller to provide a pluggable layer for
 external ssl providers. Pluggable module with required ssl provider (JSSE, OpenSSL) should be
 loaded dynamically during AC startup. SSL provider to use should be set in AC configuration file.
</p>

<h2>User interactions</h2>

<h4><i>Code interfaces</i></h4>
<p>Should provide API to implement by pluggable modules.</p>

<h2>Design summary</h2>
Suggested the following AC actions to use and API to be implemented by ssl providers:
<ul>
	<li>Agent Controller processes the configuration file to get if security is 
	enabled, ssl provider to use and ssl provider's library&nbsp; to load.</li>
	<li>AC loads required library and initializes it with<b> sslInit()</b> 
	method.</li>
	<li>AC can use <b>sslGetProviderName()</b> and <b>sslGetProviderInfo()</b> to get information about this ssl 
	provider.</li>
	<li>With incoming client connection request, AC calls <b>sslAccept() </b>to 
	open new ssl session.</li>
	<li>AC uses <b>sslRead()</b> and <b>sslWrite()</b> methods for data 
	exchange with the client.</li>
	<li>AC uses <b>sslClose()</b> to close ssl session and free allocated 
	resources when the client disconnects.</li>
	</ul>
	All ssl specific things should be incapsulated into ssl providers and AC delegates all ssl processing to them.
	</div>    
</div>

  </body>
</html>

Attachment #84612
Pluggable layer implementation	patch	2007-12-06 04:09:57 EST	41.72 KB	no flags	Details

Attachment #84631
FD for Pluggable Layer	text/html	2007-12-06 10:32:11 EST	8.29 KB	no flags	Details

<!-- ----------------------------------------------------------------------------- -->
<!-- 
Project: Eclipse Test and Performance Tools Platform Project
-->
<!-- ----------------------------------------------------------------------------- -->

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
  <head>
    <title>TPTP feature bugzilla_number 195644</title>
    <meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
    <link rel="stylesheet" type="text/css" href="http://www.eclipse.org/tptp/eclipse_style.css" >   
  	<style>
</style>
  </head>
  <body>

<h1>TPTP feature: <a href="https://bugs.eclipse.org/bugs/show_bug.cgi?id=195644">195644</a></h1>
<table border="0" cellpadding="2" cellspacing="2">
	<tbody>
		<tr>
			<td width="100">Author:</td>
			<td>Igor Alelekov</td>
		</tr>
		<tr>
			<td width="100">email:</td>
			<td><a href="mailto:igor.alelekov@intel.com">igor.alelekov@intel.com</a></td>
		</tr>
		<tr>
			<td width="100">Last updated:</td>
			<td>
				<!--webbot bot="Timestamp" S-Type="EDITED" S-Format="%m/%d/%Y %H:%M %Z" startspan -->12/06/2007 17:28 +0300<!--webbot bot="Timestamp" endspan i-checksum="29237" --></td>
		</tr>
	</tbody>
</table>
<br/>
<font color="red">Rough workload estimate in person weeks:</font>
<br/>
<table border="1">
	<tbody>
	<tr>
		<th>Process</th>
		<th>Sizing</th>
		<th>Names of people doing the work</th>
	</tr>
	<tr>
		<td>Design</td>
		<td>0.5</td>
		<td rowspan="4">&nbsp;</td>
	</tr>
	<tr>
		<td>Code</td>
		<td>1</td>
	</tr>
	<tr>
		<td>Test</td>
		<td>0.5</td>
	</tr>
	<tr>
		<td>Documentation</td>
		<td>0.2</td>
	</tr>
	<tr>
		<td>Build and infrastructure</td>
		<td>0</td>
		<td>&nbsp;</td>
	</tr>
	<tr>
		<td>Code review &amp; other committer work <br/>
			(e.g. check-in, contribution tracking) <br/>
			if this is to be contributed by someone who <br/>
			is not a committer in the component
		</td>
		<td>0</td>
		<td>N/A - will be done by committer</td>
	</tr>
	<tr>
		<td><b><font color="red">Total</font></b></td>
		<td colspan="2"><font color="#FF0000"><b>2.2</b></font></td>
	</tr>
	</tbody>
</table>
<br>
<h2>Requirement summary</h2>
<p>This feature should cover the work required to enhance TPTP Agent Controller to provide a pluggable layer for
 external ssl providers. Pluggable module with required ssl provider (JSSE, OpenSSL) should be
 set in AC configuration file and should be loaded dynamically during AC startup.
</p>

<h2>Design summary</h2>
All ssl specific things should be incapsulated into ssl provider modules and AC will delegate all ssl 
processing to them. The pluggable layer dynamically loads ssl modules according to current configuration.
Suggested the following logic and API to be implemented by ssl providers:<br><br>
<ul><li><font size="3" face="Times New Roman"><b><u>Logic</u></b>. To simplify AC it is suggested don't add once more network port for ssl communications
	 but use single server port for all connections. To do this AC could create insecure ServerSocket
	 and listen to client requests on configured network port (10006 defaults) as before.
	 AC accepts insecure incoming connection and, if security is enabled, responses with CONNECTION_REFUSE
	 protocol message with SECURITY_REQUIRED reason. After that AC passes this socket to ssl module
	 for ssl handshaking over already established insecure connection. So pluggable ssl modules should
	 support two data exchange modes - secure and insecure. After accepting connection and before ssl
	 handshaking, module should use insecure mode, after handshaking - secure. It gives ability to do some
	 insecure negotiations (sending securityRequest..) before ssl handshaking. Clients, receiving
	 SECURITY_REQUIRED, mesage don't close the connection but use it for ssl handshaking as well.<br>
<br>In current implementation ServerSocket, listening to clients, is resided in
<i>Socket Transport Layer</i>.
	 But taking in account that pluggable modules may be native as weel as Java based, and we can't do 
	 ssl handshaking in Java over native AC's sockets, we will not create ServerSocket and accept 
	 insecure connections in AC. Instead of this, ServerSocket should reside in a pluggable module, 
	 which should be dynamically loaded if security is enabled. Note, when security is disabled, no pluggable
	 modules are loaded and clients are listened to in <i>Socket Transport Layer</i> as before.<br>
<br></font></li>
<li><font size="3" face="Times New Roman"><b><u>API</u></b>. It is suggested that the pluggable layer dynamically loads ssl provider modules and
	use the following API, which modules should provide: 
<ul>
	<li><font size="3" face="Times New Roman">int <b>sslInit</b>(log_service_t* logService, int portToListen) - initializes the 
		module and opens provided port to listen to client's requests. logService - pointer to the 
		structure providing common AC logging service. sslInit() returns 0 on success and -1 
		on initialization error;<br><br></font></li>
	<li><font size="3" face="Times New Roman">void* <b>sslAccept</b>() - accepts incoming insecure connection, initializes internal 
		connection resources and returns a connection reference. Connection reference is a pointer 
		to internal data of the pluggable module. It might be any structure or just an integer number;<br>
	<br></font></li>
	<li><font size="3" face="Times New Roman">int <b>sslHandshake</b>(void* con) - negotiates ssl connection over opened insecure 
		connection. Returns 0 on success and -1 on error. Parameter con - connection reference 
		given by sslAccept();<br><br></font></li>
	<li><font size="3" face="Times New Roman">int <b>sslRead</b>(void* con, char* buffer, int length) - reads data from the connection 
		into provided buffer. Before sslHandshake() is called, sslRead() reads from plain insecure socket, 
		after - uses ssl service to read. Returns the total number of bytes read into the buffer, 
		or -1 on error;<br><br></font></li>
	<li><font size="3" face="Times New Roman">int <b>sslWrite</b>(void* con, char* buffer, int length) - writes data to the connection. 
		Before sslHandshake() is called, sslWrite() writes to the plain insecure socket, after - using ssl service. 
		Returns the total number of written bytes, or -1 on error;<br><br>
	</font></li>
	<li><font size="3" face="Times New Roman">int <b>sslClose</b>(void* con) - closes connection and releases allocated connection 
		resources;<br><br></font></li>
	<li><font size="3" face="Times New Roman">int <b>sslReset</b>() - closes server socket, releases all internal allocated resources;<br>
	<br></font></li>
	<li><font size="3" face="Times New Roman">void <b>sslSetValue</b>(const char* name, const char* value) &#8211; passes configuration 
		information to the pluggable module;<br><br></font></li>
	<li><font size="3" face="Times New Roman">char* <b>sslGetValue</b>() - retrieves information from the pluggable layer;<br>
	<br></font></li>
	<li><font size="3" face="Times New Roman">char* <b>sslGetProviderName</b>() - provides ssl provider name and its version;<br>
	<br></font></li>
</ul></font></li>

	<li><font size="3" face="Times New Roman"><b><u>Configuration</u></b>.<br>
	<ul><li><font size="3" face="Times New Roman">all configuration information is stored in AC&#8217;s configuration file serviceconfig.xml in 
	parent tags &lt;TransportLayer loadlib=&#8221;socketTL&#8221;..&gt;&lt;Configuration&gt;&#8230;
	&lt;/Configuration&gt;&lt;/TransportLayer&gt;</font></li>
	<li><font size="3" face="Times New Roman">AC recognizes and processes the two following 
	configuration tags:
	<ul><li><font size="3" face="Times New Roman">&lt;SecurityEnabled&gt;true&lt;/SecurityEnabled&gt; - 
		enabling security, security is disabled by default;</font></li>
		<li><font size="3" face="Times New Roman">&lt;SSLproviderLib&gt;library name&lt;/SSLproviderName&gt; - library name of pluggable
		module to be dynamically loaded by the pluggable layer;</font></li>
	</ul></font>
	</li>
	<li><font size="3" face="Times New Roman">all other tags are assumed to be configuration parameters of pluggable module and passed to
	the module via sslSetValue() call; These parameters might include path to ssl key and certificate files, path to jvm 
	library and so on;</font></li>
	</ul></font>
	</li>
	</ul>
	</div>    
</div>

  </body>
</html>