libzmq: Problem: CurveZMQ connection fails without ZAP

In commit a0ccdc866efbac5889d8872c7f27c53e9c0a7c5b from #2482 the logic of curve_server.cpp was changed so that zmq::curve_server_t::process_initiate returns -1 if zap_connect fails. Previously, this was allowed and the ZAP logic was only processed if that returned 0. Was this deliberate? Is ZAP mandatory now?

About this issue

Original URL
State: closed
Created 7 years ago
Comments: 17 (17 by maintainers)

Commits related to this issue

Problem: CURVE can no longer be used without ZAP Solution: revert change that made ZAP mandatory. The "Stonehouse" pattern, where CURVE is used only for encryption and without authentication, is a va... — committed to bluca/libzmq by bluca 7 years ago
Problem: CURVE can no longer be used without ZAP Solution: revert change that made ZAP mandatory. The "Stonehouse" pattern, where CURVE is used only for encryption and without authentication, is a va... — committed to bluca/libzmq by bluca 7 years ago

Most upvoted comments

It’s an inproc socket, and those are local to a context:

https://github.com/zeromq/libzmq/blob/master/src/session_base.cpp#L322

bluca on Jun 13, 2017

However if one is running ZAP for non-curve auth purposes (e.g. plain) at the same time as non-auth curve (privacy), there may be complications (not sure).

If you had the need to do that, the recommendation would probably be to use two different contexts, since the inproc socket used by ZAP is local to a single context.

jemc on Jun 13, 2017