omq-rs 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ace7dd4c9d05f6cba6ed58941ed30038c131c3de0a246395baf2b932ac76fa25
-  data.tar.gz: 4c6fdc8bd3543f98c01979ba2cabe4460a6c435d92c91b969b7a6bc0e6b7fdd0
+  metadata.gz: d916c6123be10c4d2689f3ced757ae56a96a762ed91a48331c2cc2ae6f5fcef5
+  data.tar.gz: 7e19c87b521e037a0d739486c42ab0f2586377754cb0f7dc087b4d581a81820c
 SHA512:
-  metadata.gz: ff6a09ddfa0c2c1cddad4a369509ed59085143cd5abb208e506a216f5d6c6977db2a4c77384db602f0cd193be1ab4b69b17f4f0b25f31b9a88d236093e415918
-  data.tar.gz: a0e77ee6fc098846c4e8e40035ebed72d059cbcbb249c4f264954407cc5fde6ba7f1b3b0294752ad33069e261235269e2c0a87c889636b5b8b04374e31b73f7e
+  metadata.gz: 4eca9973111eaf059d20637412340440cfa856ff21c99174a12dd4e9f802c077b6cc517ecb5475e0f619252a6f29d5df4ec22838c0700a6d0200dd2060d71abb
+  data.tar.gz: fede7168c871a78f2449b2ed5f92eafb943bafa72fa5050240c2d642f42f4beeba5acee0eea200f114563acee8f2fab11eda19599c7babd9be55441e23565415

data/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-09-04
+
+- Add PLAIN username/password allowlists and authentication callbacks through
+  `plain_auth:` and `Socket#set_plain_auth`.
+- Expand authenticator peer metadata with transport address and PLAIN
+  credentials.
+- Require explicit PLAIN server policy; bare PLAIN server mode fails closed.
+- Reject CURVE public keys that do not match the configured secret key.
+- Require `omq-proto` 0.27.0 and `omq-tokio` 0.22.0.
+
 ## [0.1.2] - 2026-09-01
 
 - Route `Socket#try_recv` directly through the native nonblocking receive path.

data/README.md

@@ -94,9 +94,10 @@ an `OMQ::Rust::MechanismPeerInfo`, or `nil` to accept every valid CURVE client.
 Configure it before the first bind, connect, send, receive, or monitor call.
 `OMQ::Rust.curve_public(secret_key)` derives a public key.
 
-PLAIN uses `plain_server: true` on the server and `plain_username` plus
-`plain_password` on clients. PLAIN authenticates without encryption; use it
-only on trusted transports.
+PLAIN servers require an explicit policy. Pass fixed credentials with
+`plain_server: true, plain_auth: [["alice", "secret"]]`, or pass a callable as
+`plain_auth:`. Clients use `plain_username` plus `plain_password`. PLAIN
+authenticates without encryption; use it only on trusted transports.
 
 ## Compression
 

data/ext/omq_rs_native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "omq_rs_native"
-version = "0.1.2"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.93"
 license = "ISC"
@@ -20,8 +20,8 @@ zstd = ["omq-tokio/zstd"]
 ws = ["omq-tokio/ws"]
 
 [dependencies]
-omq-proto = { version = ">=0.26.1, <0.28.0", default-features = false }
-omq-tokio = { version = ">=0.21.4, <0.23.0", default-features = false }
+omq-proto = { version = ">=0.27.0, <0.28.0", default-features = false }
+omq-tokio = { version = ">=0.22.0, <0.23.0", default-features = false }
 yring = { version = "=0.3.14", features = ["async"] }
 
 bytes = "1.12.0"

data/ext/omq_rs_native/src/auth.rs

@@ -6,6 +6,7 @@ use bytes::Bytes;
 use rb_sys::VALUE;
 
 use crate::notify::PipeNotify;
+#[cfg(feature = "curve")]
 use crate::options::parse_curve_public_key;
 use crate::rb::{self, RbResult};
 
@@ -13,6 +14,9 @@ enum AuthRequest {
     Check {
         public_key: [u8; 32],
         identity: Option<Bytes>,
+        peer_address: Option<String>,
+        username: Option<String>,
+        password: Option<String>,
         reply: flume::Sender<bool>,
     },
     Stop,
@@ -84,32 +88,73 @@ unsafe extern "C" fn auth_worker_main(data: *mut c_void) -> VALUE {
         while let Some(AuthRequest::Check {
             public_key,
             identity,
+            peer_address,
+            username,
+            password,
             reply,
         }) = wait_for_request(&data)
         {
-            let accepted = invoke_callback(data.callback, public_key, identity.as_ref());
+            let accepted = invoke_callback(
+                data.callback,
+                public_key,
+                identity.as_ref(),
+                peer_address.as_deref(),
+                username.as_deref(),
+                password.as_deref(),
+            );
             let _ = reply.send(accepted);
         }
     }));
     rb::qnil()
 }
 
-fn invoke_callback(callback: VALUE, public_key: [u8; 32], identity: Option<&Bytes>) -> bool {
+fn invoke_callback(
+    callback: VALUE,
+    public_key: [u8; 32],
+    identity: Option<&Bytes>,
+    peer_address: Option<&str>,
+    username: Option<&str>,
+    password: Option<&str>,
+) -> bool {
     let result = (|| -> RbResult<VALUE> {
         let peer = rb::hash_new()?;
-        let key = omq_proto::CurvePublicKey::from_bytes(public_key)
-            .to_z85()
-            .into_bytes();
-        rb::hash_aset(
-            peer,
-            rb::symbol("public_key")?,
-            rb::new_binary_string(&key)?,
-        )?;
+        let key = if username.is_some() {
+            rb::qnil()
+        } else {
+            #[cfg(feature = "curve")]
+            {
+                let key = omq_proto::CurvePublicKey::from_bytes(public_key)
+                    .to_z85()
+                    .into_bytes();
+                rb::new_binary_string(&key)?
+            }
+            #[cfg(not(feature = "curve"))]
+            {
+                let _ = public_key;
+                rb::qnil()
+            }
+        };
+        rb::hash_aset(peer, rb::symbol("public_key")?, key)?;
         let identity = match identity {
             Some(value) => rb::new_binary_string(value)?,
             None => rb::qnil(),
         };
         rb::hash_aset(peer, rb::symbol("identity")?, identity)?;
+        let peer_address = match peer_address {
+            Some(value) => rb::new_utf8_string(value)?,
+            None => rb::qnil(),
+        };
+        rb::hash_aset(peer, rb::symbol("peer_address")?, peer_address)?;
+        let username = match username {
+            Some(value) => rb::new_utf8_string(value)?,
+            None => rb::qnil(),
+        };
+        rb::hash_aset(peer, rb::symbol("username")?, username)?;
+        let password = match password {
+            Some(value) => rb::new_utf8_string(value)?,
+            None => rb::qnil(),
+        };
+        rb::hash_aset(peer, rb::symbol("password")?, password)?;
         rb::call_method_1(callback, c"call", peer)
     })();
 
@@ -121,6 +166,7 @@ fn invoke_callback(callback: VALUE, public_key: [u8; 32], identity: Option<&Byte
     }
 }
 
+#[cfg(feature = "curve")]
 pub fn allowed_keys(value: VALUE) -> RbResult<omq_proto::Authenticator> {
     let count = rb::array_len(value)?;
     let mut keys = std::collections::HashSet::with_capacity(count);
@@ -162,6 +208,9 @@ pub fn callback(callback: VALUE) -> RbResult<(omq_proto::Authenticator, AuthWork
         let request = AuthRequest::Check {
             public_key: peer.public_key,
             identity: peer.identity.clone(),
+            peer_address: peer.peer_address.clone(),
+            username: peer.username.clone(),
+            password: peer.password.clone(),
             reply,
         };
         if auth_sender.send(request).is_err() {

data/ext/omq_rs_native/src/lib.rs

@@ -1,4 +1,4 @@
-#[cfg(feature = "curve")]
+#[cfg(any(feature = "curve", feature = "plain"))]
 mod auth;
 mod error;
 mod notify;

data/ext/omq_rs_native/src/options.rs

@@ -212,7 +212,6 @@ fn apply_mechanism(hash: VALUE, mech_type: &str, opts: &mut omq_tokio::Options)
                         .ok_or_else(|| RubyErr::arg("CURVE server requires curve_secretkey"))?,
                     "curve_secretkey",
                 )?;
-                validate_curve_keypair(&public, &secret)?;
                 opts.mechanism = omq_proto::MechanismSetup::CurveServer {
                     our_keypair: omq_proto::CurveKeypair { public, secret },
                     options: omq_proto::CurveServerOptions::default(),
@@ -236,7 +235,6 @@ fn apply_mechanism(hash: VALUE, mech_type: &str, opts: &mut omq_tokio::Options)
                         .ok_or_else(|| RubyErr::arg("CURVE client requires curve_secretkey"))?,
                     "curve_secretkey",
                 )?;
-                validate_curve_keypair(&public, &secret)?;
                 let server_public = parse_curve_public_key(
                     &server_key
                         .ok_or_else(|| RubyErr::arg("CURVE client requires curve_serverkey"))?,
@@ -253,7 +251,7 @@ fn apply_mechanism(hash: VALUE, mech_type: &str, opts: &mut omq_tokio::Options)
         "plain" => {
             if get_opt_bool_alias(hash, &["plain_server", "mechanism_server"])?.unwrap_or(false) {
                 opts.mechanism = omq_proto::MechanismSetup::PlainServer {
-                    authenticator: omq_proto::Authenticator::new(|_| true),
+                    authenticator: omq_proto::Authenticator::new(|_| false),
                 };
             } else {
                 let username =
@@ -296,18 +294,6 @@ fn curve_secret_key(bytes: &[u8], label: &str) -> RbResult<omq_proto::CurveSecre
         .map_err(|error| RubyErr::arg(format!("invalid {label}: {error}")))
 }
 
-#[cfg(feature = "curve")]
-fn validate_curve_keypair(
-    public: &omq_proto::CurvePublicKey,
-    secret: &omq_proto::CurveSecretKey,
-) -> RbResult<()> {
-    if secret.derive_public().as_bytes() == public.as_bytes() {
-        Ok(())
-    } else {
-        Err(RubyErr::arg("CURVE public and secret keys do not match"))
-    }
-}
-
 fn option_present(hash: VALUE, keys: &[&str]) -> RbResult<bool> {
     for key in keys {
         if rb::hash_get(hash, key)?.is_some() {

data/ext/omq_rs_native/src/socket.rs

@@ -28,8 +28,10 @@ pub struct RustSocket {
     materialized: RwLock<Option<Materialized>>,
     closed: AtomicBool,
     linger: Mutex<Option<std::time::Duration>>,
-    #[cfg(feature = "curve")]
+    #[cfg(any(feature = "curve", feature = "plain"))]
     auth_worker: Mutex<Option<crate::auth::AuthWorker>>,
+    #[cfg(feature = "plain")]
+    plain_auth_configured: AtomicBool,
 }
 
 unsafe impl Send for RustSocket {}
@@ -71,7 +73,7 @@ unsafe extern "C" fn rust_socket_mark(ptr: *mut c_void) {
     }
     let _ = catch_unwind(AssertUnwindSafe(|| {
         let socket = unsafe { &*ptr.cast::<RustSocket>() };
-        #[cfg(feature = "curve")]
+        #[cfg(any(feature = "curve", feature = "plain"))]
         if let Some(worker) = socket.auth_worker.lock().unwrap().as_ref() {
             unsafe {
                 rb_sys::rb_gc_mark(worker.callback());
@@ -139,8 +141,10 @@ fn rust_socket_new_impl(class: VALUE, type_str: VALUE) -> RbResult<VALUE> {
                 materialized: RwLock::new(None),
                 closed: AtomicBool::new(false),
                 linger: Mutex::new(None),
-                #[cfg(feature = "curve")]
+                #[cfg(any(feature = "curve", feature = "plain"))]
                 auth_worker: Mutex::new(None),
+                #[cfg(feature = "plain")]
+                plain_auth_configured: AtomicBool::new(false),
             }),
             rust_socket_data_type(),
         )
@@ -206,6 +210,95 @@ fn set_curve_authenticator(
     Ok(())
 }
 
+#[cfg(feature = "plain")]
+fn set_plain_authenticator(
+    rb_self: &RustSocket,
+    authenticator: omq_proto::Authenticator,
+    mut worker: Option<crate::auth::AuthWorker>,
+) -> RbResult<()> {
+    if rb_self.materialized.read().unwrap().is_some() {
+        if let Some(worker) = worker.take() {
+            worker.stop();
+        }
+        return Err(RubyErr::runtime(
+            "PLAIN authentication must be configured before bind or connect",
+        ));
+    }
+
+    let mut options_guard = rb_self.options.lock().unwrap();
+    let options = options_guard
+        .as_mut()
+        .ok_or_else(|| RubyErr::runtime("socket options not configured"))?;
+    if let omq_proto::MechanismSetup::PlainServer {
+        authenticator: configured,
+    } = &mut options.mechanism
+    {
+        *configured = authenticator;
+    } else {
+        drop(options_guard);
+        if let Some(worker) = worker.take() {
+            worker.stop();
+        }
+        return Err(RubyErr::runtime(
+            "PLAIN authentication requires a PLAIN server socket",
+        ));
+    }
+    drop(options_guard);
+
+    let previous = rb_self.auth_worker.lock().unwrap().take();
+    if let Some(previous) = previous {
+        previous.stop();
+    }
+    *rb_self.auth_worker.lock().unwrap() = worker;
+    rb_self.plain_auth_configured.store(true, Ordering::Release);
+    Ok(())
+}
+
+#[cfg(feature = "plain")]
+unsafe extern "C" fn rust_socket_set_plain_auth_credentials(
+    rb_self: VALUE,
+    credentials: VALUE,
+) -> VALUE {
+    rb::wrap(|| {
+        let rb_self = unsafe { rust_socket_ref(rb_self)? };
+        let count = rb::array_len(credentials)?;
+        let mut allowlist = Vec::with_capacity(count);
+        for index in 0..count {
+            let pair = rb::array_entry(credentials, index)?;
+            if rb::array_len(pair)? != 2 {
+                return Err(RubyErr::arg(
+                    "each PLAIN credential must be a [username, password] pair",
+                ));
+            }
+            let username = rb::value_to_string(rb::array_entry(pair, 0)?)?;
+            let password = rb::value_to_string(rb::array_entry(pair, 1)?)?;
+            if username.len() > 255
+                || password.len() > 255
+                || !username.bytes().all(|byte| byte.is_ascii_graphic())
+                || !password.bytes().all(|byte| byte.is_ascii_graphic())
+            {
+                return Err(RubyErr::arg(
+                    "PLAIN credentials must contain at most 255 ASCII VCHAR bytes",
+                ));
+            }
+            allowlist.push((username, password));
+        }
+        let authenticator = omq_proto::Authenticator::plain_credentials(allowlist);
+        set_plain_authenticator(rb_self, authenticator, None)?;
+        Ok(rb::qnil())
+    })
+}
+
+#[cfg(feature = "plain")]
+unsafe extern "C" fn rust_socket_set_plain_auth_callback(rb_self: VALUE, callback: VALUE) -> VALUE {
+    rb::wrap(|| {
+        let rb_self = unsafe { rust_socket_ref(rb_self)? };
+        let (authenticator, worker) = crate::auth::callback(callback)?;
+        set_plain_authenticator(rb_self, authenticator, Some(worker))?;
+        Ok(rb::qnil())
+    })
+}
+
 #[cfg(feature = "curve")]
 unsafe extern "C" fn rust_socket_set_curve_auth_keys(rb_self: VALUE, keys: VALUE) -> VALUE {
     rb::wrap(|| {
@@ -250,6 +343,25 @@ fn rust_socket_materialize_impl(rb_self: &RustSocket) -> RbResult<()> {
         return Ok(());
     }
 
+    #[cfg(feature = "plain")]
+    if rb_self
+        .options
+        .lock()
+        .unwrap()
+        .as_ref()
+        .is_some_and(|options| {
+            matches!(
+                options.mechanism,
+                omq_proto::MechanismSetup::PlainServer { .. }
+            )
+        })
+        && !rb_self.plain_auth_configured.load(Ordering::Acquire)
+    {
+        return Err(RubyErr::runtime(
+            "PLAIN server requires explicit authentication via set_plain_auth",
+        ));
+    }
+
     let opts = rb_self.options.lock().unwrap().take().unwrap_or_default();
     let send_cap = opts.send_hwm.max(1) as usize;
     let recv_cap = opts.recv_hwm.max(1) as usize;
@@ -774,13 +886,15 @@ unsafe extern "C" fn rust_socket_leave(rb_self: VALUE, group: VALUE) -> VALUE {
 
 fn rust_socket_close_impl(rb_self: &RustSocket, wait_for_auth_worker: bool) {
     rb_self.closed.store(true, Ordering::Relaxed);
-    #[cfg(feature = "curve")]
-    let worker = rb_self.auth_worker.lock().unwrap().take();
-    if let Some(worker) = worker {
-        if wait_for_auth_worker {
-            worker.stop();
-        } else {
-            worker.request_stop();
+    #[cfg(any(feature = "curve", feature = "plain"))]
+    {
+        let worker = rb_self.auth_worker.lock().unwrap().take();
+        if let Some(worker) = worker {
+            if wait_for_auth_worker {
+                worker.stop();
+            } else {
+                worker.request_stop();
+            }
         }
     }
     let mat = rb_self.materialized.write().unwrap().take();
@@ -934,6 +1048,19 @@ pub fn register(native: VALUE) -> RbResult<()> {
             )?;
             rb::define_method_0(class, c"clear_curve_auth", rust_socket_clear_curve_auth)?;
         }
+        #[cfg(feature = "plain")]
+        {
+            rb::define_method_1(
+                class,
+                c"set_plain_auth_credentials",
+                rust_socket_set_plain_auth_credentials,
+            )?;
+            rb::define_method_1(
+                class,
+                c"set_plain_auth_callback",
+                rust_socket_set_plain_auth_callback,
+            )?;
+        }
         rb::define_method_0(class, c"materialize", rust_socket_materialize)?;
         rb::define_method_1(class, c"bind", rust_socket_bind)?;
         rb::define_method_1(class, c"connect", rust_socket_connect)?;

data/lib/omq/rs/socket.rb

@@ -81,13 +81,25 @@ module OMQ
     ].freeze
     private_constant :ROUTED_TYPES, :SINGLE_FRAME_TYPES, :SOCKET_OPTIONS
 
-    # CURVE peer metadata passed to callable authenticators.
+    # Peer metadata passed to callable CURVE and PLAIN authenticators.
     #
     # @!attribute [r] public_key
-    #   @return [String] peer's 40-byte Z85 public key
+    #   @return [String, nil] peer's 40-byte Z85 public key for CURVE
     # @!attribute [r] identity
     #   @return [String, nil] peer's ZMTP identity
-    MechanismPeerInfo = Data.define(:public_key, :identity)
+    # @!attribute [r] peer_address
+    #   @return [String, nil] peer's transport address
+    # @!attribute [r] username
+    #   @return [String, nil] peer's PLAIN username
+    # @!attribute [r] password
+    #   @return [String, nil] peer's PLAIN password
+    MechanismPeerInfo = Data.define(
+      :public_key,
+      :identity,
+      :peer_address,
+      :username,
+      :password,
+    )
 
     class << self
       # Returns number of OMQ.rs IO threads.
@@ -150,17 +162,20 @@ module OMQ
         Native.curve_public(secret_key)
       end
 
-      # Adapts a public CURVE authenticator to native peer metadata.
+      # Adapts a public authenticator to native peer metadata.
       #
       # @param authenticator [#call] callable receiving {MechanismPeerInfo}
       # @return [Proc]
       # @api private
-      def wrap_curve_authenticator(authenticator)
+      def wrap_authenticator(authenticator)
         proc do |peer|
           authenticator.call(
             MechanismPeerInfo.new(
               public_key: peer.fetch(:public_key),
               identity: peer[:identity],
+              peer_address: peer[:peer_address],
+              username: peer[:username],
+              password: peer[:password],
             ),
           )
         end
@@ -222,6 +237,8 @@ module OMQ
       # @param recv_timeout [Numeric, nil] receive timeout in seconds
       # @param send_timeout [Numeric, nil] send timeout in seconds
       # @param curve_auth [Array<String>, #call, nil] CURVE allowlist or authenticator
+      # @param plain_auth [Array<Array(String, String)>, #call, nil] PLAIN
+      #   credential allowlist or authenticator
       # @param options [Hash] native OMQ.rs socket options
       # @option options [Symbol] :workload_profile +:throughput+ or +:latency+
       # @option options [Integer] :send_hwm outbound message capacity
@@ -270,7 +287,7 @@ module OMQ
       # @option options [String] :curve_serverkey CURVE server raw or Z85 public key
       # @return [Socket]
       # @raise [ArgumentError] if an option is unknown or invalid
-      def initialize(recv_timeout: nil, send_timeout: nil, curve_auth: nil, **options)
+      def initialize(recv_timeout: nil, send_timeout: nil, curve_auth: nil, plain_auth: nil, **options)
         socket_type = self.class.const_get(:SOCKET_TYPE, false)
         @socket_type = socket_type.to_s.downcase.to_sym
         unless SOCKET_TYPES.include?(@socket_type)
@@ -290,6 +307,7 @@ module OMQ
         @peer_connected = false
         @subscriber_joined = false
         set_curve_auth(curve_auth) unless curve_auth.nil?
+        set_plain_auth(plain_auth) unless plain_auth.nil?
       end
 
       # Binds socket to an endpoint.
@@ -363,7 +381,36 @@ module OMQ
             raise TypeError, "CURVE authenticator must be an Array, callable, or nil"
           end
 
-          @native.set_curve_auth_callback(Rust.wrap_curve_authenticator(authenticator))
+          @native.set_curve_auth_callback(Rust.wrap_authenticator(authenticator))
+        end
+        self
+      end
+
+      # Configures PLAIN client admission on a server before materialization.
+      #
+      # Pass an array of username/password pairs, or a callable receiving
+      # {MechanismPeerInfo}. Pairs match exactly and case-sensitively. Each
+      # field must contain at most 255 ASCII VCHAR bytes. An empty array denies
+      # every client. PLAIN never has an allow-all mode and does not encrypt
+      # traffic.
+      #
+      # @param credentials [Array<Array(String, String)>, #call] credential
+      #   allowlist or authenticator
+      # @yieldparam peer [MechanismPeerInfo]
+      # @return [Socket] self
+      # @raise [RuntimeError] if socket is already materialized
+      # @raise [TypeError, ArgumentError] if credentials are invalid
+      def set_plain_auth(credentials = nil, &block)
+        raise RuntimeError, "PLAIN authentication must be configured before bind or connect" if @materialized
+
+        authenticator = block || (credentials if credentials.respond_to?(:call))
+        if authenticator
+          @native.set_plain_auth_callback(Rust.wrap_authenticator(authenticator))
+        else
+          unless credentials.is_a?(Array)
+            raise TypeError, "PLAIN authentication requires a credential Array or a callable"
+          end
+          @native.set_plain_auth_credentials(credentials)
         end
         self
       end

data/lib/omq/rs/version.rb

@@ -5,6 +5,6 @@ module OMQ
   module Rust
     # Ruby binding version.
     # @return [String]
-    VERSION = "0.1.2"
+    VERSION = "0.2.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omq-rs
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Patrik Wenger