Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 648690

Summary: "qpid-route route map " with ACL gives "unauthorized-access"
Product: Red Hat Enterprise MRG Reporter: ppecka <ppecka>
Component: qpid-cppAssignee: Pavel Moravec <pmoravec>
Status: CLOSED ERRATA QA Contact: Zdenek Kraus <zkraus>
Severity: medium Docs Contact:
Priority: medium    
Version: 1.3CC: freznice, gsim, iboverma, jross, pmoravec, tross, zkraus
Target Milestone: 3.1Keywords: EasyFix, Patch, TestCaseProvided
Target Release: ---   
Hardware: All   
OS: All   
Whiteboard:
Fixed In Version: qpid-cpp-0.30-2 Doc Type: Bug Fix
Doc Text:
It was discovered that the qpid-route tool only supported the ANONYMOUS SASL mechanism in the route add command, regardless of other mechanisms explicitly set. This caused an unauthorized access error for broker links created by the qpid-route tool, because the originating broker authenticated as an anonymous user with a non-anonymous SASL mechanism set. A change to the method now ensures the authentication mechanism is selected correctly and works as expected.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2015-04-14 13:45:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
reproducer
none
Trivial patch proposal none

Description ppecka 2010-11-01 22:41:36 UTC 
Created attachment 457005 [details]
reproducer

Description of problem:
Tool qpid-route supports only ANONYMOUS sasl mech in method mapRoutes.
this results as (although both broker nodes are running with very same ACL rules and qpid.sasldb)


when /etc/sasl2/qpidd.conf "mech_list" not defined:
ExecutionException(error_code=403, command_id=serial(0), class_code=8, command_code=1, field_index=0, description=u'unauthorized-access: ACL denied queue create request from anonymous@QPID (qpid/broker/SessionAdapter.cpp:349)', error_info={}, channel=1, id=serial(0))


when /etc/sasl2/qpidd.conf "mech_list: PLAIN":
    localhost:5677... (None, 'SASL error: Error in sasl_client_start (-4) SASL(-4): no mechanism available: No worthy mechs found')





Version-Release number of selected component (if applicable):
python-qpid-0.7.946106-14+bz642686.el5
qpid-cpp-client-0.7.946106-18.el5
qpid-cpp-client-devel-0.7.946106-18.el5
qpid-cpp-client-devel-docs-0.7.946106-18.el5
qpid-cpp-client-ssl-0.7.946106-18.el5
qpid-cpp-server-0.7.946106-18.el5
qpid-cpp-server-cluster-0.7.946106-18.el5
qpid-cpp-server-devel-0.7.946106-18.el5
qpid-cpp-server-ssl-0.7.946106-18.el5
qpid-cpp-server-store-0.7.946106-18.el5
qpid-cpp-server-xml-0.7.946106-18.el5
qpid-java-client-0.7.946106-11.el5
qpid-java-common-0.7.946106-11.el5
qpid-java-example-0.7.946106-11.el5
qpid-tools-0.7.946106-11.el5

How reproducible:
100%

Steps to Reproduce:
1. please see attached reproducer
  
Actual results:
qpid-route route map allmighty/g@localhost:5672

Finding Linked Brokers:
    allmighty/g@localhost:5672... Ok
    localhost:5677... ExecutionException(error_code=403, command_id=serial(0), class_code=8, command_code=1, field_index=0, description=u'unauthorized-access: ACL denied queue create request from anonymous@QPID (qpid/broker/SessionAdapter.cpp:349)', error_info={}, channel=1, id=serial(0))



OR


Finding Linked Brokers:
    allmighty/g@localhost:5672... Ok
    localhost:5677... (None, 'SASL error: Error in sasl_client_start (-4) SASL(-4): no mechanism available: No worthy mechs found')




Expected results:
all conected bokers are being listed

Additional info:
Comment 1 Pavel Moravec 2013-06-03 11:39:25 UTC 
Created attachment 756266 [details]
Trivial patch proposal

Before adding new broker to QMF console:
1) set up credentials per the local broker
2) use the same connection options
Comment 2 Pavel Moravec 2013-06-03 11:45:02 UTC 
Trivial fix provided, assuming all brokers within the federation topology accepts the same credentials and SASL method.
Comment 3 Pavel Moravec 2014-03-24 12:58:45 UTC 
Committed revision 1580827 (https://svn.apache.org/r1580827).
Comment 5 Zdenek Kraus 2015-01-07 15:39:07 UTC 
This was tested on RHEL 6.6 i686 and x86_64 with following packages:
python-qpid-0.30-2
python-qpid-qmf-0.30-3
qpid-cpp-client-0.30-4
qpid-cpp-client-devel-0.30-4
qpid-cpp-client-rdma-0.30-4
qpid-cpp-debuginfo-0.30-4
qpid-cpp-server-0.30-4
qpid-cpp-server-devel-0.30-4
qpid-cpp-server-ha-0.30-4
qpid-cpp-server-linearstore-0.30-4
qpid-cpp-server-rdma-0.30-4
qpid-cpp-server-xml-0.30-4
qpid-java-client-0.30-3
qpid-java-common-0.30-3
qpid-java-example-0.30-3
qpid-jca-0.22-2
qpid-jca-xarecovery-0.22-2
qpid-proton-c-0.7-4
qpid-qmf-0.30-3
qpid-tools-0.30-3

fix works as expected.
-> VERIFIED
Comment 6 Jared MORGAN 2015-01-16 00:08:10 UTC 
(In reply to Zdenek Kraus from comment #5)
> This was tested on RHEL 6.6 i686 and x86_64 with following packages:
> python-qpid-0.30-2
> python-qpid-qmf-0.30-3
> qpid-cpp-client-0.30-4
> qpid-cpp-client-devel-0.30-4
> qpid-cpp-client-rdma-0.30-4
> qpid-cpp-debuginfo-0.30-4
> qpid-cpp-server-0.30-4
> qpid-cpp-server-devel-0.30-4
> qpid-cpp-server-ha-0.30-4
> qpid-cpp-server-linearstore-0.30-4
> qpid-cpp-server-rdma-0.30-4
> qpid-cpp-server-xml-0.30-4
> qpid-java-client-0.30-3
> qpid-java-common-0.30-3
> qpid-java-example-0.30-3
> qpid-jca-0.22-2
> qpid-jca-xarecovery-0.22-2
> qpid-proton-c-0.7-4
> qpid-qmf-0.30-3
> qpid-tools-0.30-3
> 
> fix works as expected.
> -> VERIFIED

Hey there Zdenek. This issue appears in the Errata list for 3.1, so I had a go at writing the Release Note to accompany it. I had a bit of a hard time crafting it based on the info in the ticket, so please review and see if I got my understanding correct. If not, please propose fixes and I'll review.
Comment 7 Zdenek Kraus 2015-01-16 08:09:43 UTC 
It was discovered that the qpid-route tool only supported the ANONYMOUS SASL mechanism in route add command, although other mechanisms were set. 

With ACL rule restricting broker linking to a specific users.
This caused and unauthorized access for broker link created by qpid-route tool, because originating broker authenticated as anonymous user, with any non-anonymous SASL mechanism set.

A change to the method now ensures authentication mechanism is selected correctly and works as expected.

# please fix my english, but above should be how it didn't work.
Comment 10 errata-xmlrpc 2015-04-14 13:45:58 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2015-0805.html