Bug 689408
| Summary: | ACL denials while replicating exclusive queues to a newly joined node | ||
|---|---|---|---|
| Product: | Red Hat Enterprise MRG | Reporter: | Siddhesh Poyarekar <spoyarek> |
| Component: | qpid-cpp | Assignee: | Alan Conway <aconway> |
| Status: | CLOSED ERRATA | QA Contact: | Zdenek Kraus <zkraus> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 1.3 | CC: | aconway, freznice, iboverma, jross, mcressma, mnewsome, pematous, pmoravec, ppecka, rdassen, rrajaram, zkraus |
| Target Milestone: | 2.2 | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | qpid-cpp-0.14-20 | Doc Type: | Bug Fix |
| Doc Text: |
Cause: During an update, ACL rules were preventing access to the cluster-update exchange.
Consequence: new brokers could not join the cluster.
Fix: for catch-up connections, which are authenticated as the cluster-user, allow all access to update state.
Result: Brokers can join the cluster as expected.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-09-19 17:19:59 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 785156, 809460 | ||
|
Description
Siddhesh Poyarekar
2011-03-21 12:16:36 UTC
Fixed on trunk: r1182451 | QPID-3544: ACL denials while replicating exclusive queues to a newly joined node. Note: fix on trunk was incomplete, also need this commit: r1182451 | QPID-3544: ACL denials while replicating exclusive queues to a newly joined node *** Bug 809460 has been marked as a duplicate of this bug. *** Testing Packages: python-qpid-0.14-7.el5 python-qpid-qmf-0.14-12.el5 qpid-cpp-client-0.14-19.el5 qpid-cpp-client-devel-0.14-19.el5 qpid-cpp-client-devel-docs-0.14-19.el5 qpid-cpp-client-ssl-0.14-19.el5 qpid-cpp-mrg-debuginfo-0.14-18.el5 qpid-cpp-server-0.14-19.el5 qpid-cpp-server-cluster-0.14-19.el5 qpid-cpp-server-devel-0.14-19.el5 qpid-cpp-server-ssl-0.14-19.el5 qpid-cpp-server-store-0.14-19.el5 qpid-cpp-server-xml-0.14-19.el5 qpid-qmf-0.14-12.el5 qpid-qmf-devel-0.14-12.el5 qpid-tools-0.14-3.el5 python-qpid-0.14-8.el6 python-qpid-qmf-0.14-12.el6_3 qpid-cpp-client-0.14-19.el6_3 qpid-cpp-client-devel-0.14-19.el6_3 qpid-cpp-client-devel-docs-0.14-19.el6_3 qpid-cpp-server-0.14-19.el6_3 qpid-cpp-server-cluster-0.14-19.el6_3 qpid-cpp-server-devel-0.14-19.el6_3 qpid-cpp-server-store-0.14-19.el6_3 qpid-cpp-server-xml-0.14-19.el6_3 qpid-qmf-0.14-12.el6_3 qpid-tools-0.14-4.el6_3 Tested on RHEL 5.8, RHEL 6.3 && i386, x86_64 We discovered slight problem with fix in 0.14-19: Replication of exclusive Queue is no more denied by ACL, but Queue is replicated as NON-Exclusive, that is incorrect. -> ASSIGNED Not sure why this isn't working but it should not be hard to fix. Please describe how you reproduce the problem, or attach a test case if you have one. 1/ Prepare cluster without authentication, without ACL.
2/ Start node A.
3/ create exclusive Q by python spout:
# ./spout -b user/user@<node_A:port_A> "exclQ.A; {create: sender, delete: receiver, node:{ x-declare:{ auto-delete: false, exclusive: true } } }" "$(date | md5sum)"
4/ Start node B, cluster joining
5/ check created Q is not exclusive on node B
NOTE: authentication has no influence on behaviour in this case.
Fixed on upstream trunk r1367776 Testing packages: python-qpid-0.14-10.el5 python-qpid-qmf-0.14-13.el5 qpid-cpp-client-0.14-20.el5 qpid-cpp-client-devel-0.14-20.el5 qpid-cpp-client-devel-docs-0.14-20.el5 qpid-cpp-client-ssl-0.14-20.el5 qpid-cpp-mrg-debuginfo-0.14-18.el5 qpid-cpp-server-0.14-20.el5 qpid-cpp-server-cluster-0.14-20.el5 qpid-cpp-server-devel-0.14-20.el5 qpid-cpp-server-ssl-0.14-20.el5 qpid-cpp-server-store-0.14-20.el5 qpid-cpp-server-xml-0.14-20.el5 qpid-java-client-0.14-3.el5 qpid-java-common-0.14-3.el5 qpid-java-example-0.14-3.el5 qpid-jca-0.14-8.el5 qpid-jca-xarecovery-0.14-8.el5 qpid-qmf-0.14-13.el5 qpid-qmf-devel-0.14-13.el5 qpid-tools-0.14-5.el5 python-qpid-0.14-10.el6_3 python-qpid-qmf-0.14-13.el6_3 qpid-cpp-client-0.14-20.el6_3 qpid-cpp-client-devel-0.14-20.el6_3 qpid-cpp-client-devel-docs-0.14-20.el6_3 qpid-cpp-server-0.14-20.el6_3 qpid-cpp-server-cluster-0.14-20.el6_3 qpid-cpp-server-devel-0.14-20.el6_3 qpid-cpp-server-store-0.14-20.el6_3 qpid-cpp-server-xml-0.14-20.el6_3 qpid-qmf-0.14-13.el6_3 qpid-tools-0.14-5.el6_3 Tested on RHEL5.8, RHEL6.3 & i686, x86_64 Queue is now correctly replicated as exclusive -> VERIFIED
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
Cause: During an update, ACL rules were preventing access to the cluster-update exchange.
Consequence: new brokers could not join the cluster.
Fix: for catch-up connections, which are authenticated as the cluster-user, allow all access to update state.
Result: Brokers can join the cluster as expected.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2012-1277.html |