Red Hat Bugzilla – Bug 648690
"qpid-route route map " with ACL gives "unauthorized-access"
Last modified: 2015-04-14 09:45:58 EDT
Created attachment 457005 [details] reproducer Description of problem: Tool qpid-route supports only ANONYMOUS sasl mech in method mapRoutes. this results as (although both broker nodes are running with very same ACL rules and qpid.sasldb) when /etc/sasl2/qpidd.conf "mech_list" not defined: ExecutionException(error_code=403, command_id=serial(0), class_code=8, command_code=1, field_index=0, description=u'unauthorized-access: ACL denied queue create request from anonymous@QPID (qpid/broker/SessionAdapter.cpp:349)', error_info={}, channel=1, id=serial(0)) when /etc/sasl2/qpidd.conf "mech_list: PLAIN": localhost:5677... (None, 'SASL error: Error in sasl_client_start (-4) SASL(-4): no mechanism available: No worthy mechs found') Version-Release number of selected component (if applicable): python-qpid-0.7.946106-14+bz642686.el5 qpid-cpp-client-0.7.946106-18.el5 qpid-cpp-client-devel-0.7.946106-18.el5 qpid-cpp-client-devel-docs-0.7.946106-18.el5 qpid-cpp-client-ssl-0.7.946106-18.el5 qpid-cpp-server-0.7.946106-18.el5 qpid-cpp-server-cluster-0.7.946106-18.el5 qpid-cpp-server-devel-0.7.946106-18.el5 qpid-cpp-server-ssl-0.7.946106-18.el5 qpid-cpp-server-store-0.7.946106-18.el5 qpid-cpp-server-xml-0.7.946106-18.el5 qpid-java-client-0.7.946106-11.el5 qpid-java-common-0.7.946106-11.el5 qpid-java-example-0.7.946106-11.el5 qpid-tools-0.7.946106-11.el5 How reproducible: 100% Steps to Reproduce: 1. please see attached reproducer Actual results: qpid-route route map allmighty/g@localhost:5672 Finding Linked Brokers: allmighty/g@localhost:5672... Ok localhost:5677... ExecutionException(error_code=403, command_id=serial(0), class_code=8, command_code=1, field_index=0, description=u'unauthorized-access: ACL denied queue create request from anonymous@QPID (qpid/broker/SessionAdapter.cpp:349)', error_info={}, channel=1, id=serial(0)) OR Finding Linked Brokers: allmighty/g@localhost:5672... Ok localhost:5677... (None, 'SASL error: Error in sasl_client_start (-4) SASL(-4): no mechanism available: No worthy mechs found') Expected results: all conected bokers are being listed Additional info:
Created attachment 756266 [details] Trivial patch proposal Before adding new broker to QMF console: 1) set up credentials per the local broker 2) use the same connection options
Trivial fix provided, assuming all brokers within the federation topology accepts the same credentials and SASL method.
Committed revision 1580827 (https://svn.apache.org/r1580827).
This was tested on RHEL 6.6 i686 and x86_64 with following packages: python-qpid-0.30-2 python-qpid-qmf-0.30-3 qpid-cpp-client-0.30-4 qpid-cpp-client-devel-0.30-4 qpid-cpp-client-rdma-0.30-4 qpid-cpp-debuginfo-0.30-4 qpid-cpp-server-0.30-4 qpid-cpp-server-devel-0.30-4 qpid-cpp-server-ha-0.30-4 qpid-cpp-server-linearstore-0.30-4 qpid-cpp-server-rdma-0.30-4 qpid-cpp-server-xml-0.30-4 qpid-java-client-0.30-3 qpid-java-common-0.30-3 qpid-java-example-0.30-3 qpid-jca-0.22-2 qpid-jca-xarecovery-0.22-2 qpid-proton-c-0.7-4 qpid-qmf-0.30-3 qpid-tools-0.30-3 fix works as expected. -> VERIFIED
(In reply to Zdenek Kraus from comment #5) > This was tested on RHEL 6.6 i686 and x86_64 with following packages: > python-qpid-0.30-2 > python-qpid-qmf-0.30-3 > qpid-cpp-client-0.30-4 > qpid-cpp-client-devel-0.30-4 > qpid-cpp-client-rdma-0.30-4 > qpid-cpp-debuginfo-0.30-4 > qpid-cpp-server-0.30-4 > qpid-cpp-server-devel-0.30-4 > qpid-cpp-server-ha-0.30-4 > qpid-cpp-server-linearstore-0.30-4 > qpid-cpp-server-rdma-0.30-4 > qpid-cpp-server-xml-0.30-4 > qpid-java-client-0.30-3 > qpid-java-common-0.30-3 > qpid-java-example-0.30-3 > qpid-jca-0.22-2 > qpid-jca-xarecovery-0.22-2 > qpid-proton-c-0.7-4 > qpid-qmf-0.30-3 > qpid-tools-0.30-3 > > fix works as expected. > -> VERIFIED Hey there Zdenek. This issue appears in the Errata list for 3.1, so I had a go at writing the Release Note to accompany it. I had a bit of a hard time crafting it based on the info in the ticket, so please review and see if I got my understanding correct. If not, please propose fixes and I'll review.
It was discovered that the qpid-route tool only supported the ANONYMOUS SASL mechanism in route add command, although other mechanisms were set. With ACL rule restricting broker linking to a specific users. This caused and unauthorized access for broker link created by qpid-route tool, because originating broker authenticated as anonymous user, with any non-anonymous SASL mechanism set. A change to the method now ensures authentication mechanism is selected correctly and works as expected. # please fix my english, but above should be how it didn't work.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHEA-2015-0805.html