You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@rocketmq.apache.org by GitBox <gi...@apache.org> on 2022/06/07 07:13:07 UTC

[GitHub] [rocketmq] Cczzzz opened a new issue, #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Cczzzz opened a new issue, #4426:
URL: https://github.com/apache/rocketmq/issues/4426

   PlainAccessValidator #77
   ![image](https://user-images.githubusercontent.com/32947555/172318497-e92aade1-1cbf-41f7-ab9d-c1c34bc4e48b.png)
   
   MQClientAPIImpl #1101
   ![image](https://user-images.githubusercontent.com/32947555/172318597-6721fef0-fa99-4d23-995d-068ad65afdb9.png)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] caigy commented on issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

caigy commented on issue #4426:
URL: https://github.com/apache/rocketmq/issues/4426#issuecomment-1148614653

   In my opinion, it seems like a tradeoff. If not so, any clients with subscription permission to one topic, but without publish permission, can also publish messages to that topic through SEND_MSG_BACK request.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] caigy commented on issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

caigy commented on issue #4426:
URL: https://github.com/apache/rocketmq/issues/4426#issuecomment-1149397156

   After reviewing current resource policy, I think the following would be more reasonable:
   - CONSUMER_SEND_MSG_BACK: **ONLY** check group+SUB
   - SEND_MESSAGE, SEND_MESSAGE_V2: 
     - For retry topic, check group+SUB, **OR**
     - topic+PUB


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] duhenglucky closed issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

duhenglucky closed issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic
URL: https://github.com/apache/rocketmq/issues/4426


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] Cczzzz commented on issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

Cczzzz commented on issue #4426:
URL: https://github.com/apache/rocketmq/issues/4426#issuecomment-1149408414

   > SEND_MESSAGE, SEND_MESSAGE_V2: use topic+PUB.
   
   Under normal circumstances, no one will SEND_MESSAGE send retry topic, if he is blocked, it is reasonable. It should configure retry topic=PUB


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] Cczzzz commented on issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

Cczzzz commented on issue #4426:
URL: https://github.com/apache/rocketmq/issues/4426#issuecomment-1150634377

   > @Cczzzz Some suggestions:
   > 
   > * If publishing to a retry topic, get group name from it and check subscription permission to that group. Furthermore, checking DLQ topic is unnecessary, because no clients would publish to a DLQ topic directly.
   > * For CONSUMER_SEND_MSG_BACK, check SUB permission of group, not retry topic.
   > 
   > Would you like to submit a PR? Let's fix it.
   
   Of course willing


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] Cczzzz commented on issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

Cczzzz commented on issue #4426:
URL: https://github.com/apache/rocketmq/issues/4426#issuecomment-1148663225

   > 在我看来，这似乎是一种权衡。如果不是这样，任何对一个主题具有订阅权限但没有发布权限的客户端也可以通过 SEND_MSG_BACK 请求向该主题发布消息。但是检查订阅权限可能更合理。
   
   But I really don't need to send a message to the origin topic.And he also verifies the sub permission of the group，
   The broker restricts this message to only %RETRY%+group .
        String newTopic = MixAll.getRetryTopic(requestHeader.getGroup());
   seems safe.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] Cczzzz commented on issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

Cczzzz commented on issue #4426:
URL: https://github.com/apache/rocketmq/issues/4426#issuecomment-1149408317

   SEND_MESSAGE, SEND_MESSAGE_V2: use topic+PUB.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] caigy commented on issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

caigy commented on issue #4426:
URL: https://github.com/apache/rocketmq/issues/4426#issuecomment-1149630020

   > > SEND_MESSAGE, SEND_MESSAGE_V2: use topic+PUB.
   > 
   > Under normal circumstances, no one will SEND_MESSAGE send retry topic, if he is blocked, it is reasonable. It should configure retry topic=PUB
   
   @Cczzzz Sending to retry topic through SEND_MESSAGE request exits, e.g.:
   https://github.com/apache/rocketmq/blob/aacaf91539a90b18de21a988a204b5e842497352/client/src/main/java/org/apache/rocketmq/client/impl/consumer/ConsumeMessageOrderlyService.java#L377-L391
   
   https://github.com/apache/rocketmq/blob/aacaf91539a90b18de21a988a204b5e842497352/client/src/main/java/org/apache/rocketmq/client/impl/consumer/DefaultMQPullConsumerImpl.java#L586-L600
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] Cczzzz commented on issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

Cczzzz commented on issue #4426:
URL: https://github.com/apache/rocketmq/issues/4426#issuecomment-1149866402

   > ![image](https://user-images.githubusercontent.com/32947555/172619035-2dafce00-bed4-4acd-a57f-a018d3592fc3.png) how about this. @caigy
   
   if topic is Retry or DLQ checkout group SUB


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] Cczzzz commented on issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

Cczzzz commented on issue #4426:
URL: https://github.com/apache/rocketmq/issues/4426#issuecomment-1149865599

   ![image](https://user-images.githubusercontent.com/32947555/172619035-2dafce00-bed4-4acd-a57f-a018d3592fc3.png)
   how about this. @caigy 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [rocketmq] caigy commented on issue #4426: ACL bug，Why does retrying a message require the send permission of the original topic

Posted by GitBox <gi...@apache.org>.

caigy commented on issue #4426:
URL: https://github.com/apache/rocketmq/issues/4426#issuecomment-1150592208

   @Cczzzz Some suggestions:
   
   - If publishing to a retry topic, get group name from it and check subscription permission to that group. Furthermore, checking DLQ topic is unnecessary, because no clients would publish to a DLQ topic directly.
   - For CONSUMER_SEND_MSG_BACK, check SUB permission of group, not retry topic.
   
   Would you like to submit a PR? Let's fix it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org