You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@qpid.apache.org by "Alexander N. Moibenko" <mo...@fnal.gov> on 2016/02/24 17:54:39 UTC
authenticated message size restricted to 65535
On 23/02/16 15:11, Alexander N. Moibenko wrote:
> Hello,
> I recently found that authenticated message size (GSSAPI in my case) is
> restricted to 65535.
> In cyrus-sasl there also is a restriction. According to gssapi.c it is
> 0xFFFFFF=16777215.
> In qpid SaslFactory.cpp it is hard-coded to secprops.maxbufsize = 65535;
> There are also some places where maxFrameSize is set to
> 65535. What does this mean? I know that there is a restriction on UDP
> message size, which is 64KB, but why there is a restriction to
> authenticated TCP/IP qpid message? There is not restriction to
> non-authenticated message though.
> I wonder why it is set to such value and can anything else be done to
> safely increase this size not re-compiling the code?
AMQP 0-10 frames have their size encoded as a 16 bit value, hence the
maximum size for a frame using that protocol is 65535 bytes. However you
can construct messages with body sizes larger than that by having
multiple frames for the same message.
Could you please elaborate on as how to construct such messages?
Are there procedures or APIs provided by AMQP or I hav to to desing my own "protocol".
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org
Re: authenticated message size restricted to 65535
Posted by Gordon Sim <gs...@redhat.com>.
On 25/02/16 21:00, Alexander N. Moibenko wrote:
> On 02/25/2016 01:59 PM, Gordon Sim wrote:
>> It doesn't look like the python module is finding that sasl library.
>> What do you see for rpm -ql python-qpid?
> It actually does. When I remove this
> python-saslwrapper-0.14-1.el6.x86_64 I have authentication failure in my
> client.
You are right, my apologies! The issue in your previous stack trace
seems to be a result of the library trying to set the maxssf as a string
rather than an int for some reason.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org
Re: authenticated message size restricted to 65535
Posted by "Alexander N. Moibenko" <mo...@fnal.gov>.
On 02/25/2016 01:59 PM, Gordon Sim wrote:
> On 25/02/16 19:50, Alexander N. Moibenko wrote:
>> Yes, here are all python rpm installed on my machine:
>> [enstore@dmsen03 ~]$ rpm -qa | grep python
>> python-psycopg2-2.5.3-1.rhel6.x86_64
>> rpm-python-4.8.0-38.el6_6.x86_64
>> python-urlgrabber-3.9.1-9.el6.noarch
>> python-iniparse-0.3.1-2.1.el6.noarch
>> python-qpid-qmf-0.14-14.el6_3.x86_64
>> python-pycurl-7.19.0-8.el6.x86_64
>> newt-python-0.52.11-3.el6.x86_64
>> python-qpid-0.14-11.el6_3.noarch
>> python-libs-2.6.6-52.el6.x86_64
>> boost-python-1.41.0-27.el6.x86_64
>> python-2.6.6-52.el6.x86_64
>> libxml2-python-2.7.6-17.el6_6.1.x86_64
>> python-saslwrapper-0.14-1.el6.x86_64
>
> It doesn't look like the python module is finding that sasl library.
> What do you see for rpm -ql python-qpid?
It actually does. When I remove this
python-saslwrapper-0.14-1.el6.x86_64 I have authentication failure in my
client.
>
> (0.14 is pretty old you may want to get more recent versions at some
> point. There are more recent packages for RHEL 6 and CentOS 6 in copr
> I believe, more details at https://qpid.apache.org/packages.html)
Yes, but this is what is in our site SLF6 repo.
I tried 0.34 c++ server and 0.32 qpid-python which had the same problem.
I'll try to install newer rpms from somwhere else.
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
> For additional commands, e-mail: dev-help@qpid.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org
Re: authenticated message size restricted to 65535
Posted by Gordon Sim <gs...@redhat.com>.
On 25/02/16 19:50, Alexander N. Moibenko wrote:
> Yes, here are all python rpm installed on my machine:
> [enstore@dmsen03 ~]$ rpm -qa | grep python
> python-psycopg2-2.5.3-1.rhel6.x86_64
> rpm-python-4.8.0-38.el6_6.x86_64
> python-urlgrabber-3.9.1-9.el6.noarch
> python-iniparse-0.3.1-2.1.el6.noarch
> python-qpid-qmf-0.14-14.el6_3.x86_64
> python-pycurl-7.19.0-8.el6.x86_64
> newt-python-0.52.11-3.el6.x86_64
> python-qpid-0.14-11.el6_3.noarch
> python-libs-2.6.6-52.el6.x86_64
> boost-python-1.41.0-27.el6.x86_64
> python-2.6.6-52.el6.x86_64
> libxml2-python-2.7.6-17.el6_6.1.x86_64
> python-saslwrapper-0.14-1.el6.x86_64
It doesn't look like the python module is finding that sasl library.
What do you see for rpm -ql python-qpid?
(0.14 is pretty old you may want to get more recent versions at some
point. There are more recent packages for RHEL 6 and CentOS 6 in copr I
believe, more details at https://qpid.apache.org/packages.html)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org
Re: authenticated message size restricted to 65535
Posted by "Alexander N. Moibenko" <mo...@fnal.gov>.
On 02/25/2016 01:40 PM, Gordon Sim wrote:
> On 25/02/16 18:01, Alexander N. Moibenko wrote:
>>
>>
>> On 02/25/2016 11:48 AM, Gordon Sim wrote:
>>> On 25/02/16 17:23, Alexander N. Moibenko wrote:
>>>>
>>>>
>>>> On 02/25/2016 10:39 AM, Gordon Sim wrote:
>>>>> Another workaround is simply to set the sasl_max_ssf to 0. That way
>>>>> you still use kerberos for authentication, but don't encrypt the
>>>>> messages.
>>>> Could you tell me where and how I set it.
>>>> I tried
>>>> sasl_max_ssf: 0
>>>> in /etc/sasl2/qpidd.conf to no effect.
>>>
>>> You need to set it on the clients I'm afraid. It is a connection
>>> option for qpid::messaging, so use
>>> qpid::messaging::Connection::setOption().
>>>
>>> I have been assuming you are using AMQP 0-10 here. If so, another
>>> option might be to try using AMQP 1.0? (Specify connection option
>>> 'protocol' as 'amqp1.0'). I am merely speculating here, but certainly
>>> it does not have the same protocol level limit and it is a different
>>> codepath for fragmentation etc.
>>
>> I am doing this using python inteface.
>>
>> Here is the simple test code:
>> import qpid.messaging
>>
>> conn = qpid.messaging.Connection(host='dmsen05',
>> port=5672,
>> username=None,
>> password=None,
>> sasl_max_ssf=0,
>> sasl_mechanisms=['GSSAPI'],
>> reconnect=True,
>> reconnect_interval=60,
>> )
>> conn.open()
>>
>> print "OPEN"
>>
>> conn.close()
>>
>> Here is what happens:
>> [enstore@dmsen05 messaging]$ python ct.py
>> Traceback (most recent call last):
>> File "ct.py", line 12, in <module>
>> conn.open()
>> File "<string>", line 6, in open
>> File
>> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
>>
>> line 256, in open
>> self.attach()
>> File "<string>", line 6, in attach
>> File
>> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
>>
>> line 274, in attach
>> self._ewait(lambda: self._transport_connected and not
>> self._unlinked())
>> File
>> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
>>
>> line 209, in _ewait
>> self.check_error()
>> File
>> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
>>
>> line 202, in check_error
>> raise self.error
>> qpid.messaging.exceptions.InternalError: Traceback (most recent call
>> last):
>> File
>> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/driver.py",
>>
>> line 509, in dispatch
>> self.connect()
>> File
>> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/driver.py",
>>
>> line 528, in connect
>> self.engine = Engine(self.connection)
>> File
>> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/driver.py",
>>
>> line 615, in __init__
>> self._sasl.setAttr("maxssf", self.connection.sasl_max_ssf)
>> File "/opt/enstore/Python/lib/python2.7/site-packages/qpid/sasl.py",
>> line 36, in setAttr
>> raise SASLError(self._cli.getError())
>> SASLError: Error in setAttr (-1) Unknown string attribute name - maxssf
>>
>>
>> Looks as there is another bug, now in qpid/sasl.py, this file is a part
>> of rpm python-qpid-0.14-11.el6_3.noarch
>
> Do you have python-saslwrapper installed?
Yes, here are all python rpm installed on my machine:
[enstore@dmsen03 ~]$ rpm -qa | grep python
python-psycopg2-2.5.3-1.rhel6.x86_64
rpm-python-4.8.0-38.el6_6.x86_64
python-urlgrabber-3.9.1-9.el6.noarch
python-iniparse-0.3.1-2.1.el6.noarch
python-qpid-qmf-0.14-14.el6_3.x86_64
python-pycurl-7.19.0-8.el6.x86_64
newt-python-0.52.11-3.el6.x86_64
python-qpid-0.14-11.el6_3.noarch
python-libs-2.6.6-52.el6.x86_64
boost-python-1.41.0-27.el6.x86_64
python-2.6.6-52.el6.x86_64
libxml2-python-2.7.6-17.el6_6.1.x86_64
python-saslwrapper-0.14-1.el6.x86_64
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
> For additional commands, e-mail: dev-help@qpid.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org
Re: authenticated message size restricted to 65535
Posted by Gordon Sim <gs...@redhat.com>.
On 25/02/16 18:01, Alexander N. Moibenko wrote:
>
>
> On 02/25/2016 11:48 AM, Gordon Sim wrote:
>> On 25/02/16 17:23, Alexander N. Moibenko wrote:
>>>
>>>
>>> On 02/25/2016 10:39 AM, Gordon Sim wrote:
>>>> Another workaround is simply to set the sasl_max_ssf to 0. That way
>>>> you still use kerberos for authentication, but don't encrypt the
>>>> messages.
>>> Could you tell me where and how I set it.
>>> I tried
>>> sasl_max_ssf: 0
>>> in /etc/sasl2/qpidd.conf to no effect.
>>
>> You need to set it on the clients I'm afraid. It is a connection
>> option for qpid::messaging, so use
>> qpid::messaging::Connection::setOption().
>>
>> I have been assuming you are using AMQP 0-10 here. If so, another
>> option might be to try using AMQP 1.0? (Specify connection option
>> 'protocol' as 'amqp1.0'). I am merely speculating here, but certainly
>> it does not have the same protocol level limit and it is a different
>> codepath for fragmentation etc.
>
> I am doing this using python inteface.
>
> Here is the simple test code:
> import qpid.messaging
>
> conn = qpid.messaging.Connection(host='dmsen05',
> port=5672,
> username=None,
> password=None,
> sasl_max_ssf=0,
> sasl_mechanisms=['GSSAPI'],
> reconnect=True,
> reconnect_interval=60,
> )
> conn.open()
>
> print "OPEN"
>
> conn.close()
>
> Here is what happens:
> [enstore@dmsen05 messaging]$ python ct.py
> Traceback (most recent call last):
> File "ct.py", line 12, in <module>
> conn.open()
> File "<string>", line 6, in open
> File
> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
> line 256, in open
> self.attach()
> File "<string>", line 6, in attach
> File
> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
> line 274, in attach
> self._ewait(lambda: self._transport_connected and not
> self._unlinked())
> File
> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
> line 209, in _ewait
> self.check_error()
> File
> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
> line 202, in check_error
> raise self.error
> qpid.messaging.exceptions.InternalError: Traceback (most recent call last):
> File
> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/driver.py",
> line 509, in dispatch
> self.connect()
> File
> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/driver.py",
> line 528, in connect
> self.engine = Engine(self.connection)
> File
> "/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/driver.py",
> line 615, in __init__
> self._sasl.setAttr("maxssf", self.connection.sasl_max_ssf)
> File "/opt/enstore/Python/lib/python2.7/site-packages/qpid/sasl.py",
> line 36, in setAttr
> raise SASLError(self._cli.getError())
> SASLError: Error in setAttr (-1) Unknown string attribute name - maxssf
>
>
> Looks as there is another bug, now in qpid/sasl.py, this file is a part
> of rpm python-qpid-0.14-11.el6_3.noarch
Do you have python-saslwrapper installed?
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org
Re: authenticated message size restricted to 65535
Posted by "Alexander N. Moibenko" <mo...@fnal.gov>.
On 02/25/2016 11:48 AM, Gordon Sim wrote:
> On 25/02/16 17:23, Alexander N. Moibenko wrote:
>>
>>
>> On 02/25/2016 10:39 AM, Gordon Sim wrote:
>>> Another workaround is simply to set the sasl_max_ssf to 0. That way
>>> you still use kerberos for authentication, but don't encrypt the
>>> messages.
>> Could you tell me where and how I set it.
>> I tried
>> sasl_max_ssf: 0
>> in /etc/sasl2/qpidd.conf to no effect.
>
> You need to set it on the clients I'm afraid. It is a connection
> option for qpid::messaging, so use
> qpid::messaging::Connection::setOption().
>
> I have been assuming you are using AMQP 0-10 here. If so, another
> option might be to try using AMQP 1.0? (Specify connection option
> 'protocol' as 'amqp1.0'). I am merely speculating here, but certainly
> it does not have the same protocol level limit and it is a different
> codepath for fragmentation etc.
I am doing this using python inteface.
Here is the simple test code:
import qpid.messaging
conn = qpid.messaging.Connection(host='dmsen05',
port=5672,
username=None,
password=None,
sasl_max_ssf=0,
sasl_mechanisms=['GSSAPI'],
reconnect=True,
reconnect_interval=60,
)
conn.open()
print "OPEN"
conn.close()
Here is what happens:
[enstore@dmsen05 messaging]$ python ct.py
Traceback (most recent call last):
File "ct.py", line 12, in <module>
conn.open()
File "<string>", line 6, in open
File
"/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
line 256, in open
self.attach()
File "<string>", line 6, in attach
File
"/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
line 274, in attach
self._ewait(lambda: self._transport_connected and not self._unlinked())
File
"/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
line 209, in _ewait
self.check_error()
File
"/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/endpoints.py",
line 202, in check_error
raise self.error
qpid.messaging.exceptions.InternalError: Traceback (most recent call last):
File
"/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/driver.py",
line 509, in dispatch
self.connect()
File
"/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/driver.py",
line 528, in connect
self.engine = Engine(self.connection)
File
"/opt/enstore/Python/lib/python2.7/site-packages/qpid/messaging/driver.py",
line 615, in __init__
self._sasl.setAttr("maxssf", self.connection.sasl_max_ssf)
File "/opt/enstore/Python/lib/python2.7/site-packages/qpid/sasl.py",
line 36, in setAttr
raise SASLError(self._cli.getError())
SASLError: Error in setAttr (-1) Unknown string attribute name - maxssf
Looks as there is another bug, now in qpid/sasl.py, this file is a part
of rpm python-qpid-0.14-11.el6_3.noarch
>
>>> If you can test whether
>>> reducing that value fixes your issue, that would speed up resolution.
>>> In any case, raise a JIRA for this and I'll try to have a look at it
>>> asap.
>> reducing what value?
>
> I meant the maxbufsize for cyrus sasl. Actually though, now I think
> about it more, I'm not so sure this is the issue. It is the whole
> frame that is encrypted, not just the payload, and in any case this
> value is merely an indication of how much data to expect as input.
>
>> I am sorry, I do not know how to open JIRA.
>> Can you provide instructions?
>
> Go to https://issues.apache.org/jira/browse/QPID/ and click the
> 'create' button, then fill in the form with as much detail as you can
> and submit.
Thanks!
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
> For additional commands, e-mail: dev-help@qpid.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org
Re: authenticated message size restricted to 65535
Posted by Gordon Sim <gs...@redhat.com>.
On 25/02/16 17:23, Alexander N. Moibenko wrote:
>
>
> On 02/25/2016 10:39 AM, Gordon Sim wrote:
>> Another workaround is simply to set the sasl_max_ssf to 0. That way
>> you still use kerberos for authentication, but don't encrypt the
>> messages.
> Could you tell me where and how I set it.
> I tried
> sasl_max_ssf: 0
> in /etc/sasl2/qpidd.conf to no effect.
You need to set it on the clients I'm afraid. It is a connection option
for qpid::messaging, so use qpid::messaging::Connection::setOption().
I have been assuming you are using AMQP 0-10 here. If so, another option
might be to try using AMQP 1.0? (Specify connection option 'protocol' as
'amqp1.0'). I am merely speculating here, but certainly it does not have
the same protocol level limit and it is a different codepath for
fragmentation etc.
>> If you can test whether
>> reducing that value fixes your issue, that would speed up resolution.
>> In any case, raise a JIRA for this and I'll try to have a look at it
>> asap.
> reducing what value?
I meant the maxbufsize for cyrus sasl. Actually though, now I think
about it more, I'm not so sure this is the issue. It is the whole frame
that is encrypted, not just the payload, and in any case this value is
merely an indication of how much data to expect as input.
> I am sorry, I do not know how to open JIRA.
> Can you provide instructions?
Go to https://issues.apache.org/jira/browse/QPID/ and click the 'create'
button, then fill in the form with as much detail as you can and submit.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org
Re: authenticated message size restricted to 65535
Posted by "Alexander N. Moibenko" <mo...@fnal.gov>.
On 02/25/2016 10:39 AM, Gordon Sim wrote:
> On 25/02/16 16:22, Alexander N. Moibenko wrote:
>> Thanks for reply Gordon,
>> I am considering this issue as a bug.
>> This is what happened to me: I selected and use AMQP because it was
>> announced as a reliable way of communication without any restriction on
>> the message size. Well, there may be a restriction but I could not find
>> it in documentation. Indeed there should be no restriction as it uses
>> TCP/IP and I believe it fragments and defragments messages inside. So
>> all worked for me well before I was requested by site security to stop
>> using
>> unsecured transfer. I configured GSSAPI authentication, tested it (not
>> thinking about message size limitations) and installed in production.
>> And here it began. Now I had to back out to anonymous and ask site
>> security for exemption.
>
> Another workaround is simply to set the sasl_max_ssf to 0. That way
> you still use kerberos for authentication, but don't encrypt the
> messages.
Could you tell me where and how I set it.
I tried
sasl_max_ssf: 0
in /etc/sasl2/qpidd.conf to no effect.
>> I looked at AMQP 0.34 and still see a lot of hadrcoded 65535 all over
>> the code.
>
> In some places that will be appropriate as the protocol (v 0-10) has a
> fixed limit.
>
> The sasl max buffer size is a different case though. The issue there
> is less that it is hardcoded and more that I think it my be an invalid
> value.
>
>> Can this issue be addressed in development?
>> I probably can change all these hardcoded values and recompile, but it
>> will require a lot of unexpected effort and still will be not good to
>> run in production.
>
> Yes, I agree it is a bug and should be fixed. If you can test whether
> reducing that value fixes your issue, that would speed up resolution.
> In any case, raise a JIRA for this and I'll try to have a look at it
> asap.
reducing what value?
I am sorry, I do not know how to open JIRA.
Can you provide instructions?
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
> For additional commands, e-mail: dev-help@qpid.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org
Re: authenticated message size restricted to 65535
Posted by Gordon Sim <gs...@redhat.com>.
On 25/02/16 16:22, Alexander N. Moibenko wrote:
> Thanks for reply Gordon,
> I am considering this issue as a bug.
> This is what happened to me: I selected and use AMQP because it was
> announced as a reliable way of communication without any restriction on
> the message size. Well, there may be a restriction but I could not find
> it in documentation. Indeed there should be no restriction as it uses
> TCP/IP and I believe it fragments and defragments messages inside. So
> all worked for me well before I was requested by site security to stop
> using
> unsecured transfer. I configured GSSAPI authentication, tested it (not
> thinking about message size limitations) and installed in production.
> And here it began. Now I had to back out to anonymous and ask site
> security for exemption.
Another workaround is simply to set the sasl_max_ssf to 0. That way you
still use kerberos for authentication, but don't encrypt the messages.
> I looked at AMQP 0.34 and still see a lot of hadrcoded 65535 all over
> the code.
In some places that will be appropriate as the protocol (v 0-10) has a
fixed limit.
The sasl max buffer size is a different case though. The issue there is
less that it is hardcoded and more that I think it my be an invalid value.
> Can this issue be addressed in development?
> I probably can change all these hardcoded values and recompile, but it
> will require a lot of unexpected effort and still will be not good to
> run in production.
Yes, I agree it is a bug and should be fixed. If you can test whether
reducing that value fixes your issue, that would speed up resolution. In
any case, raise a JIRA for this and I'll try to have a look at it asap.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org
Re: authenticated message size restricted to 65535
Posted by "Alexander N. Moibenko" <mo...@fnal.gov>.
Thanks for reply Gordon,
I am considering this issue as a bug.
This is what happened to me: I selected and use AMQP because it was
announced as a reliable way of communication without any restriction on
the message size. Well, there may be a restriction but I could not find
it in documentation. Indeed there should be no restriction as it uses
TCP/IP and I believe it fragments and defragments messages inside. So
all worked for me well before I was requested by site security to stop using
unsecured transfer. I configured GSSAPI authentication, tested it (not
thinking about message size limitations) and installed in production.
And here it began. Now I had to back out to anonymous and ask site
security for exemption.
I looked at AMQP 0.34 and still see a lot of hadrcoded 65535 all over
the code.
Can this issue be addressed in development?
I probably can change all these hardcoded values and recompile, but it
will require a lot of unexpected effort and still will be not good to
run in production.
Alexander
On 02/25/2016 09:12 AM, Gordon Sim wrote:
> On 24/02/16 16:54, Alexander N. Moibenko wrote:
>> Could you please elaborate on as how to construct such messages?
>> Are there procedures or APIs provided by AMQP or I hav to to desing my
>> own "protocol".
>
> You should be able to send a larger message using qpid messaging or
> JMS, no special code is required by the application.
>
> However where a security layer is used, the message data is
> transformed, so there may well be a bug somewhere that prevents
> fragmentation working as expected here.
>
> You mentioned that secprops.maxbufsize is set to 65535. It is possible
> that is the issue. Assuming that indicates the largest chunk of data
> that can be emitted by the security layer, it is too large as that is
> the maximum size of an entire AMQP 0-10 frame, not simply the usable
> data of a transfer frame.
>
> So actually, lowering that value may be the correct thing to do.
> Unfortunately, since it is hardcoded, there is no way to avoid
> recompilation.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
> For additional commands, e-mail: dev-help@qpid.apache.org
>
>
Re: authenticated message size restricted to 65535
Posted by Gordon Sim <gs...@redhat.com>.
On 24/02/16 16:54, Alexander N. Moibenko wrote:
> Could you please elaborate on as how to construct such messages?
> Are there procedures or APIs provided by AMQP or I hav to to desing my
> own "protocol".
You should be able to send a larger message using qpid messaging or JMS,
no special code is required by the application.
However where a security layer is used, the message data is transformed,
so there may well be a bug somewhere that prevents fragmentation working
as expected here.
You mentioned that secprops.maxbufsize is set to 65535. It is possible
that is the issue. Assuming that indicates the largest chunk of data
that can be emitted by the security layer, it is too large as that is
the maximum size of an entire AMQP 0-10 frame, not simply the usable
data of a transfer frame.
So actually, lowering that value may be the correct thing to do.
Unfortunately, since it is hardcoded, there is no way to avoid
recompilation.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org