You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@qpid.apache.org by "Arnaud Simon (JIRA)" <qp...@incubator.apache.org> on 2008/12/19 16:25:44 UTC
[jira] Created: (QPID-1545) ACL failure
ACL failure
-----------
Key: QPID-1545
URL: https://issues.apache.org/jira/browse/QPID-1545
Project: Qpid
Issue Type: Bug
Components: C++ Broker
Affects Versions: M4
Reporter: Arnaud Simon
The c++ broker is segfaulting when the ACL file contains the entry "acl all all"
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-1545) ACL failure
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-1545?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12658761#action_12658761 ]
Rajith Attapattu commented on QPID-1545:
----------------------------------------
After investigating I found that the acl module has a bug when processing the following line in the acl file.
"group admin admin "
Groups are allowed to contain other groups, and the users of those groups are added to the parent group.
Sp the code first checks if a given name in the list is actually a group (instead of a user).
In this case the username given matches the group name we just created and is mistakenly identified as group. Therefore the code tries to add all the users of the "admin" group (which is empty) instead of adding the user "admin" which results in an empty list for the admin group.
I have fixed the issue by adding a simple check to prevent the above situation by checking if the user name given is the same as the current group name.
However the ACL file given here is also not correct as the username does not have a realm. This will not enfore any ACL as all the given in the ACL file does not have a realm. The correct entry should "group admin admin@QPID".
This means that if a user name is given without a realm, the ACL module should either,
a) Default to the realm specified for the broker. (Default value is 'QPID')
b) Print a warning that the given usernames does not contain a realm.
> ACL failure
> -----------
>
> Key: QPID-1545
> URL: https://issues.apache.org/jira/browse/QPID-1545
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: M4
> Reporter: Arnaud Simon
> Attachments: acldump.txt, core.qpidd.4273.zip
>
>
> The c++ broker is segfaulting when the ACL file contains the entry "acl all all"
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-1545) ACL failure
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-1545?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rajith Attapattu updated QPID-1545:
-----------------------------------
Fix Version/s: M4
Assignee: Rajith Attapattu
> ACL failure
> -----------
>
> Key: QPID-1545
> URL: https://issues.apache.org/jira/browse/QPID-1545
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: M4
> Reporter: Arnaud Simon
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: acldump.txt, core.qpidd.4273.zip
>
>
> The c++ broker segfaults when an ACL file contains a group with a single user that has the same name as the group.
> Ex "group admin admin"
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-1545) ACL failure
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-1545?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12658766#action_12658766 ]
Rajith Attapattu commented on QPID-1545:
----------------------------------------
I have comitted a fix at rev 728880 on trunk.
I have test case that I would like to check in to cover the above case. However I want to fist resolve the issue of what should should be done if a user is specified without a realm.
> ACL failure
> -----------
>
> Key: QPID-1545
> URL: https://issues.apache.org/jira/browse/QPID-1545
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: M4
> Reporter: Arnaud Simon
> Attachments: acldump.txt, core.qpidd.4273.zip
>
>
> The c++ broker segfaults when an ACL file contains a group with a single user that has the same name as the group.
> Ex "group admin admin"
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (QPID-1545) ACL failure
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-1545?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rajith Attapattu resolved QPID-1545.
------------------------------------
Resolution: Fixed
The issue that causes the seg fault has been fixed and committed.
QPID-1558 (which is not in scope for M4) covers the decesion reached to reject usernames that does not contain a realm.
The test case will also be checked in along with the fix to QPID-1558
> ACL failure
> -----------
>
> Key: QPID-1545
> URL: https://issues.apache.org/jira/browse/QPID-1545
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: M4
> Reporter: Arnaud Simon
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: acldump.txt, core.qpidd.4273.zip
>
>
> The c++ broker segfaults when an ACL file contains a group with a single user that has the same name as the group.
> Ex "group admin admin"
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-1545) ACL failure
Posted by "Carl Trieloff (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-1545?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12658840#action_12658840 ]
Carl Trieloff commented on QPID-1545:
-------------------------------------
We either need to reject then, or assume the default realm.
I think rejecting them is the safer option. I.e. update the parser to fail with an error if a user is specified without a realm.
Carl.
> ACL failure
> -----------
>
> Key: QPID-1545
> URL: https://issues.apache.org/jira/browse/QPID-1545
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: M4
> Reporter: Arnaud Simon
> Attachments: acldump.txt, core.qpidd.4273.zip
>
>
> The c++ broker segfaults when an ACL file contains a group with a single user that has the same name as the group.
> Ex "group admin admin"
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-1545) ACL failure
Posted by "Arnaud Simon (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-1545?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12658104#action_12658104 ]
Arnaud Simon commented on QPID-1545:
------------------------------------
===== ACL file was:
# sample qpid ACL file
# see http://cwiki.apache.org/qpid/acl.html for more details
group test guest lsnr foo
group admin admin
acl deny foo all
acl allow admin all
# initial testing, allow all operations
acl deny all all
==== broker trace
Startup trace:
2008-dec-18 10:54:22 debug ManagementBroker added package
com.redhat.rhm.store
2008-dec-18 10:54:22 debug ManagementBroker added class
com.redhat.rhm.store:store
2008-dec-18 10:54:22 debug ManagementBroker added class
com.redhat.rhm.store:journal
2008-dec-18 10:54:22 debug ManagementBroker added package
org.apache.qpid.acl
2008-dec-18 10:54:22 debug ManagementBroker added class
org.apache.qpid.acl:acl
2008-dec-18 10:54:22 debug ManagementBroker added class
org.apache.qpid.acl:allow
2008-dec-18 10:54:22 debug ManagementBroker added class
org.apache.qpid.acl:deny
2008-dec-18 10:54:22 debug ManagementBroker added class
org.apache.qpid.acl:fileLoaded
2008-dec-18 10:54:22 debug ManagementBroker added class
org.apache.qpid.acl:fileLoadFailed
2008-dec-18 10:54:22 notice Read ACL file
"/export/home/amqmadm/.qpidd/qpidd.acl"
2008-dec-18 10:54:22 debug Group list: 2 groups found:
2008-dec-18 10:54:22 debug "admin":
2008-dec-18 10:54:22 debug "test": andrew guest lsnr weblogic
2008-dec-18 10:54:22 debug Name list: 5 names found:
2008-dec-18 10:54:22 debug * andrew guest lsnr weblogic
2008-dec-18 10:54:22 debug Rule list: 3 ACL rules found:
2008-dec-18 10:54:22 debug 0 deny [andrew] *
2008-dec-18 10:54:22 debug 1 allow [] *
2008-dec-18 10:54:22 debug 2 deny [*] *
2008-dec-18 10:54:22 debug ACL Load Rules
2008-dec-18 10:54:22 debug ACL Processing 3 deny [*] *
2008-dec-18 10:54:22 debug ACL FoundMode deny
2008-dec-18 10:54:22 debug ACL Processing 2 allow [] *
2008-dec-18 10:54:22 debug ACL Adding action:consume
2008-dec-18 10:54:22 debug ACL Adding object:queue
Segmentation fault
> ACL failure
> -----------
>
> Key: QPID-1545
> URL: https://issues.apache.org/jira/browse/QPID-1545
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: M4
> Reporter: Arnaud Simon
>
> The c++ broker is segfaulting when the ACL file contains the entry "acl all all"
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-1545) ACL failure
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-1545?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rajith Attapattu updated QPID-1545:
-----------------------------------
Description:
The c++ broker segfaults when an ACL file contains a group with a single user that has the same name as the group.
Ex "group admin admin"
was:The c++ broker is segfaulting when the ACL file contains the entry "acl all all"
> ACL failure
> -----------
>
> Key: QPID-1545
> URL: https://issues.apache.org/jira/browse/QPID-1545
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: M4
> Reporter: Arnaud Simon
> Attachments: acldump.txt, core.qpidd.4273.zip
>
>
> The c++ broker segfaults when an ACL file contains a group with a single user that has the same name as the group.
> Ex "group admin admin"
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-1545) ACL failure
Posted by "Arnaud Simon (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-1545?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Arnaud Simon updated QPID-1545:
-------------------------------
Attachment: acldump.txt
acl dump
> ACL failure
> -----------
>
> Key: QPID-1545
> URL: https://issues.apache.org/jira/browse/QPID-1545
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: M4
> Reporter: Arnaud Simon
> Attachments: acldump.txt, core.qpidd.4273.zip
>
>
> The c++ broker is segfaulting when the ACL file contains the entry "acl all all"
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-1545) ACL failure
Posted by "Arnaud Simon (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-1545?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Arnaud Simon updated QPID-1545:
-------------------------------
Attachment: core.qpidd.4273.zip
core
> ACL failure
> -----------
>
> Key: QPID-1545
> URL: https://issues.apache.org/jira/browse/QPID-1545
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: M4
> Reporter: Arnaud Simon
> Attachments: acldump.txt, core.qpidd.4273.zip
>
>
> The c++ broker is segfaulting when the ACL file contains the entry "acl all all"
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.