Qpid
  1. Qpid
  2. QPID-2413

ACL - error handling/bounds checking

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Duplicate
    • Affects Version/s: 0.5, 0.6
    • Fix Version/s: 0.7
    • Component/s: C++ Broker
    • Labels:
      None

      Description

      The c++ broker accepts illegal values for the following ACL properties maxqueuesize, maxqueuecount, policytype,
      Only valid ACL rules should be accepted and an exception should thrown at startup time.

      At the moment the broker throws an exception at the point when the ACL rule with illegal values is triggered.

      Steps to Reproduce:
      #set ACL rules vith invalid values
      acl allow tester@QPID all queue maxqueuesize=18446744073709551617
      acl allow tester@QPID all queue maxqueuesize=-1
      acl allow tester@QPID all queue policytype=invalid_policy_type

        Activity

        Rajith Attapattu made changes -
        Field Original Value New Value
        Status Open [ 1 ] Closed [ 6 ]
        Resolution Duplicate [ 3 ]
        Hide
        Rajith Attapattu added a comment -

        This is a duplicate of QPID-2488

        Show
        Rajith Attapattu added a comment - This is a duplicate of QPID-2488
        Hide
        Rajith Attapattu added a comment -

        In rev 911509 in Qpid trunk, I added some error handling to catch the lexical cast errors and report a proper error message.
        As a security measure the ACL request is denied.
        This atleast prevents the broker killing the connection.

        A proper mechanism needs to be put in place to validate ACL rules.

        Show
        Rajith Attapattu added a comment - In rev 911509 in Qpid trunk, I added some error handling to catch the lexical cast errors and report a proper error message. As a security measure the ACL request is denied. This atleast prevents the broker killing the connection. A proper mechanism needs to be put in place to validate ACL rules.
        Rajith Attapattu created issue -

          People

          • Assignee:
            Rajith Attapattu
            Reporter:
            Rajith Attapattu
          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development