diff options
| author | Charles E. Rolke <chug@apache.org> | 2014-03-05 02:33:46 +0000 |
|---|---|---|
| committer | Charles E. Rolke <chug@apache.org> | 2014-03-05 02:33:46 +0000 |
| commit | 741aac49fb2e414a53de26e07b67a5584246c11a (patch) | |
| tree | 5f3ca7246ff32a7fd1ad4249409fb4166c62abbb /qpid/java/common/src | |
| parent | 09b098959129e58ab7e813b062b3ce6ff352767a (diff) | |
| download | qpid-python-741aac49fb2e414a53de26e07b67a5584246c11a.tar.gz | |
QPID-5599: C++ Broker silently ignores --max-connections option when no ACL file is loaded
Simply installing a null and permissive rule file trips up the 'create link'
security check. The security check from
https://issues.apache.org/jira/browse/QPID-4631 reasons that if authentication
is enabled and no ACL rule file is specified then interbroker links are
denied. The check for 'ACL rule file is loaded' is simply the existence of
the ACL object. That check is voided by always having an ACL object regardless
of whether the ACL rule file was specified or not.
One fix considered was adding an ACL rule "acl deny-log all create link" to
the formerly null rule set when no ACL file is specified. This solution has
too much complexity in several places and is too hard.
The fix implemented here is a boolean flag indicating if the ACL rule set
in force is specified by the user or not. Then the security check tests
that the acl exists (always true) and that the rule set is specified by the
user.
git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1574291 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'qpid/java/common/src')
0 files changed, 0 insertions, 0 deletions