From a97fec3b8f6c62c6564212e08dcd36eaa10f9b7b Mon Sep 17 00:00:00 2001 From: Gordon Sim Date: Thu, 26 Nov 2015 22:48:55 +0000 Subject: QPID-6754: ensure anonymous-relay doesn't expose ability to detect whether or not entity exists for those without permissions git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1716781 13f79535-47bb-0310-9956-ffa450edef68 --- qpid/cpp/src/tests/acl_1.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'qpid/cpp/src/tests') diff --git a/qpid/cpp/src/tests/acl_1.py b/qpid/cpp/src/tests/acl_1.py index 5419b87372..79d87fdc6e 100644 --- a/qpid/cpp/src/tests/acl_1.py +++ b/qpid/cpp/src/tests/acl_1.py @@ -270,23 +270,41 @@ class Acl_AMQP1_Tests (VersionTest): def test_publish_to_anonymous_relay(self): self.acl.allow('bob', 'access', 'exchange', 'name=ANONYMOUS-RELAY') self.acl.allow('bob', 'access', 'queue', 'name=acl_test_queue') + self.acl.allow('bob', 'access', 'exchange', 'name=acl_test_queue') self.acl.allow('bob', 'publish', 'exchange', 'routingkey=acl_test_queue') self.acl.allow('bob', 'access', 'exchange', 'name=amq.topic') + self.acl.allow('bob', 'access', 'queue', 'name=amq.topic') self.acl.allow('bob', 'publish', 'exchange', 'name=amq.topic', 'routingkey=abc') + self.acl.allow('bob', 'access', 'exchange', 'name=amq.direct') + self.acl.allow('bob', 'access', 'queue', 'name=amq.direct') self.acl.allow('alice').deny().apply() sender = self.bob.sender("") sender.send(Message("a message", properties={'x-amqp-to':'acl_test_queue'}), sync=True) sender.send(Message("another", subject='abc', properties={'x-amqp-to':'amq.topic'}), sync=True) try: + # have access permission, but publish not allowed for given key sender.send(Message("a third", subject='def', properties={'x-amqp-to':'amq.topic'}), sync=True) assert False, "bob should not be allowed to send message to amq.topic with key 'def'" except UnauthorizedAccess: pass sender = self.bob.sender("") try: + # have access permission, but no publish sender.send(Message("a fourth", subject='abc', properties={'x-amqp-to':'amq.direct'}), sync=True) assert False, "bob should not be allowed to send message to amq.direct" except UnauthorizedAccess: pass + sender = self.bob.sender("") + try: + # have no access permission + sender.send(Message("a fiftth", subject='abc', properties={'x-amqp-to':'amq.fanout'}), sync=True) + assert False, "bob should not be allowed to send message to amq.fanout" + except UnauthorizedAccess: pass + sender = self.bob.sender("") + try: + # have no access permission + sender.send(Message("a sixth", properties={'x-amqp-to':'somewhereelse'}), sync=True) + assert False, "bob should not be allowed to send message to somewhere else" + except UnauthorizedAccess: pass sender = self.alice.sender("") sender.send(Message("alice's message", properties={'x-amqp-to':'abc'}), sync=True) sender.send(Message("another from alice", properties={'x-amqp-to':'def'}), sync=True) -- cgit v1.2.1