Proxy roles enforcement #1168
Merged
Proxy roles enforcement #1168
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jai1
added
the
type/enhancement
|
Forgot to mention: This enhancement is configurable - if you don't populate the proxyRoles then the behavior falls back to default. |
merlimat
reviewed
Feb 1, 2018
| @@ -196,6 +202,16 @@ protected void handleLookup(CommandLookupTopic lookup) { | |||
| if (lookupSemaphore.tryAcquire()) { | |||
| final String originalPrincipal = lookup.hasOriginalPrincipal() ? lookup.getOriginalPrincipal() | |||
| : this.originalPrincipal; | |||
| if (service.isAuthorizationEnabled() && proxyRoles.contains(authRole)) { | |||
There was a problem hiding this comment.
We should have the 3 similar blocks of code in a single method
|
retest this please |
|
@merlimat @rdhabalia @saandrews @msb-at-yahoo - please review this when you find the time. |
saandrews
reviewed
Feb 2, 2018
| // Step 1: Create Admin Client | ||
| createAdminClient(); | ||
| final String proxyServiceUrl = "pulsar://localhost:" + servicePort; | ||
| // create a client which connects to proxy over tls and pass authData |
There was a problem hiding this comment.
If the test is not using tls, please remove the comment.
saandrews
approved these changes
Feb 2, 2018
|
retest this please |
added 2 commits
February 4, 2018 18:13
saandrews
approved these changes
Feb 5, 2018
merlimat
reviewed
Feb 6, 2018
| @@ -196,6 +215,13 @@ protected void handleLookup(CommandLookupTopic lookup) { | |||
| if (lookupSemaphore.tryAcquire()) { | |||
| final String originalPrincipal = lookup.hasOriginalPrincipal() ? lookup.getOriginalPrincipal() | |||
| : this.originalPrincipal; | |||
| if (!validateOriginalPrincipal(originalPrincipal, | |||
| newLookupErrorResponse(ServerError.AuthorizationError, | |||
There was a problem hiding this comment.
We cannot create the buffer in all cases, otherwise this is being leaked when there is no error.
This was referenced Feb 6, 2018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The broker should be able to distinguish between a proxy and a client so that no compromised proxy can impersonate a client.
To be specific - once a proxy host is compromised it can choose to send originalPrincipal as null which will make the broker treat it as a normal client and authenticate/authorize the proxy as a normal client rather than demanding to authorize the originalPrincipal.
So for example:-
A client using topic T1 with roleToken R1 going through proxy with roleToken R3 will require granting AuthAction produce/consume on both R1 and R3 (proxy).
Similarly, a client using topic T2 with roleToken R2 going through the same proxy will require granting AuthAction produce/consume on both R1 and R3 (proxy).
Now with my current code if proxy is compromised it can access topics T1 and T2 without requiring client roleToken (R1 and R2) at all by passing originalPrincipal as null.
If I add a broker side setting "proxyRoles=R3, R4", then as soon as I see that the roleToken (R3) extracted from the incoming cert is in proxyRoles (R3, R4) then I can return an error if originalPrincipal is null.
Thanks to @msb-at-yahoo for suggesting this.