[cleanup][broker] Validate originalPrincipal earlier in ServerCnx #19270

michaeljmarshall · 2023-01-18T07:46:36Z

Motivation

The current ServerCnx validates the proxy role on certain protocol messages. This is unnecessary. Instead, we should verify that the authRole and the originalPrincipal are a valid combination before going to the Connected state.

Modifications

Replace invalidOriginalPrincipal with validateRoleAndOriginalPrincipal.
Remove calls to invalidOriginalPrincipal.
Add call to validateRoleAndOriginalPrincipal when transitioning from Connecting to Connected state.

Verifying this change

Added new test in ServerCnxTest to validate the authorization.

Documentation

doc-required

I updated the appropriate Javadocs, but we should also update the protocol spec to indicate valid combinations of the Connect command.

Matching PR in forked repository

PR in forked repository: michaeljmarshall#13

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java

michaeljmarshall

There are some edge cases in the current solution that I think will require larger refactoring. Converting this to a draft for now.

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java

pulsar-broker/src/test/java/org/apache/pulsar/broker/service/ServerCnxTest.java

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java

michaeljmarshall · 2023-02-05T06:56:46Z

Note that the one "breaking" change is to prevent connections where the originalPrincipal is set with an authRole that is not a proxy role. This is an invalid state that was allowed to persist before. That state was not a vulnerability because the isTopicOperationAllowed validates that both the originalPrincipal and the authRole have permission to perform an operation.

I removed this logic from the PR to make it easier to accept. It would be good to submit a follow up PR to propose making the broker's logic stricter.

michaeljmarshall · 2023-02-05T06:59:19Z

@lhotari @nicoloboschi PTAL.

nodece · 2023-02-06T10:05:52Z

/pulsarbot rerun-failure-checks

…9270) (cherry picked from commit fd3ce8b)

…9270) (cherry picked from commit fd3ce8b) (cherry picked from commit 2847dd1)

…9270) (cherry picked from commit fd3ce8b) (cherry picked from commit 2847dd1) (cherry picked from commit 01bd986)

michaeljmarshall · 2023-02-14T19:01:17Z

I cherry-picked this change to the release branches because #19455 depends on it.

…ache#19270) (cherry picked from commit fd3ce8b) (cherry picked from commit 2847dd1) (cherry picked from commit 01bd986)

…9270) (cherry picked from commit fd3ce8b) (cherry picked from commit 2847dd1) (cherry picked from commit 01bd986)

…rCnx (apache#19270)" This reverts commit b233d6b.

…ache#19270) (cherry picked from commit fd3ce8b) (cherry picked from commit 2847dd1) (cherry picked from commit 01bd986)

momo-jun · 2023-02-20T03:04:10Z

Hi @michaeljmarshall did you have any plans to update the protocol spec for this cleanup? Just want to make sure it can catch up with the release schedule.

michaeljmarshall · 2023-04-20T18:55:56Z

The docs were updated here: apache/pulsar-site#408.

[cleanup][broker] Validate originalPrincipal earlier in ServerCnx

a0e603a

michaeljmarshall added doc Your PR contains doc changes, no matter whether the changes are in markdown or code files. type/cleanup Code or doc cleanups e.g. remove the outdated documentation or remove the code no longer in use area/broker labels Jan 18, 2023

michaeljmarshall added this to the 2.12.0 milestone Jan 18, 2023

michaeljmarshall requested review from freeznet, lhotari, nicoloboschi, nodece and zymap January 18, 2023 07:46

michaeljmarshall self-assigned this Jan 18, 2023

nicoloboschi reviewed Jan 18, 2023

View reviewed changes

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java Outdated Show resolved Hide resolved

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java Outdated Show resolved Hide resolved

michaeljmarshall added 5 commits January 18, 2023 11:06

Only validate roles when authorization is enabled

214e1ec

Create method for duplicated code

c571a4b

Improve method name

6dc119f

Fix log format

6d67bdf

Add test to cover all invalid role combinations

ebe5411

michaeljmarshall commented Jan 18, 2023

View reviewed changes

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java Outdated Show resolved Hide resolved

pulsar-broker/src/test/java/org/apache/pulsar/broker/service/ServerCnxTest.java Outdated Show resolved Hide resolved

michaeljmarshall marked this pull request as draft January 18, 2023 19:30

michaeljmarshall added doc-required Your PR changes impact docs and you will update later. and removed doc Your PR contains doc changes, no matter whether the changes are in markdown or code files. labels Jan 18, 2023

github-actions bot added the doc Your PR contains doc changes, no matter whether the changes are in markdown or code files. label Jan 18, 2023

lhotari reviewed Jan 20, 2023

View reviewed changes

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java Outdated Show resolved Hide resolved

michaeljmarshall added 4 commits February 5, 2023 00:13

Merge branch 'master' into cleanup-proxy-role-validation

420bbaa

Fix implementation in light of changes to master

964ec39

Only verify when both authn and authz enabled

57ebb93

Make the logic in this PR equivalent to current logic

10b526e

michaeljmarshall marked this pull request as ready for review February 5, 2023 06:54

michaeljmarshall added 2 commits February 5, 2023 01:14

Fix Javadoc for checkstyle

5245739

Fix typo

284b645

codelipenghui mentioned this pull request Feb 6, 2023

[fix][authentication] Store the original auth when using anonymous role #19390

Closed

5 tasks

nodece approved these changes Feb 6, 2023

View reviewed changes

nodece added the ready-to-test label Feb 6, 2023

lhotari approved these changes Feb 6, 2023

View reviewed changes

lhotari merged commit fd3ce8b into apache:master Feb 6, 2023

michaeljmarshall mentioned this pull request Feb 7, 2023

[improve][broker] Require authRole is proxyRole to set originalPrincipal #19455

Merged

2 tasks

michaeljmarshall added a commit that referenced this pull request Feb 14, 2023

[cleanup][broker] Validate originalPrincipal earlier in ServerCnx (#1…

2847dd1

…9270) (cherry picked from commit fd3ce8b)

michaeljmarshall added a commit that referenced this pull request Feb 14, 2023

[cleanup][broker] Validate originalPrincipal earlier in ServerCnx (#1…

01bd986

…9270) (cherry picked from commit fd3ce8b) (cherry picked from commit 2847dd1)

michaeljmarshall added a commit that referenced this pull request Feb 14, 2023

[cleanup][broker] Validate originalPrincipal earlier in ServerCnx (#1…

34a2c79

…9270) (cherry picked from commit fd3ce8b) (cherry picked from commit 2847dd1) (cherry picked from commit 01bd986)

michaeljmarshall added cherry-picked/branch-2.9 Archived: 2.9 is end of life cherry-picked/branch-2.10 cherry-picked/branch-2.11 release/2.11.1 release/2.9.5 release/2.10.4 labels Feb 14, 2023

michaeljmarshall added a commit that referenced this pull request Feb 14, 2023

[cleanup][broker] Validate originalPrincipal earlier in ServerCnx (#1…

9d36b0e

…9270) (cherry picked from commit fd3ce8b) (cherry picked from commit 2847dd1) (cherry picked from commit 01bd986)

michaeljmarshall added cherry-picked/branch-2.8 Archived: 2.8 is end of life release/2.8.5 labels Feb 14, 2023

nicoloboschi added a commit to datastax/pulsar that referenced this pull request Feb 15, 2023

Revert "[cleanup][broker] Validate originalPrincipal earlier in Serve…

8e9fe05

…rCnx (apache#19270)" This reverts commit b233d6b.

michaeljmarshall deleted the cleanup-proxy-role-validation branch March 6, 2023 22:20

michaeljmarshall added doc-complete Your PR changes impact docs and the related docs have been already added. and removed doc-required Your PR changes impact docs and you will update later. labels Apr 20, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[cleanup][broker] Validate originalPrincipal earlier in ServerCnx #19270

[cleanup][broker] Validate originalPrincipal earlier in ServerCnx #19270

Uh oh!

michaeljmarshall commented Jan 18, 2023 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

michaeljmarshall left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

michaeljmarshall commented Feb 5, 2023

Uh oh!

michaeljmarshall commented Feb 5, 2023

Uh oh!

nodece commented Feb 6, 2023

Uh oh!

michaeljmarshall commented Feb 14, 2023

Uh oh!

momo-jun commented Feb 20, 2023

Uh oh!

michaeljmarshall commented Apr 20, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

[cleanup][broker] Validate originalPrincipal earlier in ServerCnx #19270

[cleanup][broker] Validate originalPrincipal earlier in ServerCnx #19270

Uh oh!

Conversation

michaeljmarshall commented Jan 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Modifications

Verifying this change

Documentation

Matching PR in forked repository

Uh oh!

Uh oh!

Uh oh!

michaeljmarshall left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

michaeljmarshall commented Feb 5, 2023

Uh oh!

michaeljmarshall commented Feb 5, 2023

Uh oh!

nodece commented Feb 6, 2023

Uh oh!

michaeljmarshall commented Feb 14, 2023

Uh oh!

momo-jun commented Feb 20, 2023

Uh oh!

michaeljmarshall commented Apr 20, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

michaeljmarshall commented Jan 18, 2023 •

edited

Loading