Skip to content

Commit 7b64132

Browse files
michaelklishinmichaelklishin
authored
Merge pull request #12018 from rabbitmq/mergify/bp/v4.0.x/pr-11999
Add SASL mechanism ANONYMOUS (backport #11999)
2 parents 334c43b + 954bd11 commit 7b64132

File tree

29 files changed

+431
-398
lines changed

29 files changed

+431
-398
lines changed

‎deps/amqp10_client/src/amqp10_client.erl

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -429,8 +429,8 @@ parse_result(Map) ->
429429
throw(plain_sasl_missing_userinfo);
430430
_ ->
431431
case UserInfo of
432-
[] -> none;
433-
undefined -> none;
432+
[] -> anon;
433+
undefined -> anon;
434434
U -> parse_usertoken(U)
435435
end
436436
end,
@@ -456,11 +456,6 @@ parse_result(Map) ->
456456
Ret0#{tls_opts => {secure_port, TlsOpts}}
457457
end.
458458

459-
460-
parse_usertoken(undefined) ->
461-
none;
462-
parse_usertoken("") ->
463-
none;
464459
parse_usertoken(U) ->
465460
[User, Pass] = string:tokens(U, ":"),
466461
{plain,
@@ -532,7 +527,7 @@ parse_uri_test_() ->
532527
[?_assertEqual({ok, #{address => "my_host",
533528
port => 9876,
534529
hostname => <<"my_host">>,
535-
sasl => none}}, parse_uri("amqp://my_host:9876")),
530+
sasl => anon}}, parse_uri("amqp://my_host:9876")),
536531
%% port defaults
537532
?_assertMatch({ok, #{port := 5671}}, parse_uri("amqps://my_host")),
538533
?_assertMatch({ok, #{port := 5672}}, parse_uri("amqp://my_host")),

‎deps/amqp10_client/test/system_SUITE.erl

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -103,8 +103,7 @@ stop_amqp10_client_app(Config) ->
103103
%% -------------------------------------------------------------------
104104

105105
init_per_group(rabbitmq, Config0) ->
106-
Config = rabbit_ct_helpers:set_config(Config0,
107-
{sasl, {plain, <<"guest">>, <<"guest">>}}),
106+
Config = rabbit_ct_helpers:set_config(Config0, {sasl, anon}),
108107
Config1 = rabbit_ct_helpers:merge_app_env(Config,
109108
[{rabbit,
110109
[{max_message_size, 134217728}]}]),
@@ -115,7 +114,7 @@ init_per_group(rabbitmq_strict, Config0) ->
115114
{sasl, {plain, <<"guest">>, <<"guest">>}}),
116115
Config1 = rabbit_ct_helpers:merge_app_env(Config,
117116
[{rabbit,
118-
[{amqp1_0_default_user, none},
117+
[{anonymous_login_user, none},
119118
{max_message_size, 134217728}]}]),
120119
rabbit_ct_helpers:run_steps(Config1, rabbit_ct_broker_helpers:setup_steps());
121120

‎deps/rabbit/BUILD.bazel

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,16 +58,16 @@ _APP_ENV = """[
5858
{default_user_tags, [administrator]},
5959
{default_vhost, <<"/">>},
6060
{default_permissions, [<<".*">>, <<".*">>, <<".*">>]},
61-
{amqp1_0_default_user, <<"guest">>},
62-
{amqp1_0_default_vhost, <<"/">>},
6361
{loopback_users, [<<"guest">>]},
6462
{password_hashing_module, rabbit_password_hashing_sha256},
6563
{server_properties, []},
6664
{collect_statistics, none},
6765
{collect_statistics_interval, 5000},
6866
{mnesia_table_loading_retry_timeout, 30000},
6967
{mnesia_table_loading_retry_limit, 10},
70-
{auth_mechanisms, ['PLAIN', 'AMQPLAIN']},
68+
{anonymous_login_user, <<"guest">>},
69+
{anonymous_login_pass, <<"guest">>},
70+
{auth_mechanisms, ['PLAIN', 'AMQPLAIN', 'ANONYMOUS']},
7171
{auth_backends, [rabbit_auth_backend_internal]},
7272
{delegate_count, 16},
7373
{trace_vhosts, []},

‎deps/rabbit/Makefile

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,16 +38,19 @@ define PROJECT_ENV
3838
{default_user_tags, [administrator]},
3939
{default_vhost, <<"/">>},
4040
{default_permissions, [<<".*">>, <<".*">>, <<".*">>]},
41-
{amqp1_0_default_user, <<"guest">>},
42-
{amqp1_0_default_vhost, <<"/">>},
4341
{loopback_users, [<<"guest">>]},
4442
{password_hashing_module, rabbit_password_hashing_sha256},
4543
{server_properties, []},
4644
{collect_statistics, none},
4745
{collect_statistics_interval, 5000},
4846
{mnesia_table_loading_retry_timeout, 30000},
4947
{mnesia_table_loading_retry_limit, 10},
50-
{auth_mechanisms, ['PLAIN', 'AMQPLAIN']},
48+
%% The identity to act as for anonymous logins.
49+
{anonymous_login_user, <<"guest">>},
50+
{anonymous_login_pass, <<"guest">>},
51+
%% "The server mechanisms are ordered in decreasing level of preference."
52+
%% AMQP §5.3.3.1
53+
{auth_mechanisms, ['PLAIN', 'AMQPLAIN', 'ANONYMOUS']},
5154
{auth_backends, [rabbit_auth_backend_internal]},
5255
{delegate_count, 16},
5356
{trace_vhosts, []},

‎deps/rabbit/app.bzl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ def all_beam_files(name = "all_beam_files"):
5858
"src/rabbit_amqqueue_sup_sup.erl",
5959
"src/rabbit_auth_backend_internal.erl",
6060
"src/rabbit_auth_mechanism_amqplain.erl",
61+
"src/rabbit_auth_mechanism_anonymous.erl",
6162
"src/rabbit_auth_mechanism_cr_demo.erl",
6263
"src/rabbit_auth_mechanism_plain.erl",
6364
"src/rabbit_autoheal.erl",
@@ -313,6 +314,7 @@ def all_test_beam_files(name = "all_test_beam_files"):
313314
"src/rabbit_amqqueue_sup_sup.erl",
314315
"src/rabbit_auth_backend_internal.erl",
315316
"src/rabbit_auth_mechanism_amqplain.erl",
317+
"src/rabbit_auth_mechanism_anonymous.erl",
316318
"src/rabbit_auth_mechanism_cr_demo.erl",
317319
"src/rabbit_auth_mechanism_plain.erl",
318320
"src/rabbit_autoheal.erl",
@@ -586,6 +588,7 @@ def all_srcs(name = "all_srcs"):
586588
"src/rabbit_amqqueue_sup_sup.erl",
587589
"src/rabbit_auth_backend_internal.erl",
588590
"src/rabbit_auth_mechanism_amqplain.erl",
591+
"src/rabbit_auth_mechanism_anonymous.erl",
589592
"src/rabbit_auth_mechanism_cr_demo.erl",
590593
"src/rabbit_auth_mechanism_plain.erl",
591594
"src/rabbit_autoheal.erl",

‎deps/rabbit/docs/rabbitmq.conf.example

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -232,6 +232,7 @@
232232
##
233233
# auth_mechanisms.1 = PLAIN
234234
# auth_mechanisms.2 = AMQPLAIN
235+
# auth_mechanisms.3 = ANONYMOUS
235236

236237
## The rabbitmq-auth-mechanism-ssl plugin makes it possible to
237238
## authenticate a user based on the client's x509 (TLS) certificate.
@@ -905,14 +906,8 @@
905906
##
906907
# mqtt.proxy_protocol = false
907908

908-
## Set the default user name and password used for anonymous connections (when client
909-
## provides no credentials). Anonymous connections are highly discouraged!
910-
##
911-
# mqtt.default_user = guest
912-
# mqtt.default_pass = guest
913-
914909
## Enable anonymous connections. If this is set to false, clients MUST provide
915-
## credentials in order to connect. See also the mqtt.default_user/mqtt.default_pass
910+
## credentials in order to connect. See also the anonymous_login_user/anonymous_login_pass
916911
## keys. Anonymous connections are highly discouraged!
917912
##
918913
# mqtt.allow_anonymous = true

‎deps/rabbit/priv/schema/rabbit.schema

Lines changed: 19 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -444,13 +444,12 @@ end}.
444444
%% ===========================================================================
445445

446446
%% Choose the available SASL mechanism(s) to expose.
447-
%% The two default (built in) mechanisms are 'PLAIN' and
448-
%% 'AMQPLAIN'. Additional mechanisms can be added via
449-
%% plugins.
447+
%% The three default (built in) mechanisms are 'PLAIN', 'AMQPLAIN' and 'ANONYMOUS'.
448+
%% Additional mechanisms can be added via plugins.
450449
%%
451450
%% See https://www.rabbitmq.com/authentication.html for more details.
452451
%%
453-
%% {auth_mechanisms, ['PLAIN', 'AMQPLAIN']},
452+
%% {auth_mechanisms, ['PLAIN', 'AMQPLAIN', 'ANONYMOUS']},
454453

455454
{mapping, "auth_mechanisms.$name", "rabbit.auth_mechanisms", [
456455
{datatype, atom}]}.
@@ -735,6 +734,22 @@ end}.
735734
end
736735
end}.
737736

737+
%% Connections that skip SASL layer or use SASL mechanism ANONYMOUS will use this identity.
738+
%% Setting this to a username will allow (anonymous) clients to connect and act as this
739+
%% given user. For production environments, set this value to 'none'.
740+
{mapping, "anonymous_login_user", "rabbit.anonymous_login_user",
741+
[{datatype, [{enum, [none]}, binary]}]}.
742+
743+
{mapping, "anonymous_login_pass", "rabbit.anonymous_login_pass", [
744+
{datatype, [tagged_binary, binary]}
745+
]}.
746+
747+
{translation, "rabbit.anonymous_login_pass",
748+
fun(Conf) ->
749+
rabbit_cuttlefish:optionally_tagged_binary("anonymous_login_pass", Conf)
750+
end}.
751+
752+
738753
%%
739754
%% Default Policies
740755
%% ====================
@@ -2649,32 +2664,6 @@ end}.
26492664
end
26502665
}.
26512666

2652-
% ===============================
2653-
% AMQP 1.0
2654-
% ===============================
2655-
2656-
%% Connections that skip SASL layer or use SASL mechanism ANONYMOUS will connect as this account.
2657-
%% Setting this to a username will allow clients to connect without authenticating.
2658-
%% For production environments, set this value to 'none'.
2659-
{mapping, "amqp1_0.default_user", "rabbit.amqp1_0_default_user",
2660-
[{datatype, [{enum, [none]}, string]}]}.
2661-
2662-
{mapping, "amqp1_0.default_vhost", "rabbit.amqp1_0_default_vhost",
2663-
[{datatype, string}]}.
2664-
2665-
{translation, "rabbit.amqp1_0_default_user",
2666-
fun(Conf) ->
2667-
case cuttlefish:conf_get("amqp1_0.default_user", Conf) of
2668-
none -> none;
2669-
User -> list_to_binary(User)
2670-
end
2671-
end}.
2672-
2673-
{translation , "rabbit.amqp1_0_default_vhost",
2674-
fun(Conf) ->
2675-
list_to_binary(cuttlefish:conf_get("amqp1_0.default_vhost", Conf))
2676-
end}.
2677-
26782667
{mapping, "stream.replication.port_range.min", "osiris.port_range", [
26792668
{datatype, [integer]},
26802669
{validators, ["non_zero_positive_integer"]}

0 commit comments

Comments
 (0)