Skip to content

Commit ba14b15

Browse files
ansdansd
committed
Remove mqtt.default_user and mqtt.default_pass
This commit is a breaking change in RabbitMQ 4.0. ## What? Remove mqtt.default_user and mqtt.default_pass Instead, rabbit.anonymous_login_user and rabbit.anonymous_login_pass should be used. ## Why? RabbitMQ 4.0 simplifies anonymous logins. There should be a single configuration place ``` rabbit.anonymous_login_user rabbit.anonymous_login_pass ``` that is used for anonymous logins for any protocol. Anonymous login is orthogonal to the protocol the client uses. Hence, there should be a single configuration place which can then be used for MQTT, AMQP 1.0, AMQP 0.9.1, and RabbitMQ Stream protocol. This will also simplify switching to SASL for MQTT 5.0 in the future.
1 parent d46f07c commit ba14b15

File tree

10 files changed

+58
-100
lines changed

10 files changed

+58
-100
lines changed

‎deps/rabbit/src/rabbit_auth_mechanism_anonymous.erl

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
-behaviour(rabbit_auth_mechanism).
1010

1111
-export([description/0, should_offer/1, init/1, handle_response/2]).
12+
-export([credentials/0]).
1213

1314
-define(STATE, []).
1415

‎deps/rabbitmq_mqtt/BUILD.bazel

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,7 @@ APP_DESCRIPTION = "RabbitMQ MQTT Adapter"
2626
APP_MODULE = "rabbit_mqtt"
2727

2828
APP_ENV = """[
29-
{default_user, <<"guest">>},
30-
{default_pass, <<"guest">>},
3129
{ssl_cert_login,false},
32-
%% To satisfy an unfortunate expectation from popular MQTT clients.
3330
{allow_anonymous, true},
3431
{vhost, <<"/">>},
3532
{exchange, <<"amq.topic">>},

‎deps/rabbitmq_mqtt/Makefile

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,7 @@ PROJECT_MOD = rabbit_mqtt
44

55
define PROJECT_ENV
66
[
7-
{default_user, <<"guest">>},
8-
{default_pass, <<"guest">>},
97
{ssl_cert_login,false},
10-
%% To satisfy an unfortunate expectation from popular MQTT clients.
118
{allow_anonymous, true},
129
{vhost, <<"/">>},
1310
{exchange, <<"amq.topic">>},

‎deps/rabbitmq_mqtt/priv/schema/rabbitmq_mqtt.schema

Lines changed: 2 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -6,35 +6,8 @@
66
%% ----------------------------------------------------------------------------
77

88
% {rabbitmq_mqtt,
9-
% [%% Set the default user name and password. Will be used as the default login
10-
%% if a connecting client provides no other login details.
11-
%%
12-
%% Please note that setting this will allow clients to connect without
13-
%% authenticating!
14-
%%
15-
%% {default_user, <<"guest">>},
16-
%% {default_pass, <<"guest">>},
17-
18-
{mapping, "mqtt.default_user", "rabbitmq_mqtt.default_user", [
19-
{datatype, string}
20-
]}.
21-
22-
{mapping, "mqtt.default_pass", "rabbitmq_mqtt.default_pass", [
23-
{datatype, string}
24-
]}.
25-
26-
{translation, "rabbitmq_mqtt.default_user",
27-
fun(Conf) ->
28-
list_to_binary(cuttlefish:conf_get("mqtt.default_user", Conf))
29-
end}.
30-
31-
{translation, "rabbitmq_mqtt.default_pass",
32-
fun(Conf) ->
33-
list_to_binary(cuttlefish:conf_get("mqtt.default_pass", Conf))
34-
end}.
35-
36-
%% Enable anonymous access. If this is set to false, clients MUST provide
37-
%% login information in order to connect. See the default_user/default_pass
9+
% [%% Enable anonymous access. If this is set to false, clients MUST provide
10+
%% login information in order to connect. See the anonymous_login_user/anonymous_login_pass
3811
%% configuration elements for managing logins without authentication.
3912
%%
4013
%% {allow_anonymous, true},

‎deps/rabbitmq_mqtt/src/rabbit_mqtt_processor.erl

Lines changed: 32 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ process_connect(
183183
maybe
184184
ok ?= check_extended_auth(ConnectProps),
185185
{ok, ClientId} ?= ensure_client_id(ClientId0, CleanStart, ProtoVer),
186-
{ok, {Username1, Password}} ?= check_credentials(Username0, Password0, SslLoginName, PeerIp),
186+
{ok, Username1, Password} ?= check_credentials(Username0, Password0, SslLoginName, PeerIp),
187187

188188
{VHostPickedUsing, {VHost, Username2}} = get_vhost(Username1, SslLoginName, Port),
189189
?LOG_DEBUG("MQTT connection ~s picked vhost using ~s", [ConnName0, VHostPickedUsing]),
@@ -626,6 +626,8 @@ check_extended_auth(_) ->
626626

627627
check_credentials(Username, Password, SslLoginName, PeerIp) ->
628628
case creds(Username, Password, SslLoginName) of
629+
{ok, _, _} = Ok ->
630+
Ok;
629631
nocreds ->
630632
?LOG_ERROR("MQTT login failed: no credentials provided"),
631633
auth_attempt_failed(PeerIp, <<>>),
@@ -637,9 +639,7 @@ check_credentials(Username, Password, SslLoginName, PeerIp) ->
637639
{invalid_creds, {User, _Pass}} when is_binary(User) ->
638640
?LOG_ERROR("MQTT login failed for user '~s': no password provided", [User]),
639641
auth_attempt_failed(PeerIp, User),
640-
{error, ?RC_BAD_USER_NAME_OR_PASSWORD};
641-
{UserBin, PassBin} ->
642-
{ok, {UserBin, PassBin}}
642+
{error, ?RC_BAD_USER_NAME_OR_PASSWORD}
643643
end.
644644

645645
-spec ensure_client_id(client_id(), boolean(), protocol_version()) ->
@@ -1201,29 +1201,37 @@ get_vhost_from_port_mapping(Port, Mapping) ->
12011201
Res.
12021202

12031203
creds(User, Pass, SSLLoginName) ->
1204-
DefaultUser = rabbit_mqtt_util:env(default_user),
1205-
DefaultPass = rabbit_mqtt_util:env(default_pass),
1206-
{ok, Anon} = application:get_env(?APP_NAME, allow_anonymous),
1207-
{ok, TLSAuth} = application:get_env(?APP_NAME, ssl_cert_login),
1208-
HaveDefaultCreds = Anon =:= true andalso
1209-
is_binary(DefaultUser) andalso
1210-
is_binary(DefaultPass),
1211-
12121204
CredentialsProvided = User =/= undefined orelse Pass =/= undefined,
1213-
CorrectCredentials = is_binary(User) andalso is_binary(Pass) andalso Pass =/= <<>>,
1205+
ValidCredentials = is_binary(User) andalso is_binary(Pass) andalso Pass =/= <<>>,
1206+
{ok, TLSAuth} = application:get_env(?APP_NAME, ssl_cert_login),
12141207
SSLLoginProvided = TLSAuth =:= true andalso SSLLoginName =/= none,
12151208

1216-
case {CredentialsProvided, CorrectCredentials, SSLLoginProvided, HaveDefaultCreds} of
1217-
%% Username and password take priority
1218-
{true, true, _, _} -> {User, Pass};
1219-
%% Either username or password is provided
1220-
{true, false, _, _} -> {invalid_creds, {User, Pass}};
1221-
%% rabbitmq_mqtt.ssl_cert_login is true. SSL user name provided.
1222-
%% Authenticating using username only.
1223-
{false, false, true, _} -> {SSLLoginName, none};
1224-
%% Anonymous connection uses default credentials
1225-
{false, false, false, true} -> {DefaultUser, DefaultPass};
1226-
_ -> nocreds
1209+
case {CredentialsProvided, ValidCredentials, SSLLoginProvided} of
1210+
{true, true, _} ->
1211+
%% Username and password take priority
1212+
{ok, User, Pass};
1213+
{true, false, _} ->
1214+
%% Either username or password is provided
1215+
{invalid_creds, {User, Pass}};
1216+
{false, false, true} ->
1217+
%% rabbitmq_mqtt.ssl_cert_login is true. SSL user name provided.
1218+
%% Authenticating using username only.
1219+
{ok, SSLLoginName, none};
1220+
{false, false, false} ->
1221+
{ok, AllowAnon} = application:get_env(?APP_NAME, allow_anonymous),
1222+
case AllowAnon of
1223+
true ->
1224+
case rabbit_auth_mechanism_anonymous:credentials() of
1225+
{ok, _, _} = Ok ->
1226+
Ok;
1227+
error ->
1228+
nocreds
1229+
end;
1230+
false ->
1231+
nocreds
1232+
end;
1233+
_ ->
1234+
nocreds
12271235
end.
12281236

12291237
-spec auth_attempt_failed(inet:ip_address(), binary()) -> ok.

‎deps/rabbitmq_mqtt/src/rabbit_mqtt_util.erl

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -141,10 +141,10 @@ env(Key) ->
141141
undefined -> undefined
142142
end.
143143

144-
coerce_env_value(default_pass, Val) -> rabbit_data_coercion:to_binary(Val);
145-
coerce_env_value(default_user, Val) -> rabbit_data_coercion:to_binary(Val);
146-
coerce_env_value(vhost, Val) -> rabbit_data_coercion:to_binary(Val);
147-
coerce_env_value(_, Val) -> Val.
144+
coerce_env_value(vhost, Val) ->
145+
rabbit_data_coercion:to_binary(Val);
146+
coerce_env_value(_, Val) ->
147+
Val.
148148

149149
-spec table_lookup(rabbit_framing:amqp_table() | undefined, binary()) ->
150150
tuple() | undefined.

‎deps/rabbitmq_mqtt/test/auth_SUITE.erl

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -123,15 +123,20 @@ init_per_group(authz, Config0) ->
123123
User = <<"mqtt-user">>,
124124
Password = <<"mqtt-password">>,
125125
VHost = <<"mqtt-vhost">>,
126-
MqttConfig = {rabbitmq_mqtt, [{default_user, User}
127-
,{default_pass, Password}
128-
,{allow_anonymous, true}
129-
,{vhost, VHost}
130-
,{exchange, <<"amq.topic">>}
131-
]},
132-
Config = rabbit_ct_helpers:run_setup_steps(rabbit_ct_helpers:merge_app_env(Config0, MqttConfig),
133-
rabbit_ct_broker_helpers:setup_steps() ++
134-
rabbit_ct_client_helpers:setup_steps()),
126+
Env = [{rabbitmq_mqtt,
127+
[{allow_anonymous, true},
128+
{vhost, VHost},
129+
{exchange, <<"amq.topic">>}
130+
]},
131+
{rabbit,
132+
[{anonymous_login_user, User},
133+
{anonymous_login_pass, Password}
134+
]}],
135+
Config1 = rabbit_ct_helpers:merge_app_env(Config0, Env),
136+
Config = rabbit_ct_helpers:run_setup_steps(
137+
Config1,
138+
rabbit_ct_broker_helpers:setup_steps() ++
139+
rabbit_ct_client_helpers:setup_steps()),
135140
rabbit_ct_broker_helpers:add_user(Config, User, Password),
136141
rabbit_ct_broker_helpers:add_vhost(Config, VHost),
137142
[Log|_] = rpc(Config, 0, rabbit, log_locations, []),
@@ -412,7 +417,6 @@ anonymous_auth_success(Config) ->
412417
anonymous_auth_failure(Config) ->
413418
expect_authentication_failure(fun connect_anonymous/1, Config).
414419

415-
416420
ssl_user_auth_success(Config) ->
417421
expect_successful_connection(fun connect_ssl/1, Config).
418422

‎deps/rabbitmq_mqtt/test/config_schema_SUITE_data/rabbitmq_mqtt.snippets

Lines changed: 4 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
[{defaults,
22
"listeners.tcp.default = 5672
3-
mqtt.default_user = guest
4-
mqtt.default_pass = guest
53
mqtt.allow_anonymous = true
64
mqtt.vhost = /
75
mqtt.exchange = amq.topic
@@ -20,9 +18,7 @@
2018
mqtt.topic_alias_maximum = 16",
2119
[{rabbit,[{tcp_listeners,[5672]}]},
2220
{rabbitmq_mqtt,
23-
[{default_user,<<"guest">>},
24-
{default_pass,<<"guest">>},
25-
{allow_anonymous,true},
21+
[{allow_anonymous,true},
2622
{vhost,<<"/">>},
2723
{exchange,<<"amq.topic">>},
2824
{max_session_expiry_interval_seconds,86400},
@@ -101,8 +97,6 @@
10197
[rabbitmq_mqtt]},
10298
{proxy_protocol,
10399
"listeners.tcp.default = 5672
104-
mqtt.default_user = guest
105-
mqtt.default_pass = guest
106100
mqtt.allow_anonymous = true
107101
mqtt.vhost = /
108102
mqtt.exchange = amq.topic
@@ -111,19 +105,15 @@
111105
mqtt.proxy_protocol = true",
112106
[{rabbit,[{tcp_listeners,[5672]}]},
113107
{rabbitmq_mqtt,
114-
[{default_user,<<"guest">>},
115-
{default_pass,<<"guest">>},
116-
{allow_anonymous,true},
108+
[{allow_anonymous,true},
117109
{vhost,<<"/">>},
118110
{exchange,<<"amq.topic">>},
119111
{max_session_expiry_interval_seconds,infinity},
120112
{prefetch,10},
121113
{proxy_protocol,true}]}],
122114
[rabbitmq_mqtt]},
123115
{prefetch_retained_msg_store,
124-
"mqtt.default_user = guest
125-
mqtt.default_pass = guest
126-
mqtt.allow_anonymous = true
116+
"mqtt.allow_anonymous = true
127117
mqtt.vhost = /
128118
mqtt.exchange = amq.topic
129119
mqtt.max_session_expiry_interval_seconds = 1800
@@ -136,9 +126,7 @@
136126
mqtt.listeners.ssl = none
137127
mqtt.listeners.tcp.default = 1883",
138128
[{rabbitmq_mqtt,
139-
[{default_user,<<"guest">>},
140-
{default_pass,<<"guest">>},
141-
{allow_anonymous,true},
129+
[{allow_anonymous,true},
142130
{vhost,<<"/">>},
143131
{exchange,<<"amq.topic">>},
144132
{max_session_expiry_interval_seconds,1800},

‎deps/rabbitmq_mqtt/test/rabbitmq_mqtt.app

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,7 @@
44
{modules, []},
55
{registered, []},
66
{mod, {rabbit_mqtt, []}},
7-
{env, [{default_user, "guest_user"},
8-
{default_pass, "guest_pass"},
9-
{ssl_cert_login,false},
7+
{env, [{ssl_cert_login,false},
108
{allow_anonymous, true},
119
{vhost, "/"},
1210
{exchange, "amq.topic"},

‎deps/rabbitmq_mqtt/test/util_SUITE.erl

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@ groups() ->
1818
[
1919
{tests, [parallel], [
2020
coerce_vhost,
21-
coerce_default_user,
22-
coerce_default_pass,
2321
mqtt_amqp_topic_translation
2422
]
2523
}
@@ -36,12 +34,6 @@ end_per_suite(Config) ->
3634
coerce_vhost(_) ->
3735
?assertEqual(<<"/">>, rabbit_mqtt_util:env(vhost)).
3836

39-
coerce_default_user(_) ->
40-
?assertEqual(<<"guest_user">>, rabbit_mqtt_util:env(default_user)).
41-
42-
coerce_default_pass(_) ->
43-
?assertEqual(<<"guest_pass">>, rabbit_mqtt_util:env(default_pass)).
44-
4537
mqtt_amqp_topic_translation(_) ->
4638
ok = application:set_env(rabbitmq_mqtt, sparkplug, true),
4739
ok = rabbit_mqtt_util:init_sparkplug(),

0 commit comments

Comments
 (0)