Skip to content

Commit 2216a75

Browse files
jbertramjbertram
committed
ARTEMIS-5346 check routing-type when creating queue
1 parent c5bfb32 commit 2216a75

File tree

2 files changed

+118
-1
lines changed
  • artemis-server/src/main/java/org/apache/activemq/artemis/core/server/impl
  • tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/security

2 files changed

+118
-1
lines changed

‎artemis-server/src/main/java/org/apache/activemq/artemis/core/server/impl/ServerSessionImpl.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -753,7 +753,7 @@ public Queue createQueue(QueueConfiguration queueConfiguration) throws Exception
753753

754754
AddressSettings as = server.getAddressSettingsRepository().getMatch(queueConfiguration.getAddress().toString());
755755

756-
if (as.isAutoCreateAddresses() && server.getAddressInfo(queueConfiguration.getAddress()) == null) {
756+
if (as.isAutoCreateAddresses() && (server.getAddressInfo(queueConfiguration.getAddress()) == null || !server.getAddressInfo(queueConfiguration.getAddress()).getRoutingTypes().contains(queueConfiguration.getRoutingType()))) {
757757
securityCheck(queueConfiguration.getAddress(), queueConfiguration.getName(), CheckType.CREATE_ADDRESS, this);
758758
}
759759

‎tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/security/SecurityTest.java

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -646,6 +646,123 @@ public void testJAASSecurityManagerAuthorizationNegative() throws Exception {
646646
}
647647
}
648648

649+
@Test
650+
public void testJAASSecurityManagerCreateQueueWithDifferentRoutingTypeAsAddressNegative() throws Exception {
651+
final SimpleString ADDRESS = SimpleString.of("address");
652+
final SimpleString DURABLE_QUEUE = SimpleString.of("durableQueue");
653+
final SimpleString NON_DURABLE_QUEUE = SimpleString.of("nonDurableQueue");
654+
final SimpleString JMS = SimpleString.of("jms");
655+
656+
ActiveMQJAASSecurityManager securityManager = new ActiveMQJAASSecurityManager("PropertiesLogin");
657+
ActiveMQServer server = addServer(ActiveMQServers.newActiveMQServer(createDefaultInVMConfig().setSecurityEnabled(true), ManagementFactory.getPlatformMBeanServer(), securityManager, false));
658+
Set<Role> roles = new HashSet<>();
659+
roles.add(new Role("programmers", false, false, true, false, true, false, false, false, false, false, false, false));
660+
server.getConfiguration().putSecurityRoles("#", roles);
661+
server.start();
662+
server.addAddressInfo(new AddressInfo(ADDRESS, RoutingType.ANYCAST));
663+
server.addAddressInfo(new AddressInfo(JMS, RoutingType.ANYCAST));
664+
665+
ClientSessionFactory cf = createSessionFactory(locator);
666+
ClientSession session = addClientSession(cf.createSession("first", "secret", false, true, true, false, 0));
667+
668+
ConnectionFactory connectionFactory = new ActiveMQConnectionFactory("vm://0");
669+
670+
// Explicit attempt to modify address routing type with a durable queue
671+
try {
672+
session.createQueue(QueueConfiguration.of(DURABLE_QUEUE).setAddress(ADDRESS).setRoutingType(RoutingType.MULTICAST));
673+
fail("should throw exception here");
674+
} catch (ActiveMQException e) {
675+
assertTrue(e.getMessage().contains("User: first"));
676+
assertTrue(e.getMessage().contains("does not have permission='CREATE_ADDRESS' for queue durableQueue on address address"));
677+
}
678+
679+
// Implicit attempt to modify address routing type with a durable queue using auto-create via JMS
680+
try (Connection c = connectionFactory.createConnection("first", "secret")) {
681+
c.setClientID("myClientID");
682+
Session s = c.createSession();
683+
s.createDurableSubscriber(s.createTopic(JMS.toString()), "foo");
684+
fail("should throw exception here");
685+
} catch (JMSException e) {
686+
assertTrue(e.getMessage().contains("User: first"));
687+
assertTrue(e.getMessage().contains("does not have permission='CREATE_ADDRESS' for queue myClientID.foo on address jms"));
688+
}
689+
690+
// Explicit attempt to modify address routing type with a non-durable queue
691+
try {
692+
session.createQueue(QueueConfiguration.of(NON_DURABLE_QUEUE).setAddress(ADDRESS).setDurable(false).setRoutingType(RoutingType.MULTICAST));
693+
fail("should throw exception here");
694+
} catch (ActiveMQException e) {
695+
assertTrue(e.getMessage().contains("User: first"));
696+
assertTrue(e.getMessage().contains("does not have permission='CREATE_ADDRESS' for queue nonDurableQueue on address address"));
697+
}
698+
699+
// Implicit attempt to modify address routing type with a non-durable queue using auto-create via JMS
700+
try (Connection c = connectionFactory.createConnection("first", "secret")) {
701+
Session s = c.createSession();
702+
s.createConsumer(s.createTopic(JMS.toString()));
703+
fail("should throw exception here");
704+
} catch (JMSException e) {
705+
assertTrue(e.getMessage().contains("User: first"));
706+
assertTrue(e.getMessage().contains("does not have permission='CREATE_ADDRESS'"));
707+
}
708+
}
709+
710+
@Test
711+
public void testJAASSecurityManagerCreateQueueWithDifferentRoutingTypeAsAddress() throws Exception {
712+
final SimpleString ADDRESS = SimpleString.of("address");
713+
final SimpleString DURABLE_QUEUE = SimpleString.of("durableQueue");
714+
final SimpleString NON_DURABLE_QUEUE = SimpleString.of("nonDurableQueue");
715+
final SimpleString JMS = SimpleString.of("jms");
716+
717+
ActiveMQJAASSecurityManager securityManager = new ActiveMQJAASSecurityManager("PropertiesLogin");
718+
ActiveMQServer server = addServer(ActiveMQServers.newActiveMQServer(createDefaultInVMConfig().setSecurityEnabled(true), ManagementFactory.getPlatformMBeanServer(), securityManager, false));
719+
Set<Role> roles = new HashSet<>();
720+
roles.add(new Role("programmers", false, true, true, false, true, false, false, false, true, false, false, false));
721+
server.getConfiguration().putSecurityRoles("#", roles);
722+
server.start();
723+
server.addAddressInfo(new AddressInfo(ADDRESS, RoutingType.ANYCAST));
724+
725+
ClientSessionFactory cf = createSessionFactory(locator);
726+
ClientSession session = addClientSession(cf.createSession("first", "secret", false, true, true, false, 0));
727+
728+
ConnectionFactory connectionFactory = new ActiveMQConnectionFactory("vm://0");
729+
730+
// Explicit attempt to modify address routing type with a durable queue
731+
try {
732+
session.createQueue(QueueConfiguration.of(DURABLE_QUEUE).setAddress(ADDRESS).setRoutingType(RoutingType.MULTICAST));
733+
} catch (ActiveMQException e) {
734+
e.printStackTrace();
735+
fail("should not throw exception here");
736+
}
737+
738+
// Implicit attempt to modify address routing type with a durable queue using auto-create via JMS
739+
try (Connection c = connectionFactory.createConnection("first", "secret")) {
740+
c.setClientID("myClientID");
741+
Session s = c.createSession();
742+
s.createDurableSubscriber(s.createTopic(JMS.toString()), "foo");
743+
} catch (JMSException e) {
744+
e.printStackTrace();
745+
fail("should not throw exception here");
746+
}
747+
748+
// Explicit attempt to modify address routing type with a non-durable queue
749+
try {
750+
session.createQueue(QueueConfiguration.of(NON_DURABLE_QUEUE).setAddress(ADDRESS).setDurable(false).setRoutingType(RoutingType.MULTICAST));
751+
} catch (ActiveMQException e) {
752+
e.printStackTrace();
753+
fail("should not throw exception here");
754+
}
755+
756+
// Implicit attempt to modify address routing type with a non-durable queue using auto-create via JMS
757+
try (Connection c = connectionFactory.createConnection("first", "secret")) {
758+
Session s = c.createSession();
759+
s.createConsumer(s.createTopic(JMS.toString()));
760+
} catch (JMSException e) {
761+
e.printStackTrace();
762+
fail("should not throw exception here");
763+
}
764+
}
765+
649766
@Test
650767
// this is for backwards compatibility with the pre-FQQN syntax from ARTEMIS-592
651768
public void testJAASSecurityManagerAuthorizationSameAddressDifferentQueuesDotSyntax() throws Exception {

0 commit comments

Comments
 (0)