Felix-Gong opened a new issue, #11470:
URL: https://github.com/apache/rocketmq/issues/11470
### Search before asking
I checked open and closed issues and PRs for `ProxyAdminAuthInterceptor`,
`METHOD_PERMISSIONS`, `proxy.admin` authorization and unmapped admin methods.
The nearby open work is different: #11362 / PR #11363 changes which address the
ACL is evaluated against, and #11178 / PR #11179 refuses to start when
authorization is enabled without authentication. Neither covers what happens to
a method that has no entry in the permission map.
### What happened?
`ProxyAdminAuthInterceptor` binds every admin RPC to a `proxy.admin.*`
resource through the static `METHOD_PERMISSIONS` map. The authorization branch
is guarded by `resourceAction != null`:
```java
ResourceAction resourceAction = METHOD_PERMISSIONS.get(method);
if (resourceAction != null && authzEnabled) {
... authorize against proxy.admin.<module> ...
}
return next.startCall(call, headers); // unmapped methods land here
```
A method with no entry skips authorization completely and is served. With
cluster authorization on, every *mapped* method gets a real ACL decision, but
an unmapped one runs with authentication only — and the same is true in
`grpcAdminServerAuthEnable` fail-closed mode, which only checks that
authentication and authorization are *enabled*, not that this method is covered
by them.
The admin server currently hosts only the `Admin` service and all 16 of its
RPCs are mapped, so nothing is exploitable on develop today. But the surface
grows from the rocketmq-apis side — the Admin service gained RPCs in three
recent commits (#113, #115, #116) — and nothing cross-checks the proto against
the map. The first future RPC merged without a hand-written entry becomes an
authorization bypass by construction, including whatever mutation it introduces.
### Expected behavior
When the cluster authorization switch is on, a served method that has no
`proxy.admin.*` mapping should be refused (the class already documents
fail-closed as its behavior mode) rather than served without a permission
check. The map and the served surface should also be pinned against each other
in tests, so adding an RPC without deciding its resource and action fails CI
instead of shipping a silent hole.
### Runtime
develop at 57c2dc0, JDK 11. Reproduced with the existing interceptor test
harness — no broker or proxy required. On the current code, a call to an
unmapped method name with `authorizationEnabled=true` reaches
`next.startCall(...)`; the new test fails exactly there.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
