[
https://issues.apache.org/jira/browse/QPID-4712?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Chuck Rolke updated QPID-4712:
------------------------------
Comment: was deleted
(was: The existing code has a per-IP-address ACL connection quota specified by
a single value in the command line or by specification of individual users in
the ACL file. The proposed new feature would add a new Action/Object pair to
the ACL rule file:
{noformat}
acl allow create connection address=<address spec> [user=<user spec>]
{noformat}
Impact assessment:
||Design consideration||Proposed feature||
|Threading model|multithread - ACL structures need locks|
|Memory management|Per-IPaddress counters kept in new instance of existing
structure|
|Automated testing approach|Existing ACL test scheme could prove this feature|
|Impact on public API|Changes ACL file syntax|
|- Interoperability with implementations in other languages|n/a|
|- Backwards compatibility|not backward compatible|
|Performance implications|Insignificant|
|Security implications|This feature is a security enhancement|
|Platform support|n/a|
|Logging|Logs in 'usual' ACL log format|
|Monitoring|Count of denied connections already exists|
|Management|no changes|
However, how, practically, would one *specify host addresses?* If you want to
allow connections from the 10.1.0.0/16 subnet the code today would force you to
specify 65k lines of ACL rules and that's not very useful. It would be _easier_
coding for ACL to allow the address to be specified as:
{noformat}
10.1.*
{noformat}
and _harder_ coding to allow the address to be specified as
{noformat}
10.1.0.0/16
{noformat}
The same wildcard rule would apply to both IPv4 and IPv6 addresses.
If a simple wildcard is OK then this feature would be relatively easy to add.)
> [AMQP 1.0] ACL support
> ----------------------
>
> Key: QPID-4712
> URL: https://issues.apache.org/jira/browse/QPID-4712
> Project: Qpid
> Issue Type: Bug
> Components: C++ Broker
> Affects Versions: 0.22
> Reporter: Gordon Sim
> Assignee: Gordon Sim
> Fix For: 0.23
>
>
> Though e.g. creation of queues and exchanges is governed by ACL rules,
> creation of connections is not and this should be rectified.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org
For additional commands, e-mail: dev-h...@qpid.apache.org
