[Bug] Proxy Admin authorization is skipped for methods missing from the permission map

オープン
  • 何か問題がありますか？
#11,470 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@Felix-Gong がすでに取り組んでいます。

2026年10月20日 から。

  • #11471 @Felix-Gong による — オープン

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
25/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
停滞
技術スタック
grpc, java
領域
authorization, backend, security

調査の方向性

Start with ProxyAdminAuthInterceptor and its METHOD_PERMISSIONS map, then read the existing interceptor test harness. Check how authorization behaves when a served method has no map entry, and add tests that compare the Admin RPC surface with the permission map. Done means unmapped methods are refused when authorization is enabled and a newly added RPC without a mapping fails CI; PR #11471 is already open.

索引モデルが issue の本文から書いたものです。

説明

Search before asking

I checked open and closed issues and PRs for ProxyAdminAuthInterceptor, METHOD_PERMISSIONS, proxy.admin authorization and unmapped admin methods. The nearby open work is different: #11362 / PR #11363 changes which address the ACL is evaluated against, and #11178 / PR #11179 refuses to start when authorization is enabled without authentication. Neither covers what happens to a method that has no entry in the permission map.

What happened?

ProxyAdminAuthInterceptor binds every admin RPC to a proxy.admin.* resource through the static METHOD_PERMISSIONS map. The authorization branch is guarded by resourceAction != null:

ResourceAction resourceAction = METHOD_PERMISSIONS.get(method);
if (resourceAction != null && authzEnabled) {
    ... authorize against proxy.admin.<module> ...
}
return next.startCall(call, headers);   // unmapped methods land here

A method with no entry skips authorization completely and is served. With cluster authorization on, every mapped method gets a real ACL decision, but an unmapped one runs with authentication only — and the same is true in grpcAdminServerAuthEnable fail-closed mode, which only checks that authentication and authorization are enabled, not that this method is covered by them.

The admin server currently hosts only the Admin service and all 16 of its RPCs are mapped, so nothing is exploitable on develop today. But the surface grows from the rocketmq-apis side — the Admin service gained RPCs in three recent commits (#113, #115, #116) — and nothing cross-checks the proto against the map. The first future RPC merged without a hand-written entry becomes an authorization bypass by construction, including whatever mutation it introduces.

Expected behavior

When the cluster authorization switch is on, a served method that has no proxy.admin.* mapping should be refused (the class already documents fail-closed as its behavior mode) rather than served without a permission check. The map and the served surface should also be pinned against each other in tests, so adding an RPC without deciding its resource and action fails CI instead of shipping a silent hole.

Runtime

develop at 57c2dc0, JDK 11. Reproduced with the existing interceptor test harness — no broker or proxy required. On the current code, a call to an unmapped method name with authorizationEnabled=true reaches next.startCall(...); the new test fails exactly there.

主要言語
Java
スター
22.7k
フォーク
12k
平均マージ
4日 20時間
マージ済み PR（30日）
11

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

apache/rocketmq のほかの issue

apache/rocketmq の issue をすべて見る

似ている issue

Java の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。