Commit Graph

187 Commits

Author SHA1 Message Date
Philip Kuryloski 29ddca78aa Fix additional Erlang 24 compiler warnings 2021-05-17 12:05:28 +02:00
Philip Kuryloski 388654c542
Add a partial Bazel build (#2938)
Adds WORKSPACE.bazel, BUILD.bazel & *.bzl files for partial build & test with Bazel. Introduces a build-time dependency on https://github.com/rabbitmq/bazel-erlang
2021-03-29 11:01:43 +02:00
Michael Klishin 97ff62d3b2
Drop trailing newlines from logged messages where possible
Lager strips trailing newline characters but OTP logger with the default
formatter adds a newline at the end. To avoid unintentional multi-line log
messages we have to revisit most messages logged.

Some log entries are intentionally multiline, others
are printed to stdout directly: newlines are required there
for sensible formatting.
2021-03-11 15:17:37 +01:00
Jean-Sébastien Pédron cdcf602749
Switch from Lager to the new Erlang Logger API for logging
The configuration remains the same for the end-user. The only exception
is the log root directory: it is now set through the `log_root`
application env. variable in `rabbit`. People using the Cuttlefish-based
configuration file are not affected by this exception.

The main change is how the logging facility is configured. It now
happens in `rabbit_prelaunch_logging`. The `rabbit_lager` module is
removed.

The supported outputs remain the same: the console, text files, the
`amq.rabbitmq.log` exchange and syslog.

The message text format slightly changed: the timestamp is more precise
(now to the microsecond) and the level can be abbreviated to always be
4-character long to align all messages and improve readability. Here is
an example:

    2021-03-03 10:22:30.377392+01:00 [dbug] <0.229.0> == Prelaunch DONE ==
    2021-03-03 10:22:30.377860+01:00 [info] <0.229.0>
    2021-03-03 10:22:30.377860+01:00 [info] <0.229.0>  Starting RabbitMQ 3.8.10+115.g071f3fb on Erlang 23.2.5
    2021-03-03 10:22:30.377860+01:00 [info] <0.229.0>  Licensed under the MPL 2.0. Website: https://rabbitmq.com

The example above also shows that multiline messages are supported and
each line is prepended with the same prefix (the timestamp, the level
and the Erlang process PID).

JSON is also supported as a message format and now for any outputs.
Indeed, it is possible to use it with e.g. syslog or the exchange. Here
is an example of a JSON-formatted message sent to syslog:

    Mar  3 11:23:06 localhost rabbitmq-server[27908] <0.229.0> - {"time":"2021-03-03T11:23:06.998466+01:00","level":"notice","msg":"Logging: configured log handlers are now ACTIVE","meta":{"domain":"rabbitmq.prelaunch","file":"src/rabbit_prelaunch_logging.erl","gl":"<0.228.0>","line":311,"mfa":["rabbit_prelaunch_logging","configure_logger",1],"pid":"<0.229.0>"}}

For quick testing, the values accepted by the `$RABBITMQ_LOGS`
environment variables were extended:
  * `-` still means stdout
  * `-stderr` means stderr
  * `syslog:` means syslog on localhost
  * `exchange:` means logging to `amq.rabbitmq.log`

`$RABBITMQ_LOG` was also extended. It now accepts a `+json` modifier (in
addition to the existing `+color` one). With that modifier, messages are
formatted as JSON intead of plain text.

The `rabbitmqctl rotate_logs` command is deprecated. The reason is
Logger does not expose a function to force log rotation. However, it
will detect when a file was rotated by an external tool.

From a developer point of view, the old `rabbit_log*` API remains
supported, though it is now deprecated. It is implemented as regular
modules: there is no `parse_transform` involved anymore.

In the code, it is recommended to use the new Logger macros. For
instance, `?LOG_INFO(Format, Args)`. If possible, messages should be
augmented with some metadata. For instance (note the map after the
message):

    ?LOG_NOTICE("Logging: switching to configured handler(s); following "
                "messages may not be visible in this log output",
                #{domain => ?RMQLOG_DOMAIN_PRELAUNCH}),

Domains in Erlang Logger parlance are the way to categorize messages.
Some predefined domains, matching previous categories, are currently
defined in `rabbit_common/include/logging.hrl` or headers in the
relevant plugins for plugin-specific categories.

At this point, very few messages have been converted from the old
`rabbit_log*` API to the new macros. It can be done gradually when
working on a particular module or logging.

The Erlang builtin console/file handler, `logger_std_h`, has been forked
because it lacks date-based file rotation. The configuration of
date-based rotation is identical to Lager. Once the dust has settled for
this feature, the goal is to submit it upstream for inclusion in Erlang.
The forked module is calld `rabbit_logger_std_h` and is based
`logger_std_h` in Erlang 23.0.
2021-03-11 15:17:36 +01:00
Michael Klishin 66badb9492
LDAP plugin: handle undefined app env values, pass Dialyzer 2021-02-11 21:26:27 +03:00
Michael Klishin 8ea212a6b6
New configuration settings for TLS
* [Client] hostname verification matching: wildcard or none
 * SNI hostname or none

Closes #2805
2021-02-11 00:12:24 +03:00
Michael Klishin 52479099ec
Bump (c) year 2021-01-22 09:00:14 +03:00
dcorbacho 015e1152c2 Switch to Mozilla Public License 2.0 (MPL 2.0) 2020-07-10 20:19:35 +01:00
Michael Klishin ffefe91771 Explain 2020-03-24 16:08:11 +03:00
Luke Bakken d8ff8a548a Setting idle_timeout to 0 will request a connection for every operation
[171933299]
2020-03-23 14:32:59 -07:00
Luke Bakken ef14002fb6 Setting idle_timeout to 0 will request a connection for every operation
[171933299]
2020-03-23 10:29:26 -07:00
Jean-Sébastien Pédron 084605ab9d Update copyright (year 2020) 2020-03-10 16:02:56 +01:00
Luke Bakken dcb92cfabf Remove unused variable
See b67ccfbd15
2020-02-28 15:08:36 -08:00
Luke Bakken c0f43acfba Remove spammy log message
Fixes #118
2020-02-27 14:40:05 -08:00
Michael Klishin d9890ad642 (c) bump 2019-12-29 05:50:24 +03:00
Luke Bakken d9835870d2 Ensure results match expected rabbit_authz_backend behaviour
Fixes #116
2019-10-30 14:05:06 -07:00
Luke Bakken b843487019 Add warning messages when configuration values do not make sense 2019-10-14 09:58:58 -07:00
Michael Klishin 1d712739d5 Adapt to rabbit_authz_backend interface changes in rabbitmq/rabbitmq-auth-backend-oauth2#28. 2019-07-03 10:41:01 +02:00
Arnaud Cogoluègnes db497a2baf Propagate protocol-specific context
Information like MQTT client ID is now propagated to the LDAP registry
for all authentication and authorization functions.

References rabbitmq/rabbitmq-server#1767
2019-06-03 15:54:37 +02:00
Luke Bakken 4953a835d9 Rename unused variable to reflect changes
Small part of rabbitmq/rabbitmq-auth-backend-cache#20
2019-03-22 11:08:15 -07:00
Spring Operator 2afc58cf87 URL Cleanup
This commit updates URLs to prefer the https protocol. Redirects are not followed to avoid accidentally expanding intentionally shortened URLs (i.e. if using a URL shortener).

# HTTP URLs that Could Not Be Fixed
These URLs were unable to be fixed. Please review them to see if they can be manually resolved.

* http://blog.listincomprehension.com/search/label/procket (200) with 1 occurrences could not be migrated:
   ([https](https://blog.listincomprehension.com/search/label/procket) result ClosedChannelException).
* http://dozzie.jarowit.net/trac/wiki/TOML (200) with 1 occurrences could not be migrated:
   ([https](https://dozzie.jarowit.net/trac/wiki/TOML) result SSLHandshakeException).
* http://dozzie.jarowit.net/trac/wiki/subproc (200) with 1 occurrences could not be migrated:
   ([https](https://dozzie.jarowit.net/trac/wiki/subproc) result SSLHandshakeException).
* http://e2project.org (200) with 1 occurrences could not be migrated:
   ([https](https://e2project.org) result AnnotatedConnectException).
* http://nitrogenproject.com/ (200) with 2 occurrences could not be migrated:
   ([https](https://nitrogenproject.com/) result ConnectTimeoutException).
* http://proper.softlab.ntua.gr (200) with 1 occurrences could not be migrated:
   ([https](https://proper.softlab.ntua.gr) result SSLHandshakeException).
* http://yaws.hyber.org (200) with 1 occurrences could not be migrated:
   ([https](https://yaws.hyber.org) result AnnotatedConnectException).
* http://choven.ca (503) with 1 occurrences could not be migrated:
   ([https](https://choven.ca) result ConnectTimeoutException).

# Fixed URLs

## Fixed But Review Recommended
These URLs were fixed, but the https status was not OK. However, the https status was the same as the http request or http redirected to an https URL, so they were migrated. Your review is recommended.

* http://fixprotocol.org/ (301) with 1 occurrences migrated to:
  https://fixtrading.org ([https](https://fixprotocol.org/) result SSLHandshakeException).
* http://erldb.org (UnknownHostException) with 1 occurrences migrated to:
  https://erldb.org ([https](https://erldb.org) result UnknownHostException).

## Fixed Success
These URLs were switched to an https URL with a 2xx status. While the status was successful, your review is still recommended.

* http://cloudi.org/ with 27 occurrences migrated to:
  https://cloudi.org/ ([https](https://cloudi.org/) result 200).
* http://erlware.org/ with 1 occurrences migrated to:
  https://erlware.org/ ([https](https://erlware.org/) result 200).
* http://github.com/rabbitmq/rabbitmq-auth-backend-cache with 1 occurrences migrated to:
  https://github.com/rabbitmq/rabbitmq-auth-backend-cache ([https](https://github.com/rabbitmq/rabbitmq-auth-backend-cache) result 200).
* http://inaka.github.io/cowboy-trails/ with 1 occurrences migrated to:
  https://inaka.github.io/cowboy-trails/ ([https](https://inaka.github.io/cowboy-trails/) result 200).
* http://ninenines.eu with 6 occurrences migrated to:
  https://ninenines.eu ([https](https://ninenines.eu) result 200).
* http://www.actordb.com/ with 2 occurrences migrated to:
  https://www.actordb.com/ ([https](https://www.actordb.com/) result 200).
* http://www.cs.kent.ac.uk/projects/wrangler/Home.html with 1 occurrences migrated to:
  https://www.cs.kent.ac.uk/projects/wrangler/Home.html ([https](https://www.cs.kent.ac.uk/projects/wrangler/Home.html) result 200).
* http://www.rabbitmq.com/ldap.html with 4 occurrences migrated to:
  https://www.rabbitmq.com/ldap.html ([https](https://www.rabbitmq.com/ldap.html) result 200).
* http://www.rabbitmq.com/plugin-development.html with 1 occurrences migrated to:
  https://www.rabbitmq.com/plugin-development.html ([https](https://www.rabbitmq.com/plugin-development.html) result 200).
* http://www.rebar3.org with 1 occurrences migrated to:
  https://www.rebar3.org ([https](https://www.rebar3.org) result 200).
* http://contributor-covenant.org with 1 occurrences migrated to:
  https://contributor-covenant.org ([https](https://contributor-covenant.org) result 301).
* http://contributor-covenant.org/version/1/3/0/ with 1 occurrences migrated to:
  https://contributor-covenant.org/version/1/3/0/ ([https](https://contributor-covenant.org/version/1/3/0/) result 301).
* http://inaka.github.com/apns4erl with 1 occurrences migrated to:
  https://inaka.github.com/apns4erl ([https](https://inaka.github.com/apns4erl) result 301).
* http://inaka.github.com/edis/ with 1 occurrences migrated to:
  https://inaka.github.com/edis/ ([https](https://inaka.github.com/edis/) result 301).
* http://lasp-lang.org/ with 1 occurrences migrated to:
  https://lasp-lang.org/ ([https](https://lasp-lang.org/) result 301).
* http://rabbitmq.com/access-control.html with 1 occurrences migrated to:
  https://rabbitmq.com/access-control.html ([https](https://rabbitmq.com/access-control.html) result 301).
* http://saleyn.github.com/erlexec with 1 occurrences migrated to:
  https://saleyn.github.com/erlexec ([https](https://saleyn.github.com/erlexec) result 301).
* http://www.mozilla.org/MPL/ with 7 occurrences migrated to:
  https://www.mozilla.org/MPL/ ([https](https://www.mozilla.org/MPL/) result 301).
* http://zhongwencool.github.io/observer_cli with 1 occurrences migrated to:
  https://zhongwencool.github.io/observer_cli ([https](https://zhongwencool.github.io/observer_cli) result 301).
2019-03-20 03:11:50 -05:00
Michael Klishin 52d7cba41d Drive by change: Lager adds a trailing new line 2019-02-08 03:42:16 +03:00
Yury.Alioshinov 866f50790f replace rabbit_log by rabbit_log_ldap 2019-02-08 01:48:10 +03:00
Luke Bakken dab0ccc006 Rather than crash return error if search results in referrals
Fixes #97

The case of a referral being returned has only been brought up once. For now, return an error. If this turns out to be a more common case, the referral URL should be parsed and chased.
2018-11-02 15:44:20 -07:00
Joel Forsberg f8fd4393e1 Fix LDAP evaluation resulting in list of strings.
The previous code tries to do weird things by exchanging the arguments being put in to re:run(). Bidirectional match might seem to work when the regular expression is just a couple of plaintexts, but is actually really wrong and also causes confusing log messages when your RE-expression end up in the string matching.

Secondly it seemed to handle multi-valued LDAP results by concatenating them into strings like "First_item;second_item" which makes for very interesting results when you try to match against R.Es like ^read$

This change guards against cases when the LDAP query evaluates to a list and fallbacks to regular do_match when the arguments aren't lists of strings.
2018-11-02 11:59:10 -07:00
Luke Bakken 85dcb36ce6 Add user_bind_pattern
This allows using a different pattern during the "simple bind" phase. If `user_bind_pattern` is defined, it is used, otherwise fall back to `user_dn_pattern`

Related to #98 and #99

(cherry picked from commit 7f32abde3b)
2018-10-31 02:43:38 +03:00
Luke Bakken 300004dfc6 Add unit test for ad_domain / ad_user 2018-10-26 12:55:20 -07:00
Luke Bakken d2452b6cc4 Tokenize NetBIOS logins on the backslash character
Fixes #98

This allows `Domain\User` to be used in templates via `${ad_domain}` and `{$ad_user}`

See the following discussion: https://groups.google.com/d/topic/rabbitmq-users/mK87YcRy4vQ/discussion
2018-10-26 12:41:16 -07:00
Michael Klishin 4888a008cf Accept authentication context in user_login_authorization/2
Part of rabbitmq/rabbitmq-server#1633.

[#158805410]
2018-07-03 23:30:23 +03:00
Michael Klishin e0dda13ef6 Allow auth_ldap.dn_lookup_bind to be set to anon in rabbitmq.conf, closes #94
[#158471902]
2018-06-19 21:45:30 +03:00
Michael Klishin c4b32a9961 Log message wording
[#157966354]
2018-05-31 01:58:20 +03:00
Luke Bakken cdd7deeb6e Purge defunct connections in more cases
Fixes #92

This PR will purge defunct connections in a few more cases than before.
2018-05-30 15:02:02 -07:00
Michael Klishin 3ffc1255b1 Log this as a warning 2018-03-28 18:44:52 +03:00
Michael Klishin e9e9d7ea2a Extract a constant 2018-03-28 00:20:45 +03:00
Michael Klishin 4eb46af59d Handle gen_tcp errors here, too 2018-03-28 00:12:28 +03:00
Michael Klishin 62b259873c Retry LDAP operations on eldap reported connection errors
* This will retry up to 10 times when eldap reports a connection
   or gen_tcp error.

Closes #90, references #82.
[#156324176]
2018-03-27 23:21:32 +03:00
Michael Klishin 72864e84fb Recreate LDAP connection and retry on all TCP socket errors
Not just 'closed'. Per discussion with @hairyhum, @lukebakken and @kjnilsson.

Closes #82.

[#155865547]
2018-03-13 18:51:27 +03:00
Arnaud Cogoluègnes 344aba30d5 Handle map when in template arguments
An Erlang map is turned into several arguments. E.g.
{variable_map, #{username => guest, vhost = some-vhost}} is converted
into 2 arguments: variable_map.username=guest and variable_map.vhost=some-vhost.

Fixes #71
2017-06-30 16:38:50 +02:00
Michael Klishin f20f4c0193 Merge branch 'stable' 2017-05-10 21:54:53 +03:00
William Tan e8a79c06bd Add option to enable anonymous authentication
This will allow the user to enable the anon_auth flag in eldap in order
to be able to do a dn lookup by using anonymous authentication instead
of using a dedicated bind user.
2017-05-10 17:05:01 +00:00
Daniil Fedotov 6f487f5f5b Replace dicts with maps for internal structures 2017-04-24 13:49:07 +01:00
Michael Klishin 32d566f362 Merge branch 'stable' 2017-04-22 01:10:06 +02:00
Michael Klishin 6bfa455084 Compile in non-test environment
Otherwise we are getting an unused function warning that's treated
as an error.
2017-04-22 01:05:34 +02:00
Michael Klishin aa9a2a40aa Remove a debug trace 2017-04-22 01:04:04 +02:00
kjnilsson 4f4ff6c13e Fix badmatch exception when purging connections
The exception stops timed out connections from
reconnecting successfully.

[#144015233]
2017-04-20 14:12:24 +01:00
Michael Klishin 2d0afdcf8e Merge branch 'stable' 2017-04-02 21:55:36 +03:00
Michael Klishin 33d51d0a8d (c) year 2017-04-02 21:47:12 +03:00
Michael Klishin f3c75f6b2e Revert "Wording"
This reverts commit 1a554a3530.

Given that we use operation verbs (e.g. bind or evaluate) in log
messages, it makes certain sense to use the same wording
in error type atoms, even if it's imperfect English.
2017-02-20 15:03:53 +03:00
Michael Klishin 1a554a3530 Wording 2017-02-20 14:49:51 +03:00
Daniil Fedotov aa4088a118 Hide LDAP error from clients
LDAP errors are logged to LDAP log,
so we can replace errors with generic messages like
`ldap_connect_error` to be reported to clients.
2017-02-20 11:11:56 +00:00