| Bug #37172 | Agent login cannot contain special chars @ | ||
|---|---|---|---|
| Submitted: | 4 Jun 2008 0:30 | Modified: | 19 Nov 2009 12:03 |
| Reporter: | Adam Dixon | ||
| Status: | Closed | ||
| Category: | Monitoring: Agent | Severity: | S3 (Non-critical) |
| Version: | 1.3,2.0.0.7029 | OS: | Any |
| Assigned to: | Michael Schuster | Target Version: | 2.0 final beta |
| Triage: | D5 (Feature request) | ||
[12 Jun 2008 17:18]
Kay Roepke
Could you please expand on the steps to reproduce this? When I URL-encode the @ in the agent configuration file it works as expected. Thanks
[12 Jun 2008 23:03]
Adam Dixon
If you change the password post installation, you then need to update the config file manually. It is not mentioned in the interface that the password has to be urlencoded, nor does it do it for you so you can paste this into the configuration file.
[12 Jun 2008 23:09]
Adam Dixon
That is - - Install setting password to 'bob' - update password using dashboard to '@agent' - update config file manually as customer would - error as it is not urlencoded. Could be mentioned in the interface that this is a requirement if a char is in the pw that requires it at least. Its also not documented from what I can tell.
[15 Aug 2008 21:57]
Gary Whizin
Let's take Adam's suggested fix for now: disallow special characters in Dashboard's Settings/Manage Users password handling. Later, we can remove this limitation once we've addressed the issue on the agent side. QA: after this bug is verified, assign to Documentation. Doc: after documenting, change to "to be fixed later" :)
[18 Aug 2008 20:36]
Josh Sled
FFR, the list of reserved chars to be escaped: http://en.wikipedia.org/wiki/Percent-encoding#Types_of_URI_characters
[20 Aug 2008 1:49]
Josh Sled
revno: 6214 revision-id: jsled@asynchronous.org-20080819232207-ehwdausx2euoprbj parent: jsled@asynchronous.org-20080819232117-ezckkom6lgly569l committer: Josh Sled <jsled@asynchronous.org> branch nick: local timestamp: Tue 2008-08-19 19:22:07 -0400 message: Bug#37172: test the agent password string for the presence of "[url] reserved" characters, and disallow. This solution is lame. modified: src/com/mysql/merlin/ui/actions/settings/users/EditUser.java 5804@3c33494c-61f7-0310-86b9-b90697347e9d:trunk;1cbac073fe1d3e0d86211da53921520e8caac861 src/com/mysql/merlin/ui/helper/ErrorCodeMapping.java errorcodemapping.jav-20080430171212-8vqab07r9l00h4d5-1 src/resources_en.utf8 resources_en.utf8-20080717185917-kfpwvs7kmp2mb04b-1 src/resources_ja.utf8 resources_ja.utf8-20080204194215-rjksjbd0fp3oy4sa-1 test/com/mysql/merlin/ui/actions/settings/users/EditUserTest.java 7159@3c33494c-61f7-0310-86b9-b90697347e9d:trunk;2f58bd6fc03dfd73a79714a19c8b9771561c82cc (Note action unit test)
[8 Sep 2008 17:54]
Tony Bedford
An entry was added to the features/changes section of the 2.0 changelog: The dashboard could be used to change the agent password to one containing the @ character, or other special characters, which subsequently caused errors. To fix this problem, special characters in passwords are now prevented by the dashboard. The list of disallowed special characters can be found at the following location: http://en.wikipedia.org/wiki/Percent-encoding#Types_of_URI_characters
[21 Oct 2009 11:05]
Enterprise Tools JIRA Robot
Michael Schuster writes: revno: 1499 committer: michael.schuster@sun.com branch nick: trunk timestamp: Tue 2009-10-20 02:15:44 -0700 message: EM-2663
[23 Oct 2009 2:32]
Enterprise Tools JIRA Robot
Keith Russell writes: Patch installed in versions => 2.2.0.1516.
[23 Oct 2009 19:40]
Enterprise Tools JIRA Robot
Marcos Palacios writes: Tested with service manager build 2.2.0.1517 and agent build 2.2.0.1516. Test cases are as indicated in "1)" above [see 19/Oct/09 11:27 PM comment]: Case 1: agent-mgmt-hostname=http://username@host:port/ agent-mgmt-password=passwd Result: *Fail* The agent cannot connect and its log has the following messages: 2009-10-23 12:16:05: (critical) authentication information in agent-mgmt-hostname will be overridden by agent-mgmt-password 2009-10-23 12:16:05: (critical) <-- received HTTP-status: 401 (failed) for 'http://agent@127.0.0.1:18080/heartbeat': authentication credentials incorrect Case 2: agent-mgmt-hostname=http://user:pass@host:port/ Result: *Pass* The agent connects as before; no new log messages. Case 3: agent-mgmt-hostname=http://host:port/ agent-mgmt-username=user agent-mgmt-password=passwd Result: *Pass* The agent connects as before; no new log messages. Case 4: agent-mgmt-hostname=http://olduser:oldpass@host:port/ agent-mgmt-username=user agent-mgmt-password=passwd Result: *Pass* The agent connects and its log now issues the following message: 2009-10-23 11:37:31: (critical) authentication information in agent-mgmt-hostname will be overridden by agent-mgmt-username Note: It still remains to be tested (not in this build yet) the reversal of the limitation in the MEM UI which does not allow special chars in the user password.
[23 Oct 2009 21:53]
Enterprise Tools JIRA Robot
Josh Sled writes: revno: 7587 revision-id: jsled@asynchronous.org-20091023194933-2j4hhqe0vw0e64x1 parent: jsled@asynchronous.org-20091023183944-69jz60a5hims81l6 committer: Josh Sled <jsled@asynchronous.org> branch nick: local timestamp: Fri 2009-10-23 15:49:33 -0400 message: EM-3524, EM-2663 related: no longer filter "reserved" agent password characters.
[26 Oct 2009 18:36]
Enterprise Tools JIRA Robot
Marcos Palacios writes: Verified that as of build 2.2.0.1518, the MEM UI no longer filters "reserved" (special) agent password characters.
[3 Nov 2009 0:46]
Enterprise Tools JIRA Robot
Andy Bang writes: Seems to be related to Bug #48219 - MEM upgrader does not escape special characters.
[9 Nov 2009 14:39]
Enterprise Tools JIRA Robot
Michael Schuster writes: I think I was overoptimistic when I wrote my initial comment about "behaviour". as it turns out one cannot mix and match "old" and "new" styles, curl will remove anything before and including the "@" in agent-mgmt-hostname if either -username or -password are present. For completeness sake, here are the valid combinations (a limited quote from that same comment): agent-mgmt-hostname=http://user:pass@host:port/ and agent-mgmt-hostname=http://host:port/ agent-mgmt-username=user agent-mgmt-password=passwd are all valid combinations. if used like this: agent-mgmt-hostname=http://olduser:oldpass@host:port/ agent-mgmt-username=user agent-mgmt-password=passwd olduser and oldpass will be ignored.
[9 Nov 2009 14:53]
Enterprise Tools JIRA Robot
Michael Schuster writes: no new code, just changed allowed modes
[12 Nov 2009 10:53]
Enterprise Tools JIRA Robot
Michael Schuster writes:
Alas, the situation with "mixed mode" is not as clear-cut as we'd like; if we use libcurl
versions older than 7.19.01, we are restricted to either
agent-mgmt-hostname=http://user:pass@host:port/
or
agent-mgmt-hostname=http://host:port/
agent-mgmt-username=user
agent-mgmt-password=passwd
newer versions though *do* accept constructs like
agent-mgmt-hostname=http://username@host:port/
agent-mgmt-password=passwd
or
agent-mgmt-hostname=http://:pass@host:port/
agent-mgmt-username=user
This is due to the introduction of curl options CURLOPT_USERNAME and CURLOPT_PASSWORD,
which made the more liberal handling possible. Before that, CURLOPT_USERPWD was the only
way to set username/password information, and this option exhibits an all-or-nothing
approach: when it's used, anything before the @ in the URL is ignored.
Note that the newer version needs to be present at compile- *and* at run-time to get the
new behaviour.
[13 Nov 2009 20:54]
Enterprise Tools JIRA Robot
Keith Russell writes: Patch installed in versions => 2.2.0.1538.
[16 Nov 2009 23:53]
Enterprise Tools JIRA Robot
Marcos Palacios writes: Verified fixed in agent build 2.2.0.1538. Notice (as explained in the latest comment from Dev) that "mixed mode" is not supported.
[17 Nov 2009 0:02]
Enterprise Tools JIRA Robot
Marcos Palacios writes: Notice that if used like this: agent-mgmt-hostname=http://olduser:oldpass@host:port/ agent-mgmt-username=user agent-mgmt-password=passwd You get the following error message: 2009-11-16 16:55:47: (critical) no authentication information allowed in agent-mgmt-hostname if agent-mgmt-username and agent-mgmt-password are given 2009-11-16 16:55:47: (critical) chassis.c:894: Failure from chassis_mainloop. Shutting down.
[19 Nov 2009 12:03]
Tony Bedford
Also added to 2.2.0 changelog.
Description: You can still use the dashboard after initial installation to change the agent password to something like '@gent' and cause errors; 2008-06-04 07:44:45: (critical) curl_easy_perform('http://agent:@gent@127.0.0.1:18080/merlin/heartbeat') failed: Couldn't resolve host 'gent@127.0.0.1' (code = 6, os-errno = 0) Similar to bug 26044 How to repeat: Set the agent password to connect to the dashboard to @gent. Suggested fix: Do not allow the use of @ in the password change dialog, or document the inability to handle this.