Make AMQP 1.0 and AMQP 0-9-1 connections optional #12238
-
|
With Native AMQP 1.0 in 4.0 it will no longer be possible to only disable AMQP 1.0 connections. (Which was possible in 3.x, since it was a plugin - Don't enable it, don't receive AMQP 1.0 traffic) The suggestion here is to make it configurable whether to allow AMQP 1.0 and/or AMQP 0-9-1. Right now the only possibility would be to block port/not start the listener for both of them. One idea is to introduce a check here: 8cb313d#diff-c6da5f893cf5567c62329bbe62145d8dfd282a3f8ad4f00295459ed4e89c0de0L1650 and a similar check for AMQP 0-9-1. |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 2 replies
-
|
Why would you want to?
*Karl Nilsson*
…On Fri, 6 Sep 2024 at 15:31, Johan Rhodin ***@***.***> wrote:
With Native AMQP 1.0 in 4.0 it will no longer be possible to only disable
AMQP 1.0 connections. (Which was possible in 3.x, since it was a plugin -
Don't enable it, don't receive AMQP 1.0 traffic)
The suggestion here is to make it configurable whether to allow AMQP 1.0
and/or AMQP 0-9-1. Right now the only possibility would be to block
port/not start the listener for both of them.
One idea is to introduce a check here: 8cb313d
#diff-c6da5f893cf5567c62329bbe62145d8dfd282a3f8ad4f00295459ed4e89c0de0L1650
<8cb313d#diff-c6da5f893cf5567c62329bbe62145d8dfd282a3f8ad4f00295459ed4e89c0de0L1650>
and a similar check for AMQP 0-9-1.
—
Reply to this email directly, view it on GitHub
<#12238>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAJAHFB3AX4SZMVMJIRN673ZVG4DDAVCNFSM6AAAAABNYWUEYSVHI2DSMVQWIX3LMV43ERDJONRXK43TNFXW4OZXGE2DMNJWGA>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
One is security: run the least amount of services required. Example GHSA-5hjq-8gx9-79g4, similar issues can be found for MQTT/STOMP (which can be disabled by not running the respective plugins). |
Beta Was this translation helpful? Give feedback.
-
|
@johanrhodin why a solution to every problem should be a modification to RabbitMQ, that the core team will have to maintain (even if someone else contributes it initially), document, consider in support cases and automation tools? Why can't you simply block traffic on certain ports? Your company fully controls the deployment process. |
Beta Was this translation helpful? Give feedback.
-
|
99.99% of users do not need this. AMQP 1.0 is the future of RabbitMQ, AMQP 0-9-1 is not going away, if you want to disable both it should be enough to simply block traffic to the well known AMQP ports. Other protocol plugins remain, well, plugins. |
Beta Was this translation helpful? Give feedback.
99.99% of users do not need this. AMQP 1.0 is the future of RabbitMQ, AMQP 0-9-1 is not going away, if you want to disable both it should be enough to simply block traffic to the well known AMQP ports.
Other protocol plugins remain, well, plugins.