Mirroristas/etcd
2
0
Fork 0
mirror of https://github.com/etcd-io/etcd.git synced 2024-09-27 06:25:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

etcdserver, auth: not return grpc error code directly in the apply phase

Browse Source 
Current permission checking mechanism doesn't return its error code
well. The internal error (code = 13) is returned to client and the
retry mechanism doesn't work well. This commit fixes the problem.
This commit is contained in:
Hitoshi Mitake 2016-05-30 13:18:07 +09:00
parent 815bc5307f
commit 5144318af0
4 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
auth/store.go
View File

@ -42,6 +42,7 @@ var (
ErrRoleAlreadyExist = errors.New("auth: role already exists") ErrRoleAlreadyExist = errors.New("auth: role already exists")
ErrRoleNotFound = errors.New("auth: role not found") ErrRoleNotFound = errors.New("auth: role not found")
ErrAuthFailed = errors.New("auth: authentication failed, invalid user ID or password") ErrAuthFailed = errors.New("auth: authentication failed, invalid user ID or password")
ErrPermissionDenied = errors.New("auth: permission denied")
) )
type AuthStore interface { type AuthStore interface {

2
etcdserver/api/v3rpc/rpctypes/error.go
View File

@ -71,6 +71,7 @@ var (
grpc.ErrorDesc(ErrGRPCRoleAlreadyExist): ErrGRPCRoleAlreadyExist, grpc.ErrorDesc(ErrGRPCRoleAlreadyExist): ErrGRPCRoleAlreadyExist,
grpc.ErrorDesc(ErrGRPCRoleNotFound): ErrGRPCRoleNotFound, grpc.ErrorDesc(ErrGRPCRoleNotFound): ErrGRPCRoleNotFound,
grpc.ErrorDesc(ErrGRPCAuthFailed): ErrGRPCAuthFailed, grpc.ErrorDesc(ErrGRPCAuthFailed): ErrGRPCAuthFailed,
grpc.ErrorDesc(ErrGRPCPermissionDenied): ErrGRPCPermissionDenied,
grpc.ErrorDesc(ErrGRPCNoLeader): ErrGRPCNoLeader, grpc.ErrorDesc(ErrGRPCNoLeader): ErrGRPCNoLeader,
grpc.ErrorDesc(ErrGRPCNotCapable): ErrGRPCNotCapable, grpc.ErrorDesc(ErrGRPCNotCapable): ErrGRPCNotCapable,
@ -99,6 +100,7 @@ var (
ErrRoleAlreadyExist = Error(ErrGRPCRoleAlreadyExist) ErrRoleAlreadyExist = Error(ErrGRPCRoleAlreadyExist)
ErrRoleNotFound = Error(ErrGRPCRoleNotFound) ErrRoleNotFound = Error(ErrGRPCRoleNotFound)
ErrAuthFailed = Error(ErrGRPCAuthFailed) ErrAuthFailed = Error(ErrGRPCAuthFailed)
ErrPermissionDenied = Error(ErrGRPCPermissionDenied)
ErrNoLeader = Error(ErrGRPCNoLeader) ErrNoLeader = Error(ErrGRPCNoLeader)
ErrNotCapable = Error(ErrGRPCNotCapable) ErrNotCapable = Error(ErrGRPCNotCapable)

2
etcdserver/api/v3rpc/util.go
View File

@ -47,6 +47,8 @@ func togRPCError(err error) error {
return rpctypes.ErrGRPCRoleNotFound return rpctypes.ErrGRPCRoleNotFound
case auth.ErrAuthFailed: case auth.ErrAuthFailed:
return rpctypes.ErrGRPCAuthFailed return rpctypes.ErrGRPCAuthFailed
case auth.ErrPermissionDenied:
return rpctypes.ErrGRPCPermissionDenied
default: default:
return grpc.Errorf(codes.Internal, err.Error()) return grpc.Errorf(codes.Internal, err.Error())
} }

6
etcdserver/apply.go
View File

@ -19,7 +19,7 @@ import (
"fmt" "fmt"
"sort" "sort"
"github.com/coreos/etcd/etcdserver/api/v3rpc/rpctypes" "github.com/coreos/etcd/auth"
pb "github.com/coreos/etcd/etcdserver/etcdserverpb" pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
"github.com/coreos/etcd/lease" "github.com/coreos/etcd/lease"
"github.com/coreos/etcd/mvcc" "github.com/coreos/etcd/mvcc"
@ -76,13 +76,13 @@ func (s *EtcdServer) applyV3Request(r *pb.InternalRaftRequest) *applyResult {
if s.AuthStore().IsRangePermitted(r.Header, string(r.Range.Key)) { if s.AuthStore().IsRangePermitted(r.Header, string(r.Range.Key)) {
ar.resp, ar.err = s.applyV3.Range(noTxn, r.Range) ar.resp, ar.err = s.applyV3.Range(noTxn, r.Range)
} else { } else {
ar.err = rpctypes.ErrGRPCPermissionDenied ar.err = auth.ErrPermissionDenied
} }
case r.Put != nil: case r.Put != nil:
if s.AuthStore().IsPutPermitted(r.Header, string(r.Put.Key)) { if s.AuthStore().IsPutPermitted(r.Header, string(r.Put.Key)) {
ar.resp, ar.err = s.applyV3.Put(noTxn, r.Put) ar.resp, ar.err = s.applyV3.Put(noTxn, r.Put)
} else { } else {
ar.err = rpctypes.ErrGRPCPermissionDenied ar.err = auth.ErrPermissionDenied
} }
case r.DeleteRange != nil: case r.DeleteRange != nil:
ar.resp, ar.err = s.applyV3.DeleteRange(noTxn, r.DeleteRange) ar.resp, ar.err = s.applyV3.DeleteRange(noTxn, r.DeleteRange)