Mirroristas/etcd
2
0
Fork 0
mirror of https://github.com/etcd-io/etcd.git synced 2024-09-27 06:25:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #15512 from engow/automated-cherry-pick-of-#15432-origin-release-3.5

Browse Source 
[3.5] server/auth: fix auth panic bug when user changes password
This commit is contained in:
Benjamin Wang
2023-04-08 06:22:37 +08:00
committed by GitHub
parent 4501fd88c7 f7ac9dfcd6
commit 5872b80ed5
2 changed files with 25 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
server/auth/store.go
View File

@@ -479,7 +479,8 @@ func (as *authStore) UserChangePassword(r *pb.AuthUserChangePasswordRequest) (*p
var password []byte
var err error
if !user.Options.NoPassword {
// Backward compatible with old versions of etcd, user options is nil
if user.Options == nil || !user.Options.NoPassword {
password, err = as.selectPassword(r.Password, r.HashedPassword)
if err != nil {
return nil, ErrNoPasswordUser

25
server/auth/store_test.go
View File

@@ -125,6 +125,13 @@ func setupAuthStore(t *testing.T) (store *authStore, teardownfunc func(t *testin
t.Fatal(err)
}
// The UserAdd function cannot generate old etcd version user data (user's option is nil)
// add special users through the underlying interface
err = addUserWithNoOption(as)
if err != nil {
t.Fatal(err)
}
tearDown := func(_ *testing.T) {
b.Close()
as.Close()
@@ -132,6 +139,14 @@ func setupAuthStore(t *testing.T) (store *authStore, teardownfunc func(t *testin
return as, tearDown
}
func addUserWithNoOption(as *authStore) error {
_, err := as.UserAdd(&pb.AuthUserAddRequest{Name: "foo-no-user-options", Password: "bar"})
if err != nil {
return err
}
return nil
}
func enableAuthAndCreateRoot(as *authStore) error {
_, err := as.UserAdd(&pb.AuthUserAddRequest{Name: "root", HashedPassword: encodePassword("root"), Options: &authpb.UserAddOptions{NoPassword: false}})
if err != nil {
@@ -203,8 +218,8 @@ func TestRecoverWithEmptyRangePermCache(t *testing.T) {
t.Fatalf("expected auth enabled got disabled")
}
if len(as.rangePermCache) != 2 {
t.Fatalf("rangePermCache should have permission information for 2 users (\"root\" and \"foo\"), but has %d information", len(as.rangePermCache))
if len(as.rangePermCache) != 3 {
t.Fatalf("rangePermCache should have permission information for 3 users (\"root\" and \"foo\",\"foo-no-user-options\"), but has %d information", len(as.rangePermCache))
}
if _, ok := as.rangePermCache["root"]; !ok {
t.Fatal("user \"root\" should be created by setupAuthStore() but doesn't exist in rangePermCache")
@@ -335,6 +350,12 @@ func TestUserChangePassword(t *testing.T) {
if err != ErrUserNotFound {
t.Fatalf("expected %v, got %v", ErrUserNotFound, err)
}
// change a user（user option is nil) password
_, err = as.UserChangePassword(&pb.AuthUserChangePasswordRequest{Name: "foo-no-user-options", HashedPassword: encodePassword("bar")})
if err != nil {
t.Fatal(err)
}
}
func TestRoleAdd(t *testing.T) {