Mirroristas/etcd
2
0
Fork 0
mirror of https://github.com/etcd-io/etcd.git synced 2024-09-27 06:25:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

auth: disable CommonName auth for gRPC-gateway

Browse Source 
Signed-off-by: Sam Batschelet <sbatsche@redhat.com>
This commit is contained in:
Sam Batschelet 2019-01-02 15:54:40 -05:00
parent e6b2f00047
commit c7f744d6d3
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
auth/store.go
View File

@ -970,7 +970,7 @@ func (as *authStore) Revision() uint64 {
return atomic.LoadUint64(&as.revision) return atomic.LoadUint64(&as.revision)
} }
func (as *authStore) AuthInfoFromTLS(ctx context.Context) *AuthInfo { func (as *authStore) AuthInfoFromTLS(ctx context.Context) (ai *AuthInfo) {
peer, ok := peer.FromContext(ctx) peer, ok := peer.FromContext(ctx)
if !ok || peer == nil || peer.AuthInfo == nil { if !ok || peer == nil || peer.AuthInfo == nil {
return nil return nil
@ -982,10 +982,23 @@ func (as *authStore) AuthInfoFromTLS(ctx context.Context) *AuthInfo {
cn := chain.Subject.CommonName cn := chain.Subject.CommonName
plog.Debugf("found common name %s", cn) plog.Debugf("found common name %s", cn)
return &AuthInfo{ ai = &AuthInfo{
Username: cn, Username: cn,
Revision: as.Revision(), Revision: as.Revision(),
} }
md, ok := metadata.FromIncomingContext(ctx)
if !ok {
return nil
}
// gRPC-gateway proxy request to etcd server includes Grpcgateway-Accept
// header. The proxy uses etcd client server certificate. If the certificate
// has a CommonName we should never use this for authentication.
if gw := md["grpcgateway-accept"]; len(gw) > 0 {
plog.Warningf("ignoring common name in gRPC-gateway proxy request %s", ai.Username)
return nil
}
return ai
} }
} }