luxolus/open-nomad
2
0
Fork 0
Code Issues 1 Pull requests Packages Releases Wiki Activity

fixing up code review comments

Browse source
This commit is contained in:
Chelsea Holland Komlo 2017-10-06 20:54:09 -04:00 committed by Alex Dadgar
parent 1b90a2eef0
commit b018ca4d46
3 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
client/client.go
View file

@ -526,6 +526,9 @@ func (c *Client) LatestHostStats() *stats.HostStats {
return c.hostStatsCollector.Stats() return c.hostStatsCollector.Stats()
} }
// ValidateMigrateToken verifies that a token is for a specific client and
// allocation, and has been created by a trusted party that has privilaged
// knowledge of the client's secret identifier
func (c *Client) ValidateMigrateToken(allocID, migrateToken string) bool { func (c *Client) ValidateMigrateToken(allocID, migrateToken string) bool {
if !c.config.ACLEnabled { if !c.config.ACLEnabled {
return true return true

9
command/agent/alloc_endpoint.go
View file

@ -88,12 +88,11 @@ func (s *HTTPServer) ClientAllocRequest(resp http.ResponseWriter, req *http.Requ
return nil, CodedError(404, resourceNotFoundErr) return nil, CodedError(404, resourceNotFoundErr)
} }
allocID := tokens[0] allocID := tokens[0]
migrateToken := req.Header.Get("X-Nomad-Token")
switch tokens[1] { switch tokens[1] {
case "stats": case "stats":
return s.allocStats(allocID, resp, req) return s.allocStats(allocID, resp, req)
case "snapshot": case "snapshot":
return s.allocSnapshot(allocID, migrateToken, resp, req) return s.allocSnapshot(allocID, resp, req)
case "gc": case "gc":
return s.allocGC(allocID, resp, req) return s.allocGC(allocID, resp, req)
} }
@ -135,8 +134,10 @@ func (s *HTTPServer) allocGC(allocID string, resp http.ResponseWriter, req *http
return nil, s.agent.Client().CollectAllocation(allocID) return nil, s.agent.Client().CollectAllocation(allocID)
} }
func (s *HTTPServer) allocSnapshot(allocID, migrateToken string, resp http.ResponseWriter, req *http.Request) (interface{}, error) { func (s *HTTPServer) allocSnapshot(allocID string, resp http.ResponseWriter, req *http.Request) (interface{}, error) {
if !s.agent.Client().ValidateMigrateToken(allocID, migrateToken) { var secret string
s.parseToken(req, &secret)
if !s.agent.Client().ValidateMigrateToken(allocID, secret) {
return nil, fmt.Errorf("invalid migrate token for allocation %q", allocID) return nil, fmt.Errorf("invalid migrate token for allocation %q", allocID)
} }

2
nomad/node_endpoint_test.go
View file

@ -1384,7 +1384,7 @@ func TestClientEndpoint_GetClientAllocs_Blocking(t *testing.T) {
} }
} }
func TestClientEndpoint_GetClientAllocs_WIthMigrateTokens(t *testing.T) { func TestClientEndpoint_GetClientAllocs_WithMigrateTokens(t *testing.T) {
t.Parallel() t.Parallel()
assert := assert.New(t) assert := assert.New(t)