luxolus/open-nomad
2
0
Fork 0
Code Issues 1 Pull requests Packages Releases Wiki Activity
open-nomad/nomad
History
Tim Gross 8278f23042 acl: fix ACL bypass for anon requests that pass thru client HTTP 
Requests without an ACL token that pass thru the client's HTTP API are treated
as though they come from the client itself. This allows bypass of ACLs on RPC
requests where ACL permissions are checked (like `Job.Register`). Invalid tokens
are correctly rejected.

Fix the bypass by only setting a client ID on the identity if we have a valid node secret.

Note that this changeset will break rate metrics for RPCs sent by clients
without a client secret such as `Node.GetClientAllocs`; these requests will be
recorded as anonymous.

Future work should:
* Ensure the node secret is sent with all client-driven RPCs except
  `Node.Register` which is TOFU.
* Create a new `acl.ACL` object from client requests so that we
  can enforce ACLs for all endpoints in a uniform way that's less error-prone.~
2023-04-05 12:17:51 -04:00
..
deploymentwatcher renamed stanza to block for consistency with other projects (#15941) 2023-01-30 15:48:43 +01:00
drainer drainer: test refactoring to clarify behavior around delete/down nodes (#16612) 2023-03-23 14:07:09 -04:00
mock acl: fix canonicalization of JWT auth method mock (#16531) 2023-03-30 09:39:56 +02:00
state acl: RPC endpoints for JWT auth (#15918) 2023-03-30 09:39:56 +02:00
stream eventstream: Handle missing policy documents in event streams (#15495) 2023-02-14 11:27:39 -05:00
structs Prevent kill_timeout greater than progress_deadline (#16761) 2023-04-04 18:17:10 +02:00
volumewatcher volumewatcher: prevent panic on nil volume (#15101) 2022-11-01 16:53:10 -04:00
acl.go acl: fix ACL bypass for anon requests that pass thru client HTTP 2023-04-05 12:17:51 -04:00
acl_endpoint.go acl: set minACLJWTAuthMethodVersion to 1.5.3 and adjust code comment 2023-03-30 15:30:42 +02:00
acl_endpoint_test.go acl: RPC endpoints for JWT auth (#15918) 2023-03-30 09:39:56 +02:00
acl_test.go acl: fix ACL bypass for anon requests that pass thru client HTTP 2023-04-05 12:17:51 -04:00
alloc_endpoint.go metrics: Add RPC rate metrics to endpoints that validate TLS names (#15900) 2023-01-26 15:04:25 -05:00
alloc_endpoint_test.go WI: allow workloads to use RPCs associated with HTTP API (#15870) 2023-01-25 14:33:06 -05:00
autopilot.go autopilot: include only servers from the same region (#15290) 2022-11-17 12:09:36 -05:00
autopilot_oss.go migrate autopilot implementation to raft-autopilot (#14441) 2022-09-01 14:27:10 -04:00
autopilot_test.go autopilot: include only servers from the same region (#15290) 2022-11-17 12:09:36 -05:00
blocked_evals.go cleanup: remove more copies of min/max from helper 2022-08-24 09:56:15 -05:00
blocked_evals_stats.go metrics: even classless blocked evals get metrics 2022-07-15 14:12:44 -05:00
blocked_evals_stats_test.go metrics: even classless blocked evals get metrics 2022-07-15 14:12:44 -05:00
blocked_evals_system.go
blocked_evals_test.go
client_agent_endpoint.go metrics: measure rate of RPC requests that serve API (#15876) 2023-01-25 16:37:24 -05:00
client_agent_endpoint_test.go Data race fixes in tests and a new semgrep rule (#14594) 2022-09-15 10:35:08 -07:00
client_alloc_endpoint.go metrics: measure rate of RPC requests that serve API (#15876) 2023-01-25 16:37:24 -05:00
client_alloc_endpoint_test.go Data race fixes in tests and a new semgrep rule (#14594) 2022-09-15 10:35:08 -07:00
client_csi_endpoint.go metrics: Add rate metrics to Client CSI endpoints (#15905) 2023-01-26 16:40:58 -05:00
client_csi_endpoint_test.go metrics: Add rate metrics to Client CSI endpoints (#15905) 2023-01-26 16:40:58 -05:00
client_fs_endpoint.go metrics: measure rate of RPC requests that serve API (#15876) 2023-01-25 16:37:24 -05:00
client_fs_endpoint_test.go
client_meta_endpoint.go client/metadata: fix crasher caused by AllowStale = false (#16549) 2023-03-20 16:32:32 -07:00
client_meta_endpoint_test.go client/metadata: fix crasher caused by AllowStale = false (#16549) 2023-03-20 16:32:32 -07:00
client_rpc.go Dynamic Node Metadata (#15844) 2023-02-07 14:42:25 -08:00
client_rpc_test.go
client_stats_endpoint.go Dynamic Node Metadata (#15844) 2023-02-07 14:42:25 -08:00
client_stats_endpoint_test.go
config.go ent: move all license info into LicenseConfig{} (#16738) 2023-03-30 16:15:05 -05:00
consul.go consul: Removed unused ConsulUsage.Kinds. (#11303) 2022-09-22 10:07:14 -05:00
consul_oss_test.go consul: Removed unused ConsulUsage.Kinds. (#11303) 2022-09-22 10:07:14 -05:00
consul_policy.go consul: check for acceptable service identity on consul tokens (#15928) 2023-01-27 18:15:51 -06:00
consul_policy_oss_test.go consul: check for acceptable service identity on consul tokens (#15928) 2023-01-27 18:15:51 -06:00
consul_policy_test.go build: run gofmt on all go source files 2022-08-16 11:14:11 -05:00
consul_test.go
core_sched.go CSI: fix potential state store corruptions (#16256) 2023-02-27 08:47:08 -05:00
core_sched_test.go CSI: fix potential state store corruptions (#16256) 2023-02-27 08:47:08 -05:00
csi_endpoint.go handle FSM.Apply errors in raftApply (#16287) 2023-03-02 13:51:09 -05:00
csi_endpoint_test.go remove most static RPC handlers (#15451) 2022-12-02 10:12:05 -05:00
deployment_endpoint.go metrics: Add RPC rate metrics to endpoints that validate TLS names (#15900) 2023-01-26 15:04:25 -05:00
deployment_endpoint_test.go cleanup: replace TypeToPtr helper methods with pointer.Of (#14151) 2022-08-17 18:26:34 +02:00
deployment_watcher_shims.go
drainer_int_test.go cleanup: replace TypeToPtr helper methods with pointer.Of (#14151) 2022-08-17 18:26:34 +02:00
drainer_shims.go handle FSM.Apply errors in raftApply (#16287) 2023-03-02 13:51:09 -05:00
encrypter.go keyring: update handle to state inside replication loop (#15227) 2022-11-17 08:40:12 -05:00
encrypter_test.go keyring: update handle to state inside replication loop (#15227) 2022-11-17 08:40:12 -05:00
endpoints_oss.go provide RPCContext to all RPC handlers (#15430) 2022-12-01 10:05:15 -05:00
eval_broker.go eval broker: use write lock when reaping cancelable evals (#16112) 2023-02-10 10:40:41 -05:00
eval_broker_test.go eval broker: use write lock when reaping cancelable evals (#16112) 2023-02-10 10:40:41 -05:00
eval_endpoint.go metrics: Add RPC rate metrics to endpoints that validate TLS names (#15900) 2023-01-26 15:04:25 -05:00
eval_endpoint_test.go eval delete: move batching of deletes into RPC handler and state (#15117) 2022-11-14 14:08:13 -05:00
event_endpoint.go Update ioutil library references to os and io respectively for e2e helper nomad (#16332) 2023-03-08 09:39:03 -06:00
event_endpoint_test.go event stream: ensure token expiry is correctly checked for subs. 2022-10-27 13:08:05 -04:00
fsm.go renamed stanza to block for consistency with other projects (#15941) 2023-01-30 15:48:43 +01:00
fsm_oss.go
fsm_registry_oss.go
fsm_test.go acl: RPC endpoints for JWT auth (#15918) 2023-03-30 09:39:56 +02:00
heartbeat.go remove most static RPC handlers (#15451) 2022-12-02 10:12:05 -05:00
heartbeat_test.go cleanup: replace TypeToPtr helper methods with pointer.Of (#14151) 2022-08-17 18:26:34 +02:00
job_endpoint.go acl: update job eval requirement to submit-job (#16463) 2023-03-13 17:13:54 -04:00
job_endpoint_hook_connect.go renamed stanza to block for consistency with other projects (#15941) 2023-01-30 15:48:43 +01:00
job_endpoint_hook_connect_test.go provide RPCContext to all RPC handlers (#15430) 2022-12-01 10:05:15 -05:00
job_endpoint_hook_expose_check.go build: run gofmt on all go source files 2022-08-16 11:14:11 -05:00
job_endpoint_hook_expose_check_test.go build: run gofmt on all go source files 2022-08-16 11:14:11 -05:00
job_endpoint_hook_vault.go cleanup more helper updates (#14638) 2022-09-21 14:53:25 -05:00
job_endpoint_hook_vault_oss.go
job_endpoint_hooks.go Allow configurable range of Job priorities (#16084) 2023-02-17 09:23:13 -05:00
job_endpoint_hooks_test.go Allow configurable range of Job priorities (#16084) 2023-02-17 09:23:13 -05:00
job_endpoint_oss.go scheduler: create placements for non-register MRD (#15325) 2022-11-25 12:45:34 -05:00
job_endpoint_oss_test.go cleanup: replace TypeToPtr helper methods with pointer.Of (#14151) 2022-08-17 18:26:34 +02:00
job_endpoint_test.go acl: update job eval requirement to submit-job (#16463) 2023-03-13 17:13:54 -04:00
job_endpoint_validators.go
job_endpoint_validators_test.go allocrunner: refactor task coordinator (#14009) 2022-08-22 18:38:49 -04:00
keyring_endpoint.go handle FSM.Apply errors in raftApply (#16287) 2023-03-02 13:51:09 -05:00
keyring_endpoint_test.go keyring: use nanos for CreateTime in key metadata (#13849) 2022-07-20 14:46:57 -04:00
leader.go acl: set minACLJWTAuthMethodVersion to 1.5.3 and adjust code comment 2023-03-30 15:30:42 +02:00
leader_oss.go
leader_test.go acl: RPC endpoints for JWT auth (#15918) 2023-03-30 09:39:56 +02:00
license_config.go ent: move all license info into LicenseConfig{} (#16738) 2023-03-30 16:15:05 -05:00
license_config_oss.go ent: move all license info into LicenseConfig{} (#16738) 2023-03-30 16:15:05 -05:00
merge.go
namespace_endpoint.go handle FSM.Apply errors in raftApply (#16287) 2023-03-02 13:51:09 -05:00
namespace_endpoint_test.go acl: Fix panic when bogus token is passed (#15863) 2023-01-25 10:03:17 -05:00
node_endpoint.go scheduler: correctly detect inplace update with wildcard datacenters (#16362) 2023-03-07 10:05:59 -05:00
node_endpoint_test.go core: enforce strict steps for clients reconnect (#15808) 2023-01-25 15:53:59 -05:00
operator_endpoint.go handle FSM.Apply errors in raftApply (#16287) 2023-03-02 13:51:09 -05:00
operator_endpoint_test.go Update ioutil library references to os and io respectively for e2e helper nomad (#16332) 2023-03-08 09:39:03 -06:00
periodic.go style: rename ForceRun to ForceEval, for clarity (#16617) 2023-03-27 15:38:48 +02:00
periodic_endpoint.go style: rename ForceRun to ForceEval, for clarity (#16617) 2023-03-27 15:38:48 +02:00
periodic_endpoint_test.go
periodic_test.go style: rename ForceRun to ForceEval, for clarity (#16617) 2023-03-27 15:38:48 +02:00
plan_apply.go keyring: safely handle missing keys and restore GC (#15092) 2022-11-01 15:00:50 -04:00
plan_apply_node_tracker.go deps: upgrade to hashicorp/golang-lru/v2 (#16085) 2023-02-08 15:20:33 -06:00
plan_apply_node_tracker_test.go deps: upgrade to hashicorp/golang-lru/v2 (#16085) 2023-02-08 15:20:33 -06:00
plan_apply_oss.go
plan_apply_pool.go
plan_apply_pool_test.go
plan_apply_test.go fix panic from keyring raft entries being written during upgrade (#14821) 2022-10-06 12:47:02 -04:00
plan_endpoint.go metrics: Add RPC rate metrics to endpoints that validate TLS names (#15900) 2023-01-26 15:04:25 -05:00
plan_endpoint_test.go
plan_normalization_test.go
plan_queue.go Add missing timer reset (#15134) 2022-11-03 18:57:57 -04:00
plan_queue_test.go
raft_rpc.go
regions_endpoint.go metrics: Add metrics to unauthenticated endpoints (#15899) 2023-01-26 15:05:51 -05:00
regions_endpoint_test.go
rpc.go handle FSM.Apply errors in raftApply (#16287) 2023-03-02 13:51:09 -05:00
rpc_rate_metrics.go add metric for count of RPC requests (#15515) 2023-01-24 11:54:20 -05:00
rpc_test.go tls enforcement flaky tests (#16543) 2023-03-17 14:11:13 -05:00
scaling_endpoint.go metrics: measure rate of RPC requests that serve API (#15876) 2023-01-25 16:37:24 -05:00
scaling_endpoint_test.go
search_endpoint.go metrics: measure rate of RPC requests that serve API (#15876) 2023-01-25 16:37:24 -05:00
search_endpoint_oss.go rename SecureVariables to Variables throughout 2022-08-26 16:06:24 -04:00
search_endpoint_test.go
serf.go migrate autopilot implementation to raft-autopilot (#14441) 2022-09-01 14:27:10 -04:00
serf_test.go ci: fix TestNomad_BootstrapExpect_NonVoter test (#14407) 2022-08-30 16:32:54 -04:00
server.go ent: move all license info into LicenseConfig{} (#16738) 2023-03-30 16:15:05 -05:00
server_setup_oss.go ent: move all license info into LicenseConfig{} (#16738) 2023-03-30 16:15:05 -05:00
server_test.go implement pre-forwarding auth on select RPCs (#15513) 2023-01-24 10:52:07 -05:00
service_registration_endpoint.go service: fix regression in task access to list/read endpoint (#16316) 2023-03-03 11:41:19 -05:00
service_registration_endpoint_test.go service: fix regression in task access to list/read endpoint (#16316) 2023-03-03 11:41:19 -05:00
stats_fetcher.go metrics: Add metrics to unauthenticated endpoints (#15899) 2023-01-26 15:05:51 -05:00
stats_fetcher_test.go test: fix concurrent map access in TestStatsFetcher (#14496) 2022-09-08 10:41:15 -04:00
status_endpoint.go metrics: Add metrics to unauthenticated endpoints (#15899) 2023-01-26 15:05:51 -05:00
status_endpoint_test.go implement pre-forwarding auth on select RPCs (#15513) 2023-01-24 10:52:07 -05:00
system_endpoint.go metrics: measure rate of RPC requests that serve API (#15876) 2023-01-25 16:37:24 -05:00
system_endpoint_test.go
testing.go ent: move all license info into LicenseConfig{} (#16738) 2023-03-30 16:15:05 -05:00
testing_oss.go
timetable.go
timetable_test.go
util.go make version checks specific to region (1.4.x) (#14912) 2022-10-17 16:23:51 -04:00
util_test.go make version checks specific to region (1.4.x) (#14912) 2022-10-17 16:23:51 -04:00
variables_endpoint.go acl: prevent privilege escalation via workload identity 2023-03-13 11:13:27 -04:00
variables_endpoint_test.go acl: prevent privilege escalation via workload identity 2023-03-13 11:13:27 -04:00
vault.go vault: configure user agent on Nomad vault clients (#15745) 2023-01-10 10:39:45 -06:00
vault_test.go cleanup: replace TypeToPtr helper methods with pointer.Of (#14151) 2022-08-17 18:26:34 +02:00
vault_testing.go vault: detect namespace change in config reload (#14298) 2022-08-24 17:03:29 -04:00
worker.go core: backoff considerably when worker is behind raft (#15523) 2023-01-24 08:56:35 -05:00
worker_string_schedulerworkerstatus.go
worker_string_workerstatus.go
worker_test.go core: backoff considerably when worker is behind raft (#15523) 2023-01-24 08:56:35 -05:00