luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

ssh: Fix template regex test for defaultExtensions to allow additional text (#16018) 

* ssh: Fix template regex test for defaultExtensions

 - The regex to identify if our defaultExtensions contains a template was
   a little too greedy, requiring the entire field to be just the regex. Allow
   additional text within the value field to be added

* Add cl
This commit is contained in:
Steven Clark 2022-06-17 11:06:17 -04:00 committed by GitHub
parent 96371ed0a5
commit 8f118fcefb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
builtin/logical/ssh/backend_test.go
View File

@ -1480,6 +1480,8 @@ func TestBackend_DefExtTemplatingEnabled(t *testing.T) {
"default_extensions_template": true,
"default_extensions": map[string]interface{}{
"login@foobar.com": "{{identity.entity.aliases." + userpassAccessor + ".name}}",
"login@foobar2.com": "{{identity.entity.aliases." + userpassAccessor + ".name}}, " +
"{{identity.entity.aliases." + userpassAccessor + ".name}}_foobar",
},
})
if err != nil {
@ -1505,7 +1507,8 @@ func TestBackend_DefExtTemplatingEnabled(t *testing.T) {
}
defaultExtensionPermissions := map[string]string{
"login@foobar.com": testUserName,
"login@foobar.com": testUserName,
"login@foobar2.com": fmt.Sprintf("%s, %s_foobar", testUserName, testUserName),
}
err = validateSSHCertificate(parsedKey.(*ssh.Certificate), sshKeyID, ssh.UserCert, []string{"tuber"}, map[string]string{}, defaultExtensionPermissions, 16*time.Hour)

6
builtin/logical/ssh/path_issue_sign.go
View File

@ -24,6 +24,8 @@ import (
"golang.org/x/crypto/ssh"
)
var containsTemplateRegex = regexp.MustCompile(`{{.+?}}`)
var ecCurveBitsToAlgoName = map[int]string{
256: ssh.KeyAlgoECDSA256,
384: ssh.KeyAlgoECDSA384,
@ -149,7 +151,7 @@ func (b *backend) calculateValidPrincipals(data *framework.FieldData, req *logic
for _, principal := range strutil.RemoveDuplicates(strutil.ParseStringSlice(principalsAllowedByRole, ","), false) {
if role.AllowedUsersTemplate {
// Look for templating markers {{ .* }}
matched, _ := regexp.MatchString(`{{.+?}}`, principal)
matched := containsTemplateRegex.MatchString(principal)
if matched {
if req.EntityID != "" {
// Retrieve principal based on template + entityID from request.
@ -313,7 +315,7 @@ func (b *backend) calculateExtensions(data *framework.FieldData, req *logical.Re
if role.DefaultExtensionsTemplate {
for extensionKey, extensionValue := range role.DefaultExtensions {
// Look for templating markers {{ .* }}
matched, _ := regexp.MatchString(`^{{.+?}}$`, extensionValue)
matched := containsTemplateRegex.MatchString(extensionValue)
if matched {
if req.EntityID != "" {
// Retrieve extension value based on template + entityID from request.

3
changelog/16018.txt Normal file
View File

@ -0,0 +1,3 @@
```release-note:improvement
secrets/ssh: Allow additional text along with a template definition in defaultExtension value fields.
```