luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

backport of commit c3741b0177056d9e999ff03a6542a4811508fa9a (#21485) 

Co-authored-by: Violet Hynes <violet.hynes@hashicorp.com>
This commit is contained in:
hc-github-team-secure-vault-core 2023-06-27 15:54:28 -04:00 committed by GitHub
parent 0e8ded4936
commit aa7b7ad951
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changelog/24170.txt Normal file
View File

@ -0,0 +1,3 @@
```release-note:bug
core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this.
```

1
vault/auth.go
View File

@ -879,6 +879,7 @@ func (c *Core) setupCredentials(ctx context.Context) error {
// Calculate any namespace prefixes here, because when Taint() is called, there won't be
// a namespace to pull from the context. This is similar to what we do above in c.router.Mount().
path = entry.Namespace().Path + path
c.logger.Debug("tainting a mount due to it being marked as tainted in mount table", "entry.path", entry.Path, "entry.namespace.path", entry.Namespace().Path, "full_path", path)
c.router.Taint(ctx, path)
}

6
vault/mount.go
View File

@ -1593,7 +1593,11 @@ func (c *Core) setupMounts(ctx context.Context) error {
// Ensure the path is tainted if set in the mount table
if entry.Tainted {
c.router.Taint(ctx, entry.Path)
// Calculate any namespace prefixes here, because when Taint() is called, there won't be
// a namespace to pull from the context. This is similar to what we do above in c.router.Mount().
path := entry.Namespace().Path + entry.Path
c.logger.Debug("tainting a mount due to it being marked as tainted in mount table", "entry.path", entry.Path, "entry.namespace.path", entry.Namespace().Path, "full_path", path)
c.router.Taint(ctx, path)
}
// Ensure the cache is populated, don't need the result