Skip to content

Update cert-based auth documentation to use possible new options#1

Open
bfirsh wants to merge 6 commits intodmcgowan:tls_libtrust_authfrom
bfirsh:tls_libtrust_auth-documentation
Open

Update cert-based auth documentation to use possible new options#1
bfirsh wants to merge 6 commits intodmcgowan:tls_libtrust_authfrom
bfirsh:tls_libtrust_auth-documentation

Conversation

@bfirsh
Copy link
Copy Markdown

@bfirsh bfirsh commented Nov 3, 2014

I think this provides all existing functionality. To reproduce the list at the bottom of the previous docs:

Daemon modes

  • --auth=cert, --auth-ca, --auth-cert, --auth-key set: Authenticate clients
  • --auth=cert, --auth-cert, --auth-key: Do not authenticate clients

Client modes

  • --auth=cert: Authenticate server based on public/default CA pool
  • --auth=cert, --auth-ca: Authenticate server based on given CA
  • --auth=cert, --auth-cert, --auth-key: Authenticate with client certificate, do not authenticate server based on given CA
  • --auth=cert, --auth-ca, --auth-cert, --auth-key: Authenticate with client certificate and authenticate server based on given CA

dmcgowan and others added 6 commits October 22, 2014 11:07
@dmcgowan
Add trust key creation on client
aed97dd 
Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
@dmcgowan
Add default TLS using engine keys
2bfeade 
Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
@dmcgowan
Update https documentation
dbd502c 
Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
@bfirsh
Rename host-based auth to identity-based auth
8e2d2f6 
Signed-off-by: Ben Firshman <ben@firshman.co.uk>
@bfirsh
Whitespace fixes
41ca405 
Signed-off-by: Ben Firshman <ben@firshman.co.uk>
@bfirsh
Update cert-based auth docs to use new options
49286c9 
Signed-off-by: Ben Firshman <ben@firshman.co.uk>
@bfirsh bfirsh force-pushed the tls_libtrust_auth-documentation branch from 5158e3a to 49286c9 Compare November 3, 2014 12:11
@bfirsh bfirsh mentioned this pull request Nov 3, 2014
Closed
@dmcgowan dmcgowan force-pushed the tls_libtrust_auth branch 6 times, most recently from 6123f6e to 72fcdd0 Compare November 24, 2014 21:28
@dmcgowan dmcgowan force-pushed the tls_libtrust_auth branch 2 times, most recently from e644ac1 to 5869043 Compare December 15, 2014 17:35
@bfirsh bfirsh force-pushed the tls_libtrust_auth branch 3 times, most recently from d5210f6 to 33b04bf Compare December 16, 2014 17:35
@dmcgowan dmcgowan force-pushed the tls_libtrust_auth branch 2 times, most recently from e83855a to 038916d Compare January 7, 2015 19:05
dmcgowan pushed a commit that referenced this pull request Aug 1, 2015
@kolyshkin
Simplify and fix os.MkdirAll() usage
a83a769 
TL;DR: check for IsExist(err) after a failed MkdirAll() is both
redundant and wrong -- so two reasons to remove it.

Quoting MkdirAll documentation:

> MkdirAll creates a directory named path, along with any necessary
> parents, and returns nil, or else returns an error. If path
> is already a directory, MkdirAll does nothing and returns nil.

This means two things:

1. If a directory to be created already exists, no error is returned.

2. If the error returned is IsExist (EEXIST), it means there exists
a non-directory with the same name as MkdirAll need to use for
directory. Example: we want to MkdirAll("a/b"), but file "a"
(or "a/b") already exists, so MkdirAll fails.

The above is a theory, based on quoted documentation and my UNIX
knowledge.

3. In practice, though, current MkdirAll implementation [1] returns
ENOTDIR in most of cases described in #2, with the exception when
there is a race between MkdirAll and someone else creating the
last component of MkdirAll argument as a file. In this very case
MkdirAll() will indeed return EEXIST.

Because of #1, IsExist check after MkdirAll is not needed.

Because of #2 and #3, ignoring IsExist error is just plain wrong,
as directory we require is not created. It's cleaner to report
the error now.

Note this error is all over the tree, I guess due to copy-paste,
or trying to follow the same usage pattern as for Mkdir(),
or some not quite correct examples on the Internet.

[v2: a separate aufs commit is merged into this one]

[1] https://github.com/golang/go/blob/f9ed2f75/src/os/path.go

Signed-off-by: Kir Kolyshkin <kir@openvz.org>
dmcgowan pushed a commit that referenced this pull request Dec 21, 2015
@cpuguy83
Fix btrfs recursive btrfs subvol delete
f9befce 
Really fixing 2 things:

1. Panic when any error is detected while walking the btrfs graph dir on
removal due to no error check.
2. Nested subvolumes weren't actually being removed due to passing in
the wrong path

On point 2, for a path detected as a nested subvolume, we were calling
`subvolDelete("/path/to/subvol", "subvol")`, where the last part of the
path was duplicated due to a logic error, and as such actually causing
point #1 since `subvolDelete` joins the two arguemtns, and
`/path/to/subvol/subvol` (the joined version) doesn't exist.

Also adds a test for nested subvol delete.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
dmcgowan pushed a commit that referenced this pull request Mar 6, 2018
@kolyshkin
Simplify/fix MkdirAll usage
516010e 
This subtle bug keeps lurking in because error checking for `Mkdir()`
and `MkdirAll()` is slightly different wrt to `EEXIST`/`IsExist`:

 - for `Mkdir()`, `IsExist` error should (usually) be ignored
   (unless you want to make sure directory was not there before)
   as it means "the destination directory was already there"

 - for `MkdirAll()`, `IsExist` error should NEVER be ignored.

Mostly, this commit just removes ignoring the IsExist error, as it
should not be ignored.

Also, there are a couple of cases then IsExist is handled as
"directory already exist" which is wrong. As a result, some code
that never worked as intended is now removed.

NOTE that `idtools.MkdirAndChown()` behaves like `os.MkdirAll()`
rather than `os.Mkdir()` -- so its description is amended accordingly,
and its usage is handled as such (i.e. IsExist error is not ignored).

For more details, a quote from my runc commit 6f82d4b (July 2015):

    TL;DR: check for IsExist(err) after a failed MkdirAll() is both
    redundant and wrong -- so two reasons to remove it.

    Quoting MkdirAll documentation:

    > MkdirAll creates a directory named path, along with any necessary
    > parents, and returns nil, or else returns an error. If path
    > is already a directory, MkdirAll does nothing and returns nil.

    This means two things:

    1. If a directory to be created already exists, no error is
    returned.

    2. If the error returned is IsExist (EEXIST), it means there exists
    a non-directory with the same name as MkdirAll need to use for
    directory. Example: we want to MkdirAll("a/b"), but file "a"
    (or "a/b") already exists, so MkdirAll fails.

    The above is a theory, based on quoted documentation and my UNIX
    knowledge.

    3. In practice, though, current MkdirAll implementation [1] returns
    ENOTDIR in most of cases described in #2, with the exception when
    there is a race between MkdirAll and someone else creating the
    last component of MkdirAll argument as a file. In this very case
    MkdirAll() will indeed return EEXIST.

    Because of #1, IsExist check after MkdirAll is not needed.

    Because of #2 and #3, ignoring IsExist error is just plain wrong,
    as directory we require is not created. It's cleaner to report
    the error now.

    Note this error is all over the tree, I guess due to copy-paste,
    or trying to follow the same usage pattern as for Mkdir(),
    or some not quite correct examples on the Internet.

    [1] https://github.com/golang/go/blob/f9ed2f75/src/os/path.go

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
dmcgowan pushed a commit that referenced this pull request Jul 18, 2018
@thaJeztah
daemon/*.go: fix some Wrap[f]/Warn[f] errors
3737194 
In particular, these two:
> daemon/daemon_unix.go:1129: Wrapf format %v reads arg #1, but call has 0 args
> daemon/kill.go:111: Warn call has possible formatting directive %s

and a few more.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
dmcgowan pushed a commit that referenced this pull request Jul 18, 2018
@kolyshkin @thaJeztah
aufs: fix Wrapf args
2e30e9e 
Fix the following go-1.11beta1 build error:

> daemon/graphdriver/aufs/aufs.go:376: Wrapf format %s reads arg #1, but call has 0 args

While at it, change '%s' to %q.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
dmcgowan pushed a commit that referenced this pull request Apr 23, 2024
@thaJeztah
vendor: google.golang.org/protobuf v1.33.0, github.com/golang/protobu…
1ca89d7 
…f v1.5.4

full diffs:

- protocolbuffers/protobuf-go@v1.31.0...v1.33.0
- golang/protobuf@v1.5.3...v1.5.4

From the Go security announcement list;

> Version v1.33.0 of the google.golang.org/protobuf module fixes a bug in
> the google.golang.org/protobuf/encoding/protojson package which could cause
> the Unmarshal function to enter an infinite loop when handling some invalid
> inputs.
>
> This condition could only occur when unmarshaling into a message which contains
> a google.protobuf.Any value, or when the UnmarshalOptions.UnmarshalUnknown
> option is set. Unmarshal now correctly returns an error when handling these
> inputs.
>
> This is CVE-2024-24786.

In a follow-up post;

> A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown
> option is set (as well as when unmarshaling into any message which contains a
> google.protobuf.Any). There is no UnmarshalUnknown option.
>
> In addition, version 1.33.0 of google.golang.org/protobuf inadvertently
> introduced an incompatibility with the older github.com/golang/protobuf
> module. (golang/protobuf#1596) Users of the older
> module should update to github.com/golang/protobuf@v1.5.4.

govulncheck results in our code:

    govulncheck ./...
    Scanning your code and 1221 packages across 204 dependent modules for known vulnerabilities...

    === Symbol Results ===

    Vulnerability #1: GO-2024-2611
        Infinite loop in JSON unmarshaling in google.golang.org/protobuf
      More info: https://pkg.go.dev/vuln/GO-2024-2611
      Module: google.golang.org/protobuf
        Found in: google.golang.org/protobuf@v1.31.0
        Fixed in: google.golang.org/protobuf@v1.33.0
        Example traces found:
          #1: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Peek
          #2: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Read
          #3: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls protojson.Unmarshal

    Your code is affected by 1 vulnerability from 1 module.
    This scan found no other vulnerabilities in packages you import or modules you
    require.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
dmcgowan pushed a commit that referenced this pull request Jun 10, 2024
@thaJeztah
Merge pull request moby#47867 from akerouanton/api-EnableIPv6-override
00f18ef 
api: Make EnableIPv6 optional (impl #1 - pointer-based)
thaJeztah added a commit that referenced this pull request Dec 23, 2024
@thaJeztah
vendor: golang.org/x/net v0.33.0
6bd5840 
contains a fix for CVE-2024-45338 / https://go.dev/issue/70906,
but it doesn't affect our codebase:

    govulncheck -show=verbose ./...
    Scanning your code and 1260 packages across 211 dependent modules for known vulnerabilities...
    ...
    Vulnerability #1: GO-2024-3333
        Non-linear parsing of case-insensitive content in golang.org/x/net/html
      More info: https://pkg.go.dev/vuln/GO-2024-3333
      Module: golang.org/x/net
        Found in: golang.org/x/net@v0.32.0
        Fixed in: golang.org/x/net@v0.33.0

    Your code is affected by 0 vulnerabilities.
    This scan also found 0 vulnerabilities in packages you import and 1
    vulnerability in modules you require, but your code doesn't appear to call these
    vulnerabilities.

full diff: golang/net@v0.32.0...v0.33.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bfirsh @dmcgowan