-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update cert-based auth documentation to use possible new options #1
Open
bfirsh
wants to merge
6
commits into
dmcgowan:tls_libtrust_auth
Choose a base branch
from
bfirsh:tls_libtrust_auth-documentation
base: tls_libtrust_auth
Could not load branches
Branch not found: {{ refName }}
Could not load tags
Nothing to show
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Update cert-based auth documentation to use possible new options #1
bfirsh
wants to merge
6
commits into
dmcgowan:tls_libtrust_auth
from
bfirsh:tls_libtrust_auth-documentation
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
Signed-off-by: Ben Firshman <ben@firshman.co.uk>
Signed-off-by: Ben Firshman <ben@firshman.co.uk>
Signed-off-by: Ben Firshman <ben@firshman.co.uk>
bfirsh
force-pushed
the
tls_libtrust_auth-documentation
branch
from
November 3, 2014 12:11
5158e3a
to
49286c9
Compare
dmcgowan
force-pushed
the
tls_libtrust_auth
branch
from
November 11, 2014 17:25
6ee1c74
to
f169462
Compare
dmcgowan
force-pushed
the
tls_libtrust_auth
branch
6 times, most recently
from
November 24, 2014 21:28
6123f6e
to
72fcdd0
Compare
dmcgowan
force-pushed
the
tls_libtrust_auth
branch
2 times, most recently
from
December 15, 2014 17:35
e644ac1
to
5869043
Compare
bfirsh
force-pushed
the
tls_libtrust_auth
branch
3 times, most recently
from
December 16, 2014 17:35
d5210f6
to
33b04bf
Compare
dmcgowan
force-pushed
the
tls_libtrust_auth
branch
from
December 19, 2014 17:45
8170be5
to
46d885f
Compare
dmcgowan
force-pushed
the
tls_libtrust_auth
branch
2 times, most recently
from
January 7, 2015 19:05
e83855a
to
038916d
Compare
dmcgowan
pushed a commit
that referenced
this pull request
Aug 1, 2015
TL;DR: check for IsExist(err) after a failed MkdirAll() is both redundant and wrong -- so two reasons to remove it. Quoting MkdirAll documentation: > MkdirAll creates a directory named path, along with any necessary > parents, and returns nil, or else returns an error. If path > is already a directory, MkdirAll does nothing and returns nil. This means two things: 1. If a directory to be created already exists, no error is returned. 2. If the error returned is IsExist (EEXIST), it means there exists a non-directory with the same name as MkdirAll need to use for directory. Example: we want to MkdirAll("a/b"), but file "a" (or "a/b") already exists, so MkdirAll fails. The above is a theory, based on quoted documentation and my UNIX knowledge. 3. In practice, though, current MkdirAll implementation [1] returns ENOTDIR in most of cases described in #2, with the exception when there is a race between MkdirAll and someone else creating the last component of MkdirAll argument as a file. In this very case MkdirAll() will indeed return EEXIST. Because of #1, IsExist check after MkdirAll is not needed. Because of #2 and #3, ignoring IsExist error is just plain wrong, as directory we require is not created. It's cleaner to report the error now. Note this error is all over the tree, I guess due to copy-paste, or trying to follow the same usage pattern as for Mkdir(), or some not quite correct examples on the Internet. [v2: a separate aufs commit is merged into this one] [1] https://github.com/golang/go/blob/f9ed2f75/src/os/path.go Signed-off-by: Kir Kolyshkin <kir@openvz.org>
dmcgowan
pushed a commit
that referenced
this pull request
Dec 21, 2015
Really fixing 2 things: 1. Panic when any error is detected while walking the btrfs graph dir on removal due to no error check. 2. Nested subvolumes weren't actually being removed due to passing in the wrong path On point 2, for a path detected as a nested subvolume, we were calling `subvolDelete("/path/to/subvol", "subvol")`, where the last part of the path was duplicated due to a logic error, and as such actually causing point #1 since `subvolDelete` joins the two arguemtns, and `/path/to/subvol/subvol` (the joined version) doesn't exist. Also adds a test for nested subvol delete. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
dmcgowan
pushed a commit
that referenced
this pull request
Mar 6, 2018
This subtle bug keeps lurking in because error checking for `Mkdir()` and `MkdirAll()` is slightly different wrt to `EEXIST`/`IsExist`: - for `Mkdir()`, `IsExist` error should (usually) be ignored (unless you want to make sure directory was not there before) as it means "the destination directory was already there" - for `MkdirAll()`, `IsExist` error should NEVER be ignored. Mostly, this commit just removes ignoring the IsExist error, as it should not be ignored. Also, there are a couple of cases then IsExist is handled as "directory already exist" which is wrong. As a result, some code that never worked as intended is now removed. NOTE that `idtools.MkdirAndChown()` behaves like `os.MkdirAll()` rather than `os.Mkdir()` -- so its description is amended accordingly, and its usage is handled as such (i.e. IsExist error is not ignored). For more details, a quote from my runc commit 6f82d4b (July 2015): TL;DR: check for IsExist(err) after a failed MkdirAll() is both redundant and wrong -- so two reasons to remove it. Quoting MkdirAll documentation: > MkdirAll creates a directory named path, along with any necessary > parents, and returns nil, or else returns an error. If path > is already a directory, MkdirAll does nothing and returns nil. This means two things: 1. If a directory to be created already exists, no error is returned. 2. If the error returned is IsExist (EEXIST), it means there exists a non-directory with the same name as MkdirAll need to use for directory. Example: we want to MkdirAll("a/b"), but file "a" (or "a/b") already exists, so MkdirAll fails. The above is a theory, based on quoted documentation and my UNIX knowledge. 3. In practice, though, current MkdirAll implementation [1] returns ENOTDIR in most of cases described in #2, with the exception when there is a race between MkdirAll and someone else creating the last component of MkdirAll argument as a file. In this very case MkdirAll() will indeed return EEXIST. Because of #1, IsExist check after MkdirAll is not needed. Because of #2 and #3, ignoring IsExist error is just plain wrong, as directory we require is not created. It's cleaner to report the error now. Note this error is all over the tree, I guess due to copy-paste, or trying to follow the same usage pattern as for Mkdir(), or some not quite correct examples on the Internet. [1] https://github.com/golang/go/blob/f9ed2f75/src/os/path.go Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
dmcgowan
pushed a commit
that referenced
this pull request
Jul 18, 2018
In particular, these two: > daemon/daemon_unix.go:1129: Wrapf format %v reads arg #1, but call has 0 args > daemon/kill.go:111: Warn call has possible formatting directive %s and a few more. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
dmcgowan
pushed a commit
that referenced
this pull request
Jul 18, 2018
Fix the following go-1.11beta1 build error: > daemon/graphdriver/aufs/aufs.go:376: Wrapf format %s reads arg #1, but call has 0 args While at it, change '%s' to %q. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
dmcgowan
pushed a commit
that referenced
this pull request
Apr 23, 2024
…f v1.5.4 full diffs: - protocolbuffers/protobuf-go@v1.31.0...v1.33.0 - golang/protobuf@v1.5.3...v1.5.4 From the Go security announcement list; > Version v1.33.0 of the google.golang.org/protobuf module fixes a bug in > the google.golang.org/protobuf/encoding/protojson package which could cause > the Unmarshal function to enter an infinite loop when handling some invalid > inputs. > > This condition could only occur when unmarshaling into a message which contains > a google.protobuf.Any value, or when the UnmarshalOptions.UnmarshalUnknown > option is set. Unmarshal now correctly returns an error when handling these > inputs. > > This is CVE-2024-24786. In a follow-up post; > A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown > option is set (as well as when unmarshaling into any message which contains a > google.protobuf.Any). There is no UnmarshalUnknown option. > > In addition, version 1.33.0 of google.golang.org/protobuf inadvertently > introduced an incompatibility with the older github.com/golang/protobuf > module. (golang/protobuf#1596) Users of the older > module should update to github.com/golang/protobuf@v1.5.4. govulncheck results in our code: govulncheck ./... Scanning your code and 1221 packages across 204 dependent modules for known vulnerabilities... === Symbol Results === Vulnerability #1: GO-2024-2611 Infinite loop in JSON unmarshaling in google.golang.org/protobuf More info: https://pkg.go.dev/vuln/GO-2024-2611 Module: google.golang.org/protobuf Found in: google.golang.org/protobuf@v1.31.0 Fixed in: google.golang.org/protobuf@v1.33.0 Example traces found: #1: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Peek #2: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Read #3: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls protojson.Unmarshal Your code is affected by 1 vulnerability from 1 module. This scan found no other vulnerabilities in packages you import or modules you require. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I think this provides all existing functionality. To reproduce the list at the bottom of the previous docs:
Daemon modes
--auth=cert
,--auth-ca
,--auth-cert
,--auth-key
set: Authenticate clients--auth=cert
,--auth-cert
,--auth-key
: Do not authenticate clientsClient modes
--auth=cert
: Authenticate server based on public/default CA pool--auth=cert
,--auth-ca
: Authenticate server based on given CA--auth=cert
,--auth-cert
,--auth-key
: Authenticate with client certificate, do not authenticate server based on given CA--auth=cert
,--auth-ca
,--auth-cert
,--auth-key
: Authenticate with client certificate and authenticate server based on given CA