Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

When tainting a route during setup, pre-calculate the namespace specific path #15067

Merged
merged 9 commits into from Apr 26, 2022
Merged

When tainting a route during setup, pre-calculate the namespace specific path #15067

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
b7b4937
When tainting a route during setup, pre-calculate the namespace speci…
raskchanky Apr 15, 2022
1323b52
add additional trace logging
raskchanky Apr 18, 2022
83dce64
Merge branch 'main' into namespace-taint
raskchanky Apr 25, 2022
2a39144
fixing test
raskchanky Apr 25, 2022
825ce15
adding default logger
raskchanky Apr 25, 2022
e536eb8
adding changelog
raskchanky Apr 25, 2022
ed52180
get rid of IsTrace()
raskchanky Apr 25, 2022
d33c3fc
add path parameter
raskchanky Apr 25, 2022
7b9a7e4
remove trace logs, augment error response
raskchanky Apr 25, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 4 additions & 1 deletion vault/auth.go
View file
Open in desktop
Expand Up @@ -7,7 +7,7 @@ import (
"strings"

"github.com/hashicorp/go-secure-stdlib/strutil"
uuid "github.com/hashicorp/go-uuid"
"github.com/hashicorp/go-uuid"
"github.com/hashicorp/vault/builtin/plugin"
"github.com/hashicorp/vault/helper/namespace"
"github.com/hashicorp/vault/sdk/helper/consts"
Expand Down Expand Up @@ -835,6 +835,9 @@ func (c *Core) setupCredentials(ctx context.Context) error {

// Ensure the path is tainted if set in the mount table
if entry.Tainted {
// Calculate any namespace prefixes here, because when Taint() is called, there won't be
// a namespace to pull from the context. This is similar to what we do above in c.router.Mount().
path = entry.Namespace().Path + path
c.router.Taint(ctx, path)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When this is called as part of postUnseal(), as best as I can tell, we're passing an empty context all the way through these methods, originating here: https://github.com/hashicorp/vault/blob/main/vault/core.go#L1693 That means the namespace specific path that we need to add to the path won't exist in the context, as Taint() expects it to. Instead, we use the namespace specific path from the mount entry.

}

Expand Down