You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by be...@apache.org on 2019/12/05 15:32:52 UTC
[mesos] branch 1.8.x updated (4ce75b8 -> c7c716d)
This is an automated email from the ASF dual-hosted git repository.
bennoe pushed a change to branch 1.8.x
in repository https://gitbox.apache.org/repos/asf/mesos.git.
from 4ce75b8 Gracefully handled duplicated volumes from non-conforming CSI plugins.
new 32d6937 Cleaned up `HTTPTest.WWWAuthenticateHeader`.
new 21ec06e Fixed parsing of HTTP authentication headers.
new c7c716d Added MESOS-9968 to the 1.8.2 CHANGELOG.
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
3rdparty/libprocess/include/process/http.hpp | 2 +-
3rdparty/libprocess/src/http.cpp | 93 +++++++++++++++++++---
3rdparty/libprocess/src/tests/http_tests.cpp | 114 +++++++++++++++++----------
CHANGELOG | 1 +
4 files changed, 156 insertions(+), 54 deletions(-)
[mesos] 01/03: Cleaned up `HTTPTest.WWWAuthenticateHeader`.
Posted by be...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
bennoe pushed a commit to branch 1.8.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit 32d6937bee6c2c43d769daa7b95b33856b9b8364
Author: Benjamin Bannier <bb...@apache.org>
AuthorDate: Mon Sep 23 10:23:27 2019 +0200
Cleaned up `HTTPTest.WWWAuthenticateHeader`.
This patch removes a number of error-prone temporaries previously reused
in the test.
Review: https://reviews.apache.org/r/71533
---
3rdparty/libprocess/src/tests/http_tests.cpp | 87 ++++++++++++++--------------
1 file changed, 44 insertions(+), 43 deletions(-)
diff --git a/3rdparty/libprocess/src/tests/http_tests.cpp b/3rdparty/libprocess/src/tests/http_tests.cpp
index 97aaf3e..09cae46 100644
--- a/3rdparty/libprocess/src/tests/http_tests.cpp
+++ b/3rdparty/libprocess/src/tests/http_tests.cpp
@@ -1600,11 +1600,9 @@ TEST_P(HTTPTest, CaseInsensitiveHeaders)
TEST_P(HTTPTest, WWWAuthenticateHeader)
{
- http::Headers headers;
- headers["Www-Authenticate"] = "Basic realm=\"basic-realm\"";
-
Result<http::header::WWWAuthenticate> header =
- headers.get<http::header::WWWAuthenticate>();
+ http::Headers({{"Www-Authenticate", "Basic realm=\"basic-realm\""}})
+ .get<http::header::WWWAuthenticate>();
ASSERT_SOME(header);
@@ -1612,17 +1610,14 @@ TEST_P(HTTPTest, WWWAuthenticateHeader)
EXPECT_EQ(1u, header->authParam().size());
EXPECT_EQ("basic-realm", header->authParam()["realm"]);
- headers.clear();
- header = headers.get<http::header::WWWAuthenticate>();
-
- EXPECT_NONE(header);
+ EXPECT_NONE(http::Headers().get<http::header::WWWAuthenticate>());
- headers["Www-Authenticate"] =
- "Bearer realm=\"https://auth.docker.io/token\","
- "service=\"registry.docker.io\","
- "scope=\"repository:gilbertsong/inky:pull\"";
-
- header = headers.get<http::header::WWWAuthenticate>();
+ header = http::Headers(
+ {{"Www-Authenticate",
+ "Bearer realm=\"https://auth.docker.io/token\","
+ "service=\"registry.docker.io\","
+ "scope=\"repository:gilbertsong/inky:pull\""}})
+ .get<http::header::WWWAuthenticate>();
ASSERT_SOME(header);
@@ -1632,35 +1627,41 @@ TEST_P(HTTPTest, WWWAuthenticateHeader)
EXPECT_EQ("registry.docker.io", header->authParam()["service"]);
EXPECT_EQ("repository:gilbertsong/inky:pull", header->authParam()["scope"]);
- headers["Www-Authenticate"] = "";
- header = headers.get<http::header::WWWAuthenticate>();
-
- EXPECT_ERROR(header);
-
- headers["Www-Authenticate"] = " ";
- header = headers.get<http::header::WWWAuthenticate>();
-
- EXPECT_ERROR(header);
-
- headers["Www-Authenticate"] = "Digest";
- header = headers.get<http::header::WWWAuthenticate>();
-
- EXPECT_ERROR(header);
-
- headers["Www-Authenticate"] = "Digest =";
- header = headers.get<http::header::WWWAuthenticate>();
-
- EXPECT_ERROR(header);
-
- headers["Www-Authenticate"] = "Digest ,,";
- header = headers.get<http::header::WWWAuthenticate>();
-
- EXPECT_ERROR(header);
-
- headers["Www-Authenticate"] = "Digest uri=\"/dir/index.html\",qop=auth";
- header = headers.get<http::header::WWWAuthenticate>();
-
- EXPECT_ERROR(header);
+ EXPECT_ERROR(
+ http::Headers(
+ {{"Www-Authenticate",
+ ""}})
+ .get<http::header::WWWAuthenticate>());
+
+ EXPECT_ERROR(
+ http::Headers(
+ {{"Www-Authenticate",
+ " "}})
+ .get<http::header::WWWAuthenticate>());
+
+ EXPECT_ERROR(
+ http::Headers(
+ {{"Www-Authenticate",
+ "Digest"}})
+ .get<http::header::WWWAuthenticate>());
+
+ EXPECT_ERROR(
+ http::Headers(
+ {{"Www-Authenticate",
+ "Digest ="}})
+ .get<http::header::WWWAuthenticate>());
+
+ EXPECT_ERROR(
+ http::Headers(
+ {{"Www-Authenticate",
+ "Digest ,,"}})
+ .get<http::header::WWWAuthenticate>());
+
+ EXPECT_ERROR(
+ http::Headers(
+ {{"Www-Authenticate",
+ "Digest uri=\"/dir/index.html\",qop=auth"}})
+ .get<http::header::WWWAuthenticate>());
}
[mesos] 02/03: Fixed parsing of HTTP authentication headers.
Posted by be...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
bennoe pushed a commit to branch 1.8.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit 21ec06ed44c1fbd2272081b20bdcee630759f52d
Author: Benjamin Bannier <bb...@apache.org>
AuthorDate: Mon Sep 23 10:24:50 2019 +0200
Fixed parsing of HTTP authentication headers.
This patch adds support for quoted strings in `Www-Authenticate` headers
and allows to use spaces when delimiting authentication attributes of
the form `WWW-Autenticate: a=b, c=d`, both of with are allowed by
RFC2617.
Review: https://reviews.apache.org/r/71534
---
3rdparty/libprocess/include/process/http.hpp | 2 +-
3rdparty/libprocess/src/http.cpp | 93 ++++++++++++++++++++++++----
3rdparty/libprocess/src/tests/http_tests.cpp | 31 +++++++++-
3 files changed, 113 insertions(+), 13 deletions(-)
diff --git a/3rdparty/libprocess/include/process/http.hpp b/3rdparty/libprocess/include/process/http.hpp
index 029605e..5133172 100644
--- a/3rdparty/libprocess/include/process/http.hpp
+++ b/3rdparty/libprocess/include/process/http.hpp
@@ -434,7 +434,7 @@ public:
: authScheme_(authScheme),
authParam_(authParam) {}
- static Try<WWWAuthenticate> create(const std::string& value);
+ static Try<WWWAuthenticate> create(const std::string& input);
std::string authScheme();
hashmap<std::string, std::string> authParam();
diff --git a/3rdparty/libprocess/src/http.cpp b/3rdparty/libprocess/src/http.cpp
index 3e73ee9..9c7c1f3 100644
--- a/3rdparty/libprocess/src/http.cpp
+++ b/3rdparty/libprocess/src/http.cpp
@@ -635,28 +635,99 @@ Future<Nothing> Pipe::Writer::readerClosed() const
namespace header {
-Try<WWWAuthenticate> WWWAuthenticate::create(const string& value)
+Try<WWWAuthenticate> WWWAuthenticate::create(const string& input)
{
// Set `maxTokens` as 2 since auth-param quoted string may
// contain space (e.g., "Basic realm="Registry Realm").
- vector<string> tokens = strings::tokenize(value, " ", 2);
+ vector<string> tokens = strings::tokenize(input, " ", 2);
if (tokens.size() != 2) {
- return Error("Unexpected WWW-Authenticate header format: '" + value + "'");
+ return Error("Unexpected WWW-Authenticate header format: '" + input + "'");
}
+ // Since the authentication parameters can contain quote values, we
+ // do not use `strings::split` here since the delimiter may occur in
+ // a quoted value which should not be split.
hashmap<string, string> authParam;
- foreach (const string& token, strings::split(tokens[1], ",")) {
- vector<string> split = strings::split(token, "=");
- if (split.size() != 2) {
- return Error(
- "Unexpected auth-param format: '" +
- token + "' in '" + tokens[1] + "'");
- }
+ Option<string> key, value;
+ bool inQuotes = false;
+ foreach (char c, tokens[1]) {
// Auth-param values can be a quoted-string or directive values.
// Please see section "3.2.2.4 Directive values and quoted-string":
// https://tools.ietf.org/html/rfc2617.
- authParam[split[0]] = strings::trim(split[1], strings::ANY, "\"");
+ //
+ // If we see a quote we know we must already be parsing `value`
+ // since `key` cannot be a quoted-string.
+ if (c != '"' && inQuotes) {
+ if (value.isNone()) {
+ return Error("Unexpected auth-param format: '" + tokens[1] + "'");
+ }
+
+ value->append({c});
+ continue;
+ }
+
+ // If we have not yet parsed `key` this character must belong to
+ // it if it is not a space, and cannot be a `,` delimiter.
+ if (key.isNone()) {
+ if (c == ',') {
+ return Error("Unexpected auth-param format: '" + tokens[1] + "'");
+ }
+
+ if (c == ' ') {
+ continue;
+ }
+
+ key = string({c});
+ continue;
+ }
+
+ // If the current character is `=` we must start parsing a new
+ // `value`. Since we have already handled `=` in quotes above we
+ // cannot already have started parsing `value`.
+ if (c == '=') {
+ if (value.isSome()) {
+ return Error("Unexpected auth-param format: '" + tokens[1] + "'");
+ }
+ value = "";
+ continue;
+ }
+
+ // If the current character is a quote, drop the
+ // character and toogle the quote state.
+ if (c == '"') {
+ inQuotes = !inQuotes;
+ continue;
+ }
+
+ // If the current character is a record delimiter and we are not
+ // in quotes, we should have parsed both a key and a value. Store
+ // them, drop the delimiter, and restart parsing.
+ if (c == ',' && !inQuotes) {
+ if (key.isNone() || value.isNone()) {
+ return Error("Unexpected auth-param format: '" + tokens[1] + "'");
+ }
+ authParam[*key] = *value;
+ key = None();
+ value = None();
+
+ continue;
+ }
+
+ // If we have not started parsing `value` we are still parsing `key`.
+ if (value.isNone()) {
+ key->append({c});
+ } else {
+ value->append({c});
+ }
+ }
+
+ // Record the last parsed `(key, value)` pair.
+ if (key.isSome()) {
+ if (value.isNone() || inQuotes) {
+ return Error("Unexpected auth-param format: '" + tokens[1] + "'");
+ }
+ authParam[*key] = *value;
}
// The realm directive (case-insensitive) is required for all
diff --git a/3rdparty/libprocess/src/tests/http_tests.cpp b/3rdparty/libprocess/src/tests/http_tests.cpp
index 09cae46..6ba421b 100644
--- a/3rdparty/libprocess/src/tests/http_tests.cpp
+++ b/3rdparty/libprocess/src/tests/http_tests.cpp
@@ -1614,7 +1614,7 @@ TEST_P(HTTPTest, WWWAuthenticateHeader)
header = http::Headers(
{{"Www-Authenticate",
- "Bearer realm=\"https://auth.docker.io/token\","
+ "Bearer realm=\"https://auth.docker.io/token\", "
"service=\"registry.docker.io\","
"scope=\"repository:gilbertsong/inky:pull\""}})
.get<http::header::WWWAuthenticate>();
@@ -1662,6 +1662,35 @@ TEST_P(HTTPTest, WWWAuthenticateHeader)
{{"Www-Authenticate",
"Digest uri=\"/dir/index.html\",qop=auth"}})
.get<http::header::WWWAuthenticate>());
+
+ EXPECT_ERROR(
+ http::Headers(
+ {{"Www-Authenticate",
+ "Bearer =\"https://https://example.com\""}})
+ .get<http::header::WWWAuthenticate>());
+
+ // authParam keys cannot be quoted strings.
+ EXPECT_ERROR(
+ http::Headers(
+ {{"Www-Authenticate",
+ "Bearer \"realm\"=\"https://example.com\""}})
+ .get<http::header::WWWAuthenticate>());
+
+ // We do not incorrectly split if authParam values contain `=`
+ // delimiters inside quotes. This is a regression test for MESOS-9968.
+ header = http::Headers(
+ {{"Www-Authenticate",
+ "Bearer realm="
+ "\"https://nvcr.io/proxy_auth?scope="
+ "repository:nvidia/tensorflow:pull,push\""}})
+ .get<http::header::WWWAuthenticate>();
+
+ ASSERT_SOME(header);
+ EXPECT_EQ("Bearer", header->authScheme());
+ ASSERT_EQ(hashset<string>{"realm"}, header->authParam().keys());
+ EXPECT_EQ(
+ "https://nvcr.io/proxy_auth?scope=repository:nvidia/tensorflow:pull,push",
+ header->authParam()["realm"]);
}
[mesos] 03/03: Added MESOS-9968 to the 1.8.2 CHANGELOG.
Posted by be...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
bennoe pushed a commit to branch 1.8.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit c7c716dbc9ee4363ba6267591585b9984d8920b8
Author: Benno Evers <be...@apache.org>
AuthorDate: Thu Dec 5 12:24:57 2019 +0100
Added MESOS-9968 to the 1.8.2 CHANGELOG.
---
CHANGELOG | 1 +
1 file changed, 1 insertion(+)
diff --git a/CHANGELOG b/CHANGELOG
index a9dc3f0..6c5bfd3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,7 @@ Release Notes - Mesos - Version 1.8.2 (WIP)
* [MESOS-9925] - Default executor takes a couple of seconds to start and subscribe Mesos agent.
* [MESOS-9964] - Support destroying UCR containers in provisioning state.
* [MESOS-9966] - Agent crashes when trying to destroy orphaned nested container if root container is orphaned as well.
+ * [MESOS-9968] - WWWAuthenticate header parsing fails when commas are in (quoted) realm
* [MESOS-10007] - Command executor can miss exit status for short-lived commands due to double-reaping.
* [MESOS-10015] - updateAllocation() can stall the allocator with a huge number of reservations on an agent.