You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "An-DJ (via GitHub)" <gi...@apache.org> on 2023/03/22 12:33:45 UTC
[GitHub] [apisix] An-DJ opened a new pull request, #9146: fix(cli): fix allow_admin bug (#9055)
An-DJ opened a new pull request, #9146:
URL: https://github.com/apache/apisix/pull/9146
### Description
<!-- Please include a summary of the change and which issue is fixed. -->
<!-- Please also include relevant motivation and context. -->
Fixes #9055
### Checklist
- [X] I have explained the need for this PR and the problem it solves
- [X] I have explained the changes or the new features added to this PR
- [X] I have added tests corresponding to this change
- [ ] I have updated the documentation to reflect this change
- [X] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first)
<!--
Note
1. Mark the PR as draft until it's ready to be reviewed.
2. Always add/update tests for any changes unless you have a good reason.
3. Always update the documentation to reflect the changes made in the PR.
4. Make a new commit to resolve conversations instead of `push -f`.
5. To resolve merge conflicts, merge master instead of rebasing.
6. Use "request review" to notify the reviewer after making changes.
7. Only a reviewer can mark a conversation as resolved.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] monkeyDluffy6017 commented on a diff in pull request #9146: fix(cli): fix allow_admin allows non-`127.0.0.0/24` to access admin api with empty admin_key
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #9146:
URL: https://github.com/apache/apisix/pull/9146#discussion_r1147647944
##########
t/cli/test_admin.sh:
##########
@@ -154,6 +154,43 @@ fi
echo "pass: missing admin key and show ERROR message"
+# missing admin key, only allow 127.0.0.0/24 to access admin api
+
+echo '
+deployment:
+ admin:
+ allow_admin:
+ - 127.0.0.0/24
+ allow_admin: ~
+' > conf/config.yaml
+
+make init > output.log 2>&1 | true
+
+grep -E "ERROR: missing valid Admin API token." output.log > /dev/null
+if [ $? -eq 0 ]; then
Review Comment:
I have checked with @spacewander, the condition is correct
##########
t/cli/test_admin.sh:
##########
@@ -154,6 +154,43 @@ fi
echo "pass: missing admin key and show ERROR message"
+# missing admin key, only allow 127.0.0.0/24 to access admin api
+
+echo '
+deployment:
+ admin:
+ allow_admin:
+ - 127.0.0.0/24
+ allow_admin: ~
+' > conf/config.yaml
+
+make init > output.log 2>&1 | true
+
+grep -E "ERROR: missing valid Admin API token." output.log > /dev/null
+if [ $? -eq 0 ]; then
Review Comment:
I have checked with @spacewander, the condition is correct
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] monkeyDluffy6017 merged pull request #9146: fix(cli): fix allow_admin allows non-`127.0.0.0/24` to access admin api with empty admin_key
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 merged PR #9146:
URL: https://github.com/apache/apisix/pull/9146
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on a diff in pull request #9146: fix(cli): fix allow_admin allows non-`127.0.0.0/24` to access admin api with empty admin_key
Posted by "spacewander (via GitHub)" <gi...@apache.org>.
spacewander commented on code in PR #9146:
URL: https://github.com/apache/apisix/pull/9146#discussion_r1145568879
##########
apisix/cli/ops.lua:
##########
@@ -185,12 +186,9 @@ local function init(env)
local checked_admin_key = false
local allow_admin = yaml_conf.deployment.admin and
yaml_conf.deployment.admin.allow_admin
- if yaml_conf.apisix.enable_admin and allow_admin then
- for _, allow_ip in ipairs(allow_admin) do
- if allow_ip == "127.0.0.0/24" then
- checked_admin_key = true
- end
- end
+ if yaml_conf.apisix.enable_admin and allow_admin
+ and table.getn(allow_admin) == 1 and allow_admin[1] == "127.0.0.0/24" then
Review Comment:
table.getn is deprecated, use `#` instead
##########
t/cli/test_admin.sh:
##########
@@ -154,6 +154,45 @@ fi
echo "pass: missing admin key and show ERROR message"
+# missing admin key, only allow 127.0.0.0/24 to access admin api
+
+git checkout conf/config.yaml
Review Comment:
We don't need to checkout the config and then override it
##########
t/cli/test_admin.sh:
##########
@@ -154,6 +154,45 @@ fi
echo "pass: missing admin key and show ERROR message"
+# missing admin key, only allow 127.0.0.0/24 to access admin api
+
+git checkout conf/config.yaml
+
+echo '
+deployment:
+ admin:
+ allow_admin:
+ - 127.0.0.0/24
+ allow_admin: ~
+' > conf/config.yaml
+
+make init > output.log 2>&1 | true
+
+grep -E "ERROR: missing valid Admin API token." output.log > /dev/null
+if [ ! $? -ne 0 ]; then
Review Comment:
The condition here is incorrect?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] monkeyDluffy6017 commented on a diff in pull request #9146: fix(cli): fix allow_admin allows non-`127.0.0.0/24` to access admin api with empty admin_key
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #9146:
URL: https://github.com/apache/apisix/pull/9146#discussion_r1147647944
##########
t/cli/test_admin.sh:
##########
@@ -154,6 +154,43 @@ fi
echo "pass: missing admin key and show ERROR message"
+# missing admin key, only allow 127.0.0.0/24 to access admin api
+
+echo '
+deployment:
+ admin:
+ allow_admin:
+ - 127.0.0.0/24
+ allow_admin: ~
+' > conf/config.yaml
+
+make init > output.log 2>&1 | true
+
+grep -E "ERROR: missing valid Admin API token." output.log > /dev/null
+if [ $? -eq 0 ]; then
Review Comment:
I have checked with @spacewander, the condition is correct
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on a diff in pull request #9146: fix(cli): fix allow_admin allows non-`127.0.0.0/24` to access admin api with empty admin_key
Posted by "spacewander (via GitHub)" <gi...@apache.org>.
spacewander commented on code in PR #9146:
URL: https://github.com/apache/apisix/pull/9146#discussion_r1147023114
##########
t/cli/test_admin.sh:
##########
@@ -154,6 +154,43 @@ fi
echo "pass: missing admin key and show ERROR message"
+# missing admin key, only allow 127.0.0.0/24 to access admin api
+
+echo '
+deployment:
+ admin:
+ allow_admin:
+ - 127.0.0.0/24
+ allow_admin: ~
+' > conf/config.yaml
+
+make init > output.log 2>&1 | true
+
+grep -E "ERROR: missing valid Admin API token." output.log > /dev/null
+if [ $? -eq 0 ]; then
Review Comment:
The condition here is still incorrect, please think again what is going to check in this test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] monkeyDluffy6017 commented on a diff in pull request #9146: fix(cli): fix allow_admin allows non-`127.0.0.0/24` to access admin api with empty admin_key
Posted by "monkeyDluffy6017 (via GitHub)" <gi...@apache.org>.
monkeyDluffy6017 commented on code in PR #9146:
URL: https://github.com/apache/apisix/pull/9146#discussion_r1147650707
##########
t/cli/test_admin.sh:
##########
@@ -154,6 +154,43 @@ fi
echo "pass: missing admin key and show ERROR message"
+# missing admin key, only allow 127.0.0.0/24 to access admin api
+
+echo '
+deployment:
+ admin:
+ allow_admin:
+ - 127.0.0.0/24
+ allow_admin: ~
+' > conf/config.yaml
+
+make init > output.log 2>&1 | true
+
+grep -E "ERROR: missing valid Admin API token." output.log > /dev/null
+if [ $? -eq 0 ]; then
Review Comment:
I have checked with @spacewander, the condition is correct, but the shell syntax is incorrect
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on a diff in pull request #9146: fix(cli): fix allow_admin allows non-`127.0.0.0/24` to access admin api with empty admin_key
Posted by "spacewander (via GitHub)" <gi...@apache.org>.
spacewander commented on code in PR #9146:
URL: https://github.com/apache/apisix/pull/9146#discussion_r1147662146
##########
t/cli/test_admin.sh:
##########
@@ -154,6 +154,43 @@ fi
echo "pass: missing admin key and show ERROR message"
+# missing admin key, only allow 127.0.0.0/24 to access admin api
+
+echo '
+deployment:
+ admin:
+ allow_admin:
+ - 127.0.0.0/24
+ allow_admin: ~
+' > conf/config.yaml
+
+make init > output.log 2>&1 | true
+
+grep -E "ERROR: missing valid Admin API token." output.log > /dev/null
+if [ $? -eq 0 ]; then
Review Comment:
@monkeyDluffy6017
Yes, you are right. Sorry for the wrong suggestion.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org