Handle a Docker daemon without registry info #126

marcusmartins · 2017-05-24T16:21:34Z

- What I did
The current implementation of the ElectAuthServer doesn't handle well when the
default Registry server is not included in the response from the daemon Info
endpoint.

That leads to the storage and usage of the credentials for the default registry
(https://index.docker.io/v1/) under an empty string on the client config file.

Sample config file after a login via a Docker Daemon without Registry
information:

{
	"auths": {
		"": {
			"auth": "***"
		}
	}
}

That can lead to duplication of the password for the default registry and
authentication failures against the default registry if a pull/push is performed
without first authenticating via the misbehaving daemon.

- How I did it
Added an additional check to the ElectAuthServer function to validate if the daemon returned a default Registry as part of the Info API call.

- How to verify it
Run against a Docker host that doesn't return the default registry on the info api. Modern Docker hosts included that information.

- Description for the changelog
Better handling of registry operations against Daemon that don't return default registry information.

Signed-off-by: Marcus Martins marcus@docker.com

marcusmartins · 2017-05-24T16:21:53Z

cc @n4ss

marcusmartins · 2017-05-24T21:08:47Z

I missed a test that I am fixing now.

codecov-io · 2017-05-25T02:50:28Z

Codecov Report

Merging #126 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #126   +/-   ##
=======================================
  Coverage   46.12%   46.12%           
=======================================
  Files         161      161           
  Lines       11006    11006           
=======================================
  Hits         5077     5077           
  Misses       5639     5639           
  Partials      290      290

codecov-io · 2017-05-25T02:51:59Z

Codecov Report

Merging #126 into master will decrease coverage by 1.31%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master     #126      +/-   ##
==========================================
- Coverage   46.12%   44.81%   -1.32%     
==========================================
  Files         161      169       +8     
  Lines       11006    11360     +354     
==========================================
+ Hits         5077     5091      +14     
- Misses       5639     5979     +340     
  Partials      290      290

n4ss · 2017-05-25T09:10:33Z

Good catch for the test, LGTM!

aaronlehmann · 2017-05-25T21:54:31Z

LGTM

marcusmartins · 2017-05-26T01:52:35Z

@aaronlehmann @n4ss I added an additional commit (ddeca13) to test https://github.com/docker/cli/pull/126/files#diff-edfeae638bfd9c8f34d563582ac1ecd4L30)

Sorry about making changes after your review. I can squash the commits after that.

n4ss · 2017-05-26T09:45:00Z

still LGTM :)

marcusmartins · 2017-05-26T16:03:04Z

@dnephin Can you help review?

dnephin

Thanks for adding some tests. I think this is looking good.

Since the change is to add a warning, I think it would also be good to check the warning in the test cases.

dnephin · 2017-05-26T16:31:57Z

cli/command/registry_test.go

+		buf := new(bytes.Buffer)
+		cli := test.NewFakeCli(&fakeClient{infoFunc: tc.infoFunc}, buf)
+		server := ElectAuthServer(context.Background(), cli)
+		require.Equal(t, tc.expectedAuthServer, server)


This is a good place to use assert.Equal() instead of require so that it will run all the test cases, instead of ending after the first failure.

dnephin · 2017-05-26T16:36:32Z

cli/command/registry_test.go

+			expectedAuthServer: "https://index.docker.io/v1/",
+			infoFunc: func() (types.Info, error) {
+				return types.Info{IndexServerAddress: ""}, nil
+			},


To test the warning on this case you can add fakeClient.SetErr(errorBuffer), and then check that the buffer has the string you expect (or at least part of the message).

I guess there is another case below where a warning is expected as well.

Addressed in 6cd3a60

dnephin · 2017-05-26T16:38:26Z

cli/command/image/pull_test.go

+		infoFunc := func() (types.Info, error) {
+			return types.Info{IndexServerAddress: registry.IndexServer}, nil
+		}
+		cmd := NewPullCommand(test.NewFakeCli(&fakeClient{infoFunc: infoFunc}, buf))


Was this change necessary to keep the tests passing? I don't see why it would be necessary

Without this, the mock info endpoint returns an empty Registry field, which triggers the warning and causes the output not to match expectations.

marcusmartins · 2017-05-26T20:00:27Z

@dnephin Thanks for the review.

I have addressed both your comments here (6cd3a60)

Regarding:

Since the change is to add a warning, I think it would also be good to check the warning in the test cases.

Actually the main change is what auth server should be returned if we don't get an registry back from the server. I thought about not emitting any message in that case, but I decided to do so we could more easily uncover misbehaving daemons.

dnephin

Thanks, those changes look good, but I think they should be using stderr

dnephin · 2017-05-26T20:17:16Z

cli/command/registry.go

@@ -29,6 +29,8 @@ func ElectAuthServer(ctx context.Context, cli Cli) string {
 	serverAddress := registry.IndexServer
 	if info, err := cli.Client().Info(ctx); err != nil {
 		fmt.Fprintf(cli.Out(), "Warning: failed to get default registry endpoint from daemon (%v). Using system default: %s\n", err, serverAddress)
+	} else if info.IndexServerAddress == "" {
+		fmt.Fprintf(cli.Out(), "Warning: Empty registry endpoint from daemon. Using system default: %s\n", serverAddress)


Oh, I just noticed this now. These should definitely be going to cli.Err() not cli.Out().

marcusmartins · 2017-05-26T21:13:36Z

@dnephin Thanks. Addressed in cf46529

I was also able to remove the additional mocking on the pull function now that the output is going to stderr.

The current implementation of the ElectAuthServer doesn't handle well when the default Registry server is not included in the response from the daemon Info endpoint. That leads to the storage and usage of the credentials for the default registry (`https://index.docker.io/v1/`) under an empty string on the client config file. Sample config file after a login via a Docker Daemon without Registry information: ```json { "auths": { "": { "auth": "***" } } } ``` That can lead to duplication of the password for the default registry and authentication failures against the default registry if a pull/push is performed without first authenticating via the misbehaving daemon. Also, changes the output of the warning message from stdout to sdterr as per dnephin suggestion. Signed-off-by: Marcus Martins <marcus@docker.com>

dnephin

LGTM

marcusmartins · 2017-05-26T22:08:08Z

@aaronlehmann I did some refactoring based on @dnephin feedback. Do you mind taking another look?

aaronlehmann · 2017-05-26T22:32:07Z

LGTM

mavenugo · 2017-05-30T20:57:44Z

@marcusmartins @dnephin @aaronlehmann can you pls mark the priority tag in the PR ? It will help us determine if this should go into RC2 or not.

marcusmartins · 2017-05-31T03:32:50Z

I am not a maintainer so I will not set a priority but I believe it should be in RC2, so whatever priority reflects that.

n4ss · 2017-05-31T09:12:14Z

@mavenugo this is a P1 as this leads to a security issue under certain conditions.

GordonTheTurtle added the status/0-triage label May 24, 2017

marcusmartins force-pushed the handle_empty_registry_info branch from 8eaef41 to 2bb40dd Compare May 25, 2017 02:40

aaronlehmann added status/2-code-review and removed status/0-triage labels May 25, 2017

dnephin reviewed May 26, 2017

View reviewed changes

marcusmartins mentioned this pull request May 26, 2017

17.06.0 RC2 tracker docker/for-linux#2

Closed

23 tasks

marcusmartins force-pushed the handle_empty_registry_info branch from 6c11546 to 6cd3a60 Compare May 26, 2017 20:02

dnephin reviewed May 26, 2017

View reviewed changes

marcusmartins force-pushed the handle_empty_registry_info branch from 7c5777e to cf46529 Compare May 26, 2017 21:12

marcusmartins force-pushed the handle_empty_registry_info branch from cf46529 to 8626497 Compare May 26, 2017 21:48

dnephin approved these changes May 26, 2017

View reviewed changes

aaronlehmann merged commit 1b8b63b into docker:master May 26, 2017

GordonTheTurtle added this to the 17.06.0 milestone May 26, 2017

marcusmartins deleted the handle_empty_registry_info branch May 26, 2017 22:33

thaJeztah added the process/cherry-pick label May 30, 2017

aaronlehmann added the priority/P1 label May 31, 2017

mlaventure mentioned this pull request May 31, 2017

Handle a Docker daemon without registry info docker-archive/docker-ce#10

Merged

thaJeztah added process/cherry-picked and removed process/cherry-pick priority/P1 labels Jun 10, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Handle a Docker daemon without registry info #126

Handle a Docker daemon without registry info #126

marcusmartins commented May 24, 2017

marcusmartins commented May 24, 2017

marcusmartins commented May 24, 2017

codecov-io commented May 25, 2017

codecov-io commented May 25, 2017 •

edited

Loading

n4ss commented May 25, 2017

aaronlehmann commented May 25, 2017

marcusmartins commented May 26, 2017 •

edited

Loading

n4ss commented May 26, 2017

marcusmartins commented May 26, 2017

dnephin left a comment

dnephin May 26, 2017

dnephin May 26, 2017

marcusmartins May 26, 2017 •

edited

Loading

dnephin May 26, 2017

aaronlehmann May 26, 2017

marcusmartins commented May 26, 2017 •

edited

Loading

dnephin left a comment

dnephin May 26, 2017

marcusmartins commented May 26, 2017 •

edited

Loading

dnephin left a comment

marcusmartins commented May 26, 2017

aaronlehmann commented May 26, 2017

mavenugo commented May 30, 2017

marcusmartins commented May 31, 2017

n4ss commented May 31, 2017

Handle a Docker daemon without registry info #126

Handle a Docker daemon without registry info #126

Conversation

marcusmartins commented May 24, 2017

marcusmartins commented May 24, 2017

marcusmartins commented May 24, 2017

codecov-io commented May 25, 2017

Codecov Report

codecov-io commented May 25, 2017 • edited Loading

Codecov Report

n4ss commented May 25, 2017

aaronlehmann commented May 25, 2017

marcusmartins commented May 26, 2017 • edited Loading

n4ss commented May 26, 2017

marcusmartins commented May 26, 2017

dnephin left a comment

Choose a reason for hiding this comment

dnephin May 26, 2017

Choose a reason for hiding this comment

dnephin May 26, 2017

Choose a reason for hiding this comment

marcusmartins May 26, 2017 • edited Loading

Choose a reason for hiding this comment

dnephin May 26, 2017

Choose a reason for hiding this comment

aaronlehmann May 26, 2017

Choose a reason for hiding this comment

marcusmartins commented May 26, 2017 • edited Loading

dnephin left a comment

Choose a reason for hiding this comment

dnephin May 26, 2017

Choose a reason for hiding this comment

marcusmartins commented May 26, 2017 • edited Loading

dnephin left a comment

Choose a reason for hiding this comment

marcusmartins commented May 26, 2017

aaronlehmann commented May 26, 2017

mavenugo commented May 30, 2017

marcusmartins commented May 31, 2017

n4ss commented May 31, 2017

codecov-io commented May 25, 2017 •

edited

Loading

marcusmartins commented May 26, 2017 •

edited

Loading

marcusmartins May 26, 2017 •

edited

Loading

marcusmartins commented May 26, 2017 •

edited

Loading

marcusmartins commented May 26, 2017 •

edited

Loading