Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Revert "Improve CreateFakeJwks" #47661

Closed
wants to merge 1 commit into from
Closed

Revert "Improve CreateFakeJwks" #47661

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 1 addition & 4 deletions go.mod
View file
Open in desktop
Expand Up @@ -56,7 +56,6 @@ require (
github.com/kr/pretty v0.3.1
github.com/kylelemons/godebug v1.1.0
github.com/lestrrat-go/jwx v1.2.26
github.com/lestrrat-go/jwx/v2 v2.0.15
github.com/mattn/go-isatty v0.0.20
github.com/miekg/dns v1.1.56
github.com/mitchellh/copystructure v1.2.0
Expand Down Expand Up @@ -185,9 +184,8 @@ require (
github.com/klauspost/compress v1.17.0 // indirect
github.com/kr/text v0.2.0 // indirect
github.com/lestrrat-go/backoff/v2 v2.0.8 // indirect
github.com/lestrrat-go/blackmagic v1.0.2 // indirect
github.com/lestrrat-go/blackmagic v1.0.1 // indirect
github.com/lestrrat-go/httpcc v1.0.1 // indirect
github.com/lestrrat-go/httprc v1.0.4 // indirect
github.com/lestrrat-go/iter v1.0.2 // indirect
github.com/lestrrat-go/option v1.0.1 // indirect
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
Expand Down Expand Up @@ -219,7 +217,6 @@ require (
github.com/rivo/uniseg v0.4.3 // indirect
github.com/rogpeppe/go-internal v1.10.0 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/segmentio/asm v1.2.0 // indirect
github.com/shopspring/decimal v1.3.1 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/spf13/afero v1.10.0 // indirect
Expand Down
10 changes: 1 addition & 9 deletions go.sum
View file
Open in desktop
Expand Up @@ -544,19 +544,14 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
github.com/lestrrat-go/backoff/v2 v2.0.8 h1:oNb5E5isby2kiro9AgdHLv5N5tint1AnDVVf2E2un5A=
github.com/lestrrat-go/backoff/v2 v2.0.8/go.mod h1:rHP/q/r9aT27n24JQLa7JhSQZCKBBOiM/uP402WwN8Y=
github.com/lestrrat-go/blackmagic v1.0.1 h1:lS5Zts+5HIC/8og6cGHb0uCcNCa3OUt1ygh3Qz2Fe80=
github.com/lestrrat-go/blackmagic v1.0.1/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
github.com/lestrrat-go/blackmagic v1.0.2 h1:Cg2gVSc9h7sz9NOByczrbUvLopQmXrfFx//N+AkAr5k=
github.com/lestrrat-go/blackmagic v1.0.2/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
github.com/lestrrat-go/httprc v1.0.4 h1:bAZymwoZQb+Oq8MEbyipag7iSq6YIga8Wj6GOiJGdI8=
github.com/lestrrat-go/httprc v1.0.4/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
github.com/lestrrat-go/jwx v1.2.26 h1:4iFo8FPRZGDYe1t19mQP0zTRqA7n8HnJ5lkIiDvJcB0=
github.com/lestrrat-go/jwx v1.2.26/go.mod h1:MaiCdGbn3/cckbOFSCluJlJMmp9dmZm5hDuIkx8ftpQ=
github.com/lestrrat-go/jwx/v2 v2.0.15 h1:XvR2lQdX+mZechmqWxqQb2foU3hgAn5+Rj0ICa0I6sU=
github.com/lestrrat-go/jwx/v2 v2.0.15/go.mod h1:jBHyESp4e7QxfERM0UKkQ80/94paqNIEcdEfiUYz5zE=
github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
Expand Down Expand Up @@ -738,8 +733,6 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
Expand Down Expand Up @@ -1108,7 +1101,6 @@ golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
Expand Down
2 changes: 1 addition & 1 deletion istio.deps
View file
Open in desktop
Expand Up @@ -4,7 +4,7 @@
"name": "PROXY_REPO_SHA",
"repoName": "proxy",
"file": "",
"lastStableSHA": "7770bba582a02c45885ee8697c7b4453c3fd0f51"
"lastStableSHA": "25b4a3908a0366e6779d7b1cd36279b70cc8e6aa"
},
{
"_comment": "",
Expand Down
21 changes: 0 additions & 21 deletions licenses/github.com/lestrrat-go/httprc/LICENSE
View file
Open in desktop

This file was deleted.

22 changes: 0 additions & 22 deletions licenses/github.com/lestrrat-go/jwx/v2/LICENSE
View file
Open in desktop

This file was deleted.

25 changes: 9 additions & 16 deletions pilot/pkg/model/jwks_resolver.go
View file
Open in desktop
Expand Up @@ -15,10 +15,9 @@
package model

import (
"crypto/rand"
"crypto/rsa"
"crypto/tls"
"crypto/x509"
"encoding/base64"
"encoding/json"
"errors"
"fmt"
Expand All @@ -36,7 +35,6 @@ import (

core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
envoy_jwt "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/jwt_authn/v3"
"github.com/lestrrat-go/jwx/v2/jwk"

"istio.io/istio/pilot/pkg/features"
"istio.io/istio/pkg/monitoring"
Expand Down Expand Up @@ -154,6 +152,7 @@ type JwksResolver struct {
jwksUribackgroundChannel bool
}

// NewJwksResolver creates new instance of JwksResolver.
func NewJwksResolver(evictionDuration, refreshDefaultInterval, refreshIntervalOnFailure, retryInterval time.Duration) *JwksResolver {
return newJwksResolverWithCABundlePaths(
evictionDuration,
Expand Down Expand Up @@ -284,7 +283,7 @@ func (r *JwksResolver) BuildLocalJwks(jwksURI, jwtIssuer, jwtPubKey string) *env
log.Infof("The JWKS key is not yet fetched for issuer %s (%s), using a fake JWKS for now", jwtIssuer, jwksURI)
// This is a temporary workaround to reject a request with JWT token by using a fake jwks when istiod failed to fetch it.
// TODO(xulingqing): Find a better way to reject the request without using the fake jwks.
jwtPubKey = CreateFakeJwks()
jwtPubKey = CreateFakeJwks(jwksURI)
}
}
return &envoy_jwt.JwtProvider_LocalJwks{
Expand All @@ -296,19 +295,13 @@ func (r *JwksResolver) BuildLocalJwks(jwksURI, jwtIssuer, jwtPubKey string) *env
}
}

var fakeJwks string

// CreateFakeJwks is a helper function to make a fake jwks when istiod failed to fetch it.
func CreateFakeJwks() string {
if fakeJwks == "" {
fakeJwksRSAKey, _ := rsa.GenerateKey(rand.Reader, 2048)
key, _ := jwk.FromRaw(fakeJwksRSAKey)
rsaKey, _ := key.(jwk.RSAPrivateKey)
res, _ := json.Marshal(rsaKey)
fakeJwks = fmt.Sprintf(`{"keys":[ %s]}`, string(res))
}

return fakeJwks
func CreateFakeJwks(jwksURI string) string {
// Create a fake jwksURI
fakeJwksURI := "Error-IstiodFailedToFetchJwksUri-" + jwksURI
// Encode jwksURI with base64 to make dynamic n in jwks
encodedString := base64.RawURLEncoding.EncodeToString([]byte(fakeJwksURI))
return fmt.Sprintf(`{"keys":[ {"e":"AQAB","kid":"abc","kty":"RSA","n":"%s"}]}`, encodedString)
}

// Resolve jwks_uri through openID discovery.
Expand Down
7 changes: 3 additions & 4 deletions pilot/pkg/security/authn/v1beta1/policy_applier_test.go
View file
Open in desktop
Expand Up @@ -687,7 +687,7 @@ func TestJwtFilter(t *testing.T) {
JwksSourceSpecifier: &envoy_jwt.JwtProvider_LocalJwks{
LocalJwks: &core.DataSource{
Specifier: &core.DataSource_InlineString{
InlineString: model.CreateFakeJwks(),
InlineString: model.CreateFakeJwks("http://site.not.exist"),
},
},
},
Expand Down Expand Up @@ -919,7 +919,6 @@ func TestJwtFilter(t *testing.T) {
push.JwtKeyResolver = model.NewJwksResolver(
model.JwtPubKeyEvictionDuration, model.JwtPubKeyRefreshInterval,
model.JwtPubKeyRefreshIntervalOnFailure, 10*time.Millisecond)

defer push.JwtKeyResolver.Close()

push.ServiceIndex.HostnameAndNamespace[host.Name("jwt-token-issuer.mesh")] = map[string]*model.Service{}
Expand Down Expand Up @@ -1167,7 +1166,7 @@ func TestConvertToEnvoyJwtConfig(t *testing.T) {
JwksSourceSpecifier: &envoy_jwt.JwtProvider_LocalJwks{
LocalJwks: &core.DataSource{
Specifier: &core.DataSource_InlineString{
InlineString: model.CreateFakeJwks(),
InlineString: model.CreateFakeJwks(""),
},
},
},
Expand Down Expand Up @@ -1222,7 +1221,7 @@ func TestConvertToEnvoyJwtConfig(t *testing.T) {
JwksSourceSpecifier: &envoy_jwt.JwtProvider_LocalJwks{
LocalJwks: &core.DataSource{
Specifier: &core.DataSource_InlineString{
InlineString: model.CreateFakeJwks(),
InlineString: model.CreateFakeJwks("http://site.not.exist"),
},
},
},
Expand Down