Skip to content

Commit

Permalink
[2.8] Fixes (#44334)
Browse files Browse the repository at this point in the history 
* Add a check for specific fields we don't want in the headers (#372)
* Split reconcileProjectAccessToGlobalResources
* Add tests
* Check APIGroup
* Add tests and change cr client used
* [2.8] Bump API-UI version #432
* Update norman and apiserver
* Update RKE to 1.5.3
* Regenerate files after updating RKE to 1.5.3
* Update runc to 1.1.12

---------
Co-authored-by: Jonathan Crowther <jonathan.crowther@suse.com>
Co-authored-by: Ricardo Weir <ricardo.weir@suse.com>
Co-authored-by: Michael Bolot <michael.bolot@suse.com>
  • Loading branch information
@pmatseykanets
pmatseykanets committed Feb 5, 2024
1 parent fa9e804 commit 2f7113d
Show file tree
Hide file tree
Showing 21 changed files with 741 additions and 199 deletions.
10 changes: 6 additions & 4 deletions go.mod
View file
Expand Up @@ -14,6 +14,8 @@ replace (
github.com/matryer/moq => github.com/rancher/moq v0.0.0-20200712062324-13d1f37d2d77
github.com/opencontainers/image-spec => github.com/opencontainers/image-spec v1.1.0-rc2 // needed for containers/image/v5

github.com/opencontainers/runc => github.com/opencontainers/runc v1.1.12

github.com/rancher/rancher/pkg/apis => ./pkg/apis
github.com/rancher/rancher/pkg/client => ./pkg/client

Expand Down Expand Up @@ -109,7 +111,7 @@ require (
github.com/prometheus/client_model v0.4.0
github.com/prometheus/common v0.44.0
github.com/rancher/aks-operator v1.2.0
github.com/rancher/apiserver v0.0.0-20230831052300-120e615b17ba
github.com/rancher/apiserver v0.0.0-20240205154815-a3b9e3721c1b
github.com/rancher/channelserver v0.5.1-0.20230719220800-0a37b73c7df8
github.com/rancher/dynamiclistener v0.3.6
github.com/rancher/eks-operator v1.3.0
Expand All @@ -118,10 +120,10 @@ require (
github.com/rancher/kubernetes-provider-detector v0.1.5
github.com/rancher/lasso v0.0.0-20230830164424-d684fdeb6f29
github.com/rancher/machine v0.15.0-rancher106
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608
github.com/rancher/rancher/pkg/client v0.0.0
github.com/rancher/remotedialer v0.3.0
github.com/rancher/rke v1.5.2
github.com/rancher/rke v1.5.3
github.com/rancher/steve v0.0.0-20231016202603-993540401906
github.com/rancher/system-upgrade-controller/pkg/apis v0.0.0-20210727200656-10b094e30007
github.com/rancher/wrangler v1.1.1
Expand Down Expand Up @@ -269,7 +271,7 @@ require (
github.com/containerd/containerd v1.7.1 // indirect
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
github.com/cyphar/filepath-securejoin v0.2.3 // indirect
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
github.com/dimchansky/utfbom v1.1.1 // indirect
github.com/docker/cli v23.0.3+incompatible // indirect
github.com/docker/docker-credential-helpers v0.7.0 // indirect
Expand Down
20 changes: 10 additions & 10 deletions go.sum
View file
Expand Up @@ -249,8 +249,8 @@ github.com/crewjam/saml v0.4.13 h1:TYHggH/hwP7eArqiXSJUvtOPNzQDyQ7vwmwEqlFWhMc=
github.com/crewjam/saml v0.4.13/go.mod h1:igEejV+fihTIlHXYP8zOec3V5A8y3lws5bQBFsTm4gA=
github.com/cyberphone/json-canonicalization v0.0.0-20220623050100-57a0ce2678a7 h1:vU+EP9ZuFUCYE0NYLwTSob+3LNEJATzNfP/DC7SWGWI=
github.com/cyberphone/json-canonicalization v0.0.0-20220623050100-57a0ce2678a7/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI=
github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
Expand Down Expand Up @@ -918,8 +918,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/image-spec v1.1.0-rc2 h1:2zx/Stx4Wc5pIPDvIxHXvXtQFW/7XWJGmnM7r3wg034=
github.com/opencontainers/image-spec v1.1.0-rc2/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
github.com/opencontainers/runc v1.1.9 h1:XR0VIHTGce5eWPkaPesqTBrhW2yAcaraWfsEalNwQLM=
github.com/opencontainers/runc v1.1.9/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50=
github.com/opencontainers/runc v1.1.12 h1:BOIssBaW1La0/qbNZHXOOa71dZfZEQOzW7dqQf3phss=
github.com/opencontainers/runc v1.1.12/go.mod h1:S+lQwSfncpBha7XTy/5lBwWgm5+y5Ma/O44Ekby9FK8=
github.com/opencontainers/runtime-spec v1.1.0-rc.1 h1:wHa9jroFfKGQqFHj0I1fMRKLl0pfj+ynAqBxo3v6u9w=
github.com/opencontainers/runtime-spec v1.1.0-rc.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
Expand Down Expand Up @@ -1003,8 +1003,8 @@ github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPH
github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
github.com/rancher/aks-operator v1.2.0 h1:cNB84j23Ng7GUkqIt8I1TUfkpPdA5SQ2uyosPNJM5G4=
github.com/rancher/aks-operator v1.2.0/go.mod h1:CIU0AgI4DHYKEG3P3tHyEM/5QEud7upDOiYL6j5D/qE=
github.com/rancher/apiserver v0.0.0-20230831052300-120e615b17ba h1:ceAHvddZkuNbUTuMgqxYAcUSQ/+YtJQO9Z1PHjmQZBY=
github.com/rancher/apiserver v0.0.0-20230831052300-120e615b17ba/go.mod h1:1m5KKYXq6iMZFQ5kiC9rBgVLfGRNR8E+lp88f5tEAsI=
github.com/rancher/apiserver v0.0.0-20240205154815-a3b9e3721c1b h1:dEKz4mxmTA9fGGRTPyhFHCOZV+Ap2s6I9l8mrLz+w5M=
github.com/rancher/apiserver v0.0.0-20240205154815-a3b9e3721c1b/go.mod h1:1m5KKYXq6iMZFQ5kiC9rBgVLfGRNR8E+lp88f5tEAsI=
github.com/rancher/aws-iam-authenticator v0.5.9-0.20220713170329-78acb8c83863 h1:7cVEMgwyiVhLyu/Ywuw58mkkh9cWpFE3+X8IrWncBxU=
github.com/rancher/aws-iam-authenticator v0.5.9-0.20220713170329-78acb8c83863/go.mod h1:6dId2LCc8oHqeBzP6E8ndp4DflhKTxYLb5ZXwI4YmFA=
github.com/rancher/channelserver v0.5.1-0.20230719220800-0a37b73c7df8 h1:Dyg8vyYMBIImru9mo8EF40yRgNgGQQOpC/aA2vZ/SXY=
Expand All @@ -1029,12 +1029,12 @@ github.com/rancher/machine v0.15.0-rancher106 h1:X7i+sqkvFilwTw0KQK4oiC813xm8UbL
github.com/rancher/machine v0.15.0-rancher106/go.mod h1:nDJPIUiUO1a+HZ2lxpX95Djo7hJminwW6icga9FRc+w=
github.com/rancher/moq v0.0.0-20200712062324-13d1f37d2d77 h1:k+vzmkZQsH06rZnDr+phskSixG9ByNj9gVdzHcc8nxw=
github.com/rancher/moq v0.0.0-20200712062324-13d1f37d2d77/go.mod h1:wpITyDPTi/Na5h73XkbuEf2AP9fbgrIGqqxVzFhYD6U=
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d h1:Ft/iTH91TlE2oBGmpkdO4I8o8cvUmCnytdwu52a/tN4=
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d/go.mod h1:Sm2Xqai+aecgmJ86ygyEe+TdPMLkauEpykSstBAu4Ko=
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608 h1:azL/n2grvuyGqmDvnpgRoH6mmpgodiGwjv1uZwiO7HE=
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608/go.mod h1:Sm2Xqai+aecgmJ86ygyEe+TdPMLkauEpykSstBAu4Ko=
github.com/rancher/remotedialer v0.3.0 h1:y1EO8JCsgZo0RcqTUp6U8FXcBAv27R+TLnWRcpvX1sM=
github.com/rancher/remotedialer v0.3.0/go.mod h1:BwwztuvViX2JrLLUwDlsYt5DiyUwHLlzynRwkZLAY0Q=
github.com/rancher/rke v1.5.2 h1:e//fEtK2QIZ8Ok3d8oOrCPSQ2hVfJH46P46cvbfuS8U=
github.com/rancher/rke v1.5.2/go.mod h1:wZaVWzW46OTuGvyxgRHXGUyJ/QP0zOkKESO9hBOwTaY=
github.com/rancher/rke v1.5.3 h1:7mGn+NIL7KXk99NwWYBgoByh2+IfVCdws5ad3X/JIZY=
github.com/rancher/rke v1.5.3/go.mod h1:wZaVWzW46OTuGvyxgRHXGUyJ/QP0zOkKESO9hBOwTaY=
github.com/rancher/steve v0.0.0-20231016202603-993540401906 h1:gToXZxM/5S5lze/vCpQs50PJ33QTGCOaJHzjYh6y1RE=
github.com/rancher/steve v0.0.0-20231016202603-993540401906/go.mod h1:IAeZiWgZLSGGlYOUa3qj/G6i1eKl2LFuZ/DKb9mIrzw=
github.com/rancher/system-upgrade-controller/pkg/apis v0.0.0-20210727200656-10b094e30007 h1:ru+mqGnxMmKeU0Q3XIDxkARvInDIqT1hH2amTcsjxI4=
Expand Down
2 changes: 1 addition & 1 deletion package/Dockerfile
View file
Expand Up @@ -178,7 +178,7 @@ ENV CATTLE_CLI_VERSION v2.8.0
ENV CATTLE_BASE_UI_BRAND=

# Please update the api-ui-version in pkg/settings/settings.go when updating the version here.
ENV CATTLE_API_UI_VERSION 1.1.10
ENV CATTLE_API_UI_VERSION 1.1.11

RUN mkdir -p /var/log/auditlog
ENV AUDIT_LOG_PATH /var/log/auditlog/rancher-api-audit.log
Expand Down
4 changes: 2 additions & 2 deletions pkg/apis/go.mod
View file
Expand Up @@ -33,8 +33,8 @@ require (
github.com/rancher/eks-operator v1.3.0
github.com/rancher/fleet/pkg/apis v0.0.0-20231017140638-93432f288e79
github.com/rancher/gke-operator v1.2.0
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d
github.com/rancher/rke v1.5.2
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608
github.com/rancher/rke v1.5.3
github.com/rancher/wrangler v1.1.1
github.com/sirupsen/logrus v1.9.3
k8s.io/api v0.27.6
Expand Down
8 changes: 4 additions & 4 deletions pkg/apis/go.sum
View file
Expand Up @@ -523,10 +523,10 @@ github.com/rancher/gke-operator v1.2.0 h1:Byd7IYDlg8T6Dk+bqj8QOXOWnTH5+s9pRairBC
github.com/rancher/gke-operator v1.2.0/go.mod h1:R6zrDS1ihOe+ai6cqDOT8JOcod7u4gHWdc1hToT6HP4=
github.com/rancher/lasso v0.0.0-20230830164424-d684fdeb6f29 h1:+kige/h8/LnzWgPjB5NUIHz/pWiW/lFpqcTUkN5uulY=
github.com/rancher/lasso v0.0.0-20230830164424-d684fdeb6f29/go.mod h1:kgk9kJVMj9FIrrXU0iyM6u/9Je4bEjPImqswkTVaKsQ=
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d h1:Ft/iTH91TlE2oBGmpkdO4I8o8cvUmCnytdwu52a/tN4=
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d/go.mod h1:Sm2Xqai+aecgmJ86ygyEe+TdPMLkauEpykSstBAu4Ko=
github.com/rancher/rke v1.5.2 h1:e//fEtK2QIZ8Ok3d8oOrCPSQ2hVfJH46P46cvbfuS8U=
github.com/rancher/rke v1.5.2/go.mod h1:wZaVWzW46OTuGvyxgRHXGUyJ/QP0zOkKESO9hBOwTaY=
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608 h1:azL/n2grvuyGqmDvnpgRoH6mmpgodiGwjv1uZwiO7HE=
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608/go.mod h1:Sm2Xqai+aecgmJ86ygyEe+TdPMLkauEpykSstBAu4Ko=
github.com/rancher/rke v1.5.3 h1:7mGn+NIL7KXk99NwWYBgoByh2+IfVCdws5ad3X/JIZY=
github.com/rancher/rke v1.5.3/go.mod h1:wZaVWzW46OTuGvyxgRHXGUyJ/QP0zOkKESO9hBOwTaY=
github.com/rancher/wrangler v1.1.1-0.20230831050635-df1bd5aae9df h1:WJ+aaUICHPX8HeLmHE9JL/RFHhilMfcJlqmhgpc7gJU=
github.com/rancher/wrangler v1.1.1-0.20230831050635-df1bd5aae9df/go.mod h1:4T80p+rLh2OLbjCjdExIjRHKNBgK9NUAd7eIU/gRPKk=
github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
Expand Down
8 changes: 5 additions & 3 deletions pkg/auth/audit/audit.go
View file
Expand Up @@ -20,6 +20,7 @@ import (
"github.com/sirupsen/logrus"
k8stypes "k8s.io/apimachinery/pkg/types"
"k8s.io/apiserver/pkg/endpoints/request"
"k8s.io/utils/strings/slices"
)

const (
Expand Down Expand Up @@ -50,8 +51,9 @@ var (
http.MethodPut: true,
http.MethodPost: true,
}
sensitiveRequestHeader = []string{"Cookie", "Authorization", "X-Api-Tunnel-Params", "X-Api-Tunnel-Token"}
sensitiveResponseHeader = []string{"Cookie", "Set-Cookie"}
sensitiveRequestHeader = []string{"Cookie", "Authorization", "X-Api-Tunnel-Params", "X-Api-Tunnel-Token", "X-Api-Auth-Header", "X-Amz-Security-Token"}
sensitiveResponseHeader = []string{"Cookie", "Set-Cookie", "X-Api-Set-Cookie-Header"}
sensitiveBodyFields = []string{"credentials", "applicationSecret", "oauthCredential", "serviceAccountCredential", "spKey", "spCert", "certificate", "privateKey"}
// ErrUnsupportedEncoding is returned when the response encoding is unsupported
ErrUnsupportedEncoding = fmt.Errorf("unsupported encoding")
secretBaseType = regexp.MustCompile(".\"baseType\":\"([A-Za-z]*[S|s]ecret)\".")
Expand Down Expand Up @@ -394,7 +396,7 @@ func (a *auditLog) redactMap(m map[string]interface{}) bool {
for key := range m {
switch val := m[key].(type) {
case string:
if a.keysToRedactRegex.MatchString(key) {
if a.keysToRedactRegex.MatchString(key) || slices.Contains(sensitiveBodyFields, key) {
changed = true
m[key] = redacted
}
Expand Down
22 changes: 22 additions & 0 deletions pkg/auth/audit/audit_test.go
View file
Expand Up @@ -199,6 +199,11 @@ func (a *AuditTest) TestRedactSensitiveData() {
want: []byte(fmt.Sprintf(`{"kubeConfig":"%s","namespace":"testns","secretName":"secret-name"}`, redacted)),
uri: `asdf`,
},
{
name: "With items from sensitiveBodyFields",
input: []byte(`{"credentials": "{'fakeCredName': 'fakeCred'}", "applicationSecret": "fakeAppSecret", "oauthCredential": "fakeOauth", "serviceAccountCredential": "fakeSACred", "spKey": "fakeSPKey", "spCert": "fakeSPCERT", "certificate": "fakeCert", "privateKey": "fakeKey"}`),
want: []byte(fmt.Sprintf(`{"credentials": "%s", "applicationSecret": "%[1]s", "oauthCredential": "%[1]s", "serviceAccountCredential": "%[1]s", "spKey": "%[1]s", "spCert": "%[1]s", "certificate": "%[1]s", "privateKey": "%[1]s"}`, redacted)),
},
}
for i := range tests {
test := tests[i]
Expand Down Expand Up @@ -437,6 +442,18 @@ func (a *AuditTest) TestFilterSensitiveHeader() {
respHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
expectedRespHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
},
{
name: "sensitive request header: \"X-Api-Auth-Header\"",
reqHeader: http.Header{"X-Api-Auth-Header": []string{"abcd"}},
respHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
expectedRespHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
},
{
name: "sensitive request header: \"X-Amz-Security-Token\"",
reqHeader: http.Header{"X-Amz-Security-Token": []string{"abcd"}},
respHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
expectedRespHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
},
{
name: "non-sensitive request header and sensitive request header: \"Cookie\"",
reqHeader: http.Header{"Cookie": []string{"abcd"}, "User-Agent": []string{"useragent1"}},
Expand All @@ -454,6 +471,11 @@ func (a *AuditTest) TestFilterSensitiveHeader() {
respHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}, "Set-Cookie": []string{"abcd"}},
expectedRespHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
},
{
name: "sensitive response header: \"X-Api-Set-Cookie-Header\"",
respHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}, "X-Api-Set-Cookie-Header": []string{"abcd"}},
expectedRespHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
},
}
writer.Level = LevelMetadata
for i := range tests {
Expand Down

0 comments on commit 2f7113d

Please sign in to comment.