Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pkg/authn: fix nil pointer dereference #361

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dimityrmirchev
Copy link
Contributor

Fix a nil pointer dereference introduced with 06bdb53.

Assigning nil type to an interface fails a nil check later on since the interface contains the type and its value.

Sorry for introducing this in the first place.

Before the change:

go run cmd/kube-rbac-proxy/main.go --kubeconfig=$KUBECONFIG --insecure-listen-address=0.0.0.0:8100 --oidc-clientID=foo  --oidc-issuer=https://accounts.google.com --upstream=http://localhost:3000
W0224 15:09:48.670407   81616 options.go:150] 
==== Deprecation Warning ======================

Insecure listen address will be removed.
Using --insecure-listen-address won't be possible!

The ability to run kube-rbac-proxy without TLS certificates will be removed.
Not using --tls-cert-file and --tls-private-key-file won't be possible!

For more information, please go to https://github.com/brancz/kube-rbac-proxy/issues/187

===============================================


panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x1018e42b8]

goroutine 1 [running]:
k8s.io/apiserver/pkg/server/dynamiccertificates.(*DynamicFileCAContent).CurrentCABundleContent(0x102254600?)
        /Users/user/go/pkg/mod/k8s.io/apiserver@v0.32.2/pkg/server/dynamiccertificates/dynamic_cafile_content.go:254 +0x18
k8s.io/apiserver/plugin/pkg/authenticator/token/oidc.New({_, _}, {{{{0x16f5c2f0b, 0x1b}, {0x0, 0x0}, {0x0, 0x0}, {0x1400029cdb0, 0x1, ...}, ...}, ...}, ...})
        /Users/user/go/pkg/mod/k8s.io/apiserver@v0.32.2/plugin/pkg/authenticator/token/oidc/oidc.go:286 +0x2c4
github.com/brancz/kube-rbac-proxy/pkg/authn.NewOIDCAuthenticator({0x10255c870, 0x1400020a410}, 0x140000345a0)
        /Users/user/go/src/github.com/brancz/kube-rbac-proxy/pkg/authn/oidc.go:50 +0x154
github.com/brancz/kube-rbac-proxy/cmd/kube-rbac-proxy/app.Run(0x14000598320)
        /Users/user/go/src/github.com/brancz/kube-rbac-proxy/cmd/kube-rbac-proxy/app/kube-rbac-proxy.go:225 +0x7c
github.com/brancz/kube-rbac-proxy/cmd/kube-rbac-proxy/app.NewKubeRBACProxyCommand.func2(0x14000714608, {0x14000132780?, 0x0?, 0x5?})
        /Users/user/go/src/github.com/brancz/kube-rbac-proxy/cmd/kube-rbac-proxy/app/kube-rbac-proxy.go:98 +0x70
github.com/spf13/cobra.(*Command).execute(0x14000714608, {0x1400004c1f0, 0x5, 0x5})
        /Users/user/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:985 +0x834
github.com/spf13/cobra.(*Command).ExecuteC(0x14000714608)
        /Users/user/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(...)
        /Users/user/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1041
k8s.io/component-base/cli.run(0x14000714608)
        /Users/user/go/pkg/mod/k8s.io/component-base@v0.32.2/cli/run.go:143 +0x20c
k8s.io/component-base/cli.Run(0x1035076c8?)
        /Users/user/go/pkg/mod/k8s.io/component-base@v0.32.2/cli/run.go:44 +0x1c
main.main()
        /Users/user/go/src/github.com/brancz/kube-rbac-proxy/cmd/kube-rbac-proxy/main.go:29 +0x20
exit status 2

After the change:

go run cmd/kube-rbac-proxy/main.go --kubeconfig=$KUBECONFIG --insecure-listen-address=0.0.0.0:8100 --oidc-clientID=foo  --oidc-issuer=https://accounts.google.com --upstream=http://localhost:3000 
W0224 15:09:17.666065   81492 options.go:150] 
==== Deprecation Warning ======================

Insecure listen address will be removed.
Using --insecure-listen-address won't be possible!

The ability to run kube-rbac-proxy without TLS certificates will be removed.
Not using --tls-cert-file and --tls-private-key-file won't be possible!

For more information, please go to https://github.com/brancz/kube-rbac-proxy/issues/187

===============================================


I0224 15:09:17.670629   81492 oidc.go:291] OIDC: No x509 certificates provided, will use host's root CA set
I0224 15:09:17.671809   81492 kube-rbac-proxy.go:473] Listening insecurely on 0.0.0.0:8100

Fix a nil pointer dereference introduced with brancz@06bdb53.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant