Skip to content

Commit

Permalink
[2.9] Fixes (rancher#44390)
Browse files Browse the repository at this point in the history 
* Add a check for specific fields we don't want in the headers (rancher#372)
* Split reconcileProjectAccessToGlobalResources
* Add tests
* Check APIGroup
* Add tests and change cr client used
* [2.8] Bump API-UI version rancher#432
* Update norman, apiserver
* Update RKE to 1.5.3
* Regenerate files after updating RKE to 1.5.3

---------
Co-authored-by: Jonathan Crowther <jonathan.crowther@suse.com>
Co-authored-by: Ricardo Weir <ricardo.weir@suse.com>
Co-authored-by: Michael Bolot <michael.bolot@suse.com>
  • Loading branch information
@pmatseykanets
pmatseykanets authored Feb 9, 2024
1 parent 44e346d commit 4479597
Show file tree
Hide file tree
Showing 20 changed files with 923 additions and 353 deletions.
6 changes: 3 additions & 3 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ require (
github.com/prometheus/client_model v0.4.0
github.com/prometheus/common v0.44.0
github.com/rancher/aks-operator v1.3.0-rc1
github.com/rancher/apiserver v0.0.0-20230831052300-120e615b17ba
github.com/rancher/apiserver v0.0.0-20240205154815-a3b9e3721c1b
github.com/rancher/channelserver v0.5.1-0.20230719220800-0a37b73c7df8
github.com/rancher/dynamiclistener v0.3.6
github.com/rancher/eks-operator v1.4.0-rc1
Expand All @@ -119,10 +119,10 @@ require (
github.com/rancher/kubernetes-provider-detector v0.1.5
github.com/rancher/lasso v0.0.0-20230830164424-d684fdeb6f29
github.com/rancher/machine v0.15.0-rancher109
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608
github.com/rancher/rancher/pkg/client v0.0.0
github.com/rancher/remotedialer v0.3.0
github.com/rancher/rke v1.5.0
github.com/rancher/rke v1.5.3
github.com/rancher/steve v0.0.0-20231016202603-993540401906
github.com/rancher/system-upgrade-controller/pkg/apis v0.0.0-20210727200656-10b094e30007
github.com/rancher/wrangler v1.1.1
Expand Down
12 changes: 6 additions & 6 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1661,8 +1661,8 @@ github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPH
github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
github.com/rancher/aks-operator v1.3.0-rc1 h1:5y7yblhHIsK+zaNgKj/Pge2/sPO4CoucLFFUo5GljsQ=
github.com/rancher/aks-operator v1.3.0-rc1/go.mod h1:sabCPWK3lSfx2komO9kHtKX0MqRhQP/UkWM8W9+VpcM=
github.com/rancher/apiserver v0.0.0-20230831052300-120e615b17ba h1:ceAHvddZkuNbUTuMgqxYAcUSQ/+YtJQO9Z1PHjmQZBY=
github.com/rancher/apiserver v0.0.0-20230831052300-120e615b17ba/go.mod h1:1m5KKYXq6iMZFQ5kiC9rBgVLfGRNR8E+lp88f5tEAsI=
github.com/rancher/apiserver v0.0.0-20240205154815-a3b9e3721c1b h1:dEKz4mxmTA9fGGRTPyhFHCOZV+Ap2s6I9l8mrLz+w5M=
github.com/rancher/apiserver v0.0.0-20240205154815-a3b9e3721c1b/go.mod h1:1m5KKYXq6iMZFQ5kiC9rBgVLfGRNR8E+lp88f5tEAsI=
github.com/rancher/aws-iam-authenticator v0.5.9-0.20220713170329-78acb8c83863 h1:7cVEMgwyiVhLyu/Ywuw58mkkh9cWpFE3+X8IrWncBxU=
github.com/rancher/aws-iam-authenticator v0.5.9-0.20220713170329-78acb8c83863/go.mod h1:6dId2LCc8oHqeBzP6E8ndp4DflhKTxYLb5ZXwI4YmFA=
github.com/rancher/channelserver v0.5.1-0.20230719220800-0a37b73c7df8 h1:Dyg8vyYMBIImru9mo8EF40yRgNgGQQOpC/aA2vZ/SXY=
Expand All @@ -1687,14 +1687,14 @@ github.com/rancher/machine v0.15.0-rancher109 h1:+3XVQQzWA6b5FIXikfeYv/2SRiMK2Jd
github.com/rancher/machine v0.15.0-rancher109/go.mod h1:nDJPIUiUO1a+HZ2lxpX95Djo7hJminwW6icga9FRc+w=
github.com/rancher/moq v0.0.0-20200712062324-13d1f37d2d77 h1:k+vzmkZQsH06rZnDr+phskSixG9ByNj9gVdzHcc8nxw=
github.com/rancher/moq v0.0.0-20200712062324-13d1f37d2d77/go.mod h1:wpITyDPTi/Na5h73XkbuEf2AP9fbgrIGqqxVzFhYD6U=
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d h1:Ft/iTH91TlE2oBGmpkdO4I8o8cvUmCnytdwu52a/tN4=
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d/go.mod h1:Sm2Xqai+aecgmJ86ygyEe+TdPMLkauEpykSstBAu4Ko=
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608 h1:azL/n2grvuyGqmDvnpgRoH6mmpgodiGwjv1uZwiO7HE=
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608/go.mod h1:Sm2Xqai+aecgmJ86ygyEe+TdPMLkauEpykSstBAu4Ko=
github.com/rancher/qase-go/client v0.0.0-20231114201952-65195ec001fa h1:/qeYlQVfyvsO5yY0dZmm7mRTAsDm54jACiRDx3LAwsA=
github.com/rancher/qase-go/client v0.0.0-20231114201952-65195ec001fa/go.mod h1:NP3xboG+t2p+XMnrcrJ/L384Ki0Cp3Pww/X+vm5Jcy0=
github.com/rancher/remotedialer v0.3.0 h1:y1EO8JCsgZo0RcqTUp6U8FXcBAv27R+TLnWRcpvX1sM=
github.com/rancher/remotedialer v0.3.0/go.mod h1:BwwztuvViX2JrLLUwDlsYt5DiyUwHLlzynRwkZLAY0Q=
github.com/rancher/rke v1.5.0 h1:M/YryKnBs7IwzMGA2kh1EiypVQkme6o9KSg0hlllQa4=
github.com/rancher/rke v1.5.0/go.mod h1:wZaVWzW46OTuGvyxgRHXGUyJ/QP0zOkKESO9hBOwTaY=
github.com/rancher/rke v1.5.3 h1:7mGn+NIL7KXk99NwWYBgoByh2+IfVCdws5ad3X/JIZY=
github.com/rancher/rke v1.5.3/go.mod h1:wZaVWzW46OTuGvyxgRHXGUyJ/QP0zOkKESO9hBOwTaY=
github.com/rancher/shepherd v0.0.0-20240205165058-79095d1622f8 h1:uAEdiG4Spsx3DMFcFRTlPX2pfNy7/uvquWhtcCnxIWA=
github.com/rancher/shepherd v0.0.0-20240205165058-79095d1622f8/go.mod h1:pggo0NvlbxaplK5cwiTSp7AixbGrGWbz6CC710biulI=
github.com/rancher/steve v0.0.0-20231016202603-993540401906 h1:gToXZxM/5S5lze/vCpQs50PJ33QTGCOaJHzjYh6y1RE=
Expand Down
2 changes: 1 addition & 1 deletion package/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@ ENV CATTLE_CLI_VERSION v2.8.0
ENV CATTLE_BASE_UI_BRAND=

# Please update the api-ui-version in pkg/settings/settings.go when updating the version here.
ENV CATTLE_API_UI_VERSION 1.1.10
ENV CATTLE_API_UI_VERSION 1.1.11

RUN mkdir -p /var/log/auditlog
ENV AUDIT_LOG_PATH /var/log/auditlog/rancher-api-audit.log
Expand Down
4 changes: 2 additions & 2 deletions pkg/apis/go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,8 @@ require (
github.com/rancher/eks-operator v1.4.0-rc1
github.com/rancher/fleet/pkg/apis v0.0.0-20231017140638-93432f288e79
github.com/rancher/gke-operator v1.3.0-rc2
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d
github.com/rancher/rke v1.5.0
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608
github.com/rancher/rke v1.5.3
github.com/rancher/wrangler v1.1.1
github.com/sirupsen/logrus v1.9.3
k8s.io/api v0.27.9
Expand Down
8 changes: 4 additions & 4 deletions pkg/apis/go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1161,10 +1161,10 @@ github.com/rancher/gke-operator v1.3.0-rc2 h1:MFtWsNSnyAJb8pr4Hmm+dFKqpo1EAHOZB3
github.com/rancher/gke-operator v1.3.0-rc2/go.mod h1:tSLZ14qvAtuKjkpnFSN6iE3hioIyGiHpashs4jojKp8=
github.com/rancher/lasso v0.0.0-20230830164424-d684fdeb6f29 h1:+kige/h8/LnzWgPjB5NUIHz/pWiW/lFpqcTUkN5uulY=
github.com/rancher/lasso v0.0.0-20230830164424-d684fdeb6f29/go.mod h1:kgk9kJVMj9FIrrXU0iyM6u/9Je4bEjPImqswkTVaKsQ=
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d h1:Ft/iTH91TlE2oBGmpkdO4I8o8cvUmCnytdwu52a/tN4=
github.com/rancher/norman v0.0.0-20230831160711-5de27f66385d/go.mod h1:Sm2Xqai+aecgmJ86ygyEe+TdPMLkauEpykSstBAu4Ko=
github.com/rancher/rke v1.5.0 h1:M/YryKnBs7IwzMGA2kh1EiypVQkme6o9KSg0hlllQa4=
github.com/rancher/rke v1.5.0/go.mod h1:wZaVWzW46OTuGvyxgRHXGUyJ/QP0zOkKESO9hBOwTaY=
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608 h1:azL/n2grvuyGqmDvnpgRoH6mmpgodiGwjv1uZwiO7HE=
github.com/rancher/norman v0.0.0-20240205154641-a6a6cf569608/go.mod h1:Sm2Xqai+aecgmJ86ygyEe+TdPMLkauEpykSstBAu4Ko=
github.com/rancher/rke v1.5.3 h1:7mGn+NIL7KXk99NwWYBgoByh2+IfVCdws5ad3X/JIZY=
github.com/rancher/rke v1.5.3/go.mod h1:wZaVWzW46OTuGvyxgRHXGUyJ/QP0zOkKESO9hBOwTaY=
github.com/rancher/wrangler v1.1.1-0.20230831050635-df1bd5aae9df h1:WJ+aaUICHPX8HeLmHE9JL/RFHhilMfcJlqmhgpc7gJU=
github.com/rancher/wrangler v1.1.1-0.20230831050635-df1bd5aae9df/go.mod h1:4T80p+rLh2OLbjCjdExIjRHKNBgK9NUAd7eIU/gRPKk=
github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
Expand Down
8 changes: 5 additions & 3 deletions pkg/auth/audit/audit.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ import (
"github.com/sirupsen/logrus"
k8stypes "k8s.io/apimachinery/pkg/types"
"k8s.io/apiserver/pkg/endpoints/request"
"k8s.io/utils/strings/slices"
)

const (
Expand Down Expand Up @@ -50,8 +51,9 @@ var (
http.MethodPut: true,
http.MethodPost: true,
}
sensitiveRequestHeader = []string{"Cookie", "Authorization", "X-Api-Tunnel-Params", "X-Api-Tunnel-Token"}
sensitiveResponseHeader = []string{"Cookie", "Set-Cookie"}
sensitiveRequestHeader = []string{"Cookie", "Authorization", "X-Api-Tunnel-Params", "X-Api-Tunnel-Token", "X-Api-Auth-Header", "X-Amz-Security-Token"}
sensitiveResponseHeader = []string{"Cookie", "Set-Cookie", "X-Api-Set-Cookie-Header"}
sensitiveBodyFields = []string{"credentials", "applicationSecret", "oauthCredential", "serviceAccountCredential", "spKey", "spCert", "certificate", "privateKey"}
// ErrUnsupportedEncoding is returned when the response encoding is unsupported
ErrUnsupportedEncoding = fmt.Errorf("unsupported encoding")
secretBaseType = regexp.MustCompile(".\"baseType\":\"([A-Za-z]*[S|s]ecret)\".")
Expand Down Expand Up @@ -394,7 +396,7 @@ func (a *auditLog) redactMap(m map[string]interface{}) bool {
for key := range m {
switch val := m[key].(type) {
case string:
if a.keysToRedactRegex.MatchString(key) {
if a.keysToRedactRegex.MatchString(key) || slices.Contains(sensitiveBodyFields, key) {
changed = true
m[key] = redacted
}
Expand Down
22 changes: 22 additions & 0 deletions pkg/auth/audit/audit_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -199,6 +199,11 @@ func (a *AuditTest) TestRedactSensitiveData() {
want: []byte(fmt.Sprintf(`{"kubeConfig":"%s","namespace":"testns","secretName":"secret-name"}`, redacted)),
uri: `asdf`,
},
{
name: "With items from sensitiveBodyFields",
input: []byte(`{"credentials": "{'fakeCredName': 'fakeCred'}", "applicationSecret": "fakeAppSecret", "oauthCredential": "fakeOauth", "serviceAccountCredential": "fakeSACred", "spKey": "fakeSPKey", "spCert": "fakeSPCERT", "certificate": "fakeCert", "privateKey": "fakeKey"}`),
want: []byte(fmt.Sprintf(`{"credentials": "%s", "applicationSecret": "%[1]s", "oauthCredential": "%[1]s", "serviceAccountCredential": "%[1]s", "spKey": "%[1]s", "spCert": "%[1]s", "certificate": "%[1]s", "privateKey": "%[1]s"}`, redacted)),
},
}
for i := range tests {
test := tests[i]
Expand Down Expand Up @@ -437,6 +442,18 @@ func (a *AuditTest) TestFilterSensitiveHeader() {
respHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
expectedRespHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
},
{
name: "sensitive request header: \"X-Api-Auth-Header\"",
reqHeader: http.Header{"X-Api-Auth-Header": []string{"abcd"}},
respHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
expectedRespHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
},
{
name: "sensitive request header: \"X-Amz-Security-Token\"",
reqHeader: http.Header{"X-Amz-Security-Token": []string{"abcd"}},
respHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
expectedRespHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
},
{
name: "non-sensitive request header and sensitive request header: \"Cookie\"",
reqHeader: http.Header{"Cookie": []string{"abcd"}, "User-Agent": []string{"useragent1"}},
Expand All @@ -454,6 +471,11 @@ func (a *AuditTest) TestFilterSensitiveHeader() {
respHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}, "Set-Cookie": []string{"abcd"}},
expectedRespHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
},
{
name: "sensitive response header: \"X-Api-Set-Cookie-Header\"",
respHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}, "X-Api-Set-Cookie-Header": []string{"abcd"}},
expectedRespHeader: http.Header{"Content-Type": []string{"application/json"}, "Content-Encoding": []string{"none"}},
},
}
writer.Level = LevelMetadata
for i := range tests {
Expand Down
Loading

0 comments on commit 4479597

Please sign in to comment.