142 lines
4.4 KiB
Diff
142 lines
4.4 KiB
Diff
From 5608bf772250843426cc2fa357fac0a55316ad37 Mon Sep 17 00:00:00 2001
|
|
From: lvxiangcong <lvxiangcong@kylinos.cn>
|
|
Date: Mon, 17 Feb 2025 14:46:45 +0800
|
|
Subject: [PATCH] backport fix cve-2021-28235
|
|
|
|
---
|
|
etcdserver/v3_server.go | 7 ++++
|
|
tests/e2e/ctl_v3_auth_security_test.go | 58 ++++++++++++++++++++++++++
|
|
tests/e2e/ctl_v3_test.go | 6 +++
|
|
tests/e2e/util.go | 11 +++++
|
|
4 files changed, 82 insertions(+)
|
|
create mode 100644 tests/e2e/ctl_v3_auth_security_test.go
|
|
|
|
diff --git a/etcdserver/v3_server.go b/etcdserver/v3_server.go
|
|
index 93b2bc1..8d8bd9c 100644
|
|
--- a/etcdserver/v3_server.go
|
|
+++ b/etcdserver/v3_server.go
|
|
@@ -453,6 +453,13 @@ func (s *EtcdServer) Authenticate(ctx context.Context, r *pb.AuthenticateRequest
|
|
}
|
|
|
|
lg := s.getLogger()
|
|
+
|
|
+ // fix https://nvd.nist.gov/vuln/detail/CVE-2021-28235
|
|
+ defer func() {
|
|
+ if r != nil {
|
|
+ r.Password = ""
|
|
+ }
|
|
+ }()
|
|
|
|
var resp proto.Message
|
|
for {
|
|
diff --git a/tests/e2e/ctl_v3_auth_security_test.go b/tests/e2e/ctl_v3_auth_security_test.go
|
|
new file mode 100644
|
|
index 0000000..b63a15f
|
|
--- /dev/null
|
|
+++ b/tests/e2e/ctl_v3_auth_security_test.go
|
|
@@ -0,0 +1,58 @@
|
|
+// Copyright 2023 The etcd Authors
|
|
+//
|
|
+// Licensed under the Apache License, Version 2.0 (the "License");
|
|
+// you may not use this file except in compliance with the License.
|
|
+// You may obtain a copy of the License at
|
|
+//
|
|
+// http://www.apache.org/licenses/LICENSE-2.0
|
|
+//
|
|
+// Unless required by applicable law or agreed to in writing, software
|
|
+// distributed under the License is distributed on an "AS IS" BASIS,
|
|
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
+// See the License for the specific language governing permissions and
|
|
+// limitations under the License.
|
|
+
|
|
+//go:build !cluster_proxy
|
|
+
|
|
+package e2e
|
|
+
|
|
+import (
|
|
+ "strings"
|
|
+ "testing"
|
|
+
|
|
+ "github.com/stretchr/testify/require"
|
|
+
|
|
+ "go.etcd.io/etcd/tests/v3/framework/e2e"
|
|
+)
|
|
+
|
|
+// TestAuth_CVE_2021_28235 verifies https://nvd.nist.gov/vuln/detail/CVE-2021-28235
|
|
+func TestAuth_CVE_2021_28235(t *testing.T) {
|
|
+ testCtl(t, authTest_CVE_2021_28235, withCfg(*e2e.NewConfigNoTLS()), withLogLevel("debug"))
|
|
+}
|
|
+
|
|
+func authTest_CVE_2021_28235(cx ctlCtx) {
|
|
+ // create root user with root role
|
|
+ rootPass := "changeme123"
|
|
+ err := ctlV3User(cx, []string{"add", "root", "--interactive=false"}, "User root created", []string{rootPass})
|
|
+ require.NoError(cx.t, err)
|
|
+ err = ctlV3User(cx, []string{"grant-role", "root", "root"}, "Role root is granted to user root", nil)
|
|
+ require.NoError(cx.t, err)
|
|
+ err = ctlV3AuthEnable(cx)
|
|
+ require.NoError(cx.t, err)
|
|
+
|
|
+ // issue a put request
|
|
+ cx.user, cx.pass = "root", rootPass
|
|
+ err = ctlV3Put(cx, "foo", "bar", "")
|
|
+ require.NoError(cx.t, err)
|
|
+
|
|
+ // GET /debug/requests
|
|
+ httpEndpoint := cx.epc.Procs[0].EndpointsHTTP()[0]
|
|
+ req := e2e.CURLReq{Endpoint: "/debug/requests?fam=grpc.Recv.etcdserverpb.Auth&b=0&exp=1", Timeout: 5}
|
|
+ respData, err := curl(httpEndpoint, "GET", req, e2e.ClientNonTLS)
|
|
+ require.NoError(cx.t, err)
|
|
+
|
|
+ if strings.Contains(respData, rootPass) {
|
|
+ cx.t.Errorf("The root password is included in the request.\n %s", respData)
|
|
+ }
|
|
+}
|
|
+
|
|
diff --git a/tests/e2e/ctl_v3_test.go b/tests/e2e/ctl_v3_test.go
|
|
index 04f5a65..74b1838 100644
|
|
--- a/tests/e2e/ctl_v3_test.go
|
|
+++ b/tests/e2e/ctl_v3_test.go
|
|
@@ -130,6 +130,12 @@ func withFlagByEnv() ctlOption {
|
|
return func(cx *ctlCtx) { cx.envMap = make(map[string]struct{}) }
|
|
}
|
|
|
|
+func withLogLevel(logLevel string) ctlOption {
|
|
+ return func(cx *ctlCtx) {
|
|
+ cx.cfg.LogLevel = logLevel
|
|
+ }
|
|
+}
|
|
+
|
|
func testCtl(t *testing.T, testFunc func(ctlCtx), opts ...ctlOption) {
|
|
defer testutil.AfterTest(t)
|
|
|
|
diff --git a/tests/e2e/util.go b/tests/e2e/util.go
|
|
index ce7289a..0e41225 100644
|
|
--- a/tests/e2e/util.go
|
|
+++ b/tests/e2e/util.go
|
|
@@ -17,6 +17,7 @@ package e2e
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
+ "string"
|
|
"math/rand"
|
|
"strings"
|
|
"time"
|
|
@@ -108,3 +109,13 @@ func closeWithTimeout(p *expect.ExpectProcess, d time.Duration) error {
|
|
func toTLS(s string) string {
|
|
return strings.Replace(s, "http://", "https://", 1)
|
|
}
|
|
+
|
|
+func curl(endpoint string, method string, curlReq e2e.CURLReq, connType e2e.ClientConnType) (string, error) {
|
|
+ args := e2e.CURLPrefixArgs(endpoint, e2e.ClientConfig{ConnectionType: connType}, false, method, curlReq)
|
|
+ lines, err := e2e.RunUtilCompletion(args, nil)
|
|
+ if err != nil {
|
|
+ return "", err
|
|
+ }
|
|
+ return strings.Join(lines, "\n"), nil
|
|
+}
|
|
+
|
|
--
|
|
2.46.0
|
|
|