Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Router: fix missing lock on routeEntry when accessing backend field #25191

Merged
merged 3 commits into from
Feb 9, 2024
Merged

Router: fix missing lock on routeEntry when accessing backend field #25191

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2627dbe
Re-implement MatchingSystemView in terms of MatchingBackend, which fi…
ncabatoff Feb 2, 2024
603492a
Add CL
ncabatoff Feb 9, 2024
806693d
Merge branch 'main' into fix-router-missing-lock
ncabatoff Feb 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
Re-implement MatchingSystemView in terms of MatchingBackend, which fi… 
…xes a missing lock on routeEntry. Remove unused MatchingMountByAPIPath and an unused ctx argument from some funcs.
  • Loading branch information
@ncabatoff
ncabatoff committed Feb 2, 2024
commit 2627dbe07e4c4a0a0c3bfdb981a647073a14578c
35 changes: 11 additions & 24 deletions vault/router.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,9 @@ func NewRouter() *Router {

// routeEntry is used to represent a mount point in the router
type routeEntry struct {
tainted atomic.Bool
tainted atomic.Bool
// backend is the actual backend instance for this route entry; lock l must
// be held to access this field.
backend logical.Backend
mountEntry *MountEntry
storageView logical.Storage
Expand All @@ -69,7 +71,8 @@ type routeEntry struct {
loginPaths atomic.Value
binaryPaths atomic.Value
limitedPaths atomic.Value
l sync.RWMutex
// l is the lock used to protect access to backend during reloads
l sync.RWMutex
}

type wildcardPath struct {
Expand Down Expand Up @@ -495,27 +498,11 @@ func (r *Router) MatchingBackend(ctx context.Context, path string) logical.Backe

// MatchingSystemView returns the SystemView used for a path
func (r *Router) MatchingSystemView(ctx context.Context, path string) logical.SystemView {
ns, err := namespace.FromContext(ctx)
if err != nil {
backend := r.MatchingBackend(ctx, path)
if backend == nil {
return nil
}
path = ns.Path + path

r.l.RLock()
_, raw, ok := r.root.LongestPrefix(path)
r.l.RUnlock()
if !ok || raw.(*routeEntry).backend == nil {
return nil
}
return raw.(*routeEntry).backend.System()
}

func (r *Router) MatchingMountByAPIPath(ctx context.Context, path string) string {
me, _, _ := r.matchingMountEntryByPath(ctx, path, true)
if me == nil {
return ""
}
return me.Path
return backend.System()
}

// MatchingStoragePrefixByAPIPath the storage prefix for the given api path
Expand All @@ -526,13 +513,13 @@ func (r *Router) MatchingStoragePrefixByAPIPath(ctx context.Context, path string
}
path = ns.Path + path

_, prefix, found := r.matchingMountEntryByPath(ctx, path, true)
_, prefix, found := r.matchingMountEntryByPath(path, true)
return prefix, found
}

// MatchingAPIPrefixByStoragePath the api path information for the given storage path
func (r *Router) MatchingAPIPrefixByStoragePath(ctx context.Context, path string) (*namespace.Namespace, string, string, bool) {
me, prefix, found := r.matchingMountEntryByPath(ctx, path, false)
me, prefix, found := r.matchingMountEntryByPath(path, false)
if !found {
return nil, "", "", found
}
Expand All @@ -546,7 +533,7 @@ func (r *Router) MatchingAPIPrefixByStoragePath(ctx context.Context, path string
return me.Namespace(), mountPath, prefix, found
}

func (r *Router) matchingMountEntryByPath(ctx context.Context, path string, apiPath bool) (*MountEntry, string, bool) {
func (r *Router) matchingMountEntryByPath(path string, apiPath bool) (*MountEntry, string, bool) {
var raw interface{}
var ok bool
r.l.RLock()
Expand Down
Loading