Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitb01d1cb

Browse files
committed
auth tunnels via updater
1 parent42ccc2c commitb01d1cb

File tree

7 files changed

+36
-38
lines changed

7 files changed

+36
-38
lines changed

‎coderd/workspaceagents.go‎

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1482,7 +1482,6 @@ func (api *API) workspaceAgentsExternalAuthListen(ctx context.Context, rw http.R
14821482
func (api*API)tailnet(rw http.ResponseWriter,r*http.Request) {
14831483
ctx:=r.Context()
14841484
owner:=httpmw.UserParam(r)
1485-
ownerRoles:=httpmw.UserAuthorization(r)
14861485

14871486
// Check if the actor is allowed to access any workspace owned by the user.
14881487
if!api.Authorize(r,policy.ActionSSH,rbac.ResourceWorkspace.WithOwner(owner.ID.String())) {
@@ -1530,32 +1529,16 @@ func (api *API) tailnet(rw http.ResponseWriter, r *http.Request) {
15301529

15311530
gohttpapi.Heartbeat(ctx,conn)
15321531
err=api.TailnetClientService.ServeUserClient(ctx,version,wsNetConn, tailnet.ServeUserClientOptions{
1533-
PeerID:peerID,
1534-
UserID:owner.ID,
1535-
AuthFn:authAgentFn(api.Database,api.Authorizer,&ownerRoles),
1532+
PeerID:peerID,
1533+
UserID:owner.ID,
1534+
UpdatesProvider:api.WorkspaceUpdatesProvider,
15361535
})
15371536
iferr!=nil&&!xerrors.Is(err,io.EOF)&&!xerrors.Is(err,context.Canceled) {
15381537
_=conn.Close(websocket.StatusInternalError,err.Error())
15391538
return
15401539
}
15411540
}
15421541

1543-
// authAgentFn accepts a subject, and returns a closure that authorizes against
1544-
// passed agent IDs.
1545-
funcauthAgentFn(db database.Store,auth rbac.Authorizer,user*rbac.Subject)func(context.Context, uuid.UUID)error {
1546-
returnfunc(ctx context.Context,agentID uuid.UUID)error {
1547-
ws,err:=db.GetWorkspaceByAgentID(ctx,agentID)
1548-
iferr!=nil {
1549-
returnxerrors.Errorf("get workspace by agent id: %w",err)
1550-
}
1551-
err=auth.Authorize(ctx,*user,policy.ActionSSH,ws.RBACObject())
1552-
iferr!=nil {
1553-
returnxerrors.Errorf("workspace agent not found or you do not have permission: %w",sql.ErrNoRows)
1554-
}
1555-
returnnil
1556-
}
1557-
}
1558-
15591542
// createExternalAuthResponse creates an ExternalAuthResponse based on the
15601543
// provider type. This is to support legacy `/workspaceagents/me/gitauth`
15611544
// which uses `Username` and `Password`.

‎coderd/workspaceupdates.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,24 @@ type updatesProvider struct {
9191
cancelFnfunc()
9292
}
9393

94+
func (u*updatesProvider)IsOwner(userID uuid.UUID,agentID uuid.UUID)error {
95+
u.mu.RLock()
96+
deferu.mu.RUnlock()
97+
98+
workspaces,exists:=u.latest[userID]
99+
if!exists {
100+
returnxerrors.Errorf("workspace agent not found or you do not have permission: %w",sql.ErrNoRows)
101+
}
102+
for_,workspace:=rangeworkspaces {
103+
for_,agent:=rangeworkspace.Agents {
104+
ifagent.ID==agentID {
105+
returnnil
106+
}
107+
}
108+
}
109+
returnxerrors.Errorf("workspace agent not found or you do not have permission: %w",sql.ErrNoRows)
110+
}
111+
94112
var_ tailnet.WorkspaceUpdatesProvider= (*updatesProvider)(nil)
95113

96114
funcNewUpdatesProvider(ctx context.Context,dbUpdateQuerier,ps pubsub.Pubsub) (tailnet.WorkspaceUpdatesProvider,error) {

‎enterprise/tailnet/connio.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ var errDisconnect = xerrors.New("graceful disconnect")
133133

134134
func (c*connIO)handleRequest(req*proto.CoordinateRequest)error {
135135
c.logger.Debug(c.peerCtx,"got request")
136-
err:=c.auth.Authorize(c.coordCtx,req)
136+
err:=c.auth.Authorize(req)
137137
iferr!=nil {
138138
c.logger.Warn(c.peerCtx,"unauthorized request",slog.Error(err))
139139
returnxerrors.Errorf("authorize request: %w",err)

‎tailnet/coordinator.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -577,7 +577,7 @@ func (c *core) handleRequest(p *peer, req *proto.CoordinateRequest) error {
577577
returnErrAlreadyRemoved
578578
}
579579

580-
iferr:=pr.auth.Authorize(context.Background(),req);err!=nil {
580+
iferr:=pr.auth.Authorize(req);err!=nil {
581581
returnxerrors.Errorf("authorize request: %w",err)
582582
}
583583

‎tailnet/service.go‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ type WorkspaceUpdatesProvider interface {
4343
Subscribe(peerID uuid.UUID,userID uuid.UUID) (<-chan*proto.WorkspaceUpdate,error)
4444
Unsubscribe(peerID uuid.UUID)
4545
Stop()
46+
IsOwner(userID uuid.UUID,agentID uuid.UUID)error
4647
}
4748

4849
typeClientServiceOptionsstruct {
@@ -119,11 +120,9 @@ func (s *ClientService) ServeClient(ctx context.Context, version string, conn ne
119120
}
120121

121122
typeServeUserClientOptionsstruct {
122-
PeerID uuid.UUID
123-
UserID uuid.UUID
124-
// AuthFn authorizes the user to `ActionSSH` against the workspace given
125-
// an agent ID.
126-
AuthFnfunc(context.Context, uuid.UUID)error
123+
PeerID uuid.UUID
124+
UserID uuid.UUID
125+
UpdatesProviderWorkspaceUpdatesProvider
127126
}
128127

129128
func (s*ClientService)ServeUserClient(ctx context.Context,versionstring,conn net.Conn,optsServeUserClientOptions)error {
@@ -136,7 +135,6 @@ func (s *ClientService) ServeUserClient(ctx context.Context, version string, con
136135
case2:
137136
auth:=ClientUserCoordinateeAuth{
138137
UserID:opts.UserID,
139-
AuthFn:opts.AuthFn,
140138
}
141139
streamID:=StreamID{
142140
Name:"client",

‎tailnet/service_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ func TestClientService_ServeClient_V2(t *testing.T) {
7474
require.NotNil(t,call)
7575
require.Equal(t,call.ID,clientID)
7676
require.Equal(t,call.Name,"client")
77-
require.NoError(t,call.Auth.Authorize(ctx,&proto.CoordinateRequest{
77+
require.NoError(t,call.Auth.Authorize(&proto.CoordinateRequest{
7878
AddTunnel:&proto.CoordinateRequest_Tunnel{Id:agentID[:]},
7979
}))
8080
req:=testutil.RequireRecvCtx(ctx,t,call.Reqs)

‎tailnet/tunnel.go‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package tailnet
22

33
import (
4-
"context"
54
"database/sql"
65
"net/netip"
76

@@ -14,13 +13,13 @@ import (
1413
varlegacyWorkspaceAgentIP=netip.MustParseAddr("fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4")
1514

1615
typeCoordinateeAuthinterface {
17-
Authorize(ctx context.Context,req*proto.CoordinateRequest)error
16+
Authorize(req*proto.CoordinateRequest)error
1817
}
1918

2019
// SingleTailnetCoordinateeAuth allows all tunnels, since Coderd and wsproxy are allowed to initiate a tunnel to any agent
2120
typeSingleTailnetCoordinateeAuthstruct{}
2221

23-
func (SingleTailnetCoordinateeAuth)Authorize(context.Context,*proto.CoordinateRequest)error {
22+
func (SingleTailnetCoordinateeAuth)Authorize(*proto.CoordinateRequest)error {
2423
returnnil
2524
}
2625

@@ -29,7 +28,7 @@ type ClientCoordinateeAuth struct {
2928
AgentID uuid.UUID
3029
}
3130

32-
func (cClientCoordinateeAuth)Authorize(_ context.Context,req*proto.CoordinateRequest)error {
31+
func (cClientCoordinateeAuth)Authorize(req*proto.CoordinateRequest)error {
3332
iftun:=req.GetAddTunnel();tun!=nil {
3433
uid,err:=uuid.FromBytes(tun.Id)
3534
iferr!=nil {
@@ -66,7 +65,7 @@ type AgentCoordinateeAuth struct {
6665
ID uuid.UUID
6766
}
6867

69-
func (aAgentCoordinateeAuth)Authorize(_ context.Context,req*proto.CoordinateRequest)error {
68+
func (aAgentCoordinateeAuth)Authorize(req*proto.CoordinateRequest)error {
7069
iftun:=req.GetAddTunnel();tun!=nil {
7170
returnxerrors.New("agents cannot open tunnels")
7271
}
@@ -93,17 +92,17 @@ func (a AgentCoordinateeAuth) Authorize(_ context.Context, req *proto.Coordinate
9392
}
9493

9594
typeClientUserCoordinateeAuthstruct {
96-
UserID uuid.UUID
97-
AuthFnfunc(context.Context, uuid.UUID)error
95+
UserIDuuid.UUID
96+
UpdatesProviderWorkspaceUpdatesProvider
9897
}
9998

100-
func (aClientUserCoordinateeAuth)Authorize(ctx context.Context,req*proto.CoordinateRequest)error {
99+
func (aClientUserCoordinateeAuth)Authorize(req*proto.CoordinateRequest)error {
101100
iftun:=req.GetAddTunnel();tun!=nil {
102101
uid,err:=uuid.FromBytes(tun.Id)
103102
iferr!=nil {
104103
returnxerrors.Errorf("parse add tunnel id: %w",err)
105104
}
106-
err=a.AuthFn(ctx,uid)
105+
err=a.UpdatesProvider.IsOwner(a.UserID,uid)
107106
iferr!=nil {
108107
returnxerrors.Errorf("workspace agent not found or you do not have permission: %w",sql.ErrNoRows)
109108
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp