IPv6 client addresses handled incorrectly

[grawity]

When a client requests /v1/auth/kerberos/login via IPv6, the plugin logs a complaint:

[INFO]  auth.kerberos.auth_kerberos_cf8afb18: ::1:8080 - SPNEGO could not parse
client address: invalid format of client address: address ::1:8080: too many colons
in address

[INFO]  auth.kerberos.auth_kerberos_cf8afb18: ::1:8080 [email protected] - SPNEGO
authentication succeeded

(I'm not sure where the :8080 port number comes from.)

[fairclothjm]

@grawity Sorry for the very late response here! It looks like authenticate succeeds, is that correct?

The port comes from here:

vault-plugin-auth-kerberos/path_login.go

Lines 181 to 189 in abd4ef1

	// Because the outer application strips off the raw request, we need to
	// re-compose it to use this authentication handler. Only the request
	// remote addr and headers are used anyways. We use an arbitrary port
	// of 8080 because it's not used for anything but logging, but is required
	// by an underlying parser.
	rebuiltReq := &http.Request{
	Header: req.Headers,
	RemoteAddr: req.Connection.RemoteAddr + ":8080",
	}

I don't believe there is any actual error here.

[grawity]

@grawity Sorry for the very late response here! It looks like authenticate succeeds, is that correct?

The port comes from here:

vault-plugin-auth-kerberos/path_login.go

Lines 181 to 189 in abd4ef1

	// Because the outer application strips off the raw request, we need to
	// re-compose it to use this authentication handler. Only the request
	// remote addr and headers are used anyways. We use an arbitrary port
	// of 8080 because it's not used for anything but logging, but is required
	// by an underlying parser.
	rebuiltReq := &http.Request{
	Header: req.Headers,
	RemoteAddr: req.Connection.RemoteAddr + ":8080",
	}

I don't believe there is any actual error here.

As I recall, it did succeed, yes, and just logged a warning. (I admit that my Vault usage has been on the backburner for a while.)

But the comment says "...required by an underlying parser", and it seems that said parser attempts to actually parse the address provided, so it would probably be better to give it a valid address either way.

Usually, IPv6 addresses need to be formatted as [addr]:port when combined with a port number, e.g. [::1]:8080 or [2001:db8::42]:8080 and that's most likely what the aforementioned parser is expecting to receive. (I believe it uses net.SplitHostPort() if my golang source search went right.)