From c3741b0177056d9e999ff03a6542a4811508fa9a Mon Sep 17 00:00:00 2001 From: Violet Hynes Date: Tue, 27 Jun 2023 15:09:25 -0400 Subject: [PATCH] Calculate namespace prefix before tainting route entries (#21470) * Calculate namespace prefix before tainting route entries * Changelog * Remove check, log just about tainting * Typo * Better log * Update log message --- changelog/24170.txt | 3 +++ vault/auth.go | 1 + vault/mount.go | 6 +++++- 3 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 changelog/24170.txt diff --git a/changelog/24170.txt b/changelog/24170.txt new file mode 100644 index 000000000000..9f047a9d6758 --- /dev/null +++ b/changelog/24170.txt @@ -0,0 +1,3 @@ +```release-note:bug +core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. +``` diff --git a/vault/auth.go b/vault/auth.go index 59ea4f401101..0c88561daffa 100644 --- a/vault/auth.go +++ b/vault/auth.go @@ -879,6 +879,7 @@ func (c *Core) setupCredentials(ctx context.Context) error { // Calculate any namespace prefixes here, because when Taint() is called, there won't be // a namespace to pull from the context. This is similar to what we do above in c.router.Mount(). path = entry.Namespace().Path + path + c.logger.Debug("tainting a mount due to it being marked as tainted in mount table", "entry.path", entry.Path, "entry.namespace.path", entry.Namespace().Path, "full_path", path) c.router.Taint(ctx, path) } diff --git a/vault/mount.go b/vault/mount.go index ff7bca06d2c4..0fca6c5e34ff 100644 --- a/vault/mount.go +++ b/vault/mount.go @@ -1593,7 +1593,11 @@ func (c *Core) setupMounts(ctx context.Context) error { // Ensure the path is tainted if set in the mount table if entry.Tainted { - c.router.Taint(ctx, entry.Path) + // Calculate any namespace prefixes here, because when Taint() is called, there won't be + // a namespace to pull from the context. This is similar to what we do above in c.router.Mount(). + path := entry.Namespace().Path + entry.Path + c.logger.Debug("tainting a mount due to it being marked as tainted in mount table", "entry.path", entry.Path, "entry.namespace.path", entry.Namespace().Path, "full_path", path) + c.router.Taint(ctx, path) } // Ensure the cache is populated, don't need the result