From fd011ce8f2e0afea9b5964fc5aea927f3a3cf901 Mon Sep 17 00:00:00 2001 From: Will Nicholson <5702746+wjnicholson@users.noreply.github.com> Date: Tue, 14 Feb 2023 16:27:39 +0000 Subject: [PATCH] eventstream: Handle missing policy documents in event streams (#15495) Fixes https://github.com/hashicorp/nomad/issues/15493 Co-authored-by: Tim Gross --- .changelog/15495.txt | 3 +++ nomad/stream/event_broker.go | 14 ++++++++++++-- 2 files changed, 15 insertions(+), 2 deletions(-) create mode 100644 .changelog/15495.txt diff --git a/.changelog/15495.txt b/.changelog/15495.txt new file mode 100644 index 000000000..77b38170c --- /dev/null +++ b/.changelog/15495.txt @@ -0,0 +1,3 @@ +```release-note:bug +event stream: Fixed a bug where undefined ACL policies on the request's ACL would result in incorrect authentication errors +``` diff --git a/nomad/stream/event_broker.go b/nomad/stream/event_broker.go index 032a22020..55db9d3db 100644 --- a/nomad/stream/event_broker.go +++ b/nomad/stream/event_broker.go @@ -295,9 +295,14 @@ func aclObjFromSnapshotForTokenSecretID( for _, policyName := range aclToken.Policies { policy, err := aclSnapshot.ACLPolicyByName(nil, policyName) - if err != nil || policy == nil { + if err != nil { return nil, nil, errors.New("error finding acl policy") } + if policy == nil { + // Ignore policies that don't exist, since they don't grant any + // more privilege. + continue + } aclPolicies = append(aclPolicies, policy) } @@ -315,9 +320,14 @@ func aclObjFromSnapshotForTokenSecretID( for _, policyLink := range role.Policies { policy, err := aclSnapshot.ACLPolicyByName(nil, policyLink.Name) - if err != nil || policy == nil { + if err != nil { return nil, nil, errors.New("error finding acl policy") } + if policy == nil { + // Ignore policies that don't exist, since they don't grant any + // more privilege. + continue + } aclPolicies = append(aclPolicies, policy) } }