{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/54805762","id":54805762,"diff_hunk":"@@ -168,6 +176,98 @@ func namespacingFilter(handler http.Handler, contextMapper kapi.RequestContextMa\n \t})\n }\n \n+// versionSkewFilter adds a filter that may deny PUT an POST requests since they stomp entire resource objects from skewed\n+// oc clients, since we know that those clients will strip unknown fields which can lead to unexpected outcomes\n+func (c *MasterConfig) versionSkewFilter(binaryInfo version.Info, handler http.Handler) http.Handler {\n+\tskewedClientPolicy := c.Options.PolicyConfig.SkewedClientPolicy\n+\tif skewedClientPolicy == configapi.AllowAll {\n+\t\treturn handler\n+\t}\n+\tseg := strings.SplitN(binaryInfo.GitVersion, \"-\", 2)\n+\tserverVersionNumber := seg[0][1:]\n+\tserverCommit := binaryInfo.GitCommit\n+\tif len(serverCommit) > 7 {\n+\t\tserverCommit = serverCommit[:7]\n+\t}\n+\n+\treturn http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {\n+\t\tif req.Method != \"PUT\" && req.Method != \"POST\" {\n+\t\t\thandler.ServeHTTP(w, req)\n+\t\t\treturn\n+\t\t}\n+\n+\t\tuserAgent := req.Header.Get(\"User-Agent\")\n+\t\tif len(userAgent) == 0 {\n+\t\t\thandler.ServeHTTP(w, req)\n+\t\t\treturn\n+\t\t}\n+\n+\t\t// in pre-1.2 oc clients, the user agent is corrupted when we access kubernetes resources and incorrect versions\n+\t\t// are passed.  This means that we can't perform any comparison, so we allow this\n+\t\t// for example: oc/v1.2.0 (linux/amd64) kubernetes/bc4550d\n+\t\t// that value is passed for a 1.1.3 client when accessing kube resources\n+\t\tif strings.Contains(userAgent, \"kubernetes/\") {\n+\t\t\thandler.ServeHTTP(w, req)\n+\t\t\treturn\n+\t\t}\n+\n+\t\t// user agent is: binary/versionNumber (operating system) openshift/commit\n+\t\t// for example: oc/v1.1.3 (linux/amd64) openshift/9b52c41\n+\t\t// only match on oc.  This is very restrictive check.  We want to allow by default here.  Clients effectively \"opt-in\" to\n+\t\t// stop stomping things they don't recognize\n+\t\ttokens := strings.SplitN(userAgent, \"oc/v\", 2)\n+\t\tif len(tokens) != 2 {","path":"pkg/cmd/server/origin/handlers.go","position":90,"original_position":90,"commit_id":"919ca7d1fdf8c13bee11fde511337bf12baa4b8f","original_commit_id":"919ca7d1fdf8c13bee11fde511337bf12baa4b8f","user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"body":"\"oc\" is not the only client we will need to do this for.  So we should be prepared to expand to multiple client prefixes and types.","created_at":"2016-03-02T22:44:09Z","updated_at":"2016-03-02T22:44:09Z","html_url":"https://github.com/openshift/origin/pull/7741#discussion_r54805762","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/7741","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/54805762"},"html":{"href":"https://github.com/openshift/origin/pull/7741#discussion_r54805762"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/7741"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/7741","id":61456566,"html_url":"https://github.com/openshift/origin/pull/7741","diff_url":"https://github.com/openshift/origin/pull/7741.diff","patch_url":"https://github.com/openshift/origin/pull/7741.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/7741","number":7741,"state":"open","locked":false,"title":"Prevent client skew","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"body":"Adds an option to prevent skewed oc clients from performing PUT or POST (update or create) actions on the API server.  This can prevent weirdness where fields are dropped by old oc clients.  The default is to avoid restricting any client.  Any client not strictly conforming to `DefaultOpenShiftUserAgent` is allowed.\r\n\r\nAlso fixed here: update the server and client to always identify as openshift, not as kubernetes.  Our client is not the same as kube and the commits didn't really line up due to patches anyway.\r\n\r\n@fabianofranz @jwforres since you asked.\r\n@liggitt hold your nose, I don't think its ever going to smell nice.\r\n\r\nBuzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1306590","created_at":"2016-03-02T19:51:36Z","updated_at":"2016-03-02T22:44:09Z","closed_at":null,"merged_at":null,"merge_commit_sha":"e5610d9271d4aec13a9a1060bcdc9f2464dd3f0b","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/7741/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/7741/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/7741/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/919ca7d1fdf8c13bee11fde511337bf12baa4b8f","head":{"label":"deads2k:prevent-client-skew","ref":"prevent-client-skew","sha":"919ca7d1fdf8c13bee11fde511337bf12baa4b8f","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"repo":{"id":24424126,"name":"origin","full_name":"deads2k/origin","owner":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/deads2k/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/deads2k/origin","forks_url":"https://api.github.com/repos/deads2k/origin/forks","keys_url":"https://api.github.com/repos/deads2k/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/deads2k/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/deads2k/origin/teams","hooks_url":"https://api.github.com/repos/deads2k/origin/hooks","issue_events_url":"https://api.github.com/repos/deads2k/origin/issues/events{/number}","events_url":"https://api.github.com/repos/deads2k/origin/events","assignees_url":"https://api.github.com/repos/deads2k/origin/assignees{/user}","branches_url":"https://api.github.com/repos/deads2k/origin/branches{/branch}","tags_url":"https://api.github.com/repos/deads2k/origin/tags","blobs_url":"https://api.github.com/repos/deads2k/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/deads2k/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/deads2k/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/deads2k/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/deads2k/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/deads2k/origin/languages","stargazers_url":"https://api.github.com/repos/deads2k/origin/stargazers","contributors_url":"https://api.github.com/repos/deads2k/origin/contributors","subscribers_url":"https://api.github.com/repos/deads2k/origin/subscribers","subscription_url":"https://api.github.com/repos/deads2k/origin/subscription","commits_url":"https://api.github.com/repos/deads2k/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/deads2k/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/deads2k/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/deads2k/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/deads2k/origin/contents/{+path}","compare_url":"https://api.github.com/repos/deads2k/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/deads2k/origin/merges","archive_url":"https://api.github.com/repos/deads2k/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/deads2k/origin/downloads","issues_url":"https://api.github.com/repos/deads2k/origin/issues{/number}","pulls_url":"https://api.github.com/repos/deads2k/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/deads2k/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/deads2k/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/deads2k/origin/labels{/name}","releases_url":"https://api.github.com/repos/deads2k/origin/releases{/id}","deployments_url":"https://api.github.com/repos/deads2k/origin/deployments","created_at":"2014-09-24T17:02:12Z","updated_at":"2016-01-11T17:58:27Z","pushed_at":"2016-03-02T19:47:42Z","git_url":"git://github.com/deads2k/origin.git","ssh_url":"git@github.com:deads2k/origin.git","clone_url":"https://github.com/deads2k/origin.git","svn_url":"https://github.com/deads2k/origin","homepage":"https://openshift.github.io","size":224685,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"e102faac40ee44fefa72c62a5275343705406f26","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","deployments_url":"https://api.github.com/repos/openshift/origin/deployments","created_at":"2014-07-30T20:04:05Z","updated_at":"2016-03-02T13:19:31Z","pushed_at":"2016-03-02T22:28:32Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":276638,"stargazers_count":1088,"watchers_count":1088,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":666,"mirror_url":null,"open_issues_count":893,"forks":666,"open_issues":893,"watchers":1088,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/7741"},"html":{"href":"https://github.com/openshift/origin/pull/7741"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/7741"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/7741/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/7741/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/7741/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/919ca7d1fdf8c13bee11fde511337bf12baa4b8f"}}}}