{"action":"created","comment":{"url":"https://api.github.com/repos/coreos/etcd/pulls/comments/68801658","id":68801658,"diff_hunk":"@@ -110,23 +116,27 @@ type AuthStore interface {\n \t// RoleList gets a list of all roles\n \tRoleList(r *pb.AuthRoleListRequest) (*pb.AuthRoleListResponse, error)\n \n-\t// UsernameFromToken gets a username from the given Token\n-\tUsernameFromToken(token string) (string, bool)\n+\t// AuthInfoFromToken gets a username from the given Token and current revision number\n+\t// (The revision number is used for preventing the TOCTOU problem)\n+\tAuthInfoFromToken(token string) (string, uint64, bool)","path":"auth/store.go","position":40,"original_position":40,"commit_id":"808d19bf8e55ed97acb584303f98af5b16dd5f0d","original_commit_id":"808d19bf8e55ed97acb584303f98af5b16dd5f0d","user":{"login":"heyitsanthony","id":16294350,"avatar_url":"https://avatars.githubusercontent.com/u/16294350?v=3","gravatar_id":"","url":"https://api.github.com/users/heyitsanthony","html_url":"https://github.com/heyitsanthony","followers_url":"https://api.github.com/users/heyitsanthony/followers","following_url":"https://api.github.com/users/heyitsanthony/following{/other_user}","gists_url":"https://api.github.com/users/heyitsanthony/gists{/gist_id}","starred_url":"https://api.github.com/users/heyitsanthony/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/heyitsanthony/subscriptions","organizations_url":"https://api.github.com/users/heyitsanthony/orgs","repos_url":"https://api.github.com/users/heyitsanthony/repos","events_url":"https://api.github.com/users/heyitsanthony/events{/privacy}","received_events_url":"https://api.github.com/users/heyitsanthony/received_events","type":"User","site_admin":false},"body":"the user and rev are used together everywhere, it would probably be cleaner to have `type AuthUser struct { user string; rev int64}` instead of having them separate","created_at":"2016-06-28T17:19:46Z","updated_at":"2016-06-28T17:19:46Z","html_url":"https://github.com/coreos/etcd/pull/5793#discussion_r68801658","pull_request_url":"https://api.github.com/repos/coreos/etcd/pulls/5793","_links":{"self":{"href":"https://api.github.com/repos/coreos/etcd/pulls/comments/68801658"},"html":{"href":"https://github.com/coreos/etcd/pull/5793#discussion_r68801658"},"pull_request":{"href":"https://api.github.com/repos/coreos/etcd/pulls/5793"}}},"pull_request":{"url":"https://api.github.com/repos/coreos/etcd/pulls/5793","id":75455083,"html_url":"https://github.com/coreos/etcd/pull/5793","diff_url":"https://github.com/coreos/etcd/pull/5793.diff","patch_url":"https://github.com/coreos/etcd/pull/5793.patch","issue_url":"https://api.github.com/repos/coreos/etcd/issues/5793","number":5793,"state":"open","locked":false,"title":"auth, etcdserver: introduce revision of authStore for avoiding TOCTOU problem","user":{"login":"mitake","id":1173955,"avatar_url":"https://avatars.githubusercontent.com/u/1173955?v=3","gravatar_id":"","url":"https://api.github.com/users/mitake","html_url":"https://github.com/mitake","followers_url":"https://api.github.com/users/mitake/followers","following_url":"https://api.github.com/users/mitake/following{/other_user}","gists_url":"https://api.github.com/users/mitake/gists{/gist_id}","starred_url":"https://api.github.com/users/mitake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitake/subscriptions","organizations_url":"https://api.github.com/users/mitake/orgs","repos_url":"https://api.github.com/users/mitake/repos","events_url":"https://api.github.com/users/mitake/events{/privacy}","received_events_url":"https://api.github.com/users/mitake/received_events","type":"User","site_admin":false},"body":"\r\nThis commit introduces revision of authStore. The revision number\r\nrepresents a version of authStore that is incremented by updating auth\r\nrelated information.\r\n\r\nThe revision is required for avoiding TOCTOU problems. Currently there\r\nare two types of the TOCTOU problems in v3 auth.\r\n\r\nThe first one is in ordinal linearizable requests with a sequence like\r\nbelow ():\r\n1. Request from client CA is processed in follower FA. FA looks up the\r\n   username (let it U) for the request from a token of the request. At\r\n   this time, the request is authorized correctly.\r\n2. Another request from client CB is processed in follower FB. CB\r\n   is for changing U's password.\r\n3. FB forwards the request from CB to the leader before FA. Now U's\r\n   password is updated and the request from CA should be rejected.\r\n4. However, the request from CA is processed by the leader because\r\n   authentication is already done in FA.\r\n\r\nFor avoiding the above sequence, this commit lets\r\netcdserverpb.RequestHeader have a member revision. The member is\r\ninitialized during authentication by followers and checked in a\r\nleader. If the revision in RequestHeader is lower than the leader's\r\nauthStore revision, it means a sequence like above happened. The\r\nclient needs to be authenticated again.\r\n\r\nThe second one, a case of serializable range and txn, is more\r\nsubtle. Because these requests are processed in follower directly. The\r\nTOCTOU problem can be caused by a sequence like below:\r\n1. Serializable request from client CA is processed in follower FA. At\r\n   first, FA looks up the username (let it U) and its permission\r\n   before actual access to KV.\r\n2. Another request from client CB is processed in follower FB and\r\n   forwarded to the leader. The cluster including FA now commits a log\r\n   entry of the request from CB. Assume the request changed the\r\n   permission or password of U.\r\n3. Now the serializable request from CA is accessing to KV. Even if\r\n   the access is allowed at the point of 1, now it can be invalid\r\n   because of the change introduced in 2.\r\n\r\nFor avoiding the above sequence, this commit lets the functions of\r\nserializable requests (EtcdServer.Range() and EtcdServer.Txn()) save\r\nrevision of requests before processing them and compare the saved\r\nrevision with the latest revision of authStore after the actual\r\naccess. If the saved revision is lower than the latest one, it means\r\nthe permission can be changed. Although it would introduce false\r\npositives (e.g. changing other user's password), it prevents the\r\nTOCTOU problem. This idea is an implementation of Anthony's comment:\r\nhttps://github.com/coreos/etcd/pull/5739#issuecomment-228128254\r\n\r\n/cc @heyitsanthony @xiang90 ","created_at":"2016-06-28T10:39:16Z","updated_at":"2016-06-28T17:19:46Z","closed_at":null,"merged_at":null,"merge_commit_sha":"6ea5b3328e2a17072aeb315fff069f6480c4b9fe","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/coreos/etcd/pulls/5793/commits","review_comments_url":"https://api.github.com/repos/coreos/etcd/pulls/5793/comments","review_comment_url":"https://api.github.com/repos/coreos/etcd/pulls/comments{/number}","comments_url":"https://api.github.com/repos/coreos/etcd/issues/5793/comments","statuses_url":"https://api.github.com/repos/coreos/etcd/statuses/808d19bf8e55ed97acb584303f98af5b16dd5f0d","head":{"label":"mitake:auth-revision","ref":"auth-revision","sha":"808d19bf8e55ed97acb584303f98af5b16dd5f0d","user":{"login":"mitake","id":1173955,"avatar_url":"https://avatars.githubusercontent.com/u/1173955?v=3","gravatar_id":"","url":"https://api.github.com/users/mitake","html_url":"https://github.com/mitake","followers_url":"https://api.github.com/users/mitake/followers","following_url":"https://api.github.com/users/mitake/following{/other_user}","gists_url":"https://api.github.com/users/mitake/gists{/gist_id}","starred_url":"https://api.github.com/users/mitake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitake/subscriptions","organizations_url":"https://api.github.com/users/mitake/orgs","repos_url":"https://api.github.com/users/mitake/repos","events_url":"https://api.github.com/users/mitake/events{/privacy}","received_events_url":"https://api.github.com/users/mitake/received_events","type":"User","site_admin":false},"repo":{"id":40219422,"name":"etcd","full_name":"mitake/etcd","owner":{"login":"mitake","id":1173955,"avatar_url":"https://avatars.githubusercontent.com/u/1173955?v=3","gravatar_id":"","url":"https://api.github.com/users/mitake","html_url":"https://github.com/mitake","followers_url":"https://api.github.com/users/mitake/followers","following_url":"https://api.github.com/users/mitake/following{/other_user}","gists_url":"https://api.github.com/users/mitake/gists{/gist_id}","starred_url":"https://api.github.com/users/mitake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitake/subscriptions","organizations_url":"https://api.github.com/users/mitake/orgs","repos_url":"https://api.github.com/users/mitake/repos","events_url":"https://api.github.com/users/mitake/events{/privacy}","received_events_url":"https://api.github.com/users/mitake/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mitake/etcd","description":"A distributed consistent key-value store for shared configuration and service discovery","fork":true,"url":"https://api.github.com/repos/mitake/etcd","forks_url":"https://api.github.com/repos/mitake/etcd/forks","keys_url":"https://api.github.com/repos/mitake/etcd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mitake/etcd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mitake/etcd/teams","hooks_url":"https://api.github.com/repos/mitake/etcd/hooks","issue_events_url":"https://api.github.com/repos/mitake/etcd/issues/events{/number}","events_url":"https://api.github.com/repos/mitake/etcd/events","assignees_url":"https://api.github.com/repos/mitake/etcd/assignees{/user}","branches_url":"https://api.github.com/repos/mitake/etcd/branches{/branch}","tags_url":"https://api.github.com/repos/mitake/etcd/tags","blobs_url":"https://api.github.com/repos/mitake/etcd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mitake/etcd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mitake/etcd/git/refs{/sha}","trees_url":"https://api.github.com/repos/mitake/etcd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mitake/etcd/statuses/{sha}","languages_url":"https://api.github.com/repos/mitake/etcd/languages","stargazers_url":"https://api.github.com/repos/mitake/etcd/stargazers","contributors_url":"https://api.github.com/repos/mitake/etcd/contributors","subscribers_url":"https://api.github.com/repos/mitake/etcd/subscribers","subscription_url":"https://api.github.com/repos/mitake/etcd/subscription","commits_url":"https://api.github.com/repos/mitake/etcd/commits{/sha}","git_commits_url":"https://api.github.com/repos/mitake/etcd/git/commits{/sha}","comments_url":"https://api.github.com/repos/mitake/etcd/comments{/number}","issue_comment_url":"https://api.github.com/repos/mitake/etcd/issues/comments{/number}","contents_url":"https://api.github.com/repos/mitake/etcd/contents/{+path}","compare_url":"https://api.github.com/repos/mitake/etcd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mitake/etcd/merges","archive_url":"https://api.github.com/repos/mitake/etcd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mitake/etcd/downloads","issues_url":"https://api.github.com/repos/mitake/etcd/issues{/number}","pulls_url":"https://api.github.com/repos/mitake/etcd/pulls{/number}","milestones_url":"https://api.github.com/repos/mitake/etcd/milestones{/number}","notifications_url":"https://api.github.com/repos/mitake/etcd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mitake/etcd/labels{/name}","releases_url":"https://api.github.com/repos/mitake/etcd/releases{/id}","deployments_url":"https://api.github.com/repos/mitake/etcd/deployments","created_at":"2015-08-05T02:10:59Z","updated_at":"2015-08-05T02:11:01Z","pushed_at":"2016-06-28T10:38:11Z","git_url":"git://github.com/mitake/etcd.git","ssh_url":"git@github.com:mitake/etcd.git","clone_url":"https://github.com/mitake/etcd.git","svn_url":"https://github.com/mitake/etcd","homepage":"","size":26260,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"coreos:master","ref":"master","sha":"0cd5c658aad0372d1651f006b0739d82ca0fc20a","user":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"repo":{"id":11225014,"name":"etcd","full_name":"coreos/etcd","owner":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/coreos/etcd","description":"Distributed reliable key-value store for the most critical data of a distributed system","fork":false,"url":"https://api.github.com/repos/coreos/etcd","forks_url":"https://api.github.com/repos/coreos/etcd/forks","keys_url":"https://api.github.com/repos/coreos/etcd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/coreos/etcd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/coreos/etcd/teams","hooks_url":"https://api.github.com/repos/coreos/etcd/hooks","issue_events_url":"https://api.github.com/repos/coreos/etcd/issues/events{/number}","events_url":"https://api.github.com/repos/coreos/etcd/events","assignees_url":"https://api.github.com/repos/coreos/etcd/assignees{/user}","branches_url":"https://api.github.com/repos/coreos/etcd/branches{/branch}","tags_url":"https://api.github.com/repos/coreos/etcd/tags","blobs_url":"https://api.github.com/repos/coreos/etcd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/coreos/etcd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/coreos/etcd/git/refs{/sha}","trees_url":"https://api.github.com/repos/coreos/etcd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/coreos/etcd/statuses/{sha}","languages_url":"https://api.github.com/repos/coreos/etcd/languages","stargazers_url":"https://api.github.com/repos/coreos/etcd/stargazers","contributors_url":"https://api.github.com/repos/coreos/etcd/contributors","subscribers_url":"https://api.github.com/repos/coreos/etcd/subscribers","subscription_url":"https://api.github.com/repos/coreos/etcd/subscription","commits_url":"https://api.github.com/repos/coreos/etcd/commits{/sha}","git_commits_url":"https://api.github.com/repos/coreos/etcd/git/commits{/sha}","comments_url":"https://api.github.com/repos/coreos/etcd/comments{/number}","issue_comment_url":"https://api.github.com/repos/coreos/etcd/issues/comments{/number}","contents_url":"https://api.github.com/repos/coreos/etcd/contents/{+path}","compare_url":"https://api.github.com/repos/coreos/etcd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/coreos/etcd/merges","archive_url":"https://api.github.com/repos/coreos/etcd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/coreos/etcd/downloads","issues_url":"https://api.github.com/repos/coreos/etcd/issues{/number}","pulls_url":"https://api.github.com/repos/coreos/etcd/pulls{/number}","milestones_url":"https://api.github.com/repos/coreos/etcd/milestones{/number}","notifications_url":"https://api.github.com/repos/coreos/etcd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/coreos/etcd/labels{/name}","releases_url":"https://api.github.com/repos/coreos/etcd/releases{/id}","deployments_url":"https://api.github.com/repos/coreos/etcd/deployments","created_at":"2013-07-06T21:57:21Z","updated_at":"2016-06-28T13:29:09Z","pushed_at":"2016-06-28T16:36:32Z","git_url":"git://github.com/coreos/etcd.git","ssh_url":"git@github.com:coreos/etcd.git","clone_url":"https://github.com/coreos/etcd.git","svn_url":"https://github.com/coreos/etcd","homepage":"https://coreos.com/etcd/docs/latest/","size":32764,"stargazers_count":10031,"watchers_count":10031,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1691,"mirror_url":null,"open_issues_count":129,"forks":1691,"open_issues":129,"watchers":10031,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/coreos/etcd/pulls/5793"},"html":{"href":"https://github.com/coreos/etcd/pull/5793"},"issue":{"href":"https://api.github.com/repos/coreos/etcd/issues/5793"},"comments":{"href":"https://api.github.com/repos/coreos/etcd/issues/5793/comments"},"review_comments":{"href":"https://api.github.com/repos/coreos/etcd/pulls/5793/comments"},"review_comment":{"href":"https://api.github.com/repos/coreos/etcd/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/coreos/etcd/pulls/5793/commits"},"statuses":{"href":"https://api.github.com/repos/coreos/etcd/statuses/808d19bf8e55ed97acb584303f98af5b16dd5f0d"}}}}
{"actor":{"display_login":"heyitsanthony"}}