Merge commit from fork

* Adjust header handling

* wire in headerhandling in localproxy

Author: mjudeikis

pkg/proxy/authheaders/authheaders.go

@@ -30,19 +30,26 @@ import (
 	userinfo "k8s.io/apiserver/pkg/authentication/user"
 )
 
-// SetAuthHeaders stamps the given authenticated user's identity onto the request
-// headers, after deleting any inbound copies of the identity headers.
-//
-// This mirrors k8s.io/client-go/transport.SetAuthProxyHeaders and the upstream
-// requestheader authenticator's ClearAuthenticationHeaders.
-func SetAuthHeaders(header http.Header, user userinfo.Info, userHeader, groupHeader, extraHeaderPrefix string) {
+// ClearAuthHeaders deletes any inbound copies of the request-header identity
+// headers.
+func ClearAuthHeaders(header http.Header, userHeader, groupHeader, extraHeaderPrefix string) {
 	header.Del(userHeader)
 	header.Del(groupHeader)
+	lowerPrefix := strings.ToLower(extraHeaderPrefix)
 	for key := range header {
-		if strings.HasPrefix(strings.ToLower(key), strings.ToLower(extraHeaderPrefix)) {
+		if strings.HasPrefix(strings.ToLower(key), lowerPrefix) {
 			header.Del(key)
 		}
 	}
+}
+
+// SetAuthHeaders stamps the given authenticated user's identity onto the request
+// headers, after deleting any inbound copies of the identity headers.
+//
+// This mirrors k8s.io/client-go/transport.SetAuthProxyHeaders and the upstream
+// requestheader authenticator's ClearAuthenticationHeaders.
+func SetAuthHeaders(header http.Header, user userinfo.Info, userHeader, groupHeader, extraHeaderPrefix string) {
+	ClearAuthHeaders(header, userHeader, groupHeader, extraHeaderPrefix)
 
 	header.Set(userHeader, user.GetName())
 

pkg/proxy/proxy.go

@@ -60,6 +60,8 @@ func WithProxyAuthHeaders(delegate http.Handler, userHeader, groupHeader string,
 	return func(w http.ResponseWriter, r *http.Request) {
 		if u, ok := request.UserFrom(r.Context()); ok {
 			authheaders.SetAuthHeaders(r.Header, u, userHeader, groupHeader, extraHeaderPrefix)
+		} else {
+			authheaders.ClearAuthHeaders(r.Header, userHeader, groupHeader, extraHeaderPrefix)
 		}
 
 		delegate.ServeHTTP(w, r)

pkg/proxy/proxy_test.go

@@ -222,13 +222,30 @@ func TestWithProxyAuthHeaders_CustomHeaderNames(t *testing.T) {
 func TestWithProxyAuthHeaders_NoAuthenticatedUser(t *testing.T) {
 	t.Parallel()
 	var served bool
-	sink := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { served = true })
+	var forwarded http.Header
+	sink := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		served = true
+		forwarded = r.Header.Clone()
+	})
 	handler := WithProxyAuthHeaders(sink, defaultUserHeader, defaultGroupHeader, defaultExtraPrefix)
 
 	req := httptest.NewRequest(http.MethodGet, "https://front-proxy/api/v1/secrets", http.NoBody)
+	// No user in context (unauthenticated pass-through). Client forges identity.
+	req.Header.Set(defaultUserHeader, "kcp-admin")
+	req.Header.Add(defaultGroupHeader, "system:masters")
+	req.Header.Set(warrantExtraHeader, `{"user":"attacker","groups":["system:masters"]}`)
 	handler.ServeHTTP(httptest.NewRecorder(), req)
 
 	if !served {
 		t.Fatal("expected request to be passed through to delegate")
 	}
+	if v := forwarded.Values(defaultUserHeader); len(v) != 0 {
+		t.Errorf("forged user header leaked to shard: %v", v)
+	}
+	if v := forwarded.Values(defaultGroupHeader); len(v) != 0 {
+		t.Errorf("forged group header leaked to shard: %v", v)
+	}
+	if v := forwarded.Values(warrantExtraHeader); len(v) != 0 {
+		t.Errorf("forged warrant extra header leaked to shard: %v", v)
+	}
 }

pkg/server/localproxy.go

@@ -325,6 +325,8 @@ func withProxyAuthHeaders(delegate http.Handler, userHeader, groupHeader string,
 	return func(w http.ResponseWriter, r *http.Request) {
 		if u, ok := request.UserFrom(r.Context()); ok {
 			authheaders.SetAuthHeaders(r.Header, u, userHeader, groupHeader, extraHeaderPrefix)
+		} else {
+			authheaders.ClearAuthHeaders(r.Header, userHeader, groupHeader, extraHeaderPrefix)
 		}
 
 		delegate.ServeHTTP(w, r)