vendor protosanitizer

vendor/github.com/kubernetes-csi/csi-lib-utils/protosanitizer/protosanitizer.go

@@ -0,0 +1,138 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package protosanitizer supports logging of gRPC messages without
+// accidentally revealing sensitive fields.
+package protosanitizer
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/container-storage-interface/spec/lib/go/csi"
+	"github.com/golang/protobuf/descriptor"
+	"github.com/golang/protobuf/proto"
+	protobuf "github.com/golang/protobuf/protoc-gen-go/descriptor"
+)
+
+// StripSecrets returns a wrapper around the original CSI gRPC message
+// which has a Stringer implementation that serializes the message
+// as one-line JSON, but without including secret information.
+// Instead of the secret value(s), the string "***stripped***" is
+// included in the result.
+//
+// StripSecrets itself is fast and therefore it is cheap to pass the
+// result to logging functions which may or may not end up serializing
+// the parameter depending on the current log level.
+func StripSecrets(msg interface{}) fmt.Stringer {
+	return &stripSecrets{msg}
+}
+
+type stripSecrets struct {
+	msg interface{}
+}
+
+func (s *stripSecrets) String() string {
+	// First convert to a generic representation. That's less efficient
+	// than using reflect directly, but easier to work with.
+	var parsed interface{}
+	b, err := json.Marshal(s.msg)
+	if err != nil {
+		return fmt.Sprintf("<<json.Marshal %T: %s>>", s.msg, err)
+	}
+	if err := json.Unmarshal(b, &parsed); err != nil {
+		return fmt.Sprintf("<<json.Unmarshal %T: %s>>", s.msg, err)
+	}
+
+	// Now remove secrets from the generic representation of the message.
+	strip(parsed, s.msg)
+
+	// Re-encoded the stripped representation and return that.
+	b, err = json.Marshal(parsed)
+	if err != nil {
+		return fmt.Sprintf("<<json.Marshal %T: %s>>", s.msg, err)
+	}
+	return string(b)
+}
+
+func strip(parsed interface{}, msg interface{}) {
+	protobufMsg, ok := msg.(descriptor.Message)
+	if !ok {
+		// Not a protobuf message, so we are done.
+		return
+	}
+
+	// The corresponding map in the parsed JSON representation.
+	parsedFields, ok := parsed.(map[string]interface{})
+	if !ok {
+		// Probably nil.
+		return
+	}
+
+	// Walk through all fields and replace those with ***stripped*** that
+	// are marked as secret. This relies on protobuf adding "json:" tags
+	// on each field where the name matches the field name in the protobuf
+	// spec (like volume_capabilities). The field.GetJsonName() method returns
+	// a different name (volumeCapabilities) which we don't use.
+	_, md := descriptor.ForMessage(protobufMsg)
+	fields := md.GetField()
+	if fields != nil {
+		for _, field := range fields {
+			ex, err := proto.GetExtension(field.Options, csi.E_CsiSecret)
+			if err == nil && ex != nil && *ex.(*bool) {
+				// Overwrite only if already set.
+				if _, ok := parsedFields[field.GetName()]; ok {
+					parsedFields[field.GetName()] = "***stripped***"
+				}
+			} else if field.GetType() == protobuf.FieldDescriptorProto_TYPE_MESSAGE {
+				// When we get here,
+				// the type name is something like ".csi.v1.CapacityRange" (leading dot!)
+				// and looking up "csi.v1.CapacityRange"
+				// returns the type of a pointer to a pointer
+				// to CapacityRange. We need a pointer to such
+				// a value for recursive stripping.
+				typeName := field.GetTypeName()
+				if strings.HasPrefix(typeName, ".") {
+					typeName = typeName[1:]
+				}
+				t := proto.MessageType(typeName)
+				if t == nil || t.Kind() != reflect.Ptr {
+					// Shouldn't happen, but
+					// better check anyway instead
+					// of panicking.
+					continue
+				}
+				v := reflect.New(t.Elem())
+
+				// Recursively strip the message(s) that
+				// the field contains.
+				i := v.Interface()
+				entry := parsedFields[field.GetName()]
+				if slice, ok := entry.([]interface{}); ok {
+					// Array of values, like VolumeCapabilities in CreateVolumeRequest.
+					for _, entry := range slice {
+						strip(entry, i)
+					}
+				} else {
+					// Single value.
+					strip(entry, i)
+				}
+			}
+		}
+	}
+}

vendor/github.com/kubernetes-csi/csi-lib-utils/protosanitizer/protosanitizer_test.go

@@ -0,0 +1,160 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protosanitizer
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/container-storage-interface/spec/lib/go/csi"
+	"github.com/kubernetes-csi/csi-lib-utils/protosanitizer/test/csitest"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStripSecrets(t *testing.T) {
+	secretName := "secret-abc"
+	secretValue := "123"
+	createVolume := &csi.CreateVolumeRequest{
+		AccessibilityRequirements: &csi.TopologyRequirement{
+			Requisite: []*csi.Topology{
+				&csi.Topology{
+					Segments: map[string]string{
+						"foo": "bar",
+						"x":   "y",
+					},
+				},
+				&csi.Topology{
+					Segments: map[string]string{
+						"a": "b",
+					},
+				},
+			},
+		},
+		Name: "foo",
+		VolumeCapabilities: []*csi.VolumeCapability{
+			&csi.VolumeCapability{
+				AccessType: &csi.VolumeCapability_Mount{
+					Mount: &csi.VolumeCapability_MountVolume{
+						FsType: "ext4",
+					},
+				},
+			},
+		},
+		CapacityRange: &csi.CapacityRange{
+			RequiredBytes: 1024,
+		},
+		Secrets: map[string]string{
+			secretName:   secretValue,
+			"secret-xyz": "987",
+		},
+	}
+
+	cases := []struct {
+		original, stripped interface{}
+	}{
+		{nil, "null"},
+		{1, "1"},
+		{"hello world", `"hello world"`},
+		{true, "true"},
+		{false, "false"},
+		{&csi.CreateVolumeRequest{}, `{}`},
+		// Test case from https://github.com/kubernetes-csi/csi-lib-utils/pull/1#pullrequestreview-180126394.
+		{&csi.CreateVolumeRequest{
+			Name: "test-volume",
+			CapacityRange: &csi.CapacityRange{
+				RequiredBytes: int64(1024),
+				LimitBytes:    int64(1024),
+			},
+			VolumeCapabilities: []*csi.VolumeCapability{
+				&csi.VolumeCapability{
+					AccessType: &csi.VolumeCapability_Mount{
+						Mount: &csi.VolumeCapability_MountVolume{
+							FsType:     "ext4",
+							MountFlags: []string{"flag1", "flag2", "flag3"},
+						},
+					},
+					AccessMode: &csi.VolumeCapability_AccessMode{
+						Mode: csi.VolumeCapability_AccessMode_MULTI_NODE_MULTI_WRITER,
+					},
+				},
+			},
+			Secrets:                   map[string]string{"secret1": "secret1", "secret2": "secret2"},
+			Parameters:                map[string]string{"param1": "param1", "param2": "param2"},
+			VolumeContentSource:       &csi.VolumeContentSource{},
+			AccessibilityRequirements: &csi.TopologyRequirement{},
+		}, `{"accessibility_requirements":{},"capacity_range":{"limit_bytes":1024,"required_bytes":1024},"name":"test-volume","parameters":{"param1":"param1","param2":"param2"},"secrets":"***stripped***","volume_capabilities":[{"AccessType":{"Mount":{"fs_type":"ext4","mount_flags":["flag1","flag2","flag3"]}},"access_mode":{"mode":5}}],"volume_content_source":{"Type":null}}`},
+		{createVolume, `{"accessibility_requirements":{"requisite":[{"segments":{"foo":"bar","x":"y"}},{"segments":{"a":"b"}}]},"capacity_range":{"required_bytes":1024},"name":"foo","secrets":"***stripped***","volume_capabilities":[{"AccessType":{"Mount":{"fs_type":"ext4"}}}]}`},
+		{&csitest.CreateVolumeRequest{}, `{}`},
+		{&csitest.CreateVolumeRequest{
+			CapacityRange: &csitest.CapacityRange{
+				RequiredBytes: 1024,
+			},
+			MaybeSecretMap: map[int64]*csitest.VolumeCapability{
+				1: &csitest.VolumeCapability{ArraySecret: "aaa"},
+				2: &csitest.VolumeCapability{ArraySecret: "bbb"},
+			},
+			Name:         "foo",
+			NewSecretInt: 42,
+			Seecreets: map[string]string{
+				secretName:   secretValue,
+				"secret-xyz": "987",
+			},
+			VolumeCapabilities: []*csitest.VolumeCapability{
+				&csitest.VolumeCapability{
+					AccessType: &csitest.VolumeCapability_Mount{
+						Mount: &csitest.VolumeCapability_MountVolume{
+							FsType: "ext4",
+						},
+					},
+					ArraySecret: "knock knock",
+				},
+				&csitest.VolumeCapability{
+					ArraySecret: "Who's there?",
+				},
+			},
+			VolumeContentSource: &csitest.VolumeContentSource{
+				Type: &csitest.VolumeContentSource_Volume{
+					Volume: &csitest.VolumeContentSource_VolumeSource{
+						VolumeId:         "abc",
+						OneofSecretField: "hello",
+					},
+				},
+				NestedSecretField: "world",
+			},
+		},
+			// Secrets are *not* removed from all fields yet. This will have to be fixed one way or another
+			// before the CSI spec can start using secrets there (currently it doesn't).
+			// The test is still useful because it shows that also complicated fields get serialized.
+			// `{"capacity_range":{"required_bytes":1024},"maybe_secret_map":{"1":{"AccessType":null,"array_secret":"***stripped***"},"2":{"AccessType":null,"array_secret":"***stripped***"}},"name":"foo","new_secret_int":"***stripped***","seecreets":"***stripped***","volume_capabilities":[{"AccessType":{"Mount":{"fs_type":"ext4"}},"array_secret":"***stripped***"},{"AccessType":null,"array_secret":"***stripped***"}],"volume_content_source":{"Type":{"Volume":{"oneof_secret_field":"***stripped***","volume_id":"abc"}},"nested_secret_field":"***stripped***"}}`,
+			`{"capacity_range":{"required_bytes":1024},"maybe_secret_map":{"1":{"AccessType":null,"array_secret":"aaa"},"2":{"AccessType":null,"array_secret":"bbb"}},"name":"foo","new_secret_int":"***stripped***","seecreets":"***stripped***","volume_capabilities":[{"AccessType":{"Mount":{"fs_type":"ext4"}},"array_secret":"***stripped***"},{"AccessType":null,"array_secret":"***stripped***"}],"volume_content_source":{"Type":{"Volume":{"oneof_secret_field":"hello","volume_id":"abc"}},"nested_secret_field":"***stripped***"}}`,
+		},
+	}
+
+	for _, c := range cases {
+		before := fmt.Sprint(c.original)
+		stripped := StripSecrets(c.original)
+		if assert.Equal(t, c.stripped, fmt.Sprintf("%s", stripped), "unexpected result for fmt s of %s", c.original) {
+			assert.Equal(t, c.stripped, fmt.Sprintf("%v", stripped), "unexpected result for fmt v of %s", c.original)
+		}
+		assert.Equal(t, before, fmt.Sprint(c.original), "original value modified")
+	}
+
+	// The secret is hidden because StripSecrets is a struct referencing it.
+	dump := fmt.Sprintf("%#v", StripSecrets(createVolume))
+	assert.NotContains(t, dump, secretName)
+	assert.NotContains(t, dump, secretValue)
+}

vendor/github.com/kubernetes-csi/csi-lib-utils/protosanitizer/test/.gitignore

@@ -0,0 +1,5 @@
+/protoc
+/protoc-gen-go
+/csi.a
+/.protoc
+.build

vendor/github.com/kubernetes-csi/csi-lib-utils/protosanitizer/test/Makefile

@@ -0,0 +1,136 @@
+all: build
+
+########################################################################
+##                             GOLANG                                 ##
+########################################################################
+
+# If GOPATH isn't defined then set its default location.
+ifeq (,$(strip $(GOPATH)))
+GOPATH := $(HOME)/go
+else
+# If GOPATH is already set then update GOPATH to be its own
+# first element.
+GOPATH := $(word 1,$(subst :, ,$(GOPATH)))
+endif
+export GOPATH
+
+
+########################################################################
+##                             PROTOC                                 ##
+########################################################################
+
+# Only set PROTOC_VER if it has an empty value.
+ifeq (,$(strip $(PROTOC_VER)))
+PROTOC_VER := 3.5.1
+endif
+
+PROTOC_OS := $(shell uname -s)
+ifeq (Darwin,$(PROTOC_OS))
+PROTOC_OS := osx
+endif
+
+PROTOC_ARCH := $(shell uname -m)
+ifeq (i386,$(PROTOC_ARCH))
+PROTOC_ARCH := x86_32
+endif
+
+PROTOC := ./protoc
+PROTOC_ZIP := protoc-$(PROTOC_VER)-$(PROTOC_OS)-$(PROTOC_ARCH).zip
+PROTOC_URL := https://github.com/google/protobuf/releases/download/v$(PROTOC_VER)/$(PROTOC_ZIP)
+PROTOC_TMP_DIR := .protoc
+PROTOC_TMP_BIN := $(PROTOC_TMP_DIR)/bin/protoc
+
+$(PROTOC):
+	-mkdir -p "$(PROTOC_TMP_DIR)" && \
+	  curl -L $(PROTOC_URL) -o "$(PROTOC_TMP_DIR)/$(PROTOC_ZIP)" && \
+	  unzip "$(PROTOC_TMP_DIR)/$(PROTOC_ZIP)" -d "$(PROTOC_TMP_DIR)" && \
+	  chmod 0755 "$(PROTOC_TMP_BIN)" && \
+	  cp -f "$(PROTOC_TMP_BIN)" "$@"
+	stat "$@" > /dev/null 2>&1
+
+
+########################################################################
+##                          PROTOC-GEN-GO                             ##
+########################################################################
+
+# This is the recipe for getting and installing the go plug-in
+# for protoc
+PROTOC_GEN_GO_PKG := github.com/golang/protobuf/protoc-gen-go
+PROTOC_GEN_GO := protoc-gen-go
+$(PROTOC_GEN_GO): PROTOBUF_PKG := $(dir $(PROTOC_GEN_GO_PKG))
+$(PROTOC_GEN_GO): PROTOBUF_VERSION := v1.2.0
+$(PROTOC_GEN_GO):
+	mkdir -p $(dir $(GOPATH)/src/$(PROTOBUF_PKG))
+	test -d $(GOPATH)/src/$(PROTOBUF_PKG)/.git || git clone https://$(PROTOBUF_PKG) $(GOPATH)/src/$(PROTOBUF_PKG)
+	(cd $(GOPATH)/src/$(PROTOBUF_PKG) && \
+		(test "$$(git describe --tags | head -1)" = "$(PROTOBUF_VERSION)" || \
+			(git fetch && git checkout tags/$(PROTOBUF_VERSION))))
+	(cd $(GOPATH)/src/$(PROTOBUF_PKG) && go get -v -d $$(go list -f '{{ .ImportPath }}' ./...)) && \
+	go build -o "$@" $(PROTOC_GEN_GO_PKG)
+
+
+########################################################################
+##                              PATH                                  ##
+########################################################################
+
+# Update PATH with the current directory. This enables the protoc
+# binary to discover the protoc-gen-go binary, built inside this
+# directory.
+export PATH := $(shell pwd):$(PATH)
+
+
+########################################################################
+##                              BUILD                                 ##
+########################################################################
+CSI_PROTO := ./csitest.proto
+CSI_PKG_ROOT := github.com/kubernetes-csi/csi-lib-utils/protosanitizer/test
+CSI_PKG_SUB := $(shell cat $(CSI_PROTO) | sed -n -e 's/^package.\([^;]*\).v[0-9]\+;$$/\1/p'|tr '.' '/')
+CSI_BUILD := $(CSI_PKG_SUB)/.build
+CSI_GO := $(CSI_PKG_SUB)/csitest.pb.go
+CSI_A := csi.a
+CSI_GO_TMP := $(CSI_BUILD)/$(CSI_PKG_ROOT)/csitest.pb.go
+
+# This recipe generates the go language bindings to a temp area.
+$(CSI_GO_TMP): HERE := $(shell pwd)
+$(CSI_GO_TMP): PTYPES_PKG := github.com/golang/protobuf/ptypes
+$(CSI_GO_TMP): GO_OUT := plugins=grpc
+$(CSI_GO_TMP): GO_OUT := $(GO_OUT),Mgoogle/protobuf/descriptor.proto=github.com/golang/protobuf/protoc-gen-go/descriptor
+$(CSI_GO_TMP): GO_OUT := $(GO_OUT),Mgoogle/protobuf/wrappers.proto=$(PTYPES_PKG)/wrappers
+$(CSI_GO_TMP): GO_OUT := $(GO_OUT):"$(HERE)/$(CSI_BUILD)"
+$(CSI_GO_TMP): INCLUDE := -I$(GOPATH)/src -I$(HERE)/$(PROTOC_TMP_DIR)/include
+$(CSI_GO_TMP): $(CSI_PROTO) | $(PROTOC) $(PROTOC_GEN_GO)
+	@mkdir -p "$(@D)"
+	(cd "$(GOPATH)/src" && \
+		$(HERE)/$(PROTOC) $(INCLUDE) --go_out=$(GO_OUT) "$(CSI_PKG_ROOT)/$(<F)")
+
+# The temp language bindings are compared to the ones that are
+# versioned. If they are different then it means the language
+# bindings were not updated prior to being committed.
+$(CSI_GO): $(CSI_GO_TMP)
+ifeq (true,$(TRAVIS))
+	diff "$@" "$?"
+else
+	@mkdir -p "$(@D)"
+	diff "$@" "$?" > /dev/null 2>&1 || cp -f "$?" "$@"
+endif
+
+# This recipe builds the Go archive from the sources in three steps:
+#
+#   1. Go get any missing dependencies.
+#   2. Cache the packages.
+#   3. Build the archive file.
+$(CSI_A): $(CSI_GO)
+	go get -v -d ./...
+	go install ./$(CSI_PKG_SUB)
+	go build -o "$@" ./$(CSI_PKG_SUB)
+
+build: $(CSI_A)
+
+clean:
+	go clean -i ./...
+	rm -rf "$(CSI_A)" "$(CSI_GO)" "$(CSI_BUILD)"
+
+clobber: clean
+	rm -fr "$(PROTOC)" "$(PROTOC_GEN_GO)" "$(CSI_PKG_SUB)" "$(PROTOC_TMP_DIR)"
+
+.PHONY: clean clobber

vendor/github.com/kubernetes-csi/csi-lib-utils/protosanitizer/test/README.md

@@ -0,0 +1,2 @@
+This is a *modified* version of the CSI 1.0.0 spec. It's only purpose is
+to test the stripping of secret fields.