[SERVER-34653] don't even parse requiresAuth commands unless client is authenticated Created: 24/Apr/18  Updated: 29/Oct/23  Resolved: 31/May/18

Status: Closed
Project: Core Server
Component/s: Internal Code
Affects Version/s: None
Fix Version/s: 4.0.0, 4.1.1

Type: Improvement Priority: Major - P3
Reporter: Billy Donahue Assignee: Billy Donahue
Resolution: Fixed Votes: 0
Labels: security
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Backports
Duplicate
Problem/Incident
causes SERVER-35382 _isSelf command needs to be marked re... Closed
causes SERVER-35463 Mark listCommands as pre-auth Closed
Related
related to SERVER-35463 Mark listCommands as pre-auth Closed
related to SERVER-12143 Make some unauthenticated commands re... Closed
is related to SERVER-38390 Set requiresAuth to false for certain... Closed
Backwards Compatibility: Fully Compatible
Backport Requested:
v4.0, v3.6
Sprint: Platforms 2018-05-07, Platforms 2018-05-21, Platforms 2018-06-04
Participants:
Linked BF Score: 45

 Description   

Most Commands have a requiresAuth()==true condition (the default).
For those commands, we shouldn't parse() their request unless the client is authenticated.

These requests are going to be rejected anyway, so there's no user-visible change, but we could be making the rejection decision more securely and efficiently.



 Comments   
Comment by Githook User [ 05/Jun/18 ]

Author:

{'username': 'BillyDonahue', 'name': 'Billy Donahue', 'email': 'billy.donahue@mongodb.com'}

Message: SERVER-34653 don't parse if early auth-checks can reject.

(cherry picked from commit 85dc8dd191cbfcddd94a0ac0216f07c7be616cd6)
Branch: v4.0
https://github.com/mongodb/mongo/commit/48738cf690a1b14974af3750ced131ff903fa973

Comment by Billy Donahue [ 01/Jun/18 ]

https://github.com/mongodb/mongo/commit/85dc8dd191cbfcddd94a0ac0216f07c7be616cd6
Causes a test to start failing with a timeout on debian.
https://evergreen.mongodb.com/task/mongodb_mongo_master_debian92_noPassthrough_85dc8dd191cbfcddd94a0ac0216f07c7be616cd6_18_05_31_22_33_05

Comment by Githook User [ 31/May/18 ]

Author:

{'username': 'BillyDonahue', 'name': 'Billy Donahue', 'email': 'billy.donahue@mongodb.com'}

Message: Revert "Revert "SERVER-34653 don't parse if early auth-checks can reject.""

This reverts commit 7d0ea48dc8522f41e93b86d9c8f77c64b623ba60.

no MakeGuard (the lambda might throw)
Branch: master
https://github.com/mongodb/mongo/commit/85dc8dd191cbfcddd94a0ac0216f07c7be616cd6

Comment by Billy Donahue [ 29/May/18 ]

https://mongodbcr.appspot.com/203750003/

Comment by Githook User [ 25/May/18 ]

Author:

{'username': 'louiswilliams', 'name': 'Louis Williams', 'email': 'louis.williams@mongodb.com'}

Message: Revert "SERVER-34653 don't parse if early auth-checks can reject."

This reverts commit f2e762dc80e63fa47bd4c1d48e05f628464b0f54.
Branch: master
https://github.com/mongodb/mongo/commit/7d0ea48dc8522f41e93b86d9c8f77c64b623ba60

Comment by Githook User [ 25/May/18 ]

Author:

{'username': 'BillyDonahue', 'name': 'Billy Donahue', 'email': 'billy.donahue@mongodb.com'}

Message: SERVER-34653 don't parse if early auth-checks can reject.
Branch: master
https://github.com/mongodb/mongo/commit/f2e762dc80e63fa47bd4c1d48e05f628464b0f54

Comment by Githook User [ 16/May/18 ]

Author:

{'email': 'billy.donahue@mongodb.com', 'username': 'BillyDonahue', 'name': 'Billy Donahue'}

Message: SERVER-34653 MONGO_REGISTER_TEST_COMMAND
Branch: master
https://github.com/mongodb/mongo/commit/373aae274364751eec424a3665c50b53b06f6746

Comment by Githook User [ 10/May/18 ]

Author:

{'name': 'Billy Donahue', 'email': 'billy.donahue@mongodb.com', 'username': 'BillyDonahue'}

Message: SERVER-34653 linearize control flow in Command::_checkAuthorizationImpl.

Also relevant to SERVER-29862.
Branch: master
https://github.com/mongodb/mongo/commit/e2ff0151038bc01a4e8992169ed37c63de1d5a6a

Comment by Billy Donahue [ 09/May/18 ]

SERVER-34653 virtual bool Command::testOnly() marker

 

Code review: https://mongodbcr.appspot.com/202340003/

Comment by Githook User [ 09/May/18 ]

Author:

{'email': 'billy.donahue@mongodb.com', 'name': 'Billy Donahue', 'username': 'BillyDonahue'}

Message: SERVER-34653 mark some commands as requiresAuth==false
Branch: master
https://github.com/mongodb/mongo/commit/ae81206f746c53bf5c14a4cf0a388b3b1a425f04

Comment by Billy Donahue [ 04/May/18 ]

 

Another supporting code change.

http://mongodbcr.appspot.com/199700003

Comment by Githook User [ 02/May/18 ]

Author:

{'email': 'billy.donahue@mongodb.com', 'name': 'Billy Donahue', 'username': 'BillyDonahue'}

Message: SERVER-34653 Add 'AuthorizationSession::isAuthenticated()'
Branch: master
https://github.com/mongodb/mongo/commit/dbbd060edc2180b5aac94bd8f645530f7e486899

Comment by Billy Donahue [ 25/Apr/18 ]

These commits should have gone to SERVER-34596.
They had the wrong ticket number in the git commit message.

https://github.com/10gen/mongo-enterprise-modules/commit/7007d37047934dbdd05252c22c31cca781acb9df
https://github.com/mongodb/mongo/commit/c50a57061af31f92c1c6aab09b1417ab127fed0c

Comment by Githook User [ 25/Apr/18 ]

Author:

{'email': 'billy.donahue@mongodb.com', 'username': 'BillyDonahue', 'name': 'Billy Donahue'}

Message: SERVER-34653 refactor audit's parseNs(..) to ns()
Branch: master
https://github.com/mongodb/mongo/commit/c50a57061af31f92c1c6aab09b1417ab127fed0c

Comment by Githook User [ 25/Apr/18 ]

Author:

{'email': 'billy.donahue@mongodb.com', 'username': 'BillyDonahue', 'name': 'Billy Donahue'}

Message: SERVER-34653 refactor audit's parseNs(..) to ns()
Branch: master
https://github.com/10gen/mongo-enterprise-modules/commit/7007d37047934dbdd05252c22c31cca781acb9df

Generated at Thu Feb 08 04:37:24 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.