Browse Source

auth: break TLS VerifiedChains for-loop early

Fix "auth/store.go:1147:4: the surrounding loop is unconditionally terminated (SA4004)"

Signed-off-by: Gyuho Lee <gyuhox@gmail.com>
Gyuho Lee 7 years ago
parent
commit
d398d41ff0
1 changed files with 19 additions and 11 deletions
  1. 19 11
      auth/store.go

+ 19 - 11
auth/store.go

@@ -1129,7 +1129,7 @@ func (as *authStore) Revision() uint64 {
 	return atomic.LoadUint64(&as.revision)
 	return atomic.LoadUint64(&as.revision)
 }
 }
 
 
-func (as *authStore) AuthInfoFromTLS(ctx context.Context) *AuthInfo {
+func (as *authStore) AuthInfoFromTLS(ctx context.Context) (ai *AuthInfo) {
 	peer, ok := peer.FromContext(ctx)
 	peer, ok := peer.FromContext(ctx)
 	if !ok || peer == nil || peer.AuthInfo == nil {
 	if !ok || peer == nil || peer.AuthInfo == nil {
 		return nil
 		return nil
@@ -1137,18 +1137,26 @@ func (as *authStore) AuthInfoFromTLS(ctx context.Context) *AuthInfo {
 
 
 	tlsInfo := peer.AuthInfo.(credentials.TLSInfo)
 	tlsInfo := peer.AuthInfo.(credentials.TLSInfo)
 	for _, chains := range tlsInfo.State.VerifiedChains {
 	for _, chains := range tlsInfo.State.VerifiedChains {
-		for _, chain := range chains {
-			cn := chain.Subject.CommonName
-			if as.lg != nil {
-				as.lg.Debug("found command name", zap.String("common-name", cn))
-			} else {
-				plog.Debugf("found common name %s", cn)
-			}
-			return &AuthInfo{Username: cn, Revision: as.Revision()}
+		if len(chains) < 1 {
+			continue
+		}
+		ai = &AuthInfo{
+			Username: chains[0].Subject.CommonName,
+			Revision: as.Revision(),
 		}
 		}
+		if as.lg != nil {
+			as.lg.Debug(
+				"found command name",
+				zap.String("common-name", ai.Username),
+				zap.String("user-name", ai.Username),
+				zap.Uint64("revision", ai.Revision),
+			)
+		} else {
+			plog.Debugf("found common name %s", ai.Username)
+		}
+		break
 	}
 	}
-
-	return nil
+	return ai
 }
 }
 
 
 func (as *authStore) AuthInfoFromCtx(ctx context.Context) (*AuthInfo, error) {
 func (as *authStore) AuthInfoFromCtx(ctx context.Context) (*AuthInfo, error) {