vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive CA: catch a deleted CA file however its path is spelled

Browse source 
The CA-file assertion compared the option's raw string, so
`/var/lib//swarm-ca/root.pem` or `/var/lib/hive-tls/./ca.pem` got past it.
Both sides are normalised lexically now: empty and `.` components drop out,
`..` removes the one before it, a trailing `/` goes. A symlink is not
resolved at eval time, so a path through one still passes; docs/swarm/ca.md
says so.
This commit is contained in:
atlas 2026-10-05 20:47:24 +02:00 • committed by mara
commit 626790a464
3 changed files with 68 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/swarm/ca.md
View file

@ -182,8 +182,10 @@ under it.
A host whose `deploy.bao.clientCaFile`, `deploy.bao.serverCaFile` or
`deploy.swarm-controller.hiveClientCaFile` names one of those paths fails
evaluation. Those options name the store's mTLS CA,
`/var/lib/swarm-bao-pki/ca.pem` on the host that runs the store.
evaluation, however it's spelled with `//`, `.`, `..` or a trailing `/`. A
symlink to one isn't resolved, so it gets past the check. Those options name
the store's mTLS CA, `/var/lib/swarm-bao-pki/ca.pem` on the host that runs
the store.
## What to hand a peer