Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unterminated quoted string when creating read user #371

Merged
merged 1 commit into from
Feb 10, 2024

Conversation

waipeng
Copy link
Contributor

@waipeng waipeng commented Sep 1, 2023

puppetdb in default config will create a read-only user, however there is a bug[1] with the syntax to set the default read grant.

Fix it with help from comments[2].

[1] #330 (comment)
[2] #339 (comment)

@waipeng waipeng requested review from bastelfreak, smortex and a team as code owners September 1, 2023 12:05
@CLAassistant
Copy link

CLAassistant commented Sep 1, 2023

CLA assistant check
All committers have signed the CLA.

@waipeng
Copy link
Contributor Author

waipeng commented Sep 1, 2023

There are no tests, but I can confirm this works.

I am checking out the situation with the tests.

Copy link
Collaborator

@smortex smortex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like the format depend on the actual role names: puppetdb-read is quoted but puppetdb is not:

puppetdb=# SELECT pg_default_acl.defaclacl::text FROM pg_default_acl;
            defaclacl             
----------------------------------
 {"\"puppetdb-read\"=U/puppetdb"}
 {"\"puppetdb-read\"=X/puppetdb"}
 {"\"puppetdb-read\"=r/puppetdb"}
(3 lignes)

I think the - in puppetdb-read trigger the quoting. I suggested some changes to make the matching more robust in any circumstances.

manifests/database/default_read_grant.pp Outdated Show resolved Hide resolved
@smortex
Copy link
Collaborator

smortex commented Sep 30, 2023

Out of curiosity, I do not alter the default roles and have not hit this issue. Can you share the configuration you use that trigger the issue?

@waipeng
Copy link
Contributor Author

waipeng commented Oct 2, 2023

Out of curiosity, I do not alter the default roles and have not hit this issue. Can you share the configuration you use that trigger the issue?

We are seeing this on Ubuntu 22.04, Puppet Agent 7.26.0, Puppet Server 7.13.0.

Node hiera is pretty simple

puppetdb::listen_address: '0.0.0.0'
puppetdb::postgres_version: '12'
postgresql::server::contrib::package_name: 'postgresql-contrib'
puppetdb::java_args:
  '-Xmx': '2g'

A puppet run with -d shows the following:

Debug: Executing with uid=postgres gid=postgres: 'psql -d puppetdb -t -X -c "SELECT COUNT(*) FROM (SELECT                                                                                                                                                                                                                                                                                                                                   
                  ns.nspname,                                                                                                                                                                                         
                  acl.defaclobjtype,                                                                                                                                                                                                                                                                                                                                                                                                        
                  acl.defaclacl                                                                                                                                                                                       
                FROM pg_default_acl acl                                                                                                                                                                               
                JOIN pg_namespace ns ON acl.defaclnamespace=ns.oid                                                                                                                                                    
                WHERE acl.defaclacl::text ~ '.*\\\"puppetdb-read\\\"=r/puppetdb\\".*'                                                                                                                                 
                AND nspname = 'public') count"'                                                                                                                                                                       
Error: /Stage[main]/Puppetdb::Database::Postgresql/Puppetdb::Database::Read_only_user[puppetdb-read]/Puppetdb::Database::Default_read_grant[puppetdb grant read permission on new objects from puppetdb to puppetdb-read]/Postgresql_psql[grant default select permission for puppetdb-read]: Could not evaluate: Error evaluating 'unless' clause, returned pid 11837 exit 2: 'sh: 8: Syntax error: Unterminated quoted string             
'    

Please let me know if you need more information on replicating this. Thanks for your help!

@smortex
Copy link
Collaborator

smortex commented Oct 2, 2023

lol, I was forgetting that the unbalanced quote was the reason for this PR 🤦. In our infra, we have manage_dbserver => false, that's why we never hit this issue…

The file was introduced with the mismatch in #330. The lack of unit tests seems to allow a broken default config for 5 minor releases in a row… Let's fix the code at least, can you check the suggested regexp changes I proposed and if they work as expected adjust the PR?

@waipeng
Copy link
Contributor Author

waipeng commented Oct 3, 2023

I have replied on the suggestions you gave, and added a commit with your change. Thanks for looking at this.

I have taken a look at the tests and #344 was done some time ago and the logs are lost. If you can resurrect it, maybe we can all chip in to get tests working again.

Copy link
Collaborator

@smortex smortex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's give this another try. Can you try these suggestions?

manifests/database/default_read_grant.pp Outdated Show resolved Hide resolved
manifests/database/default_read_grant.pp Outdated Show resolved Hide resolved
manifests/database/default_read_grant.pp Outdated Show resolved Hide resolved
@smortex
Copy link
Collaborator

smortex commented Oct 9, 2023

lol

a new release happened

So I should adjust my comment #371 (comment)

The file was introduced with the mismatch in #330. The lack of unit tests seems to allow a broken default config for 5 minor releases in a row… Let's fix the code at least, can you check the suggested regexp changes I proposed and if they work as expected adjust the PR?

s/5 minor releases in a row/6 minor releases in a row/ 🙃

Cc @austb. I feel like you are a bit alone to try to do something with this module, I am working on fixing CI, I'll at-you to be sure you not miss it.

@waipeng
Copy link
Contributor Author

waipeng commented Oct 17, 2023

@smortex your suggestions are good. I've added them to the PR.

@smortex
Copy link
Collaborator

smortex commented Nov 7, 2023

Hey @waipeng! I see you replaced <SPACE>+<SPACE> with @ in all fragments but one. Was it on purpose of just missing? I think it's better to use the same construct each time for consistency.

@waipeng
Copy link
Contributor Author

waipeng commented Nov 7, 2023

My fault due to inexperience with Github PR.

Do you have preference on keeping the commits you suggested, or is it OK if I squash them all into one commit and put you as co-author? I am having a hard time tracing through the commits in the current form.

@smortex
Copy link
Collaborator

smortex commented Nov 8, 2023

Feel free to squash everything ;-)

@waipeng waipeng force-pushed the fix_grant_quotes branch 2 times, most recently from ed1cbe1 to 1c576af Compare November 14, 2023 12:52
Copy link
Collaborator

@smortex smortex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 💯 !

@waipeng
Copy link
Contributor Author

waipeng commented Nov 28, 2023

Hi, can this be merged and a new version be cut please?
Right now it is broken in default config which is not very healthy.

@alaunay
Copy link

alaunay commented Jan 8, 2024

Hello, no news on this ? permissions are checked every time without this patch. Thanks !

@h0tw1r3
Copy link
Contributor

h0tw1r3 commented Feb 2, 2024

@waipeng can you rebase on main please?

@smortex
Copy link
Collaborator

smortex commented Feb 4, 2024

Somebody fixed the test suite 😱. We need to update the tests according to the code changes 😁

@waipeng the "Files changed" tab shows the offending tests (beware, the view lacks some ... symbols so the diff is not really readable around the failures context), this should help adjusting the test suite to make sure we have the expected code.

Thanks!

@h0tw1r3
Copy link
Contributor

h0tw1r3 commented Feb 5, 2024

@waipeng tests are failing due to unrelated CI changes. Rebase on main again should get past that.

spec/support/unit/shared/database.rb Outdated Show resolved Hide resolved
spec/support/unit/shared/database.rb Outdated Show resolved Hide resolved
spec/support/unit/shared/database.rb Outdated Show resolved Hide resolved
puppetdb in default config will create a read-only user, however there
is a bug[1] with the syntax to set the default read grant.

Fix it with help from comments[2].

[1] puppetlabs#330 (comment)
[2] puppetlabs#339 (comment)

Co-authored-by: Romain Tartière <[email protected]>
Signed-off-by: Jake Yip <[email protected]>
@h0tw1r3 h0tw1r3 merged commit 8d91395 into puppetlabs:main Feb 10, 2024
20 checks passed
@waipeng waipeng deleted the fix_grant_quotes branch February 10, 2024 10:17
@h0tw1r3 h0tw1r3 changed the title Fix: Unterminated quoted string when creating read user Unterminated quoted string when creating read user Feb 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants