Skip to content

Commit d078f15

Browse files
authored
Merge pull request #7254 from locker95/fix/login-client-side-basic-401
registry: treat basic-auth 401 as unauthorized
2 parents 13e3261 + b4189c2 commit d078f15

3 files changed

Lines changed: 44 additions & 2 deletions

File tree

‎internal/registry/auth.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"strings"
99
"time"
1010

11+
"github.com/containerd/errdefs/pkg/errhttp"
1112
"github.com/containerd/log"
1213
"github.com/docker/distribution/registry/client/auth"
1314
"github.com/docker/distribution/registry/client/auth/challenge"
@@ -67,7 +68,7 @@ func loginV2(ctx context.Context, authConfig *registry.AuthConfig, endpoint APIE
6768

6869
if resp.StatusCode != http.StatusOK {
6970
// TODO(dmcgowan): Attempt to further interpret result, status code and error code string
70-
return "", fmt.Errorf("login attempt to %s failed with status: %d %s", endpointStr, resp.StatusCode, http.StatusText(resp.StatusCode))
71+
return "", fmt.Errorf("login attempt to %s failed with status: %d %s: %w", endpointStr, resp.StatusCode, http.StatusText(resp.StatusCode), errhttp.ToNative(resp.StatusCode))
7172
}
7273

7374
return credentialAuthConfig.IdentityToken, nil

‎internal/registry/auth_test.go‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
package registry
2+
3+
import (
4+
"context"
5+
"net/http"
6+
"net/http/httptest"
7+
"net/url"
8+
"testing"
9+
10+
"github.com/containerd/errdefs"
11+
"github.com/moby/moby/api/types/registry"
12+
"gotest.tools/v3/assert"
13+
is "gotest.tools/v3/assert/cmp"
14+
)
15+
16+
func TestLoginV2BasicAuthUnauthorized(t *testing.T) {
17+
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
18+
user, pass, ok := r.BasicAuth()
19+
if !ok || user != "alice" || pass != "secret" {
20+
w.Header().Set("WWW-Authenticate", `Basic realm="test"`)
21+
http.Error(w, "401 Unauthorized", http.StatusUnauthorized)
22+
return
23+
}
24+
w.WriteHeader(http.StatusOK)
25+
}))
26+
t.Cleanup(srv.Close)
27+
28+
u, err := url.Parse(srv.URL)
29+
assert.NilError(t, err)
30+
endpoint := APIEndpoint{URL: u}
31+
ctx := context.Background()
32+
33+
_, err = loginV2(ctx, &registry.AuthConfig{Username: "alice", Password: "wrong"}, endpoint, "docker-test")
34+
assert.ErrorContains(t, err, "401")
35+
assert.Check(t, errdefs.IsUnauthorized(err))
36+
assert.Check(t, is.ErrorType(err, errdefs.IsUnauthorized))
37+
38+
token, err := loginV2(ctx, &registry.AuthConfig{Username: "alice", Password: "secret"}, endpoint, "docker-test")
39+
assert.NilError(t, err)
40+
assert.Check(t, is.Equal("", token))
41+
}

‎vendor.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ tool (
1414
require (
1515
dario.cat/mergo v1.0.2
1616
github.com/containerd/errdefs v1.0.0
17+
github.com/containerd/errdefs/pkg v0.3.0
1718
github.com/containerd/log v0.1.0
1819
github.com/containerd/platforms v1.0.0-rc.5
1920
github.com/creack/pty v1.1.24
@@ -75,7 +76,6 @@ require (
7576
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
7677
github.com/cespare/xxhash/v2 v2.3.0 // indirect
7778
github.com/clipperhouse/uax29/v2 v2.2.0 // indirect
78-
github.com/containerd/errdefs/pkg v0.3.0 // indirect
7979
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
8080
github.com/docker/go-events v0.1.0 // indirect
8181
github.com/docker/go-metrics v0.1.0 // indirect

0 commit comments

Comments
 (0)