github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

fix bug that using invalid token to retry fetching layer

Browse Source 
Signed-off-by: frankyang <yyb196@gmail.com>
This commit is contained in:
沈陵 2023-10-19 20:25:54 +08:00 committed by frankyang
parent 9807675518
commit 09e40511af
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
remotes/docker/authorizer.go
View File

@ -148,9 +148,11 @@ func (a *dockerAuthorizer) AddResponses(ctx context.Context, responses []*http.R
defer a.mu.Unlock() defer a.mu.Unlock()
for _, c := range auth.ParseAuthHeader(last.Header) { for _, c := range auth.ParseAuthHeader(last.Header) {
if c.Scheme == auth.BearerAuth { if c.Scheme == auth.BearerAuth {
if err := invalidAuthorization(c, responses); err != nil { if retry, err := invalidAuthorization(ctx, c, responses); err != nil {
delete(a.handlers, host) delete(a.handlers, host)
return err return err
} else if retry {
delete(a.handlers, host)
} }
// reuse existing handler // reuse existing handler
@ -328,18 +330,24 @@ func (ah *authHandler) doBearerAuth(ctx context.Context) (token, refreshToken st
return resp.Token, resp.RefreshToken, nil return resp.Token, resp.RefreshToken, nil
} }
func invalidAuthorization(c auth.Challenge, responses []*http.Response) error { func invalidAuthorization(ctx context.Context, c auth.Challenge, responses []*http.Response) (retry bool, _ error) {
errStr := c.Parameters["error"] errStr := c.Parameters["error"]
if errStr == "" { if errStr == "" {
return nil return retry, nil
} }
n := len(responses) n := len(responses)
if n == 1 || (n > 1 && !sameRequest(responses[n-2].Request, responses[n-1].Request)) { if n == 1 || (n > 1 && !sameRequest(responses[n-2].Request, responses[n-1].Request)) {
return nil limitedErr := errStr
errLenghLimit := 64
if len(limitedErr) > errLenghLimit {
limitedErr = limitedErr[:errLenghLimit] + "..."
}
log.G(ctx).WithField("error", limitedErr).Debug("authorization error using bearer token, retrying")
return true, nil
} }
return fmt.Errorf("server message: %s: %w", errStr, ErrInvalidAuthorization) return retry, fmt.Errorf("server message: %s: %w", errStr, ErrInvalidAuthorization)
} }
func sameRequest(r1, r2 *http.Request) bool { func sameRequest(r1, r2 *http.Request) bool {