From 43ed7ed27aeead767e6cbdbd953aa4adcadc67ef Mon Sep 17 00:00:00 2001 From: Oliver Gugger Date: Mon, 7 Feb 2022 16:13:16 +0100 Subject: [PATCH] rpc_proxy+litcli: replace dummy string with empty macaroon To avoid the macaroon parsing to fail in session.IsSuperMacaroon(), we want the dummy macaroon to be formally valid (meaning, it can be parsed) but not actually valid (meaning, it will fail the signature verification since we don't have the root key for it anywhere). --- cmd/litcli/main.go | 3 ++- rpc_proxy.go | 11 ++++++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/cmd/litcli/main.go b/cmd/litcli/main.go index 72f94ffc..79d18a09 100644 --- a/cmd/litcli/main.go +++ b/cmd/litcli/main.go @@ -3,6 +3,7 @@ package main import ( "context" "encoding/base64" + "encoding/hex" "fmt" "os" "path/filepath" @@ -210,7 +211,7 @@ func getAuthContext(cliCtx *cli.Context) context.Context { ctxb := context.Background() md := metadata.MD{} - md.Set("macaroon", "no-macaroons-for-litcli") + md.Set("macaroon", hex.EncodeToString(terminal.EmptyMacaroonBytes)) md.Set("authorization", fmt.Sprintf("Basic %s", basicAuth)) return metadata.NewOutgoingContext(ctxb, md) diff --git a/rpc_proxy.go b/rpc_proxy.go index a51c8829..717ea9ef 100644 --- a/rpc_proxy.go +++ b/rpc_proxy.go @@ -33,6 +33,15 @@ const ( HeaderMacaroon = "Macaroon" ) +var ( + // EmptyMacaroonBytes is the byte representation of an empty but + // formally valid macaroon. + EmptyMacaroonBytes, _ = hex.DecodeString( + "020205656d7074790000062062083e2ea599285ac29350abb4ea21fd7c5a" + + "15aca8b4c0d38e6c058829369e50", + ) +) + // proxyErr is an error type that adds more context to an error occurring in the // proxy. type proxyErr struct { @@ -499,7 +508,7 @@ func (p *rpcProxy) basicAuthToMacaroon(basicAuth, requestURI string, } case isLitURI(requestURI): - return []byte("no-macaroons-for-litcli"), nil + return EmptyMacaroonBytes, nil default: return nil, fmt.Errorf("unknown gRPC web request: %v",