token-server: Make machine token minter config apply to subdomains.

token-server: Make machine token minter config apply to subdomains.

Token server is configured with a list of domains it is allowed to mint machine
tokens for. This list used to be matched exactly, e.g a cert with Common Name
"machine.sub.example.com" can be exchanged to a machine token only if
"sub.example.com" is listed in the config.

This change relaxes this rule and allows configured domains to match subdomains
too.

Also cleanup some stale assumptions in comments and code.

R=smut@google.com, iannucci@chromium.org
BUG=732467
Review-Url: https://codereview.chromium.org/2952723003
Committed: https://github.com/luci/luci-go/commit/7e4835b3ee45d01e99c04376b7bcfb741c6960fb

[Vadim Sh., 2017-06-21 00:09:02]

PTAL

https://codereview.chromium.org/2952723003/diff/1/tokenserver/api/admin/v1/co...
File tokenserver/api/admin/v1/config.proto (left):

https://codereview.chromium.org/2952723003/diff/1/tokenserver/api/admin/v1/co...
tokenserver/api/admin/v1/config.proto:27: // for generating a token with
machine_id <hostname>@<token-server-url>.
<hostname>@<token-server-url> format was actually never used. And thus '@' is
not a magical symbol

https://codereview.chromium.org/2952723003/diff/1/tokenserver/appengine/impl/...
File tokenserver/appengine/impl/machinetoken/machinetoken.go (left):

https://codereview.chromium.org/2952723003/diff/1/tokenserver/appengine/impl/...
tokenserver/appengine/impl/machinetoken/machinetoken.go:75: if
strings.ContainsRune(host, '@') {
as I mentioned above, '@' has no magical significance, no need to check it
separately

https://codereview.chromium.org/2952723003/diff/1/tokenserver/appengine/impl/...
File tokenserver/appengine/impl/machinetoken/machinetoken.go (right):

https://codereview.chromium.org/2952723003/diff/1/tokenserver/appengine/impl/...
tokenserver/appengine/impl/machinetoken/machinetoken.go:103: if domainInCfg ==
domain || strings.HasSuffix(domain, "."+domainInCfg) {
this is the actual change

[Vadim Sh., 2017-06-21 00:20:49]

Confirmed it works: https://screenshot.googleplex.com/8RjHQtLM06V.png

[smut, 2017-06-21 00:27:19]

lgtm

https://codereview.chromium.org/2952723003/diff/1/tokenserver/appengine/impl/...
File tokenserver/appengine/impl/machinetoken/machinetoken.go (right):

https://codereview.chromium.org/2952723003/diff/1/tokenserver/appengine/impl/...
tokenserver/appengine/impl/machinetoken/machinetoken.go:74: domain := chunks[1]
// e.g. "us-central-1a.c.project-id.internal"
typo: us-central1-a, not us-central-1a

[Vadim Sh., 2017-06-21 00:31:56]

https://codereview.chromium.org/2952723003/diff/1/tokenserver/appengine/impl/...
File tokenserver/appengine/impl/machinetoken/machinetoken.go (right):

https://codereview.chromium.org/2952723003/diff/1/tokenserver/appengine/impl/...
tokenserver/appengine/impl/machinetoken/machinetoken.go:74: domain := chunks[1]
// e.g. "us-central-1a.c.project-id.internal"
On 2017/06/21 00:27:19, smut wrote:
> typo: us-central1-a, not us-central-1a

Done.

[Vadim Sh., 2017-06-21 00:32:09]

The CQ bit was checked by vadimsh@chromium.org

[Vadim Sh., 2017-06-21 00:32:09]

The patchset sent to the CQ was uploaded after l-g-t-m from smut@google.com
Link to the patchset: https://codereview.chromium.org/2952723003/#ps20001
(title: "typo")

[commit-bot: I haz the power, 2017-06-21 00:32:16]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-06-21 00:38:05]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1498005129433450,
"parent_rev": "71aba0a6cd7d6264e0ecdd38afe5b69db8c8556f", "commit_rev":
"7e4835b3ee45d01e99c04376b7bcfb741c6960fb"}

[commit-bot: I haz the power, 2017-06-21 00:38:11]

Description was changed from

==========
token-server: Make machine token minter config apply to subdomains.

Token server is configured with a list of domains it is allowed to mint machine
tokens for. This list used to be matched exactly, e.g a cert with Common Name
"machine.sub.example.com" can be exchanged to a machine token only if
"sub.example.com" is listed in the config.

This change relaxes this rule and allows configured domains to match subdomains
too.

Also cleanup some stale assumptions in comments and code.

R=smut@google.com, iannucci@chromium.org
BUG=732467
==========

to

==========
token-server: Make machine token minter config apply to subdomains.

Token server is configured with a list of domains it is allowed to mint machine
tokens for. This list used to be matched exactly, e.g a cert with Common Name
"machine.sub.example.com" can be exchanged to a machine token only if
"sub.example.com" is listed in the config.

This change relaxes this rule and allows configured domains to match subdomains
too.

Also cleanup some stale assumptions in comments and code.

R=smut@google.com, iannucci@chromium.org
BUG=732467

Review-Url: https://codereview.chromium.org/2952723003
Committed:
https://github.com/luci/luci-go/commit/7e4835b3ee45d01e99c04376b7bcfb741c6960fb
==========

[commit-bot: I haz the power, 2017-06-21 00:38:12]

Committed patchset #2 (id:20001) as
https://github.com/luci/luci-go/commit/7e4835b3ee45d01e99c04376b7bcfb741c6960fb