← Back to branch summary

~ubuntu-branches/debian/jessie/keystone/jessie

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2012-4456-Some_actions_in_Keystone_admin_API_do_not_validate_token.patch

  • Committer: Package Import Robot
  • Author(s): Thomas Goirand
  • Date: 2012-10-01 05:52:23 UTC
  • Revision ID: package-import@ubuntu.com-20121001055223-7fldz5pv6lc80w9f
Tags: 2012.1.1-9
http://bugs.debian.org/689210
* Fixes sometimes failing keystone.postrm (db_get in some conditions can
return false), and fixed non-consistant indenting.
* Uses /usr/share/keystone/keystone.conf instead of /usr/share/doc/keystone
/keystone.conf.sample for temporary storing the conf file (this was a policy
violation, as the doc folder should never be required).
* Fixes CVE-2012-4457: fails to raise Unauthorized user error for disabled,
CVE-2012-4456: fails to validate tokens in Admin API (Closes: #689210).

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2012-4456-Some_actions_in_Keystone_admin_API_do_not_validate_token.patch
 
1
Description: Require authz for user role list
 
2
 Jason Xu (yinyangxu@gmail.com) discovered several vulnerabilities in OpenStack
 
3
 Keystone token verification:
 
4
 .
 
5
 The first occurs in the API /v2.0/OS-KSADM/services and
 
6
 /v2.0/OS-KSADM/services/{service_id}, the second occurs in
 
7
 /v2.0/tenants/{tenant_id}/users/{user_id}/roles
 
8
 .
 
9
 In both cases the OpenStack Keystone code fails to check if the tokens are
 
10
 valid. These issues have been addressed by adding checks in the form of
 
11
 test_service_crud_requires_auth() and test_user_role_list_requires_auth().
 
12
Bug-Debian: http://bugs.debian.org/689210
 
13
Bug-Ubuntu: https://bugs.launchpad.net/+bug/1006815
 
14
Author: Dolph Mathews <dolph.mathews@gmail.com>
 
15
Origin: Upstream
 
16
 
 
17
Index: keystone/keystone/identity/core.py
 
18
===================================================================
 
19
--- keystone.orig/keystone/identity/core.py     2012-10-01 06:25:52.000000000 +0000
 
20
+++ keystone/keystone/identity/core.py  2012-10-01 06:25:52.000000000 +0000
 
21
@@ -458,6 +458,7 @@
 
22
         not implementing them in hopes that the idea will die off.
 
23
 
 
24
         """
 
25
+        self.assert_admin(context)
 
26
         if tenant_id is None:
 
27
             raise exception.NotImplemented(message='User roles not supported: '
 
28
                                                    'tenant ID required')
 
29
Index: keystone/tests/test_content_types.py
 
30
===================================================================
 
31
--- keystone.orig/tests/test_content_types.py   2012-10-01 06:25:48.000000000 +0000
 
32
+++ keystone/tests/test_content_types.py        2012-10-01 06:25:52.000000000 +0000
 
33
@@ -16,6 +16,7 @@
 
34
 
 
35
 import httplib
 
36
 import json
 
37
+import uuid
 
38
 
 
39
 from lxml import etree
 
40
 import nose.exc
 
41
@@ -554,6 +555,49 @@
 
42
     def assertValidVersionResponse(self, r):
 
43
         self.assertValidVersion(r.body.get('version'))
 
44
 
 
45
+    def test_user_role_list_requires_auth(self):
 
46
+        """User role list should 401 without an X-Auth-Token (bug 1006815)."""
 
47
+        # values here don't matter because we should 401 before they're checked
 
48
+        path = '/v2.0/tenants/%(tenant_id)s/users/%(user_id)s/roles' % {
 
49
+                'tenant_id': uuid.uuid4().hex,
 
50
+                'user_id': uuid.uuid4().hex,
 
51
+        }
 
52
+
 
53
+        r = self.admin_request(path=path, expected_status=401)
 
54
+        self.assertValidErrorResponse(r)
 
55
+
 
56
+    def test_service_crud_requires_auth(self):
 
57
+        """Service CRUD should 401 without an X-Auth-Token (bug 1006822)."""
 
58
+        # values here don't matter because we should 401 before they're checked
 
59
+        service_path = '/v2.0/OS-KSADM/services/%s' % uuid.uuid4().hex
 
60
+        service_body = {
 
61
+                'OS-KSADM:service': {
 
62
+                    'name': uuid.uuid4().hex,
 
63
+                    'type': uuid.uuid4().hex,
 
64
+                    },
 
65
+                }
 
66
+
 
67
+        r = self.admin_request(method='GET',
 
68
+                               path='/v2.0/OS-KSADM/services',
 
69
+                               expected_status=401)
 
70
+        self.assertValidErrorResponse(r)
 
71
+
 
72
+        r = self.admin_request(method='POST',
 
73
+                               path='/v2.0/OS-KSADM/services',
 
74
+                               body=service_body,
 
75
+                               expected_status=401)
 
76
+        self.assertValidErrorResponse(r)
 
77
+
 
78
+        r = self.admin_request(method='GET',
 
79
+                               path=service_path,
 
80
+                               expected_status=401)
 
81
+        self.assertValidErrorResponse(r)
 
82
+
 
83
+        r = self.admin_request(method='DELETE',
 
84
+                               path=service_path,
 
85
+                               expected_status=401)
 
86
+        self.assertValidErrorResponse(r)
 
87
+
 
88
 
 
89
 class XmlTestCase(RestfulTestCase, CoreApiTests):
 
90
     xmlns = 'http://docs.openstack.org/identity/api/v2.0'
 
91
Index: keystone/keystone/catalog/core.py
 
92
===================================================================
 
93
--- keystone.orig/keystone/catalog/core.py      2012-10-01 06:25:48.000000000 +0000
 
94
+++ keystone/keystone/catalog/core.py   2012-10-01 06:25:52.000000000 +0000
 
95
@@ -116,29 +116,36 @@
 
96
 class ServiceController(wsgi.Application):
 
97
     def __init__(self):
 
98
         self.catalog_api = Manager()
 
99
+        self.identity_api = identity.Manager()
 
100
+        self.policy_api = policy.Manager()
 
101
+        self.token_api = token.Manager()
 
102
         super(ServiceController, self).__init__()
 
103
 
 
104
     # CRUD extensions
 
105
     # NOTE(termie): this OS-KSADM stuff is not very consistent
 
106
     def get_services(self, context):
 
107
+        self.assert_admin(context)
 
108
         service_list = self.catalog_api.list_services(context)
 
109
         service_refs = [self.catalog_api.get_service(context, x)
 
110
                         for x in service_list]
 
111
         return {'OS-KSADM:services': service_refs}
 
112
 
 
113
     def get_service(self, context, service_id):
 
114
+        self.assert_admin(context)
 
115
         service_ref = self.catalog_api.get_service(context, service_id)
 
116
         if not service_ref:
 
117
             raise exception.ServiceNotFound(service_id=service_id)
 
118
         return {'OS-KSADM:service': service_ref}
 
119
 
 
120
     def delete_service(self, context, service_id):
 
121
+        self.assert_admin(context)
 
122
         service_ref = self.catalog_api.get_service(context, service_id)
 
123
         if not service_ref:
 
124
             raise exception.ServiceNotFound(service_id=service_id)
 
125
         self.catalog_api.delete_service(context, service_id)
 
126
 
 
127
     def create_service(self, context, OS_KSADM_service):
 
128
+        self.assert_admin(context)
 
129
         service_id = uuid.uuid4().hex
 
130
         service_ref = OS_KSADM_service.copy()
 
131
         service_ref['id'] = service_id