Check timestamp of signed EC2 token request
EC2 token requests contain a signature that signs the entire request, including the access timestamp. While the signature is checked, the timestamp is not, and so these signed requests remain valid indefinitely, leaving the token API vulnerable to replay attacks. This change introduces a configurable TTL for signed token requests and ensures that the timestamp is actually validated against it. The check will work for either an AWS Signature v1/v2 'Timestamp' parameter[1] or the AWS Signature v4 'X-Aws-Date' header or parameter[2]. Although this technically adds a new feature and the default value of the feature changes behavior, this change is required to protect credential holders and therefore must be backported to all supported branches. [1] https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html [2] https://docs.aws.amazon.com/general/latest/gr/sigv4-date-handling.html Conflicts due to six removal in e2d83ae9: keystone/api/_shared/EC2_S3_Resource.py keystone/tests/unit/test_contrib_ec2_core.py Conflicts due to flask reorg: keystone/api/_shared/EC2_S3_Resource.py Change-Id: Idb10267338b4204b435df233c636046a1ce5711f Closes-bug: #1872737 (cherry picked from commitab89ea7490
) (cherry picked from commit8d5becbe4b
) (cherry picked from commite3f65d6fbc
) (cherry picked from commit1ef3828516
)
This commit is contained in:
parent
abf5cb6a55
commit
35f09e2b7c
|
@ -46,12 +46,21 @@ share this repository with the repository used to manage keys for Fernet
|
||||||
tokens.
|
tokens.
|
||||||
"""))
|
"""))
|
||||||
|
|
||||||
|
auth_ttl = cfg.IntOpt(
|
||||||
|
'auth_ttl',
|
||||||
|
default=15,
|
||||||
|
help=utils.fmt("""
|
||||||
|
The length of time in minutes for which a signed EC2 or S3 token request is
|
||||||
|
valid from the timestamp contained in the token request.
|
||||||
|
"""))
|
||||||
|
|
||||||
|
|
||||||
GROUP_NAME = __name__.split('.')[-1]
|
GROUP_NAME = __name__.split('.')[-1]
|
||||||
ALL_OPTS = [
|
ALL_OPTS = [
|
||||||
driver,
|
driver,
|
||||||
provider,
|
provider,
|
||||||
key_repository
|
key_repository,
|
||||||
|
auth_ttl
|
||||||
]
|
]
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -33,11 +33,13 @@ Glance to list images needed to perform the requested task.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
import abc
|
import abc
|
||||||
|
import datetime
|
||||||
import sys
|
import sys
|
||||||
import uuid
|
import uuid
|
||||||
|
|
||||||
from keystoneclient.contrib.ec2 import utils as ec2_utils
|
from keystoneclient.contrib.ec2 import utils as ec2_utils
|
||||||
from oslo_serialization import jsonutils
|
from oslo_serialization import jsonutils
|
||||||
|
from oslo_utils import timeutils
|
||||||
import six
|
import six
|
||||||
from six.moves import http_client
|
from six.moves import http_client
|
||||||
|
|
||||||
|
@ -87,6 +89,30 @@ class Ec2ControllerCommon(provider_api.ProviderAPIMixin, object):
|
||||||
raise exception.Unauthorized(
|
raise exception.Unauthorized(
|
||||||
message=_('EC2 signature not supplied.'))
|
message=_('EC2 signature not supplied.'))
|
||||||
|
|
||||||
|
def _check_timestamp(self, credentials):
|
||||||
|
timestamp = (
|
||||||
|
# AWS Signature v1/v2
|
||||||
|
credentials.get('params', {}).get('Timestamp') or
|
||||||
|
# AWS Signature v4
|
||||||
|
credentials.get('headers', {}).get('X-Amz-Date') or
|
||||||
|
credentials.get('params', {}).get('X-Amz-Date')
|
||||||
|
)
|
||||||
|
if not timestamp:
|
||||||
|
# If the signed payload doesn't include a timestamp then the signer
|
||||||
|
# must have intentionally left it off
|
||||||
|
return
|
||||||
|
try:
|
||||||
|
timestamp = timeutils.parse_isotime(timestamp)
|
||||||
|
timestamp = timeutils.normalize_time(timestamp)
|
||||||
|
except Exception as e:
|
||||||
|
raise exception.Unauthorized(
|
||||||
|
_('Credential timestamp is invalid: %s') % e)
|
||||||
|
auth_ttl = datetime.timedelta(minutes=CONF.credential.auth_ttl)
|
||||||
|
current_time = timeutils.normalize_time(timeutils.utcnow())
|
||||||
|
if current_time > timestamp + auth_ttl:
|
||||||
|
raise exception.Unauthorized(
|
||||||
|
_('Credential is expired'))
|
||||||
|
|
||||||
@abc.abstractmethod
|
@abc.abstractmethod
|
||||||
def authenticate(self, context, credentials=None, ec2Credentials=None):
|
def authenticate(self, context, credentials=None, ec2Credentials=None):
|
||||||
"""Validate a signed EC2 request and provide a token.
|
"""Validate a signed EC2 request and provide a token.
|
||||||
|
@ -145,6 +171,7 @@ class Ec2ControllerCommon(provider_api.ProviderAPIMixin, object):
|
||||||
six.reraise(exception.Unauthorized, exception.Unauthorized(e),
|
six.reraise(exception.Unauthorized, exception.Unauthorized(e),
|
||||||
sys.exc_info()[2])
|
sys.exc_info()[2])
|
||||||
|
|
||||||
|
self._check_timestamp(credentials)
|
||||||
roles = self.assignment_api.get_roles_for_user_and_project(
|
roles = self.assignment_api.get_roles_for_user_and_project(
|
||||||
user_ref['id'], tenant_ref['id']
|
user_ref['id'], tenant_ref['id']
|
||||||
)
|
)
|
||||||
|
|
|
@ -12,10 +12,15 @@
|
||||||
# License for the specific language governing permissions and limitations
|
# License for the specific language governing permissions and limitations
|
||||||
# under the License.
|
# under the License.
|
||||||
|
|
||||||
|
import datetime
|
||||||
|
import hashlib
|
||||||
|
|
||||||
from keystoneclient.contrib.ec2 import utils as ec2_utils
|
from keystoneclient.contrib.ec2 import utils as ec2_utils
|
||||||
|
from oslo_utils import timeutils
|
||||||
from six.moves import http_client
|
from six.moves import http_client
|
||||||
|
|
||||||
from keystone.common import provider_api
|
from keystone.common import provider_api
|
||||||
|
from keystone.common import utils
|
||||||
from keystone.contrib.ec2 import controllers
|
from keystone.contrib.ec2 import controllers
|
||||||
from keystone.tests import unit
|
from keystone.tests import unit
|
||||||
from keystone.tests.unit import test_v3
|
from keystone.tests.unit import test_v3
|
||||||
|
@ -37,6 +42,7 @@ class EC2ContribCoreV3(test_v3.RestfulTestCase):
|
||||||
|
|
||||||
def test_valid_authentication_response_with_proper_secret(self):
|
def test_valid_authentication_response_with_proper_secret(self):
|
||||||
signer = ec2_utils.Ec2Signer(self.cred_blob['secret'])
|
signer = ec2_utils.Ec2Signer(self.cred_blob['secret'])
|
||||||
|
timestamp = utils.isotime(timeutils.utcnow())
|
||||||
credentials = {
|
credentials = {
|
||||||
'access': self.cred_blob['access'],
|
'access': self.cred_blob['access'],
|
||||||
'secret': self.cred_blob['secret'],
|
'secret': self.cred_blob['secret'],
|
||||||
|
@ -46,7 +52,7 @@ class EC2ContribCoreV3(test_v3.RestfulTestCase):
|
||||||
'params': {
|
'params': {
|
||||||
'SignatureVersion': '2',
|
'SignatureVersion': '2',
|
||||||
'Action': 'Test',
|
'Action': 'Test',
|
||||||
'Timestamp': '2007-01-31T23:59:59Z'
|
'Timestamp': timestamp
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
credentials['signature'] = signer.generate(credentials)
|
credentials['signature'] = signer.generate(credentials)
|
||||||
|
@ -56,6 +62,48 @@ class EC2ContribCoreV3(test_v3.RestfulTestCase):
|
||||||
expected_status=http_client.OK)
|
expected_status=http_client.OK)
|
||||||
self.assertValidProjectScopedTokenResponse(resp, self.user)
|
self.assertValidProjectScopedTokenResponse(resp, self.user)
|
||||||
|
|
||||||
|
def test_valid_authentication_response_with_signature_v4(self):
|
||||||
|
signer = ec2_utils.Ec2Signer(self.cred_blob['secret'])
|
||||||
|
timestamp = utils.isotime(timeutils.utcnow())
|
||||||
|
hashed_payload = (
|
||||||
|
'GET\n'
|
||||||
|
'/\n'
|
||||||
|
'Action=Test\n'
|
||||||
|
'host:localhost\n'
|
||||||
|
'x-amz-date:' + timestamp + '\n'
|
||||||
|
'\n'
|
||||||
|
'host;x-amz-date\n'
|
||||||
|
'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
|
||||||
|
)
|
||||||
|
body_hash = hashlib.sha256(hashed_payload.encode()).hexdigest()
|
||||||
|
amz_credential = (
|
||||||
|
'AKIAIOSFODNN7EXAMPLE/%s/us-east-1/iam/aws4_request,' %
|
||||||
|
timestamp[:8])
|
||||||
|
|
||||||
|
credentials = {
|
||||||
|
'access': self.cred_blob['access'],
|
||||||
|
'secret': self.cred_blob['secret'],
|
||||||
|
'host': 'localhost',
|
||||||
|
'verb': 'GET',
|
||||||
|
'path': '/',
|
||||||
|
'params': {
|
||||||
|
'Action': 'Test',
|
||||||
|
'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',
|
||||||
|
'X-Amz-SignedHeaders': 'host,x-amz-date,',
|
||||||
|
'X-Amz-Credential': amz_credential
|
||||||
|
},
|
||||||
|
'headers': {
|
||||||
|
'X-Amz-Date': timestamp
|
||||||
|
},
|
||||||
|
'body_hash': body_hash
|
||||||
|
}
|
||||||
|
credentials['signature'] = signer.generate(credentials)
|
||||||
|
resp = self.post(
|
||||||
|
'/ec2tokens',
|
||||||
|
body={'credentials': credentials},
|
||||||
|
expected_status=http_client.OK)
|
||||||
|
self.assertValidProjectScopedTokenResponse(resp, self.user)
|
||||||
|
|
||||||
def test_authenticate_with_empty_body_returns_bad_request(self):
|
def test_authenticate_with_empty_body_returns_bad_request(self):
|
||||||
self.post(
|
self.post(
|
||||||
'/ec2tokens',
|
'/ec2tokens',
|
||||||
|
@ -75,6 +123,7 @@ class EC2ContribCoreV3(test_v3.RestfulTestCase):
|
||||||
|
|
||||||
def test_authenticate_without_proper_secret_returns_unauthorized(self):
|
def test_authenticate_without_proper_secret_returns_unauthorized(self):
|
||||||
signer = ec2_utils.Ec2Signer('totally not the secret')
|
signer = ec2_utils.Ec2Signer('totally not the secret')
|
||||||
|
timestamp = utils.isotime(timeutils.utcnow())
|
||||||
credentials = {
|
credentials = {
|
||||||
'access': self.cred_blob['access'],
|
'access': self.cred_blob['access'],
|
||||||
'secret': 'totally not the secret',
|
'secret': 'totally not the secret',
|
||||||
|
@ -84,7 +133,7 @@ class EC2ContribCoreV3(test_v3.RestfulTestCase):
|
||||||
'params': {
|
'params': {
|
||||||
'SignatureVersion': '2',
|
'SignatureVersion': '2',
|
||||||
'Action': 'Test',
|
'Action': 'Test',
|
||||||
'Timestamp': '2007-01-31T23:59:59Z'
|
'Timestamp': timestamp
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
credentials['signature'] = signer.generate(credentials)
|
credentials['signature'] = signer.generate(credentials)
|
||||||
|
@ -92,3 +141,75 @@ class EC2ContribCoreV3(test_v3.RestfulTestCase):
|
||||||
'/ec2tokens',
|
'/ec2tokens',
|
||||||
body={'credentials': credentials},
|
body={'credentials': credentials},
|
||||||
expected_status=http_client.UNAUTHORIZED)
|
expected_status=http_client.UNAUTHORIZED)
|
||||||
|
|
||||||
|
def test_authenticate_expired_request(self):
|
||||||
|
self.config_fixture.config(
|
||||||
|
group='credential',
|
||||||
|
auth_ttl=5
|
||||||
|
)
|
||||||
|
signer = ec2_utils.Ec2Signer(self.cred_blob['secret'])
|
||||||
|
past = timeutils.utcnow() - datetime.timedelta(minutes=10)
|
||||||
|
timestamp = utils.isotime(past)
|
||||||
|
credentials = {
|
||||||
|
'access': self.cred_blob['access'],
|
||||||
|
'secret': self.cred_blob['secret'],
|
||||||
|
'host': 'localhost',
|
||||||
|
'verb': 'GET',
|
||||||
|
'path': '/',
|
||||||
|
'params': {
|
||||||
|
'SignatureVersion': '2',
|
||||||
|
'Action': 'Test',
|
||||||
|
'Timestamp': timestamp
|
||||||
|
},
|
||||||
|
}
|
||||||
|
credentials['signature'] = signer.generate(credentials)
|
||||||
|
self.post(
|
||||||
|
'/ec2tokens',
|
||||||
|
body={'credentials': credentials},
|
||||||
|
expected_status=http_client.UNAUTHORIZED)
|
||||||
|
|
||||||
|
def test_authenticate_expired_request_v4(self):
|
||||||
|
self.config_fixture.config(
|
||||||
|
group='credential',
|
||||||
|
auth_ttl=5
|
||||||
|
)
|
||||||
|
signer = ec2_utils.Ec2Signer(self.cred_blob['secret'])
|
||||||
|
past = timeutils.utcnow() - datetime.timedelta(minutes=10)
|
||||||
|
timestamp = utils.isotime(past)
|
||||||
|
hashed_payload = (
|
||||||
|
'GET\n'
|
||||||
|
'/\n'
|
||||||
|
'Action=Test\n'
|
||||||
|
'host:localhost\n'
|
||||||
|
'x-amz-date:' + timestamp + '\n'
|
||||||
|
'\n'
|
||||||
|
'host;x-amz-date\n'
|
||||||
|
'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
|
||||||
|
)
|
||||||
|
body_hash = hashlib.sha256(hashed_payload.encode()).hexdigest()
|
||||||
|
amz_credential = (
|
||||||
|
'AKIAIOSFODNN7EXAMPLE/%s/us-east-1/iam/aws4_request,' %
|
||||||
|
timestamp[:8])
|
||||||
|
|
||||||
|
credentials = {
|
||||||
|
'access': self.cred_blob['access'],
|
||||||
|
'secret': self.cred_blob['secret'],
|
||||||
|
'host': 'localhost',
|
||||||
|
'verb': 'GET',
|
||||||
|
'path': '/',
|
||||||
|
'params': {
|
||||||
|
'Action': 'Test',
|
||||||
|
'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',
|
||||||
|
'X-Amz-SignedHeaders': 'host,x-amz-date,',
|
||||||
|
'X-Amz-Credential': amz_credential
|
||||||
|
},
|
||||||
|
'headers': {
|
||||||
|
'X-Amz-Date': timestamp
|
||||||
|
},
|
||||||
|
'body_hash': body_hash
|
||||||
|
}
|
||||||
|
credentials['signature'] = signer.generate(credentials)
|
||||||
|
self.post(
|
||||||
|
'/ec2tokens',
|
||||||
|
body={'credentials': credentials},
|
||||||
|
expected_status=http_client.UNAUTHORIZED)
|
||||||
|
|
|
@ -0,0 +1,28 @@
|
||||||
|
---
|
||||||
|
feature:
|
||||||
|
- |
|
||||||
|
[`bug 1872737 <https://bugs.launchpad.net/keystone/+bug/1872737>`_]
|
||||||
|
Added a new config option ``auth_ttl`` in the ``[credential]`` config
|
||||||
|
section to allow configuring the period for which a signed token request
|
||||||
|
from AWS is valid. The default is 15 minutes in accordance with the AWS
|
||||||
|
Signature V4 API reference.
|
||||||
|
upgrade:
|
||||||
|
- |
|
||||||
|
[`bug 1872737 <https://bugs.launchpad.net/keystone/+bug/1872737>`_]
|
||||||
|
Added a default TTL of 15 minutes for signed EC2 credential requests,
|
||||||
|
where previously an EC2 signed token request was valid indefinitely. This
|
||||||
|
change in behavior is needed to protect against replay attacks.
|
||||||
|
security:
|
||||||
|
- |
|
||||||
|
[`bug 1872737 <https://bugs.launchpad.net/keystone/+bug/1872737>`_]
|
||||||
|
Fixed an incorrect EC2 token validation implementation in which the
|
||||||
|
timestamp of the signed request was ignored, which made EC2 and S3 token
|
||||||
|
requests vulnerable to replay attacks. The default TTL is 15 minutes but
|
||||||
|
is configurable.
|
||||||
|
fixes:
|
||||||
|
- |
|
||||||
|
[`bug 1872737 <https://bugs.launchpad.net/keystone/+bug/1872737>`_]
|
||||||
|
Fixed an incorrect EC2 token validation implementation in which the
|
||||||
|
timestamp of the signed request was ignored, which made EC2 and S3 token
|
||||||
|
requests vulnerable to replay attacks. The default TTL is 15 minutes but
|
||||||
|
is configurable.
|
Loading…
Reference in New Issue