openstack
/
keystone
Code Issues Proposed changes
keystone/keystone/tests/unit
History
Colleen Murphy b25739fa96 Check timestamp of signed EC2 token request 
EC2 token requests contain a signature that signs the entire request,
including the access timestamp. While the signature is checked, the
timestamp is not, and so these signed requests remain valid
indefinitely, leaving the token API vulnerable to replay attacks. This
change introduces a configurable TTL for signed token requests and
ensures that the timestamp is actually validated against it.

The check will work for either an AWS Signature v1/v2 'Timestamp'
parameter[1] or the AWS Signature v4 'X-Aws-Date' header or
parameter[2].

Although this technically adds a new feature and the default value of
the feature changes behavior, this change is required to protect
credential holders and therefore must be backported to all supported
branches.

[1] https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html
[2] https://docs.aws.amazon.com/general/latest/gr/sigv4-date-handling.html

Conflicts due to six removal in e2d83ae9:
	keystone/api/_shared/EC2_S3_Resource.py
	keystone/tests/unit/test_contrib_ec2_core.py

Conflicts due to v2.0 API testing in stable/queens. The v2.0 tests were
removed in Rocky but in earlier releases we tested similar functionality
between v3 and v2.0. This conflict was resolved by porting the timestamp
to the v2.0 API test:
	keystone/tests/unit/test_contrib_ec2_core.py

Conflicts due to flask reorg:
	keystone/api/_shared/EC2_S3_Resource.py

Change-Id: Idb10267338b4204b435df233c636046a1ce5711f
Closes-bug: #1872737
(cherry picked from commit ab89ea7490)
(cherry picked from commit 8d5becbe4b)
(cherry picked from commit e3f65d6fbc)
(cherry picked from commit 1ef3828516)
(cherry picked from commit 35f09e2b7c)
 		2020-05-11 19:41:13 +00:00
..
application_credential Add cache invalidation when delete application credential 2018-02-05 14:09:07 +08:00
assignment Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
auth Add schema check for OS-TRUST:trust authentication 2017-11-24 01:35:17 +00:00
backend Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
catalog Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
common Set initiator id as user_id for auth events 2019-03-19 10:54:25 +01:00
config_files Remove LDAP write support 2017-01-21 21:32:07 -05:00
contrib Adds tests showing how mapping locals are handled 2017-01-26 20:42:12 +00:00
credential Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
endpoint_policy Fixes remaining nits in endpoint_policy tests 2016-11-15 20:03:47 +00:00
external Replace parse_strtime with datetime.strptime 2017-12-21 12:14:28 -06:00
federation Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
identity Merge "Fix list users by name" 2018-02-07 15:41:37 +00:00
ksfixtures Merge "Rename fernet_utils to token_utils" 2018-01-16 13:48:28 +00:00
limit Add limit provider 2018-01-25 15:45:44 +08:00
policy Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
resource Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
saml2 Add openstack_user_domain to assertion 2015-05-04 14:33:48 -03:00
tests Adds a skip method to identify useless skips 2016-06-29 19:48:12 +00:00
token Populate application credential data in token 2018-02-20 08:47:02 +01:00
trust Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
__init__.py enable ldap tests for py3 2016-05-18 12:07:23 -04:00
core.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
default_catalog.templates Remove/update v2 catalog endpoint tests 2017-10-21 16:45:12 -05:00
default_fixtures.py Add limit provider 2018-01-25 15:45:44 +08:00
fakeldap.py Add a hacking rule for string interpolation at logging 2017-07-18 14:11:28 +08:00
federation_fixtures.py Move existing tests to unit 2015-02-13 15:54:29 -06:00
filtering.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
identity_mapping.py Use the new enginefacade from oslo.db 2016-02-24 08:20:12 -08:00
mapping_fixtures.py Update test case for federation 2017-05-19 10:54:15 +08:00
rest.py Fix multiple uuid warnings with pycadf 2017-02-08 21:16:43 -06:00
test_associate_project_endpoint_extension.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_auth_plugin.py Use keystone.common.provider_api for auth APIs 2018-02-02 22:07:29 +00:00
test_backend_endpoint_policy.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_backend_endpoint_policy_sql.py Fixes the SQL model tests 2015-03-08 05:34:48 +00:00
test_backend_federation_sql.py Require domain_id when registering Identity Providers 2017-01-06 16:05:12 +00:00
test_backend_id_mapping_sql.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_backend_ldap.py Fixing dn_to_id function for cases were id is not in the DN 2019-08-29 14:26:13 +00:00
test_backend_ldap_pool.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_backend_rules.py Split policy backend tests 2016-03-04 15:32:42 -03:00
test_backend_sql.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_backend_templated.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_cli.py Ensure bootstrap handles multiple roles with the same name 2020-03-06 19:11:53 +00:00
test_config.py Using assertIsNone() instead of assertIs(None) 2016-09-26 15:33:18 +07:00
test_contrib_ec2_core.py Check timestamp of signed EC2 token request 2020-05-11 19:41:13 +00:00
test_contrib_s3_core.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_contrib_simple_cert.py Ensure HEAD is supported with simple cert 2017-06-13 16:03:38 +00:00
test_credential.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_driver_hints.py Use assertTrue/False instead of assertEqual(T/F) 2015-11-02 09:10:38 +00:00
test_entry_points.py remove "admin_token_auth" related content" 2017-12-18 17:02:34 +08:00
test_exception.py Remove log translations in keystone 2017-03-25 18:17:15 +00:00
test_hacking_checks.py Remove duplicated hacking rule 2017-06-28 07:48:03 +00:00
test_ldap_livetest.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_ldap_pool_livetest.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_ldap_tls_livetest.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_limits.py Expose unified limit APIs 2018-01-25 16:33:11 +08:00
test_middleware.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_policy.py Merge "Expose a get_enforcer method for oslo.policy scripts" 2018-01-16 09:04:07 +00:00
test_revoke.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_shadow_users.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_sql_banned_operations.py Update links in keystone 2017-09-12 15:18:13 +08:00
test_sql_upgrade.py Remove foreign key for registered limit 2018-01-23 14:39:25 +00:00
test_token_bind.py Change tests to use common name for keystone.tests.unit 2015-09-04 18:21:42 +00:00
test_token_provider.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_url_middleware.py Change url in middleware test to v3 2017-11-01 05:09:27 +00:00
test_v3.py Add test case for expanding implied roles in system tokens 2019-10-22 11:49:29 -07:00
test_v3_application_credential.py Add application credential auth plugin 2018-01-27 12:00:19 +01:00
test_v3_assignment.py Delete system role assignments when deleting groups 2018-02-14 19:21:44 +00:00
test_v3_auth.py Allows to use application credentials through group membership 2019-11-13 15:28:46 +00:00
test_v3_catalog.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_v3_credential.py Add retry for DBDeadlock in credential delete 2019-09-09 09:01:35 +05:30
test_v3_domain_config.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_v3_endpoint_policy.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_v3_federation.py Mapped Groups don't exist breaks WebSSO 2018-09-24 16:06:35 +00:00
test_v3_filters.py Merge "Refactor self.*_api out of tests" 2018-02-05 22:34:16 +00:00
test_v3_identity.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_v3_oauth1.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_v3_os_revoke.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_v3_policy.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_v3_protection.py Refactor self.*_api out of tests 2018-02-03 00:14:40 +00:00
test_v3_resource.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_v3_trust.py Finish refactoring self.*_api out of tests 2018-02-05 23:26:08 +00:00
test_validation.py Fix json schema nullable to add None to ENUM 2018-04-19 13:24:08 +00:00
test_versions.py Add Application Credentials controller 2018-01-27 11:55:05 +01:00
test_wsgi.py Small fixes for WebOb 1.7 compatibiltity 2017-03-24 20:12:01 +00:00
utils.py Add new functionality to @wip 2016-05-22 16:06:50 +00:00