openstack/python-keystoneclient
Code Issues Proposed changes

Hash for PKIZ

Browse Source 
Only PKI (asn1) based tokens were checked for format and hashed

Closes-Bug: 1355125

SecurityImpact

Change-Id: Iefedde7f168e2ff1870905041fa95301934452e5
This commit is contained in:
Adam Young
2014-08-15 16:37:32 -04:00
parent 8adce9619c
commit eb54dfa3f7
2 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
keystoneclient/middleware/auth_token.py
View File

@@ -1407,7 +1407,7 @@ class TokenCache(object):
""" """
if cms.is_asn1_token(user_token): if cms.is_asn1_token(user_token) or cms.is_pkiz(user_token):
# user_token is a PKI token that's not hashed. # user_token is a PKI token that's not hashed.
token_hashes = list(cms.cms_hash_token(user_token, mode=algo) token_hashes = list(cms.cms_hash_token(user_token, mode=algo)

23
keystoneclient/tests/test_auth_token_middleware.py
View File

@@ -629,6 +629,12 @@ class CommonAuthTokenMiddlewareTest(object):
revoked_form = cms.cms_hash_token(token) revoked_form = cms.cms_hash_token(token)
self._test_cache_revoked(token, revoked_form) self._test_cache_revoked(token, revoked_form)
def test_cached_revoked_pkiz(self):
# When the PKI token is cached and revoked, 401 is returned.
token = self.token_dict['signed_token_scoped_pkiz']
revoked_form = cms.cms_hash_token(token)
self._test_cache_revoked(token, revoked_form)
def test_revoked_token_receives_401_md5_secondary(self): def test_revoked_token_receives_401_md5_secondary(self):
# When hash_algorithms has 'md5' as the secondary hash and the # When hash_algorithms has 'md5' as the secondary hash and the
# revocation list contains the md5 hash for a token, that token is # revocation list contains the md5 hash for a token, that token is
@@ -641,7 +647,7 @@ class CommonAuthTokenMiddlewareTest(object):
self.middleware(req.environ, self.start_fake_response) self.middleware(req.environ, self.start_fake_response)
self.assertEqual(self.response_status, 401) self.assertEqual(self.response_status, 401)
def test_revoked_hashed_pki_token(self): def _test_revoked_hashed_token(self, token_key):
# If hash_algorithms is set as ['sha256', 'md5'], # If hash_algorithms is set as ['sha256', 'md5'],
# and check_revocations_for_cached is True, # and check_revocations_for_cached is True,
# and a token is in the cache because it was successfully validated # and a token is in the cache because it was successfully validated
@@ -652,27 +658,33 @@ class CommonAuthTokenMiddlewareTest(object):
self.conf['check_revocations_for_cached'] = True self.conf['check_revocations_for_cached'] = True
self.set_middleware() self.set_middleware()
token = self.token_dict['signed_token_scoped'] token = self.token_dict[token_key]
# Put the token in the revocation list. # Put the token in the revocation list.
token_hashed = cms.cms_hash_token(token) token_hashed = cms.cms_hash_token(token)
self.middleware.token_revocation_list = self.get_revocation_list_json( self.middleware.token_revocation_list = self.get_revocation_list_json(
token_ids=[token_hashed]) token_ids=[token_hashed])
# First, request is using the hashed token, is valid so goes in # request is using the hashed token, is valid so goes in
# cache using the given hash. # cache using the given hash.
req = webob.Request.blank('/') req = webob.Request.blank('/')
req.headers['X-Auth-Token'] = token_hashed req.headers['X-Auth-Token'] = token_hashed
self.middleware(req.environ, self.start_fake_response) self.middleware(req.environ, self.start_fake_response)
self.assertEqual(200, self.response_status) self.assertEqual(200, self.response_status)
# This time use the PKI token # This time use the PKI(Z) token
req.headers['X-Auth-Token'] = token req.headers['X-Auth-Token'] = token
self.middleware(req.environ, self.start_fake_response) self.middleware(req.environ, self.start_fake_response)
# Should find the token in the cache and revocation list. # Should find the token in the cache and revocation list.
self.assertEqual(401, self.response_status) self.assertEqual(401, self.response_status)
def test_revoked_hashed_pki_token(self):
self._test_revoked_hashed_token('signed_token_scoped')
def test_revoked_hashed_pkiz_token(self):
self._test_revoked_hashed_token('signed_token_scoped_pkiz')
def get_revocation_list_json(self, token_ids=None, mode=None): def get_revocation_list_json(self, token_ids=None, mode=None):
if token_ids is None: if token_ids is None:
key = 'revoked_token_hash' + (('_' + mode) if mode else '') key = 'revoked_token_hash' + (('_' + mode) if mode else '')
@@ -1371,7 +1383,8 @@ class v2AuthTokenMiddlewareTest(BaseAuthTokenMiddlewareTest,
self.examples.UUID_TOKEN_BIND, self.examples.UUID_TOKEN_BIND,
self.examples.UUID_TOKEN_UNKNOWN_BIND, self.examples.UUID_TOKEN_UNKNOWN_BIND,
self.examples.UUID_TOKEN_NO_SERVICE_CATALOG, self.examples.UUID_TOKEN_NO_SERVICE_CATALOG,
self.examples.SIGNED_TOKEN_SCOPED_KEY,): self.examples.SIGNED_TOKEN_SCOPED_KEY,
self.examples.SIGNED_TOKEN_SCOPED_PKIZ_KEY,):
text = self.examples.JSON_TOKEN_RESPONSES[token] text = self.examples.JSON_TOKEN_RESPONSES[token]
self.requests.register_uri('GET', self.requests.register_uri('GET',
'%s/v2.0/tokens/%s' % (BASE_URI, token), '%s/v2.0/tokens/%s' % (BASE_URI, token),