Attachment 833736 Details for Bug 1039148 – cve-2013-6419-nova-stable-grizzly.patch

[patch] cve-2013-6419-nova-stable-grizzly.patch

cve-2013-6419-nova-stable-grizzly.patch (text/plain), 5.58 KB, created by Kurt Seifried on 2013-12-06 19:28:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-12-06 19:28:41 UTC

Size: 5.58 KB

patch

obsolete

>commit d4155b806f52f2168742ceb37988fc7f405b44cd
>Author: Aaron Rosen <arosen@nicira.com>
>Date:   Mon Oct 7 13:33:31 2013 -0700
>
>    Prevent spoofing instance_id from neturon to nova
>    
>    Previously, one could update a port's device_id in neutron to be that
>    of another tenant's instance_id and then be able to retrieve that instance's
>    metadata. This patch prevents this from occuring by checking that X-Tenant-ID
>    received from the metadata request matches the tenant_id in the nova database.
>    
>    DocImpact - This patch is dependent on another patch in neutron which adds
>                X-Tenant-ID to the request. Therefore to minimize downtime one
>                should upgrade Neutron first (then restart neutron-metadata-agent)
>                and lastly update nova.
>    
>    Fixes bug: 1235450
>
>diff --git a/nova/api/metadata/handler.py b/nova/api/metadata/handler.py
>index bbaeba5..2b7f659 100644
>--- a/nova/api/metadata/handler.py
>+++ b/nova/api/metadata/handler.py
>@@ -144,6 +144,7 @@ class MetadataRequestHandler(wsgi.Application):
> 
>     def _handle_instance_id_request(self, req):
>         instance_id = req.headers.get('X-Instance-ID')
>+        tenant_id = req.headers.get('X-Tenant-ID')
>         signature = req.headers.get('X-Instance-ID-Signature')
>         remote_address = req.headers.get('X-Forwarded-For')
> 
>@@ -151,8 +152,12 @@ class MetadataRequestHandler(wsgi.Application):
> 
>         if instance_id is None:
>             msg = _('X-Instance-ID header is missing from request.')
>+        elif tenant_id is None:
>+            msg = _('X-Tenant-ID header is missing from request.')
>         elif not isinstance(instance_id, basestring):
>             msg = _('Multiple X-Instance-ID headers found within request.')
>+        elif not isinstance(tenant_id, basestring):
>+            msg = _('Multiple X-Tenant-ID headers found within request.')
>         else:
>             msg = None
> 
>@@ -188,4 +193,12 @@ class MetadataRequestHandler(wsgi.Application):
>             LOG.error(_('Failed to get metadata for instance id: %s'),
>                       instance_id)
> 
>+        if meta_data.instance['project_id'] != tenant_id:
>+            LOG.warning(_("Tenant_id %(tenant_id)s does not match tenant_id "
>+                          "of instance %(instance_id)s."),
>+                        {'tenant_id': tenant_id,
>+                         'instance_id': instance_id})
>+            # causes a 404 to be raised
>+            meta_data = None
>+
>         return meta_data
>diff --git a/nova/tests/test_metadata.py b/nova/tests/test_metadata.py
>index 01f274f..51b6f72 100644
>--- a/nova/tests/test_metadata.py
>+++ b/nova/tests/test_metadata.py
>@@ -510,6 +510,7 @@ class MetadataHandlerTestCase(test.TestCase):
>             relpath="/2009-04-04/user-data",
>             address="192.192.192.2",
>             headers={'X-Instance-ID': 'a-b-c-d',
>+                     'X-Tenant-ID': 'test',
>                      'X-Instance-ID-Signature': signed})
>         self.assertEqual(response.status_int, 200)
> 
>@@ -522,6 +523,7 @@ class MetadataHandlerTestCase(test.TestCase):
>             fake_get_metadata_by_instance_id=fake_get_metadata,
>             headers={'X-Forwarded-For': '192.192.192.2',
>                      'X-Instance-ID': 'a-b-c-d',
>+                     'X-Tenant-ID': 'test',
>                      'X-Instance-ID-Signature': signed})
> 
>         self.assertEqual(response.status_int, 200)
>@@ -536,10 +538,36 @@ class MetadataHandlerTestCase(test.TestCase):
>             fake_get_metadata_by_instance_id=fake_get_metadata,
>             headers={'X-Forwarded-For': '192.192.192.2',
>                      'X-Instance-ID': 'a-b-c-d',
>+                     'X-Tenant-ID': 'test',
>                      'X-Instance-ID-Signature': ''})
> 
>         self.assertEqual(response.status_int, 403)
> 
>+        # missing X-Tenant-ID from request
>+        response = fake_request(
>+            self.stubs, self.mdinst,
>+            relpath="/2009-04-04/user-data",
>+            address="192.192.192.2",
>+            fake_get_metadata_by_instance_id=fake_get_metadata,
>+            headers={'X-Forwarded-For': '192.192.192.2',
>+                     'X-Instance-ID': 'a-b-c-d',
>+                     'X-Instance-ID-Signature': signed})
>+
>+        self.assertEqual(response.status_int, 400)
>+
>+        # mismatched X-Tenant-ID
>+        response = fake_request(
>+            self.stubs, self.mdinst,
>+            relpath="/2009-04-04/user-data",
>+            address="192.192.192.2",
>+            fake_get_metadata_by_instance_id=fake_get_metadata,
>+            headers={'X-Forwarded-For': '192.192.192.2',
>+                     'X-Instance-ID': 'a-b-c-d',
>+                     'X-Tenant-ID': 'FAKE',
>+                     'X-Instance-ID-Signature': signed})
>+
>+        self.assertEqual(response.status_int, 404)
>+
>         # without X-Forwarded-For
>         response = fake_request(
>             self.stubs, self.mdinst,
>@@ -547,6 +575,7 @@ class MetadataHandlerTestCase(test.TestCase):
>             address="192.192.192.2",
>             fake_get_metadata_by_instance_id=fake_get_metadata,
>             headers={'X-Instance-ID': 'a-b-c-d',
>+                     'X-Tenant-ID': 'test',
>                      'X-Instance-ID-Signature': signed})
> 
>         self.assertEqual(response.status_int, 500)
>@@ -564,6 +593,7 @@ class MetadataHandlerTestCase(test.TestCase):
>             fake_get_metadata_by_instance_id=fake_get_metadata,
>             headers={'X-Forwarded-For': '192.192.192.2',
>                      'X-Instance-ID': 'z-z-z-z',
>+                     'X-Tenant-ID': 'test',
>                      'X-Instance-ID-Signature': signed})
>         self.assertEqual(response.status_int, 500)
>

Actions: View | Diff

Attachments on bug 1039148: 833732 | 833733 | 833734 | 833735 | 833736 | 833737