Bug 1328030 - Cookie name leaks information about the infrastructure software and the internal project names
Summary: Cookie name leaks information about the infrastructure software and the inter...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 3.2.0
Hardware: All
OS: Linux
urgent
medium
Target Milestone: ---
: ---
Assignee: Phil Cameron
QA Contact: zhaozhanqi
URL:
Whiteboard:
Depends On:
Blocks: 1267746
TreeView+ depends on / blocked
 
Reported: 2016-04-18 09:08 UTC by Harald Klein
Modified: 2022-08-04 22:20 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: The routing cookie previously contained information such as the application framework and service name. Consequence: Information about the internal routing and infrastructure components were visible to external users. Fix: The routing cookie name is now hashed. Result: Internal details are no longer visible to external users.
Clone Of:
Environment:
Last Closed: 2016-07-05 16:53:18 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:1383 0 normal SHIPPED_LIVE Red Hat OpenShift Enterprise 3.2.1.4 bug fix update 2016-07-05 20:53:01 UTC

Comment 4 Ben Bennett 2016-04-20 14:58:40 UTC 
Trello card:
  https://trello.com/c/DUabJ1ai/197-config-option-to-adjust-router-s-cookie-name
Comment 5 Ben Bennett 2016-04-20 19:46:47 UTC 
We should also make sure that we aren't leaking the project names in the cookie names.
Comment 8 Phil Cameron 2016-05-12 13:13:59 UTC 
test/integration/router_test.go lines 1038-1043
is a test for this.
Comment 9 zhaozhanqi 2016-05-20 03:58:58 UTC 
Already tested this on origin with haproxy images id

openshift/origin-haproxy-router e3edbeea1962

this issue had been fixed.

since this bug is reported on OSE, for now I'd like to move the status to 'modified'. please move back to 'ON_QA' once this is merged to OSE. thanks.
Comment 10 Phil Cameron 2016-05-20 12:49:22 UTC 
https://github.com/openshift/origin/pull/8615
See last comment:
Pull request successfully merged and closed

Is there something else that needs to be done?
Comment 11 Meng Bo 2016-05-23 05:14:53 UTC 
Hi Phil,

Yes, the bug has been fixed in latest origin code, and QE has verified that works. 
But since this bug was reported to OpenShift Enterprise product, we should close the bug only when the code has been merged into the latest OSE build as the workflow.
Comment 12 Meng Bo 2016-05-23 05:18:08 UTC 
And the productization team will handle the MODIFIED bugs when they create new builds.
Comment 24 zhaozhanqi 2016-06-12 02:43:13 UTC 
since the PR 286 has not been merged to the latest OSE puddle. So I will verify this bug once it's merged.
Comment 25 zhaozhanqi 2016-06-15 03:24:27 UTC 
@Eric

I checked the latest haproxy images with following:
brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/ose-haproxy-router          v3.2.1.1            77f0eb2358e8        31 hours ago        497.3 MB

seems PR 286 still not be merged to this images.

Could you help confirm this?
Comment 30 zhaozhanqi 2016-06-17 03:26:37 UTC 
checked this issue with haproxy router images id: 8c185ef9a991

the cookie name has been using hash key instead include the following scenario.
( insecure/edge/passthough/reencrypt)
Comment 33 errata-xmlrpc 2016-07-05 16:53:18 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2016:1383
Note You need to log in before you can comment on or make changes to this bug.