1 Upstream patch for CVE-2014-3476.  This fix will be included in the

     2 Juno-2 development milestone and in future 2013.2.4 and 2014.1.2 releases

     3 

     4 From 9162837329665b4316afc2270a602dc8ae11f6d2 Mon Sep 17 00:00:00 2001

     5 From: Adam Young <[email protected]>

     6 Date: Thu, 29 May 2014 13:56:17 -0400

     7 Subject: [PATCH] Block delegation escalation of privilege

     8 

     9 Forbids doing the following with either a trust

    10   or oauth based token:

    11   creating a trust

    12   approving a request_token

    13   listing request tokens

    14 

    15 Change-Id: I1528f9dd003f5e03cbc50b78e1b32dbbf85ffcc2

    16 Closes-Bug:  1324592

    17 ---

    18  keystone/common/controller.py          |   36 +++++++++++-

    19  keystone/contrib/oauth1/controllers.py |   12 ++++

    20  keystone/tests/test_v3_auth.py         |   62 ++++++++++++++++++++

    21  keystone/tests/test_v3_oauth1.py       |   98 ++++++++++++++++++++++++++++++++

    22  keystone/trust/controllers.py          |    9 +++

    23  5 files changed, 216 insertions(+), 1 deletion(-)

    24 

    25 diff --git a/keystone/common/controller.py b/keystone/common/controller.py

    26 index faadc09..d6c33df 100644

    27 --- a/keystone/common/controller.py

    28 +++ b/keystone/common/controller.py

    29 @@ -44,7 +44,7 @@ def _build_policy_check_credentials(self, action, context, kwargs):

    30      # it would otherwise need to reload the token_ref from backing store.

    31      wsgi.validate_token_bind(context, token_ref)

    32  

    33 -    creds = {}

    34 +    creds = {'is_delegated_auth': False}

    35      if 'token_data' in token_ref and 'token' in token_ref['token_data']:

    36          #V3 Tokens

    37          token_data = token_ref['token_data']['token']

    38 @@ -66,9 +66,32 @@ def _build_policy_check_credentials(self, action, context, kwargs):

    39              creds['roles'] = []

    40              for role in token_data['roles']:

    41                  creds['roles'].append(role['name'])

    42 +

    43 +        trust = token_data.get('OS-TRUST:trust')

    44 +        if trust is None:

    45 +            creds['trust_id'] = None

    46 +            creds['trustor_id'] = None

    47 +            creds['trustee_id'] = None

    48 +        else:

    49 +            creds['trust_id'] = trust['id']

    50 +            creds['trustor_id'] = trust['trustor_user']['id']

    51 +            creds['trustee_id'] = trust['trustee_user']['id']

    52 +            creds['is_delegated_auth'] = True

    53 +

    54 +        oauth1 = token_data.get('OS-OAUTH1')

    55 +        if oauth1 is None:

    56 +            creds['consumer_id'] = None

    57 +            creds['access_token_id'] = None

    58 +        else:

    59 +            creds['consumer_id'] = oauth1['consumer_id']

    60 +            creds['access_token_id'] = oauth1['access_token_id']

    61 +            creds['is_delegated_auth'] = True

    62 +

    63      else:

    64          #v2 Tokens

    65          creds = token_ref.get('metadata', {}).copy()

    66 +        creds['is_delegated_auth'] = False

    67 +

    68          try:

    69              creds['user_id'] = token_ref['user'].get('id')

    70          except AttributeError:

    71 @@ -81,6 +104,16 @@ def _build_policy_check_credentials(self, action, context, kwargs):

    72          # NOTE(vish): this is pretty inefficient

    73          creds['roles'] = [self.identity_api.get_role(role)['name']

    74                            for role in creds.get('roles', [])]

    75 +        trust = token_ref.get('trust')

    76 +        if trust is None:

    77 +            creds['trust_id'] = None

    78 +            creds['trustor_id'] = None

    79 +            creds['trustee_id'] = None

    80 +        else:

    81 +            creds['trust_id'] = trust.get('id')

    82 +            creds['trustor_id'] = trust.get('trustor_id')

    83 +            creds['trustee_id'] = trust.get('trustee_id')

    84 +            creds['is_delegated_auth'] = True

    85  

    86      return creds

    87  

    88 @@ -155,6 +188,7 @@ def protected(callback=None):

    89                  policy_dict.update(kwargs)

    90                  self.policy_api.enforce(creds, action, flatten(policy_dict))

    91                  LOG.debug(_('RBAC: Authorization granted'))

    92 +                context['environment'] = {'KEYSTONE_AUTH_CONTEXT': creds}

    93              return f(self, context, *args, **kwargs)

    94          return inner

    95      return wrapper

    96 diff --git a/keystone/contrib/oauth1/controllers.py b/keystone/contrib/oauth1/controllers.py

    97 index b8c2441..d4024df 100644

    98 --- a/keystone/contrib/oauth1/controllers.py

    99 +++ b/keystone/contrib/oauth1/controllers.py

   100 @@ -86,6 +86,12 @@ class AccessTokenCrudV3(controller.V3Controller):

   101  

   102      @controller.protected()

   103      def list_access_tokens(self, context, user_id):

   104 +        auth_context = context.get('environment',

   105 +                                   {}).get('KEYSTONE_AUTH_CONTEXT', {})

   106 +        if auth_context.get('is_delegated_auth'):

   107 +            raise exception.Forbidden(

   108 +                _('Cannot list request tokens'

   109 +                  ' with a token issued via delegation.'))

   110          refs = self.oauth_api.list_access_tokens(user_id)

   111          formatted_refs = ([self._format_token_entity(x) for x in refs])

   112          return AccessTokenCrudV3.wrap_collection(context, formatted_refs)

   113 @@ -314,6 +320,12 @@ class OAuthControllerV3(controller.V3Controller):

   114          there is not another easy way to make sure the user knows which roles

   115          are being requested before authorizing.

   116          """

   117 +        auth_context = context.get('environment',

   118 +                                   {}).get('KEYSTONE_AUTH_CONTEXT', {})

   119 +        if auth_context.get('is_delegated_auth'):

   120 +            raise exception.Forbidden(

   121 +                _('Cannot authorize a request token'

   122 +                  ' with a token issued via delegation.'))

   123  

   124          req_token = self.oauth_api.get_request_token(request_token_id)

   125  

   126 diff --git a/keystone/tests/test_v3_auth.py b/keystone/tests/test_v3_auth.py

   127 index e89e29f..f3e3ace 100644

   128 --- a/keystone/tests/test_v3_auth.py

   129 +++ b/keystone/tests/test_v3_auth.py

   130 @@ -2150,6 +2150,68 @@ class TestTrustAuth(TestAuthInfo):

   131          self.assertEqual(r.result['token']['project']['name'],

   132                           self.project['name'])

   133  

   134 +    def test_impersonation_token_cannot_create_new_trust(self):

   135 +        ref = self.new_trust_ref(

   136 +            trustor_user_id=self.user_id,

   137 +            trustee_user_id=self.trustee_user_id,

   138 +            project_id=self.project_id,

   139 +            impersonation=True,

   140 +            expires=dict(minutes=1),

   141 +            role_ids=[self.role_id])

   142 +        del ref['id']

   143 +

   144 +        r = self.post('/OS-TRUST/trusts', body={'trust': ref})

   145 +        trust = self.assertValidTrustResponse(r)

   146 +

   147 +        auth_data = self.build_authentication_request(

   148 +            user_id=self.trustee_user['id'],

   149 +            password=self.trustee_user['password'],

   150 +            trust_id=trust['id'])

   151 +        r = self.post('/auth/tokens', body=auth_data)

   152 +

   153 +        trust_token = r.headers['X-Subject-Token']

   154 +

   155 +        # Build second trust

   156 +        ref = self.new_trust_ref(

   157 +            trustor_user_id=self.user_id,

   158 +            trustee_user_id=self.trustee_user_id,

   159 +            project_id=self.project_id,

   160 +            impersonation=True,

   161 +            expires=dict(minutes=1),

   162 +            role_ids=[self.role_id])

   163 +        del ref['id']

   164 +

   165 +        self.post('/OS-TRUST/trusts',

   166 +                  body={'trust': ref},

   167 +                  token=trust_token,

   168 +                  expected_status=403)

   169 +

   170 +    def test_delete_trust_revokes_tokens(self):

   171 +        ref = self.new_trust_ref(

   172 +            trustor_user_id=self.user_id,

   173 +            trustee_user_id=self.trustee_user_id,

   174 +            project_id=self.project_id,

   175 +            impersonation=False,

   176 +            expires=dict(minutes=1),

   177 +            role_ids=[self.role_id])

   178 +        del ref['id']

   179 +        r = self.post('/OS-TRUST/trusts', body={'trust': ref})

   180 +        trust = self.assertValidTrustResponse(r)

   181 +        trust_id = trust['id']

   182 +        auth_data = self.build_authentication_request(

   183 +            user_id=self.trustee_user['id'],

   184 +            password=self.trustee_user['password'],

   185 +            trust_id=trust_id)

   186 +        r = self.post('/auth/tokens', body=auth_data)

   187 +        self.assertValidProjectTrustScopedTokenResponse(

   188 +            r, self.trustee_user)

   189 +        trust_token = r.headers['X-Subject-Token']

   190 +        self.delete('/OS-TRUST/trusts/%(trust_id)s' % {

   191 +            'trust_id': trust_id},

   192 +            expected_status=204)

   193 +        headers = {'X-Subject-Token': trust_token}

   194 +        self.head('/auth/tokens', headers=headers, expected_status=404)

   195 +

   196      def test_delete_trust(self):

   197          ref = self.new_trust_ref(

   198              trustor_user_id=self.user_id,

   199 diff --git a/keystone/tests/test_v3_oauth1.py b/keystone/tests/test_v3_oauth1.py

   200 index 73a34d7..a83c86e 100644

   201 --- a/keystone/tests/test_v3_oauth1.py

   202 +++ b/keystone/tests/test_v3_oauth1.py

   203 @@ -16,6 +16,7 @@

   204  

   205  import copy

   206  import os

   207 +import tempfile

   208  import urlparse

   209  import uuid

   210  

   211 @@ -26,6 +27,8 @@ from keystone import contrib

   212  from keystone.contrib import oauth1

   213  from keystone.contrib.oauth1 import controllers

   214  from keystone.openstack.common import importutils

   215 +from keystone.openstack.common import jsonutils

   216 +from keystone.policy.backends import rules

   217  from keystone.tests import test_v3

   218  

   219  

   220 @@ -447,6 +450,101 @@ class AuthTokenTests(OAuthFlowTests):

   221          self.assertTrue(len(tokens) > 0)

   222          self.assertTrue(keystone_token_uuid in tokens)

   223  

   224 +    def _create_trust_get_token(self):

   225 +        ref = self.new_trust_ref(

   226 +            trustor_user_id=self.user_id,

   227 +            trustee_user_id=self.user_id,

   228 +            project_id=self.project_id,

   229 +            impersonation=True,

   230 +            expires=dict(minutes=1),

   231 +            role_ids=[self.role_id])

   232 +        del ref['id']

   233 +

   234 +        r = self.post('/OS-TRUST/trusts', body={'trust': ref})

   235 +        trust = self.assertValidTrustResponse(r)

   236 +

   237 +        auth_data = self.build_authentication_request(

   238 +            user_id=self.user['id'],

   239 +            password=self.user['password'],

   240 +            trust_id=trust['id'])

   241 +        r = self.post('/auth/tokens', body=auth_data)

   242 +

   243 +        trust_token = r.headers['X-Subject-Token']

   244 +        return trust_token

   245 +

   246 +    def _approve_request_token_url(self):

   247 +        consumer = self._create_single_consumer()

   248 +        consumer_id = consumer.get('id')

   249 +        consumer_secret = consumer.get('secret')

   250 +        self.consumer = oauth1.Consumer(consumer_id, consumer_secret)

   251 +        self.assertIsNotNone(self.consumer.key)

   252 +

   253 +        url, headers = self._create_request_token(self.consumer,

   254 +                                                  self.project_id)

   255 +        content = self.post(url, headers=headers)

   256 +        credentials = urlparse.parse_qs(content.result)

   257 +        request_key = credentials.get('oauth_token')[0]

   258 +        request_secret = credentials.get('oauth_token_secret')[0]

   259 +        self.request_token = oauth1.Token(request_key, request_secret)

   260 +        self.assertIsNotNone(self.request_token.key)

   261 +

   262 +        url = self._authorize_request_token(request_key)

   263 +

   264 +        return url

   265 +

   266 +    def test_oauth_token_cannot_create_new_trust(self):

   267 +        self.test_oauth_flow()

   268 +        ref = self.new_trust_ref(

   269 +            trustor_user_id=self.user_id,

   270 +            trustee_user_id=self.user_id,

   271 +            project_id=self.project_id,

   272 +            impersonation=True,

   273 +            expires=dict(minutes=1),

   274 +            role_ids=[self.role_id])

   275 +        del ref['id']

   276 +

   277 +        self.post('/OS-TRUST/trusts',

   278 +                  body={'trust': ref},

   279 +                  token=self.keystone_token_id,

   280 +                  expected_status=403)

   281 +

   282 +    def test_oauth_token_cannot_authorize_request_token(self):

   283 +        self.test_oauth_flow()

   284 +        url = self._approve_request_token_url()

   285 +        body = {'roles': [{'id': self.role_id}]}

   286 +        self.put(url, body=body, token=self.keystone_token_id,

   287 +                 expected_status=403)

   288 +

   289 +    def test_oauth_token_cannot_list_request_tokens(self):

   290 +        self._set_policy({"identity:list_access_tokens": [],

   291 +                          "identity:create_consumer": [],

   292 +                          "identity:authorize_request_token": []})

   293 +        self.test_oauth_flow()

   294 +        url = '/users/%s/OS-OAUTH1/access_tokens' % self.user_id

   295 +        self.get(url, token=self.keystone_token_id,

   296 +                 expected_status=403)

   297 +

   298 +    def _set_policy(self, new_policy):

   299 +        _unused, self.tmpfilename = tempfile.mkstemp()

   300 +        rules.reset()

   301 +        self.opt(policy_file=self.tmpfilename)

   302 +        with open(self.tmpfilename, "w") as policyfile:

   303 +            policyfile.write(jsonutils.dumps(new_policy))

   304 +        self.addCleanup(os.remove, self.tmpfilename)

   305 +

   306 +    def test_trust_token_cannot_authorize_request_token(self):

   307 +        trust_token = self._create_trust_get_token()

   308 +        url = self._approve_request_token_url()

   309 +        body = {'roles': [{'id': self.role_id}]}

   310 +        self.put(url, body=body, token=trust_token, expected_status=403)

   311 +

   312 +    def test_trust_token_cannot_list_request_tokens(self):

   313 +        self._set_policy({"identity:list_access_tokens": [],

   314 +                          "identity:create_trust": []})

   315 +        trust_token = self._create_trust_get_token()

   316 +        url = '/users/%s/OS-OAUTH1/access_tokens' % self.user_id

   317 +        self.get(url, token=trust_token, expected_status=403)

   318 +

   319  

   320  class MaliciousOAuth1Tests(OAuth1Tests):

   321  

   322 diff --git a/keystone/trust/controllers.py b/keystone/trust/controllers.py

   323 index 1d54f51..7fdc8c2 100644

   324 --- a/keystone/trust/controllers.py

   325 +++ b/keystone/trust/controllers.py

   326 @@ -144,6 +144,15 @@ class TrustV3(controller.V3Controller):

   327  

   328          # TODO(ayoung): instead of raising ValidationError on the first

   329          # problem, return a collection of all the problems.

   330 +

   331 +        # Explicitly prevent a trust token from creating a new trust.

   332 +        auth_context = context.get('environment',

   333 +                                   {}).get('KEYSTONE_AUTH_CONTEXT', {})

   334 +        if auth_context.get('is_delegated_auth'):

   335 +            raise exception.Forbidden(

   336 +                _('Cannot create a trust'

   337 +                  ' with a token issued via delegation.'))

   338 +

   339          if not trust:

   340              raise exception.ValidationError(attribute='trust',

   341                                              target='request')