20885269 problem in PYTHON-MOD/KEYSTONEMIDDLE
20885288 problem in SERVICE/KEYSTONE
This upstream patch addresses CVE-2015-1852 in keystoneclient. It
should be able to be removed when keystoneclient 1.4.0 or later is
integrated.
From 710402426c6bda2fe9d9b4fde2f5b54f1790a60e Mon Sep 17 00:00:00 2001
From: Brant Knudson <[email protected]>
Date: Tue, 7 Apr 2015 19:38:29 +0000
Subject: [PATCH] Fix s3_token middleware parsing insecure option
The "insecure" option was being treated as a bool when it was
actually provided as a string. The fix is to parse the string to
a bool.
Closes-Bug: 1411063
Change-Id: Id674f40532215788675c97a8fdfa91d4420347b3
---
--- python-keystoneclient-1.0.0/keystoneclient/middleware/s3_token.py.~1~ 2014-12-18 09:37:35.000000000 -0800
+++ python-keystoneclient-1.0.0/keystoneclient/middleware/s3_token.py 2015-04-14 14:23:08.294228633 -0700
@@ -34,6 +34,7 @@ This WSGI component:
import logging
from oslo.serialization import jsonutils
+from oslo.utils import strutils
import requests
import six
from six.moves import urllib
@@ -116,7 +117,7 @@ class S3Token(object):
self.request_uri = '%s://%s:%s' % (auth_protocol, auth_host, auth_port)
# SSL
- insecure = conf.get('insecure', False)
+ insecure = strutils.bool_from_string(conf.get('insecure', False))
cert_file = conf.get('certfile')
key_file = conf.get('keyfile')
--- python-keystoneclient-1.0.0/keystoneclient/tests/test_s3_token_middleware.py.~1~ 2014-12-18 09:37:35.000000000 -0800
+++ python-keystoneclient-1.0.0/keystoneclient/tests/test_s3_token_middleware.py 2015-04-14 14:23:09.919217052 -0700
@@ -124,7 +124,7 @@ class S3TokenMiddlewareTestGood(S3TokenM
@mock.patch.object(requests, 'post')
def test_insecure(self, MOCK_REQUEST):
self.middleware = (
- s3_token.filter_factory({'insecure': True})(FakeApp()))
+ s3_token.filter_factory({'insecure': 'True'})(FakeApp()))
text_return_value = jsonutils.dumps(GOOD_RESPONSE)
if six.PY3:
@@ -142,6 +142,28 @@ class S3TokenMiddlewareTestGood(S3TokenM
mock_args, mock_kwargs = MOCK_REQUEST.call_args
self.assertIs(mock_kwargs['verify'], False)
+ def test_insecure_option(self):
+ # insecure is passed as a string.
+
+ # Some non-secure values.
+ true_values = ['true', 'True', '1', 'yes']
+ for val in true_values:
+ config = {'insecure': val, 'certfile': 'false_ind'}
+ middleware = s3_token.filter_factory(config)(FakeApp())
+ self.assertIs(False, middleware.verify)
+
+ # Some "secure" values, including unexpected value.
+ false_values = ['false', 'False', '0', 'no', 'someweirdvalue']
+ for val in false_values:
+ config = {'insecure': val, 'certfile': 'false_ind'}
+ middleware = s3_token.filter_factory(config)(FakeApp())
+ self.assertEqual('false_ind', middleware.verify)
+
+ # Default is secure.
+ config = {'certfile': 'false_ind'}
+ middleware = s3_token.filter_factory(config)(FakeApp())
+ self.assertIs('false_ind', middleware.verify)
+
class S3TokenMiddlewareTestBad(S3TokenMiddlewareTestBase):
def setUp(self):