From fc53b9eedad1fea325f651a6861a82616b715a27 Mon Sep 17 00:00:00 2001 From: Adam Young Date: Fri, 15 Aug 2014 16:13:59 -0400 Subject: [PATCH] Hash for PKIZ Only PKI (asn1) based tokens were checked for format and hashed Closes-Bug: 1355125 SecurityImpact Change-Id: I24cb09edd9a6c9e99e48042a623c7818321f2ead --- keystonemiddleware/auth_token.py | 2 +- .../tests/test_auth_token_middleware.py | 21 +++++++++++++++---- 2 files changed, 18 insertions(+), 5 deletions(-) diff --git a/keystonemiddleware/auth_token.py b/keystonemiddleware/auth_token.py index ce604020..a9625e79 100644 --- a/keystonemiddleware/auth_token.py +++ b/keystonemiddleware/auth_token.py @@ -1396,7 +1396,7 @@ class _TokenCache(object): """ - if cms.is_asn1_token(user_token): + if cms.is_asn1_token(user_token) or cms.is_pkiz(user_token): # user_token is a PKI token that's not hashed. token_hashes = list(cms.cms_hash_token(user_token, mode=algo) diff --git a/keystonemiddleware/tests/test_auth_token_middleware.py b/keystonemiddleware/tests/test_auth_token_middleware.py index e2dff21c..d3f33214 100644 --- a/keystonemiddleware/tests/test_auth_token_middleware.py +++ b/keystonemiddleware/tests/test_auth_token_middleware.py @@ -642,6 +642,12 @@ class CommonAuthTokenMiddlewareTest(object): revoked_form = cms.cms_hash_token(token) self._test_cache_revoked(token, revoked_form) + def test_cached_revoked_pkiz(self): + # When the PKIZ token is cached and revoked, 401 is returned. + token = self.token_dict['signed_token_scoped_pkiz'] + revoked_form = cms.cms_hash_token(token) + self._test_cache_revoked(token, revoked_form) + def test_revoked_token_receives_401_md5_secondary(self): # When hash_algorithms has 'md5' as the secondary hash and the # revocation list contains the md5 hash for a token, that token is @@ -655,7 +661,7 @@ class CommonAuthTokenMiddlewareTest(object): self.middleware(req.environ, self.start_fake_response) self.assertEqual(self.response_status, 401) - def test_revoked_hashed_pki_token(self): + def _test_revoked_hashed_token(self, token_name): # If hash_algorithms is set as ['sha256', 'md5'], # and check_revocations_for_cached is True, # and a token is in the cache because it was successfully validated @@ -666,7 +672,7 @@ class CommonAuthTokenMiddlewareTest(object): self.conf['check_revocations_for_cached'] = True self.set_middleware() - token = self.token_dict['signed_token_scoped'] + token = self.token_dict[token_name] # Put the token in the revocation list. token_hashed = cms.cms_hash_token(token) @@ -680,13 +686,19 @@ class CommonAuthTokenMiddlewareTest(object): self.middleware(req.environ, self.start_fake_response) self.assertEqual(200, self.response_status) - # This time use the PKI token + # This time use the PKI(Z) token req.headers['X-Auth-Token'] = token self.middleware(req.environ, self.start_fake_response) # Should find the token in the cache and revocation list. self.assertEqual(401, self.response_status) + def test_revoked_hashed_pki_token(self): + self._test_revoked_hashed_token('signed_token_scoped') + + def test_revoked_hashed_pkiz_token(self): + self._test_revoked_hashed_token('signed_token_scoped_pkiz') + def get_revocation_list_json(self, token_ids=None, mode=None): if token_ids is None: key = 'revoked_token_hash' + (('_' + mode) if mode else '') @@ -1421,7 +1433,8 @@ class v2AuthTokenMiddlewareTest(BaseAuthTokenMiddlewareTest, self.examples.UUID_TOKEN_BIND, self.examples.UUID_TOKEN_UNKNOWN_BIND, self.examples.UUID_TOKEN_NO_SERVICE_CATALOG, - self.examples.SIGNED_TOKEN_SCOPED_KEY,): + self.examples.SIGNED_TOKEN_SCOPED_KEY, + self.examples.SIGNED_TOKEN_SCOPED_PKIZ_KEY,): httpretty.register_uri(httpretty.GET, "%s/v2.0/tokens/%s" % (BASE_URI, token), body=