openstack
/
openstack
Code Issues Proposed changes

Update git submodules 

* Update ironic from branch 'master'
  - Merge "Pre-shared agent token"
  - Pre-shared agent token
    
    In order to improve security of the lookup/heartbeat
    endpoints, we need to generate and provide temporary tokens
    to the initial callers, if supported, to facilitate the
    verification of commands.
    
    This is the first patch in an entire series which utimately
    enables the endpoint communication to be better secured.
    
    The idea behind this started in private story 2006634 which
    is locked as a security related filing covering multiple
    aspects of ironic/ironic-python-agent interaction centered
    around miss-use and generally exposed endpoints. That story
    will remain marked as a private bug because it has several
    different items covered, some of which did not prove to be
    actually exploitable, but spawned stories 2006777, 2006773,
    2007025, and is ultimately similar to Story 1526748.
    
    Operationally this is a minimally invasive security
    enhancement to lay the foundation to harden interactions
    with the agent. This will take place over a series of
    patches to both Ironic and the Ironic-Python-Agent.
    
    Also see "Security of /heartbeat and /lookup endpoints"
    in http://lists.openstack.org/pipermail/openstack-discuss/2019-November/010789.html
    
    Story: 2007025
    Task: 37818
    
    Change-Id: I0118007cac3d6548e9d41c5e615a819150b6ef1a
This commit is contained in:
Zuul 2020-02-28 22:29:44 +00:00 committed by Gerrit Code Review
parent 787482e859
commit 45c4e0e39c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ironic

@ -1 +1 @@
Subproject commit 6ba983b615a75c2be69ced795ecde3681dd8f79c
Subproject commit 25879fec84c0b4ed7ea0808a8be9b2be48c15d95