Validation of Timestamp/Expires for ec2 query parameters is not correct

[Roland Hochmuth]

It doesn't appear that the the Timestamp query parameter for ec2 requests is completely validated or used. Looking at the class "Requestify" in ../nova/api/ec2/__init__.py There are several potential issues:

1. Only Timestamp is tested for, but Expires isn't.
2. The format of the Timestamp is not tested for.
3. The value of the Timestamp is not tested to be within some time delta.

The AWS documentation states at this link

    http://docs.amazonwebservices.com/AWSEC2/latest/APIReference/Query-Common-Parameters.html

"Requests must include either Timestamp or Expires, but cannot contain both" and "The date and time at which the request is signed, in the format YYYY-MM-DDThh:mm:ssZ" which addresses points 1 and 2 above.

The AWS documentation at this link and others

    http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/Error_Messages.html

states,

"Why do I get keep getting "Request has expired" errors?

To reduce the risk of replay attacks, our requests include a timestamp. This and the most important parts of the request are signed to ensure the message (including the timestamp) cannot be modified without detection.

If the difference between the timestamp in the request and the time on our servers is larger than 5 minutes, the request is too old (or too new) and an error is returned.

You need to ensure that your system clock is accurate and configured to use the correct time zone. For more information, go to NTP."

Looking at the code in Requestify and searching the rest of the code base for use of "Timestamp" I don't any places where Timestamp is used or tested. It seems like this is a potential security related issue.

[Joe Gordon (jogo)]

@Andrew, are you still working on this?

[Andrew James (ajames)]

I am not actively working on this and it's ok if you reassign to someone else. Otherwise, I will plan to complete this as time allows.

It seems this kind of 'validation' needs to be done in Requestify rather than Validate. It would be nice if a fix for this cleaned up the logic in Requestify as a side effect.

[Roland Hochmuth (roland-hochmuth)]

Hi Andrew, I'll take it.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/13194

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/14199
Committed: http://github.com/openstack/openstack-common/commit/85bed287461036745afe6a4c623e546c52641b1e
Submitter: Jenkins
Branch: master

commit 85bed287461036745afe6a4c623e546c52641b1e
Author: Sirisha Devineni <email address hidden>
Date: Tue Oct 9 17:33:35 2012 +0530

    Added is_newer_than function

    Added is_newer_than function to compare if the provided
    time is newer than current time for specified number of
    seconds

    Fixes bug 1036343

    Change-Id: Ic133b0e7e2337b6b0fdad244ded6a93f8db48379

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/13194
Committed: http://github.com/openstack/nova/commit/1056677bb6e5bda331270100b577f085cd0b5067
Submitter: Jenkins
Branch: master

commit 1056677bb6e5bda331270100b577f085cd0b5067
Author: Sirisha Devineni <email address hidden>
Date: Tue Sep 18 14:11:45 2012 +0530

    Validates Timestamp or Expiry time in EC2 requests

    Validating the format of Timestamp/Expires in the EC2 requests
    and checking for the expiry of the request. 'ec2_timestamp_expiry'
    flag is the time in seconds before ec2 timestamp expires.

    Fixes bug 1036343

    Change-Id: I2b63d85dc1d658a58ceda67c0dfd0a8eac807577