grizzly: swift Remove IP-based container-sync ACLs from auth middlewares.
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
openstack-manuals |
Fix Released
|
Medium
|
Tom Fifield |
Bug Description
https:/
The determination of the client IP looked at the X-Cluster-Client-Ip
and X-Forwarded-For headers in the incoming HTTP request. This is
trivially spoofable by a malicious client, so there's no security
gained by having the check there.
Worse, having the check there provides a false sense of security to
cluster operators. It sounds like it's based on the client IP, so an
attacker would have to do IP spoofing to defeat it. However, it's
really just a shared secret, and there's already a secret key set
up. Basically, it looks like 2-factor auth (IP+key), but it's really
1-factor (key).
Now, the one case where this might provide some security is where the
Swift cluster is behind an external load balancer that strips off the
X-Cluster-
own. I don't think it's worth the tradeoff, hence this commit.
Changed in openstack-manuals: | |
milestone: | none → grizzly |
status: | New → Confirmed |
importance: | Undecided → Medium |
tags: | added: swift |
Changed in openstack-manuals: | |
assignee: | nobody → Tom Fifield (fifieldt) |
status: | Confirmed → In Progress |
Fix proposed to branch: master /review. openstack. org/19363
Review: https:/