OpenStack Compute (nova)

Compute node doesn't pass Authentication header, but ObjectStore now checks for presence of Authentication header (Commit 146)

Bug #607572 reported by justinsb
14
This bug affects 3 people
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
Undecided
Unassigned

Bug Description

The ObjectStore now (correctly) checks security on image file downloads, after the twisted rewrite. However, when nova/compute/node.py downloads the image, it simply uses curl without any authentication. Before the twisted rewrite in commit 146, it seems that security was not checked on image downloads.

Revision history for this message
Jay Pipes (jaypipes) wrote :

This bug seems to contradict bug#607512...

Revision history for this message
justinsb (justin-fathomdb) wrote :

Bug 607512 says you can make up Authentication headers without knowing the secret
Bug 607572 says that the compute node doesn't pass any header at all

I can work around the bug by passing use_s3=False to the compute node, but long-term this isn't really an option...

summary: - ObjectStore now checks security (Commit 146), compute node doesn't
- authenticate
+ ObjectStore now checks for presence of Authentication header (Commit
+ 146), compute node doesn't pass Authentication header
summary: - ObjectStore now checks for presence of Authentication header (Commit
- 146), compute node doesn't pass Authentication header
+ Compute node doesn't pass Authentication header, ObjectStore now checks
+ for presence of Authentication header (Commit 146),
summary: - Compute node doesn't pass Authentication header, ObjectStore now checks
- for presence of Authentication header (Commit 146),
+ Compute node doesn't pass Authentication header, but ObjectStore now
+ checks for presence of Authentication header (Commit 146)
Revision history for this message
Soren Hansen (soren) wrote :

This was fixed ages ago.

Changed in nova:
status: New → Fix Committed
Ewan Mellor (ewanmellor)
Changed in nova:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.