[OSSA 2014-026] Domain-scoped tokens don't get revoked (CVE-2014-5253)

[Brant Knudson]

If a domain is invalidated and that generates a revocation event, that revocation event won't match domain-scoped tokens so those tokens won't be revoked.

This is because the code to calculate the fields for a domain-scoped token don't use the domain-scope so that information can't be used when testing against the revocation events.

[Brant Knudson (blk-u)]

In this case some tokens aren't getting revoked when you'd expect them to be, so this is a security vulnerability.

[Brant Knudson (blk-u)]

This is addressed by these reviews:

https://review.openstack.org/#/c/109820/ - Fix revoking domain-scoped tokens
https://review.openstack.org/#/c/109819/ - Correct revocation event test for domain_id

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/109819
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=c4447f16da036fe878382ce4e1b05b84bdcc4d4e
Submitter: Jenkins
Branch: master

commit c4447f16da036fe878382ce4e1b05b84bdcc4d4e
Author: Brant Knudson <email address hidden>
Date: Sat Jul 26 11:21:45 2014 -0500

    Correct revocation event test for domain_id

    The revocation event test used "user_domain_id" and
    "project_domain_id" as token fields that the "domain_id"
    revocation event field maps to, but the token fields are
    actually "identity_domain_id" and "assignment_domain_id", as
    can be seen in
    keystone.contrib.revoke.model.build_token_values().

    Change-Id: I208484da243403287eaa33893d57429c7e6d27c7
    Partial-Bug: #1349597

[Thierry Carrez (ttx)]

Sounds legit. Is havana also affected ?

[Brant Knudson (blk-u)]

Thierry - Havana isn't affected. Revocation events were added in Icehouse.

[Dolph Mathews (dolph)]

Revocations events also aren't consumed yet - so there's no real effect on stable/icehouse until a future keystonemiddleware is released and the events are consumed.

[Morgan Fainberg (mdrnstm)]

As revocation events were not added until Icehouse, havana is not affected.

[Thierry Carrez (ttx)]

@Brant: could you propose an icehouse backport ? We could try to sneak it in 2014.1.2 planned for later this week...

[Tristan Cacqueray (tristan-cacqueray)]

Title: Domain-scoped tokens don't get revoked
Reporter: Brant Knudson (IBM)
Products: Keystone
Versions: 2014.1.1

Description:
Brant Knudson from IBM reported a vulnerability in Keystone revocation events. If a domain is invalidated and that generates a revocation event, that revocation event won't match domain-scoped tokens so those tokens won't be revoked. Only Keystone setups configured to use revocation events are affected.

[Brant Knudson (blk-u)]

For the impact statement in comment 9, change "invalidated" to "disabled", and remove "and that generates a revocation event", since a domain being disabled will generate a revocation event if revocation events are enabled.

Here's a stab at a rewrite:

Brant Knudson from IBM reported a vulnerability in Keystone revocation events. If a domain is disabled any domain-scoped tokens using that domain will remain valid when they should be invalidated. Only Keystone setups configured to use revocation events are affected.

[Tristan Cacqueray (tristan-cacqueray)]

@Brant, thanks for corrections!

We are going to handle the OSSA task within this report: https://launchpad.net/bugs/1347961

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/109820
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=3e035ebb726167aef43c4a865c7e7f7d3b0978fb
Submitter: Jenkins
Branch: master

commit 3e035ebb726167aef43c4a865c7e7f7d3b0978fb
Author: Brant Knudson <email address hidden>
Date: Sat Jul 26 12:24:11 2014 -0500

    Fix revoking domain-scoped tokens

    A token scoped to a domain wouldn't be revoked for a domain-wide
    revocation event. This is because the code to convert a token to a
    dict for revocation event processing didn't handle domain-scoped
    tokens.

    Partial-Bug: #1349597

    Change-Id: Ib2c58f3fc8790dbe7f8b073d18d3fa9b0dff608d

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/112083

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/112084

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/112083
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=cccc3f3239c68479de0f6a41bd64badf2a9ec9e7
Submitter: Jenkins
Branch: stable/icehouse

commit cccc3f3239c68479de0f6a41bd64badf2a9ec9e7
Author: Brant Knudson <email address hidden>
Date: Sat Jul 26 11:21:45 2014 -0500

    Correct revocation event test for domain_id

    The revocation event test used "user_domain_id" and
    "project_domain_id" as token fields that the "domain_id"
    revocation event field maps to, but the token fields are
    actually "identity_domain_id" and "assignment_domain_id", as
    can be seen in
    keystone.contrib.revoke.model.build_token_values().

    Conflicts:

     keystone/tests/test_revoke.py

    Change-Id: I208484da243403287eaa33893d57429c7e6d27c7
    Partial-Bug: #1349597
    (cherry picked from commit c4447f16da036fe878382ce4e1b05b84bdcc4d4e)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/112084
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=317f9d34b4da20c21edd5b851889298b67c843e1
Submitter: Jenkins
Branch: stable/icehouse

commit 317f9d34b4da20c21edd5b851889298b67c843e1
Author: Brant Knudson <email address hidden>
Date: Sat Jul 26 12:24:11 2014 -0500

    Fix revoking domain-scoped tokens

    A token scoped to a domain wouldn't be revoked for a domain-wide
    revocation event. This is because the code to convert a token to a
    dict for revocation event processing didn't handle domain-scoped
    tokens.

    Partial-Bug: #1349597

    Change-Id: Ib2c58f3fc8790dbe7f8b073d18d3fa9b0dff608d
    (cherry picked from commit 3e035ebb726167aef43c4a865c7e7f7d3b0978fb)

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ryan Hsu (<email address hidden>) on branch: master
Review: https://review.openstack.org/121711
Reason: Testing