EC2 token requests contain a signature that signs the entire request,
including the access timestamp. While the signature is checked, the
timestamp is not, and so these signed requests remain valid
indefinitely, leaving the token API vulnerable to replay attacks. This
change introduces a configurable TTL for signed token requests and
ensures that the timestamp is actually validated against it.
The check will work for either an AWS Signature v1/v2 'Timestamp'
parameter[1] or the AWS Signature v4 'X-Aws-Date' header or
parameter[2].
Although this technically adds a new feature and the default value of
the feature changes behavior, this change is required to protect
credential holders and therefore must be backported to all supported
branches.
Reviewed: https:/ /review. opendev. org/724746 /git.openstack. org/cgit/ openstack/ keystone/ commit/ ?id=8d5becbe4b4 63f6a5a24a1929d d0f48dab6ae027
Committed: https:/
Submitter: Zuul
Branch: stable/ussuri
commit 8d5becbe4b463f6 a5a24a1929dd0f4 8dab6ae027
Author: Colleen Murphy <email address hidden>
Date: Thu Apr 16 17:05:43 2020 -0700
Check timestamp of signed EC2 token request
EC2 token requests contain a signature that signs the entire request,
including the access timestamp. While the signature is checked, the
timestamp is not, and so these signed requests remain valid
indefinitely, leaving the token API vulnerable to replay attacks. This
change introduces a configurable TTL for signed token requests and
ensures that the timestamp is actually validated against it.
The check will work for either an AWS Signature v1/v2 'Timestamp'
parameter[1] or the AWS Signature v4 'X-Aws-Date' header or
parameter[2].
Although this technically adds a new feature and the default value of
the feature changes behavior, this change is required to protect
credential holders and therefore must be backported to all supported
branches.
[1] https:/ /docs.aws. amazon. com/general/ latest/ gr/signature- version- 2.html /docs.aws. amazon. com/general/ latest/ gr/sigv4- date-handling. html
[2] https:/
Change-Id: Idb10267338b420 4b435df233c6360 46a1ce5711f 2c46260f68504f5 687763e019)
Closes-bug: #1872737
(cherry picked from commit ab89ea749013e7f