Verify that domain returned from IMDS is an AWS domain
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
| ec2-instance-connect (Ubuntu) |
Undecided
|
Unassigned | ||
| Xenial |
Undecided
|
Unassigned | ||
| Bionic |
Undecided
|
Unassigned | ||
| Focal |
Undecided
|
Unassigned | ||
| Groovy |
Undecided
|
Unassigned |
Bug Description
[Impact]
The domain returned from IMDS is not verified if it was and AWS domain.
[Test Cases]
0) Deploy an Amazon AWS instance with Instance Connect feature enabled
1) Connect to the instance using Instance Connect, for example by pressing the "Connect" button on the web UI.
2. Within a few ten seconds of connecting run (assuming using the ubuntu username):
bash -x /usr/share/
3) The debug output should show successful validation:
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-
+ domain=
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
++ /usr/bin/printf managed-
...
[Regression Potential]
The validation code can fail preventing connection to the VM. Considering that this is a very small amount of code an looks OK this is unlikely.
The validation could also falsely pass, but that would not be a regression since the validation was not there before.
summary: |
- Please update to upstream release 1.1.13 + Verify that domain returned from IMDS is an AWS domain |
description: | updated |
summary: |
- Verify that domain returned from IMDS is an AWS domain + Please update to 1.1.13 upstream release |
summary: |
- Please update to 1.1.13 upstream release + Verify that domain returned from IMDS is an AWS domain |
Launchpad Janitor (janitor) wrote : | #1 |
Changed in ec2-instance-connect (Ubuntu): | |
status: | New → Fix Released |
Łukasz Zemczak (sil2100) wrote : | #2 |
At first I was a bit puzzled by the true/false values used in this patch, made the test case look a bit weird in my mind. But I see it's just what they use - the opposite of what I'd normally use but oh well.
Changed in ec2-instance-connect (Ubuntu Groovy): | |
status: | New → Fix Committed |
tags: | added: verification-needed verification-needed-groovy |
Hello Balint, or anyone else affected,
Accepted ec2-instance-
Please help us by testing this new package. See https:/
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-
Further information regarding the verification process can be found at https:/
N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.
Changed in ec2-instance-connect (Ubuntu Focal): | |
status: | New → Fix Committed |
tags: | added: verification-needed-focal |
Łukasz Zemczak (sil2100) wrote : | #4 |
Hello Balint, or anyone else affected,
Accepted ec2-instance-
Please help us by testing this new package. See https:/
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-
Further information regarding the verification process can be found at https:/
N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.
Changed in ec2-instance-connect (Ubuntu Bionic): | |
status: | New → Fix Committed |
tags: | added: verification-needed-bionic |
Łukasz Zemczak (sil2100) wrote : | #5 |
Hello Balint, or anyone else affected,
Accepted ec2-instance-
Please help us by testing this new package. See https:/
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-
Further information regarding the verification process can be found at https:/
N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.
Changed in ec2-instance-connect (Ubuntu Xenial): | |
status: | New → Fix Committed |
tags: | added: verification-needed-xenial |
Łukasz Zemczak (sil2100) wrote : | #6 |
Hello Balint, or anyone else affected,
Accepted ec2-instance-
Please help us by testing this new package. See https:/
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-
Further information regarding the verification process can be found at https:/
N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.
Balint Reczey (rbalint) wrote : | #7 |
Verified on Groovy with 1.1.12+
ubuntu@
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-
+ domain=
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
++ /usr/bin/printf managed-
...
Balint Reczey (rbalint) wrote : | #8 |
Verified on Focal with 1.1.12+
ubuntu@
Desired=
| Status=
|/ Err?=(none)
||/ Name Version Architecture Description
+++-===
ii ec2-instance-
ubuntu@
+ set -e
+ umask 077
+ IMDS=http://
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-
+ domain=
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
...
Balint Reczey (rbalint) wrote : | #9 |
Verified on Bionic with 1.1.12+
ubuntu@
Desired=
| Status=
|/ Err?=(none)
||/ Name Version Architecture Description
+++-===
ii ec2-instance-
ubuntu@
+ set -e
+ umask 077
+ IMDS=http://
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-
+ domain=
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
Balint Reczey (rbalint) wrote : | #10 |
Verified on Xenial with 1.1.12+
ubuntu@
Desired=
| Status=
|/ Err?=(none)
||/ Name Version Architecture Description
+++-===
ii ec2-instance-
ubuntu@
+ set -e
+ umask 077
+ IMDS=http://
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-
+ domain=
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
...
tags: |
added: verification-done verification-done-bionic verification-done-focal verification-done-groovy verification-done-xenial removed: verification-needed verification-needed-bionic verification-needed-focal verification-needed-groovy verification-needed-xenial |
The verification of the Stable Release Update for ec2-instance-
Launchpad Janitor (janitor) wrote : | #12 |
This bug was fixed in the package ec2-instance-
---------------
ec2-instance-
* Verify that domain returned from IMDS is an AWS domain (LP: #1904741)
-- Balint Reczey <email address hidden> Wed, 18 Nov 2020 15:47:19 +0100
Changed in ec2-instance-connect (Ubuntu Focal): | |
status: | Fix Committed → Fix Released |
Launchpad Janitor (janitor) wrote : | #13 |
This bug was fixed in the package ec2-instance-
---------------
ec2-instance-
* Verify that the domain returned from IMDS is an AWS domain (LP: #1904741)
-- Balint Reczey <email address hidden> Wed, 18 Nov 2020 16:15:19 +0100
Changed in ec2-instance-connect (Ubuntu Bionic): | |
status: | Fix Committed → Fix Released |
Launchpad Janitor (janitor) wrote : | #14 |
This bug was fixed in the package ec2-instance-
---------------
ec2-instance-
* Verify that domain returned from IMDS is an AWS domain (LP: #1904741)
-- Balint Reczey <email address hidden> Wed, 18 Nov 2020 16:20:37 +0100
Changed in ec2-instance-connect (Ubuntu Xenial): | |
status: | Fix Committed → Fix Released |
Launchpad Janitor (janitor) wrote : | #15 |
This bug was fixed in the package ec2-instance-
---------------
ec2-instance-
* Verify that domain returned from IMDS is an AWS domain (LP: #1904741)
-- Balint Reczey <email address hidden> Wed, 18 Nov 2020 15:47:19 +0100
Changed in ec2-instance-connect (Ubuntu Groovy): | |
status: | Fix Committed → Fix Released |
This bug was fixed in the package ec2-instance- connect - 1.1.13-0ubuntu1
--------------- connect (1.1.13-0ubuntu1) hirsute; urgency=medium
ec2-instance-
* debian/copyright: Don't exclude debian/
This is not needed with source format 3.0.
* debian/gbp.conf: Add basic Ubuntu configuration
* New upstream version 1.1.13 (LP: #1904741):
- Verify that domain returned from IMDS is an AWS domain
-- Balint Reczey <email address hidden> Wed, 18 Nov 2020 14:31:17 +0100