Verify that domain returned from IMDS is an AWS domain

[Balint Reczey]

[Impact]

The domain returned from IMDS is not verified if it was and AWS domain.

[Test Cases]

0) Deploy an Amazon AWS instance with Instance Connect feature enabled
1) Connect to the instance using Instance Connect, for example by pressing the "Connect" button on the web UI.
2. Within a few ten seconds of connecting run (assuming using the ubuntu username):

 bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu

3) The debug output should show successful validation:
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: ...XXX...==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
++ /usr/bin/printf managed-ssh-signer.%s.%s us-east-2 amazonaws.com
...

[Regression Potential]

The validation code can fail preventing connection to the VM. Considering that this is a very small amount of code an looks OK this is unlikely.
The validation could also falsely pass, but that would not be a regression since the validation was not there before.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ec2-instance-connect - 1.1.13-0ubuntu1

---------------
ec2-instance-connect (1.1.13-0ubuntu1) hirsute; urgency=medium

  * debian/copyright: Don't exclude debian/
    This is not needed with source format 3.0.
  * debian/gbp.conf: Add basic Ubuntu configuration
  * New upstream version 1.1.13 (LP: #1904741):
    - Verify that domain returned from IMDS is an AWS domain

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 14:31:17 +0100

[Łukasz Zemczak (sil2100)]

At first I was a bit puzzled by the true/false values used in this patch, made the test case look a bit weird in my mind. But I see it's just what they use - the opposite of what I'd normally use but oh well.

[Łukasz Zemczak (sil2100)]

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into groovy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3.20.10.0 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-groovy to verification-done-groovy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-groovy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3.20.04.0 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3~18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3~16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Balint Reczey (rbalint)]

Verified on Groovy with 1.1.12+dfsg1-0ubuntu3.20.10.0:

ubuntu@ip-172-31-44-138:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
++ /usr/bin/printf managed-ssh-signer.%s.%s us-east-2 amazonaws.com

...

[Balint Reczey (rbalint)]

Verified on Focal with 1.1.12+dfsg1-0ubuntu3.20.04.0:

ubuntu@ip-172-31-39-25:~$ dpkg -l ec2-instance-connect | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-====================-=============================-============-=============================================================
ii ec2-instance-connect 1.1.12+dfsg1-0ubuntu3.20.04.0 all Configures ssh daemon to accept EC2 Instance Connect ssh keys
ubuntu@ip-172-31-39-25:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
+ set -e
+ umask 077
+ IMDS=http://169.254.169.254/latest/meta-data
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
...

[Balint Reczey (rbalint)]

Verified on Bionic with 1.1.12+dfsg1-0ubuntu3~18.04.1:

ubuntu@ip-172-31-40-227:~$ dpkg -l ec2-instance-connect | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-====================-=============================-============-=============================================================
ii ec2-instance-connect 1.1.12+dfsg1-0ubuntu3~18.04.1 all Configures ssh daemon to accept EC2 Instance Connect ssh keys
ubuntu@ip-172-31-40-227:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
+ set -e
+ umask 077
+ IMDS=http://169.254.169.254/latest/meta-data
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'

[Balint Reczey (rbalint)]

Verified on Xenial with 1.1.12+dfsg1-0ubuntu3~16.04.1:

ubuntu@ip-172-31-43-13:~$ dpkg -l ec2-instance-connect | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-====================-=============================-============-=============================================================
ii ec2-instance-connect 1.1.12+dfsg1-0ubuntu3~16.04.1 all Configures ssh daemon to accept EC2 Instance Connect ssh keys
ubuntu@ip-172-31-43-13:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
+ set -e
+ umask 077
+ IMDS=http://169.254.169.254/latest/meta-data
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
...

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for ec2-instance-connect has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3.20.04.0

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3.20.04.0) focal; urgency=medium

  * Verify that domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 15:47:19 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3~18.04.1

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3~18.04.1) bionic; urgency=medium

  * Verify that the domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 16:15:19 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3~16.04.1

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3~16.04.1) xenial; urgency=medium

  * Verify that domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 16:20:37 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3.20.10.0

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3.20.10.0) groovy; urgency=medium

  * Verify that domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 15:47:19 +0100