Verify that domain returned from IMDS is an AWS domain

Bug #1904741 reported by Balint Reczey on 2020-11-18
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ec2-instance-connect (Ubuntu)
Undecided
Unassigned
Xenial
Undecided
Unassigned
Bionic
Undecided
Unassigned
Focal
Undecided
Unassigned
Groovy
Undecided
Unassigned

Bug Description

[Impact]

The domain returned from IMDS is not verified if it was and AWS domain.

[Test Cases]

0) Deploy an Amazon AWS instance with Instance Connect feature enabled
1) Connect to the instance using Instance Connect, for example by pressing the "Connect" button on the web UI.
2. Within a few ten seconds of connecting run (assuming using the ubuntu username):

 bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu

3) The debug output should show successful validation:
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: ...XXX...==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
++ /usr/bin/printf managed-ssh-signer.%s.%s us-east-2 amazonaws.com
...

[Regression Potential]

The validation code can fail preventing connection to the VM. Considering that this is a very small amount of code an looks OK this is unlikely.
The validation could also falsely pass, but that would not be a regression since the validation was not there before.

Balint Reczey (rbalint) on 2020-11-18
summary: - Please update to upstream release 1.1.13
+ Verify that domain returned from IMDS is an AWS domain
Balint Reczey (rbalint) on 2020-11-18
description: updated
Balint Reczey (rbalint) on 2020-11-18
summary: - Verify that domain returned from IMDS is an AWS domain
+ Please update to 1.1.13 upstream release
summary: - Please update to 1.1.13 upstream release
+ Verify that domain returned from IMDS is an AWS domain
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ec2-instance-connect - 1.1.13-0ubuntu1

---------------
ec2-instance-connect (1.1.13-0ubuntu1) hirsute; urgency=medium

  * debian/copyright: Don't exclude debian/
    This is not needed with source format 3.0.
  * debian/gbp.conf: Add basic Ubuntu configuration
  * New upstream version 1.1.13 (LP: #1904741):
    - Verify that domain returned from IMDS is an AWS domain

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 14:31:17 +0100

Changed in ec2-instance-connect (Ubuntu):
status: New → Fix Released
Łukasz Zemczak (sil2100) wrote :

At first I was a bit puzzled by the true/false values used in this patch, made the test case look a bit weird in my mind. But I see it's just what they use - the opposite of what I'd normally use but oh well.

Changed in ec2-instance-connect (Ubuntu Groovy):
status: New → Fix Committed
tags: added: verification-needed verification-needed-groovy

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into groovy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3.20.10.0 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-groovy to verification-done-groovy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-groovy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in ec2-instance-connect (Ubuntu Focal):
status: New → Fix Committed
tags: added: verification-needed-focal
Łukasz Zemczak (sil2100) wrote :

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3.20.04.0 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in ec2-instance-connect (Ubuntu Bionic):
status: New → Fix Committed
tags: added: verification-needed-bionic
Łukasz Zemczak (sil2100) wrote :

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3~18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in ec2-instance-connect (Ubuntu Xenial):
status: New → Fix Committed
tags: added: verification-needed-xenial
Łukasz Zemczak (sil2100) wrote :

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3~16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Balint Reczey (rbalint) wrote :

Verified on Groovy with 1.1.12+dfsg1-0ubuntu3.20.10.0:

ubuntu@ip-172-31-44-138:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
++ /usr/bin/printf managed-ssh-signer.%s.%s us-east-2 amazonaws.com

...

Balint Reczey (rbalint) wrote :

Verified on Focal with 1.1.12+dfsg1-0ubuntu3.20.04.0:

ubuntu@ip-172-31-39-25:~$ dpkg -l ec2-instance-connect | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-====================-=============================-============-=============================================================
ii ec2-instance-connect 1.1.12+dfsg1-0ubuntu3.20.04.0 all Configures ssh daemon to accept EC2 Instance Connect ssh keys
ubuntu@ip-172-31-39-25:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
+ set -e
+ umask 077
+ IMDS=http://169.254.169.254/latest/meta-data
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
...

Balint Reczey (rbalint) wrote :

Verified on Bionic with 1.1.12+dfsg1-0ubuntu3~18.04.1:

ubuntu@ip-172-31-40-227:~$ dpkg -l ec2-instance-connect | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-====================-=============================-============-=============================================================
ii ec2-instance-connect 1.1.12+dfsg1-0ubuntu3~18.04.1 all Configures ssh daemon to accept EC2 Instance Connect ssh keys
ubuntu@ip-172-31-40-227:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
+ set -e
+ umask 077
+ IMDS=http://169.254.169.254/latest/meta-data
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'

Balint Reczey (rbalint) wrote :

Verified on Xenial with 1.1.12+dfsg1-0ubuntu3~16.04.1:

ubuntu@ip-172-31-43-13:~$ dpkg -l ec2-instance-connect | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-====================-=============================-============-=============================================================
ii ec2-instance-connect 1.1.12+dfsg1-0ubuntu3~16.04.1 all Configures ssh daemon to accept EC2 Instance Connect ssh keys
ubuntu@ip-172-31-43-13:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
+ set -e
+ umask 077
+ IMDS=http://169.254.169.254/latest/meta-data
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
...

tags: added: verification-done verification-done-bionic verification-done-focal verification-done-groovy verification-done-xenial
removed: verification-needed verification-needed-bionic verification-needed-focal verification-needed-groovy verification-needed-xenial

The verification of the Stable Release Update for ec2-instance-connect has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3.20.04.0

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3.20.04.0) focal; urgency=medium

  * Verify that domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 15:47:19 +0100

Changed in ec2-instance-connect (Ubuntu Focal):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3~18.04.1

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3~18.04.1) bionic; urgency=medium

  * Verify that the domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 16:15:19 +0100

Changed in ec2-instance-connect (Ubuntu Bionic):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3~16.04.1

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3~16.04.1) xenial; urgency=medium

  * Verify that domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 16:20:37 +0100

Changed in ec2-instance-connect (Ubuntu Xenial):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3.20.10.0

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3.20.10.0) groovy; urgency=medium

  * Verify that domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 15:47:19 +0100

Changed in ec2-instance-connect (Ubuntu Groovy):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers