keystonemiddleware

keystonemiddleware audit selects the wrong target service

Bug #1797584 reported by Michael Johnson
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
keystonemiddleware
Fix Released
Medium
Michael Johnson

Bug Description

Keystonemiddleware audit support is selecting the wrong "target" service when OpenStack service endpoints are not using unique TCP ports.

The incorrect code is here: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/audit/_api.py#L270

With that code, if the services are not using unique TCP ports for each endpoint, the first endpoint that matches the IP adddress of the request will be selected.

Since most services have moved to not using TCP ports for their endpoints, this needs to be fixed to allow the proper target service to be selected.

Michael Johnson (johnsom)
Changed in keystonemiddleware:
assignee: nobody → Michael Johnson (johnsom)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystonemiddleware (master)

Fix proposed to branch: master
Review: https://review.openstack.org/610099

Changed in keystonemiddleware:
status: New → In Progress
Morgan Fainberg (mdrnstm)
Changed in keystonemiddleware:
importance: Undecided → Medium
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystonemiddleware (master)

Reviewed: https://review.openstack.org/610099
Committed: https://git.openstack.org/cgit/openstack/keystonemiddleware/commit/?id=782729b6e98c1d2857c7e4f24bb69219e43c108f
Submitter: Zuul
Branch: master

commit 782729b6e98c1d2857c7e4f24bb69219e43c108f
Author: Michael Johnson <email address hidden>
Date: Fri Oct 12 09:05:10 2018 -0700

    Fix audit target service selection

    The keystonemiddleware audit code would select the wrong OpenStack service
    endpoint for a request if the cloud is not using unique TCP ports for each
    service endpoint. As most services are no longer using a port per service,
    but instead using unique paths, this caused the audit to select the wrong
    target service. This leads to incorrect audit logging due to the wrong
    audit map being used.

    This patch checks the request to see if a TCP port was present in the request,
    and if not, fall back to using the target_endpoint_type configured in the
    audit map file.

    Change-Id: Ie2e0bf74ecca485d599a4041bb770bd6e296bc99
    Closes-bug: 1797584

Changed in keystonemiddleware:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/keystonemiddleware 6.0.0

This issue was fixed in the openstack/keystonemiddleware 6.0.0 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.