Merge lp:~niedbalski/python-keystoneclient/kilo-fix-lp-1368545 into lp:~ubuntu-server-dev/python-keystoneclient/kilo

[Jorge Niedbalski]

Fixes LP: #1368545

[lp:~niedbalski/python-keystoneclient/kilo-fix-lp-1368545]

104. By Jorge Niedbalski on 2015-08-07

Typo on description

[Corey Bryant (corey.bryant)]

review: Approve

=== modified file 'debian/changelog'
--- debian/changelog	2015-03-05 14:03:29 +0000
+++ debian/changelog	2015-08-07 15:08:21 +0000
@@ -1,3 +1,20 @@
+python-keystoneclient (1:1.2.0-0ubuntu1.2) vivid; urgency=medium
+
+  * debian/patches/fix-1368545.patch: Changing the value type of
+    http_connect_timeout to IntOpt. (LP: #1368545)
+
+ -- Jorge Niedbalski <[e-mail]>  Fri, 07 Aug 2015 11:53:37 -0300
+
+python-keystoneclient (1:1.2.0-0ubuntu1.1) vivid-security; urgency=medium
+
+  * SECURITY UPDATE: incorrect cert verification with ssl_insecure option
+    - debian/patches/CVE-2015-1852.patch: properly parse option in
+      keystoneclient/middleware/s3_token.py, added test to
+      keystoneclient/tests/unit/test_s3_token_middleware.py.
+    - CVE-2015-1852
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 16 Jul 2015 14:44:43 -0400
+
 python-keystoneclient (1:1.2.0-0ubuntu1) vivid; urgency=medium
 
   * New upstream release. 
 
=== added file 'debian/patches/CVE-2015-1852.patch'
--- debian/patches/CVE-2015-1852.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/CVE-2015-1852.patch	2015-08-07 15:08:21 +0000
@@ -0,0 +1,79 @@
+From 85eeecbd3d06e98011def3d0d8329646cc175163 Mon Sep 17 00:00:00 2001
+From: Brant Knudson <[e-mail]>
+Date: Tue, 7 Apr 2015 19:38:29 +0000
+Subject: [PATCH] Fix s3_token middleware parsing insecure option
+
+The "insecure" option was being treated as a bool when it was
+actually provided as a string. The fix is to parse the string to
+a bool.
+
+Closes-Bug: 1411063
+Change-Id: Id674f40532215788675c97a8fdfa91d4420347b3
+---
+ keystoneclient/middleware/s3_token.py              |  3 ++-
+ .../tests/unit/test_s3_token_middleware.py         | 24 +++++++++++++++++++++-
+ 2 files changed, 25 insertions(+), 2 deletions(-)
+
+Index: python-keystoneclient-1.2.0/keystoneclient/middleware/s3_token.py
+===================================================================
+--- python-keystoneclient-1.2.0.orig/keystoneclient/middleware/s3_token.py	2015-07-16 14:44:32.325609427 -0400
++++ python-keystoneclient-1.2.0/keystoneclient/middleware/s3_token.py	2015-07-16 14:44:32.321609377 -0400
+@@ -34,6 +34,7 @@
+ import logging
+ 
+ from oslo_serialization import jsonutils
++from oslo_utils import strutils
+ import requests
+ import six
+ from six.moves import urllib
+@@ -116,7 +117,7 @@
+         self.request_uri = '%s://%s:%s' % (auth_protocol, auth_host, auth_port)
+ 
+         # SSL
+-        insecure = conf.get('insecure', False)
++        insecure = strutils.bool_from_string(conf.get('insecure', False))
+         cert_file = conf.get('certfile')
+         key_file = conf.get('keyfile')
+ 
+Index: python-keystoneclient-1.2.0/keystoneclient/tests/unit/test_s3_token_middleware.py
+===================================================================
+--- python-keystoneclient-1.2.0.orig/keystoneclient/tests/unit/test_s3_token_middleware.py	2015-07-16 14:44:32.325609427 -0400
++++ python-keystoneclient-1.2.0/keystoneclient/tests/unit/test_s3_token_middleware.py	2015-07-16 14:44:32.325609427 -0400
+@@ -122,7 +122,7 @@
+     @mock.patch.object(requests, 'post')
+     def test_insecure(self, MOCK_REQUEST):
+         self.middleware = (
+-            s3_token.filter_factory({'insecure': True})(FakeApp()))
++            s3_token.filter_factory({'insecure': 'True'})(FakeApp()))
+ 
+         text_return_value = jsonutils.dumps(GOOD_RESPONSE)
+         if six.PY3:
+@@ -140,6 +140,28 @@
+         mock_args, mock_kwargs = MOCK_REQUEST.call_args
+         self.assertIs(mock_kwargs['verify'], False)
+ 
++    def test_insecure_option(self):
++        # insecure is passed as a string.
++
++        # Some non-secure values.
++        true_values = ['true', 'True', '1', 'yes']
++        for val in true_values:
++            config = {'insecure': val, 'certfile': 'false_ind'}
++            middleware = s3_token.filter_factory(config)(FakeApp())
++            self.assertIs(False, middleware.verify)
++
++        # Some "secure" values, including unexpected value.
++        false_values = ['false', 'False', '0', 'no', 'someweirdvalue']
++        for val in false_values:
++            config = {'insecure': val, 'certfile': 'false_ind'}
++            middleware = s3_token.filter_factory(config)(FakeApp())
++            self.assertEqual('false_ind', middleware.verify)
++
++        # Default is secure.
++        config = {'certfile': 'false_ind'}
++        middleware = s3_token.filter_factory(config)(FakeApp())
++        self.assertIs('false_ind', middleware.verify)
++
+ 
+ class S3TokenMiddlewareTestBad(S3TokenMiddlewareTestBase):
+     def setUp(self):
 
=== added file 'debian/patches/fix-1368545.patch'
--- debian/patches/fix-1368545.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/fix-1368545.patch	2015-08-07 15:08:21 +0000
@@ -0,0 +1,25 @@
+Description: Changing the value type of http_connect_timeout
+
+The value type of http_connect_timeout definition
+is changed from Bool to Int value. Python treats
+a value more than 1 as True but oslo config defines
+Boolean values as 'true, '1', 'yes' and 'on'.
+So http_connect_timeout is only configured 1 or None.
+
+Change-Id: I53075cc04d0ccea543f8e657279534208ed03058
+Closes-bug: #1368545.
+
+Origin: upstream, https://review.openstack.org/#/c/126543
+Bug-Ubuntu: https://bugs.launchpad.net/keystonemiddleware/+bug/1368545
+
+--- python-keystoneclient-0.7.1.orig/keystoneclient/middleware/auth_token.py
++++ python-keystoneclient-0.7.1/keystoneclient/middleware/auth_token.py
+@@ -212,7 +212,7 @@ opts = [
+                 help='Do not handle authorization requests within the'
+                 ' middleware, but delegate the authorization decision to'
+                 ' downstream WSGI components'),
+-    cfg.BoolOpt('http_connect_timeout',
++    cfg.IntOpt('http_connect_timeout',
+                 default=None,
+                 help='Request timeout value for communicating with Identity'
+                 ' API server.'),
 
=== added file 'debian/patches/series'
--- debian/patches/series	1970-01-01 00:00:00 +0000
+++ debian/patches/series	2015-08-07 15:08:21 +0000
@@ -0,0 +1,2 @@
+CVE-2015-1852.patch
+fix-1368545.patch