Barbican

KMIP secret store cannot store keys

Bug #1449234 reported by Nathan Reller
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Barbican
Fix Released
High
Nathan Reller
Barbican 1.0.0 "liberty"
Kilo
Fix Released
Critical
Douglas Mendizábal
Barbican 2015.1.0 "kilo"

Bug Description

The KMIP secret store is not properly storing keys or is failing to store keys. If the result is positive and it stores the key then the key retrieval is incorrect.

To recreate this store a key using the values below for a POST request.

{
  "name": "AES key",
  "algorithm": "aes",
  "bit_length": 128,
  "mode": "cbc",
  "secret_type": "symmetric",
  "payload": "MTIzNDU2NzgxMjM0NTY3OA==",
  "payload_content_type": "application/octet-stream",
  "payload_content_encoding": "base64"
}

The payload in this example is '1234567812345678'. Then when the key is returned it should be the string '1234567812345678'. However, the string "{'bytes': '1234567812345678'}" is returned.

If the result is negative, meaning the KMIP appliance could not save the bytes, then an internal server error is returned with 500 error code.

Tags: kmip
Nathan Reller (rellerreller)
Changed in barbican:
assignee: nobody → Nathan Reller (rellerreller)
Douglas Mendizábal (dougmendizabal)
Changed in barbican:
status: New → Confirmed
importance: Undecided → High
milestone: none → liberty-1
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to barbican (master)

Fix proposed to branch: master
Review: https://review.openstack.org/178179

Changed in barbican:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to barbican (master)

Reviewed: https://review.openstack.org/178179
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=597869880f186ce951809fe85d5d7d0610f35c4f
Submitter: Jenkins
Branch: master

commit 597869880f186ce951809fe85d5d7d0610f35c4f
Author: Nathan Reller <email address hidden>
Date: Tue Apr 28 08:54:25 2015 -0400

    Fixed Bug for KMIP Secret Storage

    The KMIP secret store was incorrectly storing secrets. In some cases
    this resulted in extra information being stored with the keys and in
    other cases the key storage would fail with a 500 internal server
    error.

    This patch fixes the KMIP secret store to correctly store secrets.

    Change-Id: I94944a05776d366bd33d46ddb25f7129425405d0
    Co-authored-by: Kaitlin Farr <email address hidden>
    Closes-Bug: #1449234

Changed in barbican:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to barbican (stable/kilo)

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/178502

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to barbican (stable/kilo)

Reviewed: https://review.openstack.org/178502
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=e6f05febbe18a86e4e6b05acc5f4868fa3beb291
Submitter: Jenkins
Branch: stable/kilo

commit e6f05febbe18a86e4e6b05acc5f4868fa3beb291
Author: Nathan Reller <email address hidden>
Date: Tue Apr 28 08:54:25 2015 -0400

    Fixed Bug for KMIP Secret Storage

    The KMIP secret store was incorrectly storing secrets. In some cases
    this resulted in extra information being stored with the keys and in
    other cases the key storage would fail with a 500 internal server
    error.

    This patch fixes the KMIP secret store to correctly store secrets.

    Change-Id: I94944a05776d366bd33d46ddb25f7129425405d0
    Co-authored-by: Kaitlin Farr <email address hidden>
    Closes-Bug: #1449234
    (cherry picked from commit 597869880f186ce951809fe85d5d7d0610f35c4f)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to barbican (master)

Fix proposed to branch: master
Review: https://review.openstack.org/179301

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to barbican (master)
Download full text (3.2 KiB)

Reviewed: https://review.openstack.org/179301
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=80af5cbd25f49e0f96b10604978712643213d427
Submitter: Jenkins
Branch: master

commit e6f05febbe18a86e4e6b05acc5f4868fa3beb291
Author: Nathan Reller <email address hidden>
Date: Tue Apr 28 08:54:25 2015 -0400

    Fixed Bug for KMIP Secret Storage

    The KMIP secret store was incorrectly storing secrets. In some cases
    this resulted in extra information being stored with the keys and in
    other cases the key storage would fail with a 500 internal server
    error.

    This patch fixes the KMIP secret store to correctly store secrets.

    Change-Id: I94944a05776d366bd33d46ddb25f7129425405d0
    Co-authored-by: Kaitlin Farr <email address hidden>
    Closes-Bug: #1449234
    (cherry picked from commit 597869880f186ce951809fe85d5d7d0610f35c4f)

commit 604c402be0e50aaa305154dc1c39fda08b7566d9
Author: Arun Kant <email address hidden>
Date: Fri Apr 24 09:19:25 2015 -0700

    Fix for missing id check in ACL count query.

    Fixing issue and adding unit test to cover this API specifically.
    It may need to be backported to Kilo as well.

    Closes-Bug: #1447868

    Change-Id: I1d6cc4ea59ea767d08112b148fb6b085bb2c4859

commit 46184bb4b3a81e503a9e4aff4ba9ea0a66061a16
Author: Charles Neill <email address hidden>
Date: Tue Apr 21 15:49:20 2015 -0500

    Removing signing_dir directive from config

    The signing_dir directive defined in barbican-api-paste.ini explicitly
    stores Keystone's signing certificates in a known /tmp directory. This
    could be exploited by populating the directory with bogus certificates,
    potentially allowing a malicious user to generate valid tokens.

    Added comment explaining signing_dir, and a reasonable
    (commented) default.

    Change-Id: I15fda6863e888e3881694ab47a836eee2fb578ee
    Closes-Bug: #1446406

commit 4861932b51e491d217276f07f52e116179dc0d15
Author: Dave McCowan <email address hidden>
Date: Tue Apr 21 17:59:41 2015 -0400

    Fix failure with get on dict that was None

    When calling get_acl_dict_for_user() in the RBAC feature, the user list
    may be empty. In this case, make sure an empty list (not None) is
    returned so the receiving code won't fail.

    Change-Id: I6aeb94e03aa7898823ec408807180f7eeb2d2916
    Closes-bug: #1446826

commit b37c35c9229dab43e3d77e5061d06f34c787bc2b
Author: Dave McCowan <email address hidden>
Date: Fri Apr 24 08:50:09 2015 -0400

    Fix call to load_privatekey() when passphrase is None

    The original code worked, but breaks with PyOpenSSL 0.15.1,
    the version currently used by the gate.

    Closes-Bug: #1448193
    Change-Id: Iae44f08fa6442e3463e6b552955229f3fd36fbde

commit 93718aaa70d3f4523e636bfa6d602470e0d26b26
Author: OpenStack Proposal Bot <email address hidden>
Date: Mon Apr 20 17:54:00 2015 +0000

    Updated from global requirements

    Change-Id: Ife99d56a70c0ebd10a9ea47b06f969cd1e74b984

commit bb1cf4d54b2b7e95dd3f37d4c3f0cd1b0045ce7b
Author: Thierry Carrez <email address hidden>
Date: Mon Apr 20 18:26:05 2015 +0200
...

Read more...

Doug Hellmann (doug-hellmann)
Changed in barbican:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in barbican:
milestone: liberty-1 → 1.0.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.