From: Greg Blomquist gblomqui@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=760377
The fix for this involves including a bit of a hack in the authentication process. The underlying problem appears to be that certain older OAuth libraries (python-oauth2-1.2.1-3.fc15.noarch) do not include the request body in the part of the request that's signed with HTTP PUTs. However, newer OAuth libraries (python-oauth2-1.5.170-2.fc16.noarch) do include the entire request body in the signature for HTTP PUTs.
The fix introduced in this patch attempts to authenticate the request first by including the entire request body in the signature validation. If that fails, it attempts to authenticate the request by removing the request body (i.e., only uses headers) in the signature validation. If that fails, then the request cannot be authenticated and a 401 is returned. --- configserver/Rakefile | 2 +- configserver/aeolus-configserver.spec.in | 4 +++- configserver/src/config.in.ru | 12 ------------ configserver/src/lib/application_helper.rb | 16 ++++++++++++++-- configserver/src/spec/spec_helper.rb | 1 - 5 files changed, 18 insertions(+), 17 deletions(-)
diff --git a/configserver/Rakefile b/configserver/Rakefile index 4d89ba8..fd71979 100644 --- a/configserver/Rakefile +++ b/configserver/Rakefile @@ -24,7 +24,7 @@ require 'rake/clean' require 'rubygems' require 'rubygems/package_task'
-version = '0.4.3' +version = '0.4.4' man_section = '8' pkg_name = 'aeolus-configserver'
diff --git a/configserver/aeolus-configserver.spec.in b/configserver/aeolus-configserver.spec.in index 7cc7250..465e849 100644 --- a/configserver/aeolus-configserver.spec.in +++ b/configserver/aeolus-configserver.spec.in @@ -17,7 +17,7 @@
Name: aeolus-configserver Version: @VERSION@ -Release: 2%{?dist} +Release: 1%{?dist} Summary: The Aeolus Config Server
Group: Applications/System @@ -169,6 +169,8 @@ fi %doc COPYING
%changelog +* Fri Dec 16 2011 Greg Blomquist gblomqui@redhat.com 0.4.4-1 +- https://bugzilla.redhat.com/show_bug.cgi?id=760377 * Mon Dec 12 2011 Greg Blomquist gblomqui@redhat.com 0.4.3-2 - Fix 500 on audrey-agent HTTP PUT of partial params - https://bugzilla.redhat.com/show_bug.cgi?id=766967 diff --git a/configserver/src/config.in.ru b/configserver/src/config.in.ru index 493064c..2ddb82e 100644 --- a/configserver/src/config.in.ru +++ b/configserver/src/config.in.ru @@ -8,21 +8,9 @@ require 'logger' $LOGGER = Logger.new(ENV['APPLICATION_LOG']) if env == :production $LOGGER.level = Logger::INFO - set :oauth_ignore_post_body, true else $LOGGER.level = Logger::DEBUG require 'ruby-debug' - set :oauth_ignore_post_body, false -end - -# This is an awful hack that needs to go away very soon! -# In order to make this go away, Conductor needs to use -# the oauth client to post instance config XML instead of -# using RestClient -if env == :production - set :oauth_ignore_post_body, true -else - set :oauth_ignore_post_body, false end
run Sinatra::Application diff --git a/configserver/src/lib/application_helper.rb b/configserver/src/lib/application_helper.rb index 615f823..b608163 100644 --- a/configserver/src/lib/application_helper.rb +++ b/configserver/src/lib/application_helper.rb @@ -46,14 +46,26 @@ module ApplicationHelper end
def authenticate! - if not authenticated? + if not authenticated? and not legacy_authenticated? logger.debug(" **AUTHENTICATING** NOT AUTHENTICATED! (returning 401)") throw :halt, [401, "Not Authorized\n"] end end
def authenticated? - unsigned_parameters = settings.oauth_ignore_post_body ? ["data", "audrey_data"] : [] + authd? + end + + # Attempts to authenticate the request by not including the request body + # parameters ("data" or "audrey_data") in the oauth signature validation. + # Some older OAuth libraries don't include the request parameters in the OAuth + # Signature value for HTTP PUT requests. + def legacy_authenticated? + authd?(true) + end + + def authd?(ignore_request_body=false) + unsigned_parameters = ignore_request_body ? ["data", "audrey_data"] : [] OAuth::Signature.verify(request, :unsigned_parameters => unsigned_parameters) do |request_proxy| logger.debug("**AUTHENTICATING** key = #{request_proxy.consumer_key}") consumer = ConfigServer::Model::Consumer.find(request_proxy.consumer_key) diff --git a/configserver/src/spec/spec_helper.rb b/configserver/src/spec/spec_helper.rb index 5df4a79..0c0475d 100644 --- a/configserver/src/spec/spec_helper.rb +++ b/configserver/src/spec/spec_helper.rb @@ -7,7 +7,6 @@ require 'logger' ENV['INSTANCE_CONFIG_RNG'] = '../schema/instance-config.rng' require 'common_config' # HACK, see config.in.ru for details -set :oauth_ignore_post_body, false set :environment, :test
$LOGGER = Logger.new('DEBUG')