rgw: add time skew check in function parse_v4_auth_header #19476

qrGitHub · 2017-12-13T10:09:54Z

In auth v4 http header request, RGW doesn't check time skew, while AWS
does.

Fixes: http://tracker.ceph.com/issues/22418
Signed-off-by: Bingyin Zhang zhangbingyin@cloudin.cn

mattbenjamin · 2017-12-13T10:29:13Z

src/rgw/rgw_auth_s3.cc

@@ -408,6 +408,19 @@ static inline int parse_v4_auth_header(const req_info& info,               /* in
  }
  date = d;

+  uint64_t req_sec = (uint64_t)internal_timegm(&t);


I think we should be using new ceph::time primitives here; @adamemerson?

Yes, we should.

hi @mattbenjamin, thanks for your comments.
I copied "internal_timegm" from function parse_v4_query_string. Would you tell me what "new ceph::time" is?

i think the internal_timegm() bit is fine. there is a common/ceph_time.h header that's based on the std::chrono library that could be used instead of the ceph_clock_now() part. @adamemerson, do you see any advantages to using that here?

@cbodley I'd prefer we use that going forward.

Hi @adamemerson @mattbenjamin @cbodley, do you mean change ceph_clock_now to ceph::real_clock::now?

qrGitHub · 2017-12-16T08:30:30Z

hi @rzarzynski, @cbodley would you help to review this? Thanks.

adamemerson

@cbodley All new code should use the new ceph_time.h stuff. Trying to migrate to it entirely is one of our Trello cards, I believe.

adamemerson · 2017-12-13T15:27:22Z

src/rgw/rgw_auth_s3.cc

@@ -408,6 +408,19 @@ static inline int parse_v4_auth_header(const req_info& info,               /* in
  }
  date = d;

+  uint64_t req_sec = (uint64_t)internal_timegm(&t);


Yes, we should.

adamemerson · 2017-12-19T16:38:38Z

As opposed to utime_t/ceph_clock_now()

cbodley · 2017-12-20T14:40:07Z

@cbodley All new code should use the new ceph_time.h stuff. Trying to migrate to it entirely is one of our Trello cards, I believe.

okay, no arguments there. just note that this block was copied from the v2 implementation, so we should probably move this logic into a helper function and fix both while we're at it. would you be willing to share some example code for @qrGitHub? since the resolution is currently in seconds, is ceph::coarse_real_clock the one you'd recommend?

qrGitHub · 2017-12-23T22:32:01Z

Hi @adamemerson, would you be willing to share some example code? Thanks.

adamemerson · 2018-01-06T00:59:40Z

Yes! Coarse real clock should be the one to use.

adamemerson · 2018-01-06T01:01:55Z

As to timegm or internal_timegm, just use coarse_real_clock::from_time_t() to convert it to time point.

qrGitHub · 2018-01-08T10:03:04Z

Hi @cbodley @adamemerson would you help to review this? Thanks.

cbodley · 2018-01-09T21:53:01Z

src/rgw/rgw_auth_s3.cc

+  auto req_tp = ceph::coarse_real_clock::from_time_t(internal_timegm(&t));
+  auto cur_tp = ceph::coarse_real_clock::now();
+  auto skew = std::chrono::duration_cast<std::chrono::seconds>(cur_tp - req_tp).count();
+  if (skew < -60*RGW_AUTH_GRACE_MINS || skew > 60*RGW_AUTH_GRACE_MINS) {


there's a std::chrono::abs() in c++17 that can simplify this a bit:

constexpr auto grace = std::chrono::minutes{RGW_AUTH_GRACE_MINS}; if (std::chrono::abs(cur_tp - req_tp) > grace) {

cbodley · 2018-01-09T21:54:54Z

src/rgw/rgw_auth_s3.cc

+  if (skew < -60*RGW_AUTH_GRACE_MINS || skew > 60*RGW_AUTH_GRACE_MINS) {
+    dout(10) << "NOTICE: request time skew too big." << dendl;
+    dout(10) << "req_tp=" << ceph::coarse_real_clock::to_time_t(req_tp) <<
+              ", cur_tp=" << ceph::coarse_real_clock::to_time_t(cur_tp) << dendl;


these duration types can be output directly with:

using ceph::operator<<; dout(10) << "req_tp=" << req_tp << ", cur_tp=" << cur_tp << dendl;

* In auth v4 http header request, RGW doesn't check time skew, while AWS * does. Fixes: http://tracker.ceph.com/issues/22418 Signed-off-by: Bingyin Zhang <zhangbingyin@cloudin.cn>

qrGitHub · 2018-01-10T01:33:21Z

Hi @cbodley, would you help to review this?
Do you know how to enable C++17 support in Ubuntu 16.04? I didn't test "std::chrono::abs" because my build machine cannot support C++17 yet.

mattbenjamin · 2018-01-10T01:48:57Z

@qrGitHub @tchaikov certainly does; I'm pretty sure we're sourcing gcc-7and/or clang from some repo in our builders to accomplish that, e.g., https://askubuntu.com/questions/859256/how-to-install-gcc-7-or-clang-4-0

tchaikov · 2018-01-10T05:11:31Z

@qrGitHub please see https://github.com/ceph/ceph#build-prerequisites . install-deps.sh will install gcc-7 on your system.

qrGitHub · 2018-01-10T07:44:27Z

Thanks @mattbenjamin @tchaikov, after install-deps.sh, my machine can build the latest code now.

qrGitHub · 2018-01-15T22:37:27Z

Hi @cbodley, can this be merged? Thanks.

yuriw · 2018-01-16T20:30:16Z

wip-yuri2-testing-2018-01-16-1725

mattbenjamin reviewed Dec 13, 2017

View reviewed changes

qrGitHub mentioned this pull request Dec 13, 2017

rgw: fix return value of auth v2/v4 #19310

Merged

rzarzynski added bug-fix rgw labels Dec 13, 2017

rzarzynski self-requested a review December 17, 2017 12:29

adamemerson reviewed Dec 19, 2017

View reviewed changes

qrGitHub force-pushed the wip-rgw-lack-timeSkewCheck branch from 0707006 to 4a819ce Compare January 8, 2018 10:00

cbodley reviewed Jan 9, 2018

View reviewed changes

rgw: add time skew check in function parse_v4_auth_header

b4e2f32

* In auth v4 http header request, RGW doesn't check time skew, while AWS * does. Fixes: http://tracker.ceph.com/issues/22418 Signed-off-by: Bingyin Zhang <zhangbingyin@cloudin.cn>

qrGitHub force-pushed the wip-rgw-lack-timeSkewCheck branch from 4a819ce to b4e2f32 Compare January 10, 2018 01:28

cbodley approved these changes Jan 10, 2018

View reviewed changes

cbodley added the needs-qa label Jan 10, 2018

yuriw added the wip-yuri2-testing label Jan 16, 2018

yuriw merged commit c329791 into ceph:master Jan 18, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

rgw: add time skew check in function parse_v4_auth_header #19476

rgw: add time skew check in function parse_v4_auth_header #19476

qrGitHub commented Dec 13, 2017

mattbenjamin Dec 13, 2017

adamemerson Dec 13, 2017

qrGitHub Dec 14, 2017

cbodley Dec 19, 2017

mattbenjamin Dec 19, 2017

qrGitHub Dec 20, 2017

qrGitHub commented Dec 16, 2017

adamemerson left a comment

adamemerson Dec 13, 2017

adamemerson commented Dec 19, 2017

cbodley commented Dec 20, 2017

qrGitHub commented Dec 23, 2017

adamemerson commented Jan 6, 2018

adamemerson commented Jan 6, 2018

qrGitHub commented Jan 8, 2018

cbodley Jan 9, 2018

cbodley Jan 9, 2018

qrGitHub commented Jan 10, 2018

mattbenjamin commented Jan 10, 2018

tchaikov commented Jan 10, 2018

qrGitHub commented Jan 10, 2018

qrGitHub commented Jan 15, 2018

yuriw commented Jan 16, 2018

rgw: add time skew check in function parse_v4_auth_header #19476

rgw: add time skew check in function parse_v4_auth_header #19476

Conversation

qrGitHub commented Dec 13, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

qrGitHub commented Dec 16, 2017

adamemerson left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

adamemerson commented Dec 19, 2017

cbodley commented Dec 20, 2017

qrGitHub commented Dec 23, 2017

adamemerson commented Jan 6, 2018

adamemerson commented Jan 6, 2018

qrGitHub commented Jan 8, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

qrGitHub commented Jan 10, 2018

mattbenjamin commented Jan 10, 2018

tchaikov commented Jan 10, 2018

qrGitHub commented Jan 10, 2018

qrGitHub commented Jan 15, 2018

yuriw commented Jan 16, 2018