sailesh1993 / rpms / cloud-init

Forked from rpms/cloud-init a year ago
Clone
376cca
From dc9460f161efce6770f66bb95d60cea6d27df722 Mon Sep 17 00:00:00 2001
9dab26
From: Eduardo Otubo <otubo@redhat.com>
376cca
Date: Thu, 25 Jun 2020 08:03:59 +0200
376cca
Subject: [PATCH] ec2: only redact token request headers in logs, avoid
9dab26
 altering request (#230)
9dab26
9dab26
RH-Author: Eduardo Otubo <otubo@redhat.com>
376cca
Message-id: <20200624112104.376-1-otubo@redhat.com>
376cca
Patchwork-id: 97793
376cca
O-Subject: [RHEL-8.3.0 cloud-init PATCH] ec2: only redact token request headers in logs, avoid altering request (#230)
376cca
Bugzilla: 1822343
9dab26
RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
9dab26
RH-Acked-by: Mohammed Gamal <mgamal@redhat.com>
376cca
RH-Acked-by: Cathy Avery <cavery@redhat.com>
376cca
376cca
From: Chad Smith <chad.smith@canonical.com>
9dab26
9dab26
commit fa1abfec27050a4fb71cad950a17e42f9b43b478
9dab26
Author: Chad Smith <chad.smith@canonical.com>
9dab26
Date:   Tue Mar 3 15:23:33 2020 -0700
9dab26
9dab26
    ec2: only redact token request headers in logs, avoid altering request (#230)
9dab26
9dab26
    Our header redact logic was redacting both logged request headers and
9dab26
    the actual source request. This results in DataSourceEc2 sending the
9dab26
    invalid header "X-aws-ec2-metadata-token-ttl-seconds: REDACTED" which
9dab26
    gets an HTTP status response of 400.
9dab26
9dab26
    Cloud-init retries this failed token request for 2 minutes before
9dab26
    falling back to IMDSv1.
9dab26
9dab26
    LP: #1865882
9dab26
9dab26
Signed-off-by: Eduardo Otubo <otubo@redhat.com>
9dab26
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
9dab26
---
9dab26
 cloudinit/tests/test_url_helper.py | 34 +++++++++++++++++++++++++++++++++-
9dab26
 cloudinit/url_helper.py            | 15 ++++++++-------
9dab26
 2 files changed, 41 insertions(+), 8 deletions(-)
9dab26
9dab26
diff --git a/cloudinit/tests/test_url_helper.py b/cloudinit/tests/test_url_helper.py
9dab26
index 1674120..29b3937 100644
9dab26
--- a/cloudinit/tests/test_url_helper.py
9dab26
+++ b/cloudinit/tests/test_url_helper.py
9dab26
@@ -1,7 +1,8 @@
9dab26
 # This file is part of cloud-init. See LICENSE file for license information.
9dab26
 
9dab26
 from cloudinit.url_helper import (
9dab26
-    NOT_FOUND, UrlError, oauth_headers, read_file_or_url, retry_on_url_exc)
9dab26
+    NOT_FOUND, UrlError, REDACTED, oauth_headers, read_file_or_url,
9dab26
+    retry_on_url_exc)
9dab26
 from cloudinit.tests.helpers import CiTestCase, mock, skipIf
9dab26
 from cloudinit import util
9dab26
 from cloudinit import version
9dab26
@@ -50,6 +51,9 @@ class TestOAuthHeaders(CiTestCase):
9dab26
 
9dab26
 
9dab26
 class TestReadFileOrUrl(CiTestCase):
9dab26
+
9dab26
+    with_logs = True
9dab26
+
9dab26
     def test_read_file_or_url_str_from_file(self):
9dab26
         """Test that str(result.contents) on file is text version of contents.
9dab26
         It should not be "b'data'", but just "'data'" """
9dab26
@@ -71,6 +75,34 @@ class TestReadFileOrUrl(CiTestCase):
9dab26
         self.assertEqual(result.contents, data)
9dab26
         self.assertEqual(str(result), data.decode('utf-8'))
9dab26
 
9dab26
+    @httpretty.activate
9dab26
+    def test_read_file_or_url_str_from_url_redacting_headers_from_logs(self):
9dab26
+        """Headers are redacted from logs but unredacted in requests."""
9dab26
+        url = 'http://hostname/path'
9dab26
+        headers = {'sensitive': 'sekret', 'server': 'blah'}
9dab26
+        httpretty.register_uri(httpretty.GET, url)
9dab26
+
9dab26
+        read_file_or_url(url, headers=headers, headers_redact=['sensitive'])
9dab26
+        logs = self.logs.getvalue()
9dab26
+        for k in headers.keys():
9dab26
+            self.assertEqual(headers[k],  httpretty.last_request().headers[k])
9dab26
+        self.assertIn(REDACTED, logs)
9dab26
+        self.assertNotIn('sekret', logs)
9dab26
+
9dab26
+    @httpretty.activate
9dab26
+    def test_read_file_or_url_str_from_url_redacts_noheaders(self):
9dab26
+        """When no headers_redact, header values are in logs and requests."""
9dab26
+        url = 'http://hostname/path'
9dab26
+        headers = {'sensitive': 'sekret', 'server': 'blah'}
9dab26
+        httpretty.register_uri(httpretty.GET, url)
9dab26
+
9dab26
+        read_file_or_url(url, headers=headers)
9dab26
+        for k in headers.keys():
9dab26
+            self.assertEqual(headers[k], httpretty.last_request().headers[k])
9dab26
+        logs = self.logs.getvalue()
9dab26
+        self.assertNotIn(REDACTED, logs)
9dab26
+        self.assertIn('sekret', logs)
9dab26
+
9dab26
     @mock.patch(M_PATH + 'readurl')
9dab26
     def test_read_file_or_url_passes_params_to_readurl(self, m_readurl):
9dab26
         """read_file_or_url passes all params through to readurl."""
9dab26
diff --git a/cloudinit/url_helper.py b/cloudinit/url_helper.py
9dab26
index 3e7de9f..e6188ea 100644
9dab26
--- a/cloudinit/url_helper.py
9dab26
+++ b/cloudinit/url_helper.py
9dab26
@@ -291,13 +291,14 @@ def readurl(url, data=None, timeout=None, retries=0, sec_between=1,
9dab26
         for (k, v) in req_args.items():
9dab26
             if k == 'data':
9dab26
                 continue
9dab26
-            filtered_req_args[k] = v
9dab26
-            if k == 'headers':
9dab26
-                for hkey, _hval in v.items():
9dab26
-                    if hkey in headers_redact:
9dab26
-                        filtered_req_args[k][hkey] = (
9dab26
-                            copy.deepcopy(req_args[k][hkey]))
9dab26
-                        filtered_req_args[k][hkey] = REDACTED
9dab26
+            if k == 'headers' and headers_redact:
9dab26
+                matched_headers = [k for k in headers_redact if v.get(k)]
9dab26
+                if matched_headers:
9dab26
+                    filtered_req_args[k] = copy.deepcopy(v)
9dab26
+                    for key in matched_headers:
9dab26
+                        filtered_req_args[k][key] = REDACTED
9dab26
+            else:
9dab26
+                filtered_req_args[k] = v
9dab26
         try:
9dab26
 
9dab26
             if log_req_resp:
9dab26
-- 
9dab26
1.8.3.1
9dab26