From: Anton Aksola <anton.aksola@nebula.fi>
Date: Fri, 10 Apr 2015 10:25:21 +0000 (+0300)
Subject: rgw: always check if token is expired
X-Git-Tag: v9.0.2~131^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=2df069390ea3bbcfbab5022750e89f51d197cc11;p=ceph.git

rgw: always check if token is expired

Fixes: #11367

Currently token expiration is only checked by the token cache. With PKI
tokens no expiration check is done after decoding the token. This causes
PKI tokens to be valid indefinitely. UUID tokens are validated by
keystone after cache miss so they are not affected by this bug.

This commit adds explicit token expiration check to
RGWSwift::validate_keystone_token()

Signed-off-by: Anton Aksola <anton.aksola@nebula.fi>
Reported-by: Riku Lehto <riku.lehto@nexetic.com>
---

diff --git a/src/rgw/rgw_swift.cc b/src/rgw/rgw_swift.cc
index a08d94400d64..0a8d373ca9d5 100644
--- a/src/rgw/rgw_swift.cc
+++ b/src/rgw/rgw_swift.cc
@@ -525,6 +525,11 @@ int RGWSwift::validate_keystone_token(RGWRados *store, const string& token, stru
   if (ret < 0)
     return ret;
 
+  if (t.expired()) {
+    ldout(cct, 0) << "got expired token: " << t.token.tenant.name << ":" << t.user.name << " expired: " << t.token.expires << dendl;
+    return -EPERM;
+  }
+
   keystone_token_cache->add(token_id, t);
 
   ret = update_user_info(store, info, rgw_user);