OSSN-0063: Nova and Cinder key manager for Barbican misuses cached credentials

Summary

During the Icehouse release the Cinder and Nova projects added a feature that supports storage volume encryption using keys stored in Barbican. The Barbican key manager, that is part of Nova and Cinder, had a bug that could cause an authorized user to lose access to an encryption key or allow the wrong user to gain access to an encryption key.

Affected Services / Software

Cinder (Icehouse, Juno, Kilo, Liberty), Nova (Juno, Kilo, Liberty)

Discussion

The Barbican key manager is a feature that is part of Nova and Cinder to allow those projects to create and retrieve keys in Barbican. The key manager includes a cache function that allows for a copy_key() operation to work while only validating the token once with Keystone.

This cache function had a bug such that the cached token was used for operations where it was no longer valid. The symptoms of this error vary, but include a user not being able to access their key or the wrong user being able to access a key.

An affected user would see an error similar to this in their cinder log:

2015-12-03 09:09:03.648 TRACE cinder.volume.api Unauthorized: The
request you have made requires authentication. (Disable debug mode to
suppress these details.) (HTTP 401) (Request-ID:
req-d2c52e0b-c16d-43ec-a7a0-7611113f1270)

Contacts / References

Author: Dave McCowan, Cisco