mirror of https://github.com/istio/istio.io.git
Added security advisory for gateway port change (#9459)
* Added security advisory for gateway port change Added a script that users can run to evaluate if any of their existing Authorization Policies need to be migrated. * Fix shell check errors * Fix shell check errors * Fix quotes * Code review fixups * Update content/en/news/security/istio-security-2021-002/index.md Co-authored-by: craigbox <craigbox@google.com> * Update content/en/news/security/istio-security-2021-002/index.md Co-authored-by: craigbox <craigbox@google.com> * Update content/en/news/security/istio-security-2021-002/index.md Co-authored-by: craigbox <craigbox@google.com> * Update content/en/news/security/istio-security-2021-002/index.md Co-authored-by: craigbox <craigbox@google.com> * Update content/en/news/security/istio-security-2021-002/index.md Co-authored-by: craigbox <craigbox@google.com> * Update content/en/news/security/istio-security-2021-002/index.md Co-authored-by: craigbox <craigbox@google.com> * Update index.md Co-authored-by: craigbox <craigbox@google.com>
This commit is contained in:
Neeraj Poddar
GitHub
parent
a163f12a50
commit
9552d0e841
|
|
@ -0,0 +1,78 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Copyright Istio Authors
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
set -eEuo pipefail
|
||||||
|
|
||||||
|
RED='\033[0;31m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
INGRESS_LABEL="istio=ingressgateway"
|
||||||
|
INGRESS_NAMESPACE="istio-system"
|
||||||
|
|
||||||
|
INGRESS_LABEL_KEY=$(echo $INGRESS_LABEL | cut -d '=' -f 1)
|
||||||
|
INGRESS_LABEL_VAL=$(echo $INGRESS_LABEL | cut -d '=' -f 2)
|
||||||
|
|
||||||
|
ingress_pod=$(kubectl -n $INGRESS_NAMESPACE get pod \
|
||||||
|
-l $INGRESS_LABEL \
|
||||||
|
-o jsonpath='{.items[0].metadata.name}' || true)
|
||||||
|
|
||||||
|
if [ -z "$ingress_pod" ]; then
|
||||||
|
echo "No ingress pod found in \"${INGRESS_NAMESPACE}\" with label selectors \"${INGRESS_LABEL}\""
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Inspecting Istio ingress gateway pod \"${ingress_pod}\" in \"${INGRESS_NAMESPACE}\" namespace"
|
||||||
|
|
||||||
|
ingress_ports=$(istioctl proxy-config listeners \
|
||||||
|
"${ingress_pod}.${INGRESS_NAMESPACE}" \
|
||||||
|
| awk 'NR > 1 {print $2}')
|
||||||
|
|
||||||
|
function check_port {
|
||||||
|
local policy_name=$1
|
||||||
|
local port=$2
|
||||||
|
|
||||||
|
local found=false
|
||||||
|
local ip
|
||||||
|
for ip in $ingress_ports; do
|
||||||
|
if [ "$ip" == "$port" ]; then
|
||||||
|
found=true
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
if ! $found; then
|
||||||
|
echo -e "${RED} Authorization Policy \"${policy_name}\" has port \"${port}\" that needs to be migrated. ${NC}"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
authz_policies=$(kubectl -n $INGRESS_NAMESPACE get authorizationpolicies | awk 'NR > 1 {print $1}')
|
||||||
|
echo -e "Checking Authorization Policies attached to \"$ingress_pod\"\n"
|
||||||
|
|
||||||
|
for p in $authz_policies; do
|
||||||
|
policy=$(kubectl -n "${INGRESS_NAMESPACE}" get authorizationpolicy "${p}" -o json)
|
||||||
|
label_selector=$(echo "${policy}" |\
|
||||||
|
jq -r --arg KEY "$INGRESS_LABEL_KEY" '.spec.selector.matchLabels[$KEY]')
|
||||||
|
if [ "${label_selector}" != "${INGRESS_LABEL_VAL}" ]; then
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
policy_ports=$(echo "${policy}" | jq -r '.spec.rules[]|select(.to)|.to[]|.operation|select(.ports)|.ports[]')
|
||||||
|
policy_notports=$(echo "${policy}" | jq -r '.spec.rules[]|select(.to)|.to[]|.operation|select(.notPorts)|.notPorts[]')
|
||||||
|
for pp in $policy_ports; do
|
||||||
|
check_port "${p}" "${pp}"
|
||||||
|
done
|
||||||
|
for pp in $policy_notports; do
|
||||||
|
check_port "${p}" "${pp}"
|
||||||
|
done
|
||||||
|
done
|
||||||
|
|
@ -0,0 +1,102 @@
|
||||||
|
---
|
||||||
|
title: ISTIO-SECURITY-2021-002
|
||||||
|
subtitle: Security Bulletin
|
||||||
|
description: Upgrades from older Istio versions can affect access control to an ingress gateway due to a change of container ports.
|
||||||
|
cves: [N/A]
|
||||||
|
cvss: "N/A"
|
||||||
|
vector: ""
|
||||||
|
releases: ["All releases 1.6 and later"]
|
||||||
|
publishdate: 2021-04-07
|
||||||
|
keywords: [CVE]
|
||||||
|
skip_seealso: true
|
||||||
|
---
|
||||||
|
|
||||||
|
{{< security_bulletin >}}
|
||||||
|
|
||||||
|
Upgrading from Istio versions 1.5 and prior, to 1.6 and later, may result in access control bypass:
|
||||||
|
|
||||||
|
- **Incorrect gateway ports on authorization policies on upgrades**: In Istio
|
||||||
|
versions 1.6 and later, the default container ports for Istio ingress
|
||||||
|
gateways are updated from port "80" to "8080" and "443" to "8443" to allow
|
||||||
|
[gateways to run as non-root](/news/releases/1.7.x/announcing-1.7/upgrade-notes/#gateways-run-as-non-root)
|
||||||
|
by default. With this change, any existing authorization policies targeting
|
||||||
|
an Istio ingress gateway on ports `80` and `443` need to be migrated to use the
|
||||||
|
new container ports `8080` and `8443`, before upgrading to the listed versions.
|
||||||
|
Failure to migrate may result in traffic reaching ingress gateway service
|
||||||
|
ports `80` and `443` to be incorrectly allowed or blocked, thereby causing policy
|
||||||
|
violations.
|
||||||
|
|
||||||
|
Example of an authorization policy resource that needs to be updated:
|
||||||
|
|
||||||
|
{{< text yaml >}}
|
||||||
|
apiVersion: "security.istio.io/v1beta1"
|
||||||
|
kind: "AuthorizationPolicy"
|
||||||
|
metadata:
|
||||||
|
name: block-admin-access
|
||||||
|
namespace: istio-system
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
istio: ingressgateway
|
||||||
|
action: DENY
|
||||||
|
rules:
|
||||||
|
- to:
|
||||||
|
- operation:
|
||||||
|
paths: ["/admin"]
|
||||||
|
ports: [ "80" ]
|
||||||
|
- to:
|
||||||
|
- operation:
|
||||||
|
paths: ["/admin"]
|
||||||
|
ports: [ "443" ]
|
||||||
|
|
||||||
|
{{< /text >}}
|
||||||
|
|
||||||
|
The above policy in Istio versions 1.5 and prior will block all access to path
|
||||||
|
`/admin` for traffic reaching an Istio ingress gateway on container ports `80`
|
||||||
|
and `443`. On upgrading to Istio version 1.6 and later, this policy should
|
||||||
|
be updated to the following to have the same effect:
|
||||||
|
|
||||||
|
{{< text yaml >}}
|
||||||
|
apiVersion: "security.istio.io/v1beta1"
|
||||||
|
kind: "AuthorizationPolicy"
|
||||||
|
metadata:
|
||||||
|
name: block-admin-access
|
||||||
|
namespace: istio-system
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
istio: ingressgateway
|
||||||
|
action: DENY
|
||||||
|
rules:
|
||||||
|
- to:
|
||||||
|
- operation:
|
||||||
|
paths: ["/admin"]
|
||||||
|
ports: [ "8080" ]
|
||||||
|
- to:
|
||||||
|
- operation:
|
||||||
|
paths: ["/admin"]
|
||||||
|
ports: [ "8443"
|
||||||
|
{{< /text >}}
|
||||||
|
|
||||||
|
## Mitigation
|
||||||
|
|
||||||
|
- Update your authorization policies before upgrading to the
|
||||||
|
affected Istio versions. You can use this [script](./check.sh)
|
||||||
|
to check if any of the existing authorization policies
|
||||||
|
attached to the default Istio ingress gateway in the `istio-system` namespace need
|
||||||
|
to be updated. If you’re using a custom gateway installation, you can customize
|
||||||
|
the script to run with parameters applicable to your environment.
|
||||||
|
|
||||||
|
It is recommended to create a copy of your existing authorization
|
||||||
|
policies, update the copied version to use new gateway workload ports, and
|
||||||
|
apply both existing and updated policies in your cluster, before initiating
|
||||||
|
the upgrade process. You should only delete the old policies after a
|
||||||
|
successful upgrade, to ensure no policy violations occur on upgrade
|
||||||
|
failures or rollbacks.
|
||||||
|
|
||||||
|
## Credit
|
||||||
|
|
||||||
|
We'd like to thank [Neeraj Poddar](https://twitter.com/nrjpoddar)
|
||||||
|
for reporting this issue.
|
||||||
|
|
||||||
|
{{< boilerplate "security-vulnerability" >}}
|
||||||
Loading…
Reference in New Issue