[Bug 1946787] Re: [SRU] Fix inconsistent encoding secret encoding

[Liam Young]

Tested successfully on hirsute using 2:12.0.0-0ubuntu2 . I created an
encrypted volume and attached it to a VM.


cinder type-create LUKS
cinder encryption-type-create --cipher aes-xts-plain64 --key_size 512 --control_location front-end LUKS nova.volume.encryptors.luks.LuksEncryptor
cinder create --volume-type LUKS --poll --name testvol 1
openstack keypair show guests || openstack keypair create --public-key  ~/.ssh/id_rsa_guests.pub guests
openstack flavor create --id 8 --ram 1024 --disk 8 --vcpus 1 --public m1.ly
openstack server create --image bionic --flavor m1.ly --network private --key-name guests --wait test3
openstack floating ip create ext_net
openstack server add floating ip test3 172.20.0.207
openstack server add volume --device /dev/vdb test3 testvol
cinder list
+--------------------------------------+--------+---------+------+-------------+----------+--------------------------------------+
| ID                                   | Status | Name    | Size | Volume Type | Bootable | Attached to                          |
+--------------------------------------+--------+---------+------+-------------+----------+--------------------------------------+
| 67564b48-54b7-47bf-ac95-d701b455cb7d | in-use | testvol | 1    | LUKS        | false    | 6c43fed1-a195-47d8-b5a9-dc7fd166bf58 |
+--------------------------------------+--------+---------+------+-------------+----------+--------------------------------------+

cinder show testvol
+--------------------------------+------------------------------------------+
| Property                       | Value                                    |
+--------------------------------+------------------------------------------+
| attached_servers               | ['6c43fed1-a195-47d8-b5a9-dc7fd166bf58'] |
| attachment_ids                 | ['f0c3ed24-2973-407a-b6f6-afcef999ed43'] |
| availability_zone              | nova                                     |
| bootable                       | false                                    |
| cluster_name                   | None                                     |
| consistencygroup_id            | None                                     |
| created_at                     | 2021-11-01T16:38:32.000000               |
| description                    | None                                     |
| encrypted                      | True                                     |
| encryption_key_id              | c6079e38-fe86-4e16-aee0-09d07fdfc719     |
| group_id                       | None                                     |
| id                             | 67564b48-54b7-47bf-ac95-d701b455cb7d     |
| metadata                       |                                          |
| migration_status               | None                                     |
| multiattach                    | False                                    |
| name                           | testvol                                  |
| os-vol-host-attr:host          | juju-86a900-zaza-c440171f601b-11 at LVM#LVM |
| os-vol-mig-status-attr:migstat | None                                     |
| os-vol-mig-status-attr:name_id | None                                     |
| os-vol-tenant-attr:tenant_id   | 6485c947c61046c99b88e8f5f3bcae9a         |
| provider_id                    | None                                     |
| replication_status             | None                                     |
| service_uuid                   | 5a4cf232-59a0-4cd9-8d3f-badd74e9a5e8     |
| shared_targets                 | False                                    |
| size                           | 1                                        |
| snapshot_id                    | None                                     |
| source_volid                   | None                                     |
| status                         | in-use                                   |
| updated_at                     | 2021-11-01T17:27:36.000000               |
| user_id                        | d16ea8b7d0d542d8b2f36f6a121434bc         |
| volume_type                    | LUKS                                     |
| volume_type_id                 | 2bfe04b8-3e70-412f-a348-f6f5ff359991     |
+--------------------------------+------------------------------------------+


** Tags removed: verification-needed-hirsute
** Tags added: verification-done-hirsute

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1946787

Title:
  [SRU] Fix inconsistent encoding secret encoding

Status in Ubuntu Cloud Archive:
  Fix Released
Status in Ubuntu Cloud Archive ussuri series:
  New
Status in Ubuntu Cloud Archive victoria series:
  New
Status in Ubuntu Cloud Archive wallaby series:
  Fix Committed
Status in Ubuntu Cloud Archive xena series:
  Fix Released
Status in barbican package in Ubuntu:
  Fix Released
Status in barbican source package in Focal:
  New
Status in barbican source package in Hirsute:
  Fix Committed
Status in barbican source package in Impish:
  Fix Released

Bug description:
  [Impact]
  This SRU corresponds with the following story for upstream barbican
  https://storyboard.openstack.org/#!/story/2008335.

  The problem is some secrets were stored in plaintext and some were
  stored encoded. This resulted in the inability to decode some secrets.

  This is fixed by always storing secrets in plaintext and decoding
  inconsistently stored data as needed when getting secrets.

  [Test Case]
    * deploy Openstack with Barbican using Vault as a backend
    * openstack volume type create --encryption-provider nova.volume.encryptors.luks.LuksEncryptor --encryption-cipher aes-xts-plain64 --encryption-key-size 256 --encryption-control-location front-end LUKS
    * openstack volume create --size 1 --type LUKS luks_vol1
    * ensure volume created successfully
    * openstack volume show luks_vol1
    * create vm and attach volume
    * mkfs and mount then test can read/write

  
  [Where things could go wrong]
  If things were to go wrong it would probably be in the get_secret() method which calls _ensure_legacy_base64(). _ensure_legacy_base64() assumes that anything that is not a key was stored base64 encoded. Presumably this is correct, but there was a path added to catch a UnicodeDecodeError exception to handle unexpected non-base64-encoded secrets.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1946787/+subscriptions