Verify that domain returned from IMDS is an AWS domain

This bug was fixed in the package ec2-instance-connect - 1.1.13-0ubuntu1

---------------
ec2-instance-connect (1.1.13-0ubuntu1) hirsute; urgency=medium

  * debian/copyright: Don't exclude debian/
    This is not needed with source format 3.0.
  * debian/gbp.conf: Add basic Ubuntu configuration
  * New upstream version 1.1.13 (LP: #1904741):
    - Verify that domain returned from IMDS is an AWS domain

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 14:31:17 +0100

At first I was a bit puzzled by the true/false values used in this patch, made the test case look a bit weird in my mind. But I see it's just what they use - the opposite of what I'd normally use but oh well.

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into groovy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3.20.10.0 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-groovy to verification-done-groovy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-groovy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3.20.04.0 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3~18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Balint, or anyone else affected,

Accepted ec2-instance-connect into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ec2-instance-connect/1.1.12+dfsg1-0ubuntu3~16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Verified on Groovy with 1.1.12+dfsg1-0ubuntu3.20.10.0:

ubuntu@ip-172-31-44-138:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
++ /usr/bin/printf managed-ssh-signer.%s.%s us-east-2 amazonaws.com

...

Verified on Focal with 1.1.12+dfsg1-0ubuntu3.20.04.0:

ubuntu@ip-172-31-39-25:~$ dpkg -l ec2-instance-connect | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-====================-=============================-============-=============================================================
ii ec2-instance-connect 1.1.12+dfsg1-0ubuntu3.20.04.0 all Configures ssh daemon to accept EC2 Instance Connect ssh keys
ubuntu@ip-172-31-39-25:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
+ set -e
+ umask 077
+ IMDS=http://169.254.169.254/latest/meta-data
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
...

Verified on Bionic with 1.1.12+dfsg1-0ubuntu3~18.04.1:

ubuntu@ip-172-31-40-227:~$ dpkg -l ec2-instance-connect | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-====================-=============================-============-=============================================================
ii ec2-instance-connect 1.1.12+dfsg1-0ubuntu3~18.04.1 all Configures ssh daemon to accept EC2 Instance Connect ssh keys
ubuntu@ip-172-31-40-227:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
+ set -e
+ umask 077
+ IMDS=http://169.254.169.254/latest/meta-data
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'

Verified on Xenial with 1.1.12+dfsg1-0ubuntu3~16.04.1:

ubuntu@ip-172-31-43-13:~$ dpkg -l ec2-instance-connect | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-====================-=============================-============-=============================================================
ii ec2-instance-connect 1.1.12+dfsg1-0ubuntu3~16.04.1 all Configures ssh daemon to accept EC2 Instance Connect ssh keys
ubuntu@ip-172-31-43-13:~$ bash -x /usr/share/ec2-instance-connect/eic_curl_authorized_keys ubuntu
+ set -e
+ umask 077
+ IMDS=http://169.254.169.254/latest/meta-data
...
++ /usr/bin/curl -s -f -m 1 -H 'X-aws-ec2-metadata-token: XXX==' http://169.254.169.254/latest/meta-data/services/domain/
+ domain=amazonaws.com
+ domain_exit=0
+ '[' 0 -ne 0 ']'
+ is_domain_valid=1
+ for valid_domain in amazonaws.com amazonaws.com.cn c2s.ic.gov sc2s.sgov.gov
+ '[' amazonaws.com = amazonaws.com ']'
+ is_domain_valid=0
+ break
+ '[' 0 -eq 1 ']'
...

The verification of the Stable Release Update for ec2-instance-connect has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3.20.04.0

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3.20.04.0) focal; urgency=medium

  * Verify that domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 15:47:19 +0100

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3~18.04.1

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3~18.04.1) bionic; urgency=medium

  * Verify that the domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 16:15:19 +0100

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3~16.04.1

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3~16.04.1) xenial; urgency=medium

  * Verify that domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 16:20:37 +0100

This bug was fixed in the package ec2-instance-connect - 1.1.12+dfsg1-0ubuntu3.20.10.0

---------------
ec2-instance-connect (1.1.12+dfsg1-0ubuntu3.20.10.0) groovy; urgency=medium

  * Verify that domain returned from IMDS is an AWS domain (LP: #1904741)

 -- Balint Reczey <email address hidden> Wed, 18 Nov 2020 15:47:19 +0100