In the existing code, self.ssl_insecure is a string. If insecure
option is set in nova api-paste.ini, whatever it is 'true' or
'false', kwargs['verify'] will become False. This commit corrects
the condition expression. This patch is backported from
https://review.openstack.org/#/c/113191/

Change-Id: I91db8e1cb39c017167a4160079846ac7c0663b03
Closes-Bug: 1353315

Only PKI (asn1) based tokens were checked for format and hashed

Closes-Bug: 1355125

SecurityImpact

Change-Id: Iefedde7f168e2ff1870905041fa95301934452e5

Change-Id: I1faaae0373a7ae12ee528ab5c71741a2b1122d43
Closes-Bug: 1342274

Fixed most of the errors reported back from hacking 0.9.2.
Specifically:
- E128 continuation line under-indented for visual indent
- E251 unexpected spaces around keyword / parameter equals
- E265 block comment should start with '# '
- H305 imports not grouped correctly
- H307 like imports should be grouped together
- H402 one line docstring needs punctuation
- H904 Wrap long lines in parentheses instead of a backslash

But opted to ignore the following for now:
- E122: continuation line missing indentation or outdented
- H405: multi line docstring summary not separated with an empty line

Change-Id: Ib8e698d85fd598fa91435538657361a1f695ce89

When auth_token stores the token in the cache, it's stored with
the expiration time; but when the token is retrieved from the
cache, if the expiration time has passed the token is treated as if
it wasn't cached. This creates extra work because now auth_token
has to check the token expiration (either by decrypting the PKI
token or online validation for UUID tokens).

With this change, getting the token from the cache will fail if the
expiration is past.

Change-Id: Id0ec6b3c2e5af4a2d910f16da4e0312733fc2198

The token cache members are moved from AuthToken to their own
class.

Change-Id: Ibf00d39435fa7a6d9a92a9bdfacc3f1b07f890ef

The auth_token middleware always hashed PKI Tokens with MD5. This
change makes it so that PKI tokens can be hashed with SHA256 or any
other algorithm supported by hashlib.new(). This is for security
hardening.

auth_token has a new config option 'hash_algorithms' that is set
to the list of algorithms that will be used for hashing PKI tokens.
This will typically be set to a single hash algorithm which must
match the hash algorithm set in Keystone. Otherwise the tokens
in the revocation list will not match, leading to revoked tokens
being still usable.

During a transition from one algorithm to another,
'hash_algorithms' is set to both the new algorithm and the old
algorithm. Both of the hash algorithms will be used to match
against the revocation list and cache. Once the tokens using the
old algorithm have expired the old algorithm can be removed from
the list.

'hash_algorithms' defaults to ['md5'] for backwards compatibility.

DocImpact
SecurityImpact
Closes-Bug: #1174499

Change-Id: Ie524125dc5f6f1076bfd47db3a414b178e4dac80