Skip to content

Commit 188eacd

Browse files
sureshanapartisureshanaparti
authored
Certificate and VM hostname validation improvements (#10051)
* Certificate and VM hostname validation improvements * Improve certificate name validation and some code/log improvements
1 parent 0944fa1 commit 188eacd

6 files changed

Lines changed: 36 additions & 20 deletions

File tree

‎plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapper.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ public Answer execute(final GetVmIpAddressCommand command, final LibvirtComputin
4242
String ip = null;
4343
boolean result = false;
4444
String vmName = command.getVmName();
45+
if (!NetUtils.verifyDomainNameLabel(vmName, true)) {
46+
return new Answer(command, result, ip);
47+
}
4548
String sanitizedVmName = sanitizeBashCommandArgument(vmName);
4649
String networkCidr = command.getVmNetworkCidr();
4750
List<String[]> commands = new ArrayList<>();

‎plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtSetupDirectDownloadCertificateCommandWrapper.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
import com.cloud.utils.FileUtil;
3838
import com.cloud.utils.PropertiesUtil;
3939
import com.cloud.utils.exception.CloudRuntimeException;
40+
import com.cloud.utils.net.NetUtils;
4041
import com.cloud.utils.script.Script;
4142

4243
@ResourceWrapper(handles = SetupDirectDownloadCertificateCommand.class)
@@ -132,6 +133,9 @@ protected void cleanupTemporaryFile(String temporaryFile) {
132133
public Answer execute(SetupDirectDownloadCertificateCommand cmd, LibvirtComputingResource serverResource) {
133134
String certificate = cmd.getCertificate();
134135
String certificateName = cmd.getCertificateName();
136+
if (!NetUtils.verifyDomainNameLabel(certificateName, false)) {
137+
return new Answer(cmd, false, "The provided certificate name is invalid");
138+
}
135139

136140
try {
137141
File agentFile = getAgentPropertiesFile();

‎plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixGetVmIpAddressCommandWrapper.java‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -63,20 +63,18 @@ public Answer execute(final GetVmIpAddressCommand command, final CitrixResourceB
6363
}
6464

6565
if (vmIp != null) {
66-
s_logger.debug("VM " +vmName + " ip address got retrieved "+vmIp);
66+
s_logger.debug("VM " + vmName + " IP address got retrieved " + vmIp);
6767
result = true;
6868
return new Answer(command, result, vmIp);
6969
}
70-
71-
}catch (Types.XenAPIException e) {
72-
s_logger.debug("Got exception in GetVmIpAddressCommand "+ e.getMessage());
73-
errorMsg = "Failed to retrived vm ip addr, exception: "+e.getMessage();
74-
}catch (XmlRpcException e) {
75-
s_logger.debug("Got exception in GetVmIpAddressCommand "+ e.getMessage());
76-
errorMsg = "Failed to retrived vm ip addr, exception: "+e.getMessage();
70+
} catch (Types.XenAPIException e) {
71+
s_logger.debug("Got exception in GetVmIpAddressCommand " + e.getMessage());
72+
errorMsg = "Failed to retrieve vm ip addr, exception: " + e.getMessage();
73+
} catch (XmlRpcException e) {
74+
s_logger.debug("Got exception in GetVmIpAddressCommand " + e.getMessage());
75+
errorMsg = "Failed to retrieve vm ip addr, exception: " + e.getMessage();
7776
}
7877

7978
return new Answer(command, result, errorMsg);
80-
8179
}
8280
}

‎server/src/main/java/com/cloud/vm/UserVmManagerImpl.java‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -751,8 +751,6 @@ public void decrementCount() {
751751
}
752752

753753
private class VmIpAddrFetchThread extends ManagedContextRunnable {
754-
755-
756754
long nicId;
757755
long vmId;
758756
String vmName;
@@ -775,7 +773,7 @@ protected void runInContext() {
775773
boolean decrementCount = true;
776774

777775
try {
778-
s_logger.debug("Trying for vm "+ vmId +" nic Id "+nicId +" ip retrieval ...");
776+
s_logger.debug(String.format("Trying IP retrieval for VM %s (%d), nic Id %d", vmName, vmId, nicId));
779777
Answer answer = _agentMgr.send(hostId, cmd);
780778
NicVO nic = _nicDao.findById(nicId);
781779
if (answer.getResult()) {
@@ -786,12 +784,12 @@ protected void runInContext() {
786784
if (nic != null) {
787785
nic.setIPv4Address(vmIp);
788786
_nicDao.update(nicId, nic);
789-
s_logger.debug("Vm "+ vmId +" IP "+vmIp +" got retrieved successfully");
787+
s_logger.debug(String.format("VM %s (%d) - IP %s retrieved successfully", vmName, vmId, vmIp));
790788
vmIdCountMap.remove(nicId);
791789
decrementCount = false;
792790
ActionEventUtils.onActionEvent(User.UID_SYSTEM, Account.ACCOUNT_ID_SYSTEM,
793791
Domain.ROOT_DOMAIN, EventTypes.EVENT_NETWORK_EXTERNAL_DHCP_VM_IPFETCH,
794-
"VM " + vmId + " nic id " + nicId + " ip address " + vmIp + " got fetched successfully", vmId, ApiCommandResourceType.VirtualMachine.toString());
792+
"VM " + vmId + ", nic id " + nicId + ", IP address " + vmIp + " fetched successfully", vmId, ApiCommandResourceType.VirtualMachine.toString());
795793
}
796794
}
797795
} else {
@@ -802,7 +800,7 @@ protected void runInContext() {
802800
_nicDao.update(nicId, nic);
803801
}
804802
if (answer.getDetails() != null) {
805-
s_logger.debug("Failed to get vm ip for Vm "+ vmId + answer.getDetails());
803+
s_logger.debug(String.format("Failed to get IP for VM %s (%d), details: %s", vmName, vmId, answer.getDetails()));
806804
}
807805
}
808806
} catch (OperationTimedoutException e) {
@@ -813,7 +811,7 @@ protected void runInContext() {
813811
if (decrementCount) {
814812
VmAndCountDetails vmAndCount = vmIdCountMap.get(nicId);
815813
vmAndCount.decrementCount();
816-
s_logger.debug("Ip is not retrieved for VM " + vmId +" nic "+nicId + " ... decremented count to "+vmAndCount.getRetrievalCount());
814+
s_logger.debug(String.format("IP is not retrieved for VM %s (%d), nic %d ... decremented count to %d", vmName, vmId, nicId, vmAndCount.getRetrievalCount()));
817815
vmIdCountMap.put(nicId, vmAndCount);
818816
}
819817
}

‎server/src/main/java/org/apache/cloudstack/direct/download/DirectDownloadManagerImpl.java‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@
103103
import com.cloud.utils.component.ManagerBase;
104104
import com.cloud.utils.concurrency.NamedThreadFactory;
105105
import com.cloud.utils.exception.CloudRuntimeException;
106+
import com.cloud.utils.net.NetUtils;
106107
import com.cloud.utils.security.CertificateHelper;
107108

108109
import sun.security.x509.X509CertImpl;
@@ -471,10 +472,18 @@ protected void certificateSanity(String certificatePem) {
471472
@Override
472473
public Pair<DirectDownloadCertificate, List<HostCertificateStatus>> uploadCertificateToHosts(
473474
String certificateCer, String alias, String hypervisor, Long zoneId, Long hostId) {
474-
if (alias != null && (alias.equalsIgnoreCase("cloud") || alias.startsWith("cloudca"))) {
475+
if (StringUtils.isBlank(alias)) {
476+
throw new CloudRuntimeException("Certificate name not provided, please provide a valid name");
477+
}
478+
479+
if (alias.equalsIgnoreCase("cloud") || alias.startsWith("cloudca")) {
475480
throw new CloudRuntimeException("Please provide a different alias name for the certificate");
476481
}
477482

483+
if (!NetUtils.verifyDomainNameLabel(alias, false)) {
484+
throw new CloudRuntimeException("The provided certificate name is invalid, please provide a valid name");
485+
}
486+
478487
List<HostVO> hosts;
479488
DirectDownloadCertificateVO certificateVO;
480489
HypervisorType hypervisorType = HypervisorType.getType(hypervisor);

‎utils/src/main/java/com/cloud/utils/net/NetUtils.java‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ public class NetUtils {
9999
public final static int IPV6_EUI64_11TH_BYTE = -1;
100100
public final static int IPV6_EUI64_12TH_BYTE = -2;
101101

102+
// Regex
103+
public final static Pattern HOSTNAME_PATTERN = Pattern.compile("[a-zA-Z0-9-]+");
104+
public final static Pattern START_HOSTNAME_PATTERN = Pattern.compile("^[0-9-].*");
105+
102106
public static String extractHost(String uri) throws URISyntaxException {
103107
return (new URI(uri)).getHost();
104108
}
@@ -1061,13 +1065,13 @@ public static boolean verifyDomainNameLabel(final String hostName, final boolean
10611065
if (hostName.length() > 63 || hostName.length() < 1) {
10621066
s_logger.warn("Domain name label must be between 1 and 63 characters long");
10631067
return false;
1064-
} else if (!hostName.toLowerCase().matches("[a-z0-9-]*")) {
1068+
} else if (!HOSTNAME_PATTERN.matcher(hostName).matches()) {
10651069
s_logger.warn("Domain name label may contain only the ASCII letters 'a' through 'z' (in a case-insensitive manner)");
10661070
return false;
10671071
} else if (hostName.startsWith("-") || hostName.endsWith("-")) {
1068-
s_logger.warn("Domain name label can not start with a hyphen and digit, and must not end with a hyphen");
1072+
s_logger.warn("Domain name label can not start or end with a hyphen");
10691073
return false;
1070-
} else if (isHostName && hostName.matches("^[0-9-].*")) {
1074+
} else if (isHostName && START_HOSTNAME_PATTERN.matcher(hostName).matches()) {
10711075
s_logger.warn("Host name can't start with digit");
10721076
return false;
10731077
}

0 commit comments

Comments
 (0)