apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add validation for secstorage.allowed.internal.sites (#9567)

Browse Source 
* Add validation for secstorage.allowed.internal.sites

* Address comments

* Apply suggestions from code review

Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>

* Address comments

---------

Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
This commit is contained in:
Vishesh 2024-09-04 11:58:44 +05:30 committed by GitHub
parent 1ca9a10912
commit 0ba9a292d5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 43 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
View File

@ -303,6 +303,8 @@ import com.google.common.base.Preconditions;
import com.google.common.collect.Sets;
import com.googlecode.ipv6.IPv6Network;
import static com.cloud.configuration.Config.SecStorageAllowedInternalDownloadSites;
public class ConfigurationManagerImpl extends ManagerBase implements ConfigurationManager, ConfigurationService, Configurable {
public static final Logger s_logger = Logger.getLogger(ConfigurationManagerImpl.class);
public static final String PERACCOUNT = "peraccount";
@ -1314,6 +1316,18 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
}
}
if (type.equals(String.class)) {
if (name.equalsIgnoreCase(SecStorageAllowedInternalDownloadSites.key()) && StringUtils.isNotEmpty(value)) {
final String[] cidrs = value.split(",");
for (final String cidr : cidrs) {
if (!NetUtils.isValidIp4(cidr) && !NetUtils.isValidIp6(cidr) && !NetUtils.getCleanIp4Cidr(cidr).equals(cidr)) {
s_logger.error(String.format("Invalid CIDR %s value specified for the config %s", cidr, name));
throw new InvalidParameterValueException(String.format("Invalid CIDR %s value specified for the config %s", cidr, name));
}
}
}
}
if (configuration == null ) {
//range validation has to be done per case basis, for now
//return in case of Configkey parameters

5
services/secondary-storage/controller/src/main/java/org/apache/cloudstack/secondarystorage/SecondaryStorageManagerImpl.java
View File

@ -158,6 +158,8 @@ import com.cloud.vm.dao.SecondaryStorageVmDao;
import com.cloud.vm.dao.UserVmDetailsDao;
import com.cloud.vm.dao.VMInstanceDao;
import static com.cloud.configuration.Config.SecStorageAllowedInternalDownloadSites;
/**
* Class to manage secondary storages. <br><br>
* Possible secondary storage VM state transition cases:<br>
@ -401,6 +403,9 @@ public class SecondaryStorageManagerImpl extends ManagerBase implements Secondar
String[] cidrs = _allowedInternalSites.split(",");
for (String cidr : cidrs) {
if (NetUtils.isValidIp4Cidr(cidr) || NetUtils.isValidIp4(cidr) || !cidr.startsWith("0.0.0.0")) {
if (NetUtils.getCleanIp4Cidr(cidr).equals(cidr)) {
s_logger.warn(String.format("Invalid CIDR %s in %s", cidr, SecStorageAllowedInternalDownloadSites.key()));
}
allowedCidrs.add(cidr);
}
}

2
ui/src/views/setting/ConfigurationValue.vue
View File

@ -266,7 +266,7 @@ export default {
this.$message.error(this.$t('message.error.save.setting'))
this.$notification.error({
message: this.$t('label.error'),
description: this.$t('message.error.save.setting')
description: error?.response?.data?.updateconfigurationresponse?.errortext || this.$t('message.error.save.setting')
})
}).finally(() => {
this.valueLoading = false

12
utils/src/main/java/com/cloud/utils/net/NetUtils.java
View File

@ -626,6 +626,18 @@ public class NetUtils {
return long2Ip(firstPart) + "/" + size;
}
public static String getCleanIp4Cidr(final String cidr) {
if (!isValidIp4Cidr(cidr)) {
throw new CloudRuntimeException("Invalid CIDR: " + cidr);
}
String gateway = cidr.split("/")[0];
Long netmaskSize = Long.parseLong(cidr.split("/")[1]);
final long ip = ip2Long(gateway);
final long startNetMask = ip2Long(getCidrNetmask(netmaskSize));
final long start = (ip & startNetMask);
return String.format("%s/%s", long2Ip(start), netmaskSize);
}
public static String[] getIpRangeFromCidr(final String cidr, final long size) {
assert size < MAX_CIDR : "You do know this is not for ipv6 right? Keep it smaller than 32 but you have " + size;
final String[] result = new String[2];

11
utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java
View File

@ -296,6 +296,17 @@ public class NetUtilsTest {
assertTrue(NetUtils.isValidIp4Cidr(cidrThird));;
}
@Test
public void testGetCleanIp4Cidr() throws Exception {
final String cidrFirst = "10.0.144.0/20";
final String cidrSecond = "10.0.151.5/20";
final String cidrThird = "10.0.144.10/21";
assertEquals(cidrFirst, NetUtils.getCleanIp4Cidr(cidrFirst));
assertEquals("10.0.144.0/20", NetUtils.getCleanIp4Cidr(cidrSecond));
assertEquals("10.0.144.0/21", NetUtils.getCleanIp4Cidr(cidrThird));;
}
@Test
public void testIsValidCidrList() throws Exception {
final String cidrFirst = "10.0.144.0/20,1.2.3.4/32,5.6.7.8/24";