From 188eacd9eb165a86dd5328c34c44a424092819a0 Mon Sep 17 00:00:00 2001 From: Suresh Kumar Anaparti Date: Fri, 20 Dec 2024 10:18:11 +0530 Subject: [PATCH] Certificate and VM hostname validation improvements (#10051) * Certificate and VM hostname validation improvements * Improve certificate name validation and some code/log improvements --- .../LibvirtGetVmIpAddressCommandWrapper.java | 3 +++ ...pDirectDownloadCertificateCommandWrapper.java | 4 ++++ .../CitrixGetVmIpAddressCommandWrapper.java | 16 +++++++--------- .../java/com/cloud/vm/UserVmManagerImpl.java | 12 +++++------- .../download/DirectDownloadManagerImpl.java | 11 ++++++++++- .../main/java/com/cloud/utils/net/NetUtils.java | 10 +++++++--- 6 files changed, 36 insertions(+), 20 deletions(-) diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapper.java index da2839d9cee..d65b6907eeb 100644 --- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapper.java +++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVmIpAddressCommandWrapper.java @@ -42,6 +42,9 @@ public final class LibvirtGetVmIpAddressCommandWrapper extends CommandWrapper commands = new ArrayList<>(); diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtSetupDirectDownloadCertificateCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtSetupDirectDownloadCertificateCommandWrapper.java index 0774d306b8a..d2b69412a72 100644 --- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtSetupDirectDownloadCertificateCommandWrapper.java +++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtSetupDirectDownloadCertificateCommandWrapper.java @@ -37,6 +37,7 @@ import com.cloud.resource.ResourceWrapper; import com.cloud.utils.FileUtil; import com.cloud.utils.PropertiesUtil; import com.cloud.utils.exception.CloudRuntimeException; +import com.cloud.utils.net.NetUtils; import com.cloud.utils.script.Script; @ResourceWrapper(handles = SetupDirectDownloadCertificateCommand.class) @@ -132,6 +133,9 @@ public class LibvirtSetupDirectDownloadCertificateCommandWrapper extends Command public Answer execute(SetupDirectDownloadCertificateCommand cmd, LibvirtComputingResource serverResource) { String certificate = cmd.getCertificate(); String certificateName = cmd.getCertificateName(); + if (!NetUtils.verifyDomainNameLabel(certificateName, false)) { + return new Answer(cmd, false, "The provided certificate name is invalid"); + } try { File agentFile = getAgentPropertiesFile(); diff --git a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixGetVmIpAddressCommandWrapper.java b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixGetVmIpAddressCommandWrapper.java index b67ef0850ba..e03708faf86 100644 --- a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixGetVmIpAddressCommandWrapper.java +++ b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixGetVmIpAddressCommandWrapper.java @@ -63,20 +63,18 @@ public final class CitrixGetVmIpAddressCommandWrapper extends CommandWrapper> uploadCertificateToHosts( String certificateCer, String alias, String hypervisor, Long zoneId, Long hostId) { - if (alias != null && (alias.equalsIgnoreCase("cloud") || alias.startsWith("cloudca"))) { + if (StringUtils.isBlank(alias)) { + throw new CloudRuntimeException("Certificate name not provided, please provide a valid name"); + } + + if (alias.equalsIgnoreCase("cloud") || alias.startsWith("cloudca")) { throw new CloudRuntimeException("Please provide a different alias name for the certificate"); } + if (!NetUtils.verifyDomainNameLabel(alias, false)) { + throw new CloudRuntimeException("The provided certificate name is invalid, please provide a valid name"); + } + List hosts; DirectDownloadCertificateVO certificateVO; HypervisorType hypervisorType = HypervisorType.getType(hypervisor); diff --git a/utils/src/main/java/com/cloud/utils/net/NetUtils.java b/utils/src/main/java/com/cloud/utils/net/NetUtils.java index 1b4ebcccf94..2703deaad64 100644 --- a/utils/src/main/java/com/cloud/utils/net/NetUtils.java +++ b/utils/src/main/java/com/cloud/utils/net/NetUtils.java @@ -99,6 +99,10 @@ public class NetUtils { public final static int IPV6_EUI64_11TH_BYTE = -1; public final static int IPV6_EUI64_12TH_BYTE = -2; + // Regex + public final static Pattern HOSTNAME_PATTERN = Pattern.compile("[a-zA-Z0-9-]+"); + public final static Pattern START_HOSTNAME_PATTERN = Pattern.compile("^[0-9-].*"); + public static String extractHost(String uri) throws URISyntaxException { return (new URI(uri)).getHost(); } @@ -1061,13 +1065,13 @@ public class NetUtils { if (hostName.length() > 63 || hostName.length() < 1) { s_logger.warn("Domain name label must be between 1 and 63 characters long"); return false; - } else if (!hostName.toLowerCase().matches("[a-z0-9-]*")) { + } else if (!HOSTNAME_PATTERN.matcher(hostName).matches()) { s_logger.warn("Domain name label may contain only the ASCII letters 'a' through 'z' (in a case-insensitive manner)"); return false; } else if (hostName.startsWith("-") || hostName.endsWith("-")) { - s_logger.warn("Domain name label can not start with a hyphen and digit, and must not end with a hyphen"); + s_logger.warn("Domain name label can not start or end with a hyphen"); return false; - } else if (isHostName && hostName.matches("^[0-9-].*")) { + } else if (isHostName && START_HOSTNAME_PATTERN.matcher(hostName).matches()) { s_logger.warn("Host name can't start with digit"); return false; }