apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-12-20 04:23:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

bug 6755: adding checks for commands before they hit the ms; to ensure they are valid. Also returning the right error msg if the command is not valid

Browse Source 
status 6755: resolved fixed
This commit is contained in:
abhishek 2010-11-12 13:53:54 -08:00
parent 2537dc3058
commit fc461abed1
3 changed files with 39 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
server/src/com/cloud/api/ApiServer.java
View File

@ -31,6 +31,7 @@ import java.net.ServerSocket;
import java.net.Socket; import java.net.Socket;
import java.net.URLDecoder; import java.net.URLDecoder;
import java.net.URLEncoder; import java.net.URLEncoder;
import java.security.InvalidParameterException;
import java.security.SecureRandom; import java.security.SecureRandom;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Collections; import java.util.Collections;
@ -87,6 +88,7 @@ import com.cloud.domain.Domain;
import com.cloud.domain.DomainVO; import com.cloud.domain.DomainVO;
import com.cloud.event.EventUtils; import com.cloud.event.EventUtils;
import com.cloud.exception.CloudAuthenticationException; import com.cloud.exception.CloudAuthenticationException;
import com.cloud.exception.InvalidParameterValueException;
import com.cloud.maid.StackMaid; import com.cloud.maid.StackMaid;
import com.cloud.server.ManagementServer; import com.cloud.server.ManagementServer;
import com.cloud.user.Account; import com.cloud.user.Account;
@ -125,6 +127,7 @@ public class ApiServer implements HttpRequestHandler {
private static List<String> s_resellerCommands = null; // AKA domain-admin private static List<String> s_resellerCommands = null; // AKA domain-admin
private static List<String> s_adminCommands = null; private static List<String> s_adminCommands = null;
private static List<String> s_readOnlyAdminCommands = null; private static List<String> s_readOnlyAdminCommands = null;
private static List<String> s_allCommands = null;
private static ExecutorService _executor = new ThreadPoolExecutor(10, 150, 60, TimeUnit.SECONDS, new LinkedBlockingQueue<Runnable>(), new NamedThreadFactory("ApiServer")); private static ExecutorService _executor = new ThreadPoolExecutor(10, 150, 60, TimeUnit.SECONDS, new LinkedBlockingQueue<Runnable>(), new NamedThreadFactory("ApiServer"));
@ -133,6 +136,7 @@ public class ApiServer implements HttpRequestHandler {
s_resellerCommands = new ArrayList<String>(); s_resellerCommands = new ArrayList<String>();
s_adminCommands = new ArrayList<String>(); s_adminCommands = new ArrayList<String>();
s_readOnlyAdminCommands = new ArrayList<String>(); s_readOnlyAdminCommands = new ArrayList<String>();
s_allCommands = new ArrayList<String>();
} }
private ApiServer() { } private ApiServer() { }
@ -182,6 +186,11 @@ public class ApiServer implements HttpRequestHandler {
} }
} }
} }
s_allCommands.addAll(s_adminCommands);
s_allCommands.addAll(s_readOnlyAdminCommands);
s_allCommands.addAll(s_userCommands);
s_allCommands.addAll(s_resellerCommands);
} }
} catch (FileNotFoundException fnfex) { } catch (FileNotFoundException fnfex) {
s_logger.error("Unable to find properites file", fnfex); s_logger.error("Unable to find properites file", fnfex);
@ -441,8 +450,13 @@ public class ApiServer implements HttpRequestHandler {
} }
*/ */
} }
private static boolean isCommandAvailable(String commandName) {
boolean isCommandAvailable = false;
isCommandAvailable = s_allCommands.contains(commandName);
return isCommandAvailable;
}
public boolean verifyRequest(Map<String, Object[]> requestParameters, Long userId) { public boolean verifyRequest(Map<String, Object[]> requestParameters, Long userId) throws InvalidParameterException {
try { try {
String apiKey = null; String apiKey = null;
String secretKey = null; String secretKey = null;
@ -467,8 +481,16 @@ public class ApiServer implements HttpRequestHandler {
return false; return false;
} }
return true; return true;
}else{
//check against every available command to see if the command exists or not
if(!isCommandAvailable(commandName)){
s_logger.warn("The given command:"+commandName+" does not exist");
throw new InvalidParameterException("The given command:"+commandName+" does not exist");
} }
}
// - build a request string with sorted params, make sure it's all lowercase // - build a request string with sorted params, make sure it's all lowercase
// - sign the request, verify the signature is the same // - sign the request, verify the signature is the same
List<String> parameterNames = new ArrayList<String>(); List<String> parameterNames = new ArrayList<String>();
@ -552,6 +574,9 @@ public class ApiServer implements HttpRequestHandler {
} }
return equalSig; return equalSig;
} catch (Exception ex) { } catch (Exception ex) {
if(ex instanceof InvalidParameterException){
throw new InvalidParameterException(ex.getMessage());
}
s_logger.error("unable to verifty request signature", ex); s_logger.error("unable to verifty request signature", ex);
} }
return false; return false;

10
server/src/com/cloud/api/ApiServlet.java
View File

@ -20,6 +20,7 @@ package com.cloud.api;
import java.io.IOException; import java.io.IOException;
import java.io.OutputStream; import java.io.OutputStream;
import java.security.InvalidParameterException;
import java.util.Enumeration; import java.util.Enumeration;
import java.util.HashMap; import java.util.HashMap;
import java.util.Map; import java.util.Map;
@ -32,6 +33,7 @@ import javax.servlet.http.HttpSession;
import org.apache.log4j.Logger; import org.apache.log4j.Logger;
import com.cloud.exception.CloudAuthenticationException; import com.cloud.exception.CloudAuthenticationException;
import com.cloud.exception.InvalidParameterValueException;
import com.cloud.maid.StackMaid; import com.cloud.maid.StackMaid;
import com.cloud.user.Account; import com.cloud.user.Account;
import com.cloud.user.UserContext; import com.cloud.user.UserContext;
@ -266,6 +268,14 @@ public class ApiServlet extends HttpServlet {
s_logger.trace("exception processing request: " + ioex); s_logger.trace("exception processing request: " + ioex);
} }
auditTrailSb.append(" exception processing request" ); auditTrailSb.append(" exception processing request" );
}catch (InvalidParameterException ipe){
auditTrailSb.append(" " + HttpServletResponse.SC_NOT_FOUND + " " + ipe.getMessage());
try {
resp.sendError(HttpServletResponse.SC_NOT_FOUND, ipe.getMessage());
} catch (IOException e) {
s_logger.error("Unable to send back error response for invalid command");
auditTrailSb.append(" " + HttpServletResponse.SC_NOT_FOUND + " " + "Unable to send back error response for "+ipe.getMessage());
}
}catch (Exception ex) { }catch (Exception ex) {
s_logger.error("unknown exception writing api response", ex); s_logger.error("unknown exception writing api response", ex);
auditTrailSb.append(" unknown exception writing api response"); auditTrailSb.append(" unknown exception writing api response");