DaanHoogland commented on code in PR #6577:
URL: https://github.com/apache/cloudstack/pull/6577#discussion_r945769492
##########
server/src/main/java/com/cloud/consoleproxy/AgentHookBase.java:
##########
@@ -93,16 +99,20 @@ public AgentControlAnswer
onConsoleAccessAuthentication(ConsoleAccessAuthenticat
}
if (!cmd.isReauthenticating()) {
- String ticket = ConsoleProxyServlet.genAccessTicket(cmd.getHost(),
cmd.getPort(), cmd.getSid(), cmd.getVmId());
+ String ticket =
ConsoleAccessManagerImpl.genAccessTicket(cmd.getHost(), cmd.getPort(),
cmd.getSid(), cmd.getVmId(), sessionUuid);
if (s_logger.isDebugEnabled()) {
s_logger.debug("Console authentication. Ticket in 1 minute
boundary for " + cmd.getHost() + ":" + cmd.getPort() + "-" + cmd.getVmId() + "
is " + ticket);
}
+ if (!consoleAccessManager.isSessionAllowed(sessionUuid)) {
+ s_logger.error("Invalid session, only one session allowed per
token");
+ return new ConsoleAccessAuthenticationAnswer(cmd, false);
+ }
+
Review Comment:
A return in the middle of the method. Can this be refactorred to make this
complex method more readable?
##########
plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartCommandWrapper.java:
##########
@@ -110,6 +114,17 @@ public Answer execute(final StartCommand command, final
LibvirtComputingResource
}
}
+ if (vmSpec.getType() == VirtualMachine.Type.ConsoleProxy
&& vmSpec.getVncPort() != null) {
+ String novncPort = vmSpec.getVncPort();
+ try {
+ String addCmd = "echo " + novncPort + " > " +
vncConfFileLocation;
+ SshHelper.sshExecute(controlIp, sshPort, "root",
+ pemFile, null, addCmd, 20000, 20000,
600000);
+ } catch (Exception e) {
+ s_logger.error("Could not set the noVNC port " +
novncPort + " to the CPVM", e);
+ }
+ }
Review Comment:
can this be a separate method?
##########
server/src/main/java/com/cloud/consoleproxy/ConsoleAccessManagerImpl.java:
##########
@@ -0,0 +1,467 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.consoleproxy;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.GetVmVncTicketAnswer;
+import com.cloud.agent.api.GetVmVncTicketCommand;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.host.HostVO;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.resource.ResourceState;
+import com.cloud.server.ManagementServer;
+import com.cloud.servlet.ConsoleProxyClientParam;
+import com.cloud.servlet.ConsoleProxyPasswordBasedEncryptor;
+import com.cloud.storage.GuestOSVO;
+import com.cloud.user.Account;
+import com.cloud.user.AccountManager;
+import com.cloud.uservm.UserVm;
+import com.cloud.utils.Pair;
+import com.cloud.utils.Ternary;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.db.EntityManager;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.UserVmDetailVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.UserVmDetailsDao;
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import org.apache.cloudstack.consoleproxy.ConsoleAccessManager;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.security.keys.KeysManager;
+import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.log4j.Logger;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import javax.inject.Inject;
+import javax.naming.ConfigurationException;
+import java.net.InetAddress;
+import java.util.Date;
+
+import java.util.Map;
+
+public class ConsoleAccessManagerImpl extends ManagerBase implements
ConsoleAccessManager {
+
+ @Inject
+ private AccountManager _accountMgr;
+ @Inject
+ private VirtualMachineManager _vmMgr;
+ @Inject
+ private ManagementServer _ms;
+ @Inject
+ private EntityManager _entityMgr;
+ @Inject
+ private UserVmDetailsDao _userVmDetailsDao;
+ @Inject
+ private KeysManager _keysMgr;
+ @Inject
+ private AgentManager agentManager;
+
+ private static KeysManager s_keysMgr;
+ private final Gson _gson = new GsonBuilder().create();
+
+ public static final Logger s_logger =
Logger.getLogger(ConsoleAccessManagerImpl.class.getName());
+
+ @Override
+ public boolean configure(String name, Map<String, Object> params) throws
ConfigurationException {
+ s_keysMgr = _keysMgr;
+ return super.configure(name, params);
+ }
+
+ @Override
+ public Pair<Boolean, String> generateConsoleUrl(Long vmId) {
+ try {
+ if (_accountMgr == null || _vmMgr == null || _ms == null) {
+ return new Pair<>(false, "Console service is not ready");
+ }
+
+ if (_keysMgr.getHashKey() == null) {
+ String msg = "Console access denied. Ticket service is not
ready yet";
+ s_logger.debug(msg);
+ return new Pair<>(false, msg);
+ }
+
+ Account account = CallContext.current().getCallingAccount();
+
+ // Do a sanity check here to make sure the user hasn't already
been deleted
+ if (account == null) {
+ s_logger.debug("Invalid user/account, reject console access");
+ return new Pair<>(false, "Access denied. Invalid or
inconsistent account is found");
+ }
+
+ VirtualMachine vm = _entityMgr.findById(VirtualMachine.class,
vmId);
+ if (vm == null) {
+ s_logger.info("Invalid console servlet command parameter: " +
vmId);
+ return new Pair<>(false, "Cannot find VM with ID " + vmId);
+ }
+
+ if (!checkSessionPermision(vm, account)) {
+ return new Pair<>(false, "Permission denied");
+ }
+
+ return new Pair<>(true, generateAccessUrl(vmId));
+ } catch (Throwable e) {
+ s_logger.error("Unexepected exception in ConsoleProxyServlet", e);
+ return new Pair<>(false, "Server Internal Error: " +
e.getMessage());
+ }
+ }
+
+ private boolean checkSessionPermision(VirtualMachine vm, Account account) {
+ if (_accountMgr.isRootAdmin(account.getId())) {
+ return true;
+ }
+
+ switch (vm.getType()) {
+ case User:
+ try {
+ _accountMgr.checkAccess(account, null, true, vm);
+ } catch (PermissionDeniedException ex) {
+ if (_accountMgr.isNormalUser(account.getId())) {
+ if (s_logger.isDebugEnabled()) {
+ s_logger.debug("VM access is denied. VM owner
account " + vm.getAccountId() + " does not match the account id in session " +
Review Comment:
I don´t think leaving out the 'is' is bettering the English here. let's
leave it in.
##########
server/src/main/java/com/cloud/consoleproxy/ConsoleAccessManagerImpl.java:
##########
@@ -0,0 +1,451 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.consoleproxy;
Review Comment:
new classes should go in `org.apacje.cloudstack` packages
##########
server/src/main/java/com/cloud/hypervisor/HypervisorGuruBase.java:
##########
@@ -283,6 +284,15 @@ protected VirtualMachineTO
toVirtualMachineTO(VirtualMachineProfile vmProfile) {
to.setConfigDriveLocation(vmProfile.getConfigDriveLocation());
to.setState(vm.getState());
+ if (vmInstance.getType() == VirtualMachine.Type.ConsoleProxy) {
+ try {
+ String vncPort =
String.valueOf(ConsoleProxyManager.NoVncConsolePort.value());
+ to.setVncPort(vncPort);
+ } catch (Exception e) {
+ s_logger.error("Could not parse the noVNC port set on " +
ConsoleProxyManager.NoVncConsolePort.key(), e);
+ }
+ }
Review Comment:
extract?
##########
server/src/main/java/com/cloud/api/ApiServlet.java:
##########
@@ -324,6 +327,16 @@ void processRequestInContext(final HttpServletRequest req,
final HttpServletResp
// Add the HTTP method (GET/POST/PUT/DELETE) as well into the
params map.
params.put("httpmethod", new String[]{req.getMethod()});
setProjectContext(params);
+ if (org.apache.commons.lang3.StringUtils.isNotBlank(command) &&
+
command.equalsIgnoreCase(CreateConsoleEndpointCmd.APINAME)) {
+ InetAddress addr = getClientAddress(req);
+ String clientAddress = addr != null ?
addr.getHostAddress() : null;
+ params.put(ConsoleAccessUtils.CLIENT_INET_ADDRESS_KEY, new
String[] {clientAddress});
+ if
(ConsoleAccessManager.ConsoleProxyExtraSecurityHeaderEnabled.value()) {
+ String clientSecurityToken =
req.getHeader(ConsoleAccessManager.ConsoleProxyExtraSecurityHeaderName.value());
+
params.put(ConsoleAccessUtils.CLIENT_SECURITY_HEADER_PARAM_KEY, new String[]
{clientSecurityToken});
+ }
+ }
Review Comment:
extra method?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
