j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 19:26:48 +00:00
Code Issues Projects Releases Wiki Activity

fix(datasource): cloud-init endpoints work without login, keys need a unique name

Browse source 
The OpenStack-style cloud-init endpoints (index, meta_data.json,
user_data) are fetched by booting VMs, which do not log in. Since the
login-required middleware they redirected to the login page, so the
datasource has not worked. They are login_not_required now; they expose
a hostname and the public SSH keys of a VM's owners.

A VM is found by the reverse DNS name of the client address, and VM
names are not unique (only compute and UUID are). user_data merged the
owners of every VM with that name, so a user who named their VM like
another user's VM got their key into that VM at its next cloud-init
run. Keys are now given only when exactly one VM has the name.

The client address is the last X-Forwarded-For entry, which nginx in
the default setup appends; gunicorn listens on 127.0.0.1 only. The bare
except around the reverse lookup is narrowed to OSError.
This commit is contained in:
catborise 2026-10-04 20:46:15 +03:00
parent 99dabbdcec
commit 99eadaab31
3 changed files with 64 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

11
webvirtcloud/test_authorization_matrix.py
View file

@ -41,11 +41,9 @@ ALLOWED_FOR_ANY_USER = {
"rest_framework:login": "DRF browsable API login",
"rest_framework:logout": "DRF browsable API logout",
"console": "renders an error without a valid token; access is checked per VM",
"ds_openstack_index": "static cloud-init datasource index",
# Meant for VMs: answers for the VM whose name matches the reverse DNS of
# the client IP. The design is broken and needs a redesign.
"ds_openstack_metadata": "cloud-init datasource keyed by client IP",
"ds_openstack_userdata": "cloud-init datasource keyed by client IP",
"ds_openstack_index": "cloud-init datasource, fetched by VMs",
"ds_openstack_metadata": "cloud-init datasource, fetched by VMs",
"ds_openstack_userdata": "cloud-init datasource, fetched by VMs",
"instance-list": "API: filtered to the user's own instances",
"compute-instance-list": "API: filtered to the user's own instances",
"instance-flavor-list": "API: flavor catalogue",
@ -62,6 +60,9 @@ ALLOWED_FOR_ANONYMOUS = {
"accounts:login": "login page",
"accounts:email_otp": "part of the login flow (its own issues are tracked separately)",
"rest_framework:login": "DRF browsable API login page",
"ds_openstack_index": "cloud-init datasource, fetched by VMs that do not log in",
"ds_openstack_metadata": "cloud-init datasource, fetched by VMs that do not log in",
"ds_openstack_userdata": "cloud-init datasource, fetched by VMs that do not log in",
"schema": "OpenAPI schema (SERVE_PERMISSIONS not restricted yet)",
"schema-json": "OpenAPI schema (SERVE_PERMISSIONS not restricted yet)",
"schema-redoc": "API docs (SERVE_PERMISSIONS not restricted yet)",