mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
1f9347e148
Since the VM create became a job (6f0c7300) every new VM was defined with
no VNC password, and a clone copied its source's password (or its lack
of one) exactly: every clone of a template shared it. Computes listen
for VNC on all their addresses (dev/libvirt-bootstrap.sh), so anyone who
could reach a compute's VNC ports opened any of these consoles directly,
without the panel; the README's firewall rule was the only guard.
The create job asks for create.py's random 8-character password again,
and a clone's VNC graphics get a new random one. The console page sends
the password to a user with passwordless_console, which the user create
form now ticks by default next to change_password; a user without it is
asked for the password, as the permission intends. Existing VMs keep
their settings.
Live create, clone and VM page tests pass on a TCP compute.
26 lines
1.2 KiB
Python
26 lines
1.2 KiB
Python
"""A clone's VNC console gets a password of its own: one copied from its
|
|
source (a template's, say) would open the source's and every other clone's."""
|
|
|
|
import unittest
|
|
|
|
from vrtManager.instance import wvmInstance
|
|
|
|
|
|
def clone_graphics(passwd_attribute):
|
|
p = wvmInstance.__new__(wvmInstance) # no connection: only these calls
|
|
p.get_instances = lambda: []
|
|
p._XMLDesc = lambda flags: f"""<domain><name>tpl</name><uuid>u</uuid><devices>
|
|
<graphics type='vnc' port='-1' autoport='yes' {passwd_attribute} listen='0.0.0.0'/></devices></domain>"""
|
|
tree, _ = p._clone_definition({"name": "copy"}, "abababab-0000-1111-2222-333333333333")
|
|
return tree.find("devices/graphics")
|
|
|
|
|
|
class CloneConsoleTestCase(unittest.TestCase):
|
|
def test_each_clone_gets_its_own_vnc_password(self):
|
|
passwords = {clone_graphics("passwd='shared12'").get("passwd") for _ in range(5)}
|
|
self.assertNotIn("shared12", passwords)
|
|
self.assertEqual(len(passwords), 5)
|
|
self.assertTrue(all(len(p) == 8 for p in passwords)) # the length VNC allows
|
|
|
|
def test_a_source_without_a_password_gives_a_clone_with_one(self):
|
|
self.assertEqual(len(clone_graphics("").get("passwd")), 8)
|