mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
4d34d9d07c
Add webvirtcloud/test_authorization_matrix.py, which walks every named URL and checks that a user without any VM/compute relation only reaches an explicit allowlist, and that the global view_instances permission does not open consoles. It found: - /computes/<id>/... views without any check (compute_graph, get_compute_*, get_dom_capabilities, storages.get_volumes): the whole computes URL namespace is now wrapped with superuser_only, so a view added there later cannot be exposed by a missing decorator. - guess_mac_address (leaks dhcpd.conf host/MAC pairs), random_mac_address and guess_clone_name: superuser-only, like the buttons that use them. - check_instance: cross-tenant VM name lookup with no caller; removed. - getvvfile and get_vdi_url: reachable with only view_instances, and the .vv file contains the VNC password. Console access now follows one rule, instances.utils.can_open_console: an active superuser or an active owner of the VM. The global view_instances permission is read-only. It is used by the console page, novncd, getvvfile and get_vdi_url (getvvfile and the VDI tab are kept for virt-viewer users). The console page answers 403 instead of 500 when access is denied, with the same answer for a missing VM.
117 lines
3 KiB
Python
117 lines
3 KiB
Python
import json
|
|
import socket
|
|
|
|
from accounts.models import UserInstance, UserSSHKey
|
|
from computes.models import Compute
|
|
from django.core.exceptions import PermissionDenied
|
|
from django.http import Http404, HttpResponse
|
|
from django.shortcuts import get_object_or_404, render
|
|
from instances.models import Instance
|
|
from instances.utils import can_open_console
|
|
from libvirt import libvirtError
|
|
from vrtManager.instance import wvmInstance
|
|
|
|
OS_VERSIONS = ["latest", ""]
|
|
OS_UUID = "iid-dswebvirtcloud"
|
|
|
|
|
|
def os_index(request):
|
|
"""
|
|
:param request:
|
|
:return:
|
|
"""
|
|
response = "\n".join(OS_VERSIONS)
|
|
return HttpResponse(response)
|
|
|
|
|
|
def os_metadata_json(request, version):
|
|
"""
|
|
:param request:
|
|
:param version:
|
|
:return:
|
|
"""
|
|
|
|
if version == "latest":
|
|
ip = get_client_ip(request)
|
|
hostname = get_hostname_by_ip(ip)
|
|
response = {"uuid": OS_UUID, "hostname": hostname}
|
|
return HttpResponse(json.dumps(response))
|
|
else:
|
|
err = "Invalid version: %(version)s" % {"version": version}
|
|
raise Http404(err)
|
|
|
|
|
|
def os_userdata(request, version):
|
|
"""
|
|
:param request:
|
|
:param version:
|
|
:return:
|
|
"""
|
|
if version == "latest":
|
|
ip = get_client_ip(request)
|
|
hostname = get_hostname_by_ip(ip)
|
|
vname = hostname.split(".")[0]
|
|
|
|
instance_keys = []
|
|
userinstances = UserInstance.objects.filter(instance__name=vname)
|
|
|
|
for ui in userinstances:
|
|
keys = UserSSHKey.objects.filter(user=ui.user)
|
|
for k in keys:
|
|
instance_keys.append(k.keypublic)
|
|
|
|
return render(request, "user_data", locals())
|
|
else:
|
|
err = "Invalid version: %(version)s" % {"version": version}
|
|
raise Http404(err)
|
|
|
|
|
|
def get_client_ip(request):
|
|
"""
|
|
:param request:
|
|
:return:
|
|
"""
|
|
x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
|
|
if x_forwarded_for:
|
|
ip = x_forwarded_for.split(",")[-1].strip()
|
|
else:
|
|
ip = request.META.get("REMOTE_ADDR")
|
|
return ip
|
|
|
|
|
|
def get_hostname_by_ip(ip):
|
|
"""
|
|
:param ip:
|
|
:return:
|
|
"""
|
|
try:
|
|
addrs = socket.gethostbyaddr(ip)
|
|
except:
|
|
addrs = [ip]
|
|
return addrs[0]
|
|
|
|
|
|
def get_vdi_url(request, compute_id, vname):
|
|
"""
|
|
:param request:
|
|
:param vname:
|
|
:return:
|
|
"""
|
|
compute = get_object_or_404(Compute, pk=compute_id)
|
|
# The VDI URL points straight at the VM's console: same rule as the console.
|
|
instance = Instance.objects.filter(compute=compute, name=vname).first()
|
|
if instance is None or not can_open_console(request.user, instance):
|
|
raise PermissionDenied
|
|
|
|
try:
|
|
conn = wvmInstance(
|
|
compute.hostname, compute.login, compute.password, compute.type, vname
|
|
)
|
|
|
|
fqdn = get_hostname_by_ip(compute.hostname)
|
|
url = f"{conn.get_console_type()}://{fqdn}:{conn.get_console_port()}"
|
|
response = url
|
|
return HttpResponse(response)
|
|
except libvirtError:
|
|
err = "Error getting VDI URL for %(name)s" % {"name": vname}
|
|
raise Http404(err)
|