mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
17016e90cd
A compute's hostname and login go unquoted into the libvirt connection URI (qemu+ssh://login@host/system, qemu+tcp://host/system, qemu+tls://...) and, for an SSH compute, into the ssh command line of the DRBD status view. They were barely validated: validate_hostname used re.match with a negated class, so it caught only a leading special character, and login was never checked. A hostname like "192.0.2.1/system?command=/path" injected a libvirt URI parameter (verified: connecting ran the named command through the ssh wrapper), and TLS/SSH parameters such as no_verify, pkipath, socket or netcat could be added the same way; a login like "-oProxyCommand=..." became an ssh option. The DRF ComputeSerializer applied neither check, and validate_name tested a string literal instead of its argument, so it never raised. validate_hostname now accepts only an IPv4 address or a host name with fullmatch (no scheme, port, path, query, whitespace or IPv6 literal; IPv6 is left out until the URI building brackets it). validate_login accepts an empty value (TCP falls back to the server's authentication, the socket transport ignores the login) or a plain name with no leading "-". Both sit on the Compute model fields, so the forms and the DRF serializer (which copies model validators onto its fields) reject the values; a migration records the metadata. validate_name checks its argument. drbd_status validates the login and hostname before building login@host and ends ssh option parsing with "--"; an existing or bypassed bad row is skipped rather than run. Tests: hostname/login validators accept real values and reject URI and option injection; the SSH form and the serializer (create, and an empty TCP login) enforce them; drbd_status skips an injecting target. Checked the real test computes still validate. The new tests fail on the previous code.
94 lines
3 KiB
Python
94 lines
3 KiB
Python
from ipaddress import ip_address
|
|
|
|
from django.db.models import CharField, IntegerField, Model
|
|
from django.utils.functional import cached_property
|
|
from django.utils.translation import gettext_lazy as _
|
|
from libvirt import virConnect
|
|
|
|
from computes.validators import validate_hostname, validate_login, validate_migration_address
|
|
from vrtManager.connection import connection_manager
|
|
from vrtManager.hostdetails import wvmHostDetails
|
|
|
|
|
|
class Compute(Model):
|
|
name = CharField(_("name"), max_length=64, unique=True)
|
|
hostname = CharField(_("hostname"), max_length=64, validators=[validate_hostname])
|
|
login = CharField(_("login"), max_length=20, blank=True, validators=[validate_login])
|
|
password = CharField(_("password"), max_length=14, blank=True, null=True)
|
|
details = CharField(_("details"), max_length=64, null=True, blank=True)
|
|
type = IntegerField()
|
|
migration_address = CharField(
|
|
_("migration address"),
|
|
max_length=64,
|
|
blank=True,
|
|
default="",
|
|
validators=[validate_migration_address],
|
|
help_text=_(
|
|
"IP address or host name the other hosts send migrating VMs to; "
|
|
"empty: the host's own host name, which they must be able to resolve"
|
|
),
|
|
)
|
|
|
|
@property
|
|
def migration_uri(self):
|
|
"""The native migration URI for VMs migrated to this host, or None for
|
|
libvirt's default."""
|
|
if not self.migration_address:
|
|
return None
|
|
try:
|
|
if ip_address(self.migration_address).version == 6:
|
|
return f"tcp://[{self.migration_address}]"
|
|
except ValueError:
|
|
pass
|
|
return f"tcp://{self.migration_address}"
|
|
|
|
@cached_property
|
|
def status(self):
|
|
"""True if WebVirtCloud can connect to the host (within the connect
|
|
timeout; a host that failed recently is not tried again at once)."""
|
|
return isinstance(self.connection, virConnect)
|
|
|
|
@cached_property
|
|
def connection_error(self):
|
|
"""Why the host cannot be reached, or None."""
|
|
return None if self.status else str(self.connection)
|
|
|
|
@cached_property
|
|
def connection(self):
|
|
try:
|
|
return connection_manager.get_connection(
|
|
self.hostname,
|
|
self.login,
|
|
self.password,
|
|
self.type,
|
|
)
|
|
except Exception as e:
|
|
return e
|
|
|
|
@cached_property
|
|
def proxy(self):
|
|
return wvmHostDetails(
|
|
self.hostname,
|
|
self.login,
|
|
self.password,
|
|
self.type,
|
|
)
|
|
|
|
@cached_property
|
|
def cpu_count(self):
|
|
return self.proxy.get_node_info()[3]
|
|
|
|
@cached_property
|
|
def cpu_usage(self):
|
|
return round(self.proxy.get_cpu_usage(diff=False).get('usage'))
|
|
|
|
@cached_property
|
|
def ram_size(self):
|
|
return self.proxy.get_node_info()[2]
|
|
|
|
@cached_property
|
|
def ram_usage(self):
|
|
return self.proxy.get_memory_usage()["percent"]
|
|
|
|
def __str__(self):
|
|
return self.name
|