Merge branch '4.22' into ghi11941-restoreWithPassword

Author: DaanHoogland

.github/workflows/ci.yml

@@ -282,7 +282,7 @@ jobs:
           # https://github.com/actions/runner-images/blob/main/images/linux/Ubuntu2004-Readme.md#mysql
           sudo apt-get install -y mysql-server
           sudo systemctl start mysql
-          sudo mysql -uroot -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY ''; FLUSH PRIVILEGES;"
+          sudo mysql -uroot -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY ''; FLUSH PRIVILEGES;"
           sudo systemctl restart mysql
           sudo mysql -uroot -e "SELECT VERSION();"
 

agent/conf/agent.properties

@@ -472,4 +472,3 @@ iscsi.session.cleanup.enabled=false
 # Optional vCenter SHA1 thumbprint for VMware to KVM conversion via VDDK, passed as
 # -io vddk-thumbprint=<value>. If unset, CloudStack computes it on the KVM host via openssl.
 #vddk.thumbprint=
-

agent/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>

api/pom.xml

@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>

api/src/main/java/com/cloud/ha/Investigator.java

@@ -26,17 +26,19 @@ public interface Investigator extends Adapter {
      * Returns if the vm is still alive.
      *
      * @param vm to work on.
+     * @return true if vm is alive, otherwise false
      */
-    public boolean isVmAlive(VirtualMachine vm, Host host) throws UnknownVM;
+    boolean isVmAlive(VirtualMachine vm, Host host) throws UnknownVM;
 
-    public Status isAgentAlive(Host agent);
+    /**
+     * Returns the agent status of the host.
+     *
+     * @param host
+     * @return status of the host agent
+     */
+    Status getHostAgentStatus(Host host);
 
     class UnknownVM extends Exception {
-
-        /**
-         *
-         */
         private static final long serialVersionUID = 1L;
-
     };
 }

api/src/main/java/org/apache/cloudstack/acl/APIChecker.java

@@ -17,16 +17,22 @@
 package org.apache.cloudstack.acl;
 
 import com.cloud.exception.PermissionDeniedException;
+import com.cloud.exception.RequestLimitException;
 import com.cloud.user.Account;
 import com.cloud.user.User;
 import com.cloud.utils.component.Adapter;
 
+import java.util.ArrayList;
 import java.util.List;
 
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
 /**
  * APICheckers is designed to verify the ownership of resources and to control the access to APIs.
  */
 public interface APIChecker extends Adapter {
+    Logger LOGGER = LogManager.getLogger(APIChecker.class);
     // Interface for checking access for a role using apiname
     // If true, apiChecker has checked the operation
     // If false, apiChecker is unable to handle the operation or not implemented
@@ -42,5 +48,27 @@ public interface APIChecker extends Adapter {
      * @return the list of allowed apis for the given user
      */
     List<String> getApisAllowedToUser(Role role, User user, List<String> apiNames) throws PermissionDeniedException;
+
+    default List<String> getApisAllowedToAccount(Account account, List<String> apiNames) {
+        List<String> allowedApis = new ArrayList<>();
+        for (String apiName : apiNames) {
+            try {
+                checkAccess(account, apiName);
+                allowedApis.add(apiName);
+            } catch (RequestLimitException e) {
+                // Non-ACL failure (e.g. rate limiting) should not be treated as simple "not allowed".
+                // Propagate as unchecked so callers are aware of the failure.
+                throw new RuntimeException("Failed to check access for API [" + apiName + "] due to request limits", e);
+            } catch (PermissionDeniedException e) {
+                LOGGER.trace("Account [" + account + "] is not allowed to access API [" + apiName + "]");
+            }
+        }
+        return allowedApis;
+    }
+
     boolean isEnabled();
+
+    default void refreshRoleCacheOnPermissionsChange(Role role) {
+        // Only applicable for dynamic role based checkers
+    }
 }

api/src/main/java/org/apache/cloudstack/acl/Rule.java

@@ -25,16 +25,18 @@
 
 public final class Rule {
     private final String rule;
+    private final Pattern compiledPattern;
     private final static Pattern ALLOWED_PATTERN = Pattern.compile("^[a-zA-Z0-9*]+$");
 
     public Rule(final String rule) {
         validate(rule);
         this.rule = rule;
+        this.compiledPattern = Pattern.compile(rule.replace("*", "\\w*"), Pattern.CASE_INSENSITIVE);
     }
 
     public boolean matches(final String commandName) {
         return StringUtils.isNotEmpty(commandName)
-                && commandName.toLowerCase().matches(rule.toLowerCase().replace("*", "\\w*"));
+                && compiledPattern.matcher(commandName).matches();
     }
 
     public String getRuleString() {

api/src/main/java/org/apache/cloudstack/api/ApiArgValidator.java

@@ -17,9 +17,18 @@
 
 package org.apache.cloudstack.api;
 
+import java.util.Locale;
+import java.util.regex.Pattern;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.UuidUtils;
+
 public enum ApiArgValidator {
     /**
-     * Validates if the parameter is null or empty with the method {@link Strings#isNullOrEmpty(String)}.
+     * Validates if the parameter is null or empty with the method {@link StringUtils#isEmpty(CharSequence)}.
+     * Validation is currently done in the method ParamProcessWorker#validateNonEmptyString(String, String).
      */
     NotNullOrEmpty,
 
@@ -29,12 +38,72 @@ public enum ApiArgValidator {
     PositiveNumber,
 
     /**
-     * Validates if the parameter is an UUID with the method {@link UuidUtils#isUuid(String)}.
+     * Validates if the parameter is a UUID with the method {@link UuidUtils#isUuid(String)}.
+     * Validation is currently done in the method ParamProcessWorker#validateUuidString(String, String).
      */
     UuidString,
 
     /**
      * Validates if the parameter is a valid RFC Compliance domain name.
      */
     RFCComplianceDomainName,
+
+    /**
+     * Validates command option strings to avoid unsafe/code-like content.
+     */
+    SafeCommandOptions((param, annotation) -> {
+        if (BaseCmd.CommandType.STRING.equals(annotation.type())) {
+            validateSafeCommandOptions(param, annotation.name());
+        }
+    });
+
+    private static final Pattern SAFE_COMMAND_OPTIONS_PATTERN = Pattern.compile("^[A-Za-z0-9,._=:/+\\-\\s]*$");
+
+    private static final String[] UNSAFE_TOKENS = {
+            "$(", "`", "&&", "||", ";", "|", ">", "<"
+    };
+
+    private final ValidationRule rule;
+
+    ApiArgValidator() {
+        this(null);
+    }
+
+    ApiArgValidator(ValidationRule rule) {
+        this.rule = rule;
+    }
+
+    public void validate(final Object paramObj, final Parameter annotation) {
+        if (rule != null) {
+            rule.validate(paramObj, annotation);
+        }
+    }
+
+    private static void validateSafeCommandOptions(final Object param, final String argName) {
+        final String value = String.valueOf(param);
+        if (StringUtils.isBlank(value)) {
+            return;
+        }
+
+        if (!SAFE_COMMAND_OPTIONS_PATTERN.matcher(value).matches()) {
+            throwInvalidParameterValueException(argName, "contains unsupported or unsafe characters");
+        }
+
+        final String normalized = value.toLowerCase(Locale.ROOT);
+        for (String token : UNSAFE_TOKENS) {
+            if (normalized.contains(token)) {
+                throwInvalidParameterValueException(argName, "contains code-like or unsafe content");
+            }
+        }
+    }
+
+    private static void throwInvalidParameterValueException(final String argName, final String customMsg) {
+        throw new InvalidParameterValueException(String.format("Invalid value provided for API arg: %s%s", argName,
+                StringUtils.isBlank(customMsg) ? "" : " - " + customMsg));
+    }
+
+    @FunctionalInterface
+    interface ValidationRule {
+        void validate(Object paramObj, Parameter annotation);
+    }
 }

api/src/main/java/org/apache/cloudstack/api/ApiConstants.java

@@ -1408,7 +1408,7 @@ public String toString() {
     }
 
     public enum HostDetails {
-        all, capacity, events, stats, min;
+        all, capacity, core, events, stats, min;
     }
 
     public enum VMDetails {

api/src/main/java/org/apache/cloudstack/api/command/admin/ha/ConfigureHAForHostCmd.java

@@ -87,6 +87,7 @@ private void setupResponse(final boolean result, final String resourceUuid) {
         final HostHAResponse response = new HostHAResponse();
         response.setId(resourceUuid);
         response.setProvider(getHaProvider().toLowerCase());
+        response.setStatus(result);
         response.setResponseName(getCommandName());
         setResponseObject(response);
     }