Commit fa05c92d authored by Iustin Pop's avatar Iustin Pop

Merge branch 'stable-2.1' into devel-2.1

* stable-2.1:
  Bump version to 2.1.0~rc2
  Update NEWS file and release Ganeti 2.0.5
  Security issue: add validation of script names
  Move the hooks file mask into constants.py
  Improve LUQueryNodes for lockless case
  Ship rapi.rst/rapi.html in the dist archive
parents 1d65264b 1a44f8cd
......@@ -101,6 +101,15 @@ Details
- Improved burnin
Version 2.0.5
-------------
- Fix security issue due to missing validation of iallocator names; this
allows local and remote execution of arbitrary executables
- Fix failure of gnt-node list during instance removal
- Ship the RAPI documentation in the archive
Version 2.0.4
-------------
......
......@@ -2,7 +2,7 @@
m4_define([gnt_version_major], [2])
m4_define([gnt_version_minor], [1])
m4_define([gnt_version_revision], [0])
m4_define([gnt_version_suffix], [~rc1])
m4_define([gnt_version_suffix], [~rc2])
m4_define([gnt_version_full],
m4_format([%d.%d.%d%s],
gnt_version_major, gnt_version_minor,
......
......@@ -1735,10 +1735,11 @@ def _TryOSFromDisk(name, base_dir=None):
"""
if base_dir is None:
os_dir = utils.FindFile(name, constants.OS_SEARCH_PATH, os.path.isdir)
if os_dir is None:
return False, "Directory for OS %s not found in search path" % name
else:
os_dir = os.path.sep.join([base_dir, name])
os_dir = utils.FindFile(name, [base_dir], os.path.isdir)
if os_dir is None:
return False, "Directory for OS %s not found in search path" % name
status, api_versions = _OSOndiskAPIVersion(name, os_dir)
if not status:
......@@ -2616,8 +2617,6 @@ class HooksRunner(object):
on the master side.
"""
RE_MASK = re.compile("^[a-zA-Z0-9_-]+$")
def __init__(self, hooks_base_dir=None):
"""Constructor for hooks runner.
......@@ -2725,7 +2724,7 @@ class HooksRunner(object):
for relname in dir_contents:
fname = os.path.join(dir_name, relname)
if not (os.path.isfile(fname) and os.access(fname, os.X_OK) and
self.RE_MASK.match(relname) is not None):
constants.EXT_PLUGIN_MASK.match(relname) is not None):
rrval = constants.HKR_SKIP
output = ""
else:
......
......@@ -2579,10 +2579,9 @@ class LUQueryNodes(NoHooksLU):
inst_fields = frozenset(("pinst_cnt", "pinst_list",
"sinst_cnt", "sinst_list"))
if inst_fields & frozenset(self.op.output_fields):
instancelist = self.cfg.GetInstanceList()
inst_data = self.cfg.GetAllInstancesInfo()
for instance_name in instancelist:
inst = self.cfg.GetInstanceInfo(instance_name)
for instance_name, inst in inst_data.items():
if inst.primary_node in node_to_primary:
node_to_primary[inst.primary_node].add(inst.name)
for secnode in inst.secondary_nodes:
......
......@@ -21,6 +21,8 @@
"""Module holding different constants."""
import re
from ganeti import _autoconf
# various versions
......@@ -174,6 +176,9 @@ VALUE_NONE = "none"
VALUE_TRUE = "true"
VALUE_FALSE = "false"
# External script validation mask
EXT_PLUGIN_MASK = re.compile("^[a-zA-Z0-9_-]+$")
# hooks-related constants
HOOKS_BASE_DIR = CONF_DIR + "/hooks"
HOOKS_PHASE_PRE = "pre"
......
......@@ -1653,9 +1653,17 @@ def FindFile(name, search_path, test=os.path.exists):
@return: full path to the object if found, None otherwise
"""
# validate the filename mask
if constants.EXT_PLUGIN_MASK.match(name) is None:
logging.critical("Invalid value passed for external script name: '%s'",
name)
return None
for dir_name in search_path:
item_name = os.path.sep.join([dir_name, name])
if test(item_name):
# check the user test and that we're indeed resolving to the given
# basename
if test(item_name) and os.path.basename(item_name) == name:
return item_name
return None
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment