Commit Graph

3873 Commits

Author SHA1 Message Date
Rohit Yadav eb96ede328 saml: Safer DocumentBuilderFactory and ParserPool configuration
This implements safer DocumentBuilderFactory and ParserPool utilities
to be used throughout the codebase to prevent potential XXE exploits.

References:
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
(cherry picked from commit 0c6b92142cc402c3eebf9bf4aa3c77b2d9defc69)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
2022-07-12 18:44:27 +05:30
Rohit Yadav 4aaa850b63 Updating pom.xml version numbers for release 4.15.2.0
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
2021-09-10 21:19:58 +05:30
Rohit Yadav 2297c73c92
vmware: delete snapshot disk after backup to secondary storage (#5333)
* vmware: delete snapshot disk after backup to secondary storage

WIP - This ensures that worker VM is destroyed along with any of its own
disks that are backed up to secondary storage.

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

* fix

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix for volume backup and confuding vm var name

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* change

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* tag as worker vm

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

Co-authored-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-09-03 00:38:44 +05:30
sureshanaparti fc285e23f3
vmware: Cancel the pending tasks for worker VM before destroying it (#5374)
Co-authored-by: nicolas <nicovazquez90@gmail.com>
2021-09-02 11:02:20 +05:30
Abhishek Kumar 8998479606
vmware: check checksum before copying systemvm ISO to decide if it is needed (#5380)
* vmware: fix copy systemvm.iso for same version

For VMware, systemvm.iso is copied from MS to secondary store. Current server checks if the desired file is present on the secondary store or not. If it is not present ISO is copied.
This change adds a check for checksum for source and destination ISO which would allow copying new ISO if there is a mismatch.
Useful in case when file is corrupted in secondary store or new systemvm.iso is generated for dev environment.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* changes

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-09-02 10:53:29 +05:30
Wei Zhou 4e53997ca2
server: do not remove volume from DB if fail to expunge it from primary storage or secondary storage (#5373)
* server: do not remove volume from DB if fail to expunge it from primary storage or secondary storage

* server/VolumeApiServiceImpl.java: move to method

* update #5373
2021-08-31 13:48:58 -03:00
Abhishek Kumar 73cabcd641
xcp-ng: allow passing vm boot options (#5335)
* xenserver: honor vm boot details

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* ui: allow boot option selection for xenserver

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix case

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* host uefi capability

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* change

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* add detail only if uefi supported

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* update host detail

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix version comparison

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-08-31 16:10:12 +05:30
slavkap 961e85eb60
Fix of creating volumes from snapshots without backup to secondary storage (#5349)
* Fix of creating volumes from snapshots without backup

When few snaphots are created onyl on primary storage, and try to create
a volume or a template from the snapshot only the first operation is
successful. Its because the snapshot is backup on secondary storage with
wrong SQL query. The problem appears on Ceph/NFS but may affects other
storage plugins.
Bypassing secondary storage is implemented only for Ceph primary storage
and it didn't cover the functionality to create volume from snapshot
which is kept only on Ceph

* Address review
2021-08-31 12:46:57 +05:30
Rafael 14323c9db5
updated maven dependency due to #5363 (#5366)
Co-authored-by: Rafael del Valle <rvalle@privaz.io>
2021-08-31 12:39:18 +05:30
sureshanaparti e50a40ea08
Start VM with deploy-as-is template having multiple disk (SCSI) controller types. (#5311) 2021-08-30 21:52:24 -03:00
sureshanaparti 46ca853e55
Added Worker VM tags for few cloned VMs, created while performing some volume operations. (#5377)
Worker VM tags are missed for few cloned VMs in VMware, and so these are skipped when tracking / cleaning up of Worker VMs. Adding proper Worker VM tags to these VMs would make them trackable from CloudStack.
2021-08-30 20:22:06 -03:00
Wei Zhou 7fa63b3fe9
add license header in HostMetricsResponseTest.java (#5342) 2021-08-19 17:41:34 +05:30
Abhishek Kumar 6446797fdc
metrics: fix hostsmetricsresponse for zero cpu, locale (#5329)
* server: Fixed hosts not displaying with incompatible locale (#4900)

Fixes: #4733

* added unit test

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* eof newline

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

Co-authored-by: Spaceman1984 <49917670+Spaceman1984@users.noreply.github.com>
2021-08-19 01:30:01 -03:00
Abhishek Kumar 1ccb42017f
server: skip zone check for PERHOST iso during attachIso (#5270)
* server: skip zone check for PERHOST iso during attachIso

Hypervisor tools ISO - vmware-toools.iso, xs-tools.iso are marked as PERHOST in DB. They are active but not downloaded to the secondary storages and hence no template-zone entry.
Skips the template-zone check for such templates.

Fixes #5265

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* inverted check

* use constants in TemplateManager

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-08-09 14:02:25 +05:30
Rohit Yadav 5228fae7b8
kvm: pre-add 32 PCI controller for hot-plug issue on ARM64 (#5193)
On newer libvirt/qemu it seems PCI hot-plugging could be an issue as
seen in:

https://www.suse.com/support/kb/doc/?id=000019383
https://bugs.launchpad.net/nova/+bug/1836065

This was found to be true on ARM64/aarch64 platform (tested on
RaspberryPi4). As per the default machine doc, it advises to
pre-allocate PCI controllers on the machine and pcie-to-pci-bridge based
controller for legacy PCI models:
https://libvirt.org/pci-hotplug.html#x86_64-q35

This patch introduces the concept as a workaround until a proper fix is
done (ideally in the upstream libvirt/qemu projects). Until then client
code can add 32 PCI controllers and a pcie-to-pci-bridge controller for
aarch64 platforms.

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
2021-07-15 13:15:10 +05:30
Wei Zhou cf0f1feb5e
configdrive: fix some failures in tests/component/test_configdrive.py (#5144)
* server: fix failed to apply userdata when enable static nat

* server: fix cannot expunge vm as applyUserdata fails

* configdrive: fix ISO is not recognized when plug a new nic

* configdrive: detach and attach configdrive ISO as it is changed when plug a new nic or migrate vm

* configdrive test: (1) password file does not exists in recreated ISO; (2) vm hostname should be changed after migration

* configdrive: use centos55 template with sshkey and configdrive support

* configdrive: disklabel is 'config-2' for configdrive ISO

* configdrive: use copy for configdrive ISO and move for other template/volume/iso

* configdrive: use public-keys.txt

* configdrive test: fix (1) update_template ; (2) ssh into vm by keypair
2021-07-15 12:49:37 +05:30
Wei Zhou f286f01516
kvm: fix VM HA on zone-wide storage pools (#5164) 2021-07-05 11:51:07 +05:30
Rohit Yadav d916e416ec Updating pom.xml version numbers for release 4.15.2.0-SNAPSHOT
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
2021-07-02 22:59:07 +05:30
Rohit Yadav 379454caae Updating pom.xml version numbers for release 4.15.1.0
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
2021-06-28 15:27:27 +05:30
Wei Zhou 67182dc49b
vxlan: arp does not work between hosts as multicast group is communicated over physical nic instead of linux bridge (#5078)
* vxlan: arp does not work between hosts as multicast group is communicated over physical nic instead of linux bridge

when linux bridge is setup (refer to http://docs.cloudstack.apache.org/projects/archived-cloudstack-getting-started/en/latest/networking/vxlan.html#configure-product-to-use-vxlan-plugin) and used as the kvm traffic label of physical networks, the vms on different hosts cannot reach each other.

(1) does not work:
```
/usr/share/cloudstack-common/scripts/vm/network/vnet/modifyvxlan.sh -v 1001 -p eth1 -b brvx-1001 -o add
```
"bridge fdb" shows
```
00:00:00:00:00:00 dev vxlan1001 dst 239.0.3.233 via eth1 self permanent
```

(2) this works:
```
/usr/share/cloudstack-common/scripts/vm/network/vnet/modifyvxlan.sh -v 1001 -p cloudbr1 -b brvx-1001 -o add
```
"bridge fdb" shows
```
00:00:00:00:00:00 dev vxlan1001 dst 239.0.3.233 via cloudbr1 self permanent
```

* vxlan: fix issue if kvm network label is not set
2021-06-16 08:52:31 +05:30
Harikrishna 12b2e80d82
vmware: Fix fetching chain_info of the volumes. It is used to assume datastore names are in the form of UUIDs but it can be any name. So fetch chain_info based on the datastore name. (#5097)
his PR fixes the problem of not updating the chain info or setting chain info to null after volume migrations.

Problem: While fetching the volume chain info, management server assumes datastore name to be a UUID (this is true only for NFS storages added by CloudStack) but datastore name can be with any name.
Solution: To fetch the volume chain info, use datastore name instead of UUID.

The fix is made in the flow of following API operations

migrateVirtualMachine
migrateVirtualMachineWithVolume
migrateVolume
2021-06-11 20:06:06 +05:30
slavkap b0f2112dc2
kvm: Fix of some UEFI related issues (#5072)
* Fix of some UEFI related issues

1 - fix of attach/detach ISO of VM with UEFI boot type
2 - if OS type of an ISO is categorized as "Other" the bus type of the disk
will be set to "sata"

* Simplify the validation of OS types
2021-06-09 11:15:07 +05:30
Rohit Yadav 8c7e39eb89
xenserver: attempt eject and destroying patch VBD separately (#5053)
Loop through all VMs and try to eject and remove systemvm.iso VBD upon host connect.

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
2021-06-01 20:55:57 +05:30
Harikrishna 5a841159c5
vmware: Create fcd folder on local storage in VMware vSphere (#5057)
This PR fixes the issue of missing fcd folder in local storage in case of VMware vSphere.
with this fix, a folder with name fcd is created whenever local storage is initiated.
2021-06-01 20:55:23 +05:30
Spaceman1984 5f734f718e
vmware: Disk controller vmware deploy as is (#5006)
Fixes #4344
2021-05-19 14:33:16 +05:30
Abhishek Kumar dc91a1fd4d
server: destroy ssvm, cpvm on last host maintenance (#4644)
* server: destroy ssvm, cpvm on last host maintenance

When a single or last UP host enters into maintenance just stopping SSVM and CPVM will leave behind VMs on hypervisor side. As these system vms will be recreated they can be destroyed.
Fixes #3719

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix methods

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* immediately destroy systemvms

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix destroy

Added bypassHostMaintenance flag in Comma.java class to allow command to be handled by host agent even when host is in maintenace.
Flag is set true only for delete commands for ssvm and cpvm.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* unit test fix

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix missing return statement

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix

VM should be stopped with cleanup before calling expunge else it server may through error with host in PrepareForMaintenance state.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* refactor

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* rename

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* refactor

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-05-14 23:16:15 +05:30
Abhishek Kumar 755791089d
api/server: cpu, memory values with overprovisioning in metrics response (#4795)
* metrics: operprovisioned host cpu allocated

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* changes

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* remove unused

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-05-14 23:15:35 +05:30
Harikrishna 32e3bbdcc5
VMware Datastore Cluster primary storage pool synchronisation (#4871)
Datastore cluster as a primary storage support is already there. But if any changes at vCenter to datastore cluster like addition/removal of datastore is not synchronised with CloudStack directly. It needs removal of primary storage from CloudStack and add it again to CloudStack.

Here synchronisation of datastore cluster is fixed without need to remove or add the datastore cluster.
1. A new API is introduced syncStoragePool which takes datastore cluster storage pool UUID as the parameter. This API checks if there any changes in the datastore cluster and updates management server accordingly.
2. During synchronisation if a new child datastore is found in datastore cluster, then management server will create a new child storage pool in database under the datastore cluster. If the new child storage pool is already added as an individual storage pool then the existing storage pool entry will be converted to child storage pool (instead of creating a new storage pool entry)
3. During synchronisaton if the existing child datastore in CloudStack is found to be removed on vCenter then management server removes that child datastore from datastore cluster and makes it an individual storage pool.
The above behaviour is on par with the vCenter behaviour when adding and removing child datastore.
2021-05-07 16:30:54 +05:30
Pearl Dsilva de30f3b7ee
vmware cks: Guard k8s cluster root disk resize if no root disk size passed (#4957)
* Guard k8s cluster resize if no root disk size passed

* test regression

Co-authored-by: Pearl Dsilva <pearl.dsilva@shapeblue.com>
2021-04-29 20:41:38 +05:30
Pearl Dsilva 98e2ed3c4f
vmware: Add force parameter to iso attach/detach operations (#4907)
Fixes: #4808, #4941

This PR adds a force flag to the attachIso / detachIso commands, especially for VMware where it is noticed that when trying to either detach an iso or attach an iso when there already exists another present it fails to do the necessary operation as from ACS end we either answer the question returned by Esxi for CDRom disconnect operation as No (for detach operation) or do not answer the question at all (for Attach operation).

Co-authored-by: Pearl Dsilva <pearl.dsilva@shapeblue.com>
2021-04-28 13:46:03 +05:30
Pearl Dsilva d4db1015b8
marvin: fix test_scale_vm for xenserver/Xcp-ng (#4929)
Co-authored-by: Pearl Dsilva <pearl.dsilva@shapeblue.com>
2021-04-27 10:21:48 +05:30
Abhishek Kumar a30d518e8a
vmware: fix stopped VM volume migration (#4758)
* prevent other vm disks getting deleted

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* vmware: fix inter-cluster stopped vm migration

Fixes #4838

For inter-cluster migration without shared storage, VMware needs a host to be specified. Fix is to specify an appropriate host in the target cluster.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix detached volume inter-cluster migration

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* cleanup unused method

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* review changes

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* changes

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* vmware: allow attached volume migration using VmwareStorageMotionStrategy

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* find vm clusterid with multiple ROOT volumes

VM can have multiple ROOT volumes and some can be on zone-wide store therefore iterate over all of them till a cluster ID is found.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix successive storage migration

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix intercluster check

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* refactor vm cluster, host method

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* remove inter-pod check

Added by mistake, VMware won't have pods

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* address review comment

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-04-24 18:55:25 +05:30
davidjumani 40a2ca4e0a
cloudian: Set cloudian.connector.enabled as not dynamic (#4938)
This PR sets cloudian.connector.enabled as not dynamic since cloudian requires the cloudianSsoLogin API which is added only once the MS is restarted
2021-04-21 12:59:54 +05:30
Rohit Yadav 0302750aac
vmware: Add support for VMware 7 (#4300) 2021-04-15 16:10:14 +05:30
Nicolas Vazquez 9cf1e0e869
vmware: Fix VMware OVF properties copy from template (#4738)
* Fix VMware OVF properties copy from template

* Fix vapp marvin test

* Remove unused code

* Fix check for deploy as is details

* Access class fields
2021-04-12 18:04:58 +05:30
Nicolas Vazquez e47dc9c25e
ldap: Fix orphan entry on ldap trust map after account removal (#4899)
Fixes: #4673

Fix orphan entry on ldap trust map after account removal
2021-04-10 13:26:50 +05:30
Abhishek Kumar fdefee75ff
vmware: fix inter-cluster stopped vm and volume migration (#4895)
Fixes #4838

For inter-cluster migration without shared storage, VMware needs a host to be specified. Fix is to specify an appropriate host in the target cluster during a stopped VM migration. Also, find target datastore using the host in the target cluster.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-04-10 13:22:28 +05:30
Rohit Yadav ca8920dd36 Merge remote-tracking branch 'origin/4.14' into 4.15 2021-04-09 13:17:39 +05:30
Abhishek Kumar d8c6e00498
hypervisor: XCP-ng 8.2 support (#4672)
Adds new/missing guest os mappings for XCP-ng/Xenserver 8.1
Copy guest OS mappings from XCP-ng/Xenserver 8.1 for XCP-ng/Xenserver 8.2
Adds Ubuntu 20.04 guest os mapping for XCP-ng/Xenserver 8.2

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-04-09 13:12:06 +05:30
Abhishek Kumar cd60b8d97d
host-allocator: check capacity for suitable hosts (#4884)
Fixes #4517

Adds capacity checks for RandomAllocator (host allocator)

Factors out host cpu capability and capacity check wrt serviceoffering code into CapacityManager.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-04-09 12:35:58 +05:30
Pearl Dsilva cd3851946b
tests: Fix k8s test failures on VMware (#4896)
This PR fixes the k8s test failures noticed on vmware.

Co-authored-by: Pearl Dsilva <pearl.dsilva@shapeblue.com>
Co-authored-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-04-09 12:34:10 +05:30
Nicolas Vazquez 35b20b2367
vmware: Fix worker VM hardware version format (#4851)
This PR fixes a small bug when explicitly setting VM hardware versions lower than version 10.

Vmware expects the hardware version in format: vmx-DD where DD is a two-digit representation of the virtual hardware version. For hardware version lower than 10, CloudStack was not using to digits for the hardware version number, which ended up on an error while creating worker VMs. (vmx-8 for example instead of vmx-08)
2021-04-06 16:28:52 +05:30
slavkap 52c36cadf0
kvm: Fix deploy VM from ISOs with UEFI (#4773)
This PR fixes #4244
deploying of VMs from ISOs and from templates with UEFI boot type
deploying of VMs from ISOs and from templates with UEFI boot type with
volumes in RAW format
2021-04-06 15:00:21 +05:30
Rohit Yadav 6c3f4b43aa Merge remote-tracking branch 'origin/4.14' into 4.15 2021-04-05 14:58:41 +05:30
Abhishek Kumar 6048afb464
xenserver: retrieve correct name-label for presetup store (#4816)
Fixes #4729

As reported in the issue ACP 4.7 used a normal UUID in db for a presetup primary store on Xenserver.
Later the value has been changed to store's path with '/' removed.
Current changes try to retrieve SR's name-lable from store's path if UUID doesn't match path field for a pre-setup store.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-04-05 14:28:27 +05:30
Wei Zhou 09428380f7
kvm: remove unnecessary new String (#4870)
Thanks @rubieHess to point it out.
see #4800 (comment)
2021-04-04 13:08:29 +05:30
Pearl Dsilva 97176690b8
server: Fix issue with volume resize on VMWare (deploy as-is templates) (#4829)
This PR fixes the issue pertaining to volume resize on VMWare for deploy as-is templates. VMware deploy as-is templates are those that are deployed as per the specification in the imported OVF. Hence override root disk size will not be adhered to for such templates. Moreover, when we deploy VMs in stopped state and resize the volume, the root disk doesn't get resized but the volume size is merely updated in the DB.
This PR also includes the following (for deploy as-is templates):
- Disables overriding root disk size during VM deployment on the UI
- Disables selection of compute offerings with root disk size specified, at the time of deployment
- Provided users with the option to deploy VM is stopped state via UI (so as to give an option to users to resize the volumes before starting the VM)

Co-authored-by: Pearl Dsilva <pearl.dsilva@shapeblue.com>
2021-03-29 12:54:47 +05:30
Wei Zhou 952b242722
kvm: Do not set backing file format of DATADISK in vm start/migration (#4800)
* kvm: Do not rebase DATADISK in vm start/migration

* #4800: add comment and use isBlank
2021-03-24 20:22:51 +01:00
Rohit Yadav 97c1b7278f Merge remote-tracking branch 'origin/4.14' into 4.15 2021-03-04 15:02:24 +05:30
Abhishek Kumar f893c5c0e3
cks: fix token TTL, set it to never expire (#4747)
Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
2021-03-04 15:00:41 +05:30