From 1a9d7770ae882ee45839fb4e727b7b9a74299b96 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?P=C3=A1draig=20Brady?= Date: Fri, 27 Sep 2013 04:07:14 +0100 Subject: [PATCH] ensure we don't boot oversized images Since we can't generally shrink incoming images, add extra checks to ensure oversized images are not allowed through. All cases when populating the libvirt image cache are now handled, including the initial download from glance, where we avoid converting to raw, as that could generate non sparse images much larger than the downloaded image. * nova/virt/libvirt/utils.py (fetch_image): Allow passing through of the max_size parameter. * nova/virt/images.py (fetch_to_raw): Accept the max_size parameter, and use it to discard images with larger (virtual) sizes. * nova/virt/libvirt/imagebackend.py (verify_base_size): A new refactored function to identify and raise exception to oversized images. (Raw.create_image): Pass the max_size to the fetch function. Also enforce virtual image size checking for already fetched images, as this class (despite the name) can be handling qcow files. (Qcow2.create_image): Pass the max_size to the fetch function, or verify the virtual size for the instance as done previously. (Lvm.create_image): Pass the max_size to the fetch function. Also check the size before transferring to the volume to improve efficiency by not even attempting the transfer of oversized images. (Rbd.create_image): Likewise. * nova/tests/fake_libvirt_utils.py: Support max_size arg. * nova/tests/test_libvirt.py (test_fetch_raw_image): Add a case to check oversized images are discarded. * nova/virt/libvirt/imagebackend.py (test_create_image_too_small): Adjust to avoid the fetch size check. Fixes bug: 1177830 Fixes bug: 1206081 Change-Id: I3d47adaa2ad07434853f447feb27d7aae0e2e717 Conflicts: nova/tests/test_imagebackend.py nova/virt/images.py nova/virt/libvirt/imagebackend.py nova/virt/libvirt/utils.py --- nova/tests/fake_libvirt_utils.py | 2 +- nova/tests/test_imagebackend.py | 27 ++++++++++++--------- nova/tests/test_libvirt.py | 24 +++++++++++++++++-- nova/virt/images.py | 24 +++++++++++++++++-- nova/virt/libvirt/imagebackend.py | 46 +++++++++++++++++++++++++++++-------- nova/virt/libvirt/utils.py | 7 +++-- 6 files changed, 98 insertions(+), 32 deletions(-) diff --git a/nova/tests/fake_libvirt_utils.py b/nova/tests/fake_libvirt_utils.py index 353b6ef..996a3d0 100644 --- a/nova/tests/fake_libvirt_utils.py +++ b/nova/tests/fake_libvirt_utils.py @@ -119,5 +119,5 @@ def get_fs_info(path): 'free': 84 * (1024 ** 3)} -def fetch_image(context, target, image_id, user_id, project_id): +def fetch_image(context, target, image_id, user_id, project_id, max_size=0): pass diff --git a/nova/tests/test_imagebackend.py b/nova/tests/test_imagebackend.py index 8e3734f..d8556c9 100644 --- a/nova/tests/test_imagebackend.py +++ b/nova/tests/test_imagebackend.py @@ -125,7 +125,7 @@ class RawTestCase(_ImageTestCase): def test_create_image(self): fn = self.prepare_mocks() - fn(target=self.TEMPLATE_PATH, image_id=None) + fn(target=self.TEMPLATE_PATH, max_size=None, image_id=None) imagebackend.libvirt_utils.copy_image(self.TEMPLATE_PATH, self.PATH) self.mox.ReplayAll() @@ -146,7 +146,10 @@ class RawTestCase(_ImageTestCase): def test_create_image_extend(self): fn = self.prepare_mocks() - fn(target=self.TEMPLATE_PATH, image_id=None) + self.mox.StubOutWithMock(imagebackend.disk, 'get_disk_size') + fn(max_size=self.SIZE, target=self.TEMPLATE_PATH, image_id=None) + imagebackend.disk.get_disk_size(self.TEMPLATE_PATH + ).AndReturn(self.SIZE) imagebackend.libvirt_utils.copy_image(self.TEMPLATE_PATH, self.PATH) imagebackend.disk.extend(self.PATH, self.SIZE) self.mox.ReplayAll() @@ -177,7 +180,7 @@ class Qcow2TestCase(_ImageTestCase): def test_create_image(self): fn = self.prepare_mocks() - fn(target=self.TEMPLATE_PATH) + fn(max_size=None, target=self.TEMPLATE_PATH) imagebackend.libvirt_utils.create_cow_image(self.TEMPLATE_PATH, self.PATH) self.mox.ReplayAll() @@ -189,7 +192,7 @@ class Qcow2TestCase(_ImageTestCase): def test_create_image_with_size(self): fn = self.prepare_mocks() - fn(target=self.TEMPLATE_PATH) + fn(max_size=self.SIZE, target=self.TEMPLATE_PATH) self.mox.StubOutWithMock(os.path, 'exists') self.mox.StubOutWithMock(imagebackend.disk, 'get_disk_size') os.path.exists(self.QCOW2_BASE).AndReturn(False) @@ -208,21 +211,21 @@ class Qcow2TestCase(_ImageTestCase): self.mox.VerifyAll() def test_create_image_too_small(self): + fn = self.prepare_mocks() + fn(max_size=1, target=self.TEMPLATE_PATH) self.mox.StubOutWithMock(imagebackend.disk, 'get_disk_size') imagebackend.disk.get_disk_size(self.TEMPLATE_PATH ).AndReturn(self.SIZE) - fn = self.mox.CreateMockAnything() - fn(target=self.TEMPLATE_PATH) self.mox.ReplayAll() image = self.image_class(self.INSTANCE, self.NAME) - self.assertRaises(exception.ImageTooLarge, image.create_image, fn, - self.TEMPLATE_PATH, 1) + self.assertRaises(exception.InstanceTypeDiskTooSmall, + image.create_image, fn, self.TEMPLATE_PATH, 1) self.mox.VerifyAll() def test_create_image_with_size_template_exists(self): fn = self.prepare_mocks() - fn(target=self.TEMPLATE_PATH) + fn(max_size=self.SIZE, target=self.TEMPLATE_PATH) self.mox.StubOutWithMock(os.path, 'exists') self.mox.StubOutWithMock(imagebackend.disk, 'get_disk_size') os.path.exists(self.QCOW2_BASE).AndReturn(True) @@ -264,7 +267,7 @@ class LvmTestCase(_ImageTestCase): def _create_image(self, sparse): fn = self.prepare_mocks() - fn(target=self.TEMPLATE_PATH) + fn(max_size=None, target=self.TEMPLATE_PATH) self.libvirt_utils.create_lvm_image(self.VG, self.LV, self.TEMPLATE_SIZE, @@ -296,7 +299,7 @@ class LvmTestCase(_ImageTestCase): def _create_image_resize(self, sparse): fn = self.prepare_mocks() - fn(target=self.TEMPLATE_PATH) + fn(max_size=self.SIZE, target=self.TEMPLATE_PATH) self.libvirt_utils.create_lvm_image(self.VG, self.LV, self.SIZE, sparse=sparse) self.disk.get_disk_size(self.TEMPLATE_PATH @@ -335,7 +338,7 @@ class LvmTestCase(_ImageTestCase): def test_create_image_negative(self): fn = self.prepare_mocks() - fn(target=self.TEMPLATE_PATH) + fn(max_size=self.SIZE, target=self.TEMPLATE_PATH) self.libvirt_utils.create_lvm_image(self.VG, self.LV, self.SIZE, diff --git a/nova/tests/test_libvirt.py b/nova/tests/test_libvirt.py index e956eb0..1a915f9 100644 --- a/nova/tests/test_libvirt.py +++ b/nova/tests/test_libvirt.py @@ -3809,7 +3809,8 @@ disk size: 4.4M''', '')) image_id = '4' user_id = 'fake' project_id = 'fake' - images.fetch_to_raw(context, image_id, target, user_id, project_id) + images.fetch_to_raw(context, image_id, target, user_id, project_id, + max_size=0) self.mox.ReplayAll() libvirt_utils.fetch_image(context, target, image_id, @@ -3841,20 +3842,27 @@ disk size: 4.4M''', '')) file_format = path.split('.')[-2] elif file_format == 'converted': file_format = 'raw' + if 'backing' in path: backing_file = 'backing' else: backing_file = None + if 'big' in path: + virtual_size = 2 + else: + virtual_size = 1 + FakeImgInfo.file_format = file_format FakeImgInfo.backing_file = backing_file + FakeImgInfo.virtual_size = virtual_size return FakeImgInfo() self.stubs.Set(utils, 'execute', fake_execute) self.stubs.Set(os, 'rename', fake_rename) self.stubs.Set(os, 'unlink', fake_unlink) - self.stubs.Set(images, 'fetch', lambda *_: None) + self.stubs.Set(images, 'fetch', lambda *_, **__: None) self.stubs.Set(images, 'qemu_img_info', fake_qemu_img_info) self.stubs.Set(utils, 'delete_if_exists', fake_rm_on_errror) @@ -3869,7 +3877,8 @@ disk size: 4.4M''', '')) 't.qcow2.part', 't.qcow2.converted'), ('rm', 't.qcow2.part'), ('mv', 't.qcow2.converted', 't.qcow2')] - images.fetch_to_raw(context, image_id, target, user_id, project_id) + images.fetch_to_raw(context, image_id, target, user_id, project_id, + max_size=1) self.assertEqual(self.executes, expected_commands) target = 't.raw' @@ -3886,6 +3895,15 @@ disk size: 4.4M''', '')) context, image_id, target, user_id, project_id) self.assertEqual(self.executes, expected_commands) + target = 'big.qcow2' + self.executes = [] + expected_commands = [('rm', '-f', 'big.qcow2.part')] + self.assertRaises(exception.InstanceTypeDiskTooSmall, + images.fetch_to_raw, + context, image_id, target, user_id, project_id, + max_size=1) + self.assertEqual(self.executes, expected_commands) + del self.executes def test_get_disk_backing_file(self): diff --git a/nova/virt/images.py b/nova/virt/images.py index 6cf8e6b..5aeb989 100644 --- a/nova/virt/images.py +++ b/nova/virt/images.py @@ -70,7 +70,7 @@ def qemu_img_info(path): return data -def fetch(context, image_href, path, _user_id, _project_id): +def fetch(context, image_href, path, _user_id, _project_id, max_size=0): # TODO(vish): Improve context handling and add owner and auth data # when it is added to glance. Right now there is no # auth checking in glance, so we assume that access was @@ -82,9 +82,10 @@ def fetch(context, image_href, path, _user_id, _project_id): image_service.download(context, image_id, image_file) -def fetch_to_raw(context, image_href, path, user_id, project_id): +def fetch_to_raw(context, image_href, path, user_id, project_id, max_size=0): path_tmp = "%s.part" % path - fetch(context, image_href, path_tmp, user_id, project_id) + fetch(context, image_href, path_tmp, user_id, project_id, + max_size=max_size) with utils.remove_path_on_error(path_tmp): data = qemu_img_info(path_tmp) @@ -100,6 +101,23 @@ def fetch_to_raw(context, image_href, path, user_id, project_id): raise exception.ImageUnacceptable(image_id=image_href, reason=_("fmt=%(fmt)s backed by: %(backing_file)s") % locals()) + # We can't generally shrink incoming images, so disallow + # images > size of the flavor we're booting. Checking here avoids + # an immediate DoS where we convert large qcow images to raw + # (which may compress well but not be sparse). + # TODO(p-draigbrady): loop through all flavor sizes, so that + # we might continue here and not discard the download. + # If we did that we'd have to do the higher level size checks + # irrespective of whether the base image was prepared or not. + disk_size = data.virtual_size + if max_size and max_size < disk_size: + msg = _('%(base)s virtual size %(disk_size)s ' + 'larger than flavor root disk size %(size)s') + LOG.error(msg % {'base': path, + 'disk_size': disk_size, + 'size': max_size}) + raise exception.InstanceTypeDiskTooSmall() + if fmt != "raw" and FLAGS.force_raw_images: staged = "%s.converted" % path LOG.debug("%s was %s, converting to raw" % (image_href, fmt)) diff --git a/nova/virt/libvirt/imagebackend.py b/nova/virt/libvirt/imagebackend.py index 5f65124..2df5e6d 100644 --- a/nova/virt/libvirt/imagebackend.py +++ b/nova/virt/libvirt/imagebackend.py @@ -130,6 +130,36 @@ class Image(object): self.create_image(call_if_not_exists, base, size, *args, **kwargs) + @staticmethod + def verify_base_size(base, size, base_size=0): + """Check that the base image is not larger than size. + Since images can't be generally shrunk, enforce this + constraint taking account of virtual image size. + """ + + # Note(pbrady): The size and min_disk parameters of a glance + # image are checked against the instance size before the image + # is even downloaded from glance, but currently min_disk is + # adjustable and doesn't currently account for virtual disk size, + # so we need this extra check here. + # NOTE(cfb): Having a flavor that sets the root size to 0 and having + # nova effectively ignore that size and use the size of the + # image is considered a feature at this time, not a bug. + + if size is None: + return + + if size and not base_size: + base_size = disk.get_disk_size(base) + + if size < base_size: + msg = _('%(base)s virtual size %(base_size)s ' + 'larger than flavor root disk size %(size)s') + LOG.error(msg % {'base': base, + 'base_size': base_size, + 'size': size}) + raise exception.InstanceTypeDiskTooSmall() + class Raw(Image): def __init__(self, instance, name): @@ -150,7 +180,8 @@ class Raw(Image): #Generating image in place prepare_template(target=self.path, *args, **kwargs) else: - prepare_template(target=base, *args, **kwargs) + prepare_template(target=base, max_size=size, *args, **kwargs) + self.verify_base_size(base, size) with utils.remove_path_on_error(self.path): copy_raw_image(base, self.path, size) @@ -175,14 +206,8 @@ class Qcow2(Image): disk.extend(qcow2_base, size) libvirt_utils.create_cow_image(qcow2_base, target) - prepare_template(target=base, *args, **kwargs) - # NOTE(cfb): Having a flavor that sets the root size to 0 and having - # nova effectively ignore that size and use the size of the - # image is considered a feature at this time, not a bug. - if size and size < disk.get_disk_size(base): - LOG.error('%s virtual size larger than flavor root disk size %s' % - (base, size)) - raise exception.ImageTooLarge() + prepare_template(target=base, max_size=size, *args, **kwargs) + self.verify_base_size(base, size) with utils.remove_path_on_error(self.path): copy_qcow2_image(base, self.path, size) @@ -209,6 +234,7 @@ class Lvm(Image): @utils.synchronized(base, external=True, lock_path=self.lock_path) def create_lvm_image(base, size): base_size = disk.get_disk_size(base) + self.verify_base_size(base, size, base_size=base_size) resize = size > base_size size = size if resize else base_size libvirt_utils.create_lvm_image(self.vg, self.lv, @@ -227,7 +253,7 @@ class Lvm(Image): with self.remove_volume_on_error(self.path): prepare_template(target=self.path, *args, **kwargs) else: - prepare_template(target=base, *args, **kwargs) + prepare_template(target=base, max_size=size, *args, **kwargs) with self.remove_volume_on_error(self.path): create_lvm_image(base, size) diff --git a/nova/virt/libvirt/utils.py b/nova/virt/libvirt/utils.py index 82dc956..6a25b3b 100644 --- a/nova/virt/libvirt/utils.py +++ b/nova/virt/libvirt/utils.py @@ -435,9 +435,10 @@ def get_fs_info(path): 'used': used} -def fetch_image(context, target, image_id, user_id, project_id): - """Grab image""" - images.fetch_to_raw(context, image_id, target, user_id, project_id) +def fetch_image(context, target, image_id, user_id, project_id, max_size=0): + """Grab image.""" + images.fetch_to_raw(context, image_id, target, user_id, project_id, + max_size=max_size) def get_info_filename(base_path): -- 1.7.7.6