xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-09-05 20:47:55 +00:00
Code Issues Releases Wiki Activity

fix(xcatd): refuse the ^ file operator on an unauthenticated request

Browse Source 
xcatd expands the request noderange before it authorizes the caller: once to
count the nodes, and once in validate() to match the policy rules. The ^
operator makes xcatd open a caller-named file at that point. A client can
connect without a certificate, because the listener does not require one, and
such a client has no peername.

Expand these two pre-authorization noderanges with nofile when the caller has
no peername (checked with defined, so the identity "0" still counts as
authenticated). If validate() finds a rejected ^file atom on such a request,
deny it. An authenticated caller expands ^file as before.
This commit is contained in:
Vinícius Ferrão
2026-08-18 14:12:12 -03:00
parent 61b5b19a6e
commit b62c52b597
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xCAT-server/lib/perl/xCAT/xcatd.pm
+4 -1
View File
@@ -98,7 +98,10 @@ sub validate {
my %req_noderange_info;
if (defined $request->{noderange}->[0]) {
my @tmpn = xCAT::NodeRange::noderange($request->{noderange}->[0]);
my @tmpn = xCAT::NodeRange::noderange($request->{noderange}->[0], 1, 1, (defined($peername) ? () : (nofile => 1)));
if (!defined($peername) && xCAT::NodeRange::file_operator_rejected()) {
return 0;
}
$req_noderange_info{leftnodenum} = @tmpn;
if($req_noderange_info{leftnodenum}){
$req_noderange_info{leftnodes} = \@tmpn;
xCAT-server/sbin/xcatd
+1 -1
View File
@@ -2843,7 +2843,7 @@ sub service_connection {
}
if (exists($req->{noderange}) && defined($req->{noderange}->[0])) {
my @nnodes = xCAT::NodeRange::noderange($req->{noderange}->[0]);
my @nnodes = xCAT::NodeRange::noderange($req->{noderange}->[0], 1, 1, (defined($peername) ? () : (nofile => 1)));
$numofnodes = (scalar(@nnodes));
}