Skip to content

Commit

Permalink
EUCA-10971 ELB should validate bucket name when access logs are enabled
Browse files Browse the repository at this point in the history
Summary: S3BucketName field for access logs wasn't validated

Changes:
 - Use ObjectStorageGateway.checkBucketNameVailidity() to ensure a valid name is used.
 - Made ObjectStorageGateway.checkBucketNameVailitidy() public instead of protected.
 - removed bucketName null and length check in AttributesVerifier as checkBucketNameVailidity() does this.

Testing:
 - Tested load balancer attribute modification with 'extended' bucket_naming_restrictions
 - Tested load balancer attribute modification with 'dns-compliant' bucket_naming_restrictions
 - QA concise regression tests
  • Loading branch information
Steven Graham committed Jul 22, 2015
1 parent 2ce4cc1 commit f42b779
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 6 deletions.
1 change: 1 addition & 0 deletions clc/modules/loadbalancing-backend/ivy.xml
Expand Up @@ -6,6 +6,7 @@
<dependency org="com.eucalyptus" name="eucalyptus-compute-common" rev="latest.integration"/>
<dependency org="com.eucalyptus" name="eucalyptus-autoscaling-common" rev="latest.integration"/>
<dependency org="com.eucalyptus" name="eucalyptus-resources-support" rev="latest.integration"/>
<dependency org="com.eucalyptus" name="eucalyptus-object-storage" rev="latest.integration"/>
</dependencies>
</ivy-module>

Expand Up @@ -28,6 +28,8 @@
import com.eucalyptus.entities.TransactionResource;
import com.eucalyptus.loadbalancing.LoadBalancer;
import com.eucalyptus.loadbalancing.common.msgs.AccessLog;
import com.eucalyptus.objectstorage.ObjectStorageGateway;


public class EventHandlerChainModifyAttributes extends EventHandlerChain<ModifyAttributesEvent> {
private static Logger LOG = Logger.getLogger(EventHandlerChainModifyAttributes.class);
Expand Down Expand Up @@ -55,13 +57,15 @@ public void apply(ModifyAttributesEvent evt) throws EventHandlerException {

final boolean accessLogEnabled = accessLog.getEnabled();
if (accessLogEnabled) {
// No verification of accessLog.getS3BucketPrefix() is done
final String bucketName = accessLog.getS3BucketName();
final String bucketPrefix =
com.google.common.base.Objects.firstNonNull(accessLog.getS3BucketPrefix(), "");
final Integer emitInterval =
final Integer emitInterval =
com.google.common.base.Objects.firstNonNull(accessLog.getEmitInterval(), 60);
if (bucketName == null || bucketName.length() <=0)
throw new EventHandlerException("Bucket name must be specified");


if (!ObjectStorageGateway.checkBucketNameValidity(bucketName)) {
throw new EventHandlerException("Invalid bucket name specified");
}
if(emitInterval < 5 || emitInterval > 60) {
throw new EventHandlerException("Access log's emit interval must be between 5 and 60 minutes");
}
Expand Down
Expand Up @@ -361,7 +361,7 @@ public GetObjectStorageConfigurationResponseType getObjectStorageConfiguration(G
* Validity checks based on S3 naming. See http://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html Check that the bucket is a valid
* DNS name (or optionally can look like an IP)
*/
protected static boolean checkBucketNameValidity(String bucketName) {
public static boolean checkBucketNameValidity(String bucketName) {
return BucketNameValidatorRepo.getBucketNameValidator(
ConfigurationCache.getConfiguration(ObjectStorageGlobalConfiguration.class).getBucket_naming_restrictions()).check(bucketName);
}
Expand Down

0 comments on commit f42b779

Please sign in to comment.