Bug 1503038 - No validation on disks' ids when taking a snapshot
Summary: No validation on disks' ids when taking a snapshot
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: ovirt-engine
Classification: oVirt
Component: BLL.Storage
Version: 4.2.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ovirt-4.2.2
: ---
Assignee: shani
QA Contact: Kevin Alon Goldblatt
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-17 09:06 UTC by shani
Modified: 2018-04-05 09:39 UTC (History)
7 users (show)

Fixed In Version: ovirt-engine-4.2.2.4
Doc Type: Bug Fix
Doc Text:
Cause: When previewing or restoring a snapshot using the REST API, there was some missing validation regarding the disk parameters: - No checking for the disk's existence on DB - No validation for disk ids' uniqueness among the passing parameters. Consequence: - In case of a not exists disk, is has been silently ignored. - In case of a duplicated disk, there's an NPE Fix: - As a part of the fix, I had to revert some older patches which used a Set<Guid> back to a Lisk<DiskImage>, and to add a new DB query which trying to retrieve the diskImages with the ids specified by the user(or shows a 404 error if such doesn't exist) as part of patch 88355. - Also, there's a new validation of the disk ids' uniqueness, so no disk id will be supplied more than once as patched on 88646. Result: - In case of not exists disk: a 404 error - In case of duplicated ids: an appropriate error message. In both cases - operation should be stopped.
Clone Of:
Environment:
Last Closed: 2018-04-05 09:39:31 UTC
oVirt Team: Storage
Embargoed:
rule-engine: ovirt-4.2+
rule-engine: exception+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
oVirt gerrit 82295 0 master ABANDONED core: Validate snapshot's disks ids 2017-10-19 08:21:04 UTC
oVirt gerrit 88355 0 master MERGED core: Back to List<DiskImage> on snapshot preview & restore 2018-03-12 04:05:12 UTC
oVirt gerrit 88646 0 master MERGED core: Validate disks on snapshot's preview and restore 2018-03-12 04:05:16 UTC
oVirt gerrit 88783 0 ovirt-engine-4.2 MERGED core: Back to List<DiskImage> on snapshot preview & restore 2018-03-13 09:40:52 UTC
oVirt gerrit 88789 0 ovirt-engine-4.2 MERGED core: Validate disks on snapshot's preview and restore 2018-03-13 09:40:57 UTC

Description shani 2017-10-17 09:06:33 UTC
Description of problem:
When taking a snapshot using the REST API, there's no validation for the disk's id(s) supplied by the user.
Therefore, in case of supplying disks' ids which are not part of the snapshot, they are silently been ignored instead of raising an error.

Version-Release number of selected component (if applicable):
Reproduced for 4.2 version, although according to the code, was probably present before that.

How reproducible:
100%

Steps to Reproduce:
1. Take a snapshot for a VM with a disk.
2. Using the REST API, run the following:

Method:
-------
POST

URL:
----
https://xxxx.xxxx.xxxx.xxxx.com/ovirt-engine/api/vms/<VM_ID>/snapshots/<SNAPSHOT_ID>/restore

Body:
-----
<action>
	<disks>
		<disk id = "<SOME_NEW_GUID>"></disk>
	</disks>
</action>

Actual results:
The disks are silently been ignored.

Expected results:
Error: The following disks IDs are not part of the snapshot.

Additional info:
-

Comment 1 Allon Mureinik 2017-10-18 15:51:56 UTC
The proposed solution is based on a refactoring proposed in patch https://gerrit.ovirt.org/#/c/82017/.

While this refactoring looks like a step in the right direction, it's in the very least incomplete, and will result in lost functionality (full details in gerrit). Properly refactoring the command/API will require quite a bit of effort, and considering the fact that this issue has been present since the partial snapshot feature [1] was introduced in 3.4, and was never reported from the field, I'm pushing it out to 4.3.

[1] https://www.ovirt.org/develop/release-management/features/storage/single-disk-snapshot/

Comment 2 shani 2018-03-12 09:17:23 UTC
In addition to the original scenario of the problem, another missing validation is for supplying duplicated disk ids:

When the user supplies the same disk image more than once, the following error message appears on the engine log:
(Checked on ovirt-engine-4.2-7684911dad)

2018-03-12 10:45:21,102+02 ERROR [org.ovirt.engine.core.bll.snapshots.RestoreFromSnapshotCommand] (default task-38) [38c09a80-e7ee-481d-ba5e-167b32910362] Command 'org.ovirt.engine.core.bll.snapshots.RestoreFromSnapshotCommand' failed: Duplicate key org.ovirt.engine.core.common.businessentities.storage.DiskImage@c63003ec
2018-03-12 10:45:21,102+02 ERROR [org.ovirt.engine.core.bll.snapshots.RestoreFromSnapshotCommand] (default task-38) [38c09a80-e7ee-481d-ba5e-167b32910362] Exception: java.lang.IllegalStateException: Duplicate key org.ovirt.engine.core.common.businessentities.storage.DiskImage@c63003ec

Therefore, although this bug is targeted for 4.3.0, backporting patch  http://gerrit.ovirt.org/88646 is needed.

Comment 3 Allon Mureinik 2018-03-12 12:51:21 UTC
(In reply to shani from comment #2)
> Therefore, although this bug is targeted for 4.3.0, backporting patch 
> http://gerrit.ovirt.org/88646 is needed.
Let's split the difference, and just retarget it to 4.2.z.

Comment 4 Allon Mureinik 2018-03-13 13:19:20 UTC
Shani, can you add some text explaining what was added here?

Comment 5 shani 2018-03-13 13:51:59 UTC
As a part of disks' validation, while trying to preview/restore a snapshot, I had to revert some older patches which used a Set<Guid> back to a Lisk<DiskImage>.

The added validation uses a new DB query which trying to retrieve the diskImage with the disk id and image_id specified by the user on REST API (or a 404 error if such doesn't exist) as part of patch 88355.

Also, there's a new validation of the disk ids' uniqueness, so no disk id will be supplied more than once as patched on 88646.

To make it easier to validate, the diskImage field on DiskImageValidator was changed from an iterable to a collection.

Comment 6 Kevin Alon Goldblatt 2018-04-02 12:08:24 UTC
Verified with the following code:
----------------------------------------
ovirt-engine-4.2.2.6-0.1.el7.noarch
vdsm-4.20.23-1.el7ev.x86_64



Verified with the following scenario:
-------------------------------------------
Url
https://storage-ge-10.scl.lab.tlv.redhat.com/ovirt-engine/api/vms/9f00362d-3712-44e5-b846-7e6298690ad7/snapshots/967d52c6-0aab-4947-8550-e586e541dfe2/restore

Method
POST

Body
<action>
	<disks>
		<disk id = "a2487ec9-53db-42d6-b112-687dd8ddd846">
                </disk>
	</disks>
</action>

Response
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<fault>
    <detail>Entity not found: GetDiskImageByDiskAndImageIds: disk id=a2487ec9-53db-42d6-b112-687dd8ddd846, image_id=00000000-0000-0000-0000-000000000000</detail>
    <reason>Operation Failed</reason>
</fault>


Moving to VERIFIED

Comment 7 Sandro Bonazzola 2018-04-05 09:39:31 UTC
This bugzilla is included in oVirt 4.2.2 release, published on March 28th 2018.

Since the problem described in this bug report should be
resolved in oVirt 4.2.2 release, it has been closed with a resolution of CURRENT RELEASE.

If the solution does not work for you, please open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.