Mirrors/ProxMenux
1
0
Fork 0
mirror of https://github.com/MacRimi/ProxMenux.git synced 2026-11-02 19:02:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(oci): validate the installation identity before stack backups

Browse Source
This commit is contained in:
Jonatan
2026-10-28 11:43:36 +01:00
parent 05790b494e
commit bf8c495d3b
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
oci/remote/oci_stack_native.py
+2 -2
View File
@@ -410,7 +410,7 @@ class NativeAdapter:
if Path('/etc/pve/lxc/%s.conf' % vmid).exists(): if Path('/etc/pve/lxc/%s.conf' % vmid).exists():
member_tx.stop(vmid) member_tx.stop(vmid)
def backup(self, vmid, identity): def backup(self, vmid, transaction_id):
self.validate(self.plan) self.validate(self.plan)
base = self.work_base() base = self.work_base()
if base != self.journal.parent and not (self.journal.parent / work_backup.MARK).exists(): if base != self.journal.parent and not (self.journal.parent / work_backup.MARK).exists():
@@ -420,7 +420,7 @@ class NativeAdapter:
f"{self.records[self.plan['primary_vmid']]['deployment'].get(work_backup.KEY)}") f"{self.records[self.plan['primary_vmid']]['deployment'].get(work_backup.KEY)}")
directory = base / ('backup-%s' % vmid) directory = base / ('backup-%s' % vmid)
private_directory(directory) private_directory(directory)
config = member_tx.owned(vmid, identity).decode() config = member_tx.owned(vmid, self.records[vmid]['installation_id']).decode()
carried.carry_backup(self.root, vmid, self.records[vmid], config) carried.carry_backup(self.root, vmid, self.records[vmid], config)
archive = member_tx.verified_backup(vmid, directory, 'zstd', archive = member_tx.verified_backup(vmid, directory, 'zstd',
translate('The backup of a member could not be identified')) translate('The backup of a member could not be identified'))
oci/tests/test_stack_backup_carried_metadata.py
+3 -3
View File
@@ -17,7 +17,7 @@ class StackBackupCarriedMetadataTests(unittest.TestCase):
adapter.records={4901:{'vmid':4901,'installation_id':'original','status':'installed'}} adapter.records={4901:{'vmid':4901,'installation_id':'original','status':'installed'}}
return adapter return adapter
def test_restore_metadata_is_verified_before_archive_creation(self): def test_transaction_id_does_not_replace_container_identity_before_archive_creation(self):
with tempfile.TemporaryDirectory() as folder: with tempfile.TemporaryDirectory() as folder:
adapter=self.adapter(folder);events=[] adapter=self.adapter(folder);events=[]
archive=Path(folder)/'archive.tar.zst' archive=Path(folder)/'archive.tar.zst'
@@ -26,7 +26,7 @@ class StackBackupCarriedMetadataTests(unittest.TestCase):
patch.object(native.carried,'carry_backup',side_effect=lambda *args:events.append(('carry',args)),create=True), \ patch.object(native.carried,'carry_backup',side_effect=lambda *args:events.append(('carry',args)),create=True), \
patch.object(native.member_tx,'verified_backup',side_effect=lambda *args:events.append(('backup',args)) or archive), \ patch.object(native.member_tx,'verified_backup',side_effect=lambda *args:events.append(('backup',args)) or archive), \
patch.object(native.member_tx,'filehash',return_value='verified-sha'): patch.object(native.member_tx,'filehash',return_value='verified-sha'):
result=adapter.backup(4901,'original') result=adapter.backup(4901,'different-transaction-id')
owned.assert_called_once_with(4901,'original') owned.assert_called_once_with(4901,'original')
self.assertEqual([event[0] for event in events],['carry','backup']) self.assertEqual([event[0] for event in events],['carry','backup'])
self.assertEqual(events[0][1],(adapter.root,4901,adapter.records[4901],'validated original config')) self.assertEqual(events[0][1],(adapter.root,4901,adapter.records[4901],'validated original config'))
@@ -40,5 +40,5 @@ class StackBackupCarriedMetadataTests(unittest.TestCase):
patch.object(native.carried,'carry_backup',side_effect=ValueError('metadata not verified'),create=True), \ patch.object(native.carried,'carry_backup',side_effect=ValueError('metadata not verified'),create=True), \
patch.object(native.member_tx,'verified_backup') as backup: patch.object(native.member_tx,'verified_backup') as backup:
with self.assertRaisesRegex(ValueError,'metadata not verified'): with self.assertRaisesRegex(ValueError,'metadata not verified'):
adapter.backup(4901,'original') adapter.backup(4901,'different-transaction-id')
backup.assert_not_called() backup.assert_not_called()