novnc: Add source IP check

[ustcweizhou]

Description

This PR adds a global setting "novnc.console.sourceip.check.enabled", it is false by default. If it is true, The source IP to access novnc console must be same as the IP in request to management server for console URL.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Screenshots (if appropriate):

How Has This Been Tested?

Open a vm console,
view page source and get exact URL in ifram
access the URL from other server/ip

Current behavior:
succeeds.

New behavior
if novnc.console.sourceip.check.enabled is "false", succeeds.
if novnc.console.sourceip.check.enabled is "true", fails.

[yadvr]

This looks like a good security fix, can we get this in 4.15 if applicable @weizhouapache ?

[weizhouapache]

This looks like a good security fix, can we get this in 4.15 if applicable @weizhouapache ?

@rhtyd
yeah, if we agree this is a security fix , I will rebase this pr with 4.15.
@DaanHoogland @shwstppr @davidjumani your opinions ?

[shwstppr]

+1 for having it in 4.15

[DaanHoogland]

two bits i'd like to see in separate methods, but code looks good

[DaanHoogland]

+1 for moving to 4.15

[yadvr]

@weizhouapache can you change base branch of the PR and rebase to 4.15?

[weizhouapache]

@weizhouapache can you change base branch of the PR and rebase to 4.15?

@rhtyd done.

[yadvr]

thnx @weizhouapache
@blueorangutan package

[blueorangutan]

@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

[blueorangutan]

Packaging result: ✔centos7 ✔centos8 ✔debian. JID-2855

[yadvr]

@blueorangutan test

[blueorangutan]

@rhtyd a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

[blueorangutan]

Trillian test result (tid-3638)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 36599 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr4736-t3638-kvm-centos7.zip
Intermittent failure detected: /marvin/tests/smoke/test_vm_life_cycle.py
Intermittent failure detected: /marvin/tests/smoke/test_volumes.py
Smoke tests completed. 85 look OK, 1 have error(s)
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_01_migrate_VM_and_root_volume	Error	63.19	test_vm_life_cycle.py
test_02_migrate_VM_with_two_data_disks	Error	48.09	test_vm_life_cycle.py

[GabrielBrascher]

Code LGTM.

[yadvr]

@shwstppr can you do manual novnc check with a built env to see if novnc work (basic checks wrt this PR).

[shwstppr]

@blueorangutan package

[blueorangutan]

@shwstppr a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

[blueorangutan]

Packaging result: ✔centos7 ✔centos8 ✔debian. JID-2867

[blueorangutan]

Trillian test result (tid-3668)
Environment: kvm-ubuntu20 (x2), Advanced Networking with Mgmt server 7
Total time taken: 32286 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr4736-t3668-kvm-ubuntu20.zip
Intermittent failure detected: /marvin/tests/smoke/test_vm_life_cycle.py
Smoke tests completed. 85 look OK, 1 have error(s)
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_02_migrate_VM_with_two_data_disks	Error	48.10	test_vm_life_cycle.py

[davidjumani]

LGTM. Would it be a good idea to inform the user why the connection failed ?