Page History

...

1. Management Server generates a unique pre-shared key (PSK) and shares it with the SSVM agent. 
2. key is saved in encrypted form in the configuration tables as hidden configuration with name upload.secret.key
3. on start of management server, if the key doesnt exist, it generates one using sha1 and stores it in db
4. when the management server sends StartCommand to SSVM agent, it shares this key with it. 
5. SSVM agent stores this key in a file at /etc/cloudstack/agent/ms-psk.
6. New API request "getUploadParams" encoded the usual CloudStack API way using api keys. Request parameters include format, hypervisor, md5 sum etc.
7. Management Server response to (b) returns post url to upload the file, params to send to the url while uploading the file and a SHA1 signature generated using PSK and params json.  
8. User should upload the file over https POST request to the url obtained in (c). The signature and params returned in (c) should be passed as is.
9. The Apache web server on the SSVM matches the url, decrypts and passes on to the SSVM java agent as plain HTTP. The SSVM agent checks the signature against the params using the key PSK and SHA1. Once the params are verified, it writes to the NFS storage to the location encoded in the URL. 
Once the upload completes, the MD5 checksum is compared (if available from step c). 

To increase the number of parallel uploads, multiple SSVMs needs to be created. This will be handled automatically by the management server using the system.vm.auto.reserve.capacity, secstorage.capacity.standby and secstorage.session.max configuration variables.

pre-shared key management

...

1. New API request "getUploadParams" encoded the usual CloudStack API way using api keys. Request parameters include format, hypervisor, md5 sum etc.
2. Management Server response to (b) returns post url to upload the file, params to send to the url while uploading the file and a SHA1 signature generated using PSK and params json.  
3. User should upload the file over https POST request to the url obtained in (c). The signature and params returned in (c) should be passed as is.
4. The Apache web server on the SSVM matches the url, decrypts and passes on to the SSVM java agent as plain HTTP. The SSVM agent checks the signature against the params using the key PSK and SHA1. Once the params are verified, it writes to the NFS storage to the location encoded in the URL. 
5. Once the upload completes, the MD5 checksum is compared (if available from step c). 
   
   

To increase the number of parallel uploads, multiple SSVMs needs to be created. This will be handled automatically by the management server using the system.vm.auto.reserve.capacity, secstorage.capacity.standby and secstorage.session.max configuration variables.

pre-shared key management

This section shall cover when and how the pre-shared key is generated by management server, how is it stored, how is it passed to SSVM

1. key is saved in encrypted form in the configuration tables as hidden configuration with name upload.secret.key
2. on start of management server, if the key doesnt exist, it generates one using sha1 and stores it in db
3. when the management server sends StartCommand to SSVM agent, it shares this key with it. 
4. SSVM agent stores this key in a file at /etc/cloudstack/agent/ms-psk.

API changes

A new API getUploadParams which takes all the params as the registertemplate/uploadvolume except for URL and  which returns all the required params plus a post URL to be used to uploadVolume/registerTemplate

...

Example

management server api: 

request:

http://managementip:8080/client?command=getUploadParams&type=template&response=json&sessionkey=OXgYX%2BINFOOcxQgI2yzEzuA3xCg%3D&name=lxc1&displayText=lxc1&zoneid=-1&format=TAR&isextractable=false&passwordEnabled=false&isdynamicallyscalable=false&osTypeId=1b510c30-3352-11e4-aaca-a5c7f57670d0&hypervisor=LXC&requireshvm=false&_=1410847402478 

response:

{
"postURL":"https://ssvmpublicip/upload/uuid",
payload:{"store":{"com.cloud.agent.api.to.NfsTO":"nfs://10.147.28.7/export/home/rajani/lxc/secondary"}, "hvm":false,"description":"lxc1","maxDownloadSizeInBytes":53687091200,"id":207,"resourceType":"TEMPLATE","installPath":"template/tmpl/2/207", "format":"TAR","accountId":2,"name":"207-2-09c78adc-065f-3dc8-9621-9e7a036d7dc9"},
signature:de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9
}

file upload:

request:

curl -X POST "https://ssvmpublicip/upload/uuid" -F "template=@templatelocation.tar" -F "signature=de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9" -F "payload={'store':{'com.cloud.agent.api.to.NfsTO':'nfs://10.147.28.7/export/home/rajani/lxc/secondary'}, 'hvm':false,'description':'lxc1','maxDownloadSizeInBytes':53687091200,'id':207,'resourceType':'TEMPLATE','installPath':'template/tmpl/2/207', 'format':'TAR','accountId':2,'name':'207-2-09c78adc-065f-3dc8-9621-9e7a036d7dc9'}" -v 

response:

200 OK

DB Changes

...