CVE-2020-10755

@@ -144,9 +144,10 @@ class ScaleIODriver(driver.VolumeDriver):
         2.0.1: Added support for SIO 1.3x in addition to 2.0.x
         2.0.2: Added consistency group support to generic volume groups
         2.0.3: Added cache for storage pool and protection domains info
+        2.0.3.1: Fix for Bug #1823200. See OSSN-0086 for details.
     """
 
-    VERSION = "2.0.3"
+    VERSION = "2.0.3.1"
     # ThirdPartySystems wiki
     CI_WIKI_NAME = "EMC_ScaleIO_CI"
 
@@ -220,8 +221,7 @@ def __init__(self, *args, **kwargs):
             'serverIP': self.server_ip,
             'serverPort': self.server_port,
             'serverUsername': self.server_username,
-            'serverPassword': self.server_password,
-            'serverToken': self.server_token,
+            'config_group': self.configuration.config_group,
             'iopsLimit': None,
             'bandwidthLimit': None,
         }

@@ -273,6 +273,33 @@ parameters as follows:
    san_password = SIO_PASSWD
    san_thin_provision = false
 
+Connector configuration
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Before using attach/detach volume operations VxFlex OS connector must be
+properly configured. On each node where VxFlex OS SDC is installed do the
+following:
+
+#. Create ``/opt/emc/scaleio/openstack/connector.conf`` if it does not
+   exist.
+
+   .. code-block:: console
+
+     $ mkdir -p /opt/emc/scaleio/openstack
+     $ touch /opt/emc/scaleio/openstack/connector.conf
+
+#. For each VxFlex OS section in the ``cinder.conf`` create the same section in
+   the ``/opt/emc/scaleio/openstack/connector.conf`` and populate it with
+   passwords. Example:
+
+   .. code-block:: ini
+
+      [vxflexos]
+      san_password = SIO_PASSWD
+
+      [vxflexos-new]
+      san_password = SIO2_PASSWD
+
 Configuration options
 ~~~~~~~~~~~~~~~~~~~~~
 

@@ -15,6 +15,8 @@
 import json
 import os
 import requests
+import six
+from six.moves import configparser
 from six.moves import urllib
 
 from oslo_concurrency import lockutils
@@ -29,6 +31,7 @@
 
 LOG = logging.getLogger(__name__)
 DEVICE_SCAN_ATTEMPTS_DEFAULT = 3
+CONNECTOR_CONF_PATH = '/opt/emc/scaleio/openstack/connector.conf'
 synchronized = lockutils.synchronized_with_prefix('os-brick-')
 
 
@@ -39,6 +42,7 @@ class ScaleIOConnector(base.BaseLinuxConnector):
     VOLUME_NOT_MAPPED_ERROR = 84
     VOLUME_ALREADY_MAPPED_ERROR = 81
     GET_GUID_CMD = ['/opt/emc/scaleio/sdc/bin/drv_cfg', '--query_guid']
+    GET_PASSWORD_CMD = ['cat', CONNECTOR_CONF_PATH]
 
     def __init__(self, root_helper, driver=None,
                  device_scan_attempts=initiator.DEVICE_SCAN_ATTEMPTS_DEFAULT,
@@ -221,6 +225,32 @@ def _get_volume_id(self):
                  {'volume_id': volume_id})
         return volume_id
 
+    def _get_connector_password(self, config_group):
+        LOG.info("Get ScaleIO connector password from configuration file")
+
+        if not os.path.isfile(CONNECTOR_CONF_PATH):
+            msg = ("ScaleIO connector configuration file "
+                   "is not found in path %s." % CONNECTOR_CONF_PATH)
+            raise exception.BrickException(message=msg)
+
+        try:
+            (out, err) = self._execute(*self.GET_PASSWORD_CMD,
+                                       run_as_root=True,
+                                       root_helper=self._root_helper)
+            conf = configparser.ConfigParser()
+            conf.readfp(six.StringIO(out))
+            return conf[config_group]["san_password"]
+        except putils.ProcessExecutionError as e:
+            msg = _("Error reading ScaleIO connector "
+                    "configuration file: %s") % e.stderr
+            LOG.error(msg)
+            raise exception.BrickException(message=msg)
+        except Exception as e:
+            msg = _("Error getting ScaleIO connector password from "
+                    "configuration file: %s") % e
+            LOG.error(msg)
+            raise exception.BrickException(message=msg)
+
     def _check_response(self, response, request, is_get_request=True,
                         params=None):
         if response.status_code == 401 or response.status_code == 403:
@@ -269,8 +299,9 @@ def get_config(self, connection_properties):
         self.server_ip = connection_properties['serverIP']
         self.server_port = connection_properties['serverPort']
         self.server_username = connection_properties['serverUsername']
-        self.server_password = connection_properties['serverPassword']
-        self.server_token = connection_properties['serverToken']
+        self.server_password = self._get_connector_password(
+            connection_properties['config_group'],
+        )
         self.iops_limit = connection_properties['iopsLimit']
         self.bandwidth_limit = connection_properties['bandwidthLimit']
         device_info = {'type': 'block',

@@ -47,8 +47,7 @@ def setUp(self):
             'scaleIO_volume_id': self.vol['provider_id'],
             'serverPort': 443,
             'serverUsername': 'test',
-            'serverPassword': 'fake',
-            'serverToken': 'fake_token',
+            'config_group': 'test',
             'iopsLimit': None,
             'bandwidthLimit': None
         }
@@ -84,6 +83,10 @@ def setUp(self):
         self.mock_object(os, 'listdir',
                          return_value=["emc-vol-{}".format(self.vol['id'])])
 
+        self.get_password_mock = self.mock_object(scaleio.ScaleIOConnector,
+                                                  '_get_connector_password',
+                                                  return_value='fake_password')
+
         # The actual ScaleIO connector
         self.connector = scaleio.ScaleIOConnector(
             'sudo', execute=self.fake_execute)
@@ -170,6 +173,7 @@ def test_get_connector_properties(self):
     def test_connect_volume(self):
         """Successful connect to volume"""
         self.connector.connect_volume(self.fake_connection_properties)
+        self.get_password_mock.assert_called_once()
 
     def test_connect_with_bandwidth_limit(self):
         """Successful connect to volume with bandwidth limit"""