[weizhouapache]

Description

This PR adds support for HmacSHA512 when the API server verifies the signature of signed API requests (apiKey/secretKey authentication). Until now only HmacSHA1 was accepted.

Behaviour change

• ApiServer.verifyRequest() computes the expected signature with HmacSHA512 first, then falls back to HmacSHA1. The request is accepted if either matches.
• New global setting api.legacy.algorithm.supported (Advanced, global scope, dynamic, default true):
  • true: both HmacSHA512 and HmacSHA1 are accepted, so existing clients (CloudMonkey, cloudstack-go, Terraform provider and other third-party tools) keep working unchanged.
  • false: only HmacSHA512 is accepted. Requests signed with HmacSHA1 are rejected.
• The signature computation moved into a helper, getComputedSignature(algorithm, secretKey, unsignedRequest), and the algorithm names are defined in the new com.cloud.utils.security.Algorithms class.
• A failed comparison is logged once per algorithm tried (the sanitised user signature is logged, as before).
• The explicit Security.addProvider(new BouncyCastleProvider()) in ApiServer.init() is removed. The Mac lookups here only use the default JCE providers.

Compatibility

The default (true) keeps full backward compatibility. Operators can set api.legacy.algorithm.supported=false once all their API clients sign with HmacSHA512.

Signing with HmacSHA512 is not applied on the client side by this PR. Client tools have to be updated to sign with it before the legacy algorithm can be disabled.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

How Has This Been Tested?

Test plan (to be run against a management server with this change):

• Request signed with HmacSHA1, api.legacy.algorithm.supported=true (default): accepted
• Request signed with HmacSHA512, api.legacy.algorithm.supported=true: accepted
• Request signed with HmacSHA512, api.legacy.algorithm.supported=false: accepted
• Request signed with HmacSHA1, api.legacy.algorithm.supported=false: rejected (HTTP 401 / "unable to verify user credentials")
• Request with a wrong signature: rejected with either setting
• Changing the setting takes effect without restarting the management server
• Root CA, SSL certificate upload and other BouncyCastle-dependent features still work after removing the provider registration from ApiServer

How did you try to break this feature and the system with this change?

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 3.70%. Comparing base (8b72a16) to head (b48d21f).
⚠️ Report is 142 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (8b72a16) and HEAD (b48d21f). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (8b72a16)	HEAD (b48d21f)
unittests	1	0

Additional details and impacted files

@@              Coverage Diff              @@
##               main   #14457       +/-   ##
=============================================
- Coverage     19.73%    3.70%   -16.03%     
=============================================
  Files          6371      493     -5878     
  Lines        575734    42558   -533176     
  Branches      70470     8063    -62407     
=============================================
- Hits         113594     1578   -112016     
+ Misses       449793    40751   -409042     
+ Partials      12347      229    -12118     

Flag	Coverage Δ
uitests	3.70% <ø> (+0.29%)	⬆️
unittests	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[weizhouapache]

@blueorangutan package

[blueorangutan]

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19679

[weizhouapache]

cloudmonkey suports it now: apache/cloudstack-cloudmonkey#213

[weizhouapache]

@blueorangutan test

[blueorangutan]

@weizhouapache a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests