vantage6-node 4.15.1__tar.gz → 4.15.2__tar.gz

{vantage6_node-4.15.1 → vantage6_node-4.15.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vantage6_node
-Version: 4.15.1
+Version: 4.15.2
 Summary: vantage6 node
 Home-page: https://github.com/vantage6/vantage6
 Requires-Python: >=3.10
@@ -13,9 +13,9 @@ Requires-Dist: python-socketio==5.15.0
 Requires-Dist: requests==2.33.1
 Requires-Dist: psutil==5.9.0
 Requires-Dist: nvidia-ml-py==12.535.133
-Requires-Dist: vantage6==4.15.1
-Requires-Dist: vantage6-client==4.15.1
-Requires-Dist: vantage6-algorithm-tools==4.15.1
+Requires-Dist: vantage6==4.15.2
+Requires-Dist: vantage6-client==4.15.2
+Requires-Dist: vantage6-algorithm-tools==4.15.2
 Provides-Extra: dev
 Requires-Dist: coverage==6.4.4; extra == "dev"
 Requires-Dist: python-coveralls==2.9.3; extra == "dev"

vantage6_node-4.15.2/tests/docker/test_docker_manager.py

@@ -0,0 +1,140 @@
+import unittest
+from unittest.mock import MagicMock
+
+from vantage6.common.globals import NodePolicy
+
+from vantage6.node.docker.docker_manager import DockerManager
+
+
+class TestIsDockerImageAllowed(unittest.TestCase):
+    """
+    Tests for DockerManager.is_docker_image_allowed().
+
+    DockerManager.__init__ connects to the Docker daemon, so these tests bypass it
+    (via __new__) and set up only the attributes is_docker_image_allowed() actually
+    reads: `_policies` and `client` (`log` is already a class attribute, so it's
+    available for free). This keeps `_is_regex_pattern` (a real staticmethod on the
+    class) working, unlike a fully mocked `self` would.
+    """
+
+    def setUp(self):
+        self.manager = DockerManager.__new__(DockerManager)
+        self.manager.client = MagicMock()
+        self.manager._policies = {}
+
+    @staticmethod
+    def _task_info(store_id: int | None = None) -> dict:
+        task_info = {"init_org": {"id": 1}, "init_user": {"id": 1}}
+        if store_id is not None:
+            task_info["algorithm_store"] = {"id": store_id}
+        return task_info
+
+    def test_allowed_algorithms_exact_match(self):
+        """Baseline regression check for the (unchanged) allowed_algorithms policy."""
+        self.manager._policies = {
+            NodePolicy.ALLOWED_ALGORITHMS: ["some/image:tag"]
+        }
+
+        self.assertTrue(
+            self.manager.is_docker_image_allowed("some/image:tag", self._task_info())
+        )
+        self.assertFalse(
+            self.manager.is_docker_image_allowed(
+                "some/other-image:tag", self._task_info()
+            )
+        )
+
+    def test_allowed_algorithm_stores_verified(self):
+        """
+        The store URL is whitelisted and the store itself confirms the image is a
+        registered, approved algorithm there - the image is allowed.
+        """
+        self.manager._policies = {
+            NodePolicy.ALLOWED_ALGORITHM_STORES: ["https://store.example"]
+        }
+        self.manager.client.algorithm_store.get.return_value = {
+            "url": "https://store.example"
+        }
+        self.manager.client.algorithm_store.get_algorithm.return_value = {
+            "image": "some/image:tag",
+            "digest": "abc123",
+        }
+
+        self.assertTrue(
+            self.manager.is_docker_image_allowed(
+                "some/image:tag", self._task_info(store_id=1)
+            )
+        )
+        self.manager.client.algorithm_store.get_algorithm.assert_called_once_with(
+            "some/image:tag"
+        )
+
+    def test_allowed_algorithm_stores_not_confirmed_by_store(self):
+        """
+        The store URL is whitelisted, but the store does not confirm the image is
+        registered/approved there (e.g. it genuinely isn't, the store hasn't been
+        upgraded to support node requests, or it could not be reached) - the image
+        is denied. This is the fix for GHSA-j43v-wwjr-9grj: previously the store URL
+        match alone was enough.
+        """
+        self.manager._policies = {
+            NodePolicy.ALLOWED_ALGORITHM_STORES: ["https://store.example"]
+        }
+        self.manager.client.algorithm_store.get.return_value = {
+            "url": "https://store.example"
+        }
+        self.manager.client.algorithm_store.get_algorithm.return_value = None
+
+        self.assertFalse(
+            self.manager.is_docker_image_allowed(
+                "some/image:tag", self._task_info(store_id=1)
+            )
+        )
+
+    def test_allowed_algorithm_stores_url_not_whitelisted(self):
+        """
+        The store's URL isn't on the whitelist at all - the image is denied without
+        even asking the store to verify the image (no wasted network call).
+        """
+        self.manager._policies = {
+            NodePolicy.ALLOWED_ALGORITHM_STORES: ["https://trusted.example"]
+        }
+        self.manager.client.algorithm_store.get.return_value = {
+            "url": "https://untrusted.example"
+        }
+
+        self.assertFalse(
+            self.manager.is_docker_image_allowed(
+                "some/image:tag", self._task_info(store_id=1)
+            )
+        )
+        self.manager.client.algorithm_store.get_algorithm.assert_not_called()
+
+    def test_allow_either_whitelist_or_store(self):
+        """
+        Baseline regression check: with allow_either_whitelist_or_store, an image
+        that fails the allowed_algorithms whitelist but is confirmed by the
+        (whitelisted) store is still allowed.
+        """
+        self.manager._policies = {
+            NodePolicy.ALLOWED_ALGORITHMS: ["some/other-image:tag"],
+            NodePolicy.ALLOWED_ALGORITHM_STORES: ["https://store.example"],
+            "allow_either_whitelist_or_store": True,
+        }
+        self.manager.client.algorithm_store.get.return_value = {
+            "url": "https://store.example"
+        }
+        self.manager.client.algorithm_store.get_algorithm.return_value = {
+            "image": "some/image:tag",
+            "digest": "abc123",
+        }
+
+        self.assertTrue(
+            self.manager.is_docker_image_allowed(
+                "some/image:tag", self._task_info(store_id=1)
+            )
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

{vantage6_node-4.15.1 → vantage6_node-4.15.2}/vantage6/node/_version.py

@@ -7,7 +7,7 @@ with open(os.path.join(here, "__build__")) as fp:
     __build__ = json.load(fp)
 
 # Module version
-version_info = (4, 15, 1, "final", __build__, 0)
+version_info = (4, 15, 2, "final", __build__, 0)
 
 # Module version stage suffix map
 _specifier_ = {"alpha": "a", "beta": "b", "candidate": "rc", "final": ""}

{vantage6_node-4.15.1 → vantage6_node-4.15.2}/vantage6/node/docker/docker_manager.py

@@ -7,25 +7,27 @@ for creating docker networks, docker volumes, start containers and retrieve
 results from finished containers.
 """
 
-import os
-from socket import SocketIO
-import time
 import logging
-import docker
+import os
 import re
 import shutil
-
-from typing import NamedTuple
+import time
 from pathlib import Path
+from socket import SocketIO
+from typing import NamedTuple
 
-from vantage6.common import logger_name
-from vantage6.common import get_database_config
+import docker
+from vantage6.algorithm.tools.wrappers import get_column_names
+from vantage6.cli.context.node import NodeContext
+from vantage6.common import get_database_config, logger_name
+from vantage6.common.client.node_client import NodeClient
 from vantage6.common.docker.addons import (
     get_container,
     get_digest,
     get_image_name_wo_tag,
     running_in_docker,
 )
+from vantage6.common.docker.network_manager import NetworkManager
 from vantage6.common.globals import (
     APPNAME,
     BASIC_PROCESSING_IMAGE,
@@ -33,22 +35,18 @@ from vantage6.common.globals import (
     NodePolicy,
 )
 from vantage6.common.task_status import TaskStatus, has_task_failed
-from vantage6.common.docker.network_manager import NetworkManager
-from vantage6.algorithm.tools.wrappers import get_column_names
-from vantage6.cli.context.node import NodeContext
 from vantage6.node.context import DockerNodeContext
 from vantage6.node.docker.docker_base import DockerBaseManager
-from vantage6.node.docker.vpn_manager import VPNManager
-from vantage6.node.docker.task_manager import DockerTaskManager
-from vantage6.node.docker.squid import Squid
-from vantage6.common.client.node_client import NodeClient
 from vantage6.node.docker.exceptions import (
-    UnknownAlgorithmStartFail,
-    PermanentAlgorithmStartFail,
     AlgorithmContainerNotFound,
+    PermanentAlgorithmStartFail,
+    UnknownAlgorithmStartFail,
 )
-from vantage6.node.globals import DEFAULT_REQUIRE_ALGO_IMAGE_PULL
+from vantage6.node.docker.squid import Squid
+from vantage6.node.docker.task_manager import DockerTaskManager
 from vantage6.node.docker.utils import login_to_registries
+from vantage6.node.docker.vpn_manager import VPNManager
+from vantage6.node.globals import DEFAULT_REQUIRE_ALGO_IMAGE_PULL
 
 log = logging.getLogger(logger_name(__name__))
 
@@ -414,7 +412,7 @@ class DockerManager(DockerBaseManager):
         )
         if evaluated_img.startswith(BASIC_PROCESSING_IMAGE):
             if not allow_basics:
-                self.log.warn(
+                self.log.warning(
                     "A task was sent with a basics algorithm that "
                     "this node does not allow to run."
                 )
@@ -515,20 +513,47 @@ class DockerManager(DockerBaseManager):
             except Exception:
                 store_id = None
             if store_id:
-                store = self.client.algorithm_store.get(store_id)
-                store_from_task = store["url"]
+                store_info = self.client.algorithm_store.get(store_id)
+                store_from_task = store_info["url"]
                 # check if the store matches any of the regex cases
                 if isinstance(allowed_stores, str):
                     allowed_stores = [allowed_stores]
-                for store in allowed_stores:
-                    if not self._is_regex_pattern(store):
+                store_url_whitelisted = False
+                for allowed_store in allowed_stores:
+                    if not self._is_regex_pattern(allowed_store):
                         # check if string matches exactly
-                        if store == store_from_task:
-                            store_whitelisted = True
+                        if allowed_store == store_from_task:
+                            store_url_whitelisted = True
                     else:
-                        expr_ = re.compile(store)
+                        expr_ = re.compile(allowed_store)
                         if expr_.match(store_from_task):
-                            store_whitelisted = True
+                            store_url_whitelisted = True
+
+                if store_url_whitelisted:
+                    # The store's URL is whitelisted, but that alone does not prove
+                    # that the evaluated image is actually a registered, approved
+                    # algorithm in that store - the server is the one asserting that
+                    # association, and the server is not fully trusted here.
+                    # Re-verify directly with the store itself instead of trusting
+                    # the server's claim.
+                    # `store_info['url']` is the full base URL the store was
+                    # registered with, including its API path (default `/api`, but
+                    # configurable per store) - nothing needs to be appended here.
+                    self.client.algorithm_store.url = store_info["url"]
+                    self.client.algorithm_store.store_id = store_id
+                    algorithm = self.client.algorithm_store.get_algorithm(evaluated_img)
+                    if algorithm:
+                        store_whitelisted = True
+                    else:
+                        self.log.warning(
+                            "Algorithm store %s did not confirm that image %s is a "
+                            "registered, approved algorithm there. Denying the "
+                            "allowed_algorithm_stores policy for this image. This "
+                            "can also happen if the algorithm store does not yet "
+                            "support node verification requests.",
+                            store_from_task,
+                            evaluated_img,
+                        )
 
         allowed_from_whitelist = not allowed_algorithms or algorithm_whitelisted
         allowed_from_store = not allowed_stores or store_whitelisted
@@ -587,11 +612,11 @@ class DockerManager(DockerBaseManager):
             "}",
             "|",
             "+",
-            "\.",
+            r"\.",
         ]
         # Use common characters used in regular expressions as a proxy
         # for if this string is in fact a regex.
-        return any((c in pattern for c in common_regex_chars))
+        return any(c in pattern for c in common_regex_chars)
 
     def is_running(self, run_id: int) -> bool:
         """
@@ -910,7 +935,7 @@ class DockerManager(DockerBaseManager):
                     )
                 )
             else:
-                self.log.warn(
+                self.log.warning(
                     "Received instruction to kill run_id="
                     f"{container_to_kill['run_id']}, but it was not "
                     "found running on this node."
@@ -940,18 +965,18 @@ class DockerManager(DockerBaseManager):
             killed_runs = self.kill_selected_tasks(org_id=org_id, kill_list=kill_list)
         else:
             # received instruction to kill all tasks on this node
-            self.log.warn(
+            self.log.warning(
                 "Received instruction from server to kill all algorithms "
                 "running on this node. Executing that now..."
             )
             killed_runs = self.cleanup_tasks()
             if len(killed_runs):
-                self.log.warn(
+                self.log.warning(
                     "Killed the following run ids as instructed via socket:"
                     f" {', '.join([str(r.run_id) for r in killed_runs])}"
                 )
             else:
-                self.log.warn("Instructed to kill tasks but none were running")
+                self.log.warning("Instructed to kill tasks but none were running")
         return killed_runs
 
     def get_column_names(self, label: str, type_: str) -> list[str]:

{vantage6_node-4.15.1 → vantage6_node-4.15.2}/vantage6_node.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vantage6_node
-Version: 4.15.1
+Version: 4.15.2
 Summary: vantage6 node
 Home-page: https://github.com/vantage6/vantage6
 Requires-Python: >=3.10
@@ -13,9 +13,9 @@ Requires-Dist: python-socketio==5.15.0
 Requires-Dist: requests==2.33.1
 Requires-Dist: psutil==5.9.0
 Requires-Dist: nvidia-ml-py==12.535.133
-Requires-Dist: vantage6==4.15.1
-Requires-Dist: vantage6-client==4.15.1
-Requires-Dist: vantage6-algorithm-tools==4.15.1
+Requires-Dist: vantage6==4.15.2
+Requires-Dist: vantage6-client==4.15.2
+Requires-Dist: vantage6-algorithm-tools==4.15.2
 Provides-Extra: dev
 Requires-Dist: coverage==6.4.4; extra == "dev"
 Requires-Dist: python-coveralls==2.9.3; extra == "dev"

{vantage6_node-4.15.1 → vantage6_node-4.15.2}/vantage6_node.egg-info/SOURCES.txt

@@ -2,6 +2,7 @@ setup.py
 tests/__init__.py
 tests/test_ssh_tunnel.py
 tests/docker/__init__.py
+tests/docker/test_docker_manager.py
 vantage6/node/__build__
 vantage6/node/__init__.py
 vantage6/node/_version.py

{vantage6_node-4.15.1 → vantage6_node-4.15.2}/vantage6_node.egg-info/requires.txt

@@ -6,9 +6,9 @@ python-socketio==5.15.0
 requests==2.33.1
 psutil==5.9.0
 nvidia-ml-py==12.535.133
-vantage6==4.15.1
-vantage6-client==4.15.1
-vantage6-algorithm-tools==4.15.1
+vantage6==4.15.2
+vantage6-client==4.15.2
+vantage6-algorithm-tools==4.15.2
 
 [dev]
 coverage==6.4.4