From 334dc485f9776ccaf9b50b8ded6a4d386ed4288b Mon Sep 17 00:00:00 2001 From: Rene Moser Date: Thu, 6 Aug 2026 13:40:06 +0200 Subject: [PATCH 1/2] CertService: Fix account requirement by using caller account fallback --- .../network/ssl/CertServiceImpl.java | 19 ++++++------- .../network/ssl/CertServiceTest.java | 27 +++++++++++++++++++ 2 files changed, 37 insertions(+), 9 deletions(-) diff --git a/server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java b/server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java index d101ab989caa..90f2b994a30f 100644 --- a/server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java +++ b/server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java @@ -199,16 +199,12 @@ public List listSslCerts(final ListSslCertsCmd listSslCertCmd) final Account caller = ctx.getCallingAccount(); final Long certId = listSslCertCmd.getCertId(); - final Long accountId = listSslCertCmd.getAccountId(); + final Long accountId = listSslCertCmd.getAccountId() != null ? listSslCertCmd.getAccountId() : caller.getAccountId(); final Long lbRuleId = listSslCertCmd.getLbId(); final Long projectId = listSslCertCmd.getProjectId(); final List certResponseList = new ArrayList(); - if (certId == null && accountId == null && lbRuleId == null && projectId == null) { - throw new InvalidParameterValueException("Invalid parameters either certificate ID or Account ID or Loadbalancer ID or Project ID required"); - } - List certLbMap = null; SslCertVO certVO = null; @@ -241,7 +237,7 @@ public List listSslCerts(final ListSslCertsCmd listSslCertCmd) lbCertMapRule = _lbCertDao.findByLbRuleId(lbRuleId); if (lbCertMapRule == null) { - logger.debug("No certificate bound to loadbalancer id: " + lbRuleId); + logger.debug("No certificate bound to loadbalancer id: {}", lbRuleId); return certResponseList; } @@ -273,7 +269,7 @@ public List listSslCerts(final ListSslCertsCmd listSslCertCmd) return certResponseList; } - //reached here look by accountId + // Reached here: list by explicit accountId or the caller account if accountId was not provided. final List certVOList = _sslCertDao.listByAccountId(accountId); if (certVOList == null || certVOList.isEmpty()) { return certResponseList; @@ -374,7 +370,7 @@ private void validateKeys(final PublicKey pubKey, final PrivateKey privKey) { } // No encryption for DSA - if (pubKey.getAlgorithm() != "RSA") { + if (!pubKey.getAlgorithm().equals("RSA")) { return; } @@ -492,7 +488,12 @@ public Certificate parseCertificate(final String cert) { } catch (final CertificateException | IOException e) { throw new InvalidParameterValueException("Invalid Certificate format. Expected X509 certificate. Failed due to " + e.getMessage()); } finally { - IOUtils.closeQuietly(certPem); + // Try to close quietly + try { + IOUtils.close(certPem); + } catch (IOException e) { + logger.debug("Failed to close pem reader", e); + } } } diff --git a/server/src/test/java/org/apache/cloudstack/network/ssl/CertServiceTest.java b/server/src/test/java/org/apache/cloudstack/network/ssl/CertServiceTest.java index 0685167c2a42..759383136792 100644 --- a/server/src/test/java/org/apache/cloudstack/network/ssl/CertServiceTest.java +++ b/server/src/test/java/org/apache/cloudstack/network/ssl/CertServiceTest.java @@ -32,6 +32,7 @@ import com.cloud.utils.db.EntityManager; import com.cloud.utils.db.TransactionLegacy; import org.apache.cloudstack.api.command.user.loadbalancer.DeleteSslCertCmd; +import org.apache.cloudstack.api.command.user.loadbalancer.ListSslCertsCmd; import org.apache.cloudstack.api.command.user.loadbalancer.UploadSslCertCmd; import org.apache.cloudstack.context.CallContext; import org.bouncycastle.openssl.PKCS8Generator; @@ -819,6 +820,25 @@ public void runDeleteSslCertInvalidId() throws NoSuchFieldException, IllegalAcce } + @Test + public void runListSslCertsUsesCallerAccountWhenNoFilters() { + final long callerAccountId = 42L; + final CertServiceImpl certService = new CertServiceImpl(); + + certService._sslCertDao = Mockito.mock(SslCertDao.class); + when(certService._sslCertDao.listByAccountId(anyLong())).thenReturn(new ArrayList<>()); + + final AccountVO callerAccount = new AccountVO("testaccount", 1, "networkdomain", Account.Type.NORMAL, UUID.randomUUID().toString()); + callerAccount.setId(callerAccountId); + final UserVO user = new UserVO(1, "testuser", "password", "firstname", "lastName", "email", "timezone", UUID.randomUUID().toString(), User.Source.UNKNOWN); + CallContext.unregister(); + CallContext.register(user, callerAccount); + + certService.listSslCerts(new ListSslCertsCmdExtn()); + + Mockito.verify(certService._sslCertDao).listByAccountId(callerAccountId); + } + public class UploadSslCertCmdExtn extends UploadSslCertCmd { @Override public long getEntityOwnerId() { @@ -833,6 +853,13 @@ public long getEntityOwnerId() { } } + public class ListSslCertsCmdExtn extends ListSslCertsCmd { + @Override + public long getEntityOwnerId() { + return 1; + } + } + private String generateEncryptedPrivateKey(String password) throws NoSuchAlgorithmException, OperatorCreationException, IOException { // Generate RSA key pair KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA"); From a9dc8bfe297e14e4f30d40f9cf4c9e7f04b18393 Mon Sep 17 00:00:00 2001 From: Rene Moser Date: Thu, 6 Aug 2026 14:36:50 +0200 Subject: [PATCH 2/2] revert to deprecated closeQuietly --- .../org/apache/cloudstack/network/ssl/CertServiceImpl.java | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java b/server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java index 90f2b994a30f..7036e4a386d3 100644 --- a/server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java +++ b/server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java @@ -488,12 +488,7 @@ public Certificate parseCertificate(final String cert) { } catch (final CertificateException | IOException e) { throw new InvalidParameterValueException("Invalid Certificate format. Expected X509 certificate. Failed due to " + e.getMessage()); } finally { - // Try to close quietly - try { - IOUtils.close(certPem); - } catch (IOException e) { - logger.debug("Failed to close pem reader", e); - } + IOUtils.closeQuietly(certPem); } }