Merge pull request #4636 from ioito/hotfix/qx-huawei-rds-password-check

fix: 加强密码校验

pkg/compute/models/dbinstances.go

@@ -41,6 +41,7 @@ import (
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/onecloud/pkg/util/billing"
 	"yunion.io/x/onecloud/pkg/util/rbacutils"
+	"yunion.io/x/onecloud/pkg/util/seclib2"
 	"yunion.io/x/onecloud/pkg/util/stringutils2"
 )
 
@@ -182,6 +183,12 @@ func (man *SDBInstanceManager) ValidateCreateData(ctx context.Context, userCred
 		return nil, errors.Wrapf(err, "Unmarshal input failed: %v", err)
 	}
 
+	if len(input.Password) > 0 {
+		if !seclib2.MeetComplxity(input.Password) {
+			return nil, httperrors.NewWeakPasswordError()
+		}
+	}
+
 	network := networkV.Model.(*SNetwork)
 	input.NetworkExternalId = network.ExternalId
 

pkg/compute/regiondrivers/huawei.go

@@ -2178,6 +2178,14 @@ func (self *SHuaWeiRegionDriver) ValidateCreateDBInstanceAccountData(ctx context
 	if utils.IsInStringArray(instance.Engine, []string{api.DBINSTANCE_TYPE_POSTGRESQL, api.DBINSTANCE_TYPE_SQLSERVER}) {
 		return nil, httperrors.NewInputParameterError("Not support create account for huawei cloud %s instance", instance.Engine)
 	}
+	if len(input.Name) == len(input.Password) {
+		for i := range input.Name {
+			if input.Name[i] != input.Password[len(input.Password)-i-1] {
+				return input, nil
+			}
+		}
+		return nil, httperrors.NewInputParameterError("Huawei rds password cannot be in the same reverse order as the account")
+	}
 	return input, nil
 }
 

pkg/util/seclib2/seclib.go

@@ -19,6 +19,8 @@ import (
 	"fmt"
 	"math/rand"
 	"strings"
+
+	"yunion.io/x/pkg/utils"
 )
 
 const (
@@ -40,9 +42,22 @@ type PasswordStrength struct {
 	Punctuats  int
 }
 
+var WEAK_PASSWORDS []string = []string{
+	"Huawei@", "huawei@", "Admin@", "admin@", "Root@", "root@", "ABC@", "abc@", "ABCD@", "abcd@", "Huawei123@", "huawei123@", "Admin123@", "admin123@", "Root123@", "root123@", "Huawei#", "huawei#", "Admin#", "admin#", "Root#", "root#", "ABC#", "abc#", "ABCD#", "abcd#", "Huawei123#", "huawei123#", "Admin123#", "admin123#", "Root123#", "root123#，Huawei!", "huawei!", "Admin!", "admin!", "Root!", "root!", "ABC!", "abc!", "ABCD!", "abcd!", "Huawei123!", "huawei123!", "Admin123!", "admin123!", "Root123!", "root123!", "ABC123!", "abc123!", "Huawei@123", "huawei@123", "Admin@123", "admin@123", "Root@123", "root@123", "ABC@123", "abc@123", "123@Huawei", "123@Root", "123@abc", "Huawei123", "huawei123", "Admin123", "admin123", "Root123", "root123", "abc123", "Huawei_123", "huawei_123", "Admin_123", "admin_123", "Root_123", "root_123", "ABC_123", "abc_123", "123abc", "123abcd", "1234abc", "1234abcd", "abcd123", "abc1234", "abcd1234", "abcd@1234", "abcd1234!", "abcd_1234", "a123456", "123.com", "123@com", "123_com", "Huawei!@#", "huawei!@#", "Admin!@#", "admin!@#", "Root!@#", "root!@#", "Huawei!@", "huawei!@", "Admin!@", "admin!@", "Root!@", "root!@", "Huaweiroot", "HuaweiRoot", "huaweiroot", "huaweiRoot", "Huaweiadmin", "HuaweiAdmin", "huaweiadmin", "huaweiAdmin", "Adminroot", "AdminRoot", "adminRoot", "adminroot", "Rootadmin", "RootAdmin", "rootAdmin", "rootadmin", "Rootroot", "RootRoot", "rootroot", "Administrator", "Password", "Password123", "Password@123", "Password_123", "Password123!", "DDM@123", "ddM@123", "dDm@123",
+}
+
 var CHARS = fmt.Sprintf("%s%s%s%s", DIGITS, LETTERS, UPPERS, PUNC)
 
 func RandomPassword2(width int) string {
+	for {
+		password := randomPassword2(width)
+		if !utils.IsInStringArray(password, WEAK_PASSWORDS) {
+			return password
+		}
+	}
+}
+
+func randomPassword2(width int) string {
 	if width < 6 {
 		width = 6
 	}
@@ -106,6 +121,9 @@ func (ps PasswordStrength) MeetComplexity() bool {
 }
 
 func MeetComplxity(passwd string) bool {
+	if utils.IsInStringArray(passwd, WEAK_PASSWORDS) {
+		return false
+	}
 	ps := AnalyzePasswordStrenth(passwd)
 	return ps.MeetComplexity()
 }