blacklist leaked machine guids (#20016)
* blacklist the pattern of github runners machine-guids * blacklist also the one got from the daemon status file * blacklist specific guids * always use the machine_guid function to get the machine guid * always return the last status machine guid
Costa Tsaousis committed
Apr 1, 2025 at 00:16 UTC
cfd5bbe1f91564edeaf3c51f00eb0f83149b9111
2 files changed
+33
-14
src/daemon/machine-guid.c
+31
-3
@@ -9,8 +9,36 @@ static bool machine_guid_check_blacklisted(const char *guid) {
9
// new ones.
10
11
static char *blacklisted[] = {
12
+ // Third party packaging problems
13
"8a795b0c-2311-11e6-8563-000c295076a6",
14
"4aed1458-1c3e-11e6-a53f-000c290fc8f5",
15
+
16
+ // GitHub runner problems
17
+ "a177c1dc-09d9-11f0-a920-0242ac110002",
18
+ "983624e2-09d9-11f0-b90c-0242ac110002",
19
+ "477f97ae-09d9-11f0-903d-0242ac110002",
20
+ "ded81380-09e1-11f0-ae4c-0242ac110002",
21
+ "9abc69ec-09d9-11f0-a8a4-0242ac110002",
22
+ "68a2d17a-0aa2-11f0-97f3-0242ac110002",
23
+ "6499dbbe-0aa2-11f0-9ccd-0242ac110002",
24
+ "a9708cba-0aa2-11f0-98b6-0242ac110002",
25
+ "26903986-0aab-11f0-818e-0242ac110002",
26
+ "ab576242-0aa2-11f0-89c3-0242ac110002",
27
+ "eab387c6-0b6b-11f0-b715-0242ac110002",
28
+ "eaee7dfe-0b6b-11f0-870f-0242ac110002",
29
+ "c7d4e6b4-0b6b-11f0-878c-0242ac110002",
30
+ "40ac6d48-0b74-11f0-9cf4-0242ac110002",
31
+ "e366fc5a-0b6b-11f0-bd77-0242ac110002",
32
+ "c5955806-0c34-11f0-a302-0242ac110002",
33
+ "1d4d05d0-0c35-11f0-a01d-0242ac110002",
34
+ "edfc72b0-0c35-11f0-8e50-0242ac110002",
35
+ "536a030e-0c3d-11f0-837b-0242ac110002",
36
+ "10846e2e-0c35-11f0-8422-0242ac110002",
37
+ "4339f742-0dc7-11f0-838c-0242ac110002",
38
+ "3f28d7e0-0dc7-11f0-b75f-0242ac110002",
39
+ "41815788-0dc7-11f0-88e0-0242ac110002",
40
+ "104b408a-0dd0-11f0-8ca5-0242ac110002",
41
+ "8e45bc30-0dc7-11f0-8e50-0242ac110002",
42
};
43
44
for(size_t i = 0; i < _countof(blacklisted); i++) {
@@ -165,16 +193,16 @@ static ND_MACHINE_GUID machine_guid_get_or_create(void) {
193
194
// Attempt to retrieve GUID from daemon status file.
195
h = daemon_status_file_get_host_id();
168
- if (UUIDiszero(h.uuid)) {
196
+ uuid_unparse_lower(h.uuid.uuid, h.txt);
197
+ if (UUIDiszero(h.uuid) || machine_guid_check_blacklisted(h.txt)) {
198
// If the status file does not contain a GUID, generate a new one.
199
nd_log(NDLS_DAEMON, NDLP_INFO, "MACHINE_GUID: generating a new GUID");
200
uuid_generate(h.uuid.uuid);
201
+ uuid_unparse_lower(h.uuid.uuid, h.txt);
202
}
203
else
204
nd_log(NDLS_DAEMON, NDLP_INFO, "MACHINE_GUID: got previous GUID from daemon status file");
205
176
- // Ensure the text representation is updated.
177
- uuid_unparse_lower(h.uuid.uuid, h.txt);
206
h.last_modified_ut = now_realtime_usec();
207
nd_machine_guid = h;
208
src/daemon/status-file.c
+2
-11
@@ -475,13 +475,7 @@ static void daemon_status_file_migrate_once(void) {
475
476
session_status.claim_id = last_session_status.claim_id;
477
session_status.node_id = last_session_status.node_id;
478
- session_status.host_id = last_session_status.host_id;
479
- if(UUIDiszero(session_status.host_id.uuid)) {
480
- if(!UUIDiszero(last_session_status.host_id.uuid))
481
- session_status.host_id = last_session_status.host_id;
482
- else
483
- session_status.host_id = *machine_guid_get();
484
- }
478
+ session_status.host_id = *machine_guid_get();
479
480
strncpyz(session_status.architecture, last_session_status.architecture, sizeof(session_status.architecture) - 1);
481
strncpyz(session_status.virtualization, last_session_status.virtualization, sizeof(session_status.virtualization) - 1);
@@ -1400,10 +1394,7 @@ ssize_t daemon_status_file_get_reliability(void) {
1394
}
1395
1396
ND_MACHINE_GUID daemon_status_file_get_host_id(void) {
1403
- if(!UUIDiszero(session_status.host_id.uuid))
1404
- return session_status.host_id;
1405
- else
1406
- return last_session_status.host_id;
1397
+ return last_session_status.host_id;
1398
}
1399
1400
size_t daemon_status_file_get_fatal_worker_job_id(void) {