diff --git a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/acs/session/attach_resource_responder.go b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/acs/session/attach_resource_responder.go index 4cd0bbdb205..2045de56d7a 100644 --- a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/acs/session/attach_resource_responder.go +++ b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/acs/session/attach_resource_responder.go @@ -202,6 +202,10 @@ func validateAttachmentAndReturnProperties(message *ecsacs.ConfirmAttachmentMess if err != nil { return nil, errors.Wrap(err, "resource attachment validation by attachment type failed") } + err = resource.ValidateFileSystemType(attachmentProperties[resource.FileSystemKey]) + if err != nil { + return nil, errors.Wrap(err, "resource attachment validation by file system property failed") + } return attachmentProperties, nil } diff --git a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/api/resource/resource_attachment.go b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/api/resource/resource_attachment.go index 39217718075..a9bccbfd8e6 100644 --- a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/api/resource/resource_attachment.go +++ b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/api/resource/resource_attachment.go @@ -74,6 +74,16 @@ const ( FileSystemKey = "fileSystem" ) +var ( + AllowedFSTypes = map[string]bool{ + "xfs": true, + "ext2": true, + "ext3": true, + "ext4": true, + "ntfs": true, + } +) + // getCommonProperties returns the common properties as used for validating a resource. func getCommonProperties() (commonProperties []string) { commonProperties = []string{ diff --git a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/api/resource/resource_validation.go b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/api/resource/resource_validation.go index e0b11b1463c..42e420ddfcf 100644 --- a/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/api/resource/resource_validation.go +++ b/agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/api/resource/resource_validation.go @@ -71,3 +71,12 @@ func ValidateRequiredProperties(actualProperties map[string]string, requiredProp } return nil } + +// For EBS-backed task attachment payload, the file system type is optional. If we do receive a file system type value, +// we want to validate what we receive is one of the following types [xfs, ext2, ext3, ext4, ntfs]. +func ValidateFileSystemType(filesystemType string) error { + if filesystemType != "" && !AllowedFSTypes[filesystemType] { + return errors.Errorf("invalid file system type: %s", filesystemType) + } + return nil +} diff --git a/ecs-agent/acs/session/attach_resource_responder.go b/ecs-agent/acs/session/attach_resource_responder.go index 4cd0bbdb205..2045de56d7a 100644 --- a/ecs-agent/acs/session/attach_resource_responder.go +++ b/ecs-agent/acs/session/attach_resource_responder.go @@ -202,6 +202,10 @@ func validateAttachmentAndReturnProperties(message *ecsacs.ConfirmAttachmentMess if err != nil { return nil, errors.Wrap(err, "resource attachment validation by attachment type failed") } + err = resource.ValidateFileSystemType(attachmentProperties[resource.FileSystemKey]) + if err != nil { + return nil, errors.Wrap(err, "resource attachment validation by file system property failed") + } return attachmentProperties, nil } diff --git a/ecs-agent/acs/session/attach_resource_responder_test.go b/ecs-agent/acs/session/attach_resource_responder_test.go index d269846eb7b..ce1d9d9f236 100644 --- a/ecs-agent/acs/session/attach_resource_responder_test.go +++ b/ecs-agent/acs/session/attach_resource_responder_test.go @@ -59,6 +59,10 @@ var ( Name: aws.String(resource.DeviceNameKey), Value: aws.String("device1"), }, + { + Name: aws.String(resource.FileSystemKey), + Value: aws.String("ext4"), + }, } testAttachmentProperties = []*ecsacs.AttachmentProperty{ @@ -244,6 +248,30 @@ func testValidateAttachmentAndReturnPropertiesWithAttachmentType(t *testing.T) { } require.True(t, verified, "Missing required property: %s", requiredProperty) } + validFileSystems := []string{"xfs", "ext2", "ext3", "ext4", "ntfs"} + for _, property := range confirmAttachmentMessageCopy.Attachment.AttachmentProperties { + if aws.StringValue(property.Name) == resource.FileSystemKey { + for _, fs := range validFileSystems { + originalPropertyValue := property.Value + property.Value = aws.String(fs) + _, err = validateAttachmentAndReturnProperties(&confirmAttachmentMessageCopy) + require.NoError(t, err) + property.Value = originalPropertyValue + } + originalPropertyValue := property.Value + property.Value = aws.String("SomeFilesystemType") + _, err = validateAttachmentAndReturnProperties(&confirmAttachmentMessageCopy) + require.Error(t, err) + property.Value = originalPropertyValue + + originalPropertyValue = property.Value + property.Value = aws.String("") + _, err = validateAttachmentAndReturnProperties(&confirmAttachmentMessageCopy) + require.Error(t, err) + property.Value = originalPropertyValue + } + } + } // TestResourceAckHappyPath tests the happy path for a typical ConfirmAttachmentMessage and confirms expected diff --git a/ecs-agent/api/resource/resource_attachment.go b/ecs-agent/api/resource/resource_attachment.go index 39217718075..a9bccbfd8e6 100644 --- a/ecs-agent/api/resource/resource_attachment.go +++ b/ecs-agent/api/resource/resource_attachment.go @@ -74,6 +74,16 @@ const ( FileSystemKey = "fileSystem" ) +var ( + AllowedFSTypes = map[string]bool{ + "xfs": true, + "ext2": true, + "ext3": true, + "ext4": true, + "ntfs": true, + } +) + // getCommonProperties returns the common properties as used for validating a resource. func getCommonProperties() (commonProperties []string) { commonProperties = []string{ diff --git a/ecs-agent/api/resource/resource_validation.go b/ecs-agent/api/resource/resource_validation.go index e0b11b1463c..42e420ddfcf 100644 --- a/ecs-agent/api/resource/resource_validation.go +++ b/ecs-agent/api/resource/resource_validation.go @@ -71,3 +71,12 @@ func ValidateRequiredProperties(actualProperties map[string]string, requiredProp } return nil } + +// For EBS-backed task attachment payload, the file system type is optional. If we do receive a file system type value, +// we want to validate what we receive is one of the following types [xfs, ext2, ext3, ext4, ntfs]. +func ValidateFileSystemType(filesystemType string) error { + if filesystemType != "" && !AllowedFSTypes[filesystemType] { + return errors.Errorf("invalid file system type: %s", filesystemType) + } + return nil +} diff --git a/ecs-agent/api/resource/resource_validation_test.go b/ecs-agent/api/resource/resource_validation_test.go index 1e741555a39..cdc5a048c7c 100644 --- a/ecs-agent/api/resource/resource_validation_test.go +++ b/ecs-agent/api/resource/resource_validation_test.go @@ -83,3 +83,15 @@ func TestValidateVolumeResource(t *testing.T) { }) } } + +func TestValidateVolumeFileSystem(t *testing.T) { + validFileSystems := []string{"xfs", "ext2", "ext3", "ext4", "ntfs"} + + for _, fs := range validFileSystems { + err := ValidateFileSystemType(fs) + require.NoError(t, err) + } + + err := ValidateFileSystemType("someFilesystem") + require.Error(t, err) +}