flasharray: tighten NVMe-TCP EUI-128 validation

Address the 2026-08-04 Copilot follow-up:

- FlashArrayVolume.getAddress() now requires the serial to match exactly 24
  hexadecimal characters instead of merely rejecting shorter ones. The previous
  form sliced serial[0:24], so two distinct serials sharing a 24-character
  prefix would have produced the same EUI-128 and therefore the same volume
  identity. Non-hex serials are now rejected as well.

- FlashArrayAdapter.getVolumeByAddress() validates the FlashArray EUI-128
  layout before reversing it into a serial: 32 hexadecimal characters, a 00
  prefix, and the Pure Storage OUI at offset 16. Previously any 32-character
  string was accepted and deterministically mapped onto a volume serial, so a
  malformed or tampered address could resolve to an unintended volume.

Verified against a real FlashArray namespace: EUI
006c1b16ce1c034d24a9371c05ab334a passes both checks and round-trips to serial
6C1B16CE1C034D1C05AB334A and back unchanged.

Signed-off-by: Eugenio Grosso <eugenio.grosso@gmail.com>

Author: Eugenio Grosso

plugins/storage/volume/flasharray/src/main/java/org/apache/cloudstack/storage/datastore/adapter/flasharray/FlashArrayAdapter.java

@@ -30,6 +30,7 @@
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Pattern;
 
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SSLContext;
@@ -93,6 +94,9 @@ public class FlashArrayAdapter implements ProviderAdapter {
     private static final String API_LOGIN_VERSION_DEFAULT = "1.19";
     private static final String API_VERSION_DEFAULT = "2.23";
 
+    /** A FlashArray NVMe namespace EUI-128 is exactly 32 hexadecimal characters. */
+    private static final Pattern EUI128_PATTERN = Pattern.compile("[0-9a-fA-F]{32}");
+
     // URLs for which the legacy-auth deprecation WARN has already been emitted,
     // so we don't spam the logs once per refresh per pool while it's still configured.
     private static final Set<String> WARNED_LEGACY_URLS = ConcurrentHashMap.newKeySet();
@@ -353,11 +357,24 @@ public ProviderVolume getVolumeByAddress(ProviderAdapterContext context, Address
             // Reverse the EUI-128 layout: serial = eui[2:16] + eui[22:32], after
             // stripping the optional "eui." prefix that appears in udev paths.
             String eui = address.startsWith("eui.") ? address.substring(4) : address;
-            if (eui == null || eui.length() != 32) {
+            if (eui == null || !EUI128_PATTERN.matcher(eui).matches()) {
                 throw new RuntimeException("Invalid NVMe-TCP EUI-128 address ["
-                        + address + "]: expected 32 hex characters, got "
+                        + address + "]: expected 32 hexadecimal characters, got "
                         + (eui == null ? "null" : String.valueOf(eui.length())));
             }
+            // Validate the FlashArray EUI-128 layout before deriving a serial from it, so a
+            // malformed or tampered address cannot be mapped onto an unintended volume:
+            //   00 + serial[0:14] + <Pure OUI> + serial[14:24]
+            if (!eui.startsWith("00")) {
+                throw new RuntimeException("Invalid NVMe-TCP EUI-128 address [" + address
+                        + "]: expected a \"00\" prefix for a FlashArray namespace");
+            }
+            if (!eui.regionMatches(true, 16, FlashArrayVolume.PURE_OUI_EUI, 0,
+                    FlashArrayVolume.PURE_OUI_EUI.length())) {
+                throw new RuntimeException("Invalid NVMe-TCP EUI-128 address [" + address
+                        + "]: expected the Pure Storage OUI [" + FlashArrayVolume.PURE_OUI_EUI
+                        + "] at offset 16");
+            }
             serial = (eui.substring(2, 16) + eui.substring(22)).toUpperCase();
         } else {
             throw new RuntimeException(

plugins/storage/volume/flasharray/src/main/java/org/apache/cloudstack/storage/datastore/adapter/flasharray/FlashArrayVolume.java

@@ -16,6 +16,8 @@
 // under the License.
 package org.apache.cloudstack.storage.datastore.adapter.flasharray;
 
+import java.util.regex.Pattern;
+
 import org.apache.cloudstack.storage.datastore.adapter.ProviderSnapshot;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
@@ -32,6 +34,9 @@ public class FlashArrayVolume implements ProviderSnapshot {
     // prefix in its raw 6-hex-digit form.
     public static final String PURE_OUI_EUI = "24a937";
 
+    /** FlashArray volume serials are exactly 24 hexadecimal characters. */
+    private static final Pattern SERIAL_PATTERN = Pattern.compile("[0-9a-fA-F]{24}");
+
     @JsonProperty("destroyed")
     private Boolean destroyed;
     /** The virtual size requested for this volume */
@@ -116,15 +121,16 @@ public String getAddress() {
             //   00 + serial[0:14] + <Pure OUI (24a937)> + serial[14:24]
             // This is the value the Linux kernel exposes as
             //   /dev/disk/by-id/nvme-eui.<result>
-            if (serial.length() < 24) {
+            // Require an exact 24-hex-character serial. Accepting anything longer and slicing
+            // the first 24 characters would silently map two distinct serials sharing a prefix
+            // onto the same EUI, breaking volume identity; accepting anything shorter cannot
+            // produce a valid 32-character EUI at all.
+            if (!SERIAL_PATTERN.matcher(serial).matches()) {
                 throw new RuntimeException("FlashArray serial [" + serial
-                        + "] is too short to build an NVMe EUI-128 address "
-                        + "(expected 24 hex characters, got "
+                        + "] cannot be used to build an NVMe EUI-128 address "
+                        + "(expected exactly 24 hexadecimal characters, got "
                         + serial.length() + ")");
             }
-            // Slice exact ranges rather than substring(14) so a serial with unexpected trailing
-            // characters cannot produce an EUI longer than 32 hex chars (which would not match
-            // /dev/disk/by-id/nvme-eui.<eui> on Linux).
             return ("00" + serial.substring(0, 14) + PURE_OUI_EUI + serial.substring(14, 24)).toLowerCase();
         }
         return ("6" + PURE_OUI + serial).toLowerCase();