apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

bug 6971: Use PSK length configuration

Browse Source 
validate global configurations
This commit is contained in:
Chiradeep Vittal 2010-11-17 16:32:43 -08:00
parent 6100dc62b5
commit 4c7bb302bc
4 changed files with 36 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
server/src/com/cloud/configuration/Config.java
View File

@ -60,7 +60,7 @@ public enum Config {
GuestDomainSuffix("Network", AgentManager.class, String.class, "domain.suffix", "cloud-test.cloud.internal", "Default domain name for vms inside virtualized networks fronted by router", null), GuestDomainSuffix("Network", AgentManager.class, String.class, "domain.suffix", "cloud-test.cloud.internal", "Default domain name for vms inside virtualized networks fronted by router", null),
//VPN //VPN
RemoteAccessVpnPskLength("Network", AgentManager.class, Integer.class, "remote.access.vpn.psk.length", "24", "The length of the ipsec preshared key", null), RemoteAccessVpnPskLength("Network", AgentManager.class, Integer.class, "remote.access.vpn.psk.length", "24", "The length of the ipsec preshared key (minimum 8, maximum 256)", null),
RemoteAccessVpnClientIpRange("Network", AgentManager.class, String.class, "remote.access.vpn.client.iprange", "10.1.2.1-10.1.2.8", "The range of ips to be allocated to remote access vpn clients. The first ip in the range is used by the VPN server", null), RemoteAccessVpnClientIpRange("Network", AgentManager.class, String.class, "remote.access.vpn.client.iprange", "10.1.2.1-10.1.2.8", "The range of ips to be allocated to remote access vpn clients. The first ip in the range is used by the VPN server", null),

37
server/src/com/cloud/network/NetworkManagerImpl.java
View File

@ -1680,13 +1680,42 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
return null; return null;
} }
private void validateRemoteAccessVpnConfiguration() throws ConfigurationException {
String ipRange = _configs.get(Config.RemoteAccessVpnClientIpRange.key());
if (ipRange == null) {
s_logger.warn("Remote Access VPN configuration missing client ip range -- ignoring");
return;
}
Integer pskLength = getIntegerConfigValue(Config.RemoteAccessVpnPskLength.key());
if (pskLength != null && (pskLength < 8 || pskLength > 256)) {
throw new ConfigurationException("Remote Access VPN: IPSec preshared key length should be between 8 and 256");
} else if (pskLength == null) {
s_logger.warn("Remote Access VPN configuration missing Preshared Key Length -- ignoring");
return;
}
String [] range = ipRange.split("-");
if (range.length != 2) {
throw new ConfigurationException("Remote Access VPN: Invalid ip range " + ipRange);
}
if (!NetUtils.isValidIp(range[0]) || !NetUtils.isValidIp(range[1])){
throw new ConfigurationException("Remote Access VPN: Invalid ip in range specification " + ipRange);
}
if (!NetUtils.validIpRange(range[0], range[1])){
throw new ConfigurationException("Remote Access VPN: Invalid ip range " + ipRange);
}
String [] guestIpRange = getGuestIpRange();
if (NetUtils.ipRangesOverlap(range[0], range[1], guestIpRange[0], guestIpRange[1])) {
throw new ConfigurationException("Remote Access VPN: Invalid ip range: " + ipRange + " overlaps with guest ip range " + guestIpRange[0] + "-" + guestIpRange[1]);
}
}
@Override @Override
public boolean configure(final String name, final Map<String, Object> params) throws ConfigurationException { public boolean configure(final String name, final Map<String, Object> params) throws ConfigurationException {
_name = name; _name = name;
_configs = _configDao.getConfiguration("AgentManager", params); _configs = _configDao.getConfiguration("AgentManager", params);
validateRemoteAccessVpnConfiguration();
Integer rateMbps = getIntegerConfigValue(Config.NetworkThrottlingRate.key()); Integer rateMbps = getIntegerConfigValue(Config.NetworkThrottlingRate.key());
Integer multicastRateMbps = getIntegerConfigValue(Config.MulticastThrottlingRate.key()); Integer multicastRateMbps = getIntegerConfigValue(Config.MulticastThrottlingRate.key());
@ -2728,10 +2757,10 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
throw new InvalidParameterValueException("Invalid ip range"); throw new InvalidParameterValueException("Invalid ip range");
} }
if (!NetUtils.isValidIp(range[0]) || !NetUtils.isValidIp(range[1])){ if (!NetUtils.isValidIp(range[0]) || !NetUtils.isValidIp(range[1])){
throw new InvalidParameterValueException("Invalid ip range " + ipRange); throw new InvalidParameterValueException("Invalid ip in range specification " + ipRange);
} }
if (!NetUtils.validIpRange(range[0], range[1])){ if (!NetUtils.validIpRange(range[0], range[1])){
throw new InvalidParameterValueException("Invalid ip range"); throw new InvalidParameterValueException("Invalid ip range " + ipRange);
} }
String [] guestIpRange = getGuestIpRange(); String [] guestIpRange = getGuestIpRange();
if (NetUtils.ipRangesOverlap(range[0], range[1], guestIpRange[0], guestIpRange[1])) { if (NetUtils.ipRangesOverlap(range[0], range[1], guestIpRange[0], guestIpRange[1])) {
@ -2742,7 +2771,7 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
long startIp = NetUtils.ip2Long(range[0]); long startIp = NetUtils.ip2Long(range[0]);
String newIpRange = NetUtils.long2Ip(++startIp) + "-" + range[1]; String newIpRange = NetUtils.long2Ip(++startIp) + "-" + range[1];
String sharedSecret = PasswordGenerator.generatePresharedKey(24); //TODO:configurable length String sharedSecret = PasswordGenerator.generatePresharedKey(getIntegerConfigValue(Config.RemoteAccessVpnPskLength.key()));
Transaction txn = Transaction.currentTxn(); Transaction txn = Transaction.currentTxn();
txn.start(); txn.start();
boolean locked = false; boolean locked = false;

2
setup/db/create-schema.sql
View File

@ -964,7 +964,7 @@ CREATE TABLE `cloud`.`remote_access_vpn` (
`vpn_server_addr` varchar(15) UNIQUE NOT NULL, `vpn_server_addr` varchar(15) UNIQUE NOT NULL,
`local_ip` varchar(15) NOT NULL, `local_ip` varchar(15) NOT NULL,
`ip_range` varchar(32) NOT NULL, `ip_range` varchar(32) NOT NULL,
`ipsec_psk` varchar(255) NOT NULL, `ipsec_psk` varchar(256) NOT NULL,
PRIMARY KEY (`id`) PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8; ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

2
setup/db/schema-21to22.sql
View File

@ -32,7 +32,7 @@ CREATE TABLE `cloud`.`remote_access_vpn` (
`vpn_server_addr` varchar(15) UNIQUE NOT NULL, `vpn_server_addr` varchar(15) UNIQUE NOT NULL,
`local_ip` varchar(15) NOT NULL, `local_ip` varchar(15) NOT NULL,
`ip_range` varchar(32) NOT NULL, `ip_range` varchar(32) NOT NULL,
`ipsec_psk` varchar(255) NOT NULL, `ipsec_psk` varchar(256) NOT NULL,
PRIMARY KEY (`id`) PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8; ) ENGINE=InnoDB DEFAULT CHARSET=utf8;