apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-12-16 10:32:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Use URL safe BASE64 encoding for console access ticket generation.

Browse Source
This commit is contained in:
Kelven Yang 2011-01-27 11:54:22 -08:00
parent 87008ae6a9
commit e7c8872651
2 changed files with 20 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
server/src/com/cloud/consoleproxy/ConsoleProxyManagerImpl.java
View File

@ -706,21 +706,31 @@ public class ConsoleProxyManagerImpl implements ConsoleProxyManager, ConsoleProx
return new ConsoleAccessAuthenticationAnswer(cmd, false); return new ConsoleAccessAuthenticationAnswer(cmd, false);
} }
if(s_logger.isDebugEnabled())
s_logger.debug("Console authentication. Ticket in url for " + cmd.getHost() + ":" + cmd.getPort() + "-" + cmd.getVmId() + " is " + ticketInUrl);
String ticket = ConsoleProxyServlet.genAccessTicket(cmd.getHost(), cmd.getPort(), cmd.getSid(), cmd.getVmId()); String ticket = ConsoleProxyServlet.genAccessTicket(cmd.getHost(), cmd.getPort(), cmd.getSid(), cmd.getVmId());
if(!ticket.startsWith(ticketInUrl)) { if(s_logger.isDebugEnabled())
s_logger.debug("Console authentication. Ticket in 1 minute boundary for " + cmd.getHost() + ":" + cmd.getPort() + "-" + cmd.getVmId() + " is " + ticket);
if(!ticket.equals(ticketInUrl)) {
Date now = new Date(); Date now = new Date();
// considering of minute round-up // considering of minute round-up
String minuteEarlyTicket = ConsoleProxyServlet.genAccessTicket(cmd.getHost(), cmd.getPort(), cmd.getSid(), cmd.getVmId(), String minuteEarlyTicket = ConsoleProxyServlet.genAccessTicket(cmd.getHost(), cmd.getPort(), cmd.getSid(), cmd.getVmId(),
new Date(now.getTime() - 60*1000)); new Date(now.getTime() - 60*1000));
if(!minuteEarlyTicket.startsWith(ticketInUrl)) {
if(s_logger.isDebugEnabled())
s_logger.debug("Console authentication. Ticket in 2-minute boundary for " + cmd.getHost() + ":" + cmd.getPort() + "-" + cmd.getVmId() + " is " + minuteEarlyTicket);
if(!minuteEarlyTicket.equals(ticketInUrl)) {
s_logger.error("Access ticket expired or has been modified. vmId: " + cmd.getVmId() + "ticket in URL: " + ticketInUrl + ", tickets to check against: " + ticket + "," + minuteEarlyTicket); s_logger.error("Access ticket expired or has been modified. vmId: " + cmd.getVmId() + "ticket in URL: " + ticketInUrl + ", tickets to check against: " + ticket + "," + minuteEarlyTicket);
return new ConsoleAccessAuthenticationAnswer(cmd, false); return new ConsoleAccessAuthenticationAnswer(cmd, false);
} }
} }
if (cmd.getVmId() != null && cmd.getVmId().isEmpty()) { if (cmd.getVmId() != null && cmd.getVmId().isEmpty()) {
if (s_logger.isTraceEnabled()) { if (s_logger.isDebugEnabled()) {
s_logger.trace("Invalid vm id sent from proxy(happens when proxy session has terminated)"); s_logger.debug("Invalid vm id sent from proxy(happens when proxy session has terminated)");
} }
return new ConsoleAccessAuthenticationAnswer(cmd, false); return new ConsoleAccessAuthenticationAnswer(cmd, false);
} }

14
server/src/com/cloud/servlet/ConsoleProxyServlet.java
View File

@ -34,10 +34,9 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession; import javax.servlet.http.HttpSession;
import org.apache.commons.codec.binary.Base64;
import org.apache.log4j.Logger; import org.apache.log4j.Logger;
import com.cloud.domain.dao.DomainDao;
import com.cloud.domain.dao.DomainDaoImpl;
import com.cloud.host.HostVO; import com.cloud.host.HostVO;
import com.cloud.server.ManagementServer; import com.cloud.server.ManagementServer;
import com.cloud.user.Account; import com.cloud.user.Account;
@ -45,8 +44,6 @@ import com.cloud.user.User;
import com.cloud.utils.Pair; import com.cloud.utils.Pair;
import com.cloud.utils.component.ComponentLocator; import com.cloud.utils.component.ComponentLocator;
import com.cloud.utils.db.Transaction; import com.cloud.utils.db.Transaction;
import com.cloud.utils.encoding.Base64;
import com.cloud.vm.UserVmVO;
import com.cloud.vm.VMInstanceVO; import com.cloud.vm.VMInstanceVO;
/** /**
@ -288,7 +285,7 @@ public class ConsoleProxyServlet extends HttpServlet {
} }
String sid = vm.getVncPassword(); String sid = vm.getVncPassword();
long tag = vm.getId(); long tag = vm.getId();
String ticket = URLEncoder.encode(genAccessTicket(host, String.valueOf(portInfo.second()), sid, String.valueOf(tag))); String ticket = genAccessTicket(host, String.valueOf(portInfo.second()), sid, String.valueOf(tag));
sb.append("/getscreen?host=").append(host); sb.append("/getscreen?host=").append(host);
sb.append("&port=").append(portInfo.second()); sb.append("&port=").append(portInfo.second());
@ -313,7 +310,7 @@ public class ConsoleProxyServlet extends HttpServlet {
} }
String sid = vm.getVncPassword(); String sid = vm.getVncPassword();
long tag = vm.getId(); long tag = vm.getId();
String ticket = URLEncoder.encode(genAccessTicket(host, String.valueOf(portInfo.second()), sid, String.valueOf(tag))); String ticket = genAccessTicket(host, String.valueOf(portInfo.second()), sid, String.valueOf(tag));
sb.append("/ajax?host=").append(host); sb.append("/ajax?host=").append(host);
sb.append("&port=").append(portInfo.second()); sb.append("&port=").append(portInfo.second());
@ -347,7 +344,8 @@ public class ConsoleProxyServlet extends HttpServlet {
mac.update(String.valueOf(ts).getBytes()); mac.update(String.valueOf(ts).getBytes());
byte[] encryptedBytes = mac.doFinal(); byte[] encryptedBytes = mac.doFinal();
return Base64.encodeBytes(encryptedBytes);
return Base64.encodeBase64URLSafeString(encryptedBytes);
} catch(Exception e) { } catch(Exception e) {
s_logger.error("Unexpected exception ", e); s_logger.error("Unexpected exception ", e);
} }
@ -518,7 +516,7 @@ public class ConsoleProxyServlet extends HttpServlet {
mac.init(keySpec); mac.init(keySpec);
mac.update(unsignedRequest.getBytes()); mac.update(unsignedRequest.getBytes());
byte[] encryptedBytes = mac.doFinal(); byte[] encryptedBytes = mac.doFinal();
String computedSignature = Base64.encodeBytes(encryptedBytes); String computedSignature = com.cloud.utils.encoding.Base64.encodeBytes(encryptedBytes);
boolean equalSig = signature.equals(computedSignature); boolean equalSig = signature.equals(computedSignature);
if (!equalSig) { if (!equalSig) {
s_logger.info("User signature: " + signature + " is not equaled to computed signature: " + computedSignature); s_logger.info("User signature: " + signature + " is not equaled to computed signature: " + computedSignature);