From 8f8d92ad08127a9ae45d0fd7bb7f167df4a23fc3 Mon Sep 17 00:00:00 2001 From: Sheng Yang Date: Fri, 10 Aug 2012 16:11:58 -0700 Subject: [PATCH] S2S VPN: CS-15947: Add global config for S2S VPN VPN connection counts limitation And subnets limitation for each customer gateway --- .../src/com/cloud/configuration/Config.java | 3 +++ .../network/vpn/Site2SiteVpnManagerImpl.java | 22 +++++++++++++++++-- 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/server/src/com/cloud/configuration/Config.java b/server/src/com/cloud/configuration/Config.java index ccf18fed0ee..ba5ee55a8e4 100755 --- a/server/src/com/cloud/configuration/Config.java +++ b/server/src/com/cloud/configuration/Config.java @@ -22,6 +22,7 @@ import com.cloud.ha.HighAvailabilityManager; import com.cloud.hypervisor.Hypervisor.HypervisorType; import com.cloud.network.NetworkManager; import com.cloud.network.router.VpcVirtualNetworkApplianceManager; +import com.cloud.network.vpn.Site2SiteVpnManager; import com.cloud.server.ManagementServer; import com.cloud.storage.StorageManager; import com.cloud.storage.allocator.StoragePoolAllocator; @@ -105,6 +106,8 @@ public enum Config { RemoteAccessVpnPskLength("Network", AgentManager.class, Integer.class, "remote.access.vpn.psk.length", "24", "The length of the ipsec preshared key (minimum 8, maximum 256)", null), RemoteAccessVpnClientIpRange("Network", AgentManager.class, String.class, "remote.access.vpn.client.iprange", "10.1.2.1-10.1.2.8", "The range of ips to be allocated to remote access vpn clients. The first ip in the range is used by the VPN server", null), RemoteAccessVpnUserLimit("Network", AgentManager.class, String.class, "remote.access.vpn.user.limit", "8", "The maximum number of VPN users that can be created per account", null), + Site2SiteVpnConnectionPerVpnGatewayLimit("Network", ManagementServer.class, Integer.class, "site2site.vpn.vpngateway.connection.limit", "4", "The maximum number of VPN connection per VPN gateway", null), + Site2SiteVpnSubnetsPerCustomerGatewayLimit("Network", ManagementServer.class, Integer.class, "site2site.vpn.customergateway.subnets.limit", "10", "The maximum number of subnets per customer gateway", null), // Console Proxy ConsoleProxyCapacityStandby("Console Proxy", AgentManager.class, String.class, "consoleproxy.capacity.standby", "10", "The minimal number of console proxy viewer sessions that system is able to serve immediately(standby capacity)", null), diff --git a/server/src/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java b/server/src/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java index 64796fec266..1f55ca6a89a 100644 --- a/server/src/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java +++ b/server/src/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java @@ -20,6 +20,8 @@ import com.cloud.api.commands.ListVpnCustomerGatewaysCmd; import com.cloud.api.commands.ListVpnGatewaysCmd; import com.cloud.api.commands.ResetVpnConnectionCmd; import com.cloud.api.commands.UpdateVpnCustomerGatewayCmd; +import com.cloud.configuration.Config; +import com.cloud.configuration.dao.ConfigurationDao; import com.cloud.event.ActionEvent; import com.cloud.event.EventTypes; import com.cloud.exception.InvalidParameterValueException; @@ -50,7 +52,9 @@ import com.cloud.user.UserStatisticsVO; import com.cloud.user.dao.AccountDao; import com.cloud.user.dao.UserStatisticsDao; import com.cloud.utils.IdentityProxy; +import com.cloud.utils.NumbersUtil; import com.cloud.utils.Ternary; +import com.cloud.utils.component.ComponentLocator; import com.cloud.utils.component.Inject; import com.cloud.utils.component.Manager; import com.cloud.utils.db.DB; @@ -77,10 +81,18 @@ public class Site2SiteVpnManagerImpl implements Site2SiteVpnManager, Manager { @Inject AccountManager _accountMgr; @Inject UserStatisticsDao _statsDao = null; String _name; - + int _connLimit; + int _subnetsLimit; + @Override public boolean configure(String name, Map params) throws ConfigurationException { _name = name; + + ComponentLocator locator = ComponentLocator.getCurrentLocator(); + ConfigurationDao configDao = locator.getDao(ConfigurationDao.class); + Map configs = configDao.getConfiguration(params); + _connLimit = NumbersUtil.parseInt(configs.get(Config.Site2SiteVpnConnectionPerVpnGatewayLimit.key()), 4); + _subnetsLimit = NumbersUtil.parseInt(configs.get(Config.Site2SiteVpnSubnetsPerCustomerGatewayLimit.key()), 10); return true; } @@ -138,8 +150,11 @@ public class Site2SiteVpnManagerImpl implements Site2SiteVpnManager, Manager { } protected void checkCustomerGatewayCidrList(String guestCidrList) { - // Remote sub nets cannot overlap themselves String[] cidrList = guestCidrList.split(","); + if (cidrList.length > _subnetsLimit) { + throw new InvalidParameterValueException("Too many subnets of customer gateway! The limit is " + _subnetsLimit, null); + } + // Remote sub nets cannot overlap themselves for (int i = 0; i < cidrList.length - 1; i ++) { for (int j = i + 1; j < cidrList.length; j ++) { if (NetUtils.isNetworksOverlap(cidrList[i], cidrList[j])) { @@ -274,6 +289,9 @@ public class Site2SiteVpnManagerImpl implements Site2SiteVpnManager, Manager { // We also need to check if the new connection's remote CIDR is overlapped with existed connections List conns = _vpnConnectionDao.listByVpnGatewayId(vpnGatewayId); + if (conns.size() >= _connLimit) { + throw new InvalidParameterValueException("There are too many VPN connections with current VPN gateway! The limit is " + _connLimit, null); + } for (Site2SiteVpnConnectionVO vc : conns) { if (vc == null) { continue;