The fix generates X509Certificate if missing from DB and uses that for eternity.
SAML SP metadata remains same since it's using the same X509 certificate and
it remains same after restarts. The certificate is serialized, base64 encoded
and stored in the keystore table under a specific name. For reading, it's
retrieved, base64 decoded and deserialized.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
(cherry picked from commit 4358714381)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
The User table's UUID column is restricted to 40 chars only, since we don't
know how long the nameID/userID of a SAML authenticated user will be - the fix
hashes that user ID and takes a substring of length 40 chars. For hashing,
SHA256 is used which returns a 64 char length string.
- Fix tests, add test cases
- Improve checkSAMLUser method
- Use SHA256 one way hashing to create unique UUID for SAML users
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
(cherry picked from commit b2b496288d)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
on calling GetUploadParamsForVolume, persisting the metadata to db
validating the account limits and incrementing the appropriate limits
encoded the metadata on management server using preshared key
Changes;
- Upgrades maven-war plugin to 4.5 (faster war packaging)
- Upgrade spring framework to latest minor release
- Upgrade ehcache, jasypt, httpclient, httpcore and other core dependencies
- Upgrade to latest ipv6 library, fix unit test NetUtilsTest
- httpcore and httpclient are sharing same version variable
- commons-httpclient is different that httpclient, the fix gives it a separate var
- Apidocs failed to generate and get stuck with new reflections version, for now
we will continue using 0.9.8
Newer dependencies can be listed using:
mvn versions:display-dependency-updates -Dnoredist -Dsimulator -P developer,systemvm
Testing;
- Tested using Maven 3.2.1
- Local noredist build with unit tests succeeds
- CloudStack mgmt server started, basic business layer tests work
- Observed 10-15% build time improvement using new maven-war plugin
Branch: bugfix/4.5-8011 (commits are squashed in favour of a linear history)
Pull request:
https://github.com/apache/cloudstack/pull/50
This closes#50
TravisCI build summary:
https://travis-ci.org/shapeblue/cloudstack/builds/42902172
- Build passes with unit tests
- Apidocs generates successfully
- Most integration tests pass, some fail due to timeout errors, second re-run
passes some of them
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
The previous fix tried to access StatsCollector from UsageManagerImpl
which is not possible due to dependency cycle.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This allows external processing of VmStats information without using
the usage server of CloudStack
Statistics are being send to Graphite using UDP and not TCP.
UDP is used to prevent the management server waiting for TCP timeouts
when the Graphite server is unavailable
In upgrade case, the db.properties file is not changed, but the following commit
would require passphrase for keystore in it, thus result in error(NPE in fact
due to there is no such properity).
commit 918c320438
Author: Upendra Moturi <upendra.moturi@sungard.com>
Date: Fri Jun 20 11:41:58 2014 +0530
CLOUDSTACK-6847.Link.java and console proxy files have hardcoded value
This commit fix it by put default value for passphrases, also set correct
passphrase if fail-safe keystore is used.
Latest httpclient library suggests when creating Protocol object for use
with the apache common httpclient class, they should avoid using the
deprecated Protocol signature which takes in SecureProtocolSocketFactory
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
On hosts or containers where they don't have valid mac address on nic resulting
in null, NetUtils.getNetworkParam can throw NPE.
This was a case found on TravisCI where OpenVZ containers are used. This method
(getDefaultHostIp) is used at several other places within the ACS codebase to
get the host IP and if null is caught we fallback to localhost or 127.0.0.1, so
we therefore set info to null before trying to process network param and if we
fail we return null and expect other layers to use localhost.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
In MacAddress class, we start by settig macAddress String as null and go through
the output of ifconfig -a and pick the one string that is a valid mac address
but is not 0x00 and 0xff. With each loop we set the macAddress to null so that
it does not pick the last one if everything fails.
Tested on Ubuntu where I had an interface called cloud0 whose mac id was 0x00
and it was skipped to get the next one:
$ java -classpath <path-to-cloud-utils.jar> com.cloud.utils.net.MacAddress
addr in integer is 5071953436
addr in bytes is 0 1 2e 4f de 1c
addr in char is 00:01:2e:4f:de:1c
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
1. Adding the missing Template/Volume URLs expiration functionality
2. Improvement - While deleting the volume during expiration use rm -rf as vmware now contains directoy
3. Improvement - Use standard Answer so that the error gets logged in case deletion of expiration link didnt work fine.
4. Improvement - In case of domain change, expire the old urls
Publish first class objects involved in an operation (for now vm uuid) on the event bus . Example - during attach/detachIso along with iso id, vm id should be available as well.
- Refactor tests:
- Upgrade tests to use jUnit4
- Add hamcrest dependency (contribution of by Laszio Hornyak)
- Break big tests in small unit tests
- Replace assertTrue/False with complex conditions by assertThat with
specific matchers
- Remove dead code:
- Private static method never called locally
- Add test for method that validates cidrs
Signed-off-by: Laszlo Hornyak <laszlo.hornyak@gmail.com>
encoded. This cause createStoragePool or addImageStore command to fail if special
characters were present. Updated the code to pass user, password and domain as part
of details while adding primary or secondary. Also made changes on server side to
handle it.
- StringBuffer replaced with StringBuilder
- nullcheck of tokens array removed since String.split does not return null
- unit test added
Signed-off-by: Laszlo Hornyak <laszlo.hornyak@gmail.com>
For some reason the mgmt server is required to have access to the template
being registered in order to check its size against resource limits
during registration. This is bad, but worse, it's a sync call, so this
call can hang for up to the default HTTP connection timeout.
Reducing http timeout as a quick workaround, but this check needs to
1) be removed or 2) done later or 3)registerTemplate needs to be async
and 4) moved off the mgmt server (ssvm is the only thing that needs access to
template url).
This patch adds support for trust chains in the netscaler.
I initially planned on using the 10.1 API's "bundle" feature but during
my testing I found that was not working. So I am doing the chain linking
myself. Also NS can have only one entity of a certificate ie lets say
two different users try to add the same certificate on the netscaler
only one of them will go through. The other one says resouce already
exists even though they have different files.
This can be a problem in trust chains where the chain can be shared
between multiple accounts/certificates. So, I am using the figerprint as
an identifier of a certificate and making sure that we delete it only
when no one references it.
Rohit Yadav
Pierre-Yves Ritschard
Kishan Kavala
Rajani Karuturi
Sheng Yang
amoghvk
Wido den Hollander
Laszlo Hornyak
Min Chen
Daan Hoogland
Hugo Trippaers
Santhosh Edukulla
Kishan Kavala
Damodar
Anshul Gangwar
David Nalley
Frank Zhang
Jayapal
Alena Prokharchyk
Kishan Kavala
Edison Su
Mike Tutkowski
Koushik Das
Daan Hoogland
Upendra Moturi
Anthony Xu
Kelven Yang
Nitin Mehta
Marcus Sorensen
Ding Yuan
miguelaferreira
Antonio Fornie
wrodrigues
Devdeep Singh
Saksham Srivastava
Alex Huang
tuna
Syed Ahmed