You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by bh...@apache.org on 2014/11/28 19:03:52 UTC
[38/51] [abbrv] git commit: updated
refs/heads/useraccount-refactoring to 1e25886
CLOUDSTACK-7977
Fix password generator, add guards for minimum length
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/960b7bbf
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/960b7bbf
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/960b7bbf
Branch: refs/heads/useraccount-refactoring
Commit: 960b7bbf742bbba62cd25bc62b700c6c829e35f2
Parents: 95ea203
Author: amoghvk <am...@citrix.com>
Authored: Wed Nov 26 15:08:48 2014 -0800
Committer: amoghvk <am...@citrix.com>
Committed: Wed Nov 26 15:08:48 2014 -0800
----------------------------------------------------------------------
server/src/com/cloud/configuration/Config.java | 8 ++++++
.../configuration/ConfigurationManagerImpl.java | 5 ++++
.../src/com/cloud/utils/PasswordGenerator.java | 26 ++++++++++++++------
.../com/cloud/utils/PasswordGeneratorTest.java | 7 +++---
4 files changed, 35 insertions(+), 11 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/960b7bbf/server/src/com/cloud/configuration/Config.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/configuration/Config.java b/server/src/com/cloud/configuration/Config.java
index a1dd882..cd0824e 100644
--- a/server/src/com/cloud/configuration/Config.java
+++ b/server/src/com/cloud/configuration/Config.java
@@ -908,6 +908,14 @@ public enum Config {
"0",
"Default disk I/O read rate in requests per second allowed in User vm's disk.",
null),
+ VmPasswordLength(
+ "Advanced",
+ ManagementServer.class,
+ Integer.class,
+ "vm.password.length",
+ "6",
+ "Specifies the length of a randomly generated password",
+ null),
VmDiskThrottlingIopsWriteRate(
"Advanced",
ManagementServer.class,
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/960b7bbf/server/src/com/cloud/configuration/ConfigurationManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/configuration/ConfigurationManagerImpl.java b/server/src/com/cloud/configuration/ConfigurationManagerImpl.java
index 714e6fc..918dd93 100644
--- a/server/src/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/com/cloud/configuration/ConfigurationManagerImpl.java
@@ -367,6 +367,7 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
configValuesForValidation.add("xenserver.heartbeat.interval");
configValuesForValidation.add("xenserver.heartbeat.timeout");
configValuesForValidation.add("incorrect.login.attempts.allowed");
+ configValuesForValidation.add("vm.password.length");
}
private void weightBasedParametersForValidation() {
@@ -780,6 +781,10 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
if (val <= 0) {
throw new InvalidParameterValueException("Please enter a positive value for the configuration parameter:" + name);
}
+ //TODO - better validation for all password pamameters
+ if ("vm.password.length".equalsIgnoreCase(name) && val < 6) {
+ throw new InvalidParameterValueException("Please enter a value greater than 6 for the configuration parameter:" + name);
+ }
} catch (NumberFormatException e) {
s_logger.error("There was an error trying to parse the integer value for:" + name);
throw new InvalidParameterValueException("There was an error trying to parse the integer value for:" + name);
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/960b7bbf/utils/src/com/cloud/utils/PasswordGenerator.java
----------------------------------------------------------------------
diff --git a/utils/src/com/cloud/utils/PasswordGenerator.java b/utils/src/com/cloud/utils/PasswordGenerator.java
index b6e4bed..6fa2843 100644
--- a/utils/src/com/cloud/utils/PasswordGenerator.java
+++ b/utils/src/com/cloud/utils/PasswordGenerator.java
@@ -35,18 +35,28 @@ public class PasswordGenerator {
static private char[] alphaNumeric = new char[] {'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'J', 'K', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y',
'Z', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'j', 'k', 'm', 'n', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '2', '3', '4', '5', '6', '7', '8', '9'};
+ static private int minLength = 3;
+
public static String generateRandomPassword(int num) {
Random r = new SecureRandom();
StringBuilder password = new StringBuilder();
- // Generate random 3-character string with a lowercase character,
- // uppercase character, and a digit
- password.append(generateLowercaseChar(r)).append(generateUppercaseChar(r)).append(generateDigit(r));
-
- // Generate a random n-character string with only lowercase
- // characters
- for (int i = 0; i < num; i++) {
- password.append(generateLowercaseChar(r));
+ //Guard for num < minLength
+ if (num < minLength) {
+ //Add alphanumeric chars at random
+ for (int i = 0; i < minLength; i++) {
+ password.append(generateAlphaNumeric(r));
+ }
+ } else {
+ // Generate random 3-character string with a lowercase character,
+ // uppercase character, and a digit
+ password.append(generateLowercaseChar(r)).append(generateUppercaseChar(r)).append(generateDigit(r));
+
+ // Generate a random n-character string with only lowercase
+ // characters
+ for (int i = 0; i < num - 3; i++) {
+ password.append(generateLowercaseChar(r));
+ }
}
return password.toString();
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/960b7bbf/utils/test/com/cloud/utils/PasswordGeneratorTest.java
----------------------------------------------------------------------
diff --git a/utils/test/com/cloud/utils/PasswordGeneratorTest.java b/utils/test/com/cloud/utils/PasswordGeneratorTest.java
index 3e82d98..bd87987 100644
--- a/utils/test/com/cloud/utils/PasswordGeneratorTest.java
+++ b/utils/test/com/cloud/utils/PasswordGeneratorTest.java
@@ -25,10 +25,11 @@ import org.junit.Test;
public class PasswordGeneratorTest {
@Test
public void generateRandomPassword() {
- // actual length is requested length + 3
+ // actual length is requested length, minimum length is 3
Assert.assertTrue(PasswordGenerator.generateRandomPassword(0).length() == 3);
- Assert.assertTrue(PasswordGenerator.generateRandomPassword(1).length() == 4);
- String password = PasswordGenerator.generateRandomPassword(0);
+ Assert.assertTrue(PasswordGenerator.generateRandomPassword(1).length() == 3);
+ Assert.assertTrue(PasswordGenerator.generateRandomPassword(5).length() == 5);
+ String password = PasswordGenerator.generateRandomPassword(8);
// TODO: this might give more help to bruteforcing than desired
// the actual behavior is that the first character is a random lowercase
// char