nvazquez commented on code in PR #13683:
URL: https://github.com/apache/cloudstack/pull/13683#discussion_r3667346479
##########
services/console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxy.java:
##########
@@ -83,12 +82,73 @@ public class ConsoleProxy {
static String encryptorPassword = "Dummy";
static final String[] skipProperties = new String[]{"certificate",
"cacertificate", "keystore_password", "privatekey"};
- static Set<String> allowedSessions = new HashSet<>();
+ static Set<String> allowedSessions = ConcurrentHashMap.newKeySet();
+ private static final Object allowedSessionsLock = new Object();
+ private static final Map<String, ReconnectGrant> sessionReconnectGrants =
new ConcurrentHashMap<>();
+ private static long sessionReconnectionWindowMs = 0L;
+
+ // Invoked through reflection
public static void addAllowedSession(String sessionUuid) {
allowedSessions.add(sessionUuid);
}
+ /**
+ * Grant the client IP a reconnection window of #{@link
#sessionReconnectionWindowMs} ms to the same session UUID in case of a
disconnection.
+ * The grant is bound to the client IP that was using the session so it
cannot be redeemed by another client.
+ * @param sessionUuid session UUID to grant a reconnect window for
+ * @param clientIp source IP of the client the session was granted to
+ */
+ public static void grantReconnectWindowForSessionAndClientIp(String
sessionUuid, String clientIp) {
+ if (sessionReconnectionWindowMs > 0) {
+ ReconnectGrant grant = new
ReconnectGrant(System.currentTimeMillis() + sessionReconnectionWindowMs,
clientIp);
+ sessionReconnectGrants.put(sessionUuid, grant);
+ }
+ }
+
+ /**
+ * True if the session UUID has been granted reconnection, within the
reconnection window #{@link #sessionReconnectionWindowMs}.
+ */
+ private static boolean isSessionReconnectionGrantedForClientIp(String
sessionUuid, String clientIp) {
+ ReconnectGrant grant = sessionReconnectGrants.remove(sessionUuid);
+ if (grant == null) {
+ return false;
+ }
+ if (grant.isExpired(System.currentTimeMillis())) {
+ LOGGER.warn("Rejecting reconnection for session {} as the
reconnect window: {}ms is already expired",
+ sessionUuid, sessionReconnectionWindowMs);
+ return false;
+ }
+ if (grant.clientIp != null && !grant.clientIp.equals(clientIp)) {
+ LOGGER.warn("Rejecting reconnection for session {} as it was
requested from IP {} " +
+ "but the session was granted to IP {}", sessionUuid,
clientIp, grant.clientIp);
+ return false;
Review Comment:
Hi @weizhouapache not only client IPs match but also the reconnection
attempt is within the reconnection window/timeframe
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
