Merge pull request apache#927 from karuturi/secure-configs

karuturi · web-flow · commit 511ebe6dd470 · 2017-06-06T15:37:44.000+05:30
CLOUDSTACK-9901 secure and hidden config values are returned as plaintext string
diff --git a/framework/config/src/org/apache/cloudstack/config/Configuration.java b/framework/config/src/org/apache/cloudstack/config/Configuration.java
@@ -81,4 +81,10 @@ public interface Configuration {
      * parameter is no longer used and can be deleted.
      */
     Date getUpdated();
+
+    /**
+     *
+     * @return returns true if the configuration is encrypted else false.
+     */
+    boolean isEncrypted();
 }
diff --git a/framework/config/src/org/apache/cloudstack/framework/config/impl/ConfigurationVO.java b/framework/config/src/org/apache/cloudstack/framework/config/impl/ConfigurationVO.java
@@ -122,22 +122,23 @@ public void setName(String name) {
 
     @Override
     public String getValue() {
-        if(isEncryptedConfig()) {
+        if(isEncrypted()) {
             return DBEncryptionUtil.decrypt(value);
         } else {
             return value;
         }
     }
 
     public void setValue(String value) {
-        if(isEncryptedConfig()) {
+        if(isEncrypted()) {
             this.value = DBEncryptionUtil.encrypt(value);
         } else {
             this.value = value;
         }
     }
 
-    private boolean isEncryptedConfig() {
+    @Override
+    public boolean isEncrypted() {
         return "Hidden".equals(getCategory()) || "Secure".equals(getCategory());
     }
 
diff --git a/server/src/com/cloud/api/ApiResponseHelper.java b/server/src/com/cloud/api/ApiResponseHelper.java
@@ -16,6 +16,7 @@
 // under the License.
 package com.cloud.api;
 
+import com.cloud.utils.crypt.DBEncryptionUtil;
 import com.cloud.agent.api.VgpuTypesInfo;
 import com.cloud.api.query.ViewResponseHelper;
 import com.cloud.api.query.vo.AccountJoinVO;
@@ -455,7 +456,11 @@ public ConfigurationResponse createConfigurationResponse(Configuration cfg) {
         cfgResponse.setCategory(cfg.getCategory());
         cfgResponse.setDescription(cfg.getDescription());
         cfgResponse.setName(cfg.getName());
-        cfgResponse.setValue(cfg.getValue());
+        if(cfg.isEncrypted()) {
+            cfgResponse.setValue(DBEncryptionUtil.encrypt(cfg.getValue()));
+        } else {
+            cfgResponse.setValue(cfg.getValue());
+        }
         cfgResponse.setObjectName("configuration");
 
         return cfgResponse;
diff --git a/test/integration/smoke/test_internal_lb.py b/test/integration/smoke/test_internal_lb.py
@@ -705,8 +705,12 @@ def get_lb_stats_settings(self):
                 self.apiclient, name="network.loadbalancer.haproxy.stats.port")[0].value
             settings["stats_uri"] = Configurations.list(
                 self.apiclient, name="network.loadbalancer.haproxy.stats.uri")[0].value
-            settings["username"], settings["password"] = Configurations.list(
-                self.apiclient, name="network.loadbalancer.haproxy.stats.auth")[0].value.split(":")
+            # Update global setting network.loadbalancer.haproxy.stats.auth to a known value
+            haproxy_auth = "admin:password"
+            Configurations.update(self.apiclient, "network.loadbalancer.haproxy.stats.auth", haproxy_auth)
+            self.logger.debug(
+                "Updated global setting stats network.loadbalancer.haproxy.stats.auth to %s" % (haproxy_auth))
+            settings["username"], settings["password"] = haproxy_auth.split(":")
             settings["visibility"] = Configurations.list(
                 self.apiclient, name="network.loadbalancer.haproxy.stats.visibility")[0].value
             self.logger.debug(settings)

Original file line number	Diff line number	Diff line change
`@@ -122,22 +122,23 @@ public void setName(String name) {`
`122`	`122`
`123`	`123`	`@Override`
`124`	`124`	`public String getValue() {`
`125`		`- if(isEncryptedConfig()) {`
	`125`	`+ if(isEncrypted()) {`
`126`	`126`	`return DBEncryptionUtil.decrypt(value);`
`127`	`127`	`} else {`
`128`	`128`	`return value;`
`129`	`129`	`}`
`130`	`130`	`}`
`131`	`131`
`132`	`132`	`public void setValue(String value) {`
`133`		`- if(isEncryptedConfig()) {`
	`133`	`+ if(isEncrypted()) {`
`134`	`134`	`this.value = DBEncryptionUtil.encrypt(value);`
`135`	`135`	`} else {`
`136`	`136`	`this.value = value;`
`137`	`137`	`}`
`138`	`138`	`}`
`139`	`139`
`140`		`- private boolean isEncryptedConfig() {`
	`140`	`+ @Override`
	`141`	`+ public boolean isEncrypted() {`
`141`	`142`	`return "Hidden".equals(getCategory()) \|\| "Secure".equals(getCategory());`
`142`	`143`	`}`
`143`	`144`