Skip to content

Default values & bounds for SAs in Ipsec Policy #4180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jun 23, 2017

Conversation

henry416
Copy link
Member

@henry416 henry416 commented Jun 22, 2017

Description

This changes the local IPsec Policy model to more accurately depict SA value checking before sending request to NRP. Gives a better user experience.
+default values for SA
+bounds for SA values


This checklist is used to make sure that common guidelines for a pull request are followed. You can find a more complete discussion of PowerShell cmdlet best practices here.

General Guidelines

  • Title of the pull request is clear and informative.
  • There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.
  • The pull request does not introduce breaking changes (unless a major version change occurs in the assembly and module).

Testing Guidelines

  • Pull request includes test coverage for the included changes.
  • PowerShell scripts used in tests should do any necessary setup as part of the test or suite setup, and should not use hard-coded values for locations or existing resources.

Cmdlet Signature Guidelines

  • New cmdlets that make changes or have side effects should implement ShouldProcess and have SupportShouldProcess=true specified in the cmdlet attribute. You can find more information on ShouldProcess here.
  • Cmdlet specifies OutputType attribute if any output is produced - if the cmdlet produces no output, it should implement a PassThru parameter.

Cmdlet Parameter Guidelines

  • Parameter types should not expose types from the management library - complex parameter types should be defined in the module.
  • Complex parameter types are discouraged - a parameter type should be simple types as often as possible. If complex types are used, they should be shallow and easily creatable from a constructor or another cmdlet.
  • Cmdlet parameter sets should be mutually exclusive - each parameter set must have at least one mandatory parameter not in other parameter sets.

HelpMessage = "The IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB")]
[ValidateNotNullOrEmpty]
[ValidateRange(1024, int.MaxValue)]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@henry416 adding these ValidateRange attributes are breaking changes. Previously if a user provided a value outside of the above range, what would happen?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IPsec Policy is only used by the Put connection call. It would be rejected as the backend would check the SA values and see it was out of bounds. There is no logic change overall.
This PR is meant to address complaints that 1) customers were surprised to see policy get rejected on the Put call and wanted to see the policy get rejected on creating the object instead 2) customer wanted some default values to be set for unspecified SAs

ipsecPolicy.SADataSizeKilobytes = this.SADataSizeKilobytes;
// default SA values
ipsecPolicy.SALifeTimeSeconds = (this.SALifeTimeSeconds == 0) ? 27000 : this.SALifeTimeSeconds;
ipsecPolicy.SADataSizeKilobytes = (this.SADataSizeKilobytes == 0) ? 102400000 : this.SADataSizeKilobytes;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@henry416 rather than using this.X == 0 as the check for if the parameter was provided, can we use !this.MyInvocation.BoundParameters.ContainsKey("X") ?

cormacpayne
cormacpayne previously approved these changes Jun 23, 2017
Copy link
Member

@cormacpayne cormacpayne left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@henry416 one last minor comment: would you mind updating the Network change log to reflect the changes made in this PR? Specifically the default values used for the two parameters and that they are no longer mandatory

@henry416
Copy link
Member Author

henry416 commented Jun 23, 2017

@cormacpayne Changes added to changelog

cormacpayne
cormacpayne previously approved these changes Jun 23, 2017
@cormacpayne cormacpayne merged commit 9c3b6ca into Azure:preview Jun 23, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants