-
Notifications
You must be signed in to change notification settings - Fork 4k
Default values & bounds for SAs in Ipsec Policy #4180
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
HelpMessage = "The IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB")] | ||
[ValidateNotNullOrEmpty] | ||
[ValidateRange(1024, int.MaxValue)] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@henry416 adding these ValidateRange
attributes are breaking changes. Previously if a user provided a value outside of the above range, what would happen?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
IPsec Policy is only used by the Put connection call. It would be rejected as the backend would check the SA values and see it was out of bounds. There is no logic change overall.
This PR is meant to address complaints that 1) customers were surprised to see policy get rejected on the Put call and wanted to see the policy get rejected on creating the object instead 2) customer wanted some default values to be set for unspecified SAs
ipsecPolicy.SADataSizeKilobytes = this.SADataSizeKilobytes; | ||
// default SA values | ||
ipsecPolicy.SALifeTimeSeconds = (this.SALifeTimeSeconds == 0) ? 27000 : this.SALifeTimeSeconds; | ||
ipsecPolicy.SADataSizeKilobytes = (this.SADataSizeKilobytes == 0) ? 102400000 : this.SADataSizeKilobytes; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@henry416 rather than using this.X == 0
as the check for if the parameter was provided, can we use !this.MyInvocation.BoundParameters.ContainsKey("X")
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@henry416 one last minor comment: would you mind updating the Network change log to reflect the changes made in this PR? Specifically the default values used for the two parameters and that they are no longer mandatory
@cormacpayne Changes added to changelog |
Description
This changes the local IPsec Policy model to more accurately depict SA value checking before sending request to NRP. Gives a better user experience.
+default values for SA
+bounds for SA values
This checklist is used to make sure that common guidelines for a pull request are followed. You can find a more complete discussion of PowerShell cmdlet best practices here.
General Guidelines
Testing Guidelines
Cmdlet Signature Guidelines
ShouldProcess
and haveSupportShouldProcess=true
specified in the cmdlet attribute. You can find more information onShouldProcess
here.OutputType
attribute if any output is produced - if the cmdlet produces no output, it should implement aPassThru
parameter.Cmdlet Parameter Guidelines