// NewSecurityConfig initializes and returns a new SecurityConfig.
761185
func NewSecurityConfig(rootCA *RootCA, krw *KeyReadWriter, tlsKeyPair *tls.Certificate, issuerInfo *IssuerInfo) (*SecurityConfig, func() error, error) {
	// Create the Server TLS Credentials for this node. These will not be used by workers.
	serverTLSCreds, err := rootCA.NewServerTLSCredentials(tlsKeyPair)
	if err != nil {
		return nil, nil, err
	}

	// Create a TLSConfig to be used when this node connects as a client to another remote node.
	// We're using ManagerRole as remote serverName for TLS host verification because both workers
	// and managers always connect to remote managers.
	clientTLSCreds, err := rootCA.NewClientTLSCredentials(tlsKeyPair, ManagerRole)
	if err != nil {
		return nil, nil, err
	}

	q := watch.NewQueue()
	return &SecurityConfig{
		rootCA:        rootCA,
		keyReadWriter: krw,

		certificate: tlsKeyPair,
		issuerInfo:  issuerInfo,
		queue:       q,

		ClientTLSCreds: clientTLSCreds,
		ServerTLSCreds: serverTLSCreds,
	}, q.Close, nil
}
318631
func (s *DevEndpoint) SetSecurityConfiguration(v string) *DevEndpoint {
	s.SecurityConfiguration = &v
	return s
}
807301
func (s *Action) SetSecurityConfiguration(v string) *Action {
	s.SecurityConfiguration = &v
	return s
}
1315239
func NewServerTLSConfig(certs []tls.Certificate, rootCAPool *x509.CertPool) (*tls.Config, error) {
	if rootCAPool == nil {
		return nil, errors.New("valid root CA pool required")
	}

	return &tls.Config{
		Certificates: certs,
		// Since we're using the same CA server to issue Certificates to new nodes, we can't
		// use tls.RequireAndVerifyClientCert
		ClientAuth:               tls.VerifyClientCertIfGiven,
		RootCAs:                  rootCAPool,
		ClientCAs:                rootCAPool,
		PreferServerCipherSuites: true,
		MinVersion:               tls.VersionTLS12,
	}, nil
}
56437
func newSecrets(c *Client, ns string) *secrets {
	return &secrets{
		client:    c,
		namespace: ns,
	}
}
1347469
func NewServer(store *store.MemoryStore, securityConfig *SecurityConfig) *Server {
	return &Server{
		store:                           store,
		securityConfig:                  securityConfig,
		localRootCA:                     securityConfig.RootCA(),
		externalCA:                      NewExternalCA(nil, nil),
		pending:                         make(map[string]*api.Node),
		started:                         make(chan struct{}),
		reconciliationRetryInterval:     defaultReconciliationRetryInterval,
		rootReconciliationRetryInterval: defaultRootReconciliationInterval,
		clusterID:                       securityConfig.ClientTLSCreds.Organization(),
	}
}
969863
func NewSecurityRequirement(in interface{}, context *compiler.Context) (*SecurityRequirement, error) {
	errors := make([]error, 0)
	x := &SecurityRequirement{}
	m, ok := compiler.UnpackMap(in)
	if !ok {
		message := fmt.Sprintf("has unexpected value: %+v (%T)", in, in)
		errors = append(errors, compiler.NewError(context, message))
	} else {
		// repeated NamedStringArray additional_properties = 1;
		// MAP: StringArray
		x.AdditionalProperties = make([]*NamedStringArray, 0)
		for _, item := range m {
			k, ok := compiler.StringValue(item.Key)
			if ok {
				v := item.Value
				pair := &NamedStringArray{}
				pair.Name = k
				var err error
				pair.Value, err = NewStringArray(v, compiler.NewContext(k, context))
				if err != nil {
					errors = append(errors, err)
				}
				x.AdditionalProperties = append(x.AdditionalProperties, pair)
			}
		}
	}
	return x, compiler.NewErrorGroupOrNil(errors)
}
725706
func (s *VPCConfig) SetSecurityGroups(v []*string) *VPCConfig {
	s.SecurityGroups = v
	return s
}
945836
func NewSecurityRequirement(in interface{}, context *compiler.Context) (*SecurityRequirement, error) {
	errors := make([]error, 0)
	x := &SecurityRequirement{}
	m, ok := compiler.UnpackMap(in)
	if !ok {
		message := fmt.Sprintf("has unexpected value: %+v (%T)", in, in)
		errors = append(errors, compiler.NewError(context, message))
	} else {
		allowedKeys := []string{}
		allowedPatterns := []*regexp.Regexp{pattern4}
		invalidKeys := compiler.InvalidKeysInMap(m, allowedKeys, allowedPatterns)
		if len(invalidKeys) > 0 {
			message := fmt.Sprintf("has invalid %s: %+v", compiler.PluralProperties(len(invalidKeys)), strings.Join(invalidKeys, ", "))
			errors = append(errors, compiler.NewError(context, message))
		}
	}
	return x, compiler.NewErrorGroupOrNil(errors)
}
85408
func (s *Input) SetSecurityGroups(v []*string) *Input {
	s.SecurityGroups = v
	return s
}
1265357
func newSecurityRule(p newSecurityRuleParams) network.SecurityRule {
	return network.SecurityRule{
		Name: to.StringPtr(p.name),
		SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
			Description:              to.StringPtr(p.description),
			Protocol:                 network.SecurityRuleProtocolTCP,
			SourceAddressPrefix:      to.StringPtr("*"),
			SourcePortRange:          to.StringPtr("*"),
			DestinationAddressPrefix: to.StringPtr(p.destPrefix),
			DestinationPortRange:     to.StringPtr(fmt.Sprint(p.port)),
			Access:                   network.SecurityRuleAccessAllow,
			Priority:                 to.Int32Ptr(int32(p.priority)),
			Direction:                network.SecurityRuleDirectionInbound,
		},
	}
}
1242954
func (rootCA RootCA) CreateSecurityConfig(ctx context.Context, krw *KeyReadWriter, config CertificateRequestConfig) (*SecurityConfig, func() error, error) {
	ctx = log.WithModule(ctx, "tls")

	// Create a new random ID for this certificate
	cn := identity.NewID()
	org := config.Organization
	if config.Organization == "" {
		org = identity.NewID()
	}

	proposedRole := ManagerRole
	tlsKeyPair, issuerInfo, err := rootCA.IssueAndSaveNewCertificates(krw, cn, proposedRole, org)
	switch errors.Cause(err) {
	case ErrNoValidSigner:
		config.RetryInterval = GetCertRetryInterval
		// Request certificate issuance from a remote CA.
		// Last argument is nil because at this point we don't have any valid TLS creds
		tlsKeyPair, issuerInfo, err = rootCA.RequestAndSaveNewCertificates(ctx, krw, config)
		if err != nil {
			log.G(ctx).WithError(err).Error("failed to request and save new certificate")
			return nil, nil, err
		}
	case nil:
		log.G(ctx).WithFields(logrus.Fields{
			"node.id":   cn,
			"node.role": proposedRole,
		}).Debug("issued new TLS certificate")
	default:
		log.G(ctx).WithFields(logrus.Fields{
			"node.id":   cn,
			"node.role": proposedRole,
		}).WithError(err).Errorf("failed to issue and save new certificate")
		return nil, nil, err
	}

	secConfig, cleanup, err := NewSecurityConfig(&rootCA, krw, tlsKeyPair, issuerInfo)
	if err == nil {
		log.G(ctx).WithFields(logrus.Fields{
			"node.id":   secConfig.ClientTLSCreds.NodeID(),
			"node.role": secConfig.ClientTLSCreds.Role(),
		}).Debugf("new node credentials generated: %s", krw.Target())
	}
	return secConfig, cleanup, err
}
102573
func (s *CreateLaunchConfigurationInput) SetSecurityGroups(v []*string) *CreateLaunchConfigurationInput {
	s.SecurityGroups = v
	return s
}
1178766
func NewSystemConfig() *SystemConfig {

	return &SystemConfig{
		AARFlowStatsInterval:            30,
		AARProbeStatsInterval:           30,
		ACLAllowOrigin:                  "*",
		ECMPCount:                       1,
		LDAPSyncInterval:                600,
		LDAPTrustStoreCertifcate:        "/usr/lib/jvm/java-8-oracle/jre/lib/security/cacerts",
		LDAPTrustStorePassword:          "changeit",
		ADGatewayPurgeTime:              7200,
		RDLowerLimit:                    0,
		RDPublicNetworkLowerLimit:       0,
		RDPublicNetworkUpperLimit:       65535,
		RDUpperLimit:                    65535,
		ZFBRequestRetryTimer:            30,
		ZFBSchedulerStaleRequestTimeout: 1440,
		PGIDLowerLimit:                  65536,
		PGIDUpperLimit:                  2147483647,
		DHCPOptionSize:                  16,
		VLANIDLowerLimit:                0,
		VLANIDUpperLimit:                0,
		VMCacheSize:                     5000,
		VMPurgeTime:                     60,
		VMResyncDeletionWaitTime:        2,
		VMResyncOutstandingInterval:     1000,
		VMUnreachableCleanupTime:        7200,
		VMUnreachableTime:               3600,
		VNFTaskTimeout:                  3600,
		VNIDLowerLimit:                  1,
		VNIDPublicNetworkLowerLimit:     1,
		VNIDPublicNetworkUpperLimit:     16777215,
		VNIDUpperLimit:                  1048575,
		APIKeyRenewalInterval:           300,
		APIKeyValidity:                  86400,
		VPortInitStatefulTimer:          300,
		LRUCacheSizePerSubnet:           32,
		VSDReadOnlyMode:                 false,
		NSGUplinkHoldDownTimer:          5,
		ASNumber:                        65534,
		VSSStatsInterval:                30,
		RTLowerLimit:                    0,
		RTPublicNetworkLowerLimit:       0,
		RTPublicNetworkUpperLimit:       65535,
		RTUpperLimit:                    65535,
		EVPNBGPCommunityTagASNumber:     65534,
		EVPNBGPCommunityTagLowerLimit:   0,
		EVPNBGPCommunityTagUpperLimit:   65535,
		PageMaxSize:                     500,
		PageSize:                        50,
		GatewayProbeInterval:            5,
		GatewayProbeWindow:              120,
		GatewayRebalancingInterval:      600,
		MaxResponse:                     500,
		AccumulateLicensesEnabled:       false,
		PerDomainVlanIdEnabled:          false,
		ServiceIDUpperLimit:             2147483648,
		OffsetCustomerID:                10000,
		OffsetServiceID:                 20001,
		VirtualFirewallRulesEnabled:     false,
		EjbcaNSGCertificateProfile:      "VSPClient",
		EjbcaNSGEndEntityProfile:        "NSG",
		EjbcaOCSPResponderCN:            "ocspsigner",
		EjbcaOCSPResponderURI:           "http://localhost:7080/ejbca/publicweb/status/ocsp",
		EjbcaVspRootCa:                  "VSPCA",
		AlarmsMaxPerObject:              10,
		ElasticClusterName:              "nuage_elasticsearch",
		AllowEnterpriseAvatarOnNSG:      true,
		ImportedSaaSApplicationsVersion: "1.0",
		InactiveTimeout:                 600000,
		InfrastructureBGPASNumber:       65500,
		PostProcessorThreadsCount:       20,
		NsgBootstrapEndpoint:            "https://proxy-bootstrap:12443/nuage/api",
		NsgConfigEndpoint:               "https://{proxyDNSName}:11443/nuage/api",
		NsgLocalUiUrl:                   "http://registration.nsg",
		EsiID:                           10000,
		CsprootAuthenticationMethod:     "LOCAL",
		StackTraceEnabled:               false,
		StatefulACLNonTCPTimeout:        180,
		StatefulACLTCPTimeout:           3600,
		StaticWANServicePurgeTime:       3600,
		StatsCollectorAddress:           "localhost",
		StatsCollectorPort:              "29090",
		StatsCollectorProtoBufPort:      "39090",
		StatsMaxDataPoints:              10000,
		StatsMinDuration:                2592000,
		StatsNumberOfDataPoints:         30,
		StatsTSDBServerAddress:          "localhost:9300",
		StickyECMPIdleTimeout:           0,
		AttachProbeToIPsecNPM:           true,
		AttachProbeToVXLANNPM:           true,
		SubnetResyncInterval:            10,
		SubnetResyncOutstandingInterval: 20,
		CustomerIDUpperLimit:            2147483647,
		AvatarBasePath:                  "/opt/vsd/jboss/standalone/deployments/CloudMgmt-web.war",
		AvatarBaseURL:                   "https://localhost:8443",
		EventLogCleanupInterval:         3600,
		EventLogEntryMaxAge:             7,
		EventProcessorInterval:          250,
		EventProcessorMaxEventsCount:    100,
		EventProcessorTimeout:           25000,
		TwoFactorCodeExpiry:             300,
		TwoFactorCodeLength:             6,
		TwoFactorCodeSeedLength:         96,
		DynamicWANServiceDiffTime:       1,
		SyslogDestinationHost:           "http://localhost",
		SysmonCleanupTaskInterval:       20,
		SysmonNodePresenceTimeout:       3600,
		SysmonProbeResponseTimeout:      30,
	}
}
482220
func newSecrets(c *CoreClient, namespace string) *secrets {
	return &secrets{
		client: c,
		ns:     namespace,
	}
}
741818
func (s *GetSecurityConfigurationsOutput) SetSecurityConfigurations(v []*SecurityConfiguration) *GetSecurityConfigurationsOutput {
	s.SecurityConfigurations = v
	return s
}
460639
func NewSecureCookie(secret, name string, val string, age ...int64) *http.Cookie {
	var buf bytes.Buffer
	encoder := base64.NewEncoder(base64.StdEncoding, &buf)
	encoder.Write([]byte(val))
	encoder.Close()

	cookie := secCookieValue(secret, buf.Bytes())
	return NewCookie(name, cookie, age...)
}