From: "Fabian Grünbichler" <f.gruenbichler@proxmox.com>
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Subject: [pve-devel] applied: [PATCH v2 pve-guest-common 1/1] helpers : add check_vnet_access
Date: Wed, 07 Jun 2023 16:48:11 +0200 [thread overview]
Message-ID: <1686149271.9la59tywtj.astroid@yuna.none> (raw)
In-Reply-To: <20230607120357.4177891-6-aderumier@odiso.com>
applied with a small fixup, I'll write the corresponding pve-container
patch on Friday.
On June 7, 2023 2:03 pm, Alexandre Derumier wrote:
> if a tag is defined, test if user have a specific access to the vlan (or propagate from full bridge acl or zone)
> if trunks is defined, we check permissions for each vlan of the trunks
> if no tag, test if user have access to full bridge.
>
> Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
> ---
> src/PVE/GuestHelpers.pm | 49 +++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 49 insertions(+)
>
> diff --git a/src/PVE/GuestHelpers.pm b/src/PVE/GuestHelpers.pm
> index b4ccbaa..d22be1e 100644
> --- a/src/PVE/GuestHelpers.pm
> +++ b/src/PVE/GuestHelpers.pm
> @@ -10,10 +10,17 @@ use PVE::Storage;
> use POSIX qw(strftime);
> use Scalar::Util qw(weaken);
>
> +my $have_sdn;
> +eval {
> + require PVE::Network::SDN;
> + $have_sdn = 1;
> +};
> +
> use base qw(Exporter);
>
> our @EXPORT_OK = qw(
> assert_tag_permissions
> +check_vnet_access
> get_allowed_tags
> safe_boolean_ne
> safe_num_ne
> @@ -366,4 +373,46 @@ sub get_unique_tags {
> return !$no_join_result ? join(';', $res->@*) : $res;
> }
>
> +sub get_tags_from_trunk {
> + my ($trunks) = @_;
> +
> + my $res = {};
> + my @trunks_array = split /;/, $trunks;
> + for my $trunk (@trunks_array) {
> + my ($tag, $tag_end) = split /-/, $trunk;
> + if($tag_end && $tag_end > $tag) {
> + my @tags = ($tag..$tag_end);
> + $res->{$_} = 1 for @tags;
> + } else {
> + $res->{$tag} = 1;
> + }
> + }
> + return $res;
> +}
> +
> +sub check_vnet_access {
> + my ($rpcenv, $authuser, $vnet, $tag, $trunks) = @_;
> +
> + my $zone = 'localnetwork';
> +
> + if ($have_sdn) {
> + my $vnet_cfg = PVE::Network::SDN::Vnets::config();
> + if (defined(my $vnet = PVE::Network::SDN::Vnets::sdn_vnets_config($vnet_cfg, $vnet, 1))) {
> + $zone = $vnet->{zone};
> + }
> + }
> +
> + # if a tag is defined, test if user have a specific access to the vlan (or propagated from full bridge acl)
> + $rpcenv->check($authuser, "/sdn/zones/$zone/$vnet/$tag", ['SDN.Use']) if $tag;
> + # check each vlan access from trunk
> + if ($trunks) {
> + my $tags = get_tags_from_trunk($trunks);
> + for my $tag (sort keys %$tags) {
> + $rpcenv->check($authuser, "/sdn/zones/$zone/$vnet/$tag", ['SDN.Use']);
> + }
> + }
> + # if no tag, test if user have access to full bridge.
> + $rpcenv->check($authuser, "/sdn/zones/$zone/$vnet", ['SDN.Use']);
> +}
> +
> 1;
> --
> 2.30.2
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
>
>
next prev parent reply other threads:[~2023-06-07 14:48 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-07 12:03 [pve-devel] [PATCH-SERIE pve-access-control/pve-manager/pve-guest-common/qemu-server/pve-network] check permissions on local bridge Alexandre Derumier
2023-06-07 12:03 ` [pve-devel] [PATCH v2 pve-access-control 1/3] access control: add /sdn/zones/<zone>/<vnet>/<vlan> path Alexandre Derumier
2023-06-07 14:41 ` [pve-devel] applied: " Fabian Grünbichler
2023-06-07 12:03 ` [pve-devel] [PATCH v4 qemu-server 1/1] api2: add check_bridge_access for create/update/clone/restore vm Alexandre Derumier
2023-06-07 14:52 ` Fabian Grünbichler
2023-06-07 16:46 ` DERUMIER, Alexandre
2023-06-08 16:02 ` [pve-devel] applied: " Thomas Lamprecht
2023-06-09 7:00 ` DERUMIER, Alexandre
2023-06-09 7:14 ` DERUMIER, Alexandre
2023-06-09 7:29 ` Thomas Lamprecht
2023-06-09 8:28 ` DERUMIER, Alexandre
2023-06-09 7:26 ` Thomas Lamprecht
2023-06-07 12:03 ` [pve-devel] [PATCH v3 pve-manager 1/4] api2: network: check permissions for local bridges Alexandre Derumier
2023-06-07 14:45 ` [pve-devel] applied: " Fabian Grünbichler
2023-06-07 12:03 ` [pve-devel] [PATCH pve-network 1/1] get_local_vnets: fix permission path && perm Alexandre Derumier
2023-06-07 14:56 ` Fabian Grünbichler
2023-06-07 16:27 ` DERUMIER, Alexandre
2023-06-08 1:34 ` DERUMIER, Alexandre
2023-06-07 12:03 ` [pve-devel] [PATCH v2 pve-guest-common 1/1] helpers : add check_vnet_access Alexandre Derumier
2023-06-07 14:48 ` Fabian Grünbichler [this message]
2023-06-07 12:03 ` [pve-devel] [PATCH v3 pve-manager 2/4] api2: cluster: ressources: add "localnetwork" zone Alexandre Derumier
2023-06-07 14:44 ` Fabian Grünbichler
2023-06-07 17:18 ` DERUMIER, Alexandre
2023-06-07 12:03 ` [pve-devel] [PATCH v2 pve-access-control 2/3] rpcenvironnment: add check_sdn_bridge Alexandre Derumier
2023-06-07 14:41 ` [pve-devel] applied: " Fabian Grünbichler
2023-06-07 12:03 ` [pve-devel] [PATCH v2 pve-access-control 3/3] add new SDN.use privilege in PVESDNUser role Alexandre Derumier
2023-06-07 14:42 ` [pve-devel] applied: " Fabian Grünbichler
2023-06-07 12:03 ` [pve-devel] [PATCH v3 pve-manager 3/4] ui: add vnet permissions panel Alexandre Derumier
2023-06-07 12:03 ` [pve-devel] [PATCH v3 pve-manager 4/4] ui: add permissions management for "localnetwork" zone Alexandre Derumier
2023-06-12 14:39 ` [pve-devel] applied-series: [PATCH-SERIE pve-access-control/pve-manager/pve-guest-common/qemu-server/pve-network] check permissions on local bridge Fabian Grünbichler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1686149271.9la59tywtj.astroid@yuna.none \
--to=f.gruenbichler@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox