From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 816539B9C6 for ; Fri, 26 May 2023 09:27:34 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 69A1DA90E for ; Fri, 26 May 2023 09:27:34 +0200 (CEST) Received: from bastionodiso.odiso.net (bastionodiso.odiso.net [185.151.191.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Fri, 26 May 2023 09:27:32 +0200 (CEST) Received: from kvmformation3.odiso.net (formationkvm3.odiso.net [10.3.94.12]) by bastionodiso.odiso.net (Postfix) with ESMTP id 3A2F87CFB; Fri, 26 May 2023 09:27:26 +0200 (CEST) Received: by kvmformation3.odiso.net (Postfix, from userid 0) id 2B1DA2E3CA2; Fri, 26 May 2023 09:27:26 +0200 (CEST) From: Alexandre Derumier To: pve-devel@lists.proxmox.com Date: Fri, 26 May 2023 09:27:20 +0200 Message-Id: <20230526072724.1605613-1-aderumier@odiso.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.022 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy HEADER_FROM_DIFFERENT_DOMAINS 0.249 From and EnvelopeFrom 2nd level mail domains are different KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [PATCH pve-manager 0/4] add vnet/localbridge permissions management X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 May 2023 07:27:34 -0000 Hi, as we has discuted some weeks ago, this patche serie introduce management of acl for vnets && local bridges I have reuse current sdn permissions path, to have common paths /sdn/vnets// where the local vmbr are in a virtual "local" zone /sdn/vnets/local/ Vlans permissions are also handled with /sdn/vnets//. if user have permissions on the zone, he have access to all vnets/vlan if user have permissions on the vnet, he have access to all vlans of the vnet if user have permissions on the vnet.tag, he have access to only the specific vlan. I have reworked the sdn zone panel from the tree, to manage permissions on displayed vnets. some screenshots: https://mutulin1.odiso.net/sdnzone-perm.png https://mutulin1.odiso.net/localzone-perm.png patch1-2: can be applied on proxmox7, so users can already add permissions before upgrade to proxmox8 patch3-4: add filtering the displayed local bridges (for proxmox8) Alexandre Derumier (4): add vnet permissions panel add permissions management for "local" network zone api2: network: check permissions for local bridges api2: network: check vlan permissions for local bridges PVE/API2/Cluster.pm | 12 ++ PVE/API2/Network.pm | 33 ++- www/manager6/Makefile | 2 + www/manager6/sdn/Browser.js | 17 +- www/manager6/sdn/VnetACLView.js | 299 +++++++++++++++++++++++++++ www/manager6/sdn/ZoneContentPanel.js | 41 ++++ www/manager6/sdn/ZoneContentView.js | 52 ++++- 7 files changed, 429 insertions(+), 27 deletions(-) create mode 100644 www/manager6/sdn/VnetACLView.js create mode 100644 www/manager6/sdn/ZoneContentPanel.js -- 2.30.2