[PATCH 2/8] Add access control filtering of network objects

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: "Daniel P. Berrange" <berrange@xxxxxxxxxx>

Ensure that all APIs which list network objects filter
them against the access control system.

Signed-off-by: Daniel P. Berrange <berrange@xxxxxxxxxx>
---
 src/conf/network_conf.c           | 12 ++++++-----
 src/conf/network_conf.h           | 13 ++++++++----
 src/libvirt_private.syms          |  2 +-
 src/network/bridge_driver.c       | 44 ++++++++++++++++++++++++---------------
 src/parallels/parallels_network.c |  2 +-
 src/test/test_driver.c            |  2 +-
 6 files changed, 46 insertions(+), 29 deletions(-)

diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index 2b4845c..64fd581 100644
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -4289,10 +4289,11 @@ virNetworkMatch(virNetworkObjPtr netobj,
 #undef MATCH
 
 int
-virNetworkList(virConnectPtr conn,
-               virNetworkObjList netobjs,
-               virNetworkPtr **nets,
-               unsigned int flags)
+virNetworkObjListExport(virConnectPtr conn,
+                        virNetworkObjList netobjs,
+                        virNetworkPtr **nets,
+                        virNetworkObjListFilter filter,
+                        unsigned int flags)
 {
     virNetworkPtr *tmp_nets = NULL;
     virNetworkPtr net = NULL;
@@ -4310,7 +4311,8 @@ virNetworkList(virConnectPtr conn,
     for (i = 0; i < netobjs.count; i++) {
         virNetworkObjPtr netobj = netobjs.objs[i];
         virNetworkObjLock(netobj);
-        if (virNetworkMatch(netobj, flags)) {
+        if ((!filter || filter(conn, netobj->def)) &&
+            virNetworkMatch(netobj, flags)) {
             if (nets) {
                 if (!(net = virGetNetwork(conn,
                                           netobj->def->name,
diff --git a/src/conf/network_conf.h b/src/conf/network_conf.h
index 43f80d4..a1d3282 100644
--- a/src/conf/network_conf.h
+++ b/src/conf/network_conf.h
@@ -296,6 +296,10 @@ void virNetworkDefFree(virNetworkDefPtr def);
 void virNetworkObjFree(virNetworkObjPtr net);
 void virNetworkObjListFree(virNetworkObjListPtr vms);
 
+
+typedef bool (*virNetworkObjListFilter)(virConnectPtr conn,
+                                        virNetworkDefPtr def);
+
 virNetworkObjPtr virNetworkAssignDef(virNetworkObjListPtr nets,
                                      const virNetworkDefPtr def,
                                      bool live);
@@ -417,9 +421,10 @@ VIR_ENUM_DECL(virNetworkForward)
                  VIR_CONNECT_LIST_NETWORKS_FILTERS_PERSISTENT | \
                  VIR_CONNECT_LIST_NETWORKS_FILTERS_AUTOSTART)
 
-int virNetworkList(virConnectPtr conn,
-                   virNetworkObjList netobjs,
-                   virNetworkPtr **nets,
-                   unsigned int flags);
+int virNetworkObjListExport(virConnectPtr conn,
+                            virNetworkObjList netobjs,
+                            virNetworkPtr **nets,
+                            virNetworkObjListFilter filter,
+                            unsigned int flags);
 
 #endif /* __NETWORK_CONF_H__ */
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index f08ac64..bd52b3d 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -495,13 +495,13 @@ virNetworkFindByUUID;
 virNetworkForwardTypeToString;
 virNetworkIpDefNetmask;
 virNetworkIpDefPrefix;
-virNetworkList;
 virNetworkLoadAllConfigs;
 virNetworkLoadAllState;
 virNetworkObjAssignDef;
 virNetworkObjFree;
 virNetworkObjGetPersistentDef;
 virNetworkObjIsDuplicate;
+virNetworkObjListExport;
 virNetworkObjListFree;
 virNetworkObjLock;
 virNetworkObjReplacePersistentDef;
diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index fb1741f..742b492 100644
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -2899,10 +2899,12 @@ static int networkConnectNumOfNetworks(virConnectPtr conn) {
 
     networkDriverLock(driver);
     for (i = 0; i < driver->networks.count; i++) {
-        virNetworkObjLock(driver->networks.objs[i]);
-        if (virNetworkObjIsActive(driver->networks.objs[i]))
+        virNetworkObjPtr obj = driver->networks.objs[i];
+        virNetworkObjLock(obj);
+        if (virConnectNumOfNetworksCheckACL(conn, obj->def) &&
+            virNetworkObjIsActive(obj))
             nactive++;
-        virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjUnlock(obj);
     }
     networkDriverUnlock(driver);
 
@@ -2918,15 +2920,17 @@ static int networkConnectListNetworks(virConnectPtr conn, char **const names, in
 
     networkDriverLock(driver);
     for (i = 0; i < driver->networks.count && got < nnames; i++) {
-        virNetworkObjLock(driver->networks.objs[i]);
-        if (virNetworkObjIsActive(driver->networks.objs[i])) {
-            if (VIR_STRDUP(names[got], driver->networks.objs[i]->def->name) < 0) {
-                virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjPtr obj = driver->networks.objs[i];
+        virNetworkObjLock(obj);
+        if (virConnectListNetworksCheckACL(conn, obj->def) &&
+            virNetworkObjIsActive(obj)) {
+            if (VIR_STRDUP(names[got], obj->def->name) < 0) {
+                virNetworkObjUnlock(obj);
                 goto cleanup;
             }
             got++;
         }
-        virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjUnlock(obj);
     }
     networkDriverUnlock(driver);
 
@@ -2948,10 +2952,12 @@ static int networkConnectNumOfDefinedNetworks(virConnectPtr conn) {
 
     networkDriverLock(driver);
     for (i = 0; i < driver->networks.count; i++) {
-        virNetworkObjLock(driver->networks.objs[i]);
-        if (!virNetworkObjIsActive(driver->networks.objs[i]))
+        virNetworkObjPtr obj = driver->networks.objs[i];
+        virNetworkObjLock(obj);
+        if (virConnectNumOfDefinedNetworksCheckACL(conn, obj->def) &&
+            !virNetworkObjIsActive(obj))
             ninactive++;
-        virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjUnlock(obj);
     }
     networkDriverUnlock(driver);
 
@@ -2967,15 +2973,17 @@ static int networkConnectListDefinedNetworks(virConnectPtr conn, char **const na
 
     networkDriverLock(driver);
     for (i = 0; i < driver->networks.count && got < nnames; i++) {
-        virNetworkObjLock(driver->networks.objs[i]);
-        if (!virNetworkObjIsActive(driver->networks.objs[i])) {
-            if (VIR_STRDUP(names[got], driver->networks.objs[i]->def->name) < 0) {
-                virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjPtr obj = driver->networks.objs[i];
+        virNetworkObjLock(obj);
+        if (virConnectListDefinedNetworksCheckACL(conn, obj->def) &&
+            !virNetworkObjIsActive(obj)) {
+            if (VIR_STRDUP(names[got], obj->def->name) < 0) {
+                virNetworkObjUnlock(obj);
                 goto cleanup;
             }
             got++;
         }
-        virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjUnlock(obj);
     }
     networkDriverUnlock(driver);
     return got;
@@ -3001,7 +3009,9 @@ networkConnectListAllNetworks(virConnectPtr conn,
         goto cleanup;
 
     networkDriverLock(driver);
-    ret = virNetworkList(conn, driver->networks, nets, flags);
+    ret = virNetworkObjListExport(conn, driver->networks, nets,
+                                  virConnectListAllNetworksCheckACL,
+                                  flags);
     networkDriverUnlock(driver);
 
 cleanup:
diff --git a/src/parallels/parallels_network.c b/src/parallels/parallels_network.c
index c126e31..26a3f13 100644
--- a/src/parallels/parallels_network.c
+++ b/src/parallels/parallels_network.c
@@ -463,7 +463,7 @@ static int parallelsConnectListAllNetworks(virConnectPtr conn,
     virCheckFlags(VIR_CONNECT_LIST_NETWORKS_FILTERS_ALL, -1);
 
     parallelsDriverLock(privconn);
-    ret = virNetworkList(conn, privconn->networks, nets, flags);
+    ret = virNetworkObjListExport(conn, privconn->networks, nets, NULL, flags);
     parallelsDriverUnlock(privconn);
 
     return ret;
diff --git a/src/test/test_driver.c b/src/test/test_driver.c
index 88e23a3..d4c339e 100644
--- a/src/test/test_driver.c
+++ b/src/test/test_driver.c
@@ -3092,7 +3092,7 @@ testConnectListAllNetworks(virConnectPtr conn,
     virCheckFlags(VIR_CONNECT_LIST_NETWORKS_FILTERS_ALL, -1);
 
     testDriverLock(privconn);
-    ret = virNetworkList(conn, privconn->networks, nets, flags);
+    ret = virNetworkObjListExport(conn, privconn->networks, nets, NULL, flags);
     testDriverUnlock(privconn);
 
     return ret;
-- 
1.8.1.4

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]