shaba/one
1
0
Fork 0
mirror of https://github.com/OpenNebula/one.git synced 2025-01-11 05:17:41 +03:00
Code Releases Wiki Activity

F #1976: Test access rights to the security groups of a VNet and its ARs

Browse Source
This commit is contained in:
juanmont 2018-04-27 16:31:12 +02:00 committed by Ruben S. Montero
parent c903345806
commit 098ce33e79
8 changed files with 61 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
include/AddressRange.h
View File

@ -372,6 +372,19 @@ public:
return security_groups;
}
/**
* Copy security groups into set
*/
void get_security_groups(set<int>& sgs)
{
std::set<int>::const_iterator it;
for (it = security_groups.begin(); it != security_groups.end(); ++it)
{
sgs.insert(*it);
}
}
/*
* add_ar from AddressRangePool needs to access the internal representation
* of the AR to include it in the ARPool template.

6
include/AddressRangePool.h
View File

@ -308,6 +308,12 @@ public:
*/
const set<int>& get_security_groups(int ar_id) const;
/**
* Gets a the security group set of all ARs
* @param sgs set with all the SG ids
*/
void get_all_security_groups(set<int>& sgs);
/**
* Generate a XML representation of the Address Range Pool
* @param sstream where the ARPool is written

6
include/VirtualNetwork.h
View File

@ -459,6 +459,12 @@ public:
*/
int get_template_attribute(const char * name, int& value, int ar_id) const;
/**
* Adds the security group of the VNet and its ARs to the given set
* @param sgs to put the sg ids in
*/
void get_security_groups(set<int> & sgs);
/**
* @return A copy of the VNET Template
*/

3
include/VirtualNetworkPool.h
View File

@ -203,7 +203,8 @@ public:
PoolObjectSQL::ObjectType ot,
VirtualMachineNic * nic,
int uid,
AuthRequest * ar);
AuthRequest * ar,
set<int> & sgs);
//--------------------------------------------------------------------------
// VNET Reservation interface

4
src/vm/VirtualMachineNic.cc
View File

@ -128,12 +128,12 @@ void VirtualMachineNic::authorize(PoolObjectSQL::ObjectType ot, int uid,
VirtualNetworkPool * vnpool = nd.get_vnpool();
SecurityGroupPool * sgpool = nd.get_secgrouppool();
vnpool->authorize_nic(ot, this, uid, ar);
set<int> sgroups;
get_security_groups(sgroups);
vnpool->authorize_nic(ot, this, uid, ar, sgroups);
for(set<int>::iterator it = sgroups.begin(); it != sgroups.end(); it++)
{
SecurityGroup * sgroup = sgpool->get(*it);

10
src/vnm/AddressRangePool.cc
View File

@ -535,6 +535,16 @@ const set<int>& AddressRangePool::get_security_groups(int ar_id) const
return it->second->get_security_groups();
}
void AddressRangePool::get_all_security_groups(set<int>& sgs)
{
map<unsigned int, AddressRange *>::const_iterator it;
for (it=ar_pool.begin(); it!=ar_pool.end(); it++)
{
it->second->get_security_groups(sgs);
}
}
/* -------------------------------------------------------------------------- */
/* -------------------------------------------------------------------------- */

18
src/vnm/VirtualNetwork.cc
View File

@ -1284,7 +1284,25 @@ int VirtualNetwork::reserve_addr_by_mac(int rid, unsigned int rsize,
return 0;
}
/* -------------------------------------------------------------------------- */
/* -------------------------------------------------------------------------- */
bool VirtualNetwork::is_reservation() const
{
return parent_vid != -1;
}
/* -------------------------------------------------------------------------- */
/* -------------------------------------------------------------------------- */
void VirtualNetwork::get_security_groups(set<int> & sgs)
{
std::set<int>::const_iterator it;
for (it = security_groups.begin(); it != security_groups.end(); it++)
{
sgs.insert(*it);
}
ar_pool.get_all_security_groups(sgs);
}

5
src/vnm/VirtualNetworkPool.cc
View File

@ -302,7 +302,8 @@ void VirtualNetworkPool::authorize_nic(
PoolObjectSQL::ObjectType ot,
VirtualMachineNic * nic,
int uid,
AuthRequest * ar)
AuthRequest * ar,
set<int> & sgs)
{
string network;
VirtualNetwork * vnet = 0;
@ -334,6 +335,8 @@ void VirtualNetworkPool::authorize_nic(
vnet->get_permissions(perm);
vnet->get_security_groups(sgs);
vnet->unlock();
ar->add_auth(AuthRequest::USE, perm);