proxmox-mirrors/pve-manager
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-manager synced 2025-10-04 17:38:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

api2: network: anybridge: re-add regular bridges

Browse Source 
commit 89d146f207 introduced permission
checks here that caused all regular bridges to be removed from the
returned list as soon as the SDN package is installed, unless the user
is root@pam or there exists a VNET with the same ID.

this is arguably a breaking change, so limit the priv check to actually
defined VNETs for the time being, and add ALL regular bridges
uncondtionally like before.

get_local_vnets already filters by the same prvs, so we need to get the
full config to find out which IDs are VNETs and which are not.

once/iff we introduce ACL paths for *all* bridges in the future, we can
limit accordingly here.

CC: Alexandre Derumier <aderumier@odiso.com>
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
This commit is contained in:
Fabian Grünbichler 2022-04-27 13:36:00 +02:00 committed by Thomas Lamprecht
parent ca65e09904
commit c971330601
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
PVE/API2/Network.pm
View File

@ -240,13 +240,16 @@ __PACKAGE__->register_method({
if (my $tfilter = $param->{type}) { if (my $tfilter = $param->{type}) {
my $vnets; my $vnets;
my $vnet_cfg;
my $can_access_vnet = sub { # only matters for the $have_sdn case, checked implict my $can_access_vnet = sub { # only matters for the $have_sdn case, checked implict
return 1 if $authuser eq 'root@pam' || !defined($vnets); return 1 if $authuser eq 'root@pam' || !defined($vnets);
return 1 if !defined(PVE::Network::SDN::Vnets::sdn_vnets_config($vnet_cfg, $_[0], 1)); # not a vnet
$rpcenv->check_any($authuser, "/sdn/vnets/$_[0]", ['SDN.Audit', 'SDN.Allocate'], 1) $rpcenv->check_any($authuser, "/sdn/vnets/$_[0]", ['SDN.Audit', 'SDN.Allocate'], 1)
}; };
if ($have_sdn && $param->{type} eq 'any_bridge') { if ($have_sdn && $param->{type} eq 'any_bridge') {
$vnets = PVE::Network::SDN::get_local_vnets(); # returns already access-filtered $vnets = PVE::Network::SDN::get_local_vnets(); # returns already access-filtered
$vnet_cfg = PVE::Network::SDN::Vnets::config();
} }
for my $k (sort keys $ifaces->%*) { for my $k (sort keys $ifaces->%*) {