From 13e77191516872d3d5959bdb80e47cc8d01092ce Mon Sep 17 00:00:00 2001 From: "Ruben S. Montero" Date: Wed, 29 Aug 2018 18:08:05 +0200 Subject: [PATCH] B #2374: Restricted attributes checked for attach-disk (cherry picked from commit a46b8fd1a488d9b228851e4432402231c43b1594) --- include/RequestManagerVirtualMachine.h | 12 +++ src/rm/RequestManagerVirtualMachine.cc | 130 ++++++++++++++++--------- 2 files changed, 98 insertions(+), 44 deletions(-) diff --git a/include/RequestManagerVirtualMachine.h b/include/RequestManagerVirtualMachine.h index 52e0ed3009..48f17183fc 100644 --- a/include/RequestManagerVirtualMachine.h +++ b/include/RequestManagerVirtualMachine.h @@ -221,6 +221,18 @@ public: ~VirtualMachineAttach(){}; + /** + * Process a DISK attahment request to a Virtual Machine + * @param id of the VirtualMachine + * @param tl with the new DISK description + * @param att attributes of this request + * @return ErroCode as defined in Request + */ + ErrorCode request_execute(int id, VirtualMachineTemplate& tl, + RequestAttributes& att); + +protected: + void request_execute(xmlrpc_c::paramList const& _paramList, RequestAttributes& att); }; diff --git a/src/rm/RequestManagerVirtualMachine.cc b/src/rm/RequestManagerVirtualMachine.cc index c6442cf06e..9dcb6b07a9 100644 --- a/src/rm/RequestManagerVirtualMachine.cc +++ b/src/rm/RequestManagerVirtualMachine.cc @@ -1611,51 +1611,26 @@ void VirtualMachineMonitoring::request_execute( /* -------------------------------------------------------------------------- */ /* -------------------------------------------------------------------------- */ -void VirtualMachineAttach::request_execute(xmlrpc_c::paramList const& paramList, - RequestAttributes& att) +void VirtualMachineAttach::request_execute( + xmlrpc_c::paramList const& paramList, + RequestAttributes& att) { - Nebula& nd = Nebula::instance(); - DispatchManager * dm = nd.get_dm(); + VirtualMachine * vm; + VirtualMachineTemplate tmpl; - VirtualMachineTemplate tmpl; - PoolObjectAuth vm_perms; - - VirtualMachine * vm; - - int rc; - bool volatile_disk; + int rc; int id = xmlrpc_c::value_int(paramList.getInt(1)); string str_tmpl = xmlrpc_c::value_string(paramList.getString(2)); // ------------------------------------------------------------------------- - // Parse Disk template + // Check if the VM is a Virtual Router // ------------------------------------------------------------------------- - - rc = tmpl.parse_str_or_xml(str_tmpl, att.resp_msg); - - if ( rc != 0 ) - { - failure_response(INTERNAL, att); - return; - } - - // ------------------------------------------------------------------------- - // Authorize the operation & check quotas - // ------------------------------------------------------------------------- - - if ( vm_authorization(id, 0, &tmpl, att, 0, 0, 0, auth_op) == false ) - { - return; - } - if ((vm = get_vm(id, att)) == 0) { return; } - vm->get_permissions(vm_perms); - if ( !vm->hasHistory() ) { att.resp_msg = "VM is not running in any host"; @@ -1665,13 +1640,11 @@ void VirtualMachineAttach::request_execute(xmlrpc_c::paramList const& paramList, return; } - volatile_disk = set_volatile_disk_info(vm, vm->get_ds_id(), tmpl); - if (vm->is_vrouter() && - !VirtualRouter::is_action_supported(History::DISK_ATTACH_ACTION)) + !VirtualRouter::is_action_supported(History::NIC_ATTACH_ACTION)) { att.resp_msg = "Action is not supported for virtual router VMs"; - failure_response(ACTION, att); + failure_response(Request::ACTION, att); vm->unlock(); return; @@ -1679,6 +1652,79 @@ void VirtualMachineAttach::request_execute(xmlrpc_c::paramList const& paramList, vm->unlock(); + // ------------------------------------------------------------------------- + // Parse NIC template + // ------------------------------------------------------------------------- + rc = tmpl.parse_str_or_xml(str_tmpl, att.resp_msg); + + if ( rc != 0 ) + { + failure_response(INTERNAL, att); + return; + } + + // ------------------------------------------------------------------------- + // Perform the attach + // ------------------------------------------------------------------------- + ErrorCode ec = request_execute(id, tmpl, att); + + if ( ec == SUCCESS ) + { + success_response(id, att); + } + else + { + failure_response(ec, att); + } +} + +/* -------------------------------------------------------------------------- */ +/* -------------------------------------------------------------------------- */ + +Request::ErrorCode VirtualMachineAttach::request_execute(int id, + VirtualMachineTemplate& tmpl, RequestAttributes& att) +{ + Nebula& nd = Nebula::instance(); + DispatchManager * dm = nd.get_dm(); + + PoolObjectAuth vm_perms; + + VirtualMachine * vm; + + int rc; + bool volatile_disk; + + // ------------------------------------------------------------------------- + // Authorize the operation & check quotas + // ------------------------------------------------------------------------- + + if ( vm_authorization(id, 0, &tmpl, att, 0, 0, 0, auth_op) == false ) + { + return AUTHORIZATION; + } + + if (!att.is_admin()) + { + string aname; + + if (tmpl.check_restricted(aname)) + { + att.resp_msg = "DISK includes a restricted attribute " + aname; + return AUTHORIZATION; + } + } + + if ((vm = get_vm(id, att)) == 0) + { + return NO_EXISTS; + } + + vm->get_permissions(vm_perms); + + volatile_disk = set_volatile_disk_info(vm, vm->get_ds_id(), tmpl); + + vm->unlock(); + RequestAttributes att_quota(vm_perms.uid, vm_perms.gid, att); VirtualMachineTemplate deltas(tmpl); @@ -1688,7 +1734,7 @@ void VirtualMachineAttach::request_execute(xmlrpc_c::paramList const& paramList, if (quota_resize_authorization(id, &deltas, att_quota) == false) { - return; + return AUTHORIZATION; } if (volatile_disk == false) @@ -1696,7 +1742,7 @@ void VirtualMachineAttach::request_execute(xmlrpc_c::paramList const& paramList, if ( quota_authorization(&tmpl, Quotas::IMAGE, att_quota) == false ) { quota_rollback(&deltas, Quotas::VM, att_quota); - return; + return AUTHORIZATION; } } @@ -1711,14 +1757,10 @@ void VirtualMachineAttach::request_execute(xmlrpc_c::paramList const& paramList, quota_rollback(&tmpl, Quotas::IMAGE, att_quota); } - failure_response(ACTION, att); - } - else - { - success_response(id, att); + return ACTION; } - return; + return SUCCESS; } /* -------------------------------------------------------------------------- */