Add access control filtering of network objects

Ensure that all APIs which list network objects filter
them against the access control system.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index 2b4845ca995054d2e2856b0af47a08c32ebb6874..64fd581f03bc06134f75819cf699c2d9e3f6f611 100644 (file)
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -4289,10 +4289,11 @@ virNetworkMatch(virNetworkObjPtr netobj,
 #undef MATCH
 
 int
-virNetworkList(virConnectPtr conn,
-               virNetworkObjList netobjs,
-               virNetworkPtr **nets,
-               unsigned int flags)
+virNetworkObjListExport(virConnectPtr conn,
+                        virNetworkObjList netobjs,
+                        virNetworkPtr **nets,
+                        virNetworkObjListFilter filter,
+                        unsigned int flags)
 {
     virNetworkPtr *tmp_nets = NULL;
     virNetworkPtr net = NULL;
@@ -4310,7 +4311,8 @@ virNetworkList(virConnectPtr conn,
     for (i = 0; i < netobjs.count; i++) {
         virNetworkObjPtr netobj = netobjs.objs[i];
         virNetworkObjLock(netobj);
-        if (virNetworkMatch(netobj, flags)) {
+        if ((!filter || filter(conn, netobj->def)) &&
+            virNetworkMatch(netobj, flags)) {
             if (nets) {
                 if (!(net = virGetNetwork(conn,
                                           netobj->def->name,

diff --git a/src/conf/network_conf.h b/src/conf/network_conf.h
index 43f80d4ebdbb85c0a239d489d6bdd0dcf58ee706..a1d3282db4a0efd9cf9db90bb0a550887338873d 100644 (file)
--- a/src/conf/network_conf.h
+++ b/src/conf/network_conf.h
@@ -296,6 +296,10 @@ void virNetworkDefFree(virNetworkDefPtr def);
 void virNetworkObjFree(virNetworkObjPtr net);
 void virNetworkObjListFree(virNetworkObjListPtr vms);
 
+
+typedef bool (*virNetworkObjListFilter)(virConnectPtr conn,
+                                        virNetworkDefPtr def);
+
 virNetworkObjPtr virNetworkAssignDef(virNetworkObjListPtr nets,
                                      const virNetworkDefPtr def,
                                      bool live);
@@ -417,9 +421,10 @@ VIR_ENUM_DECL(virNetworkForward)
                  VIR_CONNECT_LIST_NETWORKS_FILTERS_PERSISTENT | \
                  VIR_CONNECT_LIST_NETWORKS_FILTERS_AUTOSTART)
 
-int virNetworkList(virConnectPtr conn,
-                   virNetworkObjList netobjs,
-                   virNetworkPtr **nets,
-                   unsigned int flags);
+int virNetworkObjListExport(virConnectPtr conn,
+                            virNetworkObjList netobjs,
+                            virNetworkPtr **nets,
+                            virNetworkObjListFilter filter,
+                            unsigned int flags);
 
 #endif /* __NETWORK_CONF_H__ */

diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 281478fe60ad8a199cb07383c57e18cf1698f7b5..18437328d366cbb964ba858e6eecca093423c9d6 100644 (file)
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -495,13 +495,13 @@ virNetworkFindByUUID;
 virNetworkForwardTypeToString;
 virNetworkIpDefNetmask;
 virNetworkIpDefPrefix;
-virNetworkList;
 virNetworkLoadAllConfigs;
 virNetworkLoadAllState;
 virNetworkObjAssignDef;
 virNetworkObjFree;
 virNetworkObjGetPersistentDef;
 virNetworkObjIsDuplicate;
+virNetworkObjListExport;
 virNetworkObjListFree;
 virNetworkObjLock;
 virNetworkObjReplacePersistentDef;

diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index 2d7790b3171909c5d4cc6ea8d4a0bfdcb66c6ceb..d7e90ac89c07a9757488d16f4e8f3f8409ed6c6c 100644 (file)
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -2844,10 +2844,12 @@ static int networkConnectNumOfNetworks(virConnectPtr conn) {
 
     networkDriverLock(driver);
     for (i = 0; i < driver->networks.count; i++) {
-        virNetworkObjLock(driver->networks.objs[i]);
-        if (virNetworkObjIsActive(driver->networks.objs[i]))
+        virNetworkObjPtr obj = driver->networks.objs[i];
+        virNetworkObjLock(obj);
+        if (virConnectNumOfNetworksCheckACL(conn, obj->def) &&
+            virNetworkObjIsActive(obj))
             nactive++;
-        virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjUnlock(obj);
     }
     networkDriverUnlock(driver);
 
@@ -2863,15 +2865,17 @@ static int networkConnectListNetworks(virConnectPtr conn, char **const names, in
 
     networkDriverLock(driver);
     for (i = 0; i < driver->networks.count && got < nnames; i++) {
-        virNetworkObjLock(driver->networks.objs[i]);
-        if (virNetworkObjIsActive(driver->networks.objs[i])) {
-            if (VIR_STRDUP(names[got], driver->networks.objs[i]->def->name) < 0) {
-                virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjPtr obj = driver->networks.objs[i];
+        virNetworkObjLock(obj);
+        if (virConnectListNetworksCheckACL(conn, obj->def) &&
+            virNetworkObjIsActive(obj)) {
+            if (VIR_STRDUP(names[got], obj->def->name) < 0) {
+                virNetworkObjUnlock(obj);
                 goto cleanup;
             }
             got++;
         }
-        virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjUnlock(obj);
     }
     networkDriverUnlock(driver);
 
@@ -2893,10 +2897,12 @@ static int networkConnectNumOfDefinedNetworks(virConnectPtr conn) {
 
     networkDriverLock(driver);
     for (i = 0; i < driver->networks.count; i++) {
-        virNetworkObjLock(driver->networks.objs[i]);
-        if (!virNetworkObjIsActive(driver->networks.objs[i]))
+        virNetworkObjPtr obj = driver->networks.objs[i];
+        virNetworkObjLock(obj);
+        if (virConnectNumOfDefinedNetworksCheckACL(conn, obj->def) &&
+            !virNetworkObjIsActive(obj))
             ninactive++;
-        virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjUnlock(obj);
     }
     networkDriverUnlock(driver);
 
@@ -2912,15 +2918,17 @@ static int networkConnectListDefinedNetworks(virConnectPtr conn, char **const na
 
     networkDriverLock(driver);
     for (i = 0; i < driver->networks.count && got < nnames; i++) {
-        virNetworkObjLock(driver->networks.objs[i]);
-        if (!virNetworkObjIsActive(driver->networks.objs[i])) {
-            if (VIR_STRDUP(names[got], driver->networks.objs[i]->def->name) < 0) {
-                virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjPtr obj = driver->networks.objs[i];
+        virNetworkObjLock(obj);
+        if (virConnectListDefinedNetworksCheckACL(conn, obj->def) &&
+            !virNetworkObjIsActive(obj)) {
+            if (VIR_STRDUP(names[got], obj->def->name) < 0) {
+                virNetworkObjUnlock(obj);
                 goto cleanup;
             }
             got++;
         }
-        virNetworkObjUnlock(driver->networks.objs[i]);
+        virNetworkObjUnlock(obj);
     }
     networkDriverUnlock(driver);
     return got;
@@ -2946,7 +2954,9 @@ networkConnectListAllNetworks(virConnectPtr conn,
         goto cleanup;
 
     networkDriverLock(driver);
-    ret = virNetworkList(conn, driver->networks, nets, flags);
+    ret = virNetworkObjListExport(conn, driver->networks, nets,
+                                  virConnectListAllNetworksCheckACL,
+                                  flags);
     networkDriverUnlock(driver);
 
 cleanup:

diff --git a/src/parallels/parallels_network.c b/src/parallels/parallels_network.c
index c126e31504648007f77d8f01abb91df649ecfb6f..26a3f139279be7f0ab4eff7950d14cf0167d53b7 100644 (file)
--- a/src/parallels/parallels_network.c
+++ b/src/parallels/parallels_network.c
@@ -463,7 +463,7 @@ static int parallelsConnectListAllNetworks(virConnectPtr conn,
     virCheckFlags(VIR_CONNECT_LIST_NETWORKS_FILTERS_ALL, -1);
 
     parallelsDriverLock(privconn);
-    ret = virNetworkList(conn, privconn->networks, nets, flags);
+    ret = virNetworkObjListExport(conn, privconn->networks, nets, NULL, flags);
     parallelsDriverUnlock(privconn);
 
     return ret;

diff --git a/src/test/test_driver.c b/src/test/test_driver.c
index 88e23a37f898d9b852b17d2157e28ac486607887..d4c339e3cb34f31088f21ec9d13776531dbfd93e 100644 (file)
--- a/src/test/test_driver.c
+++ b/src/test/test_driver.c
@@ -3092,7 +3092,7 @@ testConnectListAllNetworks(virConnectPtr conn,
     virCheckFlags(VIR_CONNECT_LIST_NETWORKS_FILTERS_ALL, -1);
 
     testDriverLock(privconn);
-    ret = virNetworkList(conn, privconn->networks, nets, flags);
+    ret = virNetworkObjListExport(conn, privconn->networks, nets, NULL, flags);
     testDriverUnlock(privconn);
 
     return ret;