Skip to content

Check the network access when deploying VM in Advanced Security Group. #6050

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nvazquez merged 3 commits into from
Mar 6, 2022
Merged

Check the network access when deploying VM in Advanced Security Group. #6050

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8614ca8
Check the network access when deploying VM in Advanced Security Group.
sureshanaparti Mar 1, 2022
68370cc
Removed comment
sureshanaparti Mar 1, 2022
fec436b
Removed redundant network access check, owner access check already ex…
sureshanaparti Mar 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 4 additions & 7 deletions server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1409,9 +1409,6 @@ public UserVm addNicToVirtualMachine(AddNicToVMCmd cmd) throws InvalidParameterV
throw new CloudRuntimeException("Zone " + vmInstance.getDataCenterId() + ", has a NetworkType of Basic. Can't add a new NIC to a VM on a Basic Network");
}

// Perform account permission check on network
_accountMgr.checkAccess(caller, AccessType.UseEntry, false, network);

//ensure network belongs in zone
if (network.getDataCenterId() != vmInstance.getDataCenterId()) {
throw new CloudRuntimeException(vmInstance + " is in zone:" + vmInstance.getDataCenterId() + " but " + network + " is in zone:" + network.getDataCenterId());
Expand Down Expand Up @@ -3533,6 +3530,8 @@ public UserVm createAdvancedSecurityGroupVirtualMachine(DataCenter zone, Service
throw new InvalidParameterValueException("Network is not security group enabled: " + network.getId());
}

_accountMgr.checkAccess(owner, AccessType.UseEntry, false, network);

networkList.add(network);
}
isSecurityGroupEnabledNetworkUsed = true;
Expand All @@ -3555,10 +3554,8 @@ public UserVm createAdvancedSecurityGroupVirtualMachine(DataCenter zone, Service
throw new InvalidParameterValueException("Can specify only Shared Guest networks when" + " deploy vm in Advance Security Group enabled zone");
}

// Perform account permission check
if (network.getAclType() == ACLType.Account) {
_accountMgr.checkAccess(caller, AccessType.UseEntry, false, network);
}
_accountMgr.checkAccess(owner, AccessType.UseEntry, false, network);

networkList.add(network);
}
}
Expand Down