Skip to content

Commit add7763

Browse files
sudo87sudo87
committed
acl related changes, fixes, mistakes
1 parent 582b687 commit add7763

18 files changed

Lines changed: 217 additions & 88 deletions

File tree

‎api/src/main/java/org/apache/cloudstack/api/command/user/dns/DeleteDnsServerCmd.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,13 +80,10 @@ public void execute() {
8080

8181
@Override
8282
public long getEntityOwnerId() {
83-
// Look up the server to find its owner.
84-
// This allows the Framework to check: Is Caller == Owner?
85-
DnsServer server = dnsProviderManager.getDnsServer(id);
83+
DnsServer server = _entityMgr.findById(DnsServer.class, id);
8684
if (server != null) {
8785
return server.getAccountId();
8886
}
89-
9087
// If server not found, return System to fail safely (or let manager handle 404)
9188
return Account.ACCOUNT_ID_SYSTEM;
9289
}

‎api/src/main/java/org/apache/cloudstack/api/command/user/dns/ListDnsRecordsCmd.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
package org.apache.cloudstack.api.command.user.dns;
1919

2020
import org.apache.cloudstack.acl.RoleType;
21-
import org.apache.cloudstack.api.ACL;
2221
import org.apache.cloudstack.api.APICommand;
2322
import org.apache.cloudstack.api.ApiConstants;
2423
import org.apache.cloudstack.api.BaseListCmd;
@@ -37,7 +36,6 @@
3736
authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
3837
public class ListDnsRecordsCmd extends BaseListCmd {
3938

40-
@ACL
4139
@Parameter(name = ApiConstants.DNS_ZONE_ID, type = CommandType.UUID, entityType = DnsZoneResponse.class, required = true,
4240
description = "ID of the DNS zone to list records from")
4341
private Long dnsZoneId;

‎api/src/main/java/org/apache/cloudstack/api/command/user/dns/ListDnsServersCmd.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
package org.apache.cloudstack.api.command.user.dns;
1919

2020
import org.apache.cloudstack.acl.RoleType;
21-
import org.apache.cloudstack.api.ACL;
2221
import org.apache.cloudstack.api.APICommand;
2322
import org.apache.cloudstack.api.ApiConstants;
2423
import org.apache.cloudstack.api.BaseListAccountResourcesCmd;
@@ -40,7 +39,6 @@ public class ListDnsServersCmd extends BaseListAccountResourcesCmd {
4039
//////////////// API Parameters /////////////////////
4140
/////////////////////////////////////////////////////
4241

43-
@ACL
4442
@Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = DnsServerResponse.class,
4543
description = "the ID of the DNS server")
4644
private Long id;

‎api/src/main/java/org/apache/cloudstack/api/command/user/dns/ListDnsZonesCmd.java‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
package org.apache.cloudstack.api.command.user.dns;
1919

2020
import org.apache.cloudstack.acl.RoleType;
21-
import org.apache.cloudstack.api.ACL;
2221
import org.apache.cloudstack.api.APICommand;
2322
import org.apache.cloudstack.api.ApiConstants;
2423
import org.apache.cloudstack.api.BaseListAccountResourcesCmd;
@@ -40,12 +39,10 @@ public class ListDnsZonesCmd extends BaseListAccountResourcesCmd {
4039
//////////////// API parameters /////////////////////
4140
/////////////////////////////////////////////////////
4241

43-
@ACL
4442
@Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = DnsZoneResponse.class,
4543
description = "List DNS zone by ID")
4644
private Long id;
4745

48-
@ACL
4946
@Parameter(name = "dnsserverid", type = CommandType.UUID, entityType = DnsServerResponse.class,
5047
description = "List DNS zones belonging to a specific DNS server")
5148
private Long dnsServerId;

‎api/src/main/java/org/apache/cloudstack/api/command/user/dns/UpdateDnsServerCmd.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,11 @@
2727
import org.apache.cloudstack.api.Parameter;
2828
import org.apache.cloudstack.api.ServerApiException;
2929
import org.apache.cloudstack.api.response.DnsServerResponse;
30-
import org.apache.cloudstack.context.CallContext;
3130
import org.apache.cloudstack.dns.DnsServer;
3231
import org.apache.commons.lang3.BooleanUtils;
3332
import org.apache.commons.lang3.StringUtils;
3433

34+
import com.cloud.user.Account;
3535
import com.cloud.utils.EnumUtils;
3636

3737
@APICommand(name = "updateDnsServer",
@@ -99,7 +99,12 @@ public String getPublicDomainSuffix() {
9999

100100
@Override
101101
public long getEntityOwnerId() {
102-
return CallContext.current().getCallingAccount().getId();
102+
DnsServer server = _entityMgr.findById(DnsServer.class, id);
103+
if (server != null) {
104+
return server.getAccountId();
105+
}
106+
// If server not found, return System to fail safely (or let manager handle 404)
107+
return Account.ACCOUNT_ID_SYSTEM;
103108
}
104109

105110
@Override

‎api/src/main/java/org/apache/cloudstack/dns/DnsProviderManager.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
import org.apache.cloudstack.api.response.DnsZoneResponse;
4040
import org.apache.cloudstack.api.response.ListResponse;
4141

42+
import com.cloud.user.Account;
4243
import com.cloud.utils.component.Manager;
4344
import com.cloud.utils.component.PluggableService;
4445

@@ -50,8 +51,6 @@ public interface DnsProviderManager extends Manager, PluggableService {
5051
boolean deleteDnsServer(DeleteDnsServerCmd cmd);
5152
DnsServerResponse createDnsServerResponse(DnsServer server);
5253

53-
DnsServer getDnsServer(Long id);
54-
5554
// Allocates the DB row (State: Inactive)
5655
DnsZone allocateDnsZone(CreateDnsZoneCmd cmd);
5756
// Calls the Plugin (State: Inactive -> Active)
@@ -78,4 +77,7 @@ public interface DnsProviderManager extends Manager, PluggableService {
7877

7978
boolean registerDnsRecordForVm(RegisterDnsRecordForVmCmd cmd);
8079
boolean removeDnsRecordForVm(RemoveDnsRecordForVmCmd cmd);
80+
81+
void checkDnsServerPermissions(Account caller, DnsServer server);
82+
void checkDnsZonePermission(Account caller, DnsZone zone);
8183
}

‎api/src/main/java/org/apache/cloudstack/dns/DnsServer.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ enum State {
4141

4242
long getAccountId();
4343

44-
boolean isPublic();
44+
boolean isPublicServer();
4545

4646
Date getCreated();
4747

plugins/dns/powerdns/src/test/java/org/apache/cloudstack/dns/DnsUtilTest.java renamed to plugins/dns/powerdns/src/test/java/org/apache/cloudstack/dns/DnsProviderUtilTest.java

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@
1717

1818
package org.apache.cloudstack.dns;
1919

20-
import static org.apache.cloudstack.dns.DnsUtil.appendPublicSuffixToZone;
21-
import static org.apache.cloudstack.dns.DnsUtil.normalizeDomain;
20+
import static org.apache.cloudstack.dns.DnsProviderUtil.appendPublicSuffixToZone;
21+
import static org.apache.cloudstack.dns.DnsProviderUtil.normalizeDomain;
2222
import static org.junit.Assert.assertEquals;
2323
import static org.junit.Assert.fail;
2424

@@ -31,16 +31,16 @@
3131
import org.junit.runners.Parameterized;
3232

3333
@RunWith(Parameterized.class)
34-
public class DnsUtilTest {
34+
public class DnsProviderUtilTest {
3535
private final String userZoneName;
3636
private final String publicSuffix;
3737
private final String expectedResult;
3838
private final boolean expectException;
3939

40-
public DnsUtilTest(String userZoneName,
41-
String publicSuffix,
42-
String expectedResult,
43-
boolean expectException) {
40+
public DnsProviderUtilTest(String userZoneName,
41+
String publicSuffix,
42+
String expectedResult,
43+
boolean expectException) {
4444
this.userZoneName = userZoneName;
4545
this.publicSuffix = publicSuffix;
4646
this.expectedResult = expectedResult;
@@ -96,8 +96,6 @@ public void testAppendPublicSuffix() {
9696
}
9797

9898
String executeAppendSuffixTest(String zoneName, String domainSuffix) {
99-
return appendPublicSuffixToZone(
100-
normalizeDomain(zoneName),
101-
normalizeDomain(domainSuffix));
99+
return appendPublicSuffixToZone(normalizeDomain(zoneName), domainSuffix);
102100
}
103101
}

‎server/src/main/java/com/cloud/acl/DomainChecker.java‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@
2828
import org.apache.cloudstack.acl.SecurityChecker;
2929
import org.apache.cloudstack.affinity.AffinityGroup;
3030
import org.apache.cloudstack.context.CallContext;
31+
import org.apache.cloudstack.dns.DnsProviderManager;
32+
import org.apache.cloudstack.dns.DnsServer;
33+
import org.apache.cloudstack.dns.DnsZone;
3134
import org.apache.cloudstack.query.QueryService;
3235
import org.apache.cloudstack.resourcedetail.dao.DiskOfferingDetailsDao;
3336
import org.springframework.stereotype.Component;
@@ -101,6 +104,8 @@ public class DomainChecker extends AdapterBase implements SecurityChecker {
101104
private ProjectDao projectDao;
102105
@Inject
103106
private AccountService accountService;
107+
@Inject
108+
private DnsProviderManager dnsProviderManager;
104109

105110
protected DomainChecker() {
106111
super();
@@ -216,7 +221,12 @@ public boolean checkAccess(Account caller, ControlledEntity entity, AccessType a
216221
_networkMgr.checkRouterPermissions(caller, (VirtualRouter)entity);
217222
} else if (entity instanceof AffinityGroup) {
218223
return false;
219-
} else {
224+
} else if (entity instanceof DnsServer) {
225+
dnsProviderManager.checkDnsServerPermissions(caller, (DnsServer) entity);
226+
} else if (entity instanceof DnsZone) {
227+
dnsProviderManager.checkDnsZonePermission(caller, (DnsZone) entity);
228+
}
229+
else {
220230
validateCallerHasAccessToEntityOwner(caller, entity, accessType);
221231
}
222232
return true;

‎server/src/main/java/com/cloud/network/firewall/FirewallManagerImpl.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,7 @@ public Pair<List<? extends FirewallRule>, Integer> listFirewallRules(IListFirewa
311311

312312
sb.and("id", sb.entity().getId(), Op.EQ);
313313
sb.and("trafficType", sb.entity().getTrafficType(), Op.EQ);
314-
sb.and("networkId", sb.entity().getNetworkId(), Op.EQ);
314+
sb.and("networkId", sb.entity().getNetworkId(), Op.EQ);
315315
sb.and("ip", sb.entity().getSourceIpAddressId(), Op.EQ);
316316
sb.and("purpose", sb.entity().getPurpose(), Op.EQ);
317317
sb.and("display", sb.entity().isDisplay(), Op.EQ);

0 commit comments

Comments
 (0)