Skip to content

Commit 6a0bda0

Browse files
author
Prachi Damle
committed
CLOUDSTACK-4337 Dedicated Resources: Zone dedicated to an account should only be visible and accessible to that account
Changes: - When listing a zone, add clause in the search to check the account_id for a dedicated zone - When listsing a zone with a domainid, add a similar clause. - DomainCheck:: checkAccess() for a zone should consider that zone can now be dediacted to a specific account and check access accordingly. Conflicts: server/src/com/cloud/api/query/vo/DataCenterJoinVO.java setup/db/db/schema-410to420.sql
1 parent 012afce commit 6a0bda0

4 files changed

Lines changed: 94 additions & 3 deletions

File tree

‎server/src/com/cloud/acl/DomainChecker.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@
2626
import org.springframework.stereotype.Component;
2727

2828
import com.cloud.dc.DataCenter;
29+
import com.cloud.dc.DedicatedResourceVO;
30+
import com.cloud.dc.dao.DedicatedResourceDao;
2931
import com.cloud.domain.Domain;
3032
import com.cloud.domain.dao.DomainDao;
3133
import com.cloud.exception.PermissionDeniedException;
@@ -53,6 +55,8 @@ public class DomainChecker extends AdapterBase implements SecurityChecker {
5355
@Inject ProjectManager _projectMgr;
5456
@Inject ProjectAccountDao _projecAccountDao;
5557
@Inject NetworkModel _networkMgr;
58+
@Inject
59+
private DedicatedResourceDao _dedicatedDao;
5660

5761
protected DomainChecker() {
5862
super();
@@ -238,6 +242,18 @@ public boolean checkAccess(Account account, DataCenter zone) throws PermissionDe
238242
//if account is normal user
239243
//check if account's domain is a child of zone's domain
240244
else if (account.getType() == Account.ACCOUNT_TYPE_NORMAL || account.getType() == Account.ACCOUNT_TYPE_PROJECT) {
245+
// if zone is dedicated to an account check that the accountId
246+
// matches.
247+
DedicatedResourceVO dedicatedZone = _dedicatedDao.findByZoneId(zone.getId());
248+
if (dedicatedZone != null) {
249+
if (dedicatedZone.getAccountId() != null) {
250+
if (dedicatedZone.getAccountId() == account.getId()) {
251+
return true;
252+
} else {
253+
return false;
254+
}
255+
}
256+
}
241257
if (account.getDomainId() == zone.getDomainId()) {
242258
return true; //zone and account at exact node
243259
} else {

‎server/src/com/cloud/api/query/QueryManagerImpl.java‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2499,11 +2499,21 @@ private Pair<List<DataCenterJoinVO>, Integer> listDataCentersInternal(ListZonesB
24992499
* List all resources due to Explicit Dedication except the
25002500
* dedicated resources of other account
25012501
*/
2502-
if (domainId != null && account.getType() == Account.ACCOUNT_TYPE_ADMIN) { //
2502+
if (domainId != null) { //
25032503
// for domainId != null // right now, we made the decision to
2504-
// only
2505-
// / list zones associated // with this domain, private zone
2504+
// only list zones associated // with this domain, private zone
25062505
sc.addAnd("domainId", SearchCriteria.Op.EQ, domainId);
2506+
2507+
if (account.getType() == Account.ACCOUNT_TYPE_NORMAL) {
2508+
// accountId == null (zones dedicated to a domain) or
2509+
// accountId = caller
2510+
SearchCriteria<DataCenterJoinVO> sdc = _dcJoinDao.createSearchCriteria();
2511+
sdc.addOr("accountId", SearchCriteria.Op.EQ, account.getId());
2512+
sdc.addOr("accountId", SearchCriteria.Op.NULL);
2513+
2514+
sc.addAnd("account", SearchCriteria.Op.SC, sdc);
2515+
}
2516+
25072517
} else if (account.getType() == Account.ACCOUNT_TYPE_NORMAL) {
25082518
// it was decided to return all zones for the user's domain, and
25092519
// everything above till root
@@ -2535,6 +2545,14 @@ private Pair<List<DataCenterJoinVO>, Integer> listDataCentersInternal(ListZonesB
25352545
// remove disabled zones
25362546
sc.addAnd("allocationState", SearchCriteria.Op.NEQ, Grouping.AllocationState.Disabled);
25372547

2548+
// accountId == null (zones dedicated to a domain) or
2549+
// accountId = caller
2550+
SearchCriteria<DataCenterJoinVO> sdc2 = _dcJoinDao.createSearchCriteria();
2551+
sdc2.addOr("accountId", SearchCriteria.Op.EQ, account.getId());
2552+
sdc2.addOr("accountId", SearchCriteria.Op.NULL);
2553+
2554+
sc.addAnd("account", SearchCriteria.Op.SC, sdc2);
2555+
25382556
// remove Dedicated zones not dedicated to this domainId or
25392557
// subdomainId
25402558
List<Long> dedicatedZoneIds = removeDedicatedZoneNotSuitabe(domainIds);

‎server/src/com/cloud/api/query/vo/DataCenterJoinVO.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,15 @@ public class DataCenterJoinVO extends BaseViewVO implements InternalIdentity, Id
108108
@Column(name="domain_path")
109109
private String domainPath;
110110

111+
@Column(name = "affinity_group_id")
112+
private long affinityGroupId;
113+
114+
@Column(name = "affinity_group_uuid")
115+
private String affinityGroupUuid;
116+
117+
@Column(name = "account_id")
118+
private long accountId;
119+
111120

112121
public DataCenterJoinVO() {
113122
}
@@ -303,4 +312,15 @@ public void setIp6Dns2(String ip6Dns2) {
303312
}
304313

305314

315+
public String getAffinityGroupUuid() {
316+
return affinityGroupUuid;
317+
}
318+
319+
public long getAccountId() {
320+
return accountId;
321+
}
322+
323+
public void setAccountId(long accountId) {
324+
this.accountId = accountId;
325+
}
306326
}

‎setup/db/db/schema-410to420.sql‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2338,3 +2338,40 @@ CREATE TABLE `cloud`.`ldap_configuration` (
23382338
PRIMARY KEY (`id`)
23392339
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
23402340

2341+
DROP VIEW IF EXISTS `cloud`.`data_center_view`;
2342+
CREATE VIEW `cloud`.`data_center_view` AS
2343+
select
2344+
data_center.id,
2345+
data_center.uuid,
2346+
data_center.name,
2347+
data_center.is_security_group_enabled,
2348+
data_center.is_local_storage_enabled,
2349+
data_center.description,
2350+
data_center.dns1,
2351+
data_center.dns2,
2352+
data_center.ip6_dns1,
2353+
data_center.ip6_dns2,
2354+
data_center.internal_dns1,
2355+
data_center.internal_dns2,
2356+
data_center.guest_network_cidr,
2357+
data_center.domain,
2358+
data_center.networktype,
2359+
data_center.allocation_state,
2360+
data_center.zone_token,
2361+
data_center.dhcp_provider,
2362+
data_center.removed,
2363+
domain.id domain_id,
2364+
domain.uuid domain_uuid,
2365+
domain.name domain_name,
2366+
domain.path domain_path,
2367+
dedicated_resources.affinity_group_id,
2368+
dedicated_resources.account_id,
2369+
affinity_group.uuid affinity_group_uuid
2370+
from
2371+
`cloud`.`data_center`
2372+
left join
2373+
`cloud`.`domain` ON data_center.domain_id = domain.id
2374+
left join
2375+
`cloud`.`dedicated_resources` ON data_center.id = dedicated_resources.data_center_id
2376+
left join
2377+
`cloud`.`affinity_group` ON dedicated_resources.affinity_group_id = affinity_group.id;

0 commit comments

Comments
 (0)