From d3741d9a45a8bf3ce457f2df5d134ca805ea280c Mon Sep 17 00:00:00 2001 From: rainzm Date: Sat, 18 Jul 2020 19:33:18 +0800 Subject: [PATCH] fix: default vpc must be shared globally 1. For default vpc, prohibit private operation. 2. For default vpc, prohibit public operation without scope 'system'. --- pkg/compute/models/vpcs.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go index f10792531b..3925b3c830 100644 --- a/pkg/compute/models/vpcs.go +++ b/pkg/compute/models/vpcs.go @@ -1197,6 +1197,9 @@ func (manager *SVpcManager) ListItemExportKeys(ctx context.Context, } func (vpc *SVpc) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, input apis.PerformPublicDomainInput) (jsonutils.JSONObject, error) { + if rbacutils.String2ScopeDefault(input.Scope, rbacutils.ScopeSystem) != rbacutils.ScopeSystem { + return nil, httperrors.NewForbiddenError("For default vpc, only system level sharing can be set") + } _, err := vpc.SEnabledStatusInfrasResourceBase.PerformPublic(ctx, userCred, query, input) if err != nil { return nil, errors.Wrap(err, "SEnabledStatusInfrasResourceBase.PerformPublic") @@ -1215,6 +1218,9 @@ func (vpc *SVpc) PerformPublic(ctx context.Context, userCred mcclient.TokenCrede } func (vpc *SVpc) PerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, input apis.PerformPrivateInput) (jsonutils.JSONObject, error) { + if vpc.Id == "default" { + return nil, httperrors.NewForbiddenError("Prohibit making default vpc private") + } // perform private for all emulated wires emptyNets := true wires := vpc.GetWires()