Missing and incomplete ACL checks in the SDN API

Details

Several permission checks in the SDN API were incomplete, wrong or missing:

IPAM: the zone parameter was used for ACL checks, instead of the parent VNet zone.

Subnets: the vnet parameter was not checked against the subnet's parent VNet.

VNets: the target zone's ACLs were not checked when moving a VNet from one zone to another.

The permission checks when querying the running or pending SDN configuration were done using the current configuration, which might contain different entities with different ACLs.

The existence of zones, VNets and subnets was revealed via error messages, even if the querying user does not have access to them.

It was not, but is now required to have the SDN.Use or SDN.Allocate privilege on DNS and IPAM plugins, controllers, fabrics, route maps and prefix lists for referencing them in zones, controllers, fabrics and route maps. Users who manage zones may need this privilege added, for example on '/sdn/ipams/pve' for the default IPAM.

Some of these issues were privately reported by Geoffrey McClinsey <[email protected]>.

Fixed in

• libpve-network-api-perl >= 1.6.8