rpc: add support for filtering @acls by uint params

CVE-2020-25637

Add a new field to @acl annotations for filtering by
unsigned int parameters.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>

1 files changed, 20 insertions, 1 deletions

diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl
index 6feb1c8320..590a46ef66 100755
--- a/src/rpc/gendispatch.pl
+++ b/src/rpc/gendispatch.pl
@@ -2111,10 +2111,12 @@ elsif ($mode eq "client") {
             my @acl;
             foreach (@{$acl}) {
                 my @bits = split /:/;
-                push @acl, { object => $bits[0], perm => $bits[1], flags => $bits[2] }
+                push @acl, { object => $bits[0], perm => $bits[1], flags => $bits[2],
+                             param => $bits[3], value => $bits[4] }
             }
 
             my $checkflags = 0;
+            my $paramtocheck = undef;
             for (my $i = 1 ; $i <= $#acl ; $i++) {
                 if ($acl[$i]->{object} ne $acl[0]->{object}) {
                     die "acl for '$call->{ProcName}' cannot check different objects";
@@ -2122,6 +2124,9 @@ elsif ($mode eq "client") {
                 if (defined $acl[$i]->{flags} && length $acl[$i]->{flags}) {
                     $checkflags = 1;
                 }
+                if (defined $acl[$i]->{param}) {
+                    $paramtocheck = $acl[$i]->{param};
+                }
             }
 
             my $apiname = $prefix . $call->{ProcName};
@@ -2157,6 +2162,9 @@ elsif ($mode eq "client") {
             if ($checkflags) {
                 push @argdecls, "unsigned int flags";
             }
+            if (defined $paramtocheck) {
+                push @argdecls, "unsigned int " . $paramtocheck;
+            }
 
             my $ret;
             my $pass;
@@ -2217,6 +2225,17 @@ elsif ($mode eq "client") {
                         }
                         print "        ";
                     }
+                    if (defined $acl->{param}) {
+                        my $param = $acl->{param};
+                        my $value = $acl->{value};
+                        if ($value =~ /^\!/) {
+                            $value = substr $value, 1;
+                            print "($param != ($value)) &&\n";
+                        } else {
+                            print "($param == ($value)) &&\n";
+                        }
+                        print "        ";
+                    }
                     print "(rv = $method(" . join(", ", @argvars, $perm) . ")) <= 0) {\n";
                     print "        virObjectUnref(mgr);\n";
                     if ($action eq "Ensure") {