check foreign key ownership for port/subnet creation
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| neutron |
Fix Released
|
High
|
Juliano Martinez | ||
Bug Description
In F-2, Quantum got a basic authz implementation that is equivalent to what nova has. this enforces that an entity is only updated by the tenant that created it, or by an admin tenant.
However, for quantum, we actually need something more: specifically, we need to make sure that a subnet or port can only be associated with a network that is owned by the same tenant (at least in the simple use case. there are advanced use cases where a provider will want to be able to allow tenants to create ports on a network owned by the provider).
Kevin Mitchell said that the likely best way to do this would be to extend the "brain" concept in the existing policy checking code. See comments within the review for the base authz code: https:/
| dan wendlandt (danwent) wrote | #1 |
| Changed in quantum: | |
| importance: | Undecided → High |
| status: | New → Confirmed |
| milestone: | none → folsom-2 |
| Changed in quantum: | |
| assignee: | nobody → Juliano Martinez (ncode) |
| Changed in quantum: | |
| status: | Confirmed → Fix Committed |
| status: | Fix Committed → Confirmed |
| Salvatore Orlando (salvatore-orlando) wrote | #2 |
| Juliano Martinez (ncode) wrote | #3 |
| dan wendlandt (danwent) wrote | #4 |
| Juliano Martinez (ncode) wrote | #5 |
| OpenStack Infra (hudson-openstack) wrote Fix proposed to quantum (master) | #6 |
| Changed in quantum: | |
| status: | Confirmed → In Progress |
| Changed in quantum: | |
| milestone: | folsom-2 → folsom-3 |
| OpenStack Infra (hudson-openstack) wrote Fix merged to quantum (master) | #7 |
| Changed in quantum: | |
| status: | In Progress → Fix Committed |
| Changed in quantum: | |
| status: | Fix Committed → Fix Released |
| Changed in quantum: | |
| milestone: | folsom-3 → 2012.2 |
Note: this is required for a secure implementation of quantum API that is exposed to tenants. Hence, I am targeting F-2 so it stays high on the radar, though in practice F-2 won't be production complete, so this may not be done by then.