Comment 38 for bug 1489111

Reviewed: https://review.openstack.org/221344
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=767cea23de44a963c6793ffe30ea5c6827d27a38
Submitter: Jenkins
Branch: stable/kilo

commit 767cea23de44a963c6793ffe30ea5c6827d27a38
Author: Kevin Benton <email address hidden>
Date: Tue Aug 25 22:03:27 2015 -0700

    Stop device_owner from being set to 'network:*'

    This patch adjusts the FieldCheck class in the policy engine to
    allow a regex rule. It then leverages that to prevent users from
    setting the device_owner field to anything that starts with
    'network:' on networks which they do not own.

    This policy adjustment is necessary because any ports with a
    device_owner that starts with 'network:' will not have any security
    group rules applied because it is assumed they are trusted network
    devices (e.g. router ports, DHCP ports, etc). These security rules
    include the anti-spoofing protection for DHCP, IPv6 ICMP messages,
    and IP headers.

    Without this policy adjustment, tenants can abuse this trust when
    connected to a shared network with other tenants by setting their
    VM port's device_owner field to 'network:<anything>' and hijack other
    tenants' traffic via DHCP spoofing or MAC/IP spoofing.

    Closes-Bug: #1489111
    Change-Id: Ia64cf16142e0e4be44b5b0ed72c8e00792d770f9
    (cherry picked from commit 959a2f28cbbfc309381ea9ffb55090da6fb9c78f)