Juniper Openstack

tempest: Router_external:True networks not visiable for Member users in other projects

Bug #1709196 reported by shajuvk
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Juniper Openstack
Status tracked in Trunk
R3.2
Fix Committed
High
Sachin Bansal
Juniper Openstack r3.2.5.0
R4.0
Fix Committed
High
Sachin Bansal
Juniper Openstack r4.0.1.0 "r4.0.1.0"
Trunk
Fix Committed
High
Sachin Bansal
Juniper Openstack r4.1.0.0-fcs "r4.1"

Bug Description

Member uses in other projects should be able to see the external True networks.

test case: test_list_external_networks
location: https://github.com/openstack/tempest/blob/master/tempest/api/network/admin/test_external_network_extension.py

neutron net-list (admin user)

+--------------------------------------+-------------------------------------------------------------------+----------------------------------------------------+
| id | name | subnets |
+--------------------------------------+-------------------------------------------------------------------+----------------------------------------------------+
| d9882d5a-e8ba-4171-890c-27aa2338d6af | tempest-test-network--758037640 | |
| b86765ea-da8d-4744-ae47-76b25f7eeaea | snat-si-left_snat_49ca4882-4ba0-4adf-88bf- | de06d3fc-e3d2-44c7-92ad-c9d45fc43061 100.64.0.0/29 |
| | 676914de042d_932f77c4-ed77-4ba1-98e2-fd52ee153db7 | |
| 363904aa-9d92-46fe-9d91-325ad1fc003e | ip-fabric | |
| 4da5d654-5cb9-4043-8562-98374f2e1344 | default-virtual-network | 5165fa12-3f1b-41e4-9e61-e6c4192c38a9 10.0.0.0/24 |
| 7d046cae-7024-4c12-8c40-390ab244b1da | rhosp10-private-cert-net | 0723495a-0994-4bb7-aded-7836baf09745 10.10.10.0/24 |
| 76df3318-857b-4e4f-ae89-cca82d8be70f | __link_local__ | |
| 96046966-7e54-4a2b-bbf7-1a425a9324dc | default-virtual-network | a754e868-3a63-4be9-80d5-e6f8bfdb7fde 10.0.0.0/24 |
| b86cb805-e504-4498-aac9-8f972fc8f159 | rhosp10-external-cert-net | 6329520f-90ea-4964-8055-7bf5f1eb7577 200.2.2.0/24 |
| b176166c-8501-465c-9b75-2c48f6c59a67 | tempest-network--1139198216 | |
| e268e4e4-da07-4a84-97ef-b487ab926489 | default-virtual-network | 7624ea79-b17f-4bc7-9db2-5003f3e5cf14 10.0.0.0/24 |
+--------------------------------------+-------------------------------------------------------------------+----------------------------------------------------+
[root@overcloud-controller-0 ~]#

neutron net-show b176166c-8501-465c-9b75-2c48f6c59a67

+-------------------------+---------------------------------------------+
| Field | Value |
+-------------------------+---------------------------------------------+
| admin_state_up | True |
| contrail:fq_name | default-domain |
| | tempest-ExternalNetworksTestJSON-1772785330 |
| | tempest-network--1139198216 |
| contrail:instance_count | 0 |
| created_at | 2017-08-07T18:52:01.255133 |
| description | |
| id | b176166c-8501-465c-9b75-2c48f6c59a67 |
| name | tempest-network--1139198216 |
| port_security_enabled | True |
| project_id | f87505f87ec24f319262f838197b9159 |
| router:external | True |
| shared | False |
| status | ACTIVE |
| subnets | |
| tenant_id | f87505f87ec24f319262f838197b9159 |
| updated_at | 2017-08-07T18:52:01.255133 |
+-------------------------+---------------------------------------------+

Neutron net-list as a member user with RWUD role, user part of different other than f87505f87ec24f319262f838197b9159

[root@overcloud-controller-0 tempest]# neutron net-list (member user in different project)
+--------------------------------------+--------------------------+----------------------------------------------------+
| id | name | subnets |
+--------------------------------------+--------------------------+----------------------------------------------------+
| 7d046cae-7024-4c12-8c40-390ab244b1da | rhosp10-private-cert-net | 0723495a-0994-4bb7-aded-7836baf09745 10.10.10.0/24 |
+--------------------------------------+--------------------------+----------------------------------------------------+

See original description
shajuvk (shajuvk)
description: updated
description: updated
information type: Proprietary → Public
Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] master

Review in progress for https://review.opencontrail.org/34395
Submitter: Sachin Bansal (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] R4.0

Review in progress for https://review.opencontrail.org/34408
Submitter: Sachin Bansal (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : A change has been merged

Reviewed: https://review.opencontrail.org/34395
Committed: http://github.com/Juniper/contrail-controller/commit/bb3707296ac091174b1b82edcba26fd2e79343d9
Submitter: Zuul (<email address hidden>)
Branch: master

commit bb3707296ac091174b1b82edcba26fd2e79343d9
Author: Sachin Bansal <email address hidden>
Date: Tue Aug 8 20:46:29 2017 -0700

Update permissions on external networks

Users outside the projet should be able to read/refer to External network.
This is how neutron treats external networks (even if they are not shared)

Also added check for ethertype conflict with prefix in SG rules

Closes-Bug: 1709196
Closes-Bug: 1709192
Change-Id: Id6a0c1a509d7663da8e5bc86f2c7c91c73d420a2

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] R3.2

Review in progress for https://review.opencontrail.org/34431
Submitter: Sachin Bansal (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : A change has been merged

Reviewed: https://review.opencontrail.org/34408
Committed: http://github.com/Juniper/contrail-controller/commit/9ea2c0e1701fd2df585bfa0434f60f19e58cf76a
Submitter: Zuul (<email address hidden>)
Branch: R4.0

commit 9ea2c0e1701fd2df585bfa0434f60f19e58cf76a
Author: Sachin Bansal <email address hidden>
Date: Tue Aug 8 20:46:29 2017 -0700

Update permissions on external networks

Users outside the projet should be able to read/refer to External network.
This is how neutron treats external networks (even if they are not shared)

Also added check for ethertype conflict with prefix in SG rules

Closes-Bug: 1709196
Closes-Bug: 1709192
Change-Id: Id6a0c1a509d7663da8e5bc86f2c7c91c73d420a2

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] R3.2

Review in progress for https://review.opencontrail.org/34431
Submitter: Sachin Bansal (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : A change has been merged

Reviewed: https://review.opencontrail.org/34431
Committed: http://github.com/Juniper/contrail-controller/commit/1ce8cd8bcb72d970d15e84e1c41f28a000571f4d
Submitter: Zuul (<email address hidden>)
Branch: R3.2

commit 1ce8cd8bcb72d970d15e84e1c41f28a000571f4d
Author: Sachin Bansal <email address hidden>
Date: Tue Aug 8 20:46:29 2017 -0700

Update permissions on external networks

Users outside the projet should be able to read/refer to External network.
This is how neutron treats external networks (even if they are not shared)

Also added check for ethertype conflict with prefix in SG rules

Closes-Bug: 1709196
Closes-Bug: 1709192
Change-Id: Id6a0c1a509d7663da8e5bc86f2c7c91c73d420a2

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.