Assign floating IP to port owned by another tenant is not override-able with RBAC policy

Bug #1853637 reported by Michael Johnson
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
neutron
New
Medium
LIU Yulong

Bug Description

In neutron/db/l3_db.py:

    def _internal_fip_assoc_data(self, context, fip, tenant_id):
        """Retrieve internal port data for floating IP.
        Retrieve information concerning the internal port where
        the floating IP should be associated to.
        """
        internal_port = self._core_plugin.get_port(context, fip['port_id'])
        if internal_port['tenant_id'] != tenant_id and not context.is_admin:
            port_id = fip['port_id']
            msg = (_('Cannot process floating IP association with '
                     'Port %s, since that port is owned by a '
                     'different tenant') % port_id)
            raise n_exc.BadRequest(resource='floatingip', msg=msg)

This code does not allow operators to override the ability to assign floating IPs to ports on another tenant using RBAC policy. It also does not allow members of the advsvc role to take this action.

This code should be fixed to use the standard neutron RBAC and allow the advsvc role to take this action.

Revision history for this message
Adam Harwell (adam-harwell) wrote :

Yep, sorry about that. :D

Miguel Lavalle (minsel)
Changed in neutron:
importance: Undecided → Medium
LIU Yulong (dragon889)
Changed in neutron:
assignee: nobody → LIU Yulong (dragon889)
Revision history for this message
Michael Johnson (johnsom) wrote :

It's in different code.

1796854 did not fix this if that is what you are implying.

Revision history for this message
William Fichtner (will-ficht) wrote :

Please correct me if I'm wrong, here the issue is, a user with advsvc role from another tenant is not able to assign Floating IP to a port not owned by him though RBAC gives him such power. Is it?

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.