yahoo-eng-team team mailing list archive

[Rajkumar <rajkumart@xxxxxx>]

Public bug reported:

DESCRIPTION: 
 
Shared attribute is not shown when creating firewall.
I understand that, admin can only create shared firewall since it will affect other tenants also
In that case, creating shared firewall is prohibited correctly however I am able to update the firewall from tenant by shared = true
This should not be allowed
 
Steps to Reproduce: 
 
root@IGA-OSC:~# fwc 7436f673-e1e8-4acf-b8a2-38e70a020105 --name f2 --shared true
Invalid values_specs true
root@IGA-OSC:~# fwc 7436f673-e1e8-4acf-b8a2-38e70a020105 --name f2 --shared false
Invalid values_specs false
root@IGA-OSC:~# fwc 7436f673-e1e8-4acf-b8a2-38e70a020105 --name f2 --shared
{"NeutronError": {"message": "Policy doesn't allow create_firewall to be performed.", "type": "PolicyNotAuthorized", "detail": ""}}
root@IGA-OSC:~# fwc 7436f673-e1e8-4acf-b8a2-38e70a020105 --name f2
Created a new firewall:
+--------------------+--------------------------------------+
| Field              | Value                                |
+--------------------+--------------------------------------+
| admin_state_up     | True                                 |
| description        |                                      |
| firewall_policy_id | 7436f673-e1e8-4acf-b8a2-38e70a020105 |
| id                 | 476dfe06-07f0-404b-8e92-aae953257af9 |
| name               | f2                                   |
| status             | PENDING_CREATE                       |
| tenant_id          | bf4fbb928d574829855ebfd9e5d0e58c     |
+--------------------+--------------------------------------+
root@IGA-OSC:~# fwu f2 --shared true --------------------------------------------------------------------> able to update
Updated firewall: f2
root@IGA-OSC:~# fws f2
+--------------------+--------------------------------------+
| Field              | Value                                |
+--------------------+--------------------------------------+
| admin_state_up     | True                                 |
| description        |                                      |
| firewall_policy_id | 7436f673-e1e8-4acf-b8a2-38e70a020105 |
| id                 | 476dfe06-07f0-404b-8e92-aae953257af9 |
| name               | f2                                   |
| status             | ACTIVE                               |
| tenant_id          | bf4fbb928d574829855ebfd9e5d0e58c     |
+--------------------+--------------------------------------+

Actual Results: 
Able to update the shared attribute of tenant's firewall
Expected Results: 
tenant's firewall should not be able to update the shared attribute

** Affects: neutron
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1323322

Title:
  fwaas:shrared attribute of tenant's firewall should not have the
  option to update

Status in OpenStack Neutron (virtual network service):
  New

Bug description:
  DESCRIPTION: 
   
  Shared attribute is not shown when creating firewall.
  I understand that, admin can only create shared firewall since it will affect other tenants also
  In that case, creating shared firewall is prohibited correctly however I am able to update the firewall from tenant by shared = true
  This should not be allowed
   
  Steps to Reproduce: 
   
  root@IGA-OSC:~# fwc 7436f673-e1e8-4acf-b8a2-38e70a020105 --name f2 --shared true
  Invalid values_specs true
  root@IGA-OSC:~# fwc 7436f673-e1e8-4acf-b8a2-38e70a020105 --name f2 --shared false
  Invalid values_specs false
  root@IGA-OSC:~# fwc 7436f673-e1e8-4acf-b8a2-38e70a020105 --name f2 --shared
  {"NeutronError": {"message": "Policy doesn't allow create_firewall to be performed.", "type": "PolicyNotAuthorized", "detail": ""}}
  root@IGA-OSC:~# fwc 7436f673-e1e8-4acf-b8a2-38e70a020105 --name f2
  Created a new firewall:
  +--------------------+--------------------------------------+
  | Field              | Value                                |
  +--------------------+--------------------------------------+
  | admin_state_up     | True                                 |
  | description        |                                      |
  | firewall_policy_id | 7436f673-e1e8-4acf-b8a2-38e70a020105 |
  | id                 | 476dfe06-07f0-404b-8e92-aae953257af9 |
  | name               | f2                                   |
  | status             | PENDING_CREATE                       |
  | tenant_id          | bf4fbb928d574829855ebfd9e5d0e58c     |
  +--------------------+--------------------------------------+
  root@IGA-OSC:~# fwu f2 --shared true --------------------------------------------------------------------> able to update
  Updated firewall: f2
  root@IGA-OSC:~# fws f2
  +--------------------+--------------------------------------+
  | Field              | Value                                |
  +--------------------+--------------------------------------+
  | admin_state_up     | True                                 |
  | description        |                                      |
  | firewall_policy_id | 7436f673-e1e8-4acf-b8a2-38e70a020105 |
  | id                 | 476dfe06-07f0-404b-8e92-aae953257af9 |
  | name               | f2                                   |
  | status             | ACTIVE                               |
  | tenant_id          | bf4fbb928d574829855ebfd9e5d0e58c     |
  +--------------------+--------------------------------------+

  Actual Results: 
  Able to update the shared attribute of tenant's firewall
  Expected Results: 
  tenant's firewall should not be able to update the shared attribute

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1323322/+subscriptions