yahoo-eng-team team mailing list archive

[Launchpad Bug Tracker <1337258@xxxxxxxxxxxxxxxxxx>]

[Expired for neutron because there has been no activity for 60 days.]

** Changed in: neutron
       Status: Incomplete => Expired

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1337258

Title:
  fwaas:  Admin should not be able to share tenant's firewall

Status in neutron:
  Expired

Bug description:
  Admin should not be able to update/create the shared attribute of tenant's firewall. Since if he shared, then it will affect the traffic of other tenants.  And also member tenant is not able to update with shared as true however still he is able to update with false hence I am seeing three more issues below.
   I have seen this issue in neutron version 2014.2.dev543.g8bdc649

  1.Admin able to create firewall with shared option with tenant id
   
  root@overcloud-controller0-eq56cfdcitoq:~# fwc p1 --name f1 --tenant-id 9bc0f43fcefe46ceb1124d714467a788 --shared
  Created a new firewall:
  +--------------------+--------------------------------------+
  | Field              | Value                                |
  +--------------------+--------------------------------------+
  | admin_state_up     | True                                 |
  | description        |                                      |
  | firewall_policy_id | e16342f9-7fd9-45c1-845f-f13f0dffc0dd |
  | id                 | 44a7cf82-8606-45d9-be45-a1f5253ce6f4 |
  | name               | f1                                   |
  | status             | PENDING_CREATE                       |
  | tenant_id          | 9bc0f43fcefe46ceb1124d714467a788     |
  +--------------------+--------------------------------------+
   
  2. admin is able to update shared attribute for that tenant firewall
   
  root@overcloud-controller0-eq56cfdcitoq:~# fwu f1 --shared true
  Updated firewall: f1
  root@overcloud-controller0-eq56cfdcitoq:~# fwu f1 --shared false
  Updated firewall: f1
   
  root@overcloud-controller0-eq56cfdcitoq:~# fws f1
  +--------------------+--------------------------------------+
  | Field              | Value                                |
  +--------------------+--------------------------------------+
  | admin_state_up     | True                                 |
  | description        |                                      |
  | firewall_policy_id | e16342f9-7fd9-45c1-845f-f13f0dffc0dd |
  | id                 | 44a7cf82-8606-45d9-be45-a1f5253ce6f4 |
  | name               | f1                                   |
  | status             | ACTIVE                               |
  | tenant_id          | 9bc0f43fcefe46ceb1124d714467a788     |
  +--------------------+--------------------------------------+
  root@overcloud-controller0-eq56cfdcitoq:~# ktl
  +----------------------------------+---------+---------+
  |                id                |   name  | enabled |
  +----------------------------------+---------+---------+
  | 50b6196e426544638128f4b76ad24938 |  admin  |   True  |
  | 4ea2a3dff61142a08b231c971c075bdf | service |   True  |
  | 9bc0f43fcefe46ceb1124d714467a788 | tenant1 |   True  |
  | 5db163fb680c4030a406a4ccaa259ce4 | tenant2 |   True  |
  +----------------------------------+---------+---------+
   
  3. From tenant also, he is able to update the firewall with false. ( reference bug: 1323322)
  It should throw error like "Unrecognized attribute(s) 'shared'" instead of "resource not found"
   
  root@overcloud-controller0-eq56cfdcitoq:~# fwu f1 --shared true
  The resource could not be found.
  root@overcloud-controller0-eq56cfdcitoq:~# fwu f1 --shared false
  Updated firewall: f1

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1337258/+subscriptions