openstack/neutron
Code Issues Proposed changes

Do not allow a tenant to create a default SG for another one

Browse Source 
The attempt to list security groups for a project, or any
random string, can create a default SG for it. Only allow if
privileges support it.

Closes-bug: #1988026

Change-Id: Ieef7011f48cd2188d4254ff16d90a6465bbabfe3
(cherry picked from commit 01fc2b9195f999df4d810df4ee63f77ecbc81f7e)
This commit is contained in:
Brian Haley 2022-09-01 21:13:44 -04:00
parent ac27695540
commit 733ef4f2d8
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
neutron/db/securitygroups_db.py
View File

@ -915,6 +915,10 @@ class SecurityGroupDbMixin(ext_sg.SecurityGroupPluginBase,
:returns: the default security group id for given tenant. :returns: the default security group id for given tenant.
""" """
# Do not allow a tenant to create a default SG for another one.
# See Bug 1987410.
if tenant_id != context.tenant_id and not context.is_admin:
return
if not extensions.is_extension_supported(self, 'security-group'): if not extensions.is_extension_supported(self, 'security-group'):
return return
default_group_id = self._get_default_sg_id(context, tenant_id) default_group_id = self._get_default_sg_id(context, tenant_id)

12
neutron/tests/unit/db/test_securitygroups_db.py
View File

@ -617,3 +617,15 @@ class SecurityGroupDbMixinTestCase(testlib_api.SqlTestCase):
self.mixin._ensure_default_security_group(self.ctx, 'tenant_1') self.mixin._ensure_default_security_group(self.ctx, 'tenant_1')
create_sg.assert_not_called() create_sg.assert_not_called()
get_default_sg_id.assert_not_called() get_default_sg_id.assert_not_called()
def test__ensure_default_security_group_tenant_mismatch(self):
with mock.patch.object(
self.mixin, '_get_default_sg_id') as get_default_sg_id,\
mock.patch.object(
self.mixin, 'create_security_group') as create_sg:
context = mock.Mock()
context.tenant_id = 'tenant_0'
context.is_admin = False
self.mixin._ensure_default_security_group(context, 'tenant_1')
create_sg.assert_not_called()
get_default_sg_id.assert_not_called()