openstack/neutron
Code Issues Proposed changes

Merge "[S-RBAC] Fix policies for the l3_conntrack_helpers APIs" into stable/2025.1

Browse Source
This commit is contained in:
Zuul
2025-10-05 03:38:07 +00:00
committed by Gerrit Code Review
parent d119b5d594 830f03370f
commit b3db08f483
2 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
neutron/conf/policies/l3_conntrack_helper.py
View File

@@ -32,7 +32,7 @@ rules = [
name='create_router_conntrack_helper', name='create_router_conntrack_helper',
check_str=neutron_policy.policy_or( check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_MEMBER, base.ADMIN_OR_PROJECT_MEMBER,
base.RULE_PARENT_OWNER), base.PARENT_OWNER_MEMBER),
scope_types=['project'], scope_types=['project'],
description='Create a router conntrack helper', description='Create a router conntrack helper',
operations=[ operations=[
@@ -51,7 +51,7 @@ rules = [
name='get_router_conntrack_helper', name='get_router_conntrack_helper',
check_str=neutron_policy.policy_or( check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_READER, base.ADMIN_OR_PROJECT_READER,
base.RULE_PARENT_OWNER), base.PARENT_OWNER_READER),
scope_types=['project'], scope_types=['project'],
description='Get a router conntrack helper', description='Get a router conntrack helper',
operations=[ operations=[
@@ -74,7 +74,7 @@ rules = [
name='update_router_conntrack_helper', name='update_router_conntrack_helper',
check_str=neutron_policy.policy_or( check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_MEMBER, base.ADMIN_OR_PROJECT_MEMBER,
base.RULE_PARENT_OWNER), base.PARENT_OWNER_MEMBER),
scope_types=['project'], scope_types=['project'],
description='Update a router conntrack helper', description='Update a router conntrack helper',
operations=[ operations=[
@@ -93,7 +93,7 @@ rules = [
name='delete_router_conntrack_helper', name='delete_router_conntrack_helper',
check_str=neutron_policy.policy_or( check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_MEMBER, base.ADMIN_OR_PROJECT_MEMBER,
base.RULE_PARENT_OWNER), base.PARENT_OWNER_MEMBER),
scope_types=['project'], scope_types=['project'],
description='Delete a router conntrack helper', description='Delete a router conntrack helper',
operations=[ operations=[

19
neutron/tests/unit/conf/policies/test_l3_conntrack_helper.py
View File

@@ -29,18 +29,29 @@ class L3ConntrackHelperAPITestCase(base.PolicyBaseTestCase):
self.router = { self.router = {
'id': uuidutils.generate_uuid(), 'id': uuidutils.generate_uuid(),
'project_id': self.project_id} 'project_id': self.project_id}
self.alt_router = {
'id': uuidutils.generate_uuid(),
'project_id': self.alt_project_id}
self.target = { self.target = {
'project_id': self.project_id, 'project_id': self.project_id,
'router_id': self.router['id'], 'router_id': self.router['id'],
'ext_parent_router_id': self.router['id']} 'ext_parent_router_id': self.router['id']}
self.alt_target = { self.alt_target = {
'project_id': self.alt_project_id, 'project_id': self.alt_project_id,
'router_id': self.router['id'], 'router_id': self.alt_router['id'],
'ext_parent_router_id': self.router['id']} 'ext_parent_router_id': self.alt_router['id']}
routers = {
self.router['id']: self.router,
self.alt_router['id']: self.alt_router,
}
def get_router(context, router_id, fields=None):
return routers[router_id]
self.plugin_mock = mock.Mock() self.plugin_mock = mock.Mock()
self.plugin_mock.get_router.return_value = self.router self.plugin_mock.get_router.side_effect = get_router
mock.patch( mock.patch(
'neutron_lib.plugins.directory.get_plugin', 'neutron_lib.plugins.directory.get_plugin',
return_value=self.plugin_mock).start() return_value=self.plugin_mock).start()