openstack/neutron
Code Issues Proposed changes

Force security_group_id uuid validation of sg rules

Browse Source 
security_groups_db._check_security_group is supposed to check the
security_group_id of the _create_security_group_rule payload.
When using an integer e.g. 0, as security_group_id, the check
succededs because mysql accepts following query:

SELECT * FROM securitygroups WHERE id in (0)

Forcing validation of security_group_id as uuid fixes the problem

Closes-Bug: #1968343
Change-Id: I7c36b09309c1ef66608afacfb281b6f4b06ea5b8
(cherry picked from commit c0bf560fa3)
This commit is contained in:
Andrew Karpow 2022-04-08 18:32:03 +02:00 committed by Rodolfo Alonso Hernandez
parent 610b66581c
commit d1cc994da5
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
neutron/extensions/securitygroup.py
View File

@ -246,7 +246,9 @@ RESOURCE_ATTRIBUTE_MAP = {
'primary_key': True}, 'primary_key': True},
'security_group_id': {'allow_post': True, 'allow_put': False, 'security_group_id': {'allow_post': True, 'allow_put': False,
'is_visible': True, 'required_by_policy': True, 'is_visible': True, 'required_by_policy': True,
'is_sort_key': True, 'is_filter': True}, 'is_sort_key': True, 'is_filter': True,
'validate': {
'type:string': db_const.UUID_FIELD_SIZE}},
'remote_group_id': {'allow_post': True, 'allow_put': False, 'remote_group_id': {'allow_post': True, 'allow_put': False,
'default': None, 'is_visible': True, 'default': None, 'is_visible': True,
'is_sort_key': True, 'is_filter': True}, 'is_sort_key': True, 'is_filter': True},

9
neutron/tests/unit/extensions/test_securitygroup.py
View File

@ -1945,6 +1945,15 @@ class TestSecurityGroups(SecurityGroupDBTestCase):
self.deserialize(self.fmt, res) self.deserialize(self.fmt, res)
self.assertEqual(webob.exc.HTTPBadRequest.code, res.status_int) self.assertEqual(webob.exc.HTTPBadRequest.code, res.status_int)
def test_create_security_group_rule_with_non_uuid_security_group_id(self):
security_group_id = 0
rule = self._build_security_group_rule(
security_group_id, 'ingress',
const.PROTO_NAME_TCP, '22', '22')
res = self._create_security_group_rule(self.fmt, rule)
self.deserialize(self.fmt, res)
self.assertEqual(webob.exc.HTTPBadRequest.code, res.status_int)
def test_create_port_with_non_uuid(self): def test_create_port_with_non_uuid(self):
with self.network() as n: with self.network() as n:
with self.subnet(n): with self.subnet(n):