Skip to content

Commit 68542c0

Browse files
committed
[OVN] Use elevated context to retrieve subnet in router port configuration
The method ``_get_nets_and_ipv6_ra_confs_for_router_port`` can be called from a non-admin user request, when updating or creating a local router port. If the router external gateway network is "external" (as it should be) but is not explicitly shared (a network RBAC with action "access_as_shared"), the user won't retrieve the corresponding subnet. NOTE: is is *not* needed to apply both "access_as_shared" and "access_as_external" RBACs to a network. Please read c#1 in the LP bug for more context. Related-Bug: #2051831 Change-Id: I161f1a6021c0da2d0063f8cb249b3bb9d7b6d5ae (cherry picked from commit 70e51eb)
1 parent ce640c8 commit 68542c0

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

neutron/plugins/ml2/drivers/ovn/mech_driver/ovsdb/ovn_client.py

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1203,7 +1203,13 @@ def _get_nets_and_ipv6_ra_confs_for_router_port(self, context, port):
12031203

12041204
for fixed_ip in port_fixed_ips:
12051205
subnet_id = fixed_ip['subnet_id']
1206-
subnet = self._plugin.get_subnet(context, subnet_id)
1206+
# NOTE(ralonsoh): it is needed to use the "admin" context here to
1207+
# retrieve the subnet. The subnet object is not handling correctly
1208+
# the RBAC filtering because is not filtering by
1209+
# "access_as_external", as network object is doing in
1210+
# ``_network_filter_hook``. See LP#2051831.
1211+
# TODO(ralonsoh): once LP#2051831 is fixed, remove "elevated()".
1212+
subnet = self._plugin.get_subnet(context.elevated(), subnet_id)
12071213
cidr = netaddr.IPNetwork(subnet['cidr'])
12081214
networks.add("%s/%s" % (fixed_ip['ip_address'],
12091215
str(cidr.prefixlen)))

0 commit comments

Comments
 (0)