From: Elena Ezhova <eezhova@mirantis.com>
Date: Wed, 9 Jul 2014 16:10:17 +0000 (+0400)
Subject: Add rule for updating network's router:external attribute
X-Git-Url: https://review.fuel-infra.org/gitweb?a=commitdiff_plain;h=dc444960946445f2bef0b8eaab675420a29d5ba3;p=openstack-build%2Fneutron-build.git

Add rule for updating network's router:external attribute

Set admin_only rule for update_network:router:external in policy.json

Also, change the default value of router:external from attr.ATTR_NOT_SPECIFIED
to False, because each time we try to get or update a network the dict with
its attributes is extended by _extend_network_dict_l3 function which adds
router:external=False to the dict if this attribute is not specified.
Thus, if the default value is not specified, router:external is considered
to be updated in any case and the policy rule is applied.

Change-Id: I899d98c7d8c9d9863ac5d8f992b6a2d507ec4482
Closes-Bug: 1338880
---

diff --git a/etc/policy.json b/etc/policy.json
index 81fe49556..d21427cb4 100644
--- a/etc/policy.json
+++ b/etc/policy.json
@@ -39,6 +39,7 @@
     "update_network:provider:network_type": "rule:admin_only",
     "update_network:provider:physical_network": "rule:admin_only",
     "update_network:provider:segmentation_id": "rule:admin_only",
+    "update_network:router:external": "rule:admin_only",
     "delete_network": "rule:admin_or_owner",
 
     "create_port": "",
diff --git a/neutron/extensions/external_net.py b/neutron/extensions/external_net.py
index 6e50e93cb..0e24f13f6 100644
--- a/neutron/extensions/external_net.py
+++ b/neutron/extensions/external_net.py
@@ -29,7 +29,7 @@ EXTERNAL = 'router:external'
 EXTENDED_ATTRIBUTES_2_0 = {
     'networks': {EXTERNAL: {'allow_post': True,
                             'allow_put': True,
-                            'default': attr.ATTR_NOT_SPECIFIED,
+                            'default': False,
                             'is_visible': True,
                             'convert_to': attr.convert_to_boolean,
                             'enforce_policy': True,
diff --git a/neutron/tests/unit/test_extension_ext_net.py b/neutron/tests/unit/test_extension_ext_net.py
index d841670b1..fc308747c 100644
--- a/neutron/tests/unit/test_extension_ext_net.py
+++ b/neutron/tests/unit/test_extension_ext_net.py
@@ -108,6 +108,19 @@ class ExtNetDBTestCase(test_db_plugin.NeutronDbPluginV2TestCase):
         result = plugin.get_networks(ctx, filters=None)
         self.assertEqual(result, [])
 
+    def test_update_network_set_external_non_admin_fails(self):
+        # Assert that a non-admin user cannot update the
+        # router:external attribute
+        with self.network(tenant_id='noadmin') as network:
+            data = {'network': {'router:external': True}}
+            req = self.new_update_request('networks',
+                                          data,
+                                          network['network']['id'])
+            req.environ['neutron.context'] = context.Context('', 'noadmin')
+            res = req.get_response(self.api)
+            # The API layer always returns 404 on updates in place of 403
+            self.assertEqual(exc.HTTPNotFound.code, res.status_int)
+
     def test_network_filter_hook_admin_context(self):
         plugin = manager.NeutronManager.get_plugin()
         ctx = context.Context(None, None, is_admin=True)