)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":27078,"name":"Manik Bindlish","email":"manikbindlish19@gmail.com","username":"manik"},"change_message_id":"ab7e3b9a0187425f3b59c8563294d56d05809159","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add tests to cover trunks subports"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This patch set adds tests to cver the neutron subports API [0]."},{"line_number":10,"context_line":"Test adds, gets, removes trunks subports."},{"line_number":11,"context_line":"Part of \"Increase Neutron RBAC Coverage\" initiative [1]"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"3f79a3b5_5289a36c","line":9,"range":{"start_line":9,"start_character":29,"end_line":9,"end_character":33},"updated":"2018-09-28 07:16:57.000000000","message":"very nit: cver \u003e cover","commit_id":"08b54b7cfa0a22f1e0bf79ab860e5d8b4d1b434a"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"3f21ab574c148ce6dd98af687fb21446dcd64f84","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add tests to cover trunks subports"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This patch set adds tests to cver the neutron subports API [0]."},{"line_number":10,"context_line":"Test adds, gets, removes trunks subports."},{"line_number":11,"context_line":"Part of \"Increase Neutron RBAC Coverage\" initiative [1]"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"3f79a3b5_510c1a92","line":9,"range":{"start_line":9,"start_character":29,"end_line":9,"end_character":33},"in_reply_to":"3f79a3b5_5289a36c","updated":"2018-09-30 20:20:05.000000000","message":"Done","commit_id":"08b54b7cfa0a22f1e0bf79ab860e5d8b4d1b434a"}],"patrole_tempest_plugin/tests/api/network/test_trunks_rbac.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"a99000ae0412dcba818da6f4cc0f3335321a6c94","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":137,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":138,"context_line":"                                 rules\u003d[\"add_subports\"])"},{"line_number":139,"context_line":"    def test_add_subports(self):"},{"line_number":140,"context_line":"        \"\"\"Add subports."},{"line_number":141,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_419c4fbe","line":138,"updated":"2018-07-29 21:51:55.000000000","message":"I will have to double check whether this enforces get_subports first.","commit_id":"70190f9b3d4d377d0ba473af35c335f801191688"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f37da2f00032a90085498d2ad310ca4a9b239cfc","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":137,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":138,"context_line":"                                 rules\u003d[\"add_subports\"])"},{"line_number":139,"context_line":"    def test_add_subports(self):"},{"line_number":140,"context_line":"        \"\"\"Add subports."},{"line_number":141,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_6cd4c91e","line":138,"in_reply_to":"5f7c97a3_01e417de","updated":"2018-07-30 21:50:52.000000000","message":"The multi policy enforcement happens server side, not in the network tempest client code. This is difficult to validate now due to the outstanding bug.","commit_id":"70190f9b3d4d377d0ba473af35c335f801191688"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"1020632c885a5d8ffbcf5fc035b228c990509d6a","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":137,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":138,"context_line":"                                 rules\u003d[\"add_subports\"])"},{"line_number":139,"context_line":"    def test_add_subports(self):"},{"line_number":140,"context_line":"        \"\"\"Add subports."},{"line_number":141,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_a42403b3","line":138,"in_reply_to":"5f7c97a3_419c4fbe","updated":"2018-08-01 19:51:33.000000000","message":"Done","commit_id":"70190f9b3d4d377d0ba473af35c335f801191688"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"1f66dc47849d76c9771580912703231106841fa5","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":137,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":138,"context_line":"                                 rules\u003d[\"add_subports\"])"},{"line_number":139,"context_line":"    def test_add_subports(self):"},{"line_number":140,"context_line":"        \"\"\"Add subports."},{"line_number":141,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_01e417de","line":138,"in_reply_to":"5f7c97a3_419c4fbe","updated":"2018-07-29 23:04:58.000000000","message":"I still not 100% sure what is it about. But if the question is if client call \"get\" before \"put\" - here is the link to the exact place in code:\n\nhttps://github.com/openstack/neutron-tempest-plugin/blob/master/neutron_tempest_plugin/services/network/json/network_client.py#L803","commit_id":"70190f9b3d4d377d0ba473af35c335f801191688"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"8adc56100e8ca9cf179da572dc8815769519b9fc","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":137,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":138,"context_line":"                                 rules\u003d[\"add_subports\"])"},{"line_number":139,"context_line":"    def test_add_subports(self):"},{"line_number":140,"context_line":"        \"\"\"Add subports."},{"line_number":141,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_1bec55ba","line":138,"in_reply_to":"5f7c97a3_6cd4c91e","updated":"2018-07-31 18:41:40.000000000","message":"Oookay, so it\u0027s not a real call. Can you for sake of knowledge point me where it happens? Thanks!","commit_id":"70190f9b3d4d377d0ba473af35c335f801191688"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"a99000ae0412dcba818da6f4cc0f3335321a6c94","unresolved":false,"context_lines":[{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08135\u0027)"},{"line_number":160,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":161,"context_line":"                                 rules\u003d[\"remove_subports\"])"},{"line_number":162,"context_line":"    def test_remove_subports(self):"},{"line_number":163,"context_line":"        \"\"\"Remove subports."},{"line_number":164,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_e19c7bbf","line":161,"updated":"2018-07-29 21:51:55.000000000","message":"Ditto.","commit_id":"70190f9b3d4d377d0ba473af35c335f801191688"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"1020632c885a5d8ffbcf5fc035b228c990509d6a","unresolved":false,"context_lines":[{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08135\u0027)"},{"line_number":160,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":161,"context_line":"                                 rules\u003d[\"remove_subports\"])"},{"line_number":162,"context_line":"    def test_remove_subports(self):"},{"line_number":163,"context_line":"        \"\"\"Remove subports."},{"line_number":164,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_440acf1d","line":161,"in_reply_to":"5f7c97a3_e19c7bbf","updated":"2018-08-01 19:51:33.000000000","message":"Done","commit_id":"70190f9b3d4d377d0ba473af35c335f801191688"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"f31c491d93b6054904bbac24e7e1033e06b47352","unresolved":false,"context_lines":[{"line_number":118,"context_line":"        return sub[\"sub_ports\"]"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_e33b6ace","line":122,"range":{"start_line":121,"start_character":0,"end_line":122,"end_character":56},"updated":"2018-08-08 18:17:10.000000000","message":"does this need: \n\nexpected_error_codes\u003d[404] ?","commit_id":"902d49258b3307a55837229e79ee7d7a5d745f15"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"dd5c24d11f7c0d88c86391fc96b4fc91c00add2d","unresolved":false,"context_lines":[{"line_number":118,"context_line":"        return sub[\"sub_ports\"]"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_a75a3e4d","line":122,"range":{"start_line":121,"start_character":0,"end_line":122,"end_character":56},"in_reply_to":"3f79a3b5_2c2b7582","updated":"2018-08-22 06:35:46.000000000","message":"started ML for this and mainly to get review help from neutron team - http://lists.openstack.org/pipermail/openstack-dev/2018-August/133646.html","commit_id":"902d49258b3307a55837229e79ee7d7a5d745f15"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"d1740a476e4c921cfabf6d26c314c1ba6019f990","unresolved":false,"context_lines":[{"line_number":118,"context_line":"        return sub[\"sub_ports\"]"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_a31568e7","line":122,"range":{"start_line":121,"start_character":0,"end_line":122,"end_character":56},"in_reply_to":"3f79a3b5_a75a3e4d","updated":"2018-08-31 19:30:22.000000000","message":"To keep the conversation rolling:\n\nSubports not independent entity in Neutron, but rather field in Trunk object [0].\nSo only actual HTTP call that happens is `get_trunk`. Since `get_trunk` is allowed for owners [1] our HTTP request passes as expected, and no 404 error raised.\n\nSince there is no problem on that level, actual Enforcer kicks in here [2] and raises 403.\n\nIn other words test and neutron seems to act as expected.\n\n[0] https://github.com/openstack/neutron/blob/master/neutron/services/trunk/plugin.py#L390\n[1] https://github.com/openstack/neutron/blob/master/etc/policy.json#L229\n[2] https://github.com/openstack/neutron/blob/master/neutron/policy.py#L419","commit_id":"902d49258b3307a55837229e79ee7d7a5d745f15"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"4611c5346ab65bd4cea284b07e76e207ef1b35d5","unresolved":false,"context_lines":[{"line_number":118,"context_line":"        return sub[\"sub_ports\"]"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_ac6545e3","line":122,"range":{"start_line":121,"start_character":0,"end_line":122,"end_character":56},"in_reply_to":"3f79a3b5_a93470fc","updated":"2018-08-09 18:30:13.000000000","message":"I see. It\u0027s 403.\n\n{\u0027status\u0027: \u0027403\u0027, u\u0027content-length\u0027: \u0027119\u0027, \u0027content-location\u0027: \u0027http://10.0.2.15:9696/v2.0/trunks/c77fd31f-f5c3-4e41-be10-6efa61c0c5dd/get_subports\u0027, u\u0027connection\u0027: \u0027close\u0027, u\u0027date\u0027: \u0027Thu, 09 Aug 2018 18:27:56 GMT\u0027, u\u0027content-type\u0027: \u0027application/json\u0027, u\u0027x-openstack-request-id\u0027: \u0027req-20fb28a7-f47e-49e1-93bf-de4e06eaffbe\u0027}","commit_id":"902d49258b3307a55837229e79ee7d7a5d745f15"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"2e539a653b9a11b5f0fe1a2606036f9a794262cc","unresolved":false,"context_lines":[{"line_number":118,"context_line":"        return sub[\"sub_ports\"]"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_2c2b7582","line":122,"range":{"start_line":121,"start_character":0,"end_line":122,"end_character":56},"in_reply_to":"3f79a3b5_ac6545e3","updated":"2018-08-22 04:13:26.000000000","message":"from neutron doc [1] (though it is internal doc but it explain the neutron policy internals well), it seems for GET, PUT, DELETE where resource existence is checked first. If resource does not exist then 404 is return for security purpose as 403 can tell invalid user that this resource exist. \n\nBut for PUT and DELETE, it can be 403 as resource can exist but user does not have access to PUT/DELETE operation. \n\nI was discussing it with amotoki also and we thought of\n - checking 404 for GET \n - [403, 404] for PUT and DELETE.\n - later we will strict the checks of 404 and 403 separately for PUT and DELETE.\n\nis it sounds good? but anyways let\u0027s have more feedback on this from more neutron folks. I will send it to ML for broader opinion. \n\n\n[1] https://docs.openstack.org/neutron/pike/contributor/internals/policy.html#request-authorization","commit_id":"902d49258b3307a55837229e79ee7d7a5d745f15"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"c9b3871dcb4b88eb4014d65fa546c9efbe30f1b2","unresolved":false,"context_lines":[{"line_number":118,"context_line":"        return sub[\"sub_ports\"]"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_a93470fc","line":122,"range":{"start_line":121,"start_character":0,"end_line":122,"end_character":56},"in_reply_to":"3f79a3b5_ce48d2cd","updated":"2018-08-08 23:35:09.000000000","message":"@Mykola we use Patrole to validate custom overrides so the default might be \"\" but downstream we may change it to something else. So if we override it to \"rule:admin_only\" and run this test will it return a 403 or 404?","commit_id":"902d49258b3307a55837229e79ee7d7a5d745f15"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"1514e2ed48195025d79e6ea59c8ed5b50d5cfc13","unresolved":false,"context_lines":[{"line_number":118,"context_line":"        return sub[\"sub_ports\"]"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_ce48d2cd","line":122,"range":{"start_line":121,"start_character":0,"end_line":122,"end_character":56},"in_reply_to":"3f79a3b5_e33b6ace","updated":"2018-08-08 22:05:39.000000000","message":"It is empty, so it seems it does not force such rule for now:\nhttps://github.com/openstack/neutron/blob/master/etc/policy.json#L232","commit_id":"902d49258b3307a55837229e79ee7d7a5d745f15"},{"author":{"_account_id":27078,"name":"Manik Bindlish","email":"manikbindlish19@gmail.com","username":"manik"},"change_message_id":"ab7e3b9a0187425f3b59c8563294d56d05809159","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    @classmethod"},{"line_number":98,"context_line":"    def resource_setup(cls):"},{"line_number":99,"context_line":"        super(TrunksSubportsPluginRbacTest, cls).resource_setup()"},{"line_number":100,"context_line":"        cls.network \u003d cls.create_network()"},{"line_number":101,"context_line":"        cls.port_id \u003d cls.create_port(cls.network)[\"id\"]"},{"line_number":102,"context_line":"        cls.trunk_id \u003d cls.ntp_client.create_trunk("},{"line_number":103,"context_line":"            cls.port_id, [])[\u0027trunk\u0027][\u0027id\u0027]"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"3f79a3b5_92a65b0d","line":101,"range":{"start_line":100,"start_character":8,"end_line":101,"end_character":56},"updated":"2018-09-28 07:16:57.000000000","message":"Where we are cleaning the network and port id?","commit_id":"08b54b7cfa0a22f1e0bf79ab860e5d8b4d1b434a"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"3f21ab574c148ce6dd98af687fb21446dcd64f84","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    @classmethod"},{"line_number":98,"context_line":"    def resource_setup(cls):"},{"line_number":99,"context_line":"        super(TrunksSubportsPluginRbacTest, cls).resource_setup()"},{"line_number":100,"context_line":"        cls.network \u003d cls.create_network()"},{"line_number":101,"context_line":"        cls.port_id \u003d cls.create_port(cls.network)[\"id\"]"},{"line_number":102,"context_line":"        cls.trunk_id \u003d cls.ntp_client.create_trunk("},{"line_number":103,"context_line":"            cls.port_id, [])[\u0027trunk\u0027][\u0027id\u0027]"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"3f79a3b5_31071e73","line":101,"range":{"start_line":100,"start_character":8,"end_line":101,"end_character":56},"in_reply_to":"3f79a3b5_92a65b0d","updated":"2018-09-30 20:20:05.000000000","message":"Those methods are inherited from tempest.api.network.base, and their cleanup happens on tearDown step.\n\nhttps://github.com/openstack/tempest/blob/master/tempest/api/network/base.py#L107\nhttps://github.com/openstack/tempest/blob/master/tempest/api/network/base.py#L163","commit_id":"08b54b7cfa0a22f1e0bf79ab860e5d8b4d1b434a"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"b72f8a5fa0167c5580a386560e83e16828b1a5ff","unresolved":false,"context_lines":[{"line_number":152,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":153,"context_line":"            self.ntp_client.add_subports(self.trunk_id, subports)"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"        self.addCleanup("},{"line_number":156,"context_line":"            test_utils.call_and_ignore_notfound_exc,"},{"line_number":157,"context_line":"            self.ntp_client.remove_subports,"},{"line_number":158,"context_line":"            self.trunk_id, subports)"}],"source_content_type":"text/x-python","patch_set":9,"id":"3f79a3b5_e6dd006f","line":155,"updated":"2018-11-13 17:01:31.000000000","message":"Could you put this cleanup before calling override_role L151? the cleanup will not be execute in case of unexpected error raised in the override_role function","commit_id":"08b54b7cfa0a22f1e0bf79ab860e5d8b4d1b434a"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"a224536c2f9a1e0c29b8d3ea350368030ed8709f","unresolved":false,"context_lines":[{"line_number":152,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":153,"context_line":"            self.ntp_client.add_subports(self.trunk_id, subports)"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"        self.addCleanup("},{"line_number":156,"context_line":"            test_utils.call_and_ignore_notfound_exc,"},{"line_number":157,"context_line":"            self.ntp_client.remove_subports,"},{"line_number":158,"context_line":"            self.trunk_id, subports)"}],"source_content_type":"text/x-python","patch_set":9,"id":"3f79a3b5_ecfe4106","line":155,"in_reply_to":"3f79a3b5_e6dd006f","updated":"2018-11-13 19:50:30.000000000","message":"Done","commit_id":"08b54b7cfa0a22f1e0bf79ab860e5d8b4d1b434a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"ba31e1f963db75c0285519854a7c97b9dbfb577a","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"3f79a3b5_ff248cb3","line":122,"range":{"start_line":122,"start_character":41,"end_line":122,"end_character":53},"updated":"2018-11-14 22:50:27.000000000","message":"Wouldn\u0027t this return a 404 on failure? https://github.com/openstack/neutron-lib/blob/7aa78eae721c3698a0d7d59523b1353cec629650/neutron_lib/api/definitions/trunk.py#L100","commit_id":"69c9e08b453b24ef2a48973739b7f1f279c33b0b"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"7a1319521c9a347207e04da61c0c7efaed1b0d43","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"3f79a3b5_10291c82","line":122,"range":{"start_line":122,"start_character":41,"end_line":122,"end_character":53},"in_reply_to":"3f79a3b5_42182e86","updated":"2018-11-16 15:49:42.000000000","message":"Done","commit_id":"69c9e08b453b24ef2a48973739b7f1f279c33b0b"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"a12f400fdd89744a8f405834adfa29510978eccb","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"3f79a3b5_42182e86","line":122,"range":{"start_line":122,"start_character":41,"end_line":122,"end_character":53},"in_reply_to":"3f79a3b5_5f87b112","updated":"2018-11-16 14:46:51.000000000","message":"May we make a note of that since this is an unconventional case?","commit_id":"69c9e08b453b24ef2a48973739b7f1f279c33b0b"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"e5b59b645f1023b78575866b12732b715b743267","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08133\u0027)"},{"line_number":121,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":122,"context_line":"                                 rules\u003d[\"get_subports\"])"},{"line_number":123,"context_line":"    def test_get_subports(self):"},{"line_number":124,"context_line":"        \"\"\"Get subports."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"3f79a3b5_5f87b112","line":122,"range":{"start_line":122,"start_character":41,"end_line":122,"end_character":53},"in_reply_to":"3f79a3b5_ff248cb3","updated":"2018-11-15 19:23:08.000000000","message":"Subports not independent entity in Neutron, but rather field in Trunk object [0].\nSo only actual HTTP call that happens is `get_trunk`. Since `get_trunk` is allowed for owners [1] our HTTP request passes as expected, and no 404 error raised.\nSince there is no problem on that level, actual Enforcer kicks in here [2] and raises 403.\nIn other words test and neutron seems to act as expected.\n[0] https://github.com/openstack/neutron/blob/master/neutron/services/trunk/plugin.py#L390\n[1] https://github.com/openstack/neutron/blob/master/etc/policy.json#L229\n[2] https://github.com/openstack/neutron/blob/master/neutron/policy.py#L419\n\nTo have 404 in here you should change trunk rules, not subports.","commit_id":"69c9e08b453b24ef2a48973739b7f1f279c33b0b"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"ba31e1f963db75c0285519854a7c97b9dbfb577a","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":137,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":138,"context_line":"                                 rules\u003d[\"get_subports\","},{"line_number":139,"context_line":"                                        \"add_subports\"])"},{"line_number":140,"context_line":"    def test_add_subports(self):"},{"line_number":141,"context_line":"        \"\"\"Add subports."}],"source_content_type":"text/x-python","patch_set":14,"id":"3f79a3b5_9f19d877","line":138,"range":{"start_line":138,"start_character":41,"end_line":138,"end_character":53},"updated":"2018-11-14 22:50:27.000000000","message":"Ditto","commit_id":"69c9e08b453b24ef2a48973739b7f1f279c33b0b"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"ba31e1f963db75c0285519854a7c97b9dbfb577a","unresolved":false,"context_lines":[{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08135\u0027)"},{"line_number":160,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":161,"context_line":"                                 rules\u003d[\"get_subports\","},{"line_number":162,"context_line":"                                        \"remove_subports\"])"},{"line_number":163,"context_line":"    def test_remove_subports(self):"},{"line_number":164,"context_line":"        \"\"\"Remove subports."}],"source_content_type":"text/x-python","patch_set":14,"id":"3f79a3b5_bf1e145c","line":161,"range":{"start_line":161,"start_character":41,"end_line":161,"end_character":53},"updated":"2018-11-14 22:50:27.000000000","message":"Ditto","commit_id":"69c9e08b453b24ef2a48973739b7f1f279c33b0b"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"9e0fcfd7d80d897f469bdba94bf02771ac1d932b","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        self.create_subports(self.trunk_id, port[\"id\"])"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":137,"context_line":"            self.ntp_client.get_subports(self.trunk_id)"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":140,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","}],"source_content_type":"text/x-python","patch_set":15,"id":"3f79a3b5_9c0f8237","line":137,"range":{"start_line":137,"start_character":28,"end_line":137,"end_character":40},"updated":"2018-11-17 21:31:13.000000000","message":"I confirmed this raises a 403 with admin_only rule and non-admin role:\n\nForbidden\nDetails: {u\u0027message\u0027: u\u0027rule:get_subports is disallowed by policy\u0027, u\u0027type\u0027: u\u0027PolicyNotAuthorized\u0027, u\u0027detail\u0027: u\u0027\u0027}","commit_id":"f9c63be528da5c21c52b2dd9da1cf040f30b7452"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"9e0fcfd7d80d897f469bdba94bf02771ac1d932b","unresolved":false,"context_lines":[{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":140,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":141,"context_line":"                                 rules\u003d[\"get_subports\","},{"line_number":142,"context_line":"                                        \"add_subports\"])"},{"line_number":143,"context_line":"    def test_add_subports(self):"},{"line_number":144,"context_line":"        \"\"\"Add subports."}],"source_content_type":"text/x-python","patch_set":15,"id":"3f79a3b5_97019b06","line":141,"range":{"start_line":141,"start_character":41,"end_line":141,"end_character":53},"updated":"2018-11-17 21:31:13.000000000","message":"It doesn\u0027t look like this is actually enforced here because this doesn\u0027t exhibit the normal 404 look up behavior.","commit_id":"f9c63be528da5c21c52b2dd9da1cf040f30b7452"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"4374d123ea615b3eeab8f072bade41b6f8b19a6c","unresolved":false,"context_lines":[{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":140,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":141,"context_line":"                                 rules\u003d[\"get_subports\","},{"line_number":142,"context_line":"                                        \"add_subports\"])"},{"line_number":143,"context_line":"    def test_add_subports(self):"},{"line_number":144,"context_line":"        \"\"\"Add subports."}],"source_content_type":"text/x-python","patch_set":15,"id":"3f79a3b5_ceff7201","line":141,"range":{"start_line":141,"start_character":41,"end_line":141,"end_character":53},"in_reply_to":"3f79a3b5_97019b06","updated":"2018-11-19 17:07:59.000000000","message":"Should I we just drop `get_subports` from rules, or it considered as a bug and neutron should be updated first?","commit_id":"f9c63be528da5c21c52b2dd9da1cf040f30b7452"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"c95317c08806001d0196eb7d23cac779d1318407","unresolved":false,"context_lines":[{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":140,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":141,"context_line":"                                 rules\u003d[\"get_subports\","},{"line_number":142,"context_line":"                                        \"add_subports\"])"},{"line_number":143,"context_line":"    def test_add_subports(self):"},{"line_number":144,"context_line":"        \"\"\"Add subports."}],"source_content_type":"text/x-python","patch_set":15,"id":"3f79a3b5_e6d04e59","line":141,"range":{"start_line":141,"start_character":41,"end_line":141,"end_character":53},"in_reply_to":"3f79a3b5_ceff7201","updated":"2018-11-19 22:55:07.000000000","message":"I think it has something to do with the ACTION_MAP behavior here: https://github.com/openstack/neutron-lib/blob/bbdbb805a22010ef171055abb56cb27f7008bded/neutron_lib/api/definitions/trunk.py#L97\n\nI\u0027m not sure that it is a Neutron bug?\n\nWhen I tested this manually by settin get_subports to rule:admin_only I was getting Patrole errors because the test was passing but the expected result was failing -- resulting in an inconsistency.","commit_id":"f9c63be528da5c21c52b2dd9da1cf040f30b7452"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"58f6ff56fcc25d00f6b6e4a39c7d4eb0da9cd9bf","unresolved":false,"context_lines":[{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08134\u0027)"},{"line_number":140,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":141,"context_line":"                                 rules\u003d[\"get_subports\","},{"line_number":142,"context_line":"                                        \"add_subports\"])"},{"line_number":143,"context_line":"    def test_add_subports(self):"},{"line_number":144,"context_line":"        \"\"\"Add subports."}],"source_content_type":"text/x-python","patch_set":15,"id":"3f79a3b5_acd0e557","line":141,"range":{"start_line":141,"start_character":41,"end_line":141,"end_character":53},"in_reply_to":"3f79a3b5_e6d04e59","updated":"2018-11-20 19:44:13.000000000","message":"\u003e I was getting Patrole errors because the test was passing but the expected result was failing -- resulting in an inconsistency.\n\nWith current patchset and:\n\n```\nstack@tempest:~$ cat /etc/neutron/policy.json | grep subport    \n    \"add_subports\": \"rule:admin_only\",\n    \"get_subports\": \"rule:admin_only\",\n    \"remove_subports\": \"rule:admin_only\",\n\nstack@tempest:~/tempest$ cat etc/tempest.conf | grep rbac\nrbac_test_roles \u003d member\n```\n\nI have next results:\n\n```\nstack@tempest:~/tempest$ tempest -v run --debug -r patrole_tempest_plugin.tests.api.network.test_trunks_rbac.TrunksSubportsExtRbacTest\ntempest initialize_app\nprepare_to_run_command TempestRun\nDenied\n{0} patrole_tempest_plugin.tests.api.network.test_trunks_rbac.TrunksSubportsExtRbacTest.test_add_subports [4.268597s] ... ok\nDenied\n{0} patrole_tempest_plugin.tests.api.network.test_trunks_rbac.TrunksSubportsExtRbacTest.test_get_subports [4.531779s] ... ok\nDenied\n{0} patrole_tempest_plugin.tests.api.network.test_trunks_rbac.TrunksSubportsExtRbacTest.test_remove_subports [4.759251s] ... ok\n\n\u003d\u003d\u003d\u003d\u003d\u003d\nTotals\n\u003d\u003d\u003d\u003d\u003d\u003d\nRan: 3 tests in 26.0000 sec.\n - Passed: 3\n - Skipped: 0\n - Expected Fail: 0\n - Unexpected Success: 0\n - Failed: 0\nSum of execute time for each test: 13.5596 sec.\n```\n\nExtra prints added to b/patrole_tempest_plugin/rbac_rule_validation.py so I can see actual results. All tests got their expected 403s. Not sure what Patrole errors you mentioned. Can you please provide a bit more info so I can reproduce it on my side? Thanks!","commit_id":"f9c63be528da5c21c52b2dd9da1cf040f30b7452"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"9e0fcfd7d80d897f469bdba94bf02771ac1d932b","unresolved":false,"context_lines":[{"line_number":164,"context_line":""},{"line_number":165,"context_line":"    @decorators.idempotent_id(\u0027c02618e7-bb20-1a3a-83c8-6eec2af08135\u0027)"},{"line_number":166,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":167,"context_line":"                                 rules\u003d[\"get_subports\","},{"line_number":168,"context_line":"                                        \"remove_subports\"])"},{"line_number":169,"context_line":"    def test_remove_subports(self):"},{"line_number":170,"context_line":"        \"\"\"Remove subports."}],"source_content_type":"text/x-python","patch_set":15,"id":"3f79a3b5_b704d714","line":167,"range":{"start_line":167,"start_character":41,"end_line":167,"end_character":53},"updated":"2018-11-17 21:31:13.000000000","message":"It doesn\u0027t look like this is actually enforced here because this doesn\u0027t exhibit the normal 404 look up behavior.","commit_id":"f9c63be528da5c21c52b2dd9da1cf040f30b7452"}]}