policy.json engine update_router:external_gateway_info

[Aaron Rosen]

It seems there is not a generic rule that enforces router-interface-add:

for example:
    "add_router_interface": "rule: admin_or_network_owner",
    "add_router_interface": "rule: admin_or_owner",

both prevent one from performing router-interface-add

[Aaron Rosen (arosen)]

This also don't seem to be enforced: "update_router:external_gateway_info": "rule:admin_only", but update_router is

[Aaron Rosen (arosen)]

sorry router-interface-add/delete is enforced but:

    "update_router:external_gateway_info": "rule:admin_only",

is not enforced.

[Salvatore Orlando (salvatore-orlando)]

Interesting. I will look into this.

[Salvatore Orlando (salvatore-orlando)]

that is easy. The attribute does not have enforce_policy=True.
fix coming.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/31229

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/31229
Committed: http://github.com/openstack/quantum/commit/a9098d218836aa82dc07ba94156f0d553f2f87a7
Submitter: Jenkins
Branch: master

commit a9098d218836aa82dc07ba94156f0d553f2f87a7
Author: Salvatore Orlando <email address hidden>
Date: Fri May 31 17:28:35 2013 +0200

    Enable attribute-based policy on router:external_gateway_info

    Bug 1186081

    This patch also removes a check on is_write in policy.py since
    the code block where that check is placed assumed already that
    is_write == True

    Change-Id: I21c54f63e1948675f67afb088c262dc5316c230d