Quota does not check invalid tenant_id

[Yang Youseok]

Currently, neutron quota API accept invalid tenant_id value without validation. Even user can add arbitrary quota entry which is not existed because by default quota engine create new entry if the queried entry is not found.

This bug is also found across the other openstack projects (nova, trove ..) using similar quota logic, and nova side there was commit to fix it (https://review.openstack.org/#/c/435010/). I found neutron did not have any similar approach, so It worth to talk about the solution. (which access to keystone API in the middle of quota API).

[Deepak Mourya (mourya007)]

hi, yes i can reproduce the bug with

1. using wrong tenant-id

2. Wrong format of tenant-id
  neutron quota-show --tenant-id 4659a57c3e084a6c9a22447#####

[Liu Xie (liushy)]

yeah,i think these problems should be paid attention to.
1.tenant_id of port whether same as the associated network's
2. tenant_id of listener with the associated loadbalancer's
and so on...

[Deepak Mourya (mourya007)]

yes so what should be the good approach to handle this, Like in nova they are verify the same using keystone[1]

[1] https://review.openstack.org/#/c/435010/13/nova/api/openstack/identity.py

[Slawek Kaplonski (slaweq)]

IMO this way how nova is handling that is good and we can do something similar in Neutron

[melanie witt (melwitt)]

Here is the nova spec explaining how it works:

https://specs.openstack.org/openstack/nova-specs/specs/pike/implemented/validate-project-with-keystone.html

These are the related patches that were landed:

https://review.openstack.org/#/q/(topic:verify_quota+OR+topic:bp/validate-project-with-keystone)+(status:merged)