External shared networks may not be seen by other projects

[Jakub Libosvar]

External shared networks each create its own RBAC entry. If there is a project that access the network through the shared attribute then it may not work. It depends on how mysql returns the records, then using GROUP BY clause it will use the first returned - meaning that if access_as_external is the first record returned, the network will be not treated as shared as it won't match here: https://opendev.org/openstack/neutron/src/commit/cbca72195ae5976d6f8b10bbbd58bde3542956bf/neutron/pecan_wsgi/hooks/ownership_validation.py#L45

This is a regression caused by https://review.opendev.org/c/openstack/neutron-lib/+/884878/1/neutron_lib/db/model_query.py

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-lib/+/901565

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Jakub Libosvar <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron-lib/+/901565
Reason: Not relevant for master

[Maximiliano Geier (mgeier85)]

Hi,
I was wondering why this change got abandoned. I'm currently the Wallaby branch (RDO containers from November 2023) and am affected by this same bug.

My test scenario:

- Create private network net on project admin.
- Share net using RBAC rule with project tenant1.
- Share net using RBAC rule with project tenant2.

Observed result:

- Only tenant2 is able to see the network.

Expected result:

- tenant1 and tenant2 should be able to see the network.

I also came independently to the proposed 'group by' fix, which is working for me, but I would like this to be accepted into the master branch.