Project users can add others' security services to their network by ID

[Goutham Pacha Ravi]

Description
===========
The default RBAC allows project users to add a security service by its ID to share networks they own.

It is not possible for an unprivileged user to obtain security service IDs via manila APIs. So they'd have to guess it - however, guesswork on UUIDs is considered highly improbable. This is albeit a security tightening opportunity.

Steps to reproduce
==================

A chronological list of steps which will help reproduce the issue you hit:
* As user X of project Y create a security service, record its ID
* As user A of project B, create a share network (don't create any shares)
* Associate the security service to the share network by its ID

Expected result
===============
The user must be prevented to do this with HTTP 400

Actual result
=============
HTTP 200, the security service was successfully associated with the share network.

Environment
===========
1. Manila main branch, Wallaby cycle code

[Goutham Pacha Ravi (gouthamr)]

Job set to nonvoting here: https://review.opendev.org/c/openstack/manila/+/779823

[Goutham Pacha Ravi (gouthamr)]

Please Ignore comment #1, it was for https://bugs.launchpad.net/manila/+bug/1918707

When this bug is being fixed, these new APIs need to be addressed as well: https://review.opendev.org/c/openstack/manila/+/774728/10/manila/api/v2/share_networks.py#416

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/manila/+/820044

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/manila/+/820044
Committed: https://opendev.org/openstack/manila/commit/a97d65d3eb9b3a5b4a88a1b3f22b59ca2f75c9bc
Submitter: "Zuul (22348)"
Branch: master

commit a97d65d3eb9b3a5b4a88a1b3f22b59ca2f75c9bc
Author: Ashley Rodriguez <email address hidden>
Date: Wed Dec 1 14:31:00 2021 +0000

    Add validation to share network

    Adds a check when associating a security service to a share network, so
    that both resources must have the same project_id. If not,
    a HTTP Bad Request is raised. Affiliated tests were altered or created.

    Closes-Bug: #1918323
    Change-Id: Idb2a8838d492ac3c616fb21ab1272f7dc74ee589

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/manila/+/838875

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/manila/+/838875
Committed: https://opendev.org/openstack/manila/commit/95099bdfc46f4734c082b051a0029627aff9e473
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit 95099bdfc46f4734c082b051a0029627aff9e473
Author: Ashley Rodriguez <email address hidden>
Date: Wed Dec 1 14:31:00 2021 +0000

    Add validation to share network

    Adds a check when associating a security service to a share network, so
    that both resources must have the same project_id. If not,
    a HTTP Bad Request is raised. Affiliated tests were altered or created.

    Closes-Bug: #1918323
    Change-Id: Idb2a8838d492ac3c616fb21ab1272f7dc74ee589
    (cherry picked from commit a97d65d3eb9b3a5b4a88a1b3f22b59ca2f75c9bc)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/manila/+/848712

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/manila/+/848865

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/manila/+/848712
Committed: https://opendev.org/openstack/manila/commit/65fe79297d23e391d0746216520da957fc568000
Submitter: "Zuul (22348)"
Branch: stable/xena

commit 65fe79297d23e391d0746216520da957fc568000
Author: Ashley Rodriguez <email address hidden>
Date: Wed Dec 1 14:31:00 2021 +0000

    Add validation to share network

    Adds a check when associating a security service to a share network, so
    that both resources must have the same project_id. If not,
    a HTTP Bad Request is raised. Affiliated tests were altered or created.

    Closes-Bug: #1918323
    Change-Id: Idb2a8838d492ac3c616fb21ab1272f7dc74ee589
    (cherry picked from commit a97d65d3eb9b3a5b4a88a1b3f22b59ca2f75c9bc)
    (cherry picked from commit 95099bdfc46f4734c082b051a0029627aff9e473)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/manila 15.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/manila 14.0.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/manila 13.0.4 release.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/manila/+/848865
Committed: https://opendev.org/openstack/manila/commit/42607c1f1ebbbef35ab0ae88597c0537f43c1cbf
Submitter: "Zuul (22348)"
Branch: stable/wallaby

commit 42607c1f1ebbbef35ab0ae88597c0537f43c1cbf
Author: Ashley Rodriguez <email address hidden>
Date: Wed Dec 1 14:31:00 2021 +0000

    Add validation to share network

    Adds a check when associating a security service to a share network, so
    that both resources must have the same project_id. If not,
    a HTTP Bad Request is raised. Affiliated tests were altered or created.

    Closes-Bug: #1918323
    Change-Id: Idb2a8838d492ac3c616fb21ab1272f7dc74ee589
    (cherry picked from commit a97d65d3eb9b3a5b4a88a1b3f22b59ca2f75c9bc)
    (cherry picked from commit 95099bdfc46f4734c082b051a0029627aff9e473)
    (cherry picked from commit 65fe79297d23e391d0746216520da957fc568000)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/manila wallaby-eom release.