Checking device_owner works as expected, but we need to check device_id too. I tested the following scenario and succeeded a router interface to admin router with demo tenant. In this scenario a regular tenant (demo) first adds a router interface to its router and then changes device_id of the router interface to a router of another tenant (admin).
I think we need to check if a tenant can access a router with a specified device_id (= router_id) if (new) device_owner is network:router_interface unless a tenant is admin.
-----
[admin tenant]
neutron net-create admin-net1
neutron subnet-create --name admin-subnet1 admin-net1 10.2.2.0/24
neutron router-create admin-router
# make sure to schedule router to l3-agent
neutron router-interface-add admin-router admin-subnet1
Thanks Aaron for the updated patch.
-1 from me.
Checking device_owner works as expected, but we need to check device_id too. I tested the following scenario and succeeded a router interface to admin router with demo tenant. In this scenario a regular tenant (demo) first adds a router interface to its router and then changes device_id of the router interface to a router of another tenant (admin).
I think we need to check if a tenant can access a router with a specified device_id (= router_id) if (new) device_owner is network: router_ interface unless a tenant is admin.
----- interface- add admin-router admin-subnet1
[admin tenant]
neutron net-create admin-net1
neutron subnet-create --name admin-subnet1 admin-net1 10.2.2.0/24
neutron router-create admin-router
# make sure to schedule router to l3-agent
neutron router-
[demo tenant] interface- add router1 subnet1
neutron net-create net1
neutron subnet-create --name subnet1 net1 10.1.1.0/24
neutron router-
# Change device_id of the above router interface to admin_router
neutron port-update <port-id of router1 interface> --device_id <admin-router ID>
After restarting l3-agent, I saw an interface corresponding to the router interface from demo tenant in admin-router namespace.
[restart