FWaaS v2 - incorrect shared rule check

[Salvatore Orlando]

Reference: http://git.openstack.org/cgit/openstack/neutron-fwaas/tree/neutron_fwaas/db/firewall/v2/firewall_db_v2.py#n644

    def _check_if_rules_shared_for_policy_shared(self, context, fwp_db, fwp):
        if fwp['shared']:
            rules_in_db = fwp_db.rule_associations
            for entry in rules_in_db:
                fwr_db = self._get_firewall_rule(context,
                                                 entry.firewall_rule_id)
                if not fwp_db['shared']:
                    raise f_exc.FirewallPolicySharingConflict(
                        firewall_rule_id=fwr_db['id'],
                        firewall_policy_id=fwp_db['id'])

The logic above will always raise an exception if a policy is changed from not shared to shared. There is most likely a typo in:

if not fwp_db['shared']:

as it should be:

if not fwr_db['shared']:

[Yushiro FURUKAWA (y-furukawa-2)]

Thanks for filing a bug. Previously, I've been fixing such kind of bug.

[Yushiro FURUKAWA (y-furukawa-2)]

Like https://review.openstack.org/#/c/488438/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/638394

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/638394
Committed: https://git.openstack.org/cgit/openstack/neutron-fwaas/commit/?id=9844e5e09cd10c45e7ec391a2f5af8b9fae1dd96
Submitter: Zuul
Branch: master

commit 9844e5e09cd10c45e7ec391a2f5af8b9fae1dd96
Author: Yushiro FURUKAWA <email address hidden>
Date: Thu Feb 21 20:01:56 2019 +0900

    Fix firewall rule 'shared' check in updating fwp

    This commit fixes 'shared' validation for existing firewall rules in
    updating firewall policy with 'non-shared' to 'shared'.

    Change-Id: I172632679f59e2aff79624753e1ef01f7ba1fdab
    Closes-Bug: #1816740

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.openstack.org/639573

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron-fwaas 14.0.0.0b2 development milestone.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/639573
Committed: https://git.openstack.org/cgit/openstack/neutron-fwaas/commit/?id=2f55bd16ef070b0fc91d1b92591b399b6fd5802e
Submitter: Zuul
Branch: stable/rocky

commit 2f55bd16ef070b0fc91d1b92591b399b6fd5802e
Author: Yushiro FURUKAWA <email address hidden>
Date: Thu Feb 21 20:01:56 2019 +0900

    Fix firewall rule 'shared' check in updating fwp

    This commit fixes 'shared' validation for existing firewall rules in
    updating firewall policy with 'non-shared' to 'shared'.

    Change-Id: I172632679f59e2aff79624753e1ef01f7ba1fdab
    Closes-Bug: #1816740
    (cherry picked from commit 9844e5e09cd10c45e7ec391a2f5af8b9fae1dd96)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron-fwaas 13.0.2 release.