x/vmware-nsx
Code Issues Proposed changes

Remove calls to policy.check and policy.enforce from plugin code

Browse Source 
Completes blueprint make-authz-orthogonal

This patch removes a few explicit policy checks recently added to
the plumgrid and cisco plugins.
They are not necessary as the same checks are already performed
by the policy engine.

Change-Id: Ie99f5fa6ad4a9568b050827bc479a62dd40e18ac
This commit is contained in:
Salvatore Orlando 2013-08-21 02:47:19 -07:00
parent d16e185d34
commit 7bbd215da8
2 changed files with 4 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
neutron/plugins/cisco/n1kv/n1kv_neutron_plugin.py
View File

@ -49,7 +49,6 @@ from neutron.plugins.cisco.db import n1kv_db_v2
from neutron.plugins.cisco.db import network_db_v2
from neutron.plugins.cisco.extensions import n1kv_profile
from neutron.plugins.cisco.n1kv import n1kv_client
from neutron import policy
LOG = logging.getLogger(__name__)
@ -270,16 +269,6 @@ class N1kvNeutronPluginV2(db_base_plugin_v2.NeutronDbPluginV2,
if physical_network not in self.network_vlan_ranges:
self.network_vlan_ranges[physical_network] = []
def _check_provider_view_auth(self, context, network):
return policy.check(context,
"extension:provider_network:view",
network)
def _enforce_provider_set_auth(self, context, network):
return policy.enforce(context,
"extension:provider_network:set",
network)
def _extend_network_dict_provider(self, context, network):
"""Add extended network parameters."""
binding = n1kv_db_v2.get_network_binding(context.session,
@ -306,9 +295,6 @@ class N1kvNeutronPluginV2(db_base_plugin_v2.NeutronDbPluginV2,
segmentation_id_set):
return (None, None, None)
# Authorize before exposing plugin details to client
self._enforce_provider_set_auth(context, attrs)
if not network_type_set:
msg = _("provider:network_type required")
raise q_exc.InvalidInput(error_message=msg)
@ -366,9 +352,6 @@ class N1kvNeutronPluginV2(db_base_plugin_v2.NeutronDbPluginV2,
segmentation_id_set):
return
# Authorize before exposing plugin details to client
self._enforce_provider_set_auth(context, attrs)
# TBD : Need to handle provider network updates
msg = _("plugin does not support updating provider attributes")
raise q_exc.InvalidInput(error_message=msg)

13
neutron/plugins/plumgrid/plumgrid_plugin/plumgrid_plugin.py
View File

@ -34,7 +34,6 @@ from neutron.openstack.common import importutils
from neutron.openstack.common import log as logging
from neutron.plugins.plumgrid.common import exceptions as plum_excep
from neutron.plugins.plumgrid.plumgrid_plugin.plugin_ver import VERSION
from neutron import policy
LOG = logging.getLogger(__name__)
PLUM_DRIVER = 'neutron.plugins.plumgrid.drivers.plumlib.Plumlib'
@ -492,16 +491,12 @@ class NeutronPluginPLUMgridV2(db_base_plugin_v2.NeutronDbPluginV2,
return VERSION
def _port_viftype_binding(self, context, port):
if self._check_view_auth(context, port, self.binding_view):
port[portbindings.VIF_TYPE] = portbindings.VIF_TYPE_IOVISOR
port[portbindings.CAPABILITIES] = {
portbindings.CAP_PORT_FILTER:
'security-group' in self.supported_extension_aliases}
port[portbindings.VIF_TYPE] = portbindings.VIF_TYPE_IOVISOR
port[portbindings.CAPABILITIES] = {
portbindings.CAP_PORT_FILTER:
'security-group' in self.supported_extension_aliases}
return port
def _check_view_auth(self, context, resource, action):
return policy.check(context, action, resource)
def _network_admin_state(self, network):
try:
if network["network"].get("admin_state_up"):