[Openstack-security] [Bug 1118066] Re: Nova should confirm quota requests against Keystone

Scott Devoid devoid at anl.gov
Fri Jun 13 16:14:14 UTC 2014


I would propose the following behavior:

When os-quota-sets is updated, nova-api checks the quota tables to see
if the quota-set for the project ID already exists in the table. If it
does exist, then update with the new quota value. Otherwise, use
keystoneclient to confirm that the project ID exists. If it does not
exist, return an appropriate error to the API. Otherwise update the new
quota value.

This will catch the error except for cases where the quota table is
already corrupted with quotas that apply to no projects.

-- 
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1118066

Title:
  Nova should confirm quota requests against Keystone

Status in OpenStack Compute (Nova):
  Confirmed

Bug description:
  os-quota-sets API should check requests for /v2/:tenant/os-quota-sets/
  against Keystone to ensure that :tenant does exist.

  POST requests to a non-existant tenant should fail with a 400 error
  code.

  GET requests to a non-existant tenant may fail with a 400 error code.
  Current behavior is to return 200 with the default quotas. A slightly
  incompatible change would be to return a 302 redirect to /v2/:tenant
  /os-quota-sets/defaults in this case.

  Edit (2014-01-22)

  Original Description
  --------------------
  GET /v2/:tenant/os-quota-sets/:this_tenant_does_not_exist
  returns 200 with the default quotas.

  Moreover
  POST /v2/:tenant/os-quota-sets/:this_tenant_does_not_exist
  with updated quotas succeeds and that metadata is saved!

  I'm not sure if this is a bug or not. I cannot find any documentation
  on this interface.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1118066/+subscriptions




More information about the Openstack-security mailing list