<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi Allain,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Do you know why the standard qos_policy_id attribute of the network would not hit this problem? I don’t even see them reference this field in the policy.json, so does it just permit anything to be changed by
the tenant unless it is explicitly defined?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><a href="http://crucible.wrs.com/changelog/CGCS_github_neutron?cs=1e9a089">http://crucible.wrs.com/changelog/CGCS_github_neutron?cs=1e9a089</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">-Matt<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Le, Huifeng [mailto:huifeng.le@intel.com]
<br>
<b>Sent:</b> Sunday, October 14, 2018 10:24 PM<br>
<b>To:</b> Peters, Matt<br>
<b>Cc:</b> starlingx-discuss@lists.starlingx.io; Qin, Kailun<br>
<b>Subject:</b> Question about patch upstreaming for 1e9a089<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi Matt,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We’re looking into the patch 1e9a089, which target to solve the issue of “CGTS-2408: bypass policy check when setting attribute to None.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">After investigating this issue, it is found that this issue will only happen for attribute which need to meet below conditions:<o:p></o:p></p>
<p class="MsoNormal">(1) the validate rule is: “type: uuid_or_none”<o:p></o:p></p>
<p class="MsoNormal">(2) the “enforce_policy” should be set to “True” and the policy needs to be defined in etc/policy.json<o:p></o:p></p>
<p class="MsoNormal">(3) the check policy uses “tenant_id” for owner check<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The only found attribute which will be impacted by this issue in STX is “wrs-tm:qos” which will be removed later after STX applying upstreaming QOS API. Since no other impacted attributes can be found in upstream (or could you please share
with us if you see any other attributes which may be impacted by this issue?), What’s your proposal for upstreaming or Do you think holding on this fix is make sense for now?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank much!<o:p></o:p></p>
<p class="MsoNormal"><b><i><o:p> </o:p></i></b></p>
<p class="MsoNormal"><b><i>Best Regards,<o:p></o:p></i></b></p>
<p class="MsoNormal"><b><i>Le, Huifeng</i></b><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>