diff --git a/nova/tests/unit/api/openstack/compute/test_serversV21.py b/nova/tests/unit/api/openstack/compute/test_serversV21.py index 05fee0109f..4efc815d01 100644 --- a/nova/tests/unit/api/openstack/compute/test_serversV21.py +++ b/nova/tests/unit/api/openstack/compute/test_serversV21.py @@ -8100,41 +8100,6 @@ class ServersInvalidRequestTestCase(test.TestCase): self._invalid_server_create(body=body) -# TODO(alex_xu): There isn't specified file for ips extension. Most of -# unittest related to ips extension is in this file. So put the ips policy -# enforcement tests at here until there is specified file for ips extension. -class IPsPolicyEnforcementV21(test.NoDBTestCase): - - def setUp(self): - super(IPsPolicyEnforcementV21, self).setUp() - self.controller = ips.IPsController() - self.req = fakes.HTTPRequest.blank("/v2/%s" % fakes.FAKE_PROJECT_ID) - self.mock_get = self.useFixture( - fixtures.MockPatch('nova.api.openstack.common.get_instance')).mock - self.mock_get.return_value = fake_instance.fake_instance_obj( - self.req.environ['nova.context']) - - def test_index_policy_failed(self): - rule_name = "os_compute_api:ips:index" - self.policy.set_rules({rule_name: "project:non_fake"}) - exc = self.assertRaises( - exception.PolicyNotAuthorized, - self.controller.index, self.req, fakes.FAKE_UUID) - self.assertEqual( - "Policy doesn't allow %s to be performed." % rule_name, - exc.format_message()) - - def test_show_policy_failed(self): - rule_name = "os_compute_api:ips:show" - self.policy.set_rules({rule_name: "project:non_fake"}) - exc = self.assertRaises( - exception.PolicyNotAuthorized, - self.controller.show, self.req, fakes.FAKE_UUID, fakes.FAKE_UUID) - self.assertEqual( - "Policy doesn't allow %s to be performed." % rule_name, - exc.format_message()) - - class ServersPolicyEnforcementV21(test.NoDBTestCase): def setUp(self): diff --git a/nova/tests/unit/policies/test_server_ips.py b/nova/tests/unit/policies/test_server_ips.py new file mode 100644 index 0000000000..655bbc42ad --- /dev/null +++ b/nova/tests/unit/policies/test_server_ips.py @@ -0,0 +1,96 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +import fixtures +from oslo_utils.fixture import uuidsentinel as uuids +from oslo_utils import timeutils + +from nova.api.openstack.compute import ips +from nova.compute import vm_states +from nova.policies import ips as ips_policies +from nova.tests.unit.api.openstack import fakes +from nova.tests.unit import fake_instance +from nova.tests.unit.policies import base + + +class ServerIpsPolicyTest(base.BasePolicyTest): + """Test Server IPs APIs policies with all possible context. + This class defines the set of context with different roles + which are allowed and not allowed to pass the policy checks. + With those set of context, it will call the API operation and + verify the expected behaviour. + """ + + def setUp(self): + super(ServerIpsPolicyTest, self).setUp() + self.controller = ips.IPsController() + self.req = fakes.HTTPRequest.blank('') + self.mock_get = self.useFixture( + fixtures.MockPatch('nova.api.openstack.common.get_instance')).mock + uuid = uuids.fake_id + self.instance = fake_instance.fake_instance_obj( + self.project_member_context, + id=1, uuid=uuid, project_id=self.project_id, + vm_state=vm_states.ACTIVE, + task_state=None, launched_at=timeutils.utcnow()) + self.mock_get.return_value = self.instance + self.mock_get_network = self.useFixture( + fixtures.MockPatch('nova.api.openstack.common' + '.get_networks_for_instance')).mock + self.mock_get_network.return_value = {'net1': + {'ips': '', 'floating_ips': ''}} + + # Check that admin or and server owner is able to get server + # IP addresses. + self.admin_or_owner_authorized_contexts = [ + self.legacy_admin_context, self.system_admin_context, + self.project_admin_context, self.project_member_context, + self.project_reader_context, self.project_foo_context] + # Check that non-admin/owner is not able to get the server IP + # adderesses + self.admin_or_owner_unauthorized_contexts = [ + self.system_member_context, self.system_reader_context, + self.system_foo_context, + self.other_project_member_context + ] + + def test_index_ips_policy(self): + rule_name = ips_policies.POLICY_ROOT % 'index' + self.common_policy_check(self.admin_or_owner_authorized_contexts, + self.admin_or_owner_unauthorized_contexts, + rule_name, + self.controller.index, + self.req, self.instance.uuid) + + def test_show_ips_policy(self): + rule_name = ips_policies.POLICY_ROOT % 'show' + self.common_policy_check(self.admin_or_owner_authorized_contexts, + self.admin_or_owner_unauthorized_contexts, + rule_name, + self.controller.show, + self.req, self.instance.uuid, + 'net1') + + +class ServerIpsScopeTypePolicyTest(ServerIpsPolicyTest): + """Test Server IPs APIs policies with system scope enabled. + This class set the nova.conf [oslo_policy] enforce_scope to True + so that we can switch on the scope checking on oslo policy side. + It defines the set of context with scoped token + which are allowed and not allowed to pass the policy checks. + With those set of context, it will run the API operation and + verify the expected behaviour. + """ + + def setUp(self): + super(ServerIpsScopeTypePolicyTest, self).setUp() + self.flags(enforce_scope=True, group="oslo_policy")