From 57dfe971cd479dae2586fb332ab4f808d70e0d52 Mon Sep 17 00:00:00 2001
From: Sergey Kraynev <sergejyit@gmail.com>
Date: Sun, 8 Dec 2019 15:29:31 +0400
Subject: [PATCH] RBAC for subnetpool

---
 neutron/db/rbac_db_models.py  | 11 +++++++++
 neutron/objects/subnetpool.py | 44 ++++++++++++++++++++++++++++++++++-
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/neutron/db/rbac_db_models.py b/neutron/db/rbac_db_models.py
index c3e8a163680..97c42715c8f 100644
--- a/neutron/db/rbac_db_models.py
+++ b/neutron/db/rbac_db_models.py
@@ -126,3 +126,14 @@ class SecurityGroupRBAC(RBACColumns, model_base.BASEV2):
     @staticmethod
     def get_valid_actions():
         return (ACCESS_SHARED,)
+
+
+class SubnetPoolRBAC(RBACColumns, model_base.BASEV2):
+    """RBAC table for security groups."""
+
+    object_id = _object_id_column('subnetpool.id')
+    object_type = 'subnet_pool'
+
+    @staticmethod
+    def get_valid_actions():
+        return (ACCESS_SHARED,)
diff --git a/neutron/objects/subnetpool.py b/neutron/objects/subnetpool.py
index 37d6876df00..ce89753025e 100644
--- a/neutron/objects/subnetpool.py
+++ b/neutron/objects/subnetpool.py
@@ -17,15 +17,46 @@
 from oslo_versionedobjects import fields as obj_fields
 
 from neutron.db import models_v2 as models
+from neutron.db import rbac_db_models
 from neutron.objects import base
 from neutron.objects import common_types
+from neutron.objects import rbac
+from neutron.objects import rbac_db
 
 
 @base.NeutronObjectRegistry.register
-class SubnetPool(base.NeutronDbObject):
+class SubnetPoolRBAC(rbac.RBACBaseObject):
     # Version 1.0: Initial version
     VERSION = '1.0'
 
+    db_model = rbac_db_models.SubnetPoolRBAC
+
+    @classmethod
+    def get_projects(cls, context, object_id=None, action=None,
+                     target_tenant=None):
+        clauses = []
+        if object_id:
+            clauses.append(rbac_db_models.SubnetPoolRBAC.object_id == object_id)
+        if action:
+            clauses.append(rbac_db_models.SubnetPoolRBAC.action == action)
+        if target_tenant:
+            clauses.append(rbac_db_models.SubnetPoolRBAC.target_tenant ==
+                           target_tenant)
+        query = context.session.query(
+            rbac_db_models.SubnetPoolRBAC.target_tenant)
+        if clauses:
+            query = query.filter(sa.and_(*clauses))
+        return [data[0] for data in query]
+
+
+@base.NeutronObjectRegistry.register
+class SubnetPool(base.NeutronDbObject):
+    # Version 1.0: Initial version
+    # Version 1.1: Add RBAC support
+    VERSION = '1.1'
+
+    # required by RbacNeutronMetaclass
+    rbac_db_cls = SubnetPoolRBAC
     db_model = models.SubnetPool
 
     fields = {
@@ -83,6 +114,17 @@ def update(self):
             if 'prefixes' in fields:
                 self._attach_prefixes(fields['prefixes'])
 
+    def obj_make_compatible(self, primitive, target_version):
+        _target_version = versionutils.convert_version_to_tuple(target_version)
+        if _target_version < (1, 1):
+            primitive.pop('shared')
+
+    @classmethod
+    def get_bound_tenant_ids(cls, context, obj_id):
+        port_objs = ports.Port.get_objects(context,
+                                           security_group_ids=[obj_id])
+        return {port.tenant_id for port in port_objs}
+
 
 @base.NeutronObjectRegistry.register
 class SubnetPoolPrefix(base.NeutronDbObject):