Fix the tagging policy engine [OSSA-2024-005]

[m-bull]

The service tagging policy engine should consider the parent resource or the upper parent resource project ID when checking the policies against the caller project ID.

Before this patch, as introduced in [1], the target was incorrectly populated with the caller project ID instead of using the resource ID.

[1]https://review.opendev.org/c/openstack/neutron/+/896509/13/neutron/extensions/tagging.py

OSSA-2024-005 CVE-2024-53916

Closes-Bug: #2088986
Change-Id: Id7d0c8e7ba37993b1084519d05e7e2eac095b81b (cherry picked from commit fb75d3c)

[m-bull]

Some failed unit tests, but appear to be unrelated

==============================
Failed 4 tests - output below:
==============================

neutron.tests.unit.agent.dhcp.test_agent.TestDhcpAgentEventHandler.test_enable_isolated_metadata_proxy_with_dist_network_ipv6
-----------------------------------------------------------------------------------------------------------------------------

Captured traceback:
~~~~~~~~~~~~~~~~~~~
    Traceback (most recent call last):

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/base.py", line 183, in func
    return f(self, *args, **kwargs)

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/unit/agent/dhcp/test_agent.py", line 1171, in test_enable_isolated_metadata_proxy_with_dist_network_ipv6
    self._test_enable_isolated_metadata_proxy_ipv6(network)

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/unit/agent/dhcp/test_agent.py", line 1139, in _test_enable_isolated_metadata_proxy_ipv6
    spawn.assert_called_once_with(self.dhcp._process_monitor,

      File "/usr/lib64/python3.8/unittest/mock.py", line 925, in assert_called_once_with
    return self.assert_called_with(*args, **kwargs)

      File "/usr/lib64/python3.8/unittest/mock.py", line 913, in assert_called_with
    raise AssertionError(_error_message()) from cause

    AssertionError: expected call not found.
Expected: spawn_monitored_metadata_proxy(<neutron.agent.linux.external_process.ProcessMonitor object at 0x7fe1c7fe78b0>, 'qdhcp-12345678-1234-5678-1234567890ab', 80, <oslo_config.cfg.ConfigOpts object at 0x7fe1cf005400>, bind_address='169.254.169.254', network_id='12345678-1234-5678-1234567890ab', bind_interface='fake-interface', bind_address_v6='fe80::a9fe:a9fe')
Actual: spawn_monitored_metadata_proxy(<neutron.agent.linux.external_process.ProcessMonitor object at 0x7fe1c7fe78b0>, 'qdhcp-12345678-1234-5678-1234567890ab', 80, <oslo_config.cfg.ConfigOpts object at 0x7fe1cf005400>, bind_address='169.254.169.254', network_id='12345678-1234-5678-1234567890ab')


neutron.tests.unit.agent.dhcp.test_agent.TestDhcpAgentEventHandler.test_enable_isolated_metadata_proxy_with_metadata_network_dvr_ipv6
-------------------------------------------------------------------------------------------------------------------------------------

Captured traceback:
~~~~~~~~~~~~~~~~~~~
    Traceback (most recent call last):

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/base.py", line 183, in func
    return f(self, *args, **kwargs)

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/unit/agent/dhcp/test_agent.py", line 1163, in test_enable_isolated_metadata_proxy_with_metadata_network_dvr_ipv6
    self._test_enable_isolated_metadata_proxy_ipv6(network)

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/unit/agent/dhcp/test_agent.py", line 1139, in _test_enable_isolated_metadata_proxy_ipv6
    spawn.assert_called_once_with(self.dhcp._process_monitor,

      File "/usr/lib64/python3.8/unittest/mock.py", line 925, in assert_called_once_with
    return self.assert_called_with(*args, **kwargs)

      File "/usr/lib64/python3.8/unittest/mock.py", line 913, in assert_called_with
    raise AssertionError(_error_message()) from cause

    AssertionError: expected call not found.
Expected: spawn_monitored_metadata_proxy(<neutron.agent.linux.external_process.ProcessMonitor object at 0x7fe1c699e490>, 'qdhcp-12345678-1234-5678-1234567890ab', 80, <oslo_config.cfg.ConfigOpts object at 0x7fe1cf005400>, bind_address='169.254.169.254', network_id='12345678-1234-5678-1234567890ab', bind_interface='fake-interface', bind_address_v6='fe80::a9fe:a9fe')
Actual: spawn_monitored_metadata_proxy(<neutron.agent.linux.external_process.ProcessMonitor object at 0x7fe1c699e490>, 'qdhcp-12345678-1234-5678-1234567890ab', 80, <oslo_config.cfg.ConfigOpts object at 0x7fe1cf005400>, bind_address='169.254.169.254', network_id='12345678-1234-5678-1234567890ab')


neutron.tests.unit.agent.dhcp.test_agent.TestDhcpAgentEventHandler.test_enable_isolated_metadata_proxy_with_metadata_network_ipv6
---------------------------------------------------------------------------------------------------------------------------------

Captured traceback:
~~~~~~~~~~~~~~~~~~~
    Traceback (most recent call last):

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/base.py", line 183, in func
    return f(self, *args, **kwargs)

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/unit/agent/dhcp/test_agent.py", line 1154, in test_enable_isolated_metadata_proxy_with_metadata_network_ipv6
    self._test_enable_isolated_metadata_proxy_ipv6(network)

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/unit/agent/dhcp/test_agent.py", line 1139, in _test_enable_isolated_metadata_proxy_ipv6
    spawn.assert_called_once_with(self.dhcp._process_monitor,

      File "/usr/lib64/python3.8/unittest/mock.py", line 925, in assert_called_once_with
    return self.assert_called_with(*args, **kwargs)

      File "/usr/lib64/python3.8/unittest/mock.py", line 913, in assert_called_with
    raise AssertionError(_error_message()) from cause

    AssertionError: expected call not found.
Expected: spawn_monitored_metadata_proxy(<neutron.agent.linux.external_process.ProcessMonitor object at 0x7fe1c8d6e490>, 'qdhcp-12345678-1234-5678-1234567890ab', 80, <oslo_config.cfg.ConfigOpts object at 0x7fe1cf005400>, bind_address='169.254.169.254', network_id='12345678-1234-5678-1234567890ab', bind_interface='fake-interface', bind_address_v6='fe80::a9fe:a9fe')
Actual: spawn_monitored_metadata_proxy(<neutron.agent.linux.external_process.ProcessMonitor object at 0x7fe1c8d6e490>, 'qdhcp-12345678-1234-5678-1234567890ab', 80, <oslo_config.cfg.ConfigOpts object at 0x7fe1cf005400>, bind_address='169.254.169.254', network_id='12345678-1234-5678-1234567890ab')


neutron.tests.unit.agent.dhcp.test_agent.TestDhcpAgentEventHandler.test_enable_isolated_metadata_proxy_with_2_agents_network_ipv6
---------------------------------------------------------------------------------------------------------------------------------

Captured traceback:
~~~~~~~~~~~~~~~~~~~
    Traceback (most recent call last):

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/base.py", line 183, in func
    return f(self, *args, **kwargs)

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/unit/agent/dhcp/test_agent.py", line 1182, in test_enable_isolated_metadata_proxy_with_2_agents_network_ipv6
    self._test_enable_isolated_metadata_proxy_ipv6(network)

      File "/home/matta/Projects/stackhpc/neutron/neutron/tests/unit/agent/dhcp/test_agent.py", line 1139, in _test_enable_isolated_metadata_proxy_ipv6
    spawn.assert_called_once_with(self.dhcp._process_monitor,

      File "/usr/lib64/python3.8/unittest/mock.py", line 925, in assert_called_once_with
    return self.assert_called_with(*args, **kwargs)

      File "/usr/lib64/python3.8/unittest/mock.py", line 913, in assert_called_with
    raise AssertionError(_error_message()) from cause

    AssertionError: expected call not found.
Expected: spawn_monitored_metadata_proxy(<neutron.agent.linux.external_process.ProcessMonitor object at 0x7f7db938eca0>, 'qdhcp-12345678-1234-5678-1234567890ab', 80, <oslo_config.cfg.ConfigOpts object at 0x7f7dc01ea400>, bind_address='169.254.169.254', network_id='12345678-1234-5678-1234567890ab', bind_interface='fake-interface', bind_address_v6='fe80::a9fe:a9fe')
Actual: spawn_monitored_metadata_proxy(<neutron.agent.linux.external_process.ProcessMonitor object at 0x7f7db938eca0>, 'qdhcp-12345678-1234-5678-1234567890ab', 80, <oslo_config.cfg.ConfigOpts object at 0x7f7dc01ea400>, bind_address='169.254.169.254', network_id='12345678-1234-5678-1234567890ab')



======
Totals
======
Ran: 20124 tests in 1111.0042 sec.
 - Passed: 18546
 - Skipped: 1574
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 4
Sum of execute time for each test: 8752.0700 sec.

==============
Worker Balance
==============
 - Worker 0 (2513 tests) => 0:18:31.004222
 - Worker 1 (2517 tests) => 0:18:20.511325
 - Worker 2 (2517 tests) => 0:18:06.370137
 - Worker 3 (2516 tests) => 0:18:14.571534
/home/matta/Projects/stackhpc/neutron/.tox/py38/lib/python3.8/site-packages/future/standard_library/__init__.py:65: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
  import imp
 - Worker 4 (2516 tests) => 0:18:12.029988
 - Worker 5 (2513 tests) => 0:18:12.005015
 - Worker 6 (2518 tests) => 0:18:10.510864
 - Worker 7 (2514 tests) => 0:18:25.774797