Bug 1476744

Summary:	No validation on the storage_domain parameter when creating VM disks attachments
Product:	[oVirt] ovirt-engine	Reporter:	shani <sleviim>
Component:	BLL.Storage	Assignee:	shani <sleviim>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Kevin Alon Goldblatt <kgoldbla>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	4.2.0	CC:	amureini, bugs, sleviim, tnisan
Target Milestone:	ovirt-4.1.5	Flags:	rule-engine: ovirt-4.1+
Target Release:	4.1.5.2
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	Cause: There was no validation on the storage_domain parameter on SDK / REST API. Therefore, it was "possible" to create a vm's disk_attachment without a storage_domain. Consequence: Disk attachment has been created, and the storage_domain's parameter was set as the other VM's disk storage domain. Fix: Add validation for the storage_domain parameter which supplied by the user (as a part of SDK / REST API command parameters). Result: Error message which indicates that storage_domain wasn't supplied + operation stops.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-23 08:06:54 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Storage	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description shani 2017-07-31 10:31:27 UTC

Description of problem:
When creating a new VM disk_attachment using the REST API, there's no validation on the storage_domain parameter, so it's "possible" to create a vm's disk_attachment without a storage_domain.
In this case, the storage domain would be determined by the first vm disk (returned by vm_disks[0]) storage domain. 

Version-Release number of selected component (if applicable):
Reproduced for 4.2 version, although according to the code, was probably present before that.

How reproducible:
100%

Steps to Reproduce:
1. Create a VM.
2. Create a disk and attach it to the VM. 
3. Using the REST API, run the following:

Method:
-------
POST

URL:
----
https://xxxx.xxxx.xxxx.xxxx.com/ovirt-engine/api/vms/<VM_ID>/diskattachments

Body:
-----
<disk_attachment>
<interface>ide</interface>
<active>true</active>
<disk>
<name>mydisk</name>
<provisioned_size>1024</provisioned_size>
<format>COW</format>
</disk>
</disk_attachment>


Actual results:
Disk attachment has been created, and the storage_domain's parameter was set as the other disk's storage domain. 

Expected results:
Error (Storage Domain hasn't been specified).

Additional info:
-

Comment 1 Allon Mureinik 2017-07-31 10:41:30 UTC

This behavior makes no sense (as the report suggests). I'd like to get this fixed sooner rather than later so we don't hit users relying on this broken behavior.

Comment 2 Allon Mureinik 2017-08-10 16:04:26 UTC

Shani, this is a user-visible behavior change. Can you please add some doctext explaining it?

Comment 3 Kevin Alon Goldblatt 2017-08-15 15:27:04 UTC

Verified with the following code:
------------------------------------------
ovirt-engine-4.1.5.2-0.1.el7.noarch
vdsm-4.19.27-1.el7ev

Verified with the following scenario:
------------------------------------------
Steps to Reproduce:
1. Create a VM.
2. Create a disk and attach it to the VM. 
3. Using the REST API, run the following:
>>>>> Correct error message displayed 

Method:
-------
POST

URL:
----
https://xxxx.xxxx.xxxx.xxxx.com/ovirt-engine/api/vms/<VM_ID>/diskattachments

Body:
-----
<disk_attachment>
<interface>ide</interface>
<active>true</active>
<disk>
<name>mydisk</name>
<provisioned_size>1024</provisioned_size>
<format>COW</format>
</disk>
</disk_attachment>


Message output from REST API

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<fault>
    <detail>[Cannot add Virtual Disk. Storage Domain hasn't been specified.]</detail>
    <reason>Operation Failed</reason>
</fault>



Moving to VERIFIED