RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1104656 - support for complex rules and better handling of invalid rules
Summary: support for complex rules and better handling of invalid rules
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pcs
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Tomas Jelinek
QA Contact: Martin Juricek
URL:
Whiteboard:
Depends On:
Blocks: 1129869
TreeView+ depends on / blocked
 
Reported: 2014-06-04 12:51 UTC by Tomas Jelinek
Modified: 2015-03-05 09:19 UTC (History)
6 users (show)

Fixed In Version: pcs-0.9.126-1.el7
Doc Type: Bug Fix
Doc Text:
Cause: User enters invalid or complex rule in 'pcs constraint location' command. Consequence: Depending on the rule pcs crashes, produces invalid rule or invalid CIB. Fix: Implement new rule parser supporting complex rules and providing explanatory error messages when the rule is invalid. Result: For valid rules pcs saves the rule into CIB correctly. For invalid rules pcs provides an explanatory error message and exits gracefully.
Clone Of:
: 1129869 (view as bug list)
Environment:
Last Closed: 2015-03-05 09:19:50 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
proposed fix (143.69 KB, patch)
2014-07-18 12:00 UTC, Tomas Jelinek 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:0415 0 normal SHIPPED_LIVE pcs bug fix and enhancement update 2015-03-05 14:16:41 UTC

Description Tomas Jelinek 2014-06-04 12:51:28 UTC 
Description of problem:
pcs supports simple rules like
#uname eq node1
or
#uname ne node1 and #uname ne node2 and #uname ne node3
but not rules with both 'or' and 'and' operators.

If invalid rule is specified by the user, the pcs fails to handle it and exits with traceback or creates an invalid CIB and tries to push it into pacemaker which leads to invalid CIB printed to terminal.

Version-Release number of selected component (if applicable):
pcs-0.9.115-32.el7

How reproducible:
Always

Steps to Reproduce:
1. create cluster with resource 'dummy'
2. run these commands:
  A) pcs constraint location dummy rule '#uname' ne
  B) pcs constraint location dummy rule '#uname' ne node1 and
  C) pcs constraint location dummy rule '#uname' ne node1 and '#uname' ne
  D) pcs constraint location dummy rule '#uname' ne node1 and '#uname' ne node2 or '#uname' ne node3

Actual results:
A) pcs exits with traceback
B,C) invalid CIB is dumped into terminal
D) pcs exits without error, but created rule is not correct
<rule id="location-dummy-rule" score="INFINITY">
  <expression attribute="#uname" id="location-dummy-rule-expr-1" operation="ne" value="node3"/>
</rule>

Expected results:
In case of valid rule process it right and create correct rule in CIB.
In case of invalid rule do not crash, do not dump invalid CIB, provide explanatory error message.
Comment 2 Tomas Jelinek 2014-07-18 12:00:54 UTC 
Created attachment 919059 [details]
proposed fix
Comment 4 Chris Feist 2014-08-15 20:45:16 UTC 
Upstream here:
https://github.com/feist/pcs/commit/ffa203a545b3ee8e1f1fac38f5d83e2b111411cd
Comment 5 Tomas Jelinek 2014-09-11 09:29:38 UTC 
Before Fix:
[root@rh70-node1 ~]# rpm -q pcs
pcs-0.9.115-32.el7.x86_64
[root@rh70-node1 ~]# pcs constraint location dummy rule '#uname' ne
Traceback (most recent call last):
  File "/usr/sbin/pcs", line 135, in <module>
    main(sys.argv[1:])
  File "/usr/sbin/pcs", line 122, in main
    constraint.constraint_cmd(argv)
  File "/usr/lib/python2.7/site-packages/pcs/constraint.py", line 32, in constraint_cmd
    location_rule([sub_cmd2] + argv)
  File "/usr/lib/python2.7/site-packages/pcs/constraint.py", line 838, in location_rule
    utils.rule_add(lc, argv)
  File "/usr/lib/python2.7/site-packages/pcs/utils.py", line 935, in rule_add
    if args[-1] == "or" or args[-1] == "and":
IndexError: list index out of range
[root@rh70-node1 ~]# echo $?
1
[root@rh70-node1 ~]# pcs constraint location dummy rule '#uname' ne rh70-node1 and
Error: Unable to update cib
Call cib_replace failed (-203): Update does not conform to the configured schema
<cib admin_epoch="0" cib-last-written="Wed Sep 10 16:41:52 2014" crm_feature_set="3.0.7" epoch="6504" have-quorum="1" num_updates="1" update-client="cibadmin" update-origin="rh70-node1" validate-with="pacemaker-1.2" dc-uuid="1">
{output trimmed}
[root@rh70-node1 ~]# pcs constraint location dummy rule '#uname' ne rh70-node1 and '#uname' ne
Error: Unable to update cib
Call cib_replace failed (-203): Update does not conform to the configured schema
<cib admin_epoch="0" cib-last-written="Wed Sep 10 16:42:55 2014" crm_feature_set="3.0.7" epoch="6504" have-quorum="1" num_updates="1" update-client="cibadmin" update-origin="rh70-node1" validate-with="pacemaker-1.2" dc-uuid="1">
{output trimmed}
[root@rh70-node1 ~]# pcs constraint location dummy rule '#uname' ne rh70-node1 and '#uname' ne rh70-node2 or '#uname' ne rh70-node3
[root@rh70-node1 ~]# pcs constraint
Location Constraints:
  Resource: dummy
    Constraint: location-dummy
      Rule: score=INFINITY  
        Expression: #uname ne rh70-node3  
Ordering Constraints:
Colocation Constraints:

After Fix:
[root@rh70-node1 ~]# rpm -q pcs
pcs-0.9.126-1.el7.x86_64
[root@rh70-node1 ~]# pcs constraint location dummy rule '#uname' ne
Error: '#uname ne' is not a valid rule expression: unexpected end of rule
[root@rh70-node1 ~]# echo $?
1
[root@rh70-node1 ~]# pcs constraint location dummy rule '#uname' ne rh70-node1 and
Error: '#uname ne rh70-node1 and' is not a valid rule expression: unexpected end of rule
[root@rh70-node1 ~]# echo $?
1
[root@rh70-node1 ~]# pcs constraint location dummy rule '#uname' ne rh70-node1 and '#uname' ne
Error: '#uname ne rh70-node1 and #uname ne' is not a valid rule expression: unexpected end of rule
[root@rh70-node1 ~]# echo $?
1
[root@rh70-node1 ~]# pcs constraint location dummy rule '#uname' ne rh70-node1 and '#uname' ne rh70-node2 or '#uname' ne rh70-node3
[root@rh70-node1 ~]# echo $?
0
[root@rh70-node1 ~]# pcs constraint
Location Constraints:
  Resource: dummy
    Constraint: location-dummy
      Rule: score=INFINITY boolean-op=or
        Rule: score=0 boolean-op=and
          Expression: #uname ne rh70-node1
          Expression: #uname ne rh70-node2
        Expression: #uname ne rh70-node3
Ordering Constraints:
Colocation Constraints:
Comment 9 errata-xmlrpc 2015-03-05 09:19:50 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0415.html
Note You need to log in before you can comment on or make changes to this bug.