Bug 1722422 - [OSP 13] Exceptions In Neutron Policy Enforcement
Summary: [OSP 13] Exceptions In Neutron Policy Enforcement
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-neutron
Version: 13.0 (Queens)
Hardware: Unspecified
OS: Unspecified
high
urgent
Target Milestone: z7
: 13.0 (Queens)
Assignee: Bernard Cafarelli
QA Contact: Roee Agiman
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-06-20 10:54 UTC by Maxim Babushkin
Modified: 2019-07-10 13:02 UTC (History)
9 users (show)

Fixed In Version: openstack-neutron-12.0.6-3.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-07-10 13:02:20 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
OpenStack gerrit 662464 0 'None' MERGED Use list instead of six.viewkeys to avoid py2 to py3 problems 2020-09-22 10:25:16 UTC
Red Hat Product Errata RHBA-2019:1744 0 None None None 2019-07-10 13:02:27 UTC

Description Maxim Babushkin 2019-06-20 10:54:20 UTC
Description of problem:
When deploying with a modified list of Neutron API policies, post deployment, policies which worked on previous versions will result in Neutron API Server returning 'HttpException: 500' when using the API with non admin users.

Additional API policies which were passed during deployment: http://paste.openstack.org/show/751347/


NOTE - This BZ is an identical bug found and fixed in OSP 15.
https://bugzilla.redhat.com/show_bug.cgi?id=1709930

When applied the following patch, it fixed the bug:
https://review.opendev.org/#/c/662461/


The patch of osp 15 should be backported to osp 13 as well.


Version-Release number of selected component (if applicable):
OSP 13


How reproducible:
Use a custom neutron api policy during the overcloud deployment.

1. Deploy Overcloud with modified Neutron APIs
2. Create non admin user/tenant
3. Attempt to list ports

Actual results:
Fail to retrieve ports and receive python exceptions

Expected results:
List of ports is returned

Additional info:

Bug trace:

X-Tenant: tempest-TestAdvancedScenarios-87321471
X-Tenant-Id: 5a1795d2825745799034204417b9f28c
X-Tenant-Name: tempest-TestAdvancedScenarios-87321471
X-User: tempest-TestAdvancedScenarios-87321471
X-User-Domain-Id: default
X-User-Domain-Name: Default
X-User-Id: d73acac8cc3c447ca41a24935ff2be3c
X-User-Name: tempest-TestAdvancedScenarios-87321471: RuntimeError: dictionary changed size during iteration
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors Traceback (most recent call last):
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/oslo_middleware/catch_errors.py", line 40, in __call__
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     response = req.get_response(self.application)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/webob/request.py", line 1316, in send
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     application, catch_exc_info=False)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/webob/request.py", line 1280, in call_application
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     app_iter = application(self.environ, start_response)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/webob/dec.py", line 131, in __call__
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     resp = self.call_func(req, *args, **self.kwargs)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/webob/dec.py", line 196, in call_func
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     return self.func(req, *args, **kwargs)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/keystonemiddleware/auth_token/__init__.py", line 337, in __call__
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     response = req.get_response(self._app)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/webob/request.py", line 1316, in send
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     application, catch_exc_info=False)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/webob/request.py", line 1280, in call_application
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     app_iter = application(self.environ, start_response)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/webob/dec.py", line 145, in __call__
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     return resp(environ, start_response)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/webob/dec.py", line 145, in __call__
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     return resp(environ, start_response)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/routes/middleware.py", line 141, in __call__
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     response = self.app(environ, start_response)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/webob/dec.py", line 145, in __call__
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     return resp(environ, start_response)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/pecan/middleware/recursive.py", line 56, in __call__
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     return self.application(environ, start_response)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/pecan/core.py", line 835, in __call__
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     return super(Pecan, self).__call__(environ, start_response)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/pecan/core.py", line 731, in __call__
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     state
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/pecan/core.py", line 860, in handle_hooks
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     return super(Pecan, self).handle_hooks(hooks, *args, **kw)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/pecan/core.py", line 342, in handle_hooks
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     result = getattr(hook, hook_type)(*args)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/neutron/pecan_wsgi/hooks/policy_enforcement.py", line 190, in after
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     pluralized=collection))]
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/neutron/pecan_wsgi/hooks/policy_enforcement.py", line 208, in _get_filtered_item
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     neutron_context, controller, resource, collection, data)
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors   File "/usr/lib/python2.7/site-packages/neutron/pecan_wsgi/hooks/policy_enforcement.py", line 227, in _exclude_attributes_by_policy
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors     for attr_name in six.viewkeys(data):
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors RuntimeError: dictionary changed size during iteration
2019-06-19 21:02:23.209 27 ERROR oslo_middleware.catch_errors 
2019-06-19 21:02:23.213 27 INFO neutron.wsgi [req-1593d3be-722f-4ae0-ae30-420ab204cfa1 d73acac8cc3c447ca41a24935ff2be3c 5a1795d2825745799034204417b9f28c - default default] 10.10.105.100 "GET /v2.0/ports?device_id=afdd50ef-f557-459e-9c5f-3e3a5a0043d2 HTTP/1.1" status: 500  len: 380 time: 0.1940920

Comment 2 Bernard Cafarelli 2019-06-20 12:18:20 UTC
Queens backport is already merged: https://review.opendev.org/#/c/662464/

Comment 16 errata-xmlrpc 2019-07-10 13:02:20 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:1744


Note You need to log in before you can comment on or make changes to this bug.