Removing rule from policy causes DBError while updating firewall

[Elena Ezhova]

When an firewall rule is being removed _rpc_update_firewall is called which makes an attempt to get the list of router associated with the firewall. [1] Passing id instead of firewall_id to self.get_firewall_routers leads to the following DBError:

2015-07-16 09:39:18.189 ^[[00;32mDEBUG neutron_fwaas.db.firewall.firewall_router_insertion_db [^[[01;36mreq-4c46e87c-a8c0-4edb-94c9-f1bf63a165cd ^[[00;36madmin d824ce1d57644755a6e7e62681c38af3^[[00;32m] ^[[01;35m^[[00;32mneutron_fwaas.services.firewall.fwaas_plugin.FirewallPlugin method get_firewall_routers called with arguments (<neutron.context.Context object at 0x7fac41e43ed0>, <built-in function id>) {}^[[00m ^[[00;33mfrom (pid=2443) wrapper /usr/local/lib/python2.7/dist-packages/oslo_log/helpers.py:45^[[00m
2015-07-16 09:39:18.193 ^[[01;31mERROR oslo_db.sqlalchemy.exc_filters [^[[01;36mreq-4c46e87c-a8c0-4edb-94c9-f1bf63a165cd ^[[00;36madmin d824ce1d57644755a6e7e62681c38af3^[[01;31m] ^[[01;35m^[[01;31mDB exception wrapped.^[[00m
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00mTraceback (most recent call last):
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m File "/usr/local/lib/python2.7/dist-packages/sqlalchemy/engine/base.py", line 1139, in _execute_context
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m context)
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m File "/usr/local/lib/python2.7/dist-packages/sqlalchemy/engine/default.py", line 450, in do_execute
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m cursor.execute(statement, parameters)
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m File "/usr/local/lib/python2.7/dist-packages/pymysql/cursors.py", line 132, in execute
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m query = query % self._escape_args(args, conn)
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m File "/usr/local/lib/python2.7/dist-packages/pymysql/cursors.py", line 98, in _escape_args
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m return tuple(conn.escape(arg) for arg in args)
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m File "/usr/local/lib/python2.7/dist-packages/pymysql/cursors.py", line 98, in <genexpr>
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m return tuple(conn.escape(arg) for arg in args)
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m File "/usr/local/lib/python2.7/dist-packages/pymysql/connections.py", line 729, in escape
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m return escape_item(obj, self.charset, mapping=mapping)
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m File "/usr/local/lib/python2.7/dist-packages/pymysql/converters.py", line 33, in escape_item
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m val = encoder(val, mapping)
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m File "/usr/local/lib/python2.7/dist-packages/pymysql/converters.py", line 74, in escape_unicode
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m return escape_str(value, mapping)
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m File "/usr/local/lib/python2.7/dist-packages/pymysql/converters.py", line 71, in escape_str
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m return "'%s'" % escape_string(value, mapping)
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m File "/usr/local/lib/python2.7/dist-packages/pymysql/converters.py", line 68, in escape_string
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m lambda match: ESCAPE_MAP.get(match.group(0)), value),))
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00mTypeError: expected string or buffer
^[[01;31m2015-07-16 09:39:18.193 TRACE oslo_db.sqlalchemy.exc_filters ^[[01;35m^[[00m
2015-07-16 09:39:18.205 ^[[01;31mERROR neutron.api.v2.resource [^[[01;36mreq-4c46e87c-a8c0-4edb-94c9-f1bf63a165cd ^[[00;36madmin d824ce1d57644755a6e7e62681c38af3^[[01;31m] ^[[01;35m^[[01;31mremove_rule failed^[[00m

The complete trace can be found here: [2]

[1] https://github.com/openstack/neutron-fwaas/blob/master/neutron_fwaas/services/firewall/fwaas_plugin.py#L164-L175
[2] http://paste.openstack.org/show/380339/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/202533

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/202533
Committed: https://git.openstack.org/cgit/openstack/neutron-fwaas/commit/?id=caf39a47e3aa08f164e609e5f82ac672eafd88f1
Submitter: Jenkins
Branch: master

commit caf39a47e3aa08f164e609e5f82ac672eafd88f1
Author: Elena Ezhova <email address hidden>
Date: Thu Jul 16 15:27:52 2015 +0300

    Fix wrong argument name in _rpc_update_firewall

    Passing id (built-in function id) instead of firewall_id to
    get_firewall_routers caused DBErrors due to wrong argument type.

    This change fixes this typo and adds missing unit tests that can
    prevent such error from appearing in the future.

    Change-Id: I35f13b1aab5a566c1e2768a4027e61120bf6ba2e
    Closes-Bug: #1475244

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/216633

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/216633
Committed: https://git.openstack.org/cgit/openstack/neutron-fwaas/commit/?id=3565c6561a7eb1432103650dce5e532573a6285b
Submitter: Jenkins
Branch: stable/kilo

commit 3565c6561a7eb1432103650dce5e532573a6285b
Author: Elena Ezhova <email address hidden>
Date: Thu Jul 16 15:27:52 2015 +0300

    Fix wrong argument name in _rpc_update_firewall

    Passing id (built-in function id) instead of firewall_id to
    get_firewall_routers caused DBErrors due to wrong argument type.

    This change fixes this typo and adds missing unit tests that can
    prevent such error from appearing in the future.

    Change-Id: I35f13b1aab5a566c1e2768a4027e61120bf6ba2e
    Closes-Bug: #1475244
    (cherry picked from commit caf39a47e3aa08f164e609e5f82ac672eafd88f1)

[Andrey Bubyr (abubyr)]

This fix works only if firewall has connected router(s).

When I'm creating firewall without any routers (state INACTIVE), adding or removing of rule to/from policy causes the same error - firewall goes from INACTIVE to ERROR state.

[Elena Ezhova (eezhova)]

I checked on master: there are no errors for both cases (when a firewall has an associated router and when it doesn't).