test_filtering_shared_networks fails intermittently

[Armando Migliaccio]

An example:

http://logs.openstack.org/25/212425/4/check/gate-neutron-dsvm-api/7a222e3/testr_results.html.gz

Query:

message:"in test_filtering_shared_networks" AND build_status:"FAILURE"

Logstash URL:
http://logstash.openstack.org/#eyJzZWFyY2giOiJtZXNzYWdlOlwiaW4gdGVzdF9maWx0ZXJpbmdfc2hhcmVkX25ldHdvcmtzXCIgQU5EIGJ1aWxkX3N0YXR1czpcIkZBSUxVUkVcIiIsImZpZWxkcyI6W10sIm9mZnNldCI6MCwidGltZWZyYW1lIjoiNjA0ODAwIiwiZ3JhcGhtb2RlIjoiY291bnQiLCJ0aW1lIjp7InVzZXJfaW50ZXJ2YWwiOjB9LCJzdGFtcCI6MTQ0MjA1MDM1MTQwNCwibW9kZSI6IiIsImFuYWx5emVfZmllbGQiOiIifQ==

15 failures over the last 7 days. It's unclear when it started, most likely a latent race popping up after something else reshuffled the
typical execution run.

[Armando Migliaccio (armando-migliaccio)]

It looks like the filtering is broken, as there are networks returned whose 'shared' value does not make the filter specified:

This request:

2015-09-11 11:23:15,244 6305 INFO [tempest_lib.common.rest_client] Request (SharedNetworksTest:test_filtering_shared_networks): 200 GET http://127.0.0.1:9696/v2.0/networks?shared=False 0.148s

Gets this response:

        Body: {"networks": [{"status": "ACTIVE", "subnets": ["9368a45d-3c6d-4521-b737-48efefe56324", "04e2d89e-c622-41b4-beab-54b031e3af07"], "name": "public", "admin_state_up": true, "tenant_id": "bc0fb558ac124319aab4bb5e2c50224e", "mtu": 0, "router:external": true, "shared": false, "port_security_enabled": true, "id": "07a775c4-0dbd-4f70-b06a-e6bde021aa94", "qos_policy_id": null}, {"status": "ACTIVE", "subnets": [], "name": "test-network--1632961565", "admin_state_up": true, "tenant_id": "634d0952b097401aaed76cfda2851541", "mtu": 0, "router:external": false, "shared": false, "port_security_enabled": true, "id": "274828a9-c7c5-4d51-9ed2-3fe9759c2f87", "qos_policy_id": null}, {"status": "ACTIVE", "subnets": ["2b6b9fc2-52f4-4807-b82a-f1545b874179"], "name": "test-network--309437907", "admin_state_up": true, "tenant_id": "ddd8392aa90c4c339612144273ee9b7f", "mtu": 0, "router:external": false, "shared": true, "port_security_enabled": true, "id": "41252ae7-ebed-4748-8dad-af6ee7b62956", "qos_policy_id": null}]}

And this one clearly contains a network that has shared attribute == True

[Armando Migliaccio (armando-migliaccio)]

@Kevin: can you triage this a bit please?

[Armando Migliaccio (armando-migliaccio)]

For what I can tell it seems like by the time we see whether tenant has access to the network, and the time the 'shared' attributed is elaborated something slips in whereby a network that wasn't initially shared is shown like so, even though it was selected with the opposite filter. Not sure how it's quite possible during the test above, but I would be tempted to say that is what happens.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/223024

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/223024
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=ad9aaa63e5ea427d24c07e6a36a2976d83f1a26f
Submitter: Jenkins
Branch: master

commit ad9aaa63e5ea427d24c07e6a36a2976d83f1a26f
Author: Kevin Benton <email address hidden>
Date: Fri Sep 4 18:27:42 2015 -0700

    Fix RBAC filter query for negative case

    The query to find networks that aren't shared to the querier was
    broken. It was querying for the inverse of RBAC entries that shared
    to the querier, so it would return the network for each other tenant
    it was shared to. This meant that if a network had multiple RBAC
    entries, a shared=False filter wouldn't work in the API.

    This patch corrects the behavior by adjusting the query that looks
    for objects not shared to the caller to make sure the object ID doesn't
    appear in the shared subquery.

    This patch also adds a test that reliably reproduces the original issue.
    The sporadically failing filter test that revealed this issue depended
    on a race to have a network be shared to another tenant and to the wildcard
    at the same time.

    Change-Id: I9dcd869c1640b223221ba12e97284bbfcabbeb2b
    Closes-Bug: #1495040

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: feature/pecan
Review: https://review.openstack.org/224334

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: feature/pecan
Review: https://review.openstack.org/224357

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/224357
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=fdc3431ccd219accf6a795079d9b67b8656eed8e
Submitter: Jenkins
Branch: feature/pecan

commit fe236bdaadb949661a0bfb9b62ddbe432b4cf5f1
Author: Miguel Angel Ajo <email address hidden>
Date: Thu Sep 3 15:40:12 2015 +0200

    No network devices on network attached qos policies

    Network devices, like internal router legs, or dhcp ports
    should not be affected by bandwidth limiting rules.

    This patch disables application of network attached policies
    to network/neutron owned ports.

    Closes-bug: #1486039
    DocImpact

    Change-Id: I75d80227f1e6c4b3f5fa7762b8dc3b0c0f1abd46

commit db4a06f7caa20a4c7879b58b20e95b223ed8eeaf
Author: Ken'ichi Ohmichi <email address hidden>
Date: Wed Sep 16 10:04:32 2015 +0000

    Use tempest-lib's token_client

    Now tempest-lib provides token_client modules as library and the
    interface is stable. So neutron repogitory doesn't need to contain
    these modules.
    This patch makes neutron use tempest-lib's token_client and removes
    the own modules for the maintenance.

    Change-Id: Ieff7eb003f6e8257d83368dbc80e332aa66a156c

commit 78aed58edbe6eb8a71339c7add491fe9de9a0546
Author: Jakub Libosvar <email address hidden>
Date: Thu Aug 13 09:08:20 2015 +0000

    Fix establishing UDP connection

    Previously, in establish_connection() for UDP protocol data were sent
    but never read on peer socket. That lead to successful read on peer side
    if this connection was filtered. Having constant testing string masked
    this issue as we can't distinguish to which test of connectivity data
    belong.

    This patch makes unique data string per test_connectivity() and
    also makes establish_connection() to create an ASSURED entry in
    conntrack table. Finally, in last test after firewall filter was
    removed, connection is re-established in order to avoid troubles with
    terminated processes or TCP continuing sending packets which weren't
    successfully delivered.

    Closes-Bug: 1478847
    Change-Id: I2920d587d8df8d96dc1c752c28f48ba495f3cf0f

commit e6292fcdd6262434a7b713ad8802db6bc8a6d3dc
Author: YAMAMOTO Takashi <email address hidden>
Date: Wed Sep 16 13:20:51 2015 +0900

    ovsdb: Fix a few docstring

    Change-Id: I53e1e21655b28fe5da60e58aeeb7cbbd103ae014

commit c22949a4449d96a67caa616290cf76b67b182917
Author: fumihiko kakuma <email address hidden>
Date: Wed Sep 16 11:52:59 2015 +0900

    Remove requirements.txt for the ofagent mechanism driver

    It is no longer used.

    Related-Blueprint: core-vendor-decomposition
    https://blueprints.launchpad.net/neutron/+spec/core-vendor-decomposition

    Change-Id: Ib31fb3febf8968e50d86dd66e1e6e1ea2313f8ac

commit d1d4de19d85f961d388c91e70f31b3bafec418c5
Author: Kevin Benton <email address hidden>
Date: Thu Sep 3 20:25:57 2015 -0700

    Always return iterables in L3 get_candidates

    The caller of this function expects iterables.

    Closes-Bug: #1494996
    Change-Id: I3d103e63f4e127a77268502415c0ddb0d804b54a

commit 1ad6ac448067306...

[OpenStack Infra (hudson-openstack)]

Change abandoned by Doug Wiegley (<email address hidden>) on branch: feature/pecan
Review: https://review.openstack.org/224334