When use incorrect filter for os port list neutron returns the list of all ports

[Valentina Pytlik]

I have several ports in my openstack account
I want to get list ports with specific option and specify filter.
here is an example:
curl -X GET "https://.../v2.0/ports?network_id=123" -H "Accept: application/json"

However, when I specify incorrect filter to API it returns all available ports.
example below:
curl-X GET "https://.../v2.0/ports?network_iddd=123" -H "Accept: application/json"

It looks dangerous, because I could make a mistake in filter on set or delete commands and as result this changes be applied to all available ports.

I suppose, that correct behaviour should be: return nothing or fail with an error. what do you think about it?

[Brian Haley (brian-haley)]

So the neutron API has been behaving this way forever - if the filter key given is not in the object definition it is ignored - see neutron_lib/db/model_query.py:apply_filters() for reference.

Any change to this behavior would have to be opt-in to not break backwards compatibility, so via an extension that is not enabled by default. This is just a thought.

What do other services do? For example, Nova?

[Dr. Jens Harbott (j-harbott)]

IIUC the "filter-validation" extension is what was implemented to handle this, see https://opendev.org/openstack/neutron-lib/src/branch/master/api-ref/source/v2/intro.inc#L168-L172 . It seems that it isn't enabled by default though, so deployments have to opt-in to activate it

[Valentina Pytlik (vanellopka)]

Unfortunately, I don't know about behavior in other services.
I am interesting for the neutron case only.

I will try to use filter_validation extension and come back with results later.

[Brian Haley (brian-haley)]

I guess I had forgotten about this extension, thanks for the reminder Jens.

https://review.opendev.org/c/openstack/neutron/+/574907 (merged in Rocky)

Valentina - check if the extension is loaded:

$ openstack extension list --network | grep filter-validation

If not, make sure it's enabled in neutron.conf (default is True)

    filter_validation=True

And make sure it's enabled in ml2_conf.ini (default is not, although I didn't have to enable it):

    extension_drivers=...,filter-validation,...

If you update that and restart neutron-server, the above extension check should list it.