Non existing property protection file raises 500 Internal server error

[Abhishek Kekane]

Non existing property protection file raises 500 Internal server error

If admin/operator specifies non existing property protection file in glance-api.conf then create/update image call raises 500 Internal server error.

Steps to reproduce:
1. Enable property protection in glance-api.conf and provide non existing file
   [Default]
   property_protection_file = non_existing_file.yaml
   property_protection_rule_format = policies

2. Restart glance-api service
3. Create image by specifiying additional property
   glance image-create-via-import --disk-format qcow2 --container-format bare --name conversion_test --import-method web-download --uri https://download.cirros-cloud.net/0.3.5/cirros-0.3.5-x86_64-disk.img --property xyz=xyz

Expected Result:
  API should return 400 Bad request

Actual result:
  Returns 500 Internal server error

Glance API Logs:

Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.property_utils [None req-43d209a4-3143-4855-b843-2137a9cbb22b admin admin] Couldn't find property protection file /etc/glance/property.yaml: 'NoneType' object is not iterable.
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi [None req-43d209a4-3143-4855-b843-2137a9cbb22b admin admin] Caught error: Invalid configuration in property protection file.: glance.common.exception.InvalidPropertyProtectionConfiguration: Invalid configuration in property protection file.
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi Traceback (most recent call last):
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/common/property_utils.py", line 119, in _load_rules
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi CONFIG.read(conf_file)
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi File "/usr/lib/python3.6/configparser.py", line 694, in read
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi for filename in filenames:
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi TypeError: 'NoneType' object is not iterable
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi During handling of the above exception, another exception occurred:
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi Traceback (most recent call last):
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/common/wsgi.py", line 1348, in __call__
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi request, **action_args)
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/common/wsgi.py", line 1391, in dispatch
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi return method(*args, **kwargs)
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/common/utils.py", line 416, in wrapped
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi return func(self, req, *args, **kwargs)
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/api/v2/images.py", line 74, in create
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi image_factory = self.gateway.get_image_factory(req.context)
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/gateway.py", line 50, in get_image_factory
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi property_rules = property_utils.PropertyRules(self.policy)
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/common/property_utils.py", line 114, in __init__
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi self._load_rules()
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi File "/opt/stack/glance/glance/common/property_utils.py", line 125, in _load_rules
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi raise InvalidPropProtectConf()
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi glance.common.exception.InvalidPropertyProtectionConfiguration: Invalid configuration in property protection file.
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: ERROR glance.common.wsgi
Nov 26 06:49:54 akekane-wallaby-dev glance-api[15444]: INFO eventlet.wsgi.server [None req-43d209a4-3143-4855-b843-2137a9cbb22b admin admin] 10.0.79.216,10.0.79.216 - - [26/Nov/2020 06:49:54] "POST /v2/images HTTP/1.1" 500 454 0.053478
Nov 26 06:50:21 akekane-wallaby-dev glance-api[15444]: DEBUG glance.image_cache.prefetcher [-] Nothing to prefetch. {{(pid=15444) run /opt/stack/glance/glance/image_cache/prefetcher.py:76}}

[Han Guangyu (han-guangyu)]

Hello, could you give more explanation? Why did you think 400 should be used

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/glance/+/819399
Committed: https://opendev.org/openstack/glance/commit/4e59a04d27175533d7ae91b9acd23ffe32a5917a
Submitter: "Zuul (22348)"
Branch: master

commit 4e59a04d27175533d7ae91b9acd23ffe32a5917a
Author: Han Guangyu <email address hidden>
Date: Fri Nov 26 14:25:00 2021 +0800

    Update exception for property protection file

    Non existing property protection file raises 500 Internal server
    error. If admin/operator specifies non existing property protection
    file in glance-api.conf. For example:
        [Default]
        property_protection_file = non_existing_file.yaml
        property_protection_rule_format = policies
    Then create or update image. The 500 Internal server error will be
    raised. But the expected result is 400 Bad Request.

    Add the except of InavlidPropertyProtectionConfiguration exception,
    and return 400 Bad Request.

    The previous code lacks the specific process of
    PropertyProtectionConfiguration exception, so it returned the common
    500 error. Now, it returns 400 Bad Request.

    Closes-Bug: #1905672
    Change-Id: Id77010aac04aa9a4961c5bcafbf12694a0fe17c6

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/glance 25.0.0.0b3 development milestone.