Value Type of http_connect_timeout is Wrong

[Masahito Muroi]

[Impact]

we can't configure http_connect_timeout more than 1. http_connect_timeout is defined as Boolean value in python-keystoneclient and keystonemiddleware since python can treat a value more than 1 as True. But oslo config defines Boolean values as 'true', 1, 'yes' and 'on'.

To be able to configure the value, keystoneclient and keystonemiddleware should change the type of the config to Int.

[Test Case]
- Edit the [keystone_authtoken] section (nova or ceilometer config), adding the parameter:
http_connect_timeout = 900
- Restart the service
- If debug is enabled the following entries should be printed on log:

- 2015-08-10 13:50:16.372 11612 INFO urllib3.connectionpool [-] Starting new HTTPS connection (1): 10.93.68.29

2015-08-10 13:50:16.403 11612 DEBUG urllib3.connectionpool [-] Setting read timeout to 900 _make_request /usr/lib/python2.7/dist-packages/urllib3/connectionpool.py:390

Without the patch the read timeout is set to an incorrect boolean value.

[Regression Potential]
The change is minimal. That said, however, since the timeout value has only been set to limited values in the past, the fix enables a wider range of timeout values. This needs to be considered as part of the SRU testing.

[Morgan Fainberg (mdrnstm)]

The middleware code in python-keystoneclient is frozen and will not see any bug fixes or new development unless it is a security vulnerability fix. The code in python-keystoneclient is being maintained strictly for compatibility reasons (not breaking existing deployments).

[Morgan Fainberg (mdrnstm)]

This should be fixed as it is the same bug as bug 1353315

[Masahito Muroi (muroi-masahito)]

This bug isn't the same bug as bug 1353315. Same error occurs after patching the fix.

Error messages are:

2014-09-11 11:23:11.069 TRACE nova self.app = self.loader.load_app(name)
2014-09-11 11:23:11.069 TRACE nova File "/opt/stack/nova/nova/wsgi.py", line 518, in load_app
2014-09-11 11:23:11.069 TRACE nova return deploy.loadapp("config:%s" % self.config_path, name=name)
2014-09-11 11:23:11.069 TRACE nova File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 247, in loadapp
2014-09-11 11:23:11.069 TRACE nova return loadobj(APP, uri, name=name, **kw)
2014-09-11 11:23:11.069 TRACE nova File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 272, in loadobj
2014-09-11 11:23:11.069 TRACE nova return context.create()
2014-09-11 11:23:11.069 TRACE nova File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 710, in create
2014-09-11 11:23:11.069 TRACE nova return self.object_type.invoke(self)
2014-09-11 11:23:11.069 TRACE nova File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 144, in invoke
2014-09-11 11:23:11.069 TRACE nova **context.local_conf)
2014-09-11 11:23:11.069 TRACE nova File "/usr/lib/python2.7/dist-packages/paste/deploy/util.py", line 56, in fix_call
2014-09-11 11:23:11.069 TRACE nova val = callable(*args, **kw)
2014-09-11 11:23:11.069 TRACE nova File "/opt/stack/nova/nova/api/openstack/urlmap.py", line 159, in urlmap_factory
2014-09-11 11:23:11.069 TRACE nova app = loader.get_app(app_name, global_conf=global_conf)
2014-09-11 11:23:11.069 TRACE nova File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 350, in get_app
2014-09-11 11:23:11.069 TRACE nova name=name, global_conf=global_conf).create()
2014-09-11 11:23:11.069 TRACE nova File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 710, in create
2014-09-11 11:23:11.069 TRACE nova return self.object_type.invoke(self)
2014-09-11 11:23:11.069 TRACE nova File "/usr/lib/python2.7/dist-packages/paste/deploy/loadwsgi.py", line 144, in invoke
2014-09-11 11:23:11.069 TRACE nova **context.local_conf)
2014-09-11 11:23:11.069 TRACE nova File "/usr/lib/python2.7/dist-packages/paste/deploy/util.py", line 56, in fix_call
2014-09-11 11:23:11.069 TRACE nova val = callable(*args, **kw)
2014-09-11 11:23:11.069 TRACE nova File "/opt/stack/nova/nova/api/auth.py", line 75, in pipeline_factory
2014-09-11 11:23:11.069 TRACE nova return _load_pipeline(loader, pipeline)
2014-09-11 11:23:11.069 TRACE nova File "/opt/stack/nova/nova/api/auth.py", line 58, in _load_pipeline
2014-09-11 11:23:11.069 TRACE nova app = filter(app)
2014-09-11 11:23:11.069 TRACE nova File "/usr/local/lib/python2.7/dist-packages/keystonemiddleware/auth_token.py", line 1575, in auth_filter
2014-09-11 11:23:11.069 TRACE nova return AuthProtocol(app, conf)
2014-09-11 11:23:11.069 TRACE nova File "/usr/local/lib/python2.7/dist-packages/keystonemiddleware/auth_token.py", line 527, in __init__
2014-09-11 11:23:11.069 TRACE nova self._session = self._session_factory()
2014-09-11 11:23:11.069 TRACE nova File "/usr/local/lib/python2.7/dist-packages/...

[Dolph Mathews (dolph)]

There's a patch in review for this somewhere (I've certainly reviewed it). Does anyone have a link?

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/126543
Committed: https://git.openstack.org/cgit/openstack/keystonemiddleware/commit/?id=c1eef68186ede3cc0bf521e34056489abea7fcd1
Submitter: Jenkins
Branch: master

commit c1eef68186ede3cc0bf521e34056489abea7fcd1
Author: Masahito Muroi <email address hidden>
Date: Tue Oct 7 20:57:46 2014 +0000

    Changing the value type of http_connect_timeout

    The value type of http_connect_timeout definition
    is changed from Bool to Int value. Python treats
    a value more than 1 as True but oslo config defines
    Boolean values as 'true, '1', 'yes' and 'on'.
    So http_connect_timeout is only configured 1 or None.

    Change-Id: I53075cc04d0ccea543f8e657279534208ed03058
    Closes-bug: #1368545

[Alvaro Lopez (aloga)]

FWIW, the original patch was here: https://review.openstack.org/#/c/117213/

I do not know why it made the gate tests fail, being the very same patch.

[Alvaro Lopez (aloga)]

Nevermind, I realized that this was against keystonemiddleware, not python-keystoneclient.

[Corey Bryant (corey.bryant)]

Fixes required for Ubuntu:

icehouse (trusty) - python-keystoneclient
juno (utopic) - python-keystoneclient and python-keystonemiddleware (cloud archive only - utopic EOL)
kilo (vivid) - python-keystoneclient
liberty (wily) - python-keystoneclient

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Trusty Patch" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Sebastien Bacher (seb128)]

Could somebody add a testcase for the SRU?

[Brian Murray (brian-murray)]

This doesn't seem to be fixed in wily yet.

http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/wily/python-keystoneclient/wily-proposed/view/head:/keystoneclient/middleware/auth_token.py#L237

[Brian Murray (brian-murray)]

From #ubuntu-release:

11:52 < coreycb> bdmurray, ugh, we're behind it didn't
                 get uploaded. sorry about that.
11:53 < coreycb> bdmurray, it's in the branch but not
                 uploaded. maybe hold off on that then
                 until we get it uploaded and sync'd?

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-keystoneclient - 1:1.6.0-2

---------------
python-keystoneclient (1:1.6.0-2) experimental; urgency=medium

  * d/p/fix-key-iteration.patch: Iterate over copy of session.adapters keys.
  * d/p/fix-1368545.patch: Change http_connect_timeout to IntOpt. (LP: #1368545)
  * d/p/oauth-use-actual-request-headers.patch: Make OAuth testcase use actual
    request headers.

 -- Corey Bryant <email address hidden> Wed, 12 Aug 2015 09:30:59 -0400

[Chris J Arges (arges)]

Hello Masahito, or anyone else affected,

Accepted python-keystoneclient into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python-keystoneclient/1:0.7.1-ubuntu1.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris J Arges (arges)]

Hello Masahito, or anyone else affected,

Accepted python-keystoneclient into vivid-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python-keystoneclient/1:1.2.0-0ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Corey Bryant (corey.bryant)]

python-keystoneclient 1:0.7.1-ubuntu1.3 has been verified on trusty-proposed.
python-keystoneclient 1:1.2.0-0ubuntu1.2 has been verified on trusty-proposed.

[Corey Bryant (corey.bryant)]

That should say: python-keystoneclient 1:1.2.0-0ubuntu1.2 has been verified on vivid-proposed.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-keystoneclient - 1:0.7.1-ubuntu1.3

---------------
python-keystoneclient (1:0.7.1-ubuntu1.3) trusty; urgency=medium

  * debian/patches/fix-1368545.patch: hanging the value type of
    http_connect_timeout to IntOpt. (LP: #1368545)

 -- Jorge Niedbalski <email address hidden> Fri, 07 Aug 2015 10:50:46 -0300

[Chris J Arges (arges)]

The verification of the Stable Release Update for python-keystoneclient has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-keystoneclient - 1:1.2.0-0ubuntu1.2

---------------
python-keystoneclient (1:1.2.0-0ubuntu1.2) vivid; urgency=medium

  * debian/patches/fix-1368545.patch: Changing the value type of
    http_connect_timeout to IntOpt. (LP: #1368545)

 -- Jorge Niedbalski <email address hidden> Fri, 07 Aug 2015 11:53:37 -0300