Enabling ml2 port security extension driver causes net-list to fail on existing deployment

Bug #1461519 reported by Magesh GV on 2015-06-03
62
This bug affects 11 people
Affects Status Importance Assigned to Milestone
neutron
High
Kahou Lei
Kilo
Undecided
Unassigned

Bug Description

I had a kilo setup where there were a few existing networks. Then I enabled the port security extension driver in ml2_conf.ini.

After this net-list fails because the extension driver tries to access the fields(port security related) which were never set for the old networks.

This also happens when port-security is enabled and when creating an HA router.

ocloud@ubuntu:~/devstack$ neutron net-list
Request Failed: internal server error while processing your request.

2015-06-03 17:14:44.059 ERROR neutron.api.v2.resource [req-d831393d-e02a-4405-8f3a-dd13291f86b1 admin admin] index failed
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource Traceback (most recent call last):
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/api/v2/resource.py", line 83, in resource
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource result = method(request=request, **args)
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/api/v2/base.py", line 319, in index
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource return self._items(request, True, parent_id)
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/api/v2/base.py", line 249, in _items
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource obj_list = obj_getter(request.context, **kwargs)
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/plugins/ml2/plugin.py", line 669, in get_networks
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource limit, marker, page_reverse)
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/db/db_base_plugin_v2.py", line 1020, in get_networks
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource page_reverse=page_reverse)
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/db/common_db_mixin.py", line 184, in _get_collection
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource items = [dict_func(c, fields) for c in query]
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/db/db_base_plugin_v2.py", line 858, in _make_network_dict
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource attributes.NETWORKS, res, network)
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/db/common_db_mixin.py", line 162, in _apply_dict_extend_functions
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource func(*args)
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/plugins/ml2/plugin.py", line 477, in _ml2_md_extend_network_dict
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource self.extension_manager.extend_network_dict(session, netdb, result)
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/plugins/ml2/managers.py", line 782, in extend_network_dict
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource driver.obj.extend_network_dict(session, base_model, result)
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/plugins/ml2/extensions/port_security.py", line 60, in extend_network_dict
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource self._extend_port_security_dict(result, db_data)
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource File "/opt/stack/neutron/neutron/plugins/ml2/extensions/port_security.py", line 68, in _extend_port_security_dict
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource db_data['port_security'][psec.PORTSECURITY])
2015-06-03 17:14:44.059 11154 TRACE neutron.api.v2.resource TypeError: 'NoneType' object has no attribute '__getitem__'

Kahou Lei (kahou82) on 2015-06-03
Changed in neutron:
assignee: nobody → Kahou Lei (kahou82)
Kahou Lei (kahou82) wrote :

I am able to reproduce it in Liberty. Looking into it now.

Kahou Lei (kahou82) wrote :

It is due to some old network was created before port_security_enable option is enabled. Fixing it now.

Changed in neutron:
status: New → Confirmed

Fix proposed to branch: master
Review: https://review.openstack.org/188209

Changed in neutron:
status: Confirmed → In Progress
Assaf Muller (amuller) on 2015-06-04
Changed in neutron:
importance: Undecided → Medium
yalei wang (yalei-wang) wrote :

have you update db?

this file 35a0f3365720_add_port_security_in_ml2.py will updated the dict for networks/ports created before.

Eran Kuris (ekuris) wrote :

there is already bug that I opened please duplicate one of the bugs .

https://bugs.launchpad.net/neutron/+bug/1454148

Assaf Muller (amuller) on 2015-07-08
tags: added: l3-ha
description: updated
Changed in neutron:
importance: Medium → High

Reviewed: https://review.openstack.org/188209
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=f4e1289d8d381b775f7a6e5f98c507a99fd42b54
Submitter: Jenkins
Branch: master

commit f4e1289d8d381b775f7a6e5f98c507a99fd42b54
Author: Kahou Lei <email address hidden>
Date: Wed Jun 3 16:39:11 2015 -0700

    populate port security default into network

    Previously, the default value would be populated into attr by API
    controller, but some codes in plugin or service plugins call plugin
    to create network directly, such as l3, which will have no default
    value populated.
    This patch fixes it by populating default port_security value into
    network data.

    In addition, for network without port-security set, we also give the
    default value to populate the return network dict object, which will
    let the extension construct the response dictionary gracefully for
    those existing network.

    Co-Authored-By: gong yong sheng <gong.yongsheng@99cloud.net>

    Change-Id: I73abc98d83372f6259f17680806e6541458e2077
    Closes-bug: #1461519
    Closes-Bug: #1461647
    Closes-Bug: #1468588

Changed in neutron:
status: In Progress → Fix Committed
Steve Baker (steve-stevebaker) wrote :

Could this bug please be backported to Kilo?

tags: added: kilo-backport-potential
Changed in neutron:
milestone: none → liberty-2
status: Fix Committed → Fix Released
Download full text (70.7 KiB)

Reviewed: https://review.openstack.org/207903
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=9badcd249dab2d3330f0cd608496b59c9f44499a
Submitter: Jenkins
Branch: feature/pecan

commit 991ea00e6c115343eabecc62e86072175823f81f
Author: Moshe Levi <email address hidden>
Date: Thu Jul 30 12:04:15 2015 +0300

    SR-IOV: Fix SR-IOV agent to run ip link commands as root

    Commit https://review.openstack.org/#/c/155523/
    remove the remaining root_helper args, but didn't
    update the SR-IOV agent to execute them as root.

    This patch updates the agent to execute ip link commands
    as root and pass options argument as a list in the
    self._as_root method.

    Closes-Bug: #1479694
    Change-Id: I53cafd61845a69fae3a759fb7526950d655ffa20

commit 5b3bacedf6c014815bef03c2e821b5eb8ef92dcb
Author: Saksham Varma <email address hidden>
Date: Thu Jul 23 22:46:23 2015 -0700

    Moved out cisco n1kv mech driver and db models

    Moving out Cisco N1Kv database models and the mech driver
    to the openstack/networking-cisco repo as part of the second
    phase vendor-core decomposition

    Partial-Bug: #1479123
    Partial-implements: blueprint core-vendor-decomposition

    Change-Id: I65a704b238d8cbe2951a6912fa4f1e8518c6f412

commit 65ac8cd0a80548e115b8ec1d4cfd47a94422fddf
Author: OpenStack Proposal Bot <email address hidden>
Date: Wed Jul 29 20:44:01 2015 +0000

    Updated from global requirements

    Change-Id: I3a884a73d51df0f93b5cc88b3e3250d81bb1f455

commit f0e8356d04d04600c072a1c0f0bdf274ff19ab8c
Author: sridhargaddam <email address hidden>
Date: Mon Jul 27 03:46:48 2015 +0000

    Update dhcp agent cache for network:dhcp ports

    When a network with a dhcp_enabled subnet is scheduled on a dhcp
    agent, dhcp driver creates the network:dhcp port for the subnet.
    However, the port info is not updated in dhcp agents internal cache.
    Subsequently if the user deletes the network:dhcp port, the port is
    properly deleted on the server side (i.e., in the database) and when
    the port_delete_end notification is sent to the dhcp agent, it simply
    ignores it as the port entry would be missing in the cache. This patch
    fixes this issue by updating the dhcp agents cache when dhcp driver
    creates the network:dhcp port for the subnets.

    Closes-Bug: #1478426
    Change-Id: I69f5834dd964a4320c606c4e0aa2cdba70416943

commit cb60d0bb4e0cc0cba68f59fdf5f4e89d6ec52950
Author: changzhi <email address hidden>
Date: Thu Jul 16 10:14:16 2015 +0800

    Keep dns nameserver order consistency

    Currently, there is no dns servers prioritization for subnets
    for Neutron.

    Generally speaking, it is useful to keep the order of dns
    nameservers consistent. Add a new column named 'order' in table
    'dnsnameservers' and add nameserver into DB one by one.

    Closes-Bug: #1218629
    Implements: blueprint keep-dns-nameserver-orderconsistency
    Change-Id: Id937aea411397d39370368a4eb45be26c4eefa9e

commit b39e1469e824bc8bc79e1ecafa98825a94811c0b
Author: Salvatore Orlando <email address hidden>
Date: Tue Jun 23 04:54:2...

tags: added: in-feature-pecan

Reviewed: https://review.openstack.org/228742
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=23944185af7ef4ec54a7e18b7a1c38a636b6b883
Submitter: Jenkins
Branch: stable/kilo

commit 23944185af7ef4ec54a7e18b7a1c38a636b6b883
Author: Kahou Lei <email address hidden>
Date: Wed Jun 3 16:39:11 2015 -0700

    populate port security default into network

    Previously, the default value would be populated into attr by API
    controller, but some codes in plugin or service plugins call plugin
    to create network directly, such as l3, which will have no default
    value populated.
    This patch fixes it by populating default port_security value into
    network data.

    In addition, for network without port-security set, we also give the
    default value to populate the return network dict object, which will
    let the extension construct the response dictionary gracefully for
    those existing network.

    Co-Authored-By: gong yong sheng <gong.yongsheng@99cloud.net>

    Change-Id: I73abc98d83372f6259f17680806e6541458e2077
    Closes-bug: #1461519
    Closes-Bug: #1461647
    Closes-Bug: #1468588
    (cherry picked from commit f4e1289d8d381b775f7a6e5f98c507a99fd42b54)

tags: added: in-stable-kilo
Thierry Carrez (ttx) on 2015-10-15
Changed in neutron:
milestone: liberty-2 → 7.0.0
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers