failed to list qos rule type due to policy check

Bug #1487324 reported by yong sheng gong
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
neutron
Fix Released
Undecided
yong sheng gong

Bug Description

2015-08-21 13:52:36.212 23375 INFO neutron.wsgi [-] (23375) accepted ('192.168.1.118', 43606)
2015-08-21 13:52:42.711 ERROR neutron.policy [req-ba182095-d12d-4bde-a47e-88507e4c4898 demo demo] Unable to verify match:%(tenant_id)s as the parent resource: tenant was not found
2015-08-21 13:52:42.711 23375 ERROR neutron.policy Traceback (most recent call last):
2015-08-21 13:52:42.711 23375 ERROR neutron.policy File "/mnt/data3/opt/stack/neutron/neutron/policy.py", line 224, in __call__
2015-08-21 13:52:42.711 23375 ERROR neutron.policy parent_res, parent_field = do_split(separator)
2015-08-21 13:52:42.711 23375 ERROR neutron.policy File "/mnt/data3/opt/stack/neutron/neutron/policy.py", line 219, in do_split
2015-08-21 13:52:42.711 23375 ERROR neutron.policy separator, 1)
2015-08-21 13:52:42.711 23375 ERROR neutron.policy ValueError: need more than 1 value to unpack
2015-08-21 13:52:42.711 23375 ERROR neutron.policy
2015-08-21 13:52:42.714 ERROR neutron.api.v2.resource [req-ba182095-d12d-4bde-a47e-88507e4c4898 demo demo] index failed
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource Traceback (most recent call last):
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource File "/mnt/data3/opt/stack/neutron/neutron/api/v2/resource.py", line 83, in resource
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource result = method(request=request, **args)
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource File "/mnt/data3/opt/stack/neutron/neutron/api/v2/base.py", line 339, in index
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource return self._items(request, True, parent_id)
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource File "/mnt/data3/opt/stack/neutron/neutron/api/v2/base.py", line 279, in _items
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource pluralized=self._collection)]
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource File "/mnt/data3/opt/stack/neutron/neutron/policy.py", line 354, in check
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource pluralized=pluralized)
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource File "/usr/lib/python2.7/site-packages/oslo_policy/policy.py", line 487, in enforce
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource result = rule(target, creds, self)
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource File "/usr/lib/python2.7/site-packages/oslo_policy/_checks.py", line 238, in __call__
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource return enforcer.rules[self.match](target, creds, enforcer)
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource File "/usr/lib/python2.7/site-packages/oslo_policy/_checks.py", line 238, in __call__
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource return enforcer.rules[self.match](target, creds, enforcer)
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource File "/usr/lib/python2.7/site-packages/oslo_policy/_checks.py", line 191, in __call__
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource if rule(target, cred, enforcer):
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource File "/mnt/data3/opt/stack/neutron/neutron/policy.py", line 246, in __call__
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource reason=err_reason)
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource PolicyCheckError: Failed to check policy tenant_id:%(tenant_id)s because Unable to verify match:%(tenant_id)s as the parent resource: tenant was not found
2015-08-21 13:52:42.714 23375 ERROR neutron.api.v2.resource

$ neutron qos-available-rule-types -v
DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://172.17.42.1:5000/v2.0 -H "Accept: application/json" -H "User-Agent: python-keystoneclient"
DEBUG: keystoneclient.session RESP: [200] Content-Length: 337 Vary: X-Auth-Token Connection: keep-alive Date: Fri, 21 Aug 2015 05:52:35 GMT Content-Type: application/json X-Openstack-Request-Id: req-3ff33f59-d69b-412a-8137-0ce5f6deb868
RESP BODY: {"version": {"status": "stable", "updated": "2014-04-17T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v2.0+json"}], "id": "v2.0", "links": [{"href": "http://172.17.42.1:5000/v2.0/", "rel": "self"}, {"href": "http://docs.openstack.org/", "type": "text/html", "rel": "describedby"}]}}

DEBUG: stevedore.extension found extension EntryPoint.parse('yaml = clifftablib.formatters:YamlFormatter')
DEBUG: stevedore.extension found extension EntryPoint.parse('json = clifftablib.formatters:JsonFormatter')
DEBUG: stevedore.extension found extension EntryPoint.parse('html = clifftablib.formatters:HtmlFormatter')
DEBUG: stevedore.extension found extension EntryPoint.parse('table = cliff.formatters.table:TableFormatter')
DEBUG: stevedore.extension found extension EntryPoint.parse('csv = cliff.formatters.commaseparated:CSVLister')
DEBUG: stevedore.extension found extension EntryPoint.parse('value = cliff.formatters.value:ValueFormatter')
DEBUG: neutronclient.neutron.v2_0.qos.rule.ListQoSRuleTypes get_data(Namespace(columns=[], fields=[], formatter='table', max_width=0, page_size=None, quote_mode='nonnumeric', request_format='json', show_details=False, sort_dir=[], sort_key=[]))
DEBUG: keystoneclient.auth.identity.v2 Making authentication request to http://172.17.42.1:5000/v2.0/tokens
DEBUG: keystoneclient.session REQ: curl -g -i -X GET http://172.17.42.1:9696/v2.0/qos/rule-types.json -H "User-Agent: python-neutronclient" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}cbf58ad3ce9ff5b3eb3b7e8043ca6699841277b3"
DEBUG: keystoneclient.session RESP: [500] Date: Fri, 21 Aug 2015 05:52:42 GMT Connection: keep-alive Content-Type: application/json; charset=UTF-8 Content-Length: 211 X-Openstack-Request-Id: req-ba182095-d12d-4bde-a47e-88507e4c4898
RESP BODY: {"NeutronError": {"message": "Failed to check policy tenant_id:%(tenant_id)s because Unable to verify match:%(tenant_id)s as the parent resource: tenant was not found", "type": "PolicyCheckError", "detail": ""}}

DEBUG: neutronclient.v2_0.client Error message: {"NeutronError": {"message": "Failed to check policy tenant_id:%(tenant_id)s because Unable to verify match:%(tenant_id)s as the parent resource: tenant was not found", "type": "PolicyCheckError", "detail": ""}}
ERROR: neutronclient.shell Failed to check policy tenant_id:%(tenant_id)s because Unable to verify match:%(tenant_id)s as the parent resource: tenant was not found
Traceback (most recent call last):
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/shell.py", line 817, in run_subcommand
    return run_command(cmd, cmd_parser, sub_argv)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/shell.py", line 111, in run_command
    return cmd.run(known_args)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/common/command.py", line 29, in run
    return super(OpenStackCommand, self).run(parsed_args)
  File "/usr/lib/python2.7/site-packages/cliff/display.py", line 92, in run
    column_names, data = self.take_action(parsed_args)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/common/command.py", line 35, in take_action
    return self.get_data(parsed_args)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/neutron/v2_0/__init__.py", line 716, in get_data
    data = self.retrieve_list(parsed_args)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/neutron/v2_0/__init__.py", line 679, in retrieve_list
    data = self.call_server(neutron_client, search_opts, parsed_args)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/neutron/v2_0/__init__.py", line 651, in call_server
    data = obj_lister(**search_opts)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/v2_0/client.py", line 102, in with_params
    ret = self.function(instance, *args, **kwargs)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/v2_0/client.py", line 1706, in list_qos_rule_types
    retrieve_all, **_params)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/v2_0/client.py", line 307, in list
    for r in self._pagination(collection, path, **params):
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/v2_0/client.py", line 320, in _pagination
    res = self.get(path, params=params)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/v2_0/client.py", line 293, in get
    headers=headers, params=params)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/v2_0/client.py", line 270, in retry_request
    headers=headers, params=params)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/v2_0/client.py", line 211, in do_request
    self._handle_fault_response(status_code, replybody)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/v2_0/client.py", line 185, in _handle_fault_response
    exception_handler_v20(status_code, des_error_body)
  File "/mnt/data3/opt/stack/python-neutronclient/neutronclient/v2_0/client.py", line 70, in exception_handler_v20
    status_code=status_code)
InternalServerError: Failed to check policy tenant_id:%(tenant_id)s because Unable to verify match:%(tenant_id)s as the parent resource: tenant was not found

Revision history for this message
yong sheng gong (gongysh) wrote :

I am using non-admin user

Changed in neutron:
assignee: nobody → yong sheng gong (gongysh)
description: updated
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (master)

Fix proposed to branch: master
Review: https://review.openstack.org/215484

Changed in neutron:
status: New → In Progress
tags: added: qos
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (master)

Reviewed: https://review.openstack.org/215484
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=20459979e0b37ad74190d77cb9b7574b012f8ac4
Submitter: Jenkins
Branch: master

commit 20459979e0b37ad74190d77cb9b7574b012f8ac4
Author: gong yong sheng <gong.yongsheng@99cloud.net>
Date: Fri Aug 21 14:51:45 2015 +0800

    Add empty policy rule to get_rule_type action

    Without this empty policy rule, get_rule_type will use default, which
    will demand admin role or tenant_id in object. but rule_type has no
    tenant_id in its body.

    Change-Id: I92b1222fbcdc2efd13ca6f586cfefefc55b59189
    Closes-bug: #1487324

Changed in neutron:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (feature/pecan)

Fix proposed to branch: feature/pecan
Review: https://review.openstack.org/218710

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (feature/pecan)
Download full text (155.6 KiB)

Reviewed: https://review.openstack.org/218710
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=2c5f44e1b3bd4ed8a0b7232fd293b576cc8c1c87
Submitter: Jenkins
Branch: feature/pecan

commit f35d1c5c50dccbef1a2e079f967b82f0df0e22e9
Author: Adelina Tuvenie <email address hidden>
Date: Thu Aug 27 02:27:28 2015 -0700

    Fixes wrong neutron Hyper-V Agent name in constants

    Change Id03fb147e11541be309c1cd22ce27e70fadc28b5 moved the
    AGENT_TYPE_HYPERV constant from common.constants to
    plugins.ml2.drivers.hyperv.constants but change the value of the
    constant from 'HyperV agent' to 'hyperv'. This patch changes
    the name back to 'HyperV agent'

    Change-Id: If74b4b2a84811e266c8b12e70bf6bfe74ed4ea21
    Partial-Bug: #1487598

commit de604de334854e2eb6b4312ff57920564cbd4459
Author: OpenStack Proposal Bot <email address hidden>
Date: Sun Aug 30 01:39:06 2015 +0000

    Updated from global requirements

    Change-Id: Ie52aa3b59784722806726e4046bd07f4a4d97328

commit f0415ac20eaf5ab4abb9bd4839bf6d04ceee85d0
Author: armando-migliaccio <email address hidden>
Date: Fri Aug 28 13:53:04 2015 -0700

    Revert "Add support for unaddressed port"

    This implementation may expose a vulnerability where a malicious
    user can sieze the opportunity of a time window where a port
    may land unaddressed on a shared network, thus allowing him/her
    to suck up all the tenant traffic he/she wants....oh the shivers.

    This reverts commit d4c52b7f5a36a103a92bf9dcda7f371959112292.

    Change-Id: I7ebdaa8d3defa80eab90e460fde541a5bdd8864c

commit 013fdcd2a6d45dbe4de5d6e7077e5e9b60985ef9
Author: Assaf Muller <email address hidden>
Date: Fri Aug 28 16:41:07 2015 -0400

    Improve logging upon failure in iptables functional tests

    This will help us nail down a more accurate and efficient logstash
    query.

    Change-Id: Iee4238e358f7b056e373c7be8d6aa3202117a680
    Related-Bug: #1478847

commit 622dea818d851224a43d5276a81d5ce8a6eebb76
Author: Ivar Lazzaro <email address hidden>
Date: Mon Aug 17 17:17:42 2015 -0700

    handle gw_info outside of the db transaction on router creation

    Move the gateway interface creation outside the DB transaction
    to avoid lock timeout.

    Change-Id: I5a78d7f32e8ca912016978105221d5f34618af19
    Closes-bug: 1485809

commit 5b27d290a0a95f6247fc5a0fe6da1e7d905e6b2d
Author: Assaf Muller <email address hidden>
Date: Wed Aug 26 10:07:03 2015 -0400

    Remove ml2 resource extension success logging

    This is the cause of a tremendous amount of logs, for no
    perceivable gain. A normal dvr run in the gate shows this debug
    message around 120K times, which is way too much.

    Closes-Bug: #1489952

    Change-Id: I26fca8515d866a7cc1638d07fa33bc04479ae221

commit 8d3faf549cba2f58c872ef4121b2481e73464010
Author: huangpengtao <email address hidden>
Date: Fri Aug 28 23:20:46 2015 +0800

    Replace "prt" variable by "port"

    the local variable prt is meaningless,
    and port is used popular.

    Change-Id: I20849102cf5b4d84433c46791b4b1e2a22dc4739

commit ee374e7a5f4dea538fcd942f5...

tags: added: in-feature-pecan
Thierry Carrez (ttx)
Changed in neutron:
milestone: none → liberty-3
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in neutron:
milestone: liberty-3 → 7.0.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.