"ping" command should be correctly supported in rootwrap filters

[Rodolfo Alonso]

Some "ping" commands have failed because the rootwrap filter does not match. Example [1]:

RuntimeError: Process ['ping', '192.178.0.2', '-W', '1', '-c', '3'] hasn't been spawned in 20 seconds. Return code: 99, stdout: , sdterr: /home/zuul/src/opendev.org/openstack/neutron/.tox/dsvm-functional/bin/neutron-rootwrap: Unauthorized command: ip netns exec test-ed1ca152-40df-457f-95ea-bd1edd68baa9 ping 192.178.0.2 -W 1 -c 3 (no filter matched)

"ping" commands should always have the same parameters and in the same order.

[1] https://f686e70b9699eba6880c-12f0768fe735ff9b43e4aa64f3cfd6c9.ssl.cf2.rackcdn.com/701733/33/check/neutron-functional/36f4f9c/testr_results.html

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/707452

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/707452
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=cc3b9df4268ac339d0b7316595a4148ba4c69836
Submitter: Zuul
Branch: master

commit cc3b9df4268ac339d0b7316595a4148ba4c69836
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Feb 12 18:56:13 2020 +0000

    "ping"/"ping6" command support in rootwrap filters

    To have correct support in rootwrap, "ping"/"ping6" command should
    have the correct filters in rootwrap.

    Because "ping" command is harmless, "CommandFilter" is used to allow
    any binary call, regardless of the parameters used and the order.

    Nevertheless, this patch also proposes to use "ping"/"ping6" with
    the same parameters and a specific order, to help in the debug
    process:
    - ping[6] -W <timeout> <address>
    - ping[6] -W <timeout> -c <count> <address>
    - ping[6] -W <timeout> -c <count> -i <interval> <address>

    Those commands could be called from inside a namespace. The needed
    filter is also added in this patch.

    Change-Id: Ie5cbc0dcc76672b26cd2605f08cfd17a30b4c905
    Closes-Bug: #1863006

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 16.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/train
Review: https://review.opendev.org/749955

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/749956

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.opendev.org/749960

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.opendev.org/749961

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/749956
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=6f5ebbd3de3fbe7ccfd34fdc5fd1a842308ca362
Submitter: Zuul
Branch: stable/stein

commit 6f5ebbd3de3fbe7ccfd34fdc5fd1a842308ca362
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Feb 12 18:56:13 2020 +0000

    "ping"/"ping6" command support in rootwrap filters

    To have correct support in rootwrap, "ping"/"ping6" command should
    have the correct filters in rootwrap.

    Because "ping" command is harmless, "CommandFilter" is used to allow
    any binary call, regardless of the parameters used and the order.

    Nevertheless, this patch also proposes to use "ping"/"ping6" with
    the same parameters and a specific order, to help in the debug
    process:
    - ping[6] -W <timeout> <address>
    - ping[6] -W <timeout> -c <count> <address>
    - ping[6] -W <timeout> -c <count> -i <interval> <address>

    Those commands could be called from inside a namespace. The needed
    filter is also added in this patch.

    Change-Id: Ie5cbc0dcc76672b26cd2605f08cfd17a30b4c905
    Closes-Bug: #1863006
    (cherry picked from commit cc3b9df4268ac339d0b7316595a4148ba4c69836)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/749955
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=d351ba1137d3062d9953bd1a2e45664d1dc7189d
Submitter: Zuul
Branch: stable/train

commit d351ba1137d3062d9953bd1a2e45664d1dc7189d
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Feb 12 18:56:13 2020 +0000

    "ping"/"ping6" command support in rootwrap filters

    To have correct support in rootwrap, "ping"/"ping6" command should
    have the correct filters in rootwrap.

    Because "ping" command is harmless, "CommandFilter" is used to allow
    any binary call, regardless of the parameters used and the order.

    Nevertheless, this patch also proposes to use "ping"/"ping6" with
    the same parameters and a specific order, to help in the debug
    process:
    - ping[6] -W <timeout> <address>
    - ping[6] -W <timeout> -c <count> <address>
    - ping[6] -W <timeout> -c <count> -i <interval> <address>

    Those commands could be called from inside a namespace. The needed
    filter is also added in this patch.

    Depends-On: https://review.opendev.org/754960
    Change-Id: Ie5cbc0dcc76672b26cd2605f08cfd17a30b4c905
    Closes-Bug: #1863006
    (cherry picked from commit cc3b9df4268ac339d0b7316595a4148ba4c69836)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/749961
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=4d9d77fd2e48ad68d1affd6ecca2acf42766a855
Submitter: Zuul
Branch: stable/queens

commit 4d9d77fd2e48ad68d1affd6ecca2acf42766a855
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Feb 12 18:56:13 2020 +0000

    "ping"/"ping6" command support in rootwrap filters

    To have correct support in rootwrap, "ping"/"ping6" command should
    have the correct filters in rootwrap.

    Because "ping" command is harmless, "CommandFilter" is used to allow
    any binary call, regardless of the parameters used and the order.

    Nevertheless, this patch also proposes to use "ping"/"ping6" with
    the same parameters and a specific order, to help in the debug
    process:
    - ping[6] -W <timeout> <address>
    - ping[6] -W <timeout> -c <count> <address>
    - ping[6] -W <timeout> -c <count> -i <interval> <address>

    Those commands could be called from inside a namespace. The needed
    filter is also added in this patch.

    Conflicts:
        etc/neutron/rootwrap.d/debug.filters
        neutron/tests/common/net_helpers.py

    Change-Id: Ie5cbc0dcc76672b26cd2605f08cfd17a30b4c905
    Closes-Bug: #1863006
    (cherry picked from commit cc3b9df4268ac339d0b7316595a4148ba4c69836)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/749960
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=055484a3ab2fd6433487eac294b1bc3e00be3030
Submitter: Zuul
Branch: stable/rocky

commit 055484a3ab2fd6433487eac294b1bc3e00be3030
Author: Rodolfo Alonso Hernandez <email address hidden>
Date: Wed Feb 12 18:56:13 2020 +0000

    "ping"/"ping6" command support in rootwrap filters

    To have correct support in rootwrap, "ping"/"ping6" command should
    have the correct filters in rootwrap.

    Because "ping" command is harmless, "CommandFilter" is used to allow
    any binary call, regardless of the parameters used and the order.

    Nevertheless, this patch also proposes to use "ping"/"ping6" with
    the same parameters and a specific order, to help in the debug
    process:
    - ping[6] -W <timeout> <address>
    - ping[6] -W <timeout> -c <count> <address>
    - ping[6] -W <timeout> -c <count> -i <interval> <address>

    Those commands could be called from inside a namespace. The needed
    filter is also added in this patch.

    Conflicts:
        etc/neutron/rootwrap.d/debug.filters
        neutron/tests/common/net_helpers.py

    Change-Id: Ie5cbc0dcc76672b26cd2605f08cfd17a30b4c905
    Closes-Bug: #1863006
    (cherry picked from commit cc3b9df4268ac339d0b7316595a4148ba4c69836)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron queens-eol release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron rocky-eol release.