Error 500 after request with Invalid Scope

[Slawek Kaplonski]

After patch https://review.opendev.org/c/openstack/neutron/+/821208 was merged, when scope enforcement is enabled and API request with wrong scope is made, there is unhandled InvalidScope exception raised and error 500 returned to user. It should be properly handled and some better error returned.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/826872

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron-lib/+/835234

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron-lib/+/835234
Committed: https://opendev.org/openstack/neutron-lib/commit/da2baf389c85548b5c0b475a651aaf22bd7d9701
Submitter: "Zuul (22348)"
Branch: master

commit da2baf389c85548b5c0b475a651aaf22bd7d9701
Author: Slawek Kaplonski <email address hidden>
Date: Fri Mar 25 14:50:33 2022 +0100

    Add oslo_policy.InvalidScope exception to the api faults map

    With enforcing scopes enabled in Neutron, oslo_policy can raise
    InvalidScope exception while enforcing policy rules. So this exception
    type should be handled in the same way as it is with
    PolicyNotAuthorized. Otherwise neutron returns 500 if InvalidScope
    exception was raised by the policy enforce.

    Closes-Bug: #1959333
    Change-Id: Iad1e2c9f797091d728d419c6b9dc67d861d4214a

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/826872
Committed: https://opendev.org/openstack/neutron/commit/51d1899bacb1e5d625f201380035db634da2e27c
Submitter: "Zuul (22348)"
Branch: master

commit 51d1899bacb1e5d625f201380035db634da2e27c
Author: Slawek Kaplonski <email address hidden>
Date: Fri Jan 28 12:08:32 2022 +0100

    Handle properly InvalidScope exceptions to not return error 500

    When new default policy rules and scope enforcement are enabled, Neutron
    needs to handle properly not only PolicyNotAuthorized exception from
    oslo_policy module but also InvalidScope exception.
    This patch adds handling of that exception to the neutron policy
    modules.

    In the check() method from the neutron.policy module we are calling
    ENFORCER.enforce() method with do_raise=False which means that
    PolicyNotAuthorized isn't rasised. Unfortunately it seems that there is
    bug in oslo.policy module and InvalidScope is raised even with
    do_raise=False.
    For now, lets workaround it in Neutron by properly handling InvalidScope
    exception in the check() method.
    This workaround can be cleaned when bug [1] will be fixed in
    oslo.policy.

    [1] https://bugs.launchpad.net/oslo.policy/+bug/1965315

    Partial-Bug: #1959333
    Change-Id: I973f8896248c8222031c53343bb53ce48254da74

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/neutron/+/838697

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/neutron/+/838698

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/neutron/+/838699

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Slawek Kaplonski <email address hidden>" on branch: stable/xena
Review: https://review.opendev.org/c/openstack/neutron/+/838698
Reason: not needed in that branch

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Slawek Kaplonski <email address hidden>" on branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/neutron/+/838699
Reason: not needed in that branch

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/838697
Committed: https://opendev.org/openstack/neutron/commit/dcb35466484d9c66c6ea912c6c68802b89847404
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit dcb35466484d9c66c6ea912c6c68802b89847404
Author: Slawek Kaplonski <email address hidden>
Date: Fri Jan 28 12:08:32 2022 +0100

    Handle properly InvalidScope exceptions to not return error 500

    When new default policy rules and scope enforcement are enabled, Neutron
    needs to handle properly not only PolicyNotAuthorized exception from
    oslo_policy module but also InvalidScope exception.
    This patch adds handling of that exception to the neutron policy
    modules.

    In the check() method from the neutron.policy module we are calling
    ENFORCER.enforce() method with do_raise=False which means that
    PolicyNotAuthorized isn't rasised. Unfortunately it seems that there is
    bug in oslo.policy module and InvalidScope is raised even with
    do_raise=False.
    For now, lets workaround it in Neutron by properly handling InvalidScope
    exception in the check() method.
    This workaround can be cleaned when bug [1] will be fixed in
    oslo.policy.

    [1] https://bugs.launchpad.net/oslo.policy/+bug/1965315

    Partial-Bug: #1959333
    Change-Id: I973f8896248c8222031c53343bb53ce48254da74
    (cherry picked from commit 51d1899bacb1e5d625f201380035db634da2e27c)

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/840171

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/840171
Committed: https://opendev.org/openstack/neutron/commit/3939ec35af1769b9f04e19b8b499ad4d37d51f1d
Submitter: "Zuul (22348)"
Branch: master

commit 3939ec35af1769b9f04e19b8b499ad4d37d51f1d
Author: Slawek Kaplonski <email address hidden>
Date: Mon May 2 12:47:16 2022 +0200

    Bump oslo.policy to 3.12.0

    It allows us to revert temporary fix part from [1] as now InvalidScope
    exception is properly handled by oslo.policy.

    [1] https://review.opendev.org/c/openstack/neutron/+/826872

    Related-bug: #1959333
    Change-Id: I6b42306479c134ad8b07b8bf87d5c650fef9faae

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron-lib 2.21.0 release.