nova list by ip returns all the servers, even though invalid ip format is given

[meenakshi m]

nova list by ip returns all the servers, even though invalid ip format is given.It is expected to throw an error

meenakshi_m@pshys0284:~$ nova list --ip "aa.bb.cc.dd"
+--------------------------------------+-------------------+--------+-------------------+
| ID | Name | Status | Networks |
+--------------------------------------+-------------------+--------+-------------------+
| 71c52c14-24d9-48bc-a767-94a02d9515ea | server91352891389 | BUILD | private=10.0.0.10 |
| cc50a41b-f4c4-4796-a63a-4d52da629a87 | test-ssh-server | ACTIVE | private=10.0.0.5 |
| ce889f11-03e7-40dc-b5cc-9caf2104ba72 | demo_server | ACTIVE | private=10.0.0.2 |
| df306f21-cda7-4adc-b92b-13c39a9ed4e3 | server49545803763 | ACTIVE | private=10.0.0.6 |
+--------------------------------------+-------------------+--------+-------------------+

I doubt is it the correct format to list the ip , as the description of the argument says to provide regular expression.

And the behaviour is same, if the exceeded ip range is provided as input.

[Daryl Walleck (dwalleck)]

I would think this should be a bug for Nova, not Tempest. Also, I don't see this functionality in the API docs. Can you point out where this is coming from?

[meenakshi m (meenakshi-m)]

The following is the description of "nova list" command in nova API, I hope this helps you to understand.

meenakshi_m@pshys0284:~$ nova help list
usage: nova list [--reservation_id <reservation_id>] [--recurse_zones [<0|1>]]
                 [--ip <ip_regexp>] [--ip6 <ip6_regexp>]
                 [--name <name_regexp>] [--instance_name <name_regexp>]
                 [--status <status>] [--flavor <flavor>] [--image <image>]
                 [--host <hostname>]

List active servers.

Optional arguments:
  --reservation_id <reservation_id>
                        Only return instances that match reservation_id.
  --recurse_zones [<0|1>]
                        Recurse through all zones if set.
  --ip <ip_regexp> Search with regular expression match by IP address
  --ip6 <ip6_regexp> Search with regular expression match by IPv6 address
  --name <name_regexp> Search with regular expression match by name
  --instance_name <name_regexp>
                        Search with regular expression match by instance name
  --status <status> Search by server status
  --flavor <flavor> Search by flavor ID
  --image <image> Search by image ID
  --host <hostname> Search instances by hostname to which they are
                        assigned

[Russell Bryant (russellb)]

If you enable debug logging, do you have a debug message that says something like: "Removing options 'ip' from query" ?

It looks like the code in nova/api/openstack/compute/servers.py is dropping it as an invalid search option.

    def _get_server_search_options(self):
        """Return server search options allowed by non-admin."""
        return ('reservation_id', 'name', 'status', 'image', 'flavor',
                'changes-since')

Though I do see code for it (the compute API and db API). So, either it's accidentally filtered out, or not allowed via the OpenStack API on purpose. I suspect it's just an accident and the fix is just to treat it as a valid filter when sanitizing the input.

[Nikola Đipanov (ndipanov)]

I agree with Russel,

The 'ip' option is disallowed for non-admin role in the API, and works as expected when queried as admin.

I feel reluctant to change it - it seems non admin users cannot query servers by IP is there by design.

If we were to treat tests as documentation - I would say that this is exactly the intended behaviour - take a look at nova.tests.api.openstack.compute.test_servers.py specifically

ServersControllerTest.test_get_servers_admin_allows_ip
ServersControllerTest.test_get_servers_admin_allows_ip6

both tests assume only admin role, and

ServersControllerTesttest_get_servers_with_bad_option

shows that invalid get params should be ignored (which is the behaviou we are seeing).