Security Group Create and adding rule to it, is not raising proper error code for overlimit

Bug #1021748 reported by Rajalakshmi Ganesan
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
Low
Eoghan Glynn

Bug Description

Security Group Create and adding rule to it, is not raising proper error code for overlimit

Actual result : http 400

Excepted result: http 413

Creation of security group after reaching over limit it is raising HTTP 400, instead of raising HTTP 413.

Following is the nova command log for security group creation

muralik@ubuntu:~$ nova secgroup-create testsec testdesc
ERROR: Quota exceeded, too many security groups. (HTTP 400) (Request-ID: req-f1789db3-7e61-40c0-8bfe-3214fa1f66d9)
muralik@ubuntu:~$ nova secgroup-list
+------------------+------------------+
| Name | Description |
+------------------+------------------+
| testsec1 | testsecdesc1 |
| testsec2 | testsecdesc2 |
| testsec3 | testsecdesc3 |
| testsec4 | testsecdesc4 |
| testsec5 | testsecdesc5 |
| testsec6 | testsecdesc6 |
| testsec7 | testsecdesc7 |
| testsec8 | testsecdesc8 |
| testsec9 | testsecdesc9 |
| default | default |
+------------------+------------------+

And also the behaviour is same for adding rule to the security group

nova secgroup-add-rule testsec12 icmp 23 19 0.0.0.0/0
ERROR: Quota exceeded, too many security group rules. (HTTP 400) (Request-ID: req-81a7d160-3de4-431a-8788-a380b55ffa4c)

muralik@ubuntu:~$ nova secgroup-list-rules testsec12
+-------------+-----------+---------+-----------+--------------+
| IP Protocol | From Port | To Port | IP Range | Source Group |
+-------------+-----------+---------+-----------+--------------+
| icmp | 3 | 23 | 0.0.0.0/0 | |
| icmp | 5 | 23 | 0.0.0.0/0 | |
| icmp | 6 | 23 | 0.0.0.0/0 | |
| icmp | 7 | 23 | 0.0.0.0/0 | |
| icmp | 8 | 23 | 0.0.0.0/0 | |
| icmp | 9 | 23 | 0.0.0.0/0 | |
| icmp | 10 | 23 | 0.0.0.0/0 | |
| icmp | 11 | 23 | 0.0.0.0/0 | |
| icmp | 14 | 23 | 0.0.0.0/0 | |
| icmp | 17 | 23 | 0.0.0.0/0 | |
| icmp | 18 | 23 | 0.0.0.0/0 | |
| icmp | 19 | 23 | 0.0.0.0/0 | |
| icmp | 20 | 23 | 0.0.0.0/0 | |
| icmp | 21 | 23 | 0.0.0.0/0 | |
| icmp | 22 | 23 | 0.0.0.0/0 | |
| icmp | 23 | 20 | 0.0.0.0/0 | |
| icmp | 23 | 21 | 0.0.0.0/0 | |
| icmp | 23 | 22 | 0.0.0.0/0 | |
| icmp | 23 | 23 | 0.0.0.0/0 | |
| tcp | 22 | 23 | 0.0.0.0/0 | |
+-------------+-----------+---------+-----------+--------------+

affects: tempest → nova
description: updated
summary: - Security Group Create is not raising proper error code for overlimit
+ Security Group Create and adding rule to it, is not raising proper
+ error code for overlimit
Revision history for this message
Mark McLoughlin (markmc) wrote :

Ok, here's where the over-quota errors are being raised:

  class NativeSecurityGroupAPI(compute.api.SecurityGroupAPI):
    @staticmethod
    def raise_over_quota(msg):
        raise exc.HTTPBadRequest(explanation=msg)

    @staticmethod
    def raise_not_found(msg):
        raise exc.HTTPNotFound(explanation=msg)

these should probably just raise exceptions which are subclasses of QuotaError which will cause a 413 to be raised

Changed in nova:
status: New → Confirmed
assignee: nobody → Eoghan Glynn (eglynn)
Eoghan Glynn (eglynn)
Changed in nova:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (master)

Fix proposed to branch: master
Review: https://review.openstack.org/10023

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova (master)

Reviewed: https://review.openstack.org/10023
Committed: http://github.com/openstack/nova/commit/39146d2e2e36ad96e8cf8b4f4bc9c426f1b80efb
Submitter: Jenkins
Branch: master

commit 39146d2e2e36ad96e8cf8b4f4bc9c426f1b80efb
Author: Eoghan Glynn <email address hidden>
Date: Thu Jul 19 17:14:00 2012 +0100

    Ensure 413 response for security group over-quota

    Fixes LP 1021748

    Instead of raising the relevant webob.exc exception directly,
    we now follow the usual pattern of mapping in the FaultWrapper
    middleware from an internal exception type to the corresponding
    HTTP error.

    Change-Id: Ifb43685e4f9b0b5bd53e74747d1f87aa5e119fb5

Changed in nova:
status: In Progress → Fix Committed
Revision history for this message
Rajalakshmi Ganesan (rajalakshmi-ganesan) wrote :
Download full text (14.4 KiB)

LOG after "Fix-Commit"
--------------------------------

FOR SECURITY GROUP:
-------------------------------

muralik@ubuntu:~/tempest_raj$ nova --debug secgroup-create secgroup secgroup
connect: (10.233.52.237, 5000)
send: 'POST /v2.0/tokens HTTP/1.1\r\nHost: 10.233.52.237:5000\r\nContent-Length: 102\r\ncontent-type: application/json\r\naccept-encoding: gzip, deflate\r\naccept: application/json\r\nuser-agent: python-novaclient\r\n\r\n{"auth": {"tenantName": "admin", "passwordCredentials": {"username": "admin", "password": "muralik"}}}'
reply: 'HTTP/1.1 200 OK\r\n'
header: Vary: X-Auth-Token
header: Content-Type: application/json
header: Content-Length: 2238
header: Date: Thu, 26 Jul 2012 16:00:01 GMT

REQ: curl -i http://10.233.52.237:5000/v2.0/tokens -X POST -H "Content-Type: application/json" -H "Accept: application/json" -H "User-Agent: python-novaclient"

REQ BODY: {"auth": {"tenantName": "admin", "passwordCredentials": {"username": "admin", "password": "muralik"}}}

RESP:{'date': 'Thu, 26 Jul 2012 16:00:01 GMT', 'vary': 'X-Auth-Token', 'content-length': '2238', 'status': '200', 'content-type': 'application/json'} {"access": {"token": {"expires": "2012-07-27T16:00:01Z", "id": "e230440b8bd84a7cbf225ee129b7d3d4", "tenant": {"enabled": true, "id": "d566937afddd43aeb452c077276c4e81", "name": "admin", "description": null}}, "serviceCatalog": [{"endpoints": [{"adminURL": "http://10.233.52.237:8774/v2/d566937afddd43aeb452c077276c4e81", "region": "RegionOne", "publicURL": "http://10.233.52.237:8774/v2/d566937afddd43aeb452c077276c4e81", "internalURL": "http://10.233.52.237:8774/v2/d566937afddd43aeb452c077276c4e81"}], "endpoints_links": [], "type": "compute", "name": "Compute Service"}, {"endpoints": [{"adminURL": "http://10.233.52.237:3333", "region": "RegionOne", "publicURL": "http://10.233.52.237:3333", "internalURL": "http://10.233.52.237:3333"}], "endpoints_links": [], "type": "s3", "name": "S3 Service"}, {"endpoints": [{"adminURL": "http://10.233.52.237:9292", "region": "RegionOne", "publicURL": "http://10.233.52.237:9292", "internalURL": "http://10.233.52.237:9292"}], "endpoints_links": [], "type": "image", "name": "Image Service"}, {"endpoints": [{"adminURL": "http://10.233.52.237:8776/v1/d566937afddd43aeb452c077276c4e81", "region": "RegionOne", "publicURL": "http://10.233.52.237:8776/v1/d566937afddd43aeb452c077276c4e81", "internalURL": "http://10.233.52.237:8776/v1/d566937afddd43aeb452c077276c4e81"}], "endpoints_links": [], "type": "volume", "name": "Volume Service"}, {"endpoints": [{"adminURL": "http://10.233.52.237:8773/services/Admin", "region": "RegionOne", "publicURL": "http://10.233.52.237:8773/services/Cloud", "internalURL": "http://10.233.52.237:8773/services/Cloud"}], "endpoints_links": [], "type": "ec2", "name": "EC2 Service"}, {"endpoints": [{"adminURL": "http://10.233.52.237:35357/v2.0", "region": "RegionOne", "publicURL": "http://10.233.52.237:5000/v2.0", "internalURL": "http://10.233.52.237:5000/v2.0"}], "endpoints_links": [], "type": "identity", "name": "Identity Service"}], "user": {"username": "admin", "roles_links": [], "id": "6e9f9972d853442484271c542d17459a", "roles": [{"id": "fb029f126dcd416ca451b41e3c15c57d", "name"...

Revision history for this message
Rajalakshmi Ganesan (rajalakshmi-ganesan) wrote :

Hence marking it as "Fix-Released".

Changed in nova:
status: Fix Committed → Fix Released
Eoghan Glynn (eglynn)
Changed in nova:
importance: Undecided → Low
milestone: none → folsom-3
Revision history for this message
Thierry Carrez (ttx) wrote :

Do not mark FixReleased until it's landed in a development milestone.

Changed in nova:
status: Fix Released → Fix Committed
Thierry Carrez (ttx)
Changed in nova:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in nova:
milestone: folsom-3 → 2012.2
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.