neutron router-gateway-set --enable-snat fails

[[e-mail]]

I have a Mitaka environment with 1 control node and 3 compute nodes, all physical machines running on openSUSE Leap 42.1.

My version of neutron client:

---cut here---
control1:~ # rpm -qi python-neutronclient-3.1.1-1.1.noarch
Name : python-neutronclient
Version : 3.1.1
Release : 1.1
Architecture: noarch
Install Date: Mo 11 Apr 2016 12:13:44 CEST
Group : Development/Languages/Python
Size : 2079132
License : Apache-2.0
Signature : RSA/SHA1, Do 03 Mär 2016 16:46:07 CET, Key ID 893a90dad85f9316
Source RPM : python-neutronclient-3.1.1-1.1.src.rpm
Build Date : Do 03 Mär 2016 16:45:27 CET
Build Host : cloud118
Relocations : (not relocatable)
Vendor : obs://build.opensuse.org/Cloud:OpenStack
URL : http://launchpad.net/python-neutronclient
Summary : Openstack Network (Quantum) API Client
---cut here---

Changing the router property "enable_snat" works only in one direction. The resource description in Horizon for "resource_types/OS::Neutron::Router/" says:
    enable_snat: {description: 'Enables Source [...] update_allowed: true}
So trying to update this property in CLI (as project admin) seems to work:

control1:~ # neutron router-gateway-set --enable-snat <ROUTER_ID> <NETWORK_ID>
Set gateway for router cbc39730-34cc-4d18-986a-5b6b9b1b4e96

But actually no change has been made:
control1:~ # neutron router-list
+----------------+------------+-------------------------------------------------+
| id | name | external_gateway_info |
+----------------+------------+-------------------------------------------------+
| cbc39730... | router01 | {"network_id": "ID", "enable_snat": false, [...]|
+----------------+------------+-------------------------------------------------+

I know there's no such option in the help page for router-gateway-set command, but if there's not I'd expect an error message. Or if it's a valid option it should actually change this property.

Steps to reproduce:
1. Create a router with snat disabled
2. Try to enable snat via command line

Expected output:
Along with the success message ("Set gateway for router...") it should either actually enable snat or throw an error message ("unknown option" or something similar).

Actual output:
Success message saying router-gateway has been set, but the argument "--enable-snat" is ignored, no changes have been applied.

I will be out of office for the next three weeks, I'll set my co-worker in cc to this bug. If there are any questions on this issue he will try to answer them.

[Jens-U. Mozdzen (jmozdzen)]

To add a bit more of detail:

The behavior is related to neutron's "enable_snat_by_default" setting:

- if it's set to "true" (which is the default value), then a newly created router will have "enable_snat" set to true (expected) and you can change that setting via CLI (expected)

- if it's set to "false", then a newly created router will have "enable_snat" set to false (expected) and you cannot change that setting via CLI (which is unexpected)

Below terminal log show the following sequence of commands and results:

- enable_snat_by_default is set to true (and neutron restarted, to use that setting)
- the router settings show "enable_snat": true (which was created previously)
- "neutron router-gateway-set --disable-snat" and "--enable-snat" is invoked on that router, without returning errors, and the router settings are positively changed
- enable_snat_by_default is set to false (and neutron restarted, to use that setting)
- "neutron router-gateway-set --disable-snat" and "--enable-snat" is invoked on that router, without returning errors. "disable" actually disables SNAT, while "enable" does not change back to enabled state.

--- cut here ---
control1:~ # grep enable_snat_by_default /etc/neutron/neutron.conf
enable_snat_by_default = true
control1:~ # systemctl restart openstack-neutron.service
control1:~ # neutron router-list
+--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+
| id | name | external_gateway_info | distributed | ha |
+--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+
| cbc39730-34cc-4d18-986a-5b6b9b1b4e96 | ebl-router01 | {"network_id": "18db85e5-36aa-4669-9004-9ec43baad3f2", "enable_snat": true, "external_fixed_ips": [{"subnet_id": "dafed1c4-da5b-4557-bf18-cc7f9266f82a", "ip_address": "192.168.164.40"}]} | False | False |
+--------------------------------------+----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+-------+
control1:~ # neutron router-gateway-set --disable-snat cbc39730-34cc-4d18-986a-5b6b9b1b4e96 18db85e5-36aa-4669-9004-9ec43baad3f2
Set gateway for router cbc39730-34cc-4d18-986a-5b6b9b1b4e96
control1:~ # neutron router-list
+--------------------------------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------------+----...

[Zhenmei (zma-4)]

It looks like the neutron client bug. The function "take_action" in the class SetGatewayRouter doesn't pass the extra arguments to the neutron api, it caused the "router_gateway_set" command have no invalid attributes validation.

[Zhenmei (zma-4)]

I have code review for this https://review.openstack.org/#/c/342685/. Not sure why there is no related automatic comment generated.

[Rodion Tikunov (rtikunov)]

Proposed fix: https://review.openstack.org/#/c/395002/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/402472
Committed: https://git.openstack.org/cgit/openstack/python-neutronclient/commit/?id=0113ec4297942d18bba0cae8a1f6c55011e0ed2a
Submitter: Jenkins
Branch: stable/newton

commit 0113ec4297942d18bba0cae8a1f6c55011e0ed2a
Author: Rodion Tikunov <email address hidden>
Date: Tue Nov 8 17:34:22 2016 +0300

    Added --enable-snat option for router-gateway-set

    If enable_snat_by_default option set to false and disable snat via cli
    it becomes unavailable to enable snat again.
    This commit allows to enable snat after disabling it.

    Change-Id: I01009d5cd5edd5be3eead615c37d6aa2e3224442
    Closes-Bug: #1598171
    (cherry picked from commit cc1d3fdd3582b0bbc2e24b65b9c690b5f0318148)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/402475
Committed: https://git.openstack.org/cgit/openstack/python-neutronclient/commit/?id=40b55be84e34083d272ff905457d03f4154571e3
Submitter: Jenkins
Branch: stable/mitaka

commit 40b55be84e34083d272ff905457d03f4154571e3
Author: Rodion Tikunov <email address hidden>
Date: Tue Nov 8 17:34:22 2016 +0300

    Added --enable-snat option for router-gateway-set

    If enable_snat_by_default option set to false and disable snat via cli
    it becomes unavailable to enable snat again.
    This commit allows to enable snat after disabling it.

    Change-Id: I01009d5cd5edd5be3eead615c37d6aa2e3224442
    Closes-Bug: #1598171
    (cherry picked from commit cc1d3fdd3582b0bbc2e24b65b9c690b5f0318148)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/python-neutronclient 6.1.0 release.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Kevin Benton (<email address hidden>) on branch: master
Review: https://review.openstack.org/342685
Reason: please file any improvements to OSC or the SDK

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/python-neutronclient 6.0.1 release.