Filter port-list based on security_groups associated not working

Bug #1405057 reported by Shivakumar M
34
This bug affects 5 people
Affects Status Importance Assigned to Milestone
neutron
Fix Released
Low
Boden R

Bug Description

Sample Usecases:

1. neutron port-list --security_groups=6f3d9d9d-e84d-437c-ac40-82ce3196230c
Invalid input for operation: '6' is not an integer or uuid.

2.neutron port-list --security_groups list=true 6f3d9d9d-e84d-437c-ac40-82ce3196230c
Invalid input for operation: '6' is not an integer or uuid.

Since, security_groups associated to a port are referenced from securitygroups db table, we cant just filter ports
based on security_groups directly as it works for other paramters.

Example:
neutron port-list --mac_address list=true fa:16:3e:40:2b:cc fa:16:3e:8e:32:3e
+--------------------------------------+------+-------------------+-----------------------------------------------------------------------------------+
| id | name | mac_address | fixed_ips |
+--------------------------------------+------+-------------------+-----------------------------------------------------------------------------------+
| 1cecec78-226f-4379-b5ad-c145e2e14048 | | fa:16:3e:40:2b:cc | {"subnet_id": "af938c1c-e2d7-47a0-954a-ec8524677486", "ip_address": "50.10.10.2"} |
| eec24494-09a8-4fa8-885d-e3fda37fe756 | | fa:16:3e:8e:32:3e | {"subnet_id": "af938c1c-e2d7-47a0-954a-ec8524677486", "ip_address": "50.10.10.3"} |
+--------------------------------------+------+-------------------+-----------------------------------------------------------------------------------+

Shivakumar M (shiva-m)
Changed in neutron:
assignee: nobody → Shivakumar M (shiva-m)
Shivakumar M (shiva-m)
description: updated
Revision history for this message
Eugene Nikanorov (enikanorov) wrote :

The request doesn't reflect the attribute that should be used to filter by security group, which is security_group_id.
So I doubt the request in this form should work as you expect.

tags: added: api
removed: neutron port-list security-groups
Changed in neutron:
importance: Undecided → Low
status: New → Incomplete
Revision history for this message
Shivakumar M (shiva-m) wrote :

You are right, filter passed need not be attribute name only.
For this issue, we should add a check in the server side, if filters contains security group,
then it should return Ports associated to the specified security group.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (master)

Fix proposed to branch: master
Review: https://review.openstack.org/180413

Changed in neutron:
status: Incomplete → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on neutron (master)

Change abandoned by Kyle Mestery (<email address hidden>) on branch: master
Review: https://review.openstack.org/180413
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

Revision history for this message
Shivakumar M (shiva-m) wrote :
Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Change abandoned by Armando Migliaccio (<email address hidden>) on branch: master
Review: https://review.openstack.org/180413
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

Changed in neutron:
status: In Progress → Incomplete
assignee: Shivakumar M (shiva-m) → nobody
Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for neutron because there has been no activity for 60 days.]

Changed in neutron:
status: Incomplete → Expired
Changed in neutron:
status: Expired → Confirmed
tags: added: low
tags: added: low-hanging-fruit
removed: low
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (master)

Fix proposed to branch: master
Review: https://review.openstack.org/527105

Changed in neutron:
assignee: nobody → Ahmed Zaid (ahmedzaid10)
status: Confirmed → In Progress
Revision history for this message
Ihar Hrachyshka (ihar-hrachyshka) wrote :

For the record, once we switch ML2 to Port OVO, it should already work with the following filter name:

extra_filter_names = {'security_group_ids'}

We may need to extend client to support that, not sure.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (master)

Reviewed: https://review.openstack.org/527105
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=43d3e88a07b4275ad814c6875fa037efd94223bb
Submitter: Zuul
Branch: master

commit 43d3e88a07b4275ad814c6875fa037efd94223bb
Author: Ahmed Zaid <email address hidden>
Date: Wed Jan 17 09:32:59 2018 -0500

    Filter port-list based on security_groups.

    This patch allows users to filter ports depending on security groups.
    In addition to that I added a unit test to verify this change.
    TODO: move security_groups_port_filtering_lib.py into neutron-lib.

    Closes-Bug: 1405057
    Change-Id: I528719d895fc1d89f74e2ee85b9ddc470323c601

Changed in neutron:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/neutron 13.0.0.0b1

This issue was fixed in the openstack/neutron 13.0.0.0b1 development milestone.

Revision history for this message
Boden R (boden) wrote :

Reopening. It appears this work was never completed; the api def never made it into neutron-lib and was consumed, so I'll do that.

Changed in neutron:
status: Fix Released → In Progress
assignee: Ahmed Zaid (ahmedzaid10) → Boden R (boden)
Revision history for this message
Brian Haley (brian-haley) wrote :

Boden - thanks for picking this up, I had just noticed the same issue but you beat me to it:

WARNING neutron.api.extensions [req-1b8305d9-1be2-4ffd-b8b3-bfa3d84f81d2 - - - - -] Did not find expected name "Security_groups_port_filtering_lib" in /opt/stack/new/neutron/neutron/extensions/security_groups_port_filtering_lib.py

The name mis-match reminded me of other places that were fixed by moving to neutron-lib.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron-lib (master)

Reviewed: https://review.openstack.org/575243
Committed: https://git.openstack.org/cgit/openstack/neutron-lib/commit/?id=2544b1e906cb73607d38cf2198304d0097dff94c
Submitter: Zuul
Branch: master

commit 2544b1e906cb73607d38cf2198304d0097dff94c
Author: Boden R <email address hidden>
Date: Wed Jun 13 15:42:12 2018 -0600

    rehome port-security-groups-filtering api extension

    This patch rehomes the port-security-groups-filtering API extension as
    a neutron-lib API definition.

    Partial-Bug: 1405057

    Change-Id: I5e1f61a666c1001a71663466b1e70839ce6c8adb

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (stable/queens)

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/652118

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on neutron (stable/queens)

Change abandoned by Bernard Cafarelli (<email address hidden>) on branch: stable/queens
Review: https://review.opendev.org/652118
Reason: No updates in 6 months and overall opinion that it should not be backported, abandoning it.
Feel free to reopen if situation has changed

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/python-openstackclient 5.8.0

This issue was fixed in the openstack/python-openstackclient 5.8.0 release.

Changed in neutron:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.