Designate

Blacklist error message is unhelpful

Bug #1933784 reported by Michael Chapman
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Designate
New
Undecided
Unassigned

Bug Description

As noted during review here https://review.opendev.org/c/openstack/designate/+/793325/3/doc/source/admin/blacklists.rst when the user attempts to create a zone that is within a blacklist the error message doesn't let the user know what the blacklist covers.

The zone create API spec doesn't specify what is contained within the message when there is an error, so perhaps either the blacklist object ID or the regex itself could be returned.

By default the blacklist API only allows read access to system admins, so this should probably change if the user is going to be told which regex their zone has matched as part of the error.

Revision history for this message
Dr. Jens Harbott (j-harbott) wrote :

a) This would seem a bug of the API instead of the client, the latter can only respond with what it gets from the API.
b) In my understanding the details of the blacklist regexes are hidden from users by design, so exposing any of the information you are mentioning might undermine what some deployers consider a security feature.
Maybe a deployer can change the access permissions for the blacklist API via a different policy, but I'm not convinced that the current default behavior is wrong and would need to be changed.

Revision history for this message
Michael Chapman (michaeltchapman) wrote :

a) Fixed, thanks.

b) This is reasonable. How about if we put the blacklist resource ID that it has matched? That doesn't really leak anything and then if the blacklist API is opened up by the operator for reads by users they can see what's blocking them.

An extension to this could be to make an extra API call in the client when it hits that error, so that the client error is improved to showing the query where possible. This is a small performance hit, but I think in this case it would be worth it.

affects: python-designateclient → designate
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.