queens regresion: _dn_to_id() not using utf8_encode/decode

Bug #1850634 reported by Corey Bryant
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Triaged
Low
Corey Bryant
Ubuntu Cloud Archive
Invalid
Undecided
Unassigned
Queens
Fix Released
High
Corey Bryant
keystone (Ubuntu)
Invalid
Undecided
Unassigned
Bionic
Fix Released
High
Corey Bryant

Bug Description

[Impact]

There's a regression in the LDAP common backend code due to a recent stable/queens backport that shouldn't have been backported past stable/rocky. It was backported as part of the fixes for https://bugs.launchpad.net/bugs/1782922.

The following patch shouldn't have been backported to stable/queens:
https://review.opendev.org/#/c/672519/

The reason why is because the following patch, which switched to bytes_mode=False, doesn't exist in stable/queens:
https://review.opendev.org/#/c/613648/
In particular see the changes to _dn_to_id() in https://review.opendev.org/#/c/613648/4/keystone/identity/backends/ldap/common.py.

Those changes didn't happen in stable/queens so _dn_to_id should still be UTF-8 encoding/decoding the appropriate fields. In other words it should still be using the following in stable/queens:

        if self.id_attr == utf8_decode(
                ldap.dn.str2dn(utf8_encode(dn))[0][0][0].lower()):
            return utf8_decode(ldap.dn.str2dn(utf8_encode(dn))[0][0][1])

[Test Case]
See test case in https://bugs.launchpad.net/bugs/1782922.

[Regression Potential]
The code that will be fixed for this bug (ie. the code in the if statement) is being reverted to what it used to be prior to the bug fix for https://bugs.launchpad.net/bugs/1782922. Prior to 1782922, _dn_to_id() used to only consist of the code that is in the if statment, so the regression potential is very low. Code will be tested to minimize regression potential and patch has been submitted upstream.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (stable/queens)

Fix proposed to branch: stable/queens
Review: https://review.opendev.org/692128

Changed in keystone (Ubuntu):
status: New → Invalid
Changed in keystone (Ubuntu Bionic):
status: New → Triaged
importance: Undecided → High
Changed in cloud-archive:
status: New → Invalid
Changed in keystone (Ubuntu Bionic):
assignee: nobody → Corey Bryant (corey.bryant)
description: updated
summary: - stable/queens regresion - _dn_to_id() should still be using
- utf8_encode/utf8_decode in queens
+ queens regresion - _dn_to_id() not using utf8_encode/utf8_decode
summary: - queens regresion - _dn_to_id() not using utf8_encode/utf8_decode
+ queens regresion: _dn_to_id() not using utf8_encode/utf8_decode
summary: - queens regresion: _dn_to_id() not using utf8_encode/utf8_decode
+ queens regresion: _dn_to_id() not using utf8_encode/decode
Gage Hugo (gagehugo)
Changed in keystone:
status: New → Triaged
importance: Undecided → Low
milestone: none → ussuri-1
assignee: nobody → Corey Bryant (corey.bryant)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to keystone (stable/queens)

Reviewed: https://review.opendev.org/692128
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=e8b04cc4265d672214da50b99ead8c4f8cc49aa2
Submitter: Zuul
Branch: stable/queens

commit e8b04cc4265d672214da50b99ead8c4f8cc49aa2
Author: Corey Bryant <email address hidden>
Date: Wed Oct 30 08:49:24 2019 -0400

    Revert "Fix python3 compatibility on LDAP search DN from id"

    This reverts commit 79ed42ee67915383242541329dd5aa186f087ff2,
    which shouldn't have been backported to stable/queens because the
    following patch, which switched to bytes_mode=False, doesn't exist
    in stable/queens: https://review.opendev.org/#/c/613648/.

    Change-Id: I3c0fe74559f1bbf66f717fbaeb1e1dd435e7eb2c
    Closes-Bug: #1850634

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/keystone 13.0.4

This issue was fixed in the openstack/keystone 13.0.4 release.

Mathew Hodson (mhodson)
tags: added: bionic regression-proposed
Revision history for this message
Timo Aaltonen (tjaalton) wrote : Please test proposed package

Hello Corey, or anyone else affected,

Accepted keystone into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/keystone/2:13.0.2-0ubuntu3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in keystone (Ubuntu Bionic):
status: Triaged → Fix Committed
tags: added: verification-needed verification-needed-bionic
Revision history for this message
Corey Bryant (corey.bryant) wrote :

This fix was released upstream in queens 13.0.4

Revision history for this message
Corey Bryant (corey.bryant) wrote :

Hello Corey, or anyone else affected,

Accepted keystone into queens-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

  sudo add-apt-repository cloud-archive:queens-proposed
  sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-queens-needed to verification-queens-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-queens-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

tags: added: verification-queens-needed
Revision history for this message
Felipe Reyes (freyes) wrote :
Download full text (34.4 KiB)

I went through the test case using the package available in -proposed and everything worked fine, no regressions were detected when using keystone neither.

 Here it's the journal of my testing.

$ time tox -e func-smoke
func-smoke installed: DEPRECATION: Python 2.7 will reach the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 won't be maintained after that date. A future version of pip will drop support for Python 2.7. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support,amulet==1.21.0,aodhclient==1.5.0,appdirs==1.4.3,Babel==2.8.0,backports.os==0.1.1,blessings==1.6,bundletester==0.12.2,certifi==2019.11.28,cffi==1.13.2,chardet==3.0.4,charm-tools==2.7.2,charmhelpers==0.20.7,Cheetah3==3.2.4,cliff==2.18.0,cmd2==0.8.9,colander==1.7.0,configparser==4.0.2,contextlib2==0.6.0.post1,coverage==5.0.3,cryptography==2.8,debtcollector==1.22.0,decorator==4.4.1,dict2colander==0.2,distro==1.4.0,distro-info==0.0.0,dogpile.cache==0.9.0,entrypoints==0.3,enum34==1.1.6,extras==1.0.0,fasteners==0.15,fixtures==3.0.0,flake8==2.4.1,funcsigs==1.0.2,functools32==3.2.3.post2,future==0.18.2,futures==3.3.0,futurist==1.10.0,gnocchiclient==3.1.1,httplib2==0.15.0,idna==2.8,importlib-metadata==1.4.0,ipaddress==1.0.23,iso8601==0.1.12,Jinja2==2.10.3,jmespath==0.9.4,jsonpatch==1.24,jsonpointer==2.0,jsonschema==2.5.1,juju-deployer==0.11.0,juju-wait==2.5.0,jujubundlelib==0.5.6,jujuclient==0.54.0,keyring==18.0.1,keystoneauth1==3.18.0,launchpadlib==1.10.9,lazr.authentication==0.1.3,lazr.restfulclient==0.14.2,lazr.uri==1.0.3,libcharmstore==0.0.9,linecache2==1.0.0,macaroonbakery==1.2.3,MarkupSafe==1.1.1,mccabe==0.3.1,mock==3.0.5,monotonic==1.5,more-itertools==5.0.0,msgpack==0.6.2,munch==2.5.0,netaddr==0.7.19,netifaces==0.10.9,nose==1.3.7,oauth==1.0.1,oauthlib==3.1.0,openstacksdk==0.39.0,os-client-config==2.0.0,os-service-types==1.7.0,osc-lib==1.15.0,oslo.concurrency==3.31.0,oslo.config==7.0.0,oslo.context==2.23.0,oslo.i18n==3.25.1,oslo.log==3.45.2,oslo.serialization==2.29.2,oslo.utils==3.42.1,osprofiler==2.9.0,otherstuf==1.1.0,parse==1.14.0,path.py==11.5.2,pathlib2==2.3.5,pathspec==0.3.4,pbr==5.4.4,pep8==1.7.1,pika==0.13.1,pkg-resources==0.0.0,prettytable==0.7.2,protobuf==3.11.2,pycparser==2.19,pyflakes==0.8.1,pyinotify==0.9.6,pymacaroons==0.13.0,PyNaCl==1.3.0,pyOpenSSL==19.1.0,pyparsing==2.4.6,pyperclip==1.7.0,pyRFC3339==1.1,python-barbicanclient==4.9.0,python-ceilometerclient==2.9.0,python-cinderclient==4.3.0,python-dateutil==2.8.1,python-designateclient==3.0.0,python-glanceclient==2.17.0,python-heatclient==1.18.0,python-keystoneclient==3.22.0,python-manilaclient==1.29.0,python-mimeparse==1.6.0,python-neutronclient==6.14.0,python-novaclient==16.0.0,python-openstackclient==4.0.0,python-subunit==1.3.0,python-swiftclient==3.8.1,pytz==2019.3,pyudev==0.21.0,PyYAML==3.13,requests==2.22.0,requestsexceptions==1.4.0,rfc3986==1.3.2,ruamel.ordereddict==0.4.14,ruamel.yaml==0.15.100,scandir==1.10.0,SecretStorage==2.3.1,simplejson==3.17.0,six==1.13.0,stestr==2.6.0,stevedore==1.31.0,stuf==0.9.16,subprocess32==3.5.4,Tempita==0.5.2,testresources==2.0.1,testtools==2.3.0,theblues==0.5.2,t...

tags: added: verification-done-bionic
removed: verification-needed-bionic
Revision history for this message
Felipe Reyes (freyes) wrote :
Download full text (16.2 KiB)

verified xenial-queens, no regressions detected, testing journal:

$ time tox -e func-smoke
func-smoke installed: DEPRECATION: Python 2.7 will reach the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 won't be maintained after that date. A future version of pip will drop support for Python 2.7. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support,amulet==1.21.0,aodhclient==1.5.0,appdirs==1.4.3,Babel==2.8.0,backports.os==0.1.1,blessings==1.6,bundletester==0.12.2,certifi==2019.11.28,cffi==1.13.2,chardet==3.0.4,charm-tools==2.7.2,charmhelpers==0.20.7,Cheetah3==3.2.4,cliff==2.18.0,cmd2==0.8.9,colander==1.7.0,configparser==4.0.2,contextlib2==0.6.0.post1,coverage==5.0.3,cryptography==2.8,debtcollector==1.22.0,decorator==4.4.1,dict2colander==0.2,distro==1.4.0,distro-info==0.0.0,dogpile.cache==0.9.0,entrypoints==0.3,enum34==1.1.6,extras==1.0.0,fasteners==0.15,fixtures==3.0.0,flake8==2.4.1,funcsigs==1.0.2,functools32==3.2.3.post2,future==0.18.2,futures==3.3.0,futurist==1.10.0,gnocchiclient==3.1.1,httplib2==0.15.0,idna==2.8,importlib-metadata==1.4.0,ipaddress==1.0.23,iso8601==0.1.12,Jinja2==2.10.3,jmespath==0.9.4,jsonpatch==1.24,jsonpointer==2.0,jsonschema==2.5.1,juju-deployer==0.11.0,juju-wait==2.5.0,jujubundlelib==0.5.6,jujuclient==0.54.0,keyring==18.0.1,keystoneauth1==3.18.0,launchpadlib==1.10.9,lazr.authentication==0.1.3,lazr.restfulclient==0.14.2,lazr.uri==1.0.3,libcharmstore==0.0.9,linecache2==1.0.0,macaroonbakery==1.2.3,MarkupSafe==1.1.1,mccabe==0.3.1,mock==3.0.5,monotonic==1.5,more-itertools==5.0.0,msgpack==0.6.2,munch==2.5.0,netaddr==0.7.19,netifaces==0.10.9,nose==1.3.7,oauth==1.0.1,oauthlib==3.1.0,openstacksdk==0.39.0,os-client-config==2.0.0,os-service-types==1.7.0,osc-lib==1.15.0,oslo.concurrency==3.31.0,oslo.config==7.0.0,oslo.context==2.23.0,oslo.i18n==3.25.1,oslo.log==3.45.2,oslo.serialization==2.29.2,oslo.utils==3.42.1,osprofiler==2.9.0,otherstuf==1.1.0,parse==1.14.0,path.py==11.5.2,pathlib2==2.3.5,pathspec==0.3.4,pbr==5.4.4,pep8==1.7.1,pika==0.13.1,pkg-resources==0.0.0,prettytable==0.7.2,protobuf==3.11.2,pycparser==2.19,pyflakes==0.8.1,pyinotify==0.9.6,pymacaroons==0.13.0,PyNaCl==1.3.0,pyOpenSSL==19.1.0,pyparsing==2.4.6,pyperclip==1.7.0,pyRFC3339==1.1,python-barbicanclient==4.9.0,python-ceilometerclient==2.9.0,python-cinderclient==4.3.0,python-dateutil==2.8.1,python-designateclient==3.0.0,python-glanceclient==2.17.0,python-heatclient==1.18.0,python-keystoneclient==3.22.0,python-manilaclient==1.29.0,python-mimeparse==1.6.0,python-neutronclient==6.14.0,python-novaclient==16.0.0,python-openstackclient==4.0.0,python-subunit==1.3.0,python-swiftclient==3.8.1,pytz==2019.3,pyudev==0.21.0,PyYAML==3.13,requests==2.22.0,requestsexceptions==1.4.0,rfc3986==1.3.2,ruamel.ordereddict==0.4.14,ruamel.yaml==0.15.100,scandir==1.10.0,SecretStorage==2.3.1,simplejson==3.17.0,six==1.13.0,stestr==2.6.0,stevedore==1.31.0,stuf==0.9.16,subprocess32==3.5.4,Tempita==0.5.2,testresources==2.0.1,testtools==2.3.0,theblues==0.5.2,traceback2==1.4.0,translationstring==1.3,unicodecsv==0.14.1,unittest2==1.1.0,urllib3==1.25.7,vergit==1.0.2,virtualenv==16.7.9,volu...

tags: added: verification-queens-done
removed: verification-queens-needed
tags: added: verification-done
removed: verification-needed
Revision history for this message
Chris Halse Rogers (raof) wrote : Update Released

The verification of the Stable Release Update for keystone has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package keystone - 2:13.0.2-0ubuntu3

---------------
keystone (2:13.0.2-0ubuntu3) bionic; urgency=medium

  * d/p/0002-fixing-dn-to-id.patch: Dropped. This patch shouldn't have
    been backported to stable/queens (LP: #1850634).

 -- Corey Bryant <email address hidden> Wed, 30 Oct 2019 08:55:58 -0400

Changed in keystone (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Corey Bryant (corey.bryant) wrote :

The verification of the Stable Release Update for keystone has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Corey Bryant (corey.bryant) wrote :

This bug was fixed in the package keystone - 2:13.0.2-0ubuntu3~cloud0
---------------

 keystone (2:13.0.2-0ubuntu3~cloud0) xenial-queens; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 keystone (2:13.0.2-0ubuntu3) bionic; urgency=medium
 .
   * d/p/0002-fixing-dn-to-id.patch: Dropped. This patch shouldn't have
     been backported to stable/queens (LP: #1850634).

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.