Merge lp:~mpontillo/maas/discovered-ip-address-api-fix--bug-1686732 into lp:~maas-committers/maas/trunk

[Mike Pontillo]

Allow releasing IP addresses of type DISCOVERED using the API.

[Lee Trager (ltrager)]

Why not allow the force option to release any type of IP address?

review: Needs Information

[Mike Pontillo (mpontillo)]

The IP address release code expects to find a single IP address. Since discovered addresses can exist in the database at the same time as non-Discovered addresses, we need a way to ensure that we only ever pick one StaticIPAddress to delete.

[Mike Pontillo (mpontillo)]

... the alternatives would be:

(1) user intends to delete a static IP, but deletes both the static IP and the discovered address

(2) user intends to delete just the discovered address, but deletes both the discovered address and the static address.

[Lee Trager (ltrager)]

Thanks for the explanation.

review: Approve

[MAAS Lander (maas-lander)]

The attempt to merge lp:~mpontillo/maas/discovered-ip-address-api-fix--bug-1686732 into lp:maas failed. Below is the output from the failed tests.

Get:1 http://security.ubuntu.com/ubuntu xenial-security InRelease [102 kB]
Hit:2 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial InRelease
Get:3 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-updates InRelease [102 kB]
Get:4 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-backports InRelease [102 kB]
Get:5 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages [527 kB]
Get:6 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-updates/universe amd64 Packages [460 kB]
Fetched 1,294 kB in 0s (2,236 kB/s)
Reading package lists...
sudo DEBIAN_FRONTEND=noninteractive apt-get -y \
    --no-install-recommends install apache2 archdetect-deb authbind avahi-utils bash bind9 bind9utils build-essential bzr bzr-builddeb chromium-browser chromium-chromedriver curl daemontools debhelper dh-apport dh-systemd distro-info dnsutils firefox freeipmi-tools git gjs ipython isc-dhcp-common isc-dhcp-server libjs-angularjs libjs-jquery libjs-jquery-hotkeys libjs-yui3-full libjs-yui3-min libnss-wrapper libpq-dev make nodejs-legacy npm postgresql psmisc pxelinux python3-all python3-apt python3-attr python3-bson python3-convoy python3-crochet python3-cssselect python3-curtin python3-dev python3-distro-info python3-django python3-django-nose python3-django-piston3 python3-dnspython python3-docutils python3-formencode python3-hivex python3-httplib2 python3-jinja2 python3-jsonschema python3-lxml python3-netaddr python3-netifaces python3-novaclient python3-oauth python3-oauthlib python3-openssl python3-paramiko python3-petname python3-pexpect python3-psycopg2 python3-pyinotify python3-pyparsing python3-pyvmomi python3-requests python3-seamicroclient python3-setuptools python3-simplestreams python3-sphinx python3-tempita python3-twisted python3-txtftp python3-tz python3-yaml python3-zope.interface python-bson python-crochet python-django python-django-piston python-djorm-ext-pgarray python-formencode python-lxml python-netaddr python-netifaces python-pocket-lint python-psycopg2 python-simplejson python-tempita python-twisted python-yaml socat syslinux-common tgt ubuntu-cloudimage-keyring wget xvfb
Reading package lists...
Building dependency tree...
Reading state information...
authbind is already the newest version (2.1.1+nmu1).
avahi-utils is already the newest version (0.6.32~rc+dfsg-1ubuntu2).
build-essential is already the newest version (12.1ubuntu2).
debhelper is already the newest version (9.20160115ubuntu3).
distro-info is already the newest version (0.14build1).
git is already the newest version (1:2.7.4-0ubuntu1).
libjs-angularjs is already the newest version (1.2.28-1ubuntu2).
libjs-jquery is already the newest version (1.11.3+dfsg-4).
libjs-yui3-full is already the newest version (3.5.1-1ubuntu3).
libjs-yui3-min is already the newest version (3.5.1-1ubuntu3).
make is already the newest version (4.1-6).
postgresql is already the newest version (9.5+173).
psmisc is already the newest version (22.21-2.1build1).
pxelinux is a...

=== modified file 'src/maasserver/api/ip_addresses.py'
--- src/maasserver/api/ip_addresses.py	2016-10-12 17:50:40 +0000
+++ src/maasserver/api/ip_addresses.py	2017-05-05 04:10:34 +0000
@@ -231,11 +231,18 @@
             caution.
         :type force: bool
 
+        :param discovered: If True, allows a MAAS administrator to release
+            a discovered address. Only valid if 'force' is specified. If not
+            specified, MAAS will attempt to release any type of address except
+            for discovered addresses.
+
         Returns 404 if the provided IP address is not found.
         """
         ip = get_mandatory_param(request.POST, "ip")
         force = get_optional_param(
             request.POST, 'force', default=False, validator=StringBool)
+        discovered = get_optional_param(
+            request.POST, 'discovered', default=False, validator=StringBool)
 
         if force is True and not request.user.is_superuser:
             return HttpResponseForbidden(
@@ -248,21 +255,24 @@
             raise MAASAPIValidationError(form.errors)
 
         if force:
-            query_args = dict(ip=ip)
+            query = StaticIPAddress.objects.filter(ip=ip)
+            if discovered:
+                query = query.filter(alloc_type=IPADDRESS_TYPE.DISCOVERED)
+            else:
+                query = query.exclude(alloc_type=IPADDRESS_TYPE.DISCOVERED)
         else:
-            query_args = dict(
-                alloc_type=IPADDRESS_TYPE.USER_RESERVED, ip=ip,
+            query = StaticIPAddress.objects.filter(
+                ip=ip, alloc_type=IPADDRESS_TYPE.USER_RESERVED,
                 user=request.user)
 
         # Get the reserved IP address, or raise bad request.
-        try:
-            ip_address = StaticIPAddress.objects.get(**query_args)
-        except StaticIPAddress.DoesNotExist:
+        ip_address = query.first()
+        if ip_address is None:
             if force:
                 error = "IP address %s does not exist."
             else:
                 error = (
-                    "IP address %s does not exist, is not a user-reserved "
+                    "IP address %s does not exist, is not the correct type of "
                     "address, or does not belong to the requesting user.\n"
                     "If you are sure you want to release this address, use "
                     "force=true as a MAAS administrator.")

=== modified file 'src/maasserver/api/tests/test_ipaddresses.py'
--- src/maasserver/api/tests/test_ipaddresses.py	2017-01-28 00:51:47 +0000
+++ src/maasserver/api/tests/test_ipaddresses.py	2017-05-05 04:10:34 +0000
@@ -240,7 +240,7 @@
         else:
             return status
 
-    def post_release_request(self, ip, mac=None):
+    def post_release_request(self, ip, mac=None, discovered=None):
         params = {
             'op': 'release',
             'ip': ip,
@@ -249,6 +249,8 @@
             params["mac"] = mac
         if self.force is not None:
             params["force"] = str(self.force)
+        if discovered is not None:
+            params["discovered"] = str(discovered)
         return self.client.post(reverse('ipaddresses_handler'), params)
 
     @transactional
@@ -310,6 +312,29 @@
                 Equals(""))
 
     @transactional
+    def test_POST_release_allows_admin_to_release_discovered_ip(self):
+        # Make an "orphaned" IP address, like the one in bug #1630034.
+        static_ip = factory.make_StaticIPAddress(
+            alloc_type=IPADDRESS_TYPE.DISCOVERED)
+        response = self.post_release_request(
+            str(static_ip.ip), discovered=True)
+        if self.expect_forbidden:
+            self.assertEqual(http.client.FORBIDDEN, response.status_code)
+            self.assertEqual(
+                "Force-releasing an IP address requires admin privileges.",
+                response.content.decode("utf-8"))
+        elif not self.force:
+            self.assertEqual(http.client.BAD_REQUEST, response.status_code)
+            self.assertThat(
+                response.content.decode("utf-8"),
+                DocTestMatches("...does not belong to the requesting user..."))
+        else:
+            self.assertEqual(http.client.NO_CONTENT, response.status_code)
+            self.assertThat(
+                response.content.decode("utf-8"),
+                Equals(""))
+
+    @transactional
     def test_POST_release_deallocates_address(self):
         ipaddress = factory.make_StaticIPAddress(
             alloc_type=IPADDRESS_TYPE.USER_RESERVED, user=self.user)