)]}'
{"nova/context.py":[{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"7af8d26773d22585b0ad68fb4c7ea7c78cd30a8c","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba2be162_2c29a98a","line":376,"updated":"2017-03-04 15:42:06.000000000","message":"I think we should create the rpc transport here and set it as context.mq_connection instead of using the raw transport url. The transport url contains the user/pass login for the database and the original change avoided passing it around in the context (the db_connection is done similarly). I think one of the concerns is the possibility of having it logged somewhere potentially in an exception or similar.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"0e00a684d1729676268cbd2356676e3b7e123b64","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_81a78e4e","line":376,"in_reply_to":"9a30ddce_21542253","updated":"2017-03-07 01:07:48.000000000","message":"If we did, we\u0027d have to maintain a mapping of cell_uuid to the parameters we need for it, which would require us looking up the CellMapping either in compute rpc directly (which we can\u0027t do) or maintaining it somewhere global for the module to use if present by the other layers. That\u0027s a lot of complexity and extra lookups.\n\nReally, I hope we can identify where this is an actual problem before we architect a complex solution for it.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"1ae6564477a2dcfec732476fcc89f62e0ff99ae8","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_fb5e3775","line":376,"in_reply_to":"9a30ddce_3ba0cf90","updated":"2017-03-06 23:57:45.000000000","message":"FYI, this is my suggestion to obfuscate it:\n\n http://pastebin.com/raw/UPhdwA7f\n\nThat means if someone somehow stringifies the context automatically, they\u0027ll get \"\u003cTargetURL\u003e\" for that field instead of the url. They\u0027d have to know to drill down further into that object to get the url, just like they could in the oslo.db objects.\n\nI don\u0027t really think this is necessary for the reasons stated above, but if you think this is actually better somehow, I\u0027m glad to do it this way.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"a501c5a2304272a322b7d270fecc293533da624d","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_9b5ffb74","line":376,"in_reply_to":"9a30ddce_3ba0cf90","updated":"2017-03-06 23:57:50.000000000","message":"Yeah, we really shouldn\u0027t be logging/storing CellMappings forever in places, but things have changed a lot as work has progressed to now. I suppose the argument of \"horse already left the barn\" might work here.\n\nWhen I started working on cells v2, the idea was to be really careful with the db and mq urls since they are plain username/passwords.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"cce30e27a66febed634a8e0d36961fdff4d39e54","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_9ca0d1a7","line":376,"in_reply_to":"9a30ddce_3c6525e1","updated":"2017-03-07 01:29:42.000000000","message":"We can\u0027t construct rpcclient in target_cell since we don\u0027t know what topic, min_ver, etc will be used, right? Meaning, the client for conductor and compute are different (the target is the same).\n\nHonestly I\u0027m frustrated with this because storing the target on the context is no less obfuscated than my suggested patch above, and both  are \"solutions\" to a theoretical problem. A problem that we\u0027ve already demonstrated we can have anywhere else, as was shipped with ocata...\n\nHowever, if that\u0027s what other people want then I\u0027ll rip out all the caching stuff and replace it with new objects every time. I just want to make progress here.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d68e84b732846c7960185b823175a2d4c597b9db","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_90ed1a91","line":376,"in_reply_to":"9a30ddce_4de5cda6","updated":"2017-03-06 23:19:07.000000000","message":"Well, the db connection is in there too, it just doesn\u0027t (currently) stringify to something that would expose details, but it could and we wouldn\u0027t notice. We could do the same thing to just obscure what we\u0027re storing here for transport url, if that\u0027s good enough for you.\n\nCan you point me to somewhere that we dict-ify the whole context and log the details? The only places I remember us doing that, we used the serialized form that we send over RPC, which won\u0027t have these two bits inside.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"b4018c028b81084eb333bf63d79abfb63542fc99","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_a673c3b3","line":376,"in_reply_to":"9a30ddce_50ad5d30","updated":"2017-03-07 03:09:01.000000000","message":"Before I go profile the RPC stuff to determine how painful or not it would be to construct RPCClient each time from the transport stored in context, can you please explain why storing transport is more \"secure\" than my obfuscation wrapper? I feel like you haven\u0027t addressed that, but Matt said he thinks it\u0027s a reasonable compromise.\n\nI\u0027d like to know why that is any different from storing transport, which itself stores the url as a string inside (see below), and why it\u0027s different from all the rest of the code which has always had access to these values as strings in CONF.transport_url. Why is that new precedent?\n\nThe one difference I can see with that approach is that we can\u0027t cache client objects.\n\n \u003e\u003e\u003e print transport._driver._url.hosts\n \u003e\u003e\u003e [\u003cTransportHost hostname\u003d\u0027192.168.201.194\u0027, port\u003d5672, username\u003d\u0027stackrabbit\u0027, password\u003d\u0027foo\u0027\u003e]","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"faa0b9b6b10f65c0a7ded2985e5ce1781ef86cbc","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_50ad5d30","line":376,"in_reply_to":"9a30ddce_70c8a175","updated":"2017-03-07 02:18:38.000000000","message":"I don\u0027t want to architect a complex solution either, so I have suggested reverting the patch that added the rpc caching in the first place. I think that should be simple.\n\nI really don\u0027t want the precedent of storing a plain text password as an attribute on an object that\u0027s passed to almost every function in our code.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"514e1eeda6e98ccacd006ed9e55cffaccdadcdbb","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_300c6942","line":376,"in_reply_to":"9a30ddce_70c8a175","updated":"2017-03-07 02:19:54.000000000","message":"Nevermind the two birds with one stone, I was totally having a brain fart on the getattr magic in o.vo such that the context.mq_connection is not the field type from the CellMapping object, it\u0027s the str/unicode object value that\u0027s backing that field. So having said that, I think doing a facade/wrapper thing around the field to mask it\u0027s value when logged would be a fine compromise.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"184b8b6bb5a5dc6ec409538386d8657c3d8e9e99","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_9c4c5178","line":376,"in_reply_to":"9a30ddce_81a78e4e","updated":"2017-03-07 01:15:44.000000000","message":"No, I was thinking we would keep only cell_uuid on the RequestContext instead of the transport_url. If the cache were global (which it would be easy to make it global in rpc.py, I guess), we could: 1) lookup cell_uuid in the cache, 2) if not found, create RPCClient and put in cache, 3) let the context travel with the cell_uuid and the client comes from the cache in the end. No extra lookup other than a dict key lookup.\n\nI don\u0027t think there is an actual problem at present, but I want to carefully consider being risky about it. If these passwords leak into logs at any point, it\u0027s going to require operators to roll entirely new passwords and patch the logging out. It\u0027s not a trivial thing to deal with and I\u0027m motivated to avoid them being leaked into logs.\"","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"b689964c4b94d1718d090de39054a574bc7994e0","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_9be8db18","line":376,"in_reply_to":"9a30ddce_90ed1a91","updated":"2017-03-06 23:42:50.000000000","message":"The db_connection is a _TransactionContextManager object which, I just checked, has a _factory attribute that has a _url_cfg attribute, that stores the db url. So, technically you are right, but it\u0027s not nearly as obvious as the attribute on RequestContext.\n\nI don\u0027t think we currently do that. My concern is more about putting a plain password directly onto RequestContext and the potential/ease with which it could get logged. I just don\u0027t think it\u0027s a great idea. The original design and spec specifically called out to avoid putting the plain db url and mq urls on the context, so it\u0027s remained something I\u0027m thinking about.\n\nIf we want to revisit and change the approach there, I think it\u0027s worth looping in some other folks and discussing it again.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"960086239b3b3002129ff1d3bf10ceb425a2a49a","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_bb991f22","line":376,"in_reply_to":"9a30ddce_9b5ffb74","updated":"2017-03-07 00:02:10.000000000","message":"Sure, I\u0027m not saying we shouldn\u0027t be careful with them, but we either have to cache CellMappings or look them up every time, which is majorly inefficient, especially given they should rarely change. That has definitely been a design point from the beginning.\n\nThat logging of the list of cells definitely shouldn\u0027t be there, but it\u0027s a good example of why the humans are the ones that are going to leak something in a log if it\u0027s going to happen, IMHO.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"a3ef0e96449872cb583aaafb59036888e23b7600","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_3ba0cf90","line":376,"in_reply_to":"9a30ddce_9be8db18","updated":"2017-03-06 23:49:55.000000000","message":"Okay, this seems like much less of an issue than, for example this:\n\nhttps://github.com/openstack/nova/blob/master/nova/compute/api.py#L2527\n\nwhich clearly shouldn\u0027t be logging the details, but is.\n\nPutting something in a place that could be logged if someone called it out specifically doesn\u0027t worry to me too much. If the context gets logged automatically somehow then that makes it a bit more of an issue, but I\u0027m not sure where that would be.\n\nWe look up CellMappings and stash them in memory forever in API, scheduler and other places. Someone could easily LOG those (see above link).. why is this any different if it\u0027s not being logged right now?","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"60fcb8f5bb3e69e03bea7f615e9f44f63ceddb1e","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_3c6525e1","line":376,"in_reply_to":"9a30ddce_9c4c5178","updated":"2017-03-07 01:18:05.000000000","message":"Honestly, I would support us going back what we originally had which was no caching of RPCClient objects at all. Just create one in target_cell every time, same as we\u0027re doing for db_connection. I think it\u0027s no more expensive than what cells v1 was doing with every cells/messaging call it did.\n\nMy thinking with what we had originally was, let\u0027s not add complex caching before we know the performance is actually a problem.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"7e0702b38c3c7b1910936eae5bb58d913bb9b666","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_bc3bd59b","line":376,"in_reply_to":"9a30ddce_9c4c5178","updated":"2017-03-07 01:22:34.000000000","message":"Okay, but you can\u0027t cache the client in rpc.py keyed by a hash of the transport url alone because the cache for compute, conductor, console, etc are all different. Since we instantiate ComputeRPC in multiple places, you\u0027d need to store it somewhere common, but keyed by host, optic, and cell uuid.\n\nMaybe you can explain why having it on the context is riskier than a global cache anywhere else? Is it just because we sometimes log the values from the serialized context (which does not include the mq or db values)? If so, why does my proposed repr-defeating obfuscation not offer a (much simpler than a complex shared cache) solution to that?","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"400fc4c36899e781696a57a3982894c6877b3b50","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_70c8a175","line":376,"in_reply_to":"9a30ddce_9ca0d1a7","updated":"2017-03-07 02:02:23.000000000","message":"As noted in:\n\nhttps://review.openstack.org/#/c/442211/1/nova/compute/api.py\n\nIf the transport_url and database_connection fields were SensitiveStringFields, *and* the mask_password method can handle the format they are in to mask the credentials in the URL, then that would also obfuscate logging the transport_url here too.\n\nI won\u0027t pretend to follow the discussion related to the rpc caching stuff here; I was never involved in the original work on this and the RPC machinery is all voodoo to me.\n\nI tend to agree with Dan though that we need not bend over backwards to worry too much about architecting a complex solution to something that might not be happening (logging the attributes of the context somewhere). I added the SensitiveStringField to o.vo originally because of the whack a mole with logging credentials from the BlockDeviceMapping.connection_info dict. I would literally probably fix one of those per release because of how often the volume operations would log the entire connection_info dict.\n\nSince RequestContext doesn\u0027t have a __repr__ or __str__ method, then it sounds like the only way the mq_connection field would be logged is, as Dan pointed out, logging the to_dict() form - and these fields are in that dict, or intentionally iterating over the attributes on the context and logging them, which seems nutty.\n\nSo if we\u0027re just looking to hide those values when logged, I think changing CellMapping to use the SensitiveStringField kills two birds with one stone.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"281774f7b90ad2a291014baba75ec664339551c7","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_1cf8617c","line":376,"in_reply_to":"9a30ddce_9ca0d1a7","updated":"2017-03-07 01:52:55.000000000","message":"You are right, we can\u0027t construct rpcclient here, but we used to construct rpc transport here [1] (which is the only piece relevant to the transport_url). So to correct myself, I think we can just keep the transport object here.\n\nI\u0027m frustrated with this too because I have spent a lot of time working on the message queue switching and keeping the transport_url availability to a minimum. I think context is ubiquitous and worse for carrying a password. I think it\u0027s passed to most functions in our codebase.\n\nI think it might be better to take a step back to before we added the caching complexity since we\u0027re not even sure we _need_ caching. That was probably premature optimization. I think if we revert [1], we can solve the concerns and we can think about caching later, if we need it.\n\nThings have already gotten muddied IMHO because we have the cell mapping lookups in rpc.py, but we\u0027re trying to circumvent it with target_cell, and deprecating the lookups, and adding mq user/pass to context. \n\n[1] https://review.openstack.org/#/c/326906/11/nova/context.py","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"1ce7dad93b3c5581d31c1748ed11ae87af9d8f18","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_21542253","line":376,"in_reply_to":"9a30ddce_a1d2d232","updated":"2017-03-07 01:03:57.000000000","message":"I was thinking, would it be possible for us to lookup by cell_uuid in the rpc layer\u0027s cache, create the transport object and stash it early in here. It looks like maybe we can\u0027t because the RPCClient objects aren\u0027t cached in a global dict anywhere, the cache is an attribute on the rpcapi.ComputeAPI instance, effectively.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"65bfb19efeef286e538c647eb03c037751fa30c5","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_66fc6b3f","line":376,"in_reply_to":"9a30ddce_a673c3b3","updated":"2017-03-07 03:35:32.000000000","message":"I think storing the transport is obviously less bad than a bare \"public\" attribute on the context. In your example, the url is a \"private\" attribute that someone isn\u0027t going to think is okay to log by default, IMO. As alaski mentioned earlier, if you\u0027re going to do that, you should at least rename the attribute to \"transport_url\" to be clear about what it is.\n\nYou needn\u0027t profile the RPC stuff -- I\u0027m fine to have others vote over me if that\u0027s what everyone else wants. I just thought a revert would be simple and no one has concrete reason to think caching is necessary. IIRC, the cells v1 cell rpc messaging creates new transports/clients every time too.\n\nObfuscating with the wrapper is fine for protecting against the password being logged. My issue with that is at the end of the day, this patch chooses to put a plain text password as an attribute on an object that is passed to most functions and people regularly access its data. I didn\u0027t think we usually do that. On top of that, I feel like this patch is choosing to put the plain text password on the context to force it to fit with the caching code we already have, that didn\u0027t take into account this use case of pre-targeting and avoiding CellMapping lookup later. I think we wouldn\u0027t have gone this route if it weren\u0027t for what we already did so far, without pre-targeting in mind. I hope that makes sense.\n\nThat\u0027s true that anyone can get the url through the CONF, but I don\u0027t see it as readily available as the context that comes in as an arg to everything. But I see your point.\n\nIn summary, if everyone else wants to go forward with putting a password that doesn\u0027t expire here and obfuscating it, I am okay with being voted over.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"20e08000cff3d3a094db954f5e34316d7e8272f1","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_d66cea0a","line":376,"in_reply_to":"9a30ddce_bb991f22","updated":"2017-03-07 00:40:35.000000000","message":"I\u0027ve been away from things long enough to not understand everything here, but I\u0027ll be presumptuous and insert my thoughts anyways. I don\u0027t know all of the caching mechanisms being used in the RPC layer but it seems like caching could be done by storing a hash of the transport_url on the context as well as the rpc transport. That way there is no security concern here.\n\nAnother possibility would be to explicitly set mq_connection, and db_connection, to something like \"\u003credacted\u003e\" in to_dict() above so that nothing is accidentally logged. \n\nAlso, if the transport_url is being stored I think it\u0027s worth calling it context.transport_url, not context.mq_connection. The mismatch between that and db_connection is likely to be confusing.\n\nMy 2 cents.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"196e9738c4f730bbdf0b689286e8dbada3d2f30c","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_c186e664","line":376,"in_reply_to":"9a30ddce_c178a692","updated":"2017-03-07 00:48:13.000000000","message":"Yeah the problem is we want to cache a fully created RPCClient, which has in it a target, min_version, topic, etc. Just a hash of the target_url isn\u0027t enough.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"94f50a788f1cd1294a1ce82eb22f3ac3f9954805","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_a1d2d232","line":376,"in_reply_to":"9a30ddce_c186e664","updated":"2017-03-07 00:52:38.000000000","message":"Sorry, I think I see what you meant, however, we still have to communicate the url through the context to the lower layers, so unless everything looks up every possible target_url and hashes it, and then faults in any new CellMapping things when it finds a hash it doesn\u0027t know about... I don\u0027t think that\u0027s going to work.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"e8d94fbabd004d74091161929e25d985aa649e16","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_c178a692","line":376,"in_reply_to":"9a30ddce_d66cea0a","updated":"2017-03-07 00:45:39.000000000","message":"Another thought. I\u0027m trying to recall my original thinking about storing an RPC transport, or db connection, here vs. a connection string for either. I think it was because it allowed for the connection/transport to be created once on the context and then used multiple times in a request, while storing the connection string meant creating the transport or connection each time it was needed.\n\nIt sounds like there\u0027s caching in another layer that may remove the value of doing that here.","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"196e9738c4f730bbdf0b689286e8dbada3d2f30c","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_61b9ba2e","line":376,"in_reply_to":"9a30ddce_d66cea0a","updated":"2017-03-07 00:48:13.000000000","message":"These fields are not present in a to_dict() of the context, which is why I assert that there is no concern here :)","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":21813,"name":"Andrey Volkov","email":"m@amadev.ru","username":"avolkov"},"change_message_id":"f384fc40342b7fc71d3bb092f5b44b9692f6fdd7","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba2be162_83d971f5","line":376,"in_reply_to":"ba2be162_2c29a98a","updated":"2017-03-06 07:13:52.000000000","message":"+1 in term of security it can be not safe","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"b05dfe605747c2ddcb2d78684f0d19868624318e","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba2be162_ffd2aacf","line":376,"in_reply_to":"ba2be162_2c29a98a","updated":"2017-03-06 15:42:10.000000000","message":"Yeah, so the reason I had to do this like this is because otherwise we basically can\u0027t do all the connection caching that you have in the rpc layer. Wit this, we have a key we can look up in a dict of cached clients. Without it we either have to not cache, or dig deep into oslo.messaging layers to figure out the connection string.\n\nI\u0027m not sure I get the security concern since the object within the Target has the url buried inside. You\u0027re worried about something just iterating all the things in a RequestContext and logging them?","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"4652a376cd74e1dee13f058de795c9f3a8720298","unresolved":false,"context_lines":[{"line_number":373,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":374,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":375,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"},{"line_number":376,"context_line":"        context.mq_connection \u003d cell_mapping.transport_url"},{"line_number":377,"context_line":""},{"line_number":378,"context_line":""},{"line_number":379,"context_line":"@contextmanager"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a30ddce_4de5cda6","line":376,"in_reply_to":"ba2be162_ffd2aacf","updated":"2017-03-06 23:14:39.000000000","message":"I know. I spent a lot of time wracking my brain some months ago to figure out some way we could still cache in the rpc layer. We could if we passed the cell_uuid down in the context alongside the rpc transport object, but maybe that\u0027s a bit clunky. We would also have to lookup in the rpc layer cache here to avoid creating a new object when one isn\u0027t needed. Otherwise, we have to move all the caching to context.py.\n\nYeah, so one is that. Another would be say, logging the RequestContext object as a dict dump. Or someone not realizing that transport_url means a message queue username and password in plain text and logging it somewhere. Currently, the most sensitive thing we have in the context is the auth token and that 1) has a time expiration and 2) gets masked for logging if the mask_password oslo.utils function is used [1].\n\nI also understand the same issue exists for CellMapping in general, but CellMappings were supposed to be short-lived objects that we lookup and not pass anywhere.\n\n[1] https://github.com/openstack/oslo.utils/blob/3181e5b/oslo_utils/strutils.py#L56","commit_id":"eb48c3609a4ad4c48a56892dde5836769910f829"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"40f84a340d4e1ca3013ece06c7227fb578ffc480","unresolved":false,"context_lines":[{"line_number":370,"context_line":"    \"\"\""},{"line_number":371,"context_line":"    # avoid circular import"},{"line_number":372,"context_line":"    from nova import db"},{"line_number":373,"context_line":"    from nova import rpc"},{"line_number":374,"context_line":"    db_connection_string \u003d cell_mapping.database_connection"},{"line_number":375,"context_line":"    context.db_connection \u003d db.create_context_manager(db_connection_string)"},{"line_number":376,"context_line":"    if not cell_mapping.transport_url.startswith(\u0027none\u0027):"}],"source_content_type":"text/x-python","patch_set":25,"id":"9a30ddce_d3a7dc08","line":373,"updated":"2017-03-10 17:06:28.000000000","message":"damn you smith this conflicts with https://review.openstack.org/#/c/443403/","commit_id":"159062882ec1a004cc62fffc9c426c5a5e533e15"}],"nova/rpc.py":[{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fc4dab967c7c4d08b6416b99f9fff98712d4133","unresolved":false,"context_lines":[{"line_number":418,"context_line":"            return self.default_client"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    def by_instance(self, context, instance):"},{"line_number":421,"context_line":"        \"\"\"Deprecated.\"\"\""},{"line_number":422,"context_line":"        return self._client(context, transport\u003dcontext.mq_connection)"},{"line_number":423,"context_line":""},{"line_number":424,"context_line":"    def by_host(self, context, host):"}],"source_content_type":"text/x-python","patch_set":24,"id":"9a30ddce_0806b585","line":421,"updated":"2017-03-10 10:22:35.000000000","message":"Should we somehow log that ? It would be nice because we could see in the gate logs where or when those methods are still called.","commit_id":"5259bd5bcb5f8a09455e2902ffc6c4595d3309f3"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"a8fe10061027b18dd02a57c258a43702f90d6a84","unresolved":false,"context_lines":[{"line_number":418,"context_line":"            return self.default_client"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    def by_instance(self, context, instance):"},{"line_number":421,"context_line":"        \"\"\"Deprecated.\"\"\""},{"line_number":422,"context_line":"        return self._client(context, transport\u003dcontext.mq_connection)"},{"line_number":423,"context_line":""},{"line_number":424,"context_line":"    def by_host(self, context, host):"}],"source_content_type":"text/x-python","patch_set":24,"id":"9a30ddce_82943943","line":421,"in_reply_to":"9a30ddce_0806b585","updated":"2017-03-10 14:37:37.000000000","message":"No, we know where they\u0027re used. Every compute RPC method will hit one of these :)\n\nI just need to go back and clean up compute/rpc to use a common method here and am saving that for cleanup. I\u0027ll put a WIP cleanup patch at the end of this series.","commit_id":"5259bd5bcb5f8a09455e2902ffc6c4595d3309f3"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fc4dab967c7c4d08b6416b99f9fff98712d4133","unresolved":false,"context_lines":[{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    def by_instance(self, context, instance):"},{"line_number":421,"context_line":"        \"\"\"Deprecated.\"\"\""},{"line_number":422,"context_line":"        return self._client(context, transport\u003dcontext.mq_connection)"},{"line_number":423,"context_line":""},{"line_number":424,"context_line":"    def by_host(self, context, host):"},{"line_number":425,"context_line":"        \"\"\"Deprecated.\"\"\""}],"source_content_type":"text/x-python","patch_set":24,"id":"9a30ddce_a86cc935","line":422,"range":{"start_line":422,"start_character":47,"end_line":422,"end_character":68},"updated":"2017-03-10 10:22:35.000000000","message":"that supposes we previously explicitly did called set_target_cell() to get that attribute. I know that this method is now legacy and should never be used but maybe we could just first verify that the attribute is set before using it, or we could get an AttributeError here which would be very misunderstanding.","commit_id":"5259bd5bcb5f8a09455e2902ffc6c4595d3309f3"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"a8fe10061027b18dd02a57c258a43702f90d6a84","unresolved":false,"context_lines":[{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    def by_instance(self, context, instance):"},{"line_number":421,"context_line":"        \"\"\"Deprecated.\"\"\""},{"line_number":422,"context_line":"        return self._client(context, transport\u003dcontext.mq_connection)"},{"line_number":423,"context_line":""},{"line_number":424,"context_line":"    def by_host(self, context, host):"},{"line_number":425,"context_line":"        \"\"\"Deprecated.\"\"\""}],"source_content_type":"text/x-python","patch_set":24,"id":"9a30ddce_e2909545","line":422,"range":{"start_line":422,"start_character":47,"end_line":422,"end_character":68},"in_reply_to":"9a30ddce_a86cc935","updated":"2017-03-10 14:37:37.000000000","message":"Ah, you\u0027re right. In the most recent redo of this, I forgot to take the default client if none is specified. It won\u0027t matter for compute, but will when the others start using this module.","commit_id":"5259bd5bcb5f8a09455e2902ffc6c4595d3309f3"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"2fa9931792f01d7e3c4d27612ddcfef940fd15a1","unresolved":false,"context_lines":[{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    def by_instance(self, context, instance):"},{"line_number":421,"context_line":"        \"\"\"Deprecated.\"\"\""},{"line_number":422,"context_line":"        return self._client(context, transport\u003dcontext.mq_connection)"},{"line_number":423,"context_line":""},{"line_number":424,"context_line":"    def by_host(self, context, host):"},{"line_number":425,"context_line":"        \"\"\"Deprecated.\"\"\""}],"source_content_type":"text/x-python","patch_set":24,"id":"9a30ddce_2b76fcd6","line":422,"range":{"start_line":422,"start_character":47,"end_line":422,"end_character":68},"in_reply_to":"9a30ddce_e2909545","updated":"2017-03-10 19:24:56.000000000","message":"Actually, this was covered by L413 above. However, it\u0027s already merged and I have a patch to post soon to remove all this debt anyway :)","commit_id":"5259bd5bcb5f8a09455e2902ffc6c4595d3309f3"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"6327179ca773e3874aecd3af596808fe49c0c133","unresolved":false,"context_lines":[{"line_number":418,"context_line":"            return self.default_client"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    def by_instance(self, context, instance):"},{"line_number":421,"context_line":"        \"\"\"Deprecated.\"\"\""},{"line_number":422,"context_line":"        if context.mq_connection:"},{"line_number":423,"context_line":"            return self._client(context, transport\u003dcontext.mq_connection)"},{"line_number":424,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":25,"id":"9a30ddce_b3f26804","line":421,"updated":"2017-03-10 17:07:42.000000000","message":"Should probably use warnings.warn(..., DeprecationWarning) here, or use oslo debtcollector.","commit_id":"159062882ec1a004cc62fffc9c426c5a5e533e15"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"b532bdf8a7ac7bc668c2fd41de69a76ed61b7da5","unresolved":false,"context_lines":[{"line_number":418,"context_line":"            return self.default_client"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    def by_instance(self, context, instance):"},{"line_number":421,"context_line":"        \"\"\"Deprecated.\"\"\""},{"line_number":422,"context_line":"        if context.mq_connection:"},{"line_number":423,"context_line":"            return self._client(context, transport\u003dcontext.mq_connection)"},{"line_number":424,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":25,"id":"9a30ddce_940b8ad5","line":421,"in_reply_to":"9a30ddce_b3f26804","updated":"2017-03-10 18:10:50.000000000","message":"This isn\u0027t a library, so we\u0027re just warning for ourselves. It\u0027s not actionable by an operator so I don\u0027t think that emitting something in the logs is appropriate.\n\nI\u0027m working on the patch to clean this all up in compute/rpcapi right now anyway.","commit_id":"159062882ec1a004cc62fffc9c426c5a5e533e15"}],"nova/tests/unit/test_context.py":[{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fc4dab967c7c4d08b6416b99f9fff98712d4133","unresolved":false,"context_lines":[{"line_number":302,"context_line":"                                      transport_url\u003d\u0027fake://\u0027)"},{"line_number":303,"context_line":"        with context.target_cell(ctxt, mapping):"},{"line_number":304,"context_line":"            self.assertEqual(ctxt.db_connection, mock.sentinel.cm)"},{"line_number":305,"context_line":"        self.assertEqual(mock.sentinel.db_conn, ctxt.db_connection)"},{"line_number":306,"context_line":""},{"line_number":307,"context_line":"    def test_get_context(self):"},{"line_number":308,"context_line":"        ctxt \u003d context.get_context()"}],"source_content_type":"text/x-python","patch_set":24,"id":"9a30ddce_a8c9295b","line":305,"updated":"2017-03-10 10:22:35.000000000","message":"I would certainly appreciate if you could also verify the MQ connection.","commit_id":"5259bd5bcb5f8a09455e2902ffc6c4595d3309f3"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"a8fe10061027b18dd02a57c258a43702f90d6a84","unresolved":false,"context_lines":[{"line_number":302,"context_line":"                                      transport_url\u003d\u0027fake://\u0027)"},{"line_number":303,"context_line":"        with context.target_cell(ctxt, mapping):"},{"line_number":304,"context_line":"            self.assertEqual(ctxt.db_connection, mock.sentinel.cm)"},{"line_number":305,"context_line":"        self.assertEqual(mock.sentinel.db_conn, ctxt.db_connection)"},{"line_number":306,"context_line":""},{"line_number":307,"context_line":"    def test_get_context(self):"},{"line_number":308,"context_line":"        ctxt \u003d context.get_context()"}],"source_content_type":"text/x-python","patch_set":24,"id":"9a30ddce_429c015d","line":305,"in_reply_to":"9a30ddce_a8c9295b","updated":"2017-03-10 14:37:37.000000000","message":"Ack, thanks.","commit_id":"5259bd5bcb5f8a09455e2902ffc6c4595d3309f3"}]}