You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "xujiantop-crypto (via GitHub)" <gi...@apache.org> on 2026/09/10 15:54:37 UTC
[PR] network: handle missing network when releasing public IP [cloudstack]
xujiantop-crypto opened a new pull request, #14133:
URL: https://github.com/apache/cloudstack/pull/14133
Fixes #14068
During VPC teardown, a public IP can retain its associated network ID after the tier's network record has been deleted. `disassociatePublicIpAddress` passes the missing network to `applyIpAssociations`, which dereferences it and aborts VPC deletion with a `NullPointerException`.
Resolve the associated network before choosing the release path. When the network no longer exists, a releasing IP follows the existing quarantine and unassignment path. The association path continues to be used when the network exists.
The regression test supplies a non-null associated network ID whose DAO lookup returns null. It verifies successful release, IP unassignment, annotation cleanup and lock release, without calling `applyIpAssociations`.
This targets `4.22` in accordance with the contribution guide's release-branch policy for bug fixes; the affected code is also present there.
### Validation
- On the unfixed `4.22` base, the new regression test fails with `NullPointerException`.
- With the fix, the complete `IpAddressManagerTest` passes: 27 tests, 0 failures/errors/skips. All 25 selected reactor modules succeed, with 0 Checkstyle violations (JDK 11).
- `git diff --check` passes.
The Maven download plugin could not retrieve the system VM checksum file in this environment. I downloaded the unmodified official `https://download.cloudstack.org/systemvm/4.22/sha512sum.txt` to `engine/schema/dist/systemvm-templates/sha512sum.txt` and ran:
```sh
mvn -B -pl server -am -Dtest=IpAddressManagerTest -Dsurefire.failIfNoSpecifiedTests=false -Ddownload.plugin.skip=true test
```
Only the redundant download was skipped; compilation, Checkstyle and the selected tests ran. No build configuration changes are included.
For an environment-level check, follow the steps in #14068: create a VPC offering with firewall service enabled, deploy a tier and VM, apply a public-IP firewall rule, remove the VM and tier, then destroy the VPC. The VPC should be removed without the missing-network exception and the public IP should be released. This full VPC scenario has not been run locally.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] network: handle missing network when releasing public IP [cloudstack]
Posted by "nagaboinaramgopal (via GitHub)" <gi...@apache.org>.
nagaboinaramgopal commented on PR #14133:
URL: https://github.com/apache/cloudstack/pull/14133#issuecomment-5682909252
Thanks for the fix and the tests. I tried it on a KVM zone with the steps from #14068 (VPC offering with the Firewall service, a tier with a VM, a public IP with a port forwarding and a firewall rule, then remove the VM and the tier).
Without the change, deleting the VPC fails with `Cannot invoke "com.cloud.network.Network.getId()" because "network" is null`, with the same stack as in #14068. Releasing the public IP after removing the tier, while keeping the VPC, fails with the same NPE. In both cases the IP still has `network_id` set to the removed tier and stays in Releasing.
With the change, both work. The VPC is deleted, and the released IP goes back to Free with `network_id` and `vpc_id` cleared. A VPC that was already stuck from the earlier attempt could also be deleted with the change in place.
I was curious where the stale id comes from. On tier removal, `NetworkOrchestrator` calls `VpcManager.unassignIPFromVpcNetwork` for VPC IPs, and that method returns early when `isIpAllocatedToVpc(ip)` is true. With the Firewall service in the VPC offering, a public IP with a firewall rule matches that check (`firewallDao.listByIp` is not empty), so the IP keeps pointing at the removed tier.
One thing I noticed: after releasing the IP with the VPC kept, the IP is still configured on the VPC router's public interface, with an iptables rule for it, since no ipassoc is sent in the new path. As the IP is Free again, it could be given to another network while the old router still holds it. Would it make sense to apply the association through the VPC in that case, since the router is still there, or to clear the association when the tier is removed so the normal release path runs?
Either way, keeping the guard as a safety net sounds good to me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] network: handle missing network when releasing public IP [cloudstack]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #14133:
URL: https://github.com/apache/cloudstack/pull/14133#issuecomment-5630343251
## [Codecov](https://app.codecov.io/gh/apache/cloudstack/pull/14133?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 4.02%. Comparing base ([`b9a5977`](https://app.codecov.io/gh/apache/cloudstack/commit/b9a5977a2bbafd5ed178ae392c129a0cdc4930f6?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`8903273`](https://app.codecov.io/gh/apache/cloudstack/commit/89032735858f68cac99ee115fd6cd6eb6f126d25?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
> :exclamation: There is a different number of reports uploaded between BASE (b9a5977) and HEAD (8903273). Click for more details.
>
> <details><summary>HEAD has 1 upload less than BASE</summary>
>
>| Flag | BASE (b9a5977) | HEAD (8903273) |
>|------|------|------|
>|unittests|1|0|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## 4.22 #14133 +/- ##
=============================================
- Coverage 17.94% 4.02% -13.92%
=============================================
Files 5928 449 -5479
Lines 535174 38239 -496935
Branches 65494 7082 -58412
=============================================
- Hits 96017 1538 -94479
+ Misses 428228 36489 -391739
+ Partials 10929 212 -10717
```
| [Flag](https://app.codecov.io/gh/apache/cloudstack/pull/14133/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [uitests](https://app.codecov.io/gh/apache/cloudstack/pull/14133/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `4.02% <ø> (ø)` | |
| [unittests](https://app.codecov.io/gh/apache/cloudstack/pull/14133/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/cloudstack/pull/14133?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] network: handle missing network when releasing public IP [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #14133:
URL: https://github.com/apache/cloudstack/pull/14133#issuecomment-6514350300
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19842
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] network: handle missing network when releasing public IP [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #14133:
URL: https://github.com/apache/cloudstack/pull/14133#issuecomment-6512666892
@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] network: handle missing network when releasing public IP [cloudstack]
Posted by "nvazquez (via GitHub)" <gi...@apache.org>.
nvazquez commented on PR #14133:
URL: https://github.com/apache/cloudstack/pull/14133#issuecomment-6512642507
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org