Security Group Rule create with forged integer security_group_id causes exceptions

[Andrew Karpow]

Assuming a project xyz has Security Groups, following POST requests fails with HTTP 500 ValueError:

/v2.0/security-group-rules
{
 "security_group_rule": {
  "direction": "egress",
  "ethertype": "IPv4",
  "port_range_max": 443,
  "port_range_min": 443,
  "project_id": "xyz",
  "protocol": "tcp",
  "remote_ip_prefix": "34.231.24.224/32",
  "security_group_id": 0
 }
}

The value error is raised by python uuid with `badly formed hexadecimal UUID string`.
This is because the prior validation _check_security_group in securitygroups_db.py is using
sg_obj.SecurityGroup.objects_exist(context, id=id) which yields true with MySQL, e.g.:

MariaDB [neutron]> SELECT count(*) FROM securitygroups WHERE securitygroups.id IN (0);
+----------+
| count(*) |
+----------+
| 15 |
+----------+
1 row in set, 46 warnings (0.001 sec)

MariaDB [neutron]> SHOW WARNINGS LIMIT 1;
+---------+------+--------------------------------------------------------------------------+
| Level | Code | Message |
+---------+------+--------------------------------------------------------------------------+
| Warning | 1292 | Truncated incorrect DOUBLE value: '77dd53b2-59c0-4208-b03c-9f9f65bf9a28' |
+---------+------+--------------------------------------------------------------------------+
1 row in set (0.000 sec)

Thus, the validation succeeds and the code path is followed till the id is converted to a UUID - which causes the unexpected exception.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/837146

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/837168

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/neutron/+/837308

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/neutron/+/837309

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/wallaby
Review: https://review.opendev.org/c/openstack/neutron/+/837330

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/victoria
Review: https://review.opendev.org/c/openstack/neutron/+/837332

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ussuri
Review: https://review.opendev.org/c/openstack/neutron/+/837333

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/train
Review: https://review.opendev.org/c/openstack/neutron/+/837334

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/837168
Committed: https://opendev.org/openstack/neutron/commit/c0bf560fa36aac798ad8783749fa78ddf766bdec
Submitter: "Zuul (22348)"
Branch: master

commit c0bf560fa36aac798ad8783749fa78ddf766bdec
Author: Andrew Karpow <email address hidden>
Date: Fri Apr 8 18:32:03 2022 +0200

    Force security_group_id uuid validation of sg rules

    security_groups_db._check_security_group is supposed to check the
    security_group_id of the _create_security_group_rule payload.
    When using an integer e.g. 0, as security_group_id, the check
    succededs because mysql accepts following query:

    SELECT * FROM securitygroups WHERE id in (0)

    Forcing validation of security_group_id as uuid fixes the problem

    Closes-Bug: #1968343
    Change-Id: I7c36b09309c1ef66608afacfb281b6f4b06ea5b8

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/837309
Committed: https://opendev.org/openstack/neutron/commit/afe3ba73ea1b2c3c244050d672c23134fa4bc08c
Submitter: "Zuul (22348)"
Branch: stable/xena

commit afe3ba73ea1b2c3c244050d672c23134fa4bc08c
Author: Andrew Karpow <email address hidden>
Date: Fri Apr 8 18:32:03 2022 +0200

    Force security_group_id uuid validation of sg rules

    security_groups_db._check_security_group is supposed to check the
    security_group_id of the _create_security_group_rule payload.
    When using an integer e.g. 0, as security_group_id, the check
    succededs because mysql accepts following query:

    SELECT * FROM securitygroups WHERE id in (0)

    Forcing validation of security_group_id as uuid fixes the problem

    Closes-Bug: #1968343
    Change-Id: I7c36b09309c1ef66608afacfb281b6f4b06ea5b8
    (cherry picked from commit c0bf560fa36aac798ad8783749fa78ddf766bdec)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/837330
Committed: https://opendev.org/openstack/neutron/commit/5598510c80b4accb97ed7fc62f63ee400e4237ec
Submitter: "Zuul (22348)"
Branch: stable/wallaby

commit 5598510c80b4accb97ed7fc62f63ee400e4237ec
Author: Andrew Karpow <email address hidden>
Date: Fri Apr 8 18:32:03 2022 +0200

    Force security_group_id uuid validation of sg rules

    security_groups_db._check_security_group is supposed to check the
    security_group_id of the _create_security_group_rule payload.
    When using an integer e.g. 0, as security_group_id, the check
    succededs because mysql accepts following query:

    SELECT * FROM securitygroups WHERE id in (0)

    Forcing validation of security_group_id as uuid fixes the problem

    Closes-Bug: #1968343
    Change-Id: I7c36b09309c1ef66608afacfb281b6f4b06ea5b8
    (cherry picked from commit c0bf560fa36aac798ad8783749fa78ddf766bdec)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/837332
Committed: https://opendev.org/openstack/neutron/commit/f13ab9c0c76e6a90464b249e15db50f4a531ca52
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit f13ab9c0c76e6a90464b249e15db50f4a531ca52
Author: Andrew Karpow <email address hidden>
Date: Fri Apr 8 18:32:03 2022 +0200

    Force security_group_id uuid validation of sg rules

    security_groups_db._check_security_group is supposed to check the
    security_group_id of the _create_security_group_rule payload.
    When using an integer e.g. 0, as security_group_id, the check
    succededs because mysql accepts following query:

    SELECT * FROM securitygroups WHERE id in (0)

    Forcing validation of security_group_id as uuid fixes the problem

    Closes-Bug: #1968343
    Change-Id: I7c36b09309c1ef66608afacfb281b6f4b06ea5b8
    (cherry picked from commit c0bf560fa36aac798ad8783749fa78ddf766bdec)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/837333
Committed: https://opendev.org/openstack/neutron/commit/d1cc994da52a4ef2fc9d336148e1f61d7920c16c
Submitter: "Zuul (22348)"
Branch: stable/ussuri

commit d1cc994da52a4ef2fc9d336148e1f61d7920c16c
Author: Andrew Karpow <email address hidden>
Date: Fri Apr 8 18:32:03 2022 +0200

    Force security_group_id uuid validation of sg rules

    security_groups_db._check_security_group is supposed to check the
    security_group_id of the _create_security_group_rule payload.
    When using an integer e.g. 0, as security_group_id, the check
    succededs because mysql accepts following query:

    SELECT * FROM securitygroups WHERE id in (0)

    Forcing validation of security_group_id as uuid fixes the problem

    Closes-Bug: #1968343
    Change-Id: I7c36b09309c1ef66608afacfb281b6f4b06ea5b8
    (cherry picked from commit c0bf560fa36aac798ad8783749fa78ddf766bdec)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/837308
Committed: https://opendev.org/openstack/neutron/commit/e887386aa1e560562b0e3b0d1049887b2f1f1870
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit e887386aa1e560562b0e3b0d1049887b2f1f1870
Author: Andrew Karpow <email address hidden>
Date: Fri Apr 8 18:32:03 2022 +0200

    Force security_group_id uuid validation of sg rules

    security_groups_db._check_security_group is supposed to check the
    security_group_id of the _create_security_group_rule payload.
    When using an integer e.g. 0, as security_group_id, the check
    succededs because mysql accepts following query:

    SELECT * FROM securitygroups WHERE id in (0)

    Forcing validation of security_group_id as uuid fixes the problem

    Closes-Bug: #1968343
    Change-Id: I7c36b09309c1ef66608afacfb281b6f4b06ea5b8
    (cherry picked from commit c0bf560fa36aac798ad8783749fa78ddf766bdec)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 17.4.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 18.3.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 19.2.0 release.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/837334
Committed: https://opendev.org/openstack/neutron/commit/f5fa74c5c6926eb46403f6b0b5e0bd81a90cf234
Submitter: "Zuul (22348)"
Branch: stable/train

commit f5fa74c5c6926eb46403f6b0b5e0bd81a90cf234
Author: Andrew Karpow <email address hidden>
Date: Fri Apr 8 18:32:03 2022 +0200

    Force security_group_id uuid validation of sg rules

    security_groups_db._check_security_group is supposed to check the
    security_group_id of the _create_security_group_rule payload.
    When using an integer e.g. 0, as security_group_id, the check
    succededs because mysql accepts following query:

    SELECT * FROM securitygroups WHERE id in (0)

    Forcing validation of security_group_id as uuid fixes the problem

    Closes-Bug: #1968343
    Change-Id: I7c36b09309c1ef66608afacfb281b6f4b06ea5b8
    (cherry picked from commit c0bf560fa36aac798ad8783749fa78ddf766bdec)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 20.1.0 release.

[Slawek Kaplonski (slaweq)]

This bug has had a related patch abandoned and has been automatically un-assigned due to inactivity. Please re-assign yourself if you are continuing work or adjust the state as appropriate if it is no longer valid.

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Slawek Kaplonski <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/837146
Reason: This review is > 4 weeks without comment, and failed Zuul jobs the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 21.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron train-eol release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron ussuri-eol release.