spans beyond the subnet reported incorrectly in ipam

[john]

summary: When needing to create a point to point connection via a subnet, generally and /31 is the recommended cidr. Neutron supports /31 via disabling dhcp and gateway on a subnet. However, IPam does not provide the allocation pool of the subnet properly and a VM cannot be created.

Steps to reproduce

root@ubuntu:~# neutron subnet-create --disable-dhcp --no-gateway --cidr=10.14.0.20/31 --name bug-subnet 69c5342a-5526-4257-880a-f8fd2e633de9
Created a new subnet:
+-------------------+--------------------------------------+
| Field | Value |
+-------------------+--------------------------------------+
| allocation_pools | |
| cidr | 10.14.0.20/31 |
| dns_nameservers | |
| enable_dhcp | False |
| gateway_ip | |
| host_routes | |
| id | 63ce4e26-9838-4fa3-b2d5-e59f88f5b7ce |
| ip_version | 4 |
| ipv6_address_mode | |
| ipv6_ra_mode | |
| name | bug-subnet |
| network_id | 69c5342a-5526-4257-880a-f8fd2e633de9 |
| subnetpool_id | |
| tenant_id | ca02fc470acc4a27b468dff32ee850b2 |
+-------------------+--------------------------------------+
root@ubuntu:~# neutron subnet-update --allocation-pool start=10.14.0.20,end=10.14.0.21 bug-subnet
The allocation pool 10.14.0.20-10.14.0.21 spans beyond the subnet cidr 10.14.0.20/31.

Recommended Fix:

in db/ipam_backend_mixin.py :: function: validate_allocation_pools
~~lines: 276

           if start_ip < subnet_first_ip or end_ip > subnet_last_ip:
                LOG.info(_LI("Found pool larger than subnet "
                             "CIDR:%(start)s - %(end)s"),
                         {'start': start_ip, 'end': end_ip})
                raise n_exc.OutOfBoundsAllocationPool(
                    pool=ip_pool,
                    subnet_cidr=subnet_cidr)

This if block should have a special case for ipv4 /31 and /32 for "<= and >=" :
                start_ip <= subnet_first_ip or end_ip >= subnet_last_ip

[Brian Haley (brian-haley)]

Can you create a patch with the change you proposed? I can try and make sure the relevant people get added to review it. Thanks.

[andrew yongjoon kong (sstrato-kong)]

Does it create gw and dhcp port for the subnet too? Actually We've been using /32bit network. If you guy want, i can share the code

[wujun (wujun)]

I think it is not a bug. When needing to create a point to point connection via a subnet, /30 is the recommended cidr.
Because the first IP address is considered as Network ID, and the last IP address is considered as broadcast address, the other IP address can be allocated, in a given subnet.

[john (g-john-p)]

/31 is an allowed network CIDR and is used as industry standard practice and is an IETF standard https://tools.ietf.org/html/rfc3021.

/30 (as well as /24 for that matter) is a separate use case

/32 is also supported in OpenStack.

Please reconsider applying our patch.

[Brian Haley (brian-haley)]

Yes, a /31 is valid since you can specify, for example with /sbin/ip, to not use a broadcast address. We actually do this in the DVR code.

@John - with Openstack being an open-source project, we rely on a community of developers to propose patches that fix bugs, add features, etc. If you are able to check-out the code, make this change, and submit it for review it would greatly speed-up getting it accepted. The following links have information on how to do this:

https://wiki.openstack.org/wiki/NeutronDevelopment
http://docs.openstack.org/infra/manual/developers.html

Otherwise you will have to wait for another developer to (hopefully) prioritize this into their schedule.

[john (g-john-p)]

@Brian - We will provide the fix. We just wanted to validate that the community will accept our patch.

thanks ...

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/318542

[OpenStack Infra (hudson-openstack)]

Change abandoned by Armando Migliaccio (<email address hidden>) on branch: master
Review: https://review.openstack.org/318542
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Armando Migliaccio (armando-migliaccio)]

Needs a new owner.

[Tyler Britten (9-me-9)]

This issue actually spans to *any* CIDR. The first/last addresses are not required to be allocated to net/broadcast.

For example, static (forwarded) public blocks from a provider- for a /29 they treat all 8 ips as useable. Same with a /30- all 4 are useable IPs. as long as the addresses are within the CIDR, neutron should allow it.

[Tyler Britten (9-me-9)]

To add references, RFC 1812 (https://tools.ietf.org/html/rfc1812#page-23)
under 2.2.5.2:

In this model, hosts and routers make no assumptions about the use of addressing in the internet.

[Tyler Britten (9-me-9)]

Updated with some further testing. Assigning the first (net) address works, assigning the last (broadcast) does not.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/318542
Committed: https://opendev.org/openstack/neutron/commit/437a311eca27bde5799b04d6a27d8e0e2aaf1c1f
Submitter: "Zuul (22348)"
Branch: master

commit 437a311eca27bde5799b04d6a27d8e0e2aaf1c1f
Author: Nurmatov Mamatisa <email address hidden>
Date: Thu Feb 25 21:19:17 2021 +0300

    Using 31-Bit and 32-Bit prefixes for IPv4 reasonably

    When needing to create a point to point connection via a subnet,
    generally and /31 is the recommended cidr. Neutron supports /31
    disabling dhcp and gateway on a subnet. /32 is also supported in
    openstack.

    Closes-Bug: #1580927
    Change-Id: I3bfa3efb9fb8076656b16c89d2f35d74efde12b7

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 19.0.0.0rc1 release candidate.