neutron

Invalid IPv6 subnet in self-service network breaks DHCP agent

Bug #2028159 reported by Lana Kaleif
260
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Security Advisory
Incomplete
Undecided
Unassigned
neutron
Fix Released
High
Brian Haley

Bug Description

High level description:

A user creates self-service network (vxlan) with IPv6 subnet with the address ::/24, gateway ::
After that new instances in other networks do not receive addresses via DHCP.

Pre-conditions:

Neutron 20.3.1 (Yoga) with OVS ML2 plugin
3 DHCP agents for each network running on each of 3 controllers
A user account with a user role in some project

Step-by-step reproduction steps:

1. Launch a new instance in any DHCP-enabled network.
2. Verify that the instance receives an address.
3. Create a new network with a subnet with the following options:
   a) via Dashboard:
      Network Address: ::/24
      IP Version: IPv6
      Gateway IP: ::
      Enable DHCP: true
      IPv6 Address Configuration Mode: No options specified
   b) or via CLI:
      openstack network create bad
      openstack subnet create --network bad --dhcp --ip-version 6 --subnet-range "::/24" --gateway "::" badsub
4. Launch another instance in the same network as #1.
5. Verify that the instance does not receive an address.
6. Delete the network from step 3.
7. Reboot the last instance.
8. Verify that it receives an address.

Expected output:

Either Neutron does not allow to create such subnet, or
New instances do receive addresses (DHCP agent stays uninterrupted)

Actual output:

Neutron did not perform verification of the subnet options.
DHCP agent enters a broken state, new instances do not receive addresses.

Version:

# rpm -qa | grep neutron | sort
openstack-neutron-20.3.1-1.el8.noarch
openstack-neutron-common-20.3.1-1.el8.noarch
openstack-neutron-ml2-20.3.1-1.el8.noarch
openstack-neutron-openvswitch-20.3.1-1.el8.noarch
python3-neutron-20.3.1-1.el8.noarch
python3-neutronclient-7.8.0-1.el8.noarch
python3-neutron-lib-2.20.2-1.el8.noarch
# cat /etc/redhat-release
CentOS Stream release 8
# uname -srvmpio
Linux 4.18.0-383.el8.x86_64 #1 SMP Wed Apr 20 15:38:08 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Environment:

# openstack compute service list --sort-column Host
+--------------------------------------+----------------+------+----------+---------+-------+----------------------------+
| ID | Binary | Host | Zone | Status | State | Updated At |
+--------------------------------------+----------------+------+----------+---------+-------+----------------------------+
| c45e81ed-e173-4e36-b209-01c80b99036d | nova-conductor | s5 | internal | enabled | up | 2023-07-19T12:05:47.000000 |
| c0310488-c0c5-4c37-9847-44259c86f776 | nova-scheduler | s5 | internal | enabled | up | 2023-07-19T12:05:48.000000 |
| b30d037e-90c2-4624-b8a0-91822ecf85a8 | nova-conductor | s6 | internal | enabled | up | 2023-07-19T12:05:55.000000 |
| da00e178-c2a5-487c-affa-10ed60cc3a2f | nova-scheduler | s6 | internal | enabled | up | 2023-07-19T12:05:49.000000 |
| 49e63486-c55f-428b-a1a1-defac0f47bb7 | nova-conductor | s7 | internal | enabled | up | 2023-07-19T12:05:53.000000 |
| ae929e33-a114-4446-8c7a-a1f9a8aa5c21 | nova-scheduler | s7 | internal | enabled | up | 2023-07-19T12:05:55.000000 |
| 0e10eb67-8150-4a3d-a268-ec9e1a3cc0ec | nova-compute | s8 | nova | enabled | up | 2023-07-19T12:05:46.000000 |
| d271bf37-4d47-4150-8cd2-7119fcebc1a6 | nova-compute | s9 | nova | enabled | up | 2023-07-19T12:05:54.000000 |
+--------------------------------------+----------------+------+----------+---------+-------+----------------------------+
# openstack network agent list --sort-column Binary --sort-column Host
+--------------------------------------+--------------------+------+-------------------+-------+-------+---------------------------+
| ID | Agent Type | Host | Availability Zone | Alive | State | Binary |
+--------------------------------------+--------------------+------+-------------------+-------+-------+---------------------------+
| d749fb1b-2bda-42bf-b5a4-dd6a6c0f56c2 | DHCP agent | s5 | nova | :-) | UP | neutron-dhcp-agent |
| cceea512-154c-44ea-a571-9e5a542ccde9 | DHCP agent | s6 | nova | :-) | UP | neutron-dhcp-agent |
| 5c5ad312-c1ab-4d33-9e54-b62e7112b218 | DHCP agent | s7 | nova | :-) | UP | neutron-dhcp-agent |
| 7dc0b55f-6a3c-45bc-866a-28540128147d | L3 agent | s5 | nova | :-) | UP | neutron-l3-agent |
| 6171f6e5-66b6-475a-ba6b-6cc113dd2729 | L3 agent | s6 | nova | :-) | UP | neutron-l3-agent |
| df9b3796-181b-46ab-8adb-52083cbc5d1a | L3 agent | s7 | nova | :-) | UP | neutron-l3-agent |
| 03cffc3b-3e27-48bf-a633-b5ffed011fa6 | L3 agent | s8 | nova | :-) | UP | neutron-l3-agent |
| 1430f493-57e4-436d-8fcb-d8344fdbb2b0 | L3 agent | s9 | nova | :-) | UP | neutron-l3-agent |
| 52bd49c0-96d3-410f-88bb-ea99550851bc | Metadata agent | s5 | None | :-) | UP | neutron-metadata-agent |
| 699aca37-efc3-4c42-ad2c-eb6d5897a203 | Metadata agent | s6 | None | :-) | UP | neutron-metadata-agent |
| 89588d09-93ca-4c92-b544-0fd16274f4c9 | Metadata agent | s7 | None | :-) | UP | neutron-metadata-agent |
| e9af410b-7237-4e25-adcc-c13483917bf4 | Metadata agent | s8 | None | :-) | UP | neutron-metadata-agent |
| b4e9bef5-36fe-4953-a2f9-8d437fe7b30f | Metadata agent | s9 | None | :-) | UP | neutron-metadata-agent |
| 7173b0ed-4ec5-4177-ba29-3782e3e5f8be | Open vSwitch agent | s5 | None | :-) | UP | neutron-openvswitch-agent |
| d58ca721-f56d-4b3a-85d7-5e6c0d04f9db | Open vSwitch agent | s6 | None | :-) | UP | neutron-openvswitch-agent |
| 2924fb03-7e16-42c5-8af8-c1a3b25b0905 | Open vSwitch agent | s7 | None | :-) | UP | neutron-openvswitch-agent |
| b2118af9-a418-469f-9fea-379a92aa8548 | Open vSwitch agent | s8 | None | :-) | UP | neutron-openvswitch-agent |
| ee1c3f12-be03-4891-8895-b8f72f417585 | Open vSwitch agent | s9 | None | :-) | UP | neutron-openvswitch-agent |
+--------------------------------------+--------------------+------+-------------------+-------+-------+---------------------------+

Perceived severity:

High

dhcp-agent.log contains the following:

2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent [-] Unable to enable dhcp for eb2e3a84-87fa-4d03-87fa-8986a70f5d57.: pr2modules.netlink.exceptions.NetlinkError: (99, 'Cannot assign requested address')
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent Traceback (most recent call last):
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/dhcp/agent.py", line 218, in call_driver
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent rv = getattr(driver, action)(**action_kwargs)
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/dhcp.py", line 275, in enable
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent common_utils.wait_until_true(self._enable, timeout=300)
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/common/utils.py", line 717, in wait_until_true
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent while not predicate():
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/dhcp.py", line 287, in _enable
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent interface_name = self.device_manager.setup(self.network)
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/dhcp.py", line 1780, in setup
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent namespace=network.namespace)
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/interface.py", line 152, in init_l3
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent device.addr.add(ip_cidr)
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/ip_lib.py", line 541, in add
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent add_broadcast)
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/ip_lib.py", line 830, in add_ip_address
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent device, namespace, scope, broadcast)
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/oslo_privsep/priv_context.py", line 272, in _wrap
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent r_call_timeout)
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/oslo_privsep/daemon.py", line 215, in remote_call
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent raise exc_type(*result[2])
2023-07-14 16:26:03.589 93091 ERROR neutron.agent.dhcp.agent pr2modules.netlink.exceptions.NetlinkError: (99, 'Cannot assign requested address')

or

2023-07-19 13:58:39.777 98250 DEBUG neutron.agent.linux.dhcp [req-82f865b9-f787-4983-acb2-145c7db53877 - - - - -] Setting IPv6 gateway for dhcp netns on net 94355373-4bb8-4117-bec3-c6f492f26a93 to :: _set_default_route_ip_version /usr/lib/python3.6/site-packages/neutron/agent/linux/dhcp.py:1464
2023-07-19 13:58:39.832 98645 DEBUG oslo.privsep.daemon [-] privsep: Exception during request[14221983-9b1e-49c3-8248-59325d3e4069]: (22, 'Invalid argument') _process_cmd /usr/lib/python3.6/site-packages/oslo_privsep/daemon.py:481
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/oslo_privsep/daemon.py", line 476, in _process_cmd
    ret = func(*f_args, **f_kwargs)
  File "/usr/lib/python3.6/site-packages/oslo_privsep/priv_context.py", line 274, in _wrap
    return func(*args, **kwargs)
  File "/usr/lib/python3.6/site-packages/neutron/privileged/agent/linux/ip_lib.py", line 752, in add_ip_route
    ip.route('replace', **kwargs)
  File "/usr/lib/python3.6/site-packages/pr2modules/iproute/linux.py", line 2042, in route
    callback=callback)
  File "/usr/lib/python3.6/site-packages/pr2modules/netlink/nlsocket.py", line 397, in nlm_request
    return tuple(self._genlm_request(*argv, **kwarg))
  File "/usr/lib/python3.6/site-packages/pr2modules/netlink/nlsocket.py", line 891, in nlm_request
    callback=callback):
  File "/usr/lib/python3.6/site-packages/pr2modules/netlink/nlsocket.py", line 400, in get
    return tuple(self._genlm_get(*argv, **kwarg))
  File "/usr/lib/python3.6/site-packages/pr2modules/netlink/nlsocket.py", line 725, in get
    raise msg['header']['error']
pr2modules.netlink.exceptions.NetlinkError: (22, 'Invalid argument')
2023-07-19 13:58:39.834 98645 DEBUG oslo.privsep.daemon [-] privsep: reply[14221983-9b1e-49c3-8248-59325d3e4069]: (5, 'pr2modules.netlink.exceptions.NetlinkError', (22, 'Invalid argument')) _call_back /usr/lib/python3.6/site-packages/oslo_privsep/daemon.py:502
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent [req-82f865b9-f787-4983-acb2-145c7db53877 - - - - -] Unable to enable dhcp for 94355373-4bb8-4117-bec3-c6f492f26a93.: pr2modules.netlink.exceptions.NetlinkError: (22, 'Invalid argument')
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent [req-82f865b9-f787-4983-acb2-145c7db53877 - - - - -] Unable to enable dhcp for 94355373-4bb8-4117-bec3-c6f492f26a93.: pr2modules.netlink.exceptions.NetlinkError: (22, 'Invalid argument')
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent Traceback (most recent call last):
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/dhcp/agent.py", line 218, in call_driver
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent rv = getattr(driver, action)(**action_kwargs)
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/dhcp.py", line 275, in enable
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent common_utils.wait_until_true(self._enable, timeout=300)
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/common/utils.py", line 717, in wait_until_true
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent while not predicate():
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/dhcp.py", line 287, in _enable
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent interface_name = self.device_manager.setup(self.network)
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/dhcp.py", line 1782, in setup
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent self._set_default_route(network, interface_name)
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/dhcp.py", line 1505, in _set_default_route
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent ip_version)
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/dhcp.py", line 1483, in _set_default_route_ip_version
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent device.route.add_gateway(subnet.gateway_ip)
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/ip_lib.py", line 620, in add_gateway
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent scope=scope)
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/ip_lib.py", line 658, in add_route
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent table=table, metric=metric, scope=scope, **kwargs)
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/neutron/agent/linux/ip_lib.py", line 1532, in add_ip_route
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent metric=metric, scope=scope, proto=proto, **kwargs)
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/oslo_privsep/priv_context.py", line 272, in _wrap
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent r_call_timeout)
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent File "/usr/lib/python3.6/site-packages/oslo_privsep/daemon.py", line 215, in remote_call
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent raise exc_type(*result[2])
2023-07-19 13:58:39.837 98250 ERROR neutron.agent.dhcp.agent pr2modules.netlink.exceptions.NetlinkError: (22, 'Invalid argument')

See original description
Revision history for this message
Jeremy Stanley (fungi) wrote :

Since this report concerns a possible security risk, an incomplete
security advisory task has been added while the core security
reviewers for the affected project or projects confirm the bug and
discuss the scope of any vulnerability along with potential
solutions.

description: updated
Changed in ossa:
status: New → Incomplete
Revision history for this message
Brian Haley (brian-haley) wrote :

This looks like a duplicate of https://bugs.launchpad.net/neutron/+bug/1953165 which has already been fixed and backported to Victoria I believe.

Changed in neutron:
status: New → Incomplete
Revision history for this message
Jeremy Stanley (fungi) wrote :

Lana: Can you confirm whether your Yoga deployment has https://review.opendev.org/880960 applied? Also https://review.opendev.org/885272 will be wanted, I expect.

Revision history for this message
Lana Kaleif (lkaleif) wrote :

Jeremy: Yes, both appear to be applied.

Revision history for this message
Brian Haley (brian-haley) wrote :

Then maybe this is related to a different issue. Does your network have a very small MTU?

https://bugs.launchpad.net/neutron/+bug/1988069

That has the same stack trace as your first paste above.

The fix is not back-portable as it changed the API behavior.

Revision history for this message
Lana Kaleif (lkaleif) wrote :

Brian: The stack trace just points that underlying interface cannot accept parameters provided.
In case of this bug report, a regular non-admin user may deliberately set a subnet address to "::" or a gateway to "::", which results in DHCP agent taking first address "::1" (loopback) for itself, or trying to create a static route via "::", which in turn breaks the agent.

Revision history for this message
Lana Kaleif (lkaleif) wrote :

We have just also reproduced this on Neutron 22.0.1 (Antelope).

Revision history for this message
Lana Kaleif (lkaleif) wrote :

If you try to do the same for IPv4, you would get the following error:
Failed to create subnet "127.0.0.0/8" for network "bad".
Invalid input for operation: Loopback IP subnet is not supported if enable_dhcp is True.

It would be nice to have something similar for IPv6.

Revision history for this message
Lana Kaleif (lkaleif) wrote :

Another test:
Failed to create subnet "0.0.0.0/24" for network "bad".
Invalid input for operation: First IP '0.0.0.0' of network is not supported if enable_dhcp is True.

Revision history for this message
Brian Haley (brian-haley) wrote :

Ok, thanks for the info, guess I should have looked at the reproducer commands instead of looking at the stack trace.

This change should be referenced (and the bug) as to why we are a little more lenient with IPv6, just so we don't break anything:

https://review.opendev.org/c/openstack/neutron/+/647484

I don't think that broke it, and it can't really be reverted anyways, so we'll have to figure out a way to detect this invalid condition, most likely via the API.

For the record, the failure I see in the dhcp-agent is this with some debug added:

DEBUG neutron.agent.linux.interface [-] init_l3: adding cidr ::1/24 {{(pid=75396) init_l3 /opt/stack/neutron/neutron/agent/linux/interface.py:152}}
DEBUG oslo.privsep.daemon [-] privsep: Exception during request[61e6ea71-f26e-4f16-ae71-046d3f476594]: (99, 'Cannot assign requested address')

So it looks like since the gateway (and network) was :: it picked the next address of ::1 to be used for DHCP. The usage of ::/24 as a subnet is wrong and I'm surprised it wasn't detected.

The following quick change works for me, if you want to give it a try, although it might break something as I have not tested it much, can only assume it breaks the unit tests*:

diff --git a/neutron/db/db_base_plugin_v2.py b/neutron/db/db_base_plugin_v2.py
index 8b68a84cc2..a9cd7c6099 100644
--- a/neutron/db/db_base_plugin_v2.py
+++ b/neutron/db/db_base_plugin_v2.py
@@ -678,9 +678,10 @@ class NeutronDbPluginV2(db_base_plugin_common.DbBasePluginCommon,
                 error_message = _("Loopback IP subnet is not supported "
                                   "if enable_dhcp is True")
                 raise exc.InvalidInput(error_message=error_message)
- if ip_ver == constants.IP_VERSION_4 and net.first == 0:
- error_message = _("First IP '0.0.0.0' of network is not "
- "supported if enable_dhcp is True.")
+ if net.first == 0:
+ error_message = _("First IP '%s' of network is not "
+ "supported if enable_dhcp is True" %
+ netaddr.IPAddress(0, ip_ver))
                 raise exc.InvalidInput(error_message=error_message)

         if validators.is_attr_set(s.get('gateway_ip')):

stack@22-04:~/devstack$ openstack subnet create --network bad --dhcp --ip-version 6 --subnet-range "::/24" --gateway "::" badsub
BadRequestException: 400: Client Error for url: http://172.16.0.150:9696/networking/v2.0/subnets, Invalid input for operation: First IP '::' of network is not supported if enable_dhcp is True.

stack@22-04:~/devstack$ openstack subnet create --network bad --dhcp --ip-version 6 --subnet-range "::1/24" --gateway "::" badsub
BadRequestException: 400: Client Error for url: http://172.16.0.150:9696/networking/v2.0/subnets, Invalid input for operation: First IP '::' of network is not supported if enable_dhcp is True.

* It breaks 11 unit tests in neutron.tests.unit.db.test_db_base_plugin_v2

I will be out for a week, so if this is critical someone would have to pick up where I left off.

Brian Haley (brian-haley)
Changed in neutron:
status: Incomplete → Confirmed
importance: Undecided → High
Revision history for this message
Brian Haley (brian-haley) wrote :

I started working on this again, will update when I have something working better.

Revision history for this message
Brian Haley (brian-haley) wrote :

Ok, I have a better fix for this, will attach. Will need some feedback to see whether the other Neutron cores agree with the changes.

I also found a doc bug which I've fixed in the patch, and noticed the python-openstackclient code is incorrect in it's usage of the --use-prefix-delegation argument. The reason I mention it is because the only case to have a cidr for a subnet be "::/64" is when it's setup to use prefix delegation, it's actually a temporary value used by neutron to denote it's state.

Revision history for this message
Brian Haley (brian-haley) wrote :
Revision history for this message
Jeremy Stanley (fungi) wrote :

Looking at the proposed change, I suppose any cases it disallows were already broken, so this isn't really backward-incompatible and can be safely backported to maintained stable branches, correct?

Revision history for this message
Brian Haley (brian-haley) wrote :

Right, although it technically changes the API for the "::" case it never worked, so I doubt anyone would notice. I should add a release note as well just to denote the change in behavior.

Since I haven't run a full test suite against this I'm not sure if I've broken anything else.

Revision history for this message
Jeremy Stanley (fungi) wrote :

Apologies, we're several months past the embargo expiration at this point. It looks like Neutron security reviewers did not weigh in on the patch attached in comment #13, which is also lacking the release note mentioned in comment #15, nor have any backports been produced for stable branches.

I'd like to switch this to public security so we can seek assistance from the broader community, in hopes that might get things moving again, or so users and admins alike can at least be made aware of this risk. If there are no immediate objections, I'll go ahead and do that on Tuesday, January 9.

Revision history for this message
Brian Haley (brian-haley) wrote :

If setting to public will allow me to send a patch out that might be a better option since others can review. There would also be a change to the client code as well. What I originally did will probably require a rebase at this point as well. Unless someone takes a look before next week. Thanks.

Revision history for this message
Brian Haley (brian-haley) wrote :

I've updated my patch based on current master branch, will attach an update.

Will also attach a client update since the PD code seems broken.

Revision history for this message
Brian Haley (brian-haley) wrote :

Updated neutron patch

Revision history for this message
Brian Haley (brian-haley) wrote :

Related python-openstackclient patch for PD

Revision history for this message
Jeremy Stanley (fungi) wrote :

As indicated in comment #16, since there were no objections I've switched this report to our public workflow now in order to increase visibility and (hopefully) make better/faster progress.

description: updated
information type: Private Security → Public Security
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/905148

Changed in neutron:
status: Confirmed → In Progress
Rodolfo Alonso (rodolfo-alonso-hernandez)
Changed in neutron:
assignee: nobody → Brian Haley (brian-haley)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (master)

Reviewed: https://review.opendev.org/c/openstack/neutron/+/905148
Committed: https://opendev.org/openstack/neutron/commit/2f0011194012a2482f79603c310028736e9ff3c8
Submitter: "Zuul (22348)"
Branch: master

commit 2f0011194012a2482f79603c310028736e9ff3c8
Author: Brian Haley <email address hidden>
Date: Mon Jan 8 15:50:40 2024 -0500

    Disallow subnet cidr of :: without PD

    Do not allow the subnet cidr of :: to be used when
    creating a subnet, except in the case IPv6 prefix
    delegation has been specified in the request.

    Closes-bug: #2028159
    Change-Id: I480e9a117513996f3c070acd4ba39c2b9fe9c0f1

Changed in neutron:
status: In Progress → Fix Released
Revision history for this message
Jeremy Stanley (fungi) wrote :

If the fix is also backportable to supported stable branches, we could entertain issuing a security advisory for this.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (stable/2023.2)

Fix proposed to branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/neutron/+/908973

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (stable/2023.1)

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/neutron/+/908974

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (stable/2023.1)

Reviewed: https://review.opendev.org/c/openstack/neutron/+/908974
Committed: https://opendev.org/openstack/neutron/commit/45acc0c53bce770ce19a2601072cd6f5b0db9f5f
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit 45acc0c53bce770ce19a2601072cd6f5b0db9f5f
Author: Brian Haley <email address hidden>
Date: Mon Jan 8 15:50:40 2024 -0500

    Disallow subnet cidr of :: without PD

    Do not allow the subnet cidr of :: to be used when
    creating a subnet, except in the case IPv6 prefix
    delegation has been specified in the request.

    Conflicts:
        neutron/tests/unit/db/test_db_base_plugin_v2.py

    Closes-bug: #2028159
    Change-Id: I480e9a117513996f3c070acd4ba39c2b9fe9c0f1
    (cherry picked from commit 2f0011194012a2482f79603c310028736e9ff3c8)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (stable/2023.2)

Reviewed: https://review.opendev.org/c/openstack/neutron/+/908973
Committed: https://opendev.org/openstack/neutron/commit/09e007c1ae878df643c26d46de9f4cf6c7d59f94
Submitter: "Zuul (22348)"
Branch: stable/2023.2

commit 09e007c1ae878df643c26d46de9f4cf6c7d59f94
Author: Brian Haley <email address hidden>
Date: Mon Jan 8 15:50:40 2024 -0500

    Disallow subnet cidr of :: without PD

    Do not allow the subnet cidr of :: to be used when
    creating a subnet, except in the case IPv6 prefix
    delegation has been specified in the request.

    Closes-bug: #2028159
    Change-Id: I480e9a117513996f3c070acd4ba39c2b9fe9c0f1
    (cherry picked from commit 2f0011194012a2482f79603c310028736e9ff3c8)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/neutron 24.0.0.0rc1

This issue was fixed in the openstack/neutron 24.0.0.0rc1 release candidate.

To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.