normal user can show all the networks

[David Geng]

As an normal user in project I can show all the networks even the network is not belong to the project.

Expectation: An normal user can only see the networks which belongs to the user's project.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/31481

[Russell Bryant (russellb)]

Added vulnerability management team to take a look to see if this is something we should be treating as a vulnerability. It looks like as a regular user, you when you list networks using the os-tenant-networks API extension, you get the networks for all tenants.

[Thierry Carrez (ttx)]

This could decently be seen as an information leak.

[David Geng (genggjh)]

Here is our detail test scenario:
Scenario:

Step 1.
        - create 3 new projects
        - public-project
        - my-project1
        - my-project2
    - create 3 users belong to my-project1
        - test1-admin with admin role
        - test1-member with member role
        - test1-catalogeditor with catalogeditor role
    - add them to public-project
    - create 3 users belong to my-project2
        - test2-admin with admin role
        - test2-member with member role
        - test2-catalogeditor with catalogeditor role
    - add them to public-project
    - add all other users to public-project as well

    NOTE for all the users into this environment the password is always passw0rd.

Step 2.Modify network settings

    one network is associated with public-project
    another network is associated with my-project1

[root@fbox-env6-b7 ˜]# keystone tenant-list
+----------------------------------+----------------+---------+
| id | name | enabled |
+----------------------------------+----------------+---------+
| 31eaf85660ca49c181cbe4e18be05f25 | my-project1 | True |
| 4825fd88da044c628207a5563c2e6fef | public-project | True |
| 5b4085ec4e2e49d7a9e6ae012111f6f0 | service | true |
| 66b1ae90d1624969af9753994e3d3da9 | admin | true |
| aa45e77fa2a34b2395f3f6593b9d53ce | my-project2 | True |
+----------------------------------+----------------+---------+

nova-manage network modify --project=4825fd88da044c628207a5563c2e6fef --fixed_range=172.16.86.0/24

nova-manage network modify --project=31eaf85660ca49c181cbe4e18be05f25 --fixed_range=172.16.85.0/24

so i'll have the same result:

[root@fbox-env6-b7 ˜]# nova-manage network list
id IPv4 IPv6 start address DNS1 DNS2 VlanID project uuid
1 172.16.79.0/24 None 172.16.79.56 172.16.79.50 172.16.79.50 4090 None 6d72af56-5398-453c-91ff-2ce60d622519
2 172.16.85.0/24 None 172.16.85.3 172.16.79.50 172.16.79.50 3215 31eaf85660ca49c181cbe4e18be05f25 bf9ec47a-21ce-45e3-9d3f-3e33cf43695c
3 172.16.86.0/24 None 172.16.86.3 172.16.79.50 172.16.79.50 3216 4825fd88da044c628207a5563c2e6fef 31fe2434-a341-4461-931d-237f62d17d1e

Step 3.

done the following command:

[root@fbox-env6-b7 ˜]# nova --os-tenant-name public-project --os-username test2-member --os-password passw0rd network-list
+--------------------------------------+-----------+----------------+
| ID | Label | Cidr |
+--------------------------------------+-----------+----------------+
| 31fe2434-a341-4461-931d-237f62d17d1e | vlan-3216 | 172.16.86.0/24 |
| 6d72af56-5398-453c-91ff-2ce60d622519 | public | 172.16.79.0/24 |
| bf9ec47a-21ce-45e3-9d3f-3e33cf43695c | vlan-3215 | 172.16.85.0/24 |
+--------------------------------------+-----------+----------------+

It is an error....the expected result should be that only the vlan 3216 associated to the public...

[Jeremy Stanley (fungi)]

Can Nova developers comment specifically in here on what the actual intent is with network restrictions, whether it's just meant to limit access to particular networks or if it's really designed to hide all information on the unavailable topology and failing at that task? If the former, this seems like maybe a need for clearer wording in the documentation to set appropriate expectations along with a hardening feature request. If the latter, then I agree this is an information leak vulnerability (but a low one, because relying on the secrecy of your network topology to protect you from an attacker is a serious case of security by obscurity in my opinion).

[David Geng (genggjh)]

IMO, at least if the end user can not use the networks which are not belong to his project to run VM, then he need not to see those networks which will mislead him.

[David Ripton (dripton)]

I marked it as High priority. The security team can overrule that if they want.

[Vish Ishaya (vishvananda)]

I agree that you shouldn't see networks belonging to other projects. I don't think this is severe enough to be considered a vulnerability though.

[Thierry Carrez (ttx)]

It just affects nova-network, not Quantum^WNeutron, right ? If yes I would just pass on OSSA for this one.

[David Geng (genggjh)]

I have not gotten the chance to try this in Quantum, since our production is still basing on VlanManage.

[Vish Ishaya (vishvananda)]

AFAIK this will not affect Neutron, but adding aaron rosen to verify.

[Aaron Rosen (arosen)]

Nope this does not affect neutron as nova-manage network list does not query quantum for it's networks (also neutron's policy engine takes this into account that the tenant_id matches what's returned).

I'm wondering if this is the expected behavor since in nova-network you cannot have overlapping ips one would need to see a list of networks created before they could create a network for themselves?

[David Geng (genggjh)]

But the problem is they can not use the networks which are not under their project (it is blocked in nova code) even they can see.

[Thierry Carrez (ttx)]

OK, let's pass on security advisory for this one. Just scream if you disagree.

[David Geng (genggjh)]

Please help to review my commit https://review.openstack.org/31481 and give me your comments. Thanks!

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/31481
Committed: http://github.com/openstack/nova/commit/2a7f08ae4abca51dc60a02deee06a108ad1c4dcc
Submitter: Jenkins
Branch: master

commit 2a7f08ae4abca51dc60a02deee06a108ad1c4dcc
Author: gengjh <email address hidden>
Date: Mon Jun 3 18:34:15 2013 +0800

    Filter network by project id

    Need filter the networks by project id when show the networks with
    normal user

    Fix bug 1186867

    Change-Id: I10b5880070a569614f54fa7dbcf08e548bcbc924

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/grizzly
Review: https://review.openstack.org/44256

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/grizzly
Review: https://review.openstack.org/45159

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/45159
Committed: http://github.com/openstack/nova/commit/c5a59fd2f9ceac2ad618fa1db052a8e5b5576082
Submitter: Jenkins
Branch: stable/grizzly

commit c5a59fd2f9ceac2ad618fa1db052a8e5b5576082
Author: gengjh <email address hidden>
Date: Mon Jun 3 18:34:15 2013 +0800

    Filter network by project id

    Need filter the networks by project id when show the networks with
    normal user

    Fix bug 1186867

    Change-Id: I10b5880070a569614f54fa7dbcf08e548bcbc924
    (cherry picked from commit 2a7f08ae4abca51dc60a02deee06a108ad1c4dcc)