Cause:
The default ProvisioningIP differs if host bits are set in the provisioning Network CIDR
Consequence:
The ProvisioningIP may differ from what was expected and class with other IP addresses on the provisioning network
Fix:
Added validation to ensure that the provisioningNetworkCIDR doesn't have host bits set
Result:
If the provisioningNetworkCIDR is provided with host bits set the installer will now stop and report and error
e.g. 172.2.3.4/24 would raise a validation error, 172.2.3.0/24 is ok
When setting provisioningNetworkCIDR in install config, not using the 0th address
in the range can result in the wrong ProvisioningIP being set.
This is because of a bug in apparentlymart/go-cidr , is it calculates the IP address with a bitwise OR without masking.
ProvisioningNetworkCIDR := ipnet.MustParseCIDR("172.22.0.0/24");
ip, _ := cidr.Host(&ProvisioningNetworkCIDR.IPNet, 2);
fmt.Println(ip);
results in 172.22.0.2
ProvisioningNetworkCIDR := ipnet.MustParseCIDR("172.22.0.1/24");
ip, _ := cidr.Host(&ProvisioningNetworkCIDR.IPNet, 2);
fmt.Println(ip);
results in 172.22.0.3
(In reply to Derek Higgins from comment #0)
> This is because of a bug in apparentlymart/go-cidr , is it calculates the IP
> address with a bitwise OR without masking.
The bitwise OR works in go-cidr as it expects the net.IPNet
passed into it to be from ParseCIDR, we use MustParseCIDR which returns a HostIP/MaskLen
A change in this behaviour has already been submitted upstream
https://github.com/apparentlymart/go-cidr/pull/15 (see ip = ip.Mask(mask) )
This hasn't been reviewed in some time, so in the meantime
I've submitted a PR to validate the CIDR
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHSA-2022:0056
When setting provisioningNetworkCIDR in install config, not using the 0th address in the range can result in the wrong ProvisioningIP being set. This is because of a bug in apparentlymart/go-cidr , is it calculates the IP address with a bitwise OR without masking. ProvisioningNetworkCIDR := ipnet.MustParseCIDR("172.22.0.0/24"); ip, _ := cidr.Host(&ProvisioningNetworkCIDR.IPNet, 2); fmt.Println(ip); results in 172.22.0.2 ProvisioningNetworkCIDR := ipnet.MustParseCIDR("172.22.0.1/24"); ip, _ := cidr.Host(&ProvisioningNetworkCIDR.IPNet, 2); fmt.Println(ip); results in 172.22.0.3