Bug 1960101 - CNO: exportNetworkFlows accepts invalid TCP/UDP port numbers
Summary: CNO: exportNetworkFlows accepts invalid TCP/UDP port numbers
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.8
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: ---
: 4.9.0
Assignee: Ben Pickard
QA Contact: Ross Brattain
URL:
Whiteboard:
: 1959223 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-05-13 03:56 UTC by Ross Brattain
Modified: 2021-10-18 17:31 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-18 17:31:04 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift api pull 934 0 None open Bug 1960101: Fixed port section of kubebuilder validation pattern 2021-06-02 20:09:02 UTC
Github openshift cluster-network-operator pull 1140 0 None None None 2021-08-06 00:18:31 UTC
Github openshift cluster-network-operator pull 1158 0 None None None 2021-08-23 01:45:55 UTC
Red Hat Product Errata RHSA-2021:3759 0 None None None 2021-10-18 17:31:56 UTC

Description Ross Brattain 2021-05-13 03:56:23 UTC
Description of problem:

CNO doesn't validate Port argument for exportNetworkFlows.  It this case port 65537 and port 0 are passed all the way to OVS, and OVS accepts the invalid ports without error.



Version-Release number of selected component (if applicable):

4.8.0-0.nightly-2021-05-12-072240


How reproducible:

Always

Steps to Reproduce:
1. create YAML with invalid TCP port number 65537 and reserved port number 0

apiVersion: operator.openshift.io/v1
kind: Network
metadata:
  name: cluster
spec:
  exportNetworkFlows:
    netFlow:
      collectors:
        - 10.131.0.9:65537
        - 10.131.0.7:0

3.

Actual results:

oc logs -c ovnkube-node ovnkube-node-zmrdm | grep 655
+ [[ -n 10.131.0.9:65537 ]]
+ export_network_flows_flags='--netflow-targets 10.131.0.9:65537'
+ exec /usr/bin/ovnkube --init-node rbrattai-o48g36-phqg2-master-1.c.openshift-qe.internal --nb-address ssl:10.0.0.5:9641,ssl:10.0.0.6:9641,ssl:10.0.0.7:9641 --sb-address ssl:10.0.0.5:9642,ssl:10.0.0.6:9642,ssl:10.0.0.7:9642 --nb-client-privkey /ovn-cert/tls.key --nb-client-cert /ovn-cert/tls.crt --nb-client-cacert /ovn-ca/ca-bundle.crt --nb-cert-common-name ovn --sb-client-privkey /ovn-cert/tls.key --sb-client-cert /ovn-cert/tls.crt --sb-client-cacert /ovn-ca/ca-bundle.crt --sb-cert-common-name ovn --config-file=/run/ovnkube-config/ovnkube.conf --loglevel 4 --inactivity-probe=30000 --gateway-mode shared --gateway-interface br-ex --disable-snat-multiple-gws --metrics-bind-address 127.0.0.1:29103 --netflow-targets 10.131.0.9:65537
I0513 03:37:19.791204 3326210 ovs.go:170] exec(2): /usr/bin/ovs-vsctl --timeout=15 -- --id=@netflow create netflow targets=["10.131.0.9:65537"] active_timeout=60 -- set bridge br-int netflow=@netflow


sh-4.4# ovs-vsctl find netflow
_uuid               : f098d84c-9e4a-4a51-9af9-eb8970297f7c
active_timeout      : 60
add_id_to_interface : false
engine_id           : []
engine_type         : []
external_ids        : {}
targets             : ["10.131.0.9:65537"]
 

+ [[ -n 10.131.0.7:0 ]]
+ export_network_flows_flags='--netflow-targets 10.131.0.7:0'
+ exec /usr/bin/ovnkube --init-node rbrattai-o48g36-phqg2-master-1.c.openshift-qe.internal --nb-address ssl:10.0.0.5:9641,ssl:10.0.0.6:9641,ssl:10.0.0.7:9641 --sb-address ssl:10.0.0.5:9642,ssl:10.0.0.6:9642,ssl:10.0.0.7:9642 --nb-client-privkey /ovn-cert/tls.key --nb-client-cert /ovn-cert/tls.crt --nb-client-cacert /ovn-ca/ca-bundle.crt --nb-cert-common-name ovn --sb-client-privkey /ovn-cert/tls.key --sb-client-cert /ovn-cert/tls.crt --sb-client-cacert /ovn-ca/ca-bundle.crt --sb-cert-common-name ovn --config-file=/run/ovnkube-config/ovnkube.conf --loglevel 4 --inactivity-probe=30000 --gateway-mode shared --gateway-interface br-ex --disable-snat-multiple-gws --metrics-bind-address 127.0.0.1:29103 --netflow-targets 10.131.0.7:0
I0513 03:50:30.011382 3380380 ovs.go:170] exec(2): /usr/bin/ovs-vsctl --timeout=15 -- --id=@netflow create netflow targets=["10.131.0.7:0"] active_timeout=60 -- set bridge br-int netflow=@netflow

# ovs-vsctl find netflow
_uuid               : ef16366a-2f8b-490e-8bb0-57cf2f66c1a4
active_timeout      : 60
add_id_to_interface : false
engine_id           : []
engine_type         : []
external_ids        : {}
targets             : ["10.131.0.7:0"]



Expected results:

Invalid port numbers are rejected.


Additional info:

OVS should also reject invalid port numbers as well.

Comment 2 Ben Pickard 2021-05-20 20:15:19 UTC
*** Bug 1959223 has been marked as a duplicate of this bug. ***

Comment 4 Ross Brattain 2021-06-11 06:28:00 UTC
Verification failed on 4.8.0-0.nightly-2021-06-10-071057

Do we need to update CNO go.mod and rebuild to get the new API regex?  Or what grabs the new API?

https://github.com/openshift/cluster-network-operator/blob/2c69dc92d938f0674b7a9fb320b41da34183401b/go.mod#L19

	github.com/openshift/api v0.0.0-20210526151222-14f26e4285a4


https://github.com/openshift/cluster-network-operator/blob/2c69dc92d938f0674b7a9fb320b41da34183401b/vendor/github.com/openshift/api/operator/v1/types_network.go#L418

// +kubebuilder:validation:Pattern=`^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):[0-9]+$`
type IPPort string

Comment 5 Ben Pickard 2021-06-14 14:03:05 UTC
Will put a pr up in the CNO

Comment 6 Ben Pickard 2021-06-23 21:01:32 UTC
https://github.com/openshift/cluster-network-operator/pull/1140 once this gets through should be good to go

Comment 8 Ross Brattain 2021-06-30 03:07:52 UTC
Verified using cluster bot with https://github.com/openshift/cluster-network-operator/pull/1140

Comment 9 Ross Brattain 2021-08-06 00:25:10 UTC
Moving to Modified because waiting on https://github.com/openshift/cluster-network-operator/pull/1140

Comment 12 Ross Brattain 2021-08-23 01:45:56 UTC
It looks like go.mod was updated to 

	github.com/openshift/api v0.0.0-20210720160326-96bb0f993a66

with https://github.com/openshift/cluster-network-operator/pull/1158

Comment 36 Ross Brattain 2021-09-09 20:47:33 UTC
Verified on 4.9.0-0.nightly-2021-09-09-145014



[20:40:55] INFO> Shell Commands: oc patch networks.operator.openshift.io cluster --type=merge -p \{\"spec\":\{\"exportNetworkFlows\":\{\"netFlow\":\{\"collectors\":\[\"10.131.0.7:0\"\]\}\}\}\} --kubeconfig=ocp4_admin.kubeconfig
waiting for operation up to 3600 seconds..


STDERR:
The Network "cluster" is invalid: spec.exportNetworkFlows.netFlow.collectors: Invalid value: "10.131.0.7:0": spec.exportNetworkFlows.netFlow.collectors in body should match '^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$'


[20:40:57] INFO> Exit Status: 1

[20:40:57] INFO> Shell Commands: oc patch networks.operator.openshift.io cluster --type=merge -p \{\"spec\":\{\"exportNetworkFlows\":\{\"netFlow\":\{\"collectors\":\[\"10.131.0.7:65536\"\]\}\}\}\} --kubeconfig=ocp4_admin.kubeconfig
waiting for operation up to 3600 seconds..


STDERR:
The Network "cluster" is invalid: spec.exportNetworkFlows.netFlow.collectors: Invalid value: "10.131.0.7:65536": spec.exportNetworkFlows.netFlow.collectors in body should match '^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$'


[20:40:59] INFO> Exit Status: 1

[20:40:59] INFO> Shell Commands: oc patch networks.operator.openshift.io cluster --type=merge -p \{\"spec\":\{\"exportNetworkFlows\":\{\"netFlow\":\{\"collectors\":\[\"10.131.0.7:999999999999999\"\]\}\}\}\} --kubeconfig=ocp4_admin.kubeconfig
waiting for operation up to 3600 seconds..


STDERR:
The Network "cluster" is invalid: spec.exportNetworkFlows.netFlow.collectors: Invalid value: "10.131.0.7:999999999999999": spec.exportNetworkFlows.netFlow.collectors in body should match '^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$'


[20:41:01] INFO> Exit Status: 1

Comment 38 errata-xmlrpc 2021-10-18 17:31:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.9.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:3759


Note You need to log in before you can comment on or make changes to this bug.