Description of problem: CNO doesn't validate Port argument for exportNetworkFlows. It this case port 65537 and port 0 are passed all the way to OVS, and OVS accepts the invalid ports without error. Version-Release number of selected component (if applicable): 4.8.0-0.nightly-2021-05-12-072240 How reproducible: Always Steps to Reproduce: 1. create YAML with invalid TCP port number 65537 and reserved port number 0 apiVersion: operator.openshift.io/v1 kind: Network metadata: name: cluster spec: exportNetworkFlows: netFlow: collectors: - 10.131.0.9:65537 - 10.131.0.7:0 3. Actual results: oc logs -c ovnkube-node ovnkube-node-zmrdm | grep 655 + [[ -n 10.131.0.9:65537 ]] + export_network_flows_flags='--netflow-targets 10.131.0.9:65537' + exec /usr/bin/ovnkube --init-node rbrattai-o48g36-phqg2-master-1.c.openshift-qe.internal --nb-address ssl:10.0.0.5:9641,ssl:10.0.0.6:9641,ssl:10.0.0.7:9641 --sb-address ssl:10.0.0.5:9642,ssl:10.0.0.6:9642,ssl:10.0.0.7:9642 --nb-client-privkey /ovn-cert/tls.key --nb-client-cert /ovn-cert/tls.crt --nb-client-cacert /ovn-ca/ca-bundle.crt --nb-cert-common-name ovn --sb-client-privkey /ovn-cert/tls.key --sb-client-cert /ovn-cert/tls.crt --sb-client-cacert /ovn-ca/ca-bundle.crt --sb-cert-common-name ovn --config-file=/run/ovnkube-config/ovnkube.conf --loglevel 4 --inactivity-probe=30000 --gateway-mode shared --gateway-interface br-ex --disable-snat-multiple-gws --metrics-bind-address 127.0.0.1:29103 --netflow-targets 10.131.0.9:65537 I0513 03:37:19.791204 3326210 ovs.go:170] exec(2): /usr/bin/ovs-vsctl --timeout=15 -- --id=@netflow create netflow targets=["10.131.0.9:65537"] active_timeout=60 -- set bridge br-int netflow=@netflow sh-4.4# ovs-vsctl find netflow _uuid : f098d84c-9e4a-4a51-9af9-eb8970297f7c active_timeout : 60 add_id_to_interface : false engine_id : [] engine_type : [] external_ids : {} targets : ["10.131.0.9:65537"] + [[ -n 10.131.0.7:0 ]] + export_network_flows_flags='--netflow-targets 10.131.0.7:0' + exec /usr/bin/ovnkube --init-node rbrattai-o48g36-phqg2-master-1.c.openshift-qe.internal --nb-address ssl:10.0.0.5:9641,ssl:10.0.0.6:9641,ssl:10.0.0.7:9641 --sb-address ssl:10.0.0.5:9642,ssl:10.0.0.6:9642,ssl:10.0.0.7:9642 --nb-client-privkey /ovn-cert/tls.key --nb-client-cert /ovn-cert/tls.crt --nb-client-cacert /ovn-ca/ca-bundle.crt --nb-cert-common-name ovn --sb-client-privkey /ovn-cert/tls.key --sb-client-cert /ovn-cert/tls.crt --sb-client-cacert /ovn-ca/ca-bundle.crt --sb-cert-common-name ovn --config-file=/run/ovnkube-config/ovnkube.conf --loglevel 4 --inactivity-probe=30000 --gateway-mode shared --gateway-interface br-ex --disable-snat-multiple-gws --metrics-bind-address 127.0.0.1:29103 --netflow-targets 10.131.0.7:0 I0513 03:50:30.011382 3380380 ovs.go:170] exec(2): /usr/bin/ovs-vsctl --timeout=15 -- --id=@netflow create netflow targets=["10.131.0.7:0"] active_timeout=60 -- set bridge br-int netflow=@netflow # ovs-vsctl find netflow _uuid : ef16366a-2f8b-490e-8bb0-57cf2f66c1a4 active_timeout : 60 add_id_to_interface : false engine_id : [] engine_type : [] external_ids : {} targets : ["10.131.0.7:0"] Expected results: Invalid port numbers are rejected. Additional info: OVS should also reject invalid port numbers as well.
*** Bug 1959223 has been marked as a duplicate of this bug. ***
Verification failed on 4.8.0-0.nightly-2021-06-10-071057 Do we need to update CNO go.mod and rebuild to get the new API regex? Or what grabs the new API? https://github.com/openshift/cluster-network-operator/blob/2c69dc92d938f0674b7a9fb320b41da34183401b/go.mod#L19 github.com/openshift/api v0.0.0-20210526151222-14f26e4285a4 https://github.com/openshift/cluster-network-operator/blob/2c69dc92d938f0674b7a9fb320b41da34183401b/vendor/github.com/openshift/api/operator/v1/types_network.go#L418 // +kubebuilder:validation:Pattern=`^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):[0-9]+$` type IPPort string
Will put a pr up in the CNO
https://github.com/openshift/cluster-network-operator/pull/1140 once this gets through should be good to go
Verified using cluster bot with https://github.com/openshift/cluster-network-operator/pull/1140
Moving to Modified because waiting on https://github.com/openshift/cluster-network-operator/pull/1140
It looks like go.mod was updated to github.com/openshift/api v0.0.0-20210720160326-96bb0f993a66 with https://github.com/openshift/cluster-network-operator/pull/1158
Verified on 4.9.0-0.nightly-2021-09-09-145014 [20:40:55] INFO> Shell Commands: oc patch networks.operator.openshift.io cluster --type=merge -p \{\"spec\":\{\"exportNetworkFlows\":\{\"netFlow\":\{\"collectors\":\[\"10.131.0.7:0\"\]\}\}\}\} --kubeconfig=ocp4_admin.kubeconfig waiting for operation up to 3600 seconds.. STDERR: The Network "cluster" is invalid: spec.exportNetworkFlows.netFlow.collectors: Invalid value: "10.131.0.7:0": spec.exportNetworkFlows.netFlow.collectors in body should match '^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$' [20:40:57] INFO> Exit Status: 1 [20:40:57] INFO> Shell Commands: oc patch networks.operator.openshift.io cluster --type=merge -p \{\"spec\":\{\"exportNetworkFlows\":\{\"netFlow\":\{\"collectors\":\[\"10.131.0.7:65536\"\]\}\}\}\} --kubeconfig=ocp4_admin.kubeconfig waiting for operation up to 3600 seconds.. STDERR: The Network "cluster" is invalid: spec.exportNetworkFlows.netFlow.collectors: Invalid value: "10.131.0.7:65536": spec.exportNetworkFlows.netFlow.collectors in body should match '^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$' [20:40:59] INFO> Exit Status: 1 [20:40:59] INFO> Shell Commands: oc patch networks.operator.openshift.io cluster --type=merge -p \{\"spec\":\{\"exportNetworkFlows\":\{\"netFlow\":\{\"collectors\":\[\"10.131.0.7:999999999999999\"\]\}\}\}\} --kubeconfig=ocp4_admin.kubeconfig waiting for operation up to 3600 seconds.. STDERR: The Network "cluster" is invalid: spec.exportNetworkFlows.netFlow.collectors: Invalid value: "10.131.0.7:999999999999999": spec.exportNetworkFlows.netFlow.collectors in body should match '^(([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[0-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]):([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$' [20:41:01] INFO> Exit Status: 1
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.9.0 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:3759