It was found that a non privileged tenant can add a router interface to a shared / external network's subnet with an IP address outside the subnet's allocation pool. This can result in a Denial of Service. Upstream issue: https://bugs.launchpad.net/neutron/+bug/1757482 Upstream patch: https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d
Created openstack-neutron tracking bugs for this issue: Affects: openstack-rdo [bug 1607824]
Hi Andrej, The fix has been merged to the upstream master branch and backports were proposed in Ocata to Queens (equiv. to OSP 11 to 13). We'll need to do a downstream only backport to OSP 10. Were you going to open RHBZs on openstack-neutron branches 10 to 13?
(In reply to Assaf Muller from comment #2) > Hi Andrej, > > The fix has been merged to the upstream master branch and backports were > proposed in Ocata to Queens (equiv. to OSP 11 to 13). We'll need to do a > downstream only backport to OSP 10. Were you going to open RHBZs on > openstack-neutron branches 10 to 13? Hi Assaf, I have been asked to open the flaw by Joshua Padman. I believe that our Openstack analysis team will get to this shortly and open the relevant trackers. I'll leave it up to their analysis to figure out which of our OSPs need the backports.
RHOSP 7.0 through 14.0 all exhibit this behaviour, so I am creating RHBZs for those versions, with the goal of downstream backports being performed for those releases too. In RHOSP 9.0 through 13.0, the function _validate_router_port_info is addressed by the linked upstream patch in OpenStack gerrit, potentially with small adjustments so everything applies cleanly. In addition, the neutron In RHOSP 7.0 and 8.0, the function _validate_router_port_info (which the upstream patches apply to) in db/l3_db.py had not been introduced, so does not exist in 7.0 and 8.0's l3_db.py - the simple validation logic is however consolidated in the _add_interface_by_port function in these older releases. Given no similar protection logic is present in these releases, I suggest that in order to address this for those releases, additional backporting work would be required to add validation to _add_interface_by_port.
Clearing my needinfo as James has suitably answered the query.
This issue has been addressed in the following products: Red Hat OpenStack Platform 13.0 (Queens) Via RHSA-2018:2710 https://access.redhat.com/errata/RHSA-2018:2710
This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2018:2715 https://access.redhat.com/errata/RHSA-2018:2715
This issue has been addressed in the following products: Red Hat OpenStack Platform 12.0 (Pike) Via RHSA-2018:3792 https://access.redhat.com/errata/RHSA-2018:3792