<html><body>
<p><font size="2" face="sans-serif">Thanks for your input, Carl. You're right, it seems the more appropriate place for this is _validate_subnet(). It checks ip version, gateway, etc... but not the size of the subnet.<br>
<br>
</font><br>
<br>
<tt><font size="2">Carl Baldwin <carl@ecbaldwin.net> wrote on 01/21/2014 09:22:55 PM:<br>
<br>
> From: Carl Baldwin <carl@ecbaldwin.net></font></tt><br>
<tt><font size="2">> To: OpenStack Development Mailing List <openstack-dev@lists.openstack.org>, </font></tt><br>
<tt><font size="2">> Date: 01/21/2014 09:27 PM</font></tt><br>
<tt><font size="2">> Subject: Re: [openstack-dev] [neutron] Neutron should disallow /32 CIDR</font></tt><br>
<tt><font size="2">> <br>
> The bottom line is that the method you mentioned shouldn't validate <br>
> the subnet. It should assume the subnet has been validated and <br>
> validate the pool. It seems to do a adequate job of that.</font></tt><br>
<tt><font size="2">> Perhaps there is a _validate_subnet method that you should be <br>
> focused on? (I'd check but I don't have convenient access to the <br>
> code at the moment)</font></tt><br>
<tt><font size="2">> Carl</font></tt><br>
<tt><font size="2">> On Jan 21, 2014 6:16 PM, "Paul Ward" <wpward@us.ibm.com> wrote:</font></tt><br>
<tt><font size="2">> You beat me to it. :) I just responded about not checking the <br>
> allocation pool start and end but rather, checking subnet_first_ip <br>
> and subnet_last_ip, which is set as follows:<br>
> <br>
> subnet = netaddr.IPNetwork(subnet_cidr)<br>
> subnet_first_ip = netaddr.IPAddress(subnet.first + 1)<br>
> subnet_last_ip = netaddr.IPAddress(subnet.last - 1)<br>
> <br>
> However, I'm curious about your contention that we're ok... I'm <br>
> assuming you mean that this should already be handled. I don't <br>
> believe anything is really checking to be sure the allocation pool <br>
> leaves room for a gateway, I think it just makes sure it fits in the<br>
> subnet. A member of our test team successfully created a network <br>
> with a subnet of 255.255.255.255, so it got through somehow. I will<br>
> look into that more tomorrow.<br>
> <br>
> <br>
> <br>
> Carl Baldwin <carl@ecbaldwin.net> wrote on 01/21/2014 05:27:49 PM:<br>
> <br>
> > From: Carl Baldwin <carl@ecbaldwin.net><br>
> > To: "OpenStack Development Mailing List (not for usage questions)" <br>
> > <openstack-dev@lists.openstack.org>, <br>
> > Date: 01/21/2014 05:32 PM<br>
> > Subject: Re: [openstack-dev] [neutron] Neutron should disallow /32 CIDR<br>
> > <br>
> > I think there may be some confusion between the two concepts: subnet<br>
> > and allocation pool. You are right that an ipv4 subnet smaller than<br>
> > /30 is not useable on a network.<br>
> > <br>
> > However, this method is checking the validity of an allocation pool.<br>
> > These pools should not include room for a gateway nor broadcast<br>
> > address. Their relation to subnets is that the range of ips contained<br>
> > in the pool must fit within the allocatable IP space on the subnet<br>
> > from which they are allocated. Other than that, they are simple<br>
> > ranges; they don't need to be cidr aligned or anything. A pool of a<br>
> > single IP is valid.<br>
> > <br>
> > I just checked the method's implementation now. It does check that<br>
> > the pool fits within the allocatable range of the subnet. I think<br>
> > we're good.<br>
> > <br>
> > Carl<br>
> > <br>
> > On Tue, Jan 21, 2014 at 3:35 PM, Paul Ward <wpward@us.ibm.com> wrote:<br>
> > > Currently, NeutronDbPluginV2._validate_allocation_pools() does some very<br>
> > > basic checking to be sure the specified subnet is valid. One thing that's<br>
> > > missing is checking for a CIDR of /32. A subnet with one IP address in it<br>
> > > is unusable as the sole IP address will be allocated to the gateway, and<br>
> > > thus no IPs are left over to be allocated to VMs.<br>
> > ><br>
> > > The fix for this is simple. In<br>
> > > NeutronDbPluginV2._validate_allocation_pools(), we'd check for start_ip ==<br>
> > > end_ip and raise an exception if that's true.<br>
> > ><br>
> > > I've opened lauchpad bug report 1271311<br>
> > > (<a href="https://bugs.launchpad.net/neutron/+bug/1271311">https://bugs.launchpad.net/neutron/+bug/1271311</a>) for this, but wanted to<br>
> > > start a discussion here to see if others find this enhancement to be a<br>
> > > valuable addition.<br>
> > ><br>
> > ><br>
> > > _______________________________________________<br>
> > > OpenStack-dev mailing list<br>
> > > OpenStack-dev@lists.openstack.org<br>
> > > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
> > ><br>
> > <br>
> > _______________________________________________<br>
> > OpenStack-dev mailing list<br>
> > OpenStack-dev@lists.openstack.org<br>
> > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
> > </font></tt><br>
<tt><font size="2">> <br>
> _______________________________________________<br>
> OpenStack-dev mailing list<br>
> OpenStack-dev@lists.openstack.org<br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
> _______________________________________________<br>
> OpenStack-dev mailing list<br>
> OpenStack-dev@lists.openstack.org<br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</font></tt></body></html>