- openstack-discuss - lists.openstack.org

[OSSA-2024-005] Neutron: Authorization bypassed when setting tags on Neutron networks (CVE-2024-53916)
by Jay Faulkner 04 Dec '24

04 Dec '24

=========================================================================== OSSA-2024-005: Authorization bypassed when setting tags on Neutron networks =========================================================================== :Date: December 03, 2024 :CVE: CVE-2024-53916 Affects ~~~~~~~ - Neutron: >=23.0.0 <23.2.1, >=24.0.0 <24.0.2, >=25.0.0 <25.0.1 Description ~~~~~~~~~~~ Tore Anderson of Redpill Linpro AS discovered that Neutron does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects which do not belong to the tenant, and this action is not being subjected to the proper policy authorization check. Patches ~~~~~~~ -https://review.opendev.org/c/openstack/neutron/+/936849 (2023.2/bobcat) -https://review.opendev.org/c/openstack/neutron/+/936846 (2024.1/caracal) -https://review.opendev.org/c/openstack/neutron/+/936843 (2024.2/dalmatian) -https://review.opendev.org/c/openstack/neutron/+/935883 (2025.1/epoxy) Credits ~~~~~~~ - Tore Anderson from Redpill Linpro AS (C, V, E, -, 2, 0, 2, 4, -, 5, 3, 9, 1, 6) References ~~~~~~~~~~ -https://launchpad.net/bugs/2088986 -http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53916 -- Jay Faulkner OpenStack VMT

1 0

[publiccloud-sig] Reminder: next meeting December 4th (tomorrow) - 0800 UTC
by Felix Kronlage-Dammers 03 Dec '24

03 Dec '24

Hi everyone, This Wednesday, tomorrow, (December 4th) the next meeting of the publiccloud-sig is going to happen. We’ll be meeting at 0800 UTC here: https://meetpad.opendev.org/publiccloud-sig <https://meetpad.opendev.org/publiccloud-sig> See also here for all other details: https://wiki.openstack.org/wiki/PublicCloudSIG <https://wiki.openstack.org/wiki/PublicCloudSIG> See you tomorrow! felix -- Felix Kronlage-Dammers Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0

[nova] Rescuing a volume-backed instance
by Francesco Di Nucci 03 Dec '24

03 Dec '24

Hello, I am using Openstack 2024.1 and I have issues with an instance with a corrupted FS - I wanted to start it in rescue mode, but I'm getting stuck After reading nova#1926601 <https://bugs.launchpad.net/nova/+bug/1926601> , downloaded System Rescue CD and created an image with properties [otherwise it always failed with "Cannot rescue a volume-backed instance (HTTP 400)"] : openstack image create --file systemrescue-11.02-amd64.iso --disk-format iso --container-format bare --property hw_rescue_bus=virtio --property hw_rescue_device=disk systemrescuecd Then tried to rescue the instance: openstack --os-compute-api-version 2.96 server rescue --image systemrescuecd (my-instance-id) Now it fails with "Instance (my-instance-id) cannot be rescued: Driver Error: Image (my-image-id) is unacceptable: Image not in a supported format" How should I proceed? Thanks in advance -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email: francesco.dinucci(a)na.infn.it

3 3

[ironic] meeting schedule for December and end of the year holidays break
by Riccardo Pittau 03 Dec '24

03 Dec '24

Hello ironicers! Holiday season is upon us and we're close to the end of 2024. The last Ironic community meeting for this year will be held on Monday December 16th, so we have two meetings left before the break. We'll skip December 23rd and 30th and come back in 2025 on Monday January 6th. Thanks everyone for all your contributions during 2024! Ciao! Riccardo

1 0

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2025.1/R-17)
by Goutham Pacha Ravi 03 Dec '24

03 Dec '24

Hello Stackers, This week marks the 2024.2 ("Dalmatian") release trailing deadline [1]. All projects following the cycle-trailing release model [2][3] must release their 2024.2 ("Dalmatian") deliverables by December 5, 2024. No new governance changes were merged in the past week; goal champions and volunteers continued their efforts on the cross-community goals that have been committed to [4]. As Ghanshyam Mann (gmann) highlighted in this mailing list [5], nine project teams need to address CI jobs within their repositories due to the switch of base DevStack (and some tox) jobs to Ubuntu 24.04 LTS. Teams can work around the problem temporarily by pinning the nodeset used to run their failing jobs to Ubuntu 22.04 LTS while they triage and resolve these issues. The Ironic and Neutron teams recently dropped functional testing with the PostgreSQL database. As highlighted at the PTG [6], there is very little motivation within OpenStack's contributor community to support PostgreSQL as a database alternative to MySQL and its derivatives with Oslo.db. The TC has clarified this in a past resolution as well [7]. We are currently identifying places within the documentation where PostgreSQL references need to be removed and aim to address these promptly. If you rely on PostgreSQL, please voice your concerns and consider dedicating time and resources to reviving testing with this database. === Weekly Meeting === TC members met last Tuesday (2024-11-26) on OFTC's #openstack-tc channel [8]. A significant portion of the discussion focused on the state of CI. Members of the Testing and Collaboration Tools SIG highlighted that much of the gate flakiness is due to jobs encountering the new rate limits on DockerHub [9]. Alternatives that may be more suitable for CI usage within open-source communities were discussed. As a result, we encourage project teams to explore these alternatives, as many open-source communities have already done. The OpenStack TC's next weekly meeting is today (2024-12-03). It will be held simultaneously via video (Zoom) and IRC (OFTC's #openstack-tc channel) at 18:00 UTC. The agenda for this meeting, along with participation links, can be found on the wiki [10]. I hope to see you there! === Governance Proposals === ==== Open for Review ==== - Retire Murano/Senlin/Sahara OpenStack-Ansible roles: https://review.opendev.org/c/openstack/governance/+/935677 - Add ansible-role-httpd repo to OSA-owned projects: https://review.opendev.org/c/openstack/governance/+/935694 - Rework the initial goal proposal as suggested by the community: https://review.opendev.org/c/openstack/governance/+/931254 - Resolve to adhere to non-biased language: https://review.opendev.org/c/openstack/governance/+/934907 - Propose to select the eventlet-removal community goal: https://review.opendev.org/c/openstack/governance/+/934936 Thank you for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] 2025.1 "Epoxy" Release Schedule: https://releases.openstack.org/epoxy/schedule.html [2] Cycle-trailing release model: https://releases.openstack.org/reference/release_models.html#cycle-trailing [3] Cycle-trailing projects: https://codesearch.opendev.org/?q=type%3A%20trailing&i=nope&literal=nope&fi… [4] Proposed and selected community goals: https://governance.openstack.org/tc/goals/#community-goals [5] Migrate to noble communication: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [6] OpenStack TC PTG Notes (around line 159): https://etherpad.opendev.org/p/r.0f25532f564fb786a89cfe1de39b004b [7] State of community support for databases: https://governance.openstack.org/tc/resolutions/20170613-postgresql-status.… [8] TC Meeting IRC Log 2024-11-26: https://meetings.opendev.org/meetings/tc/2024/tc.2024-11-26-18.01.log.html [9] DockerHub rate limit changes: https://www.docker.com/blog/november-2024-updated-plans-announcement/ [10] TC Meeting Agenda, 2024-12-03: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee

1 0

[neutron] bug deputy report for week of 2024-11-25
by Bence Romsics 02 Dec '24

02 Dec '24

Hi All, These are the new bugs reported last week. Except the last one, each has an assignee or even a proposed fix. ovn-octavia-provider cores, please have a look at the last one! It seems valid to me, but I'm not familiar with the code base. The reporter/assignee seems to be a new contributor, may be happy to get some help from you. Medium: * https://bugs.launchpad.net/neutron/+bug/2089940 [WSGI] Make ``TunnelTypeDriverBase.sync_allocations`` compatible with WSGI Fix proposed: https://review.opendev.org/c/openstack/neutron/+/936813 * https://bugs.launchpad.net/neutron/+bug/2089661 Resource cache should be delete after port remove from br-int Fix in progress: https://review.opendev.org/c/openstack/neutron/+/936235 * https://bugs.launchpad.net/neutron/+bug/2089663 Router port device owner changed should send PORT resource UPDATE event Fix in progress: https://review.opendev.org/c/openstack/neutron/+/936237 * https://bugs.launchpad.net/neutron/+bug/2089727 neutron-tempest-plugin-openvswitch router migration cases are not run Assigned to Yulong. RFE: * https://bugs.launchpad.net/neutron/+bug/2089726 Sequential Execution of run Methods in OVN Agent Suggestion to parallelize the ovsdbapp event loop, see discussion in wip patch: https://review.opendev.org/c/openstack/ovsdbapp/+/936327 Stable: * https://bugs.launchpad.net/neutron/+bug/2089522 [stable] 2024.1 and 2023.2, broken grenade and skip jobs due to a partial migration to um/2023.1 Fixes in progress, some merged already: https://review.opendev.org/q/topic:"bug/2089522" ovn-octavia-provider: * https://bugs.launchpad.net/neutron/+bug/2090782 Some requests take a lot of time to process in OVN Octavia Provider on huge loadbalancers Assigned to Aslan. Cheers, Bence

1 0

[DevStack] Fail to install devstack (stable/2024.2)
by Seongsoo Cho 02 Dec '24

02 Dec '24

Hi OpenStack Community Since a few weeks ago, I've been getting an error on neutron module import when installing devstack. I still can't get rid of the error, how can I fix it? [ Error Message ] ERROR neutron return self.channel.remote_call(name, args, kwargs, ERROR neutron File "/opt/stack/data/venv/lib/python3.10/site-packages/oslo_privsep/daemon.py", line 215, in remote_call ERROR neutron raise exc_type(*result[2]) ERROR neutron ModuleNotFoundError: No module named 'neutron.privileged.agent' ERROR neutron +lib/neutron_plugins/ovs_base:_neutron_ovs_base_setup_bridge:1 exit_trap +./stack.sh:exit_trap:540 local r=1 ++./stack.sh:exit_trap:541 jobs -p You can find the full error message from this link full error : https://pastebin.com/KEn33H1a [ Environment ] OS : Ubuntu 24.04 devstack branch : stable/2024.2 full error : https://pastebin.com/KEn33H1a world dump : https://pastebin.com/vp4Azqjg Best Regards Seongsoo -- Seongsoo Cho OpenStack Korea User Group / Community Leader IRC #seongsoocho

2 2

join to contribute
by alibasafa18＠gmail.com 01 Dec '24

01 Dec '24

Hi everyone, I’m interested in contributing to Neutron. Could you please guide me on how to start understanding its codebase and logic? I have experience working with OpenStack, and I’m familiar with OVS and OVN, as well as their concepts.

2 1

[kayobe] [bifrost] Enabling and Deploying compute node
by alidot-subs Mail 30 Nov '24

30 Nov '24

Hi Everyone, Its be good experience to deploy Kayobe in all in one mode and see cirros image getting deployed and acesssible. Moving forward for multi-node deployment of baremetal machines. i tried to enable bifrost bit i doesn't seems to et enable by setting configurations in bifrost.yaml. What it takes to enable and use Bifrost using kayobe ? It may sound basic question. Thank you Ali

2 3

[cinder] What is the "official" name for Cinder in the service catalog?
by Stephen Finucane 29 Nov '24

29 Nov '24

o/ I've proposed a series of patches to "clean up" the service catalog that DevStack creates in a deployment. Currently, DevStack creates two endpoints for Cinder: one called 'cinderv3' of type 'volumev3' and another called 'cinder' of type 'block-storage'. For example: { "services": [ { "name": "cinderv3", "description": "Cinder Volume Service V3", "id": "65460706a9864e71926f13042f526aeb", "type": "volumev3", "enabled": true, "links": { "self": "http://10.0.108.50/identity/v3/services/65460706a9864e71926f13042f526aeb" } }, { "name": "cinder", "description": "Cinder Volume Service", "id": "cd406a0e296d47dca1e481e992851bb2", "type": "block-storage", "enabled": true, "links": { "self": "http://10.0.108.50/identity/v3/services/cd406a0e296d47dca1e481e992851bb2" } }, // ... ], "links": { "next": null, "self": "http://10.0.108.50/identity/v3/services", "previous": null } } They both ultimately point to the same API, the Cinder v3 API, meaning one of these endpoints is redundant. My assumption was 'block-storage' was the correct one, since that's the official service type [1], and that 'cinder' was the appropriate name since it mirrors what we use for other services (nova, neutron, keystone, glance, ...). However, tkajinam raised the point [2] that the Install Guide currently recommends use of the 'volumev3' type and that projects like Nova and Glance have an '[cinder] catalog_info' that defaults to 'volumev3'. If so, is 'block-storage' really the official service type, or is it 'volumev3'. If it is, should we be changing the Install Guide and the various config option defaults? Cheers, Stephen [1] https://specs.openstack.org/openstack/service-types-authority/

6 18