[Yahoo-eng-team] [Bug 1844712] Re: RA Leak on tenant network

2023-06-01 Thread Jeremy Stanley
As annoying and disturbing as this bug is, we still years later lack sufficient information to be able to reproduce and study the behavior in order to even attempt to identify a root cause. Unless that situation changes, it seems impractical to exploit at the very least. In discussion between VMT m

[Yahoo-eng-team] [Bug 1838473] Re: non-IP ethertypes are permitted with iptables_hybrid firewall driver

2023-06-01 Thread Jeremy Stanley
Based on discussion between members of the VMT and others in the OpenStack Security SIG during the 2023.1 PTG, it appears that any fixes will depend on non-backportable default behavior or configuration changes. An OSSN might be warranted, but we wouldn't likely issue a security advisory about this

[Yahoo-eng-team] [Bug 1798904] Re: tenant isolation is bypassed if port admin-state-up=false

2023-06-01 Thread Jeremy Stanley
Based on discussion between VMT members and others in the OpenStack Security SIG during the 2023.1 PTG, it's presumed that all maintained branches of affected projects are no longer subject to this problem. Since it was fixed in master and then the affected branches eventually aged out of maintenan

[Yahoo-eng-team] [Bug 2022070] Re: [CI] "neutron-ovn-rally-task" timing out randomly

2023-06-01 Thread OpenStack Infra
Reviewed: https://review.opendev.org/c/openstack/neutron/+/885045 Committed: https://opendev.org/openstack/neutron/commit/b6ce7223244cd27cc620985ef88ada8ff8d48be5 Submitter: "Zuul (22348)" Branch:master commit b6ce7223244cd27cc620985ef88ada8ff8d48be5 Author: Rodolfo Alonso Hernandez Date:

[Yahoo-eng-team] [Bug 1724598] Re: DOS : API_RESULT_LIMIT does not work for swift objects

2023-06-01 Thread Jeremy Stanley
The lack of priority on this over the past 6 years seems to indicate it's not a severe enough risk to warrant a widely published advisory even if a fix ever does merge. The VMT and other OpenStack Security SIG members agreed during the 2023.1 cycle that this should be considered class B2 per our re

[Yahoo-eng-team] [Bug 2022093] [NEW] hw_disk_bus='sata' is replaced to scsi when it is attached to additional disk.

2023-06-01 Thread Artom Lifshitz
Public bug reported: Description === hw_disk_bus='sata' is replaced to scsi when it is attached to addtional disk. Steps to reproduce == 1. set hw_disk_bus=sata in a image $openstack image set --property hw_disk_bus=sata $openstack image set --property hw_disk_bus=sata

[Yahoo-eng-team] [Bug 2022070] [NEW] [CI] "neutron-ovn-rally-task" timing out randomly

2023-06-01 Thread Rodolfo Alonso
Public bug reported: The CI job "neutron-ovn-rally-task" is timing out randomly. Checking the last executions [1], the duration of this job is very close the timeout set in the job definition (7800 seconds). [1]https://zuul.opendev.org/t/openstack/builds?job_name=neutron-ovn- rally-task&skip=0 *

[Yahoo-eng-team] [Bug 2022058] [NEW] [ovn] l3ha and disitributed router extra attributes do not reflect OVN state

2023-06-01 Thread Dmitrii Shcherbakov
Public bug reported: With https://bugs.launchpad.net/neutron/+bug/1995974 fixed and https://review.opendev.org/c/openstack/neutron/+/864051 merged extra attributes such as `distributed` and `ha` are now created for OVN routers as well. Their default values are taken from the global configuration

[Yahoo-eng-team] [Bug 2022059] [NEW] [OVN] Trunk can be deleted when the parent port is bound to a VM

2023-06-01 Thread Rodolfo Alonso
Public bug reported: Inlike in other backends (ML2/OVS for example), the "Trunk" object can be deleted while the parent port (and the subports) are bound. This operation should raise an exception instead (same as in ML2/OVS). Example using ML2/OVS: $ openstack network trunk delete trunk1 Failed t

[Yahoo-eng-team] [Bug 1986906] Re: [rfe][fwaas]support standard_attrs for firewall_group

2023-06-01 Thread OpenStack Infra
Reviewed: https://review.opendev.org/c/openstack/neutron-fwaas/+/866988 Committed: https://opendev.org/openstack/neutron-fwaas/commit/3b4e1bdda1cd8cd76ecc6ffdfc6c72ea35fa7e18 Submitter: "Zuul (22348)" Branch:master commit 3b4e1bdda1cd8cd76ecc6ffdfc6c72ea35fa7e18 Author: liushy Date: Thu D

[Yahoo-eng-team] [Bug 2022043] [NEW] APIs for resources which don't have project_id still requires it in the API definition

2023-06-01 Thread Slawek Kaplonski
Public bug reported: I discovered that while working on new default SG rules templates API: https://review.opendev.org/c/openstack/neutron/+/883246 but it seems it's the same for e.g. flavors: https://github.com/openstack/neutron- lib/blob/master/neutron_lib/api/definitions/flavors.py which have t