Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-23788

gatewayConfig.ipForwarding allows any invalid value

XMLWordPrintable

    • Moderate
    • No
    • False
    • Hide

      None

      Show
      None
    • Release Note Not Required
    • In Progress

      Description of problem:
      gatewayConfig.ipForwarding allows any invalid value but it should enforce "", "Restricted" or "Global"
       
      You can currently even do really funky stuff with that:

      oc edit network.operator/cluster
      (...)
       15 spec:                                                                                                                   
       16   clusterNetwork:                                                                                                       
       17   - cidr: 10.128.0.0/14                                                                                                 
       18     hostPrefix: 23                                                                                                      
       19   - cidr: fd01::/48                                                                                                     
       20     hostPrefix: 64                                                                                                      
       21   defaultNetwork:                                                                                                       
       22     ovnKubernetesConfig:                                                                                                
       23       egressIPConfig: {}                                                                                                
       24       gatewayConfig:                                                                                                    
       25         ipForwarding: $(echo 'Im injected'; lscpu)
      
      $ oc get pods -n openshift-ovn-kubernetes ovnkube-node-24628 -o yaml | grep sysctl -C5
            fi
      
            # If IP Forwarding mode is global set it in the host here.
            ip_forwarding_flag=
            if [ "$(echo 'Im injected'; lscpu)" == "Global" ]; then
              sysctl -w net.ipv4.ip_forward=1
              sysctl -w net.ipv6.conf.all.forwarding=1
            else
              ip_forwarding_flag="--disable-forwarding"
            fi
      
            NETWORK_NODE_IDENTITY_ENABLE=
      
      $ oc logs -n openshift-ovn-kubernetes ovnkube-node-24628 -c ovnkube-controller | grep inje -A5
      ++ echo 'Im injected'
      ++ lscpu
      + '[' 'Im injected
      Architecture:                       x86_64
      CPU op-mode(s):                     32-bit, 64-bit
      Address sizes:                      46 bits physical, 57 bits virtual
      Byte Order:                         Little Endian
      CPU(s):                             112
      

      I wouldn't consider this a security issue, because I have to be the admin to do that, and as the admin I can also simply modify the pod, but it's not very elegant to allow for some sort of code injection, even by the admin

              akaris@redhat.com Andreas Karis
              akaris@redhat.com Andreas Karis
              Huiran Wang Huiran Wang
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated: