| abhishekk | stable/2026.1 patches gone in merge conflicts, will rebase and repost them | 07:02 |
|---|---|---|
| opendevreview | Abhishek Kekane proposed openstack/glance stable/2026.1: Block restricted addresses in web-download import URIs https://review.opendev.org/c/openstack/glance/+/1003813 | 07:10 |
| opendevreview | Abhishek Kekane proposed openstack/glance stable/2026.1: Pin import downloads to validated destination addresses https://review.opendev.org/c/openstack/glance/+/1003814 | 07:10 |
| opendevreview | Abhishek Kekane proposed openstack/glance stable/2026.1: Block restricted hosts when adding HTTP image locations https://review.opendev.org/c/openstack/glance/+/1003815 | 07:10 |
| abhishekk | @croelandt you need to add +w again on above patches | 07:10 |
| opendevreview | Merged openstack/glance stable/2025.2: Properly limit web-download image fetch size https://review.opendev.org/c/openstack/glance/+/1003816 | 10:31 |
| *** sfinucan is now known as stephenfin | 10:55 | |
| pas-ha[m] | hello glance team, please see https://bugs.launchpad.net/glance/+bug/2158999/comments/33 | 11:56 |
| pas-ha[m] | namely, recent SSRF patches introduced a problem. When DNS returns both IPv6 and IPv4, and by chance the first one checked by glance and allowed thru is IPv6 but glance itself runs in an IPv4-only network - image download/import will fail. | 11:56 |
| pas-ha[m] | As I read the description of disallowed_host option, it does not look like I can put "all IPv6 range" there. | 11:58 |
| opendevreview | Merged openstack/glance stable/2025.2: Block restricted addresses in web-download import URIs https://review.opendev.org/c/openstack/glance/+/1003817 | 12:24 |
| opendevreview | Merged openstack/glance stable/2025.2: Pin import downloads to validated destination addresses https://review.opendev.org/c/openstack/glance/+/1003818 | 12:25 |
| abhishekk | @croelandt @rosmaita test_image_web_download_import test is failing intermittently on stable/2025.2 and it might will fail on master (though it's merged) and other branches as well | 12:47 |
| abhishekk | Pavlo has commented out the reason which looks valid, https://bugs.launchpad.net/glance/+bug/2158999/comments/33 | 12:48 |
| abhishekk | I have asked him whether he is willing to fix this, let me know what we should do, wait or proceed with a fix | 12:49 |
| rosmaita | abhishekk: ok, let's see what he says ... that looks like a "regular" bug, so should be filed separately from the security issue | 12:52 |
| rosmaita | i.e., it doesn't compromise the security fix | 12:53 |
| abhishekk | yes, sounds good | 12:53 |
| pas-ha[m] | yes, definitely, let me file a separate bug | 12:53 |
| abhishekk | cool, thank you!! | 12:53 |
| pas-ha[m] | this was kind of heads up for people who apply these patches and see similar failures | 12:53 |
| abhishekk | we are seeing it in stable/2026.1 at the moment, network unreachable | 12:54 |
| rosmaita | this is the problem with fixing bugs in private, it's difficult to consider all the real-life side-effects to the exploit that we're trying to prevent | 12:54 |
| abhishekk | agree | 12:54 |
| pas-ha[m] | I have patch in the works, will push 1st idea shortly so we can agree on new option names etc | 12:55 |
| rosmaita | pas-ha[m]: excellent! | 12:55 |
| rosmaita | pas-ha[m]: to be clear, i think you were correct in reporting the issue on the security bug, i just think we should follow it up on a different bug | 12:56 |
| abhishekk | pas-ha[m]: i think we should avoid introducing new config options to avoid breaking backward compatibility? | 12:56 |
| abhishekk | rosmaita: wdyt? ^^ | 12:56 |
| abhishekk | how about simple one line change which will sort the list to prefer ipv4 1st? like addresses.sort(key=lambda addr: (isinstance(addr, ipaddress.IPv6Address), addr)) | 12:57 |
| rosmaita | if we can set a sensible default, i think it would be ok to add a new option | 12:57 |
| pas-ha[m] | I plan to follow other image_filtering options somewhat, add option 'allowed_ip_version' with values ipv4, ipv6 and 'all' (default) | 12:57 |
| pas-ha[m] | abhishekk: that would break IPv6-only deployments then | 12:58 |
| rosmaita | so 'all' would basically be current behavior | 12:58 |
| pas-ha[m] | yes | 12:58 |
| abhishekk | ack | 12:58 |
| rosmaita | i think that would be ok, we can argue to the release team that it's the only way to fix a regression caused by a security fix, and that since the default preserves current behavior, it's backportable | 13:00 |
| abhishekk | ack, can't we detect local network capabilities and act accordingly? | 13:04 |
| abhishekk | # - If system has IPv4 only: IPv4 addresses first | 13:05 |
| abhishekk | # - If system has IPv6 only: IPv6 addresses first | 13:05 |
| abhishekk | # - If system has both: IPv4 first (conservative/common) | 13:05 |
| pas-ha[m] | not sure we can make it general enough for all possible edge cases 😕 | 13:06 |
| pas-ha[m] | but let me file a bug, push the change and we can continue in gerrit review 🙂 | 13:06 |
| abhishekk | ack, lets discuss this on your patch then | 13:06 |
| abhishekk | sounds good | 13:07 |
| abhishekk | thank you for working on this!! | 13:07 |
| opendevreview | Merged openstack/glance stable/2026.1: Properly limit web-download image fetch size https://review.opendev.org/c/openstack/glance/+/1003812 | 13:11 |
| pas-ha[m] | https://bugs.launchpad.net/glance/+bug/2166488 issue filed | 13:18 |
| opendevreview | Pavlo Shchelokovskyy proposed openstack/glance master: Allow to limit DNS resolution by IP version https://review.opendev.org/c/openstack/glance/+/1003956 | 13:22 |
| pas-ha[m] | that's the 1st iteration of the patch | 13:22 |
| *** EugenMayer4401809 is now known as EugenMayer440180 | 13:33 | |
| abhishekk | ack | 13:44 |
| opendevreview | Abhishek Kekane proposed openstack/glance master: DNM - Fix randomly fails on wrong IP version on web-download https://review.opendev.org/c/openstack/glance/+/1003982 | 14:09 |
| abhishekk | @pas-ha[m] I was talking about this way ^^ | 14:09 |
| pas-ha[m] | abhishekk: unfortunately this does not work. AFAIU This only detects if system network stack is IPv6 capable, i guess it is essentially the same as `socket.has_ipv6`. As a check I have just tried the same command in my env where we reproduce this (w/o IPv6 connectivity), and this check passes - but the actual connect is not possible. | 14:23 |
| abhishekk | ack, thanks for testing | 14:24 |
| pas-ha[m] | also, I suppose there could be cases where ipv6 is only local, but global access 'outside' is routable via ipv4, or vice versa. hence my comment re 'general case', and my idea to be explicit, with config option. | 14:32 |
| opendevreview | Pavlo Shchelokovskyy proposed openstack/glance master: Allow to limit DNS resolution by IP version https://review.opendev.org/c/openstack/glance/+/1003956 | 14:40 |
| pas-ha[m] | ready for review, with unit tests and release note | 14:41 |
| abhishek_ | @rosmaita @dansmith @croelandt when you are free ^^ | 14:57 |
| opendevreview | Merged openstack/glance stable/2026.1: Block restricted addresses in web-download import URIs https://review.opendev.org/c/openstack/glance/+/1003813 | 14:57 |
| *** EugenMayer4401808 is now known as EugenMayer440180 | 15:06 | |
| opendevreview | Pavlo Shchelokovskyy proposed openstack/glance master: Try all allowed DNS addresses when importing image https://review.opendev.org/c/openstack/glance/+/1004004 | 16:10 |
| pas-ha[m] | alternative variant that tries multiple IPs one by one (not tested yet) | 16:12 |
| pas-ha[m] | https://review.opendev.org/c/openstack/glance/+/1004004 | 16:12 |
| abhishek_ | thanks, lets wait for others to comment, i found this non-config way better | 16:47 |
| opendevreview | Pavlo Shchelokovskyy proposed openstack/glance master: Try all allowed DNS addresses when importing image https://review.opendev.org/c/openstack/glance/+/1004004 | 16:49 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!