Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2021-08-23
13:35:09 sean-k-mooney ok that should do it https://review.opendev.org/c/openstack/project-config/+/787523
13:38:11 opendevreview Vadym Markov proposed openstack/nova master: Fix for concurrent DB update issue https://review.opendev.org/c/openstack/nova/+/804985
14:02:59 opendevreview Lee Yarwood proposed openstack/nova master: workarounds: Remove disable_native_luksv1 https://review.opendev.org/c/openstack/nova/+/805647
14:03:00 opendevreview Lee Yarwood proposed openstack/nova master: workarounds: Remove rbd_volume_local_attach https://review.opendev.org/c/openstack/nova/+/805648
14:04:42 fungi melwitt: gibi: someone commented on https://launchpad.net/bugs/1927677 (OSSA-2021-002, CVE-2021-3654) that the fix is incomplete... any chance you have time to take a closer look and reopen the bug if so?
14:07:28 opendevreview Ilya Popov proposed openstack/nova master: Fix to use cell with more free memory first https://review.opendev.org/c/openstack/nova/+/805649
14:08:44 gibi fungi: ack
14:09:22 gibi fungi, melwitt: I can look at it tomorrow so melwitt if you have time still today then feel free to check it out
14:14:01 fungi i don't know that it's urgent, just didn't want it to slip through the cracks as it's comments on a closed bug
14:14:12 fungi but thanks!
14:15:07 gibi fungi: thanks for the headsup it would not notice it otherwise
14:16:20 fungi no worries, it's exactly why i continue to monitor comments on presumed fixed vulnerability reports
14:21:48 sean-k-mooney so they are reporting it does not work with 3 slashes
14:22:03 sean-k-mooney but with 2 or more then 4
14:23:03 sean-k-mooney https://launchpadlibrarian.net/554904339/python3.patch is more general
14:23:47 opendevreview Ilya Popov proposed openstack/nova master: Fix to use cell with more free memory first https://review.opendev.org/c/openstack/nova/+/805649
14:24:07 fungi sean-k-mooney: yep, hoping someone can test and confirm the assertion that the vulnerability is still exploitable with odd numbers of slashes
14:24:27 sean-k-mooney let me see if we have a func test for this
14:24:36 sean-k-mooney if we do i can try it with 3 slasshes
14:24:48 fungi thanks a bunch
14:24:53 fungi that's a huge help
14:26:44 sean-k-mooney we dont seam to have a func test but we do have a unit test https://review.opendev.org/c/openstack/nova/+/803091 ill see if i can modify that quickly
14:29:43 opendevreview Lee Yarwood proposed openstack/nova stable/wallaby: workarounds: Add libvirt_disable_apic https://review.opendev.org/c/openstack/nova/+/805628
14:30:29 opendevreview Lee Yarwood proposed openstack/nova stable/victoria: workarounds: Add libvirt_disable_apic https://review.opendev.org/c/openstack/nova/+/805629
14:30:57 opendevreview Lee Yarwood proposed openstack/nova stable/ussuri: workarounds: Add libvirt_disable_apic https://review.opendev.org/c/openstack/nova/+/805630
14:31:41 sean-k-mooney testtools.matchers._impl.MismatchError: 'Error code: 400' not in 'HTTP/1.1 301 Moved Permanently\r\nServer: WebSockify Python/3.8.10\r\nDate: Mon, 23 Aug 2021 14:31:26 GMT\r\nLocation: /example.com/%2F../\r\n\r\n'
14:31:55 sean-k-mooney fungi: ^ so ya that seams to confirm that /// is not blocked
14:32:10 sean-k-mooney ill quickly apply there patch and see if that correct it
14:33:37 opendevreview Lee Yarwood proposed openstack/nova stable/train: workarounds: Add libvirt_disable_apic https://review.opendev.org/c/openstack/nova/+/805631
14:34:04 sean-k-mooney gibi: fungi there patch seams to work for both cases. shall i submit it to gerrit
14:34:42 gibi sean-k-mooney: yes please
14:34:48 gibi or wait
14:35:07 gibi do we need any special treatment due to this being a secuirty bug?
14:35:20 gibi I guess not but fungi might knows better
14:35:27 sean-k-mooney well its public and the report and patch were submitted in the clear
14:35:45 sean-k-mooney so i think at this point we treat it as a public security bug
14:36:08 sean-k-mooney if the report was made privatly then yes
14:37:00 fungi sean-k-mooney: gibi: no special treatment other than please prioritize reviews and backporting
14:37:40 sean-k-mooney ok give me 2 mins to write a commit message and ill push the new unit test and the fix with the reporter listed as a co author of the patch
14:38:02 gibi sean-k-mooney: ack, I will prioritize the review
14:38:03 fungi or you could git am it
14:38:26 fungi i didn't look to see whether they included sufficient headers (a la git format-patch or similar)
14:38:46 fungi gerrit will allow you to push with any author on the commit, so long as your account is listed as the committer
14:38:54 sean-k-mooney its just https://launchpadlibrarian.net/554904339/python3.patch
14:39:03 sean-k-mooney no commit headers it just a raw patch file
14:39:15 sean-k-mooney not a git commit
14:39:25 fungi yeah, co-authored-by or whatever then
14:40:44 fungi the patch is trivial enough i doubt we need to worry about icla
14:41:52 fungi hopefully melwitt knows if there was some necessary nuance to the other solution we're not spotting
14:42:04 fungi once she's able to review it
14:48:13 opendevreview sean mooney proposed openstack/nova master: address open redirect with 3 forward slashes https://review.opendev.org/c/openstack/nova/+/805654
14:52:03 opendevreview sean mooney proposed openstack/nova master: address open redirect with 3 forward slashes https://review.opendev.org/c/openstack/nova/+/805654
14:52:53 lyarwood gibi: thanks for creating https://bugs.launchpad.net/nova/+bug/1940741 - have you had time to look into the race that's causing it?
14:53:43 gibi lyarwood: I only have the repro with DEBUG and tried to add sleep before the confirm call but that did not increased the chance of repro
14:53:57 lyarwood `2021-08-23 12:47:50,585 DEBUG [nova.servicegroup.drivers.db] Seems service nova-compute on host src is down. Last heartbeat was 2021-08-23 12:47:45.500309. Elapsed time is 5.084755` what the hell
14:54:13 gibi lyarwood: I'm deep in https://bugs.launchpad.net/nova/+bug/1936849 now so you can take https://bugs.launchpad.net/nova/+bug/1940741 forward
14:54:20 lyarwood ack np
14:54:39 gibi lyarwood: yepp I saw that hence my trial with sleeps
14:55:15 gibi lyarwood: maybe the compute service is busy and cannot do an update in every second
14:56:11 lyarwood yeah the dest is likely running through the resize codepaths and blocking the src prior to that
14:56:19 lyarwood good old func tests
14:56:22 gibi :)
14:56:48 gibi lyarwood: but you can prove that if you slow down the resize on the dest with sleep
14:57:39 gibi if that increases the repro rate then we have a proof
15:01:54 gibi lyarwood: you won't belive what causing https://bugs.launchpad.net/nova/+bug/1936849
15:02:30 lyarwood surprise me :)
15:02:44 gibi lyarwood: https://github.com/openstack/nova/blob/10b1dc84f47a71061340f8e0ae0fe32dca44061a/nova/tests/unit/storage/test_rbd.py#L122-L125
15:03:31 gibi that is the same shutdown as https://github.com/openstack/nova/blob/10b1dc84f47a71061340f8e0ae0fe32dca44061a/nova/tests/unit/virt/hyperv/test_serialproxy.py#L70
15:03:47 gibi because the Rbd test sets shutdown on the Mock class level
15:04:29 gibi becuase Rados is an alias for Mock not an instance of Mock
15:04:31 gibi the missing ()
15:05:32 lyarwood oofffffff
15:05:36 lyarwood nice catch
15:06:01 gibi I will do some grepping for other missing () after mock.Mock
15:06:13 gibi as this was a long journey :)
15:06:14 lyarwood yeah that sounds like an easy hacking rule
15:21:43 gibi hehh after the fix the rbd unit tests are failing :) The Rados = mock.Mock was intentional in the setup as they wanted to make sure that when the code calls Rados() it actually calls Mock()
15:23:21 lyarwood noice
15:41:17 opendevreview Balazs Gibizer proposed openstack/nova master: Avoid modifying the Mock class in test https://review.opendev.org/c/openstack/nova/+/805657
15:52:44 opendevreview Stephen Finucane proposed openstack/nova master: docs: Drop references to non-filter scheduler drivers https://review.opendev.org/c/openstack/nova/+/773645
15:52:44 opendevreview Stephen Finucane proposed openstack/nova master: scheduler: Merge driver into manager https://review.opendev.org/c/openstack/nova/+/773644
15:52:45 opendevreview Stephen Finucane proposed openstack/nova master: tests: Merge 'test_utils', 'test_scheduler_utils' https://review.opendev.org/c/openstack/nova/+/773646
15:52:45 opendevreview Stephen Finucane proposed openstack/nova master: conf: Remove deprecated aliases https://review.opendev.org/c/openstack/nova/+/773647
16:00:13 sean-k-mooney gibi: oh it was using the class defintion not an instance of the class
16:00:24 gibi sean-k-mooney: yepp
16:00:25 sean-k-mooney fun
16:00:52 gibi sean-k-mooney: and as the class definitions are global per interpreter it created a way that two tests interfere
16:01:25 sean-k-mooney yep we have seen that several times before
16:03:00 opendevreview Ade Lee proposed openstack/nova master: Add check job for FIPS https://review.opendev.org/c/openstack/nova/+/790519
16:45:55 opendevreview Stephen Finucane proposed openstack/nova master: db: Handle parameters in DB strings https://review.opendev.org/c/openstack/nova/+/805663
16:46:19 stephenfin lyarwood: sean-k-mooney: Feel free to improve the commit message on that with additional context if you'd like
16:49:44 sean-k-mooney stephenfin: ack thanks
16:50:36 sean-k-mooney ah you are adding a url parse was not sure if it needed a pears or a decode
16:51:22 sean-k-mooney in anycase the test seams good
16:55:59 lyarwood I don't get how it's encoded by the time it gets there however if it's not in the config
16:58:56 sean-k-mooney i think its becasue we were geting it form an object of type sqlalchemy.engine.url.URL
16:59:01 sean-k-mooney and then casting that to a string
16:59:16 lyarwood ah
16:59:18 sean-k-mooney so it was likely being url encoded by the str call
17:19:20 opendevreview Lee Yarwood proposed openstack/nova master: compute: Query the service group API within check_instance_host https://review.opendev.org/c/openstack/nova/+/802317

Earlier   Later