oxidecomputer / oxidecomputer/omicron
Instance NIC list method might be authorizing against the wrong parent
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 572
- Forks
- 97
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 96
Description
While working on adding the IP version to our IP Pool objects, I found this:
This seems to be doing an authorization check on our builtin Oxide services IP Pool, while we're listing the interfaces attached to instances. Those use a separate, customer controlled IP Pool. It seems like we're doing the authz check against the wrong thing here. AFAICT, this is only used in one place, instance_network_interfaces_all_list_batched, which itself seems unused anywhere in Omicron. We could just remove this whole thing entirely, or figure out how to adjust this authz check to be on the right pool.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in nexus/db-queries/src/db/datastore/network_interface.rs at instance_network_interfaces_all_list_batched and the authorization check around lines 888-894. Search Omicron for callers to confirm whether the method is unused, then determine whether removing it or correcting the checked IP Pool is appropriate. Done means the listing path no longer authorizes against the wrong parent and its callers remain valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authorization, backend-api-design
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100