oxidecomputer / oxidecomputer/omicron

Instance NIC list method might be authorizing against the wrong parent

Open
#8,873 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
572
Forks
97
Avg merge
2d 12h
Merged PRs (30d)
96

Description

While working on adding the IP version to our IP Pool objects, I found this:

https://github.com/oxidecomputer/omicron/blob/dab669342984908b1efd08df5a05830387c07afb/nexus/db-queries/src/db/datastore/network_interface.rs#L888-L894

This seems to be doing an authorization check on our builtin Oxide services IP Pool, while we're listing the interfaces attached to instances. Those use a separate, customer controlled IP Pool. It seems like we're doing the authz check against the wrong thing here. AFAICT, this is only used in one place, instance_network_interfaces_all_list_batched, which itself seems unused anywhere in Omicron. We could just remove this whole thing entirely, or figure out how to adjust this authz check to be on the right pool.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in nexus/db-queries/src/db/datastore/network_interface.rs at instance_network_interfaces_all_list_batched and the authorization check around lines 888-894. Search Omicron for callers to confirm whether the method is unused, then determine whether removing it or correcting the checked IP Pool is appropriate. Done means the listing path no longer authorizes against the wrong parent and its callers remain valid.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
authorization, backend-api-design
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.