Ubuntu Cloud Archive

[SRU] It's not possible to upload a volume that was build from an image back to glance, if multistore (glance) is enabled.

Series zed
Bug #1945500

Bug #1945500 reported by Florian Engelmann on 2021-09-29

This bug affects 7 people

	Status	Importance	Assigned to
Cinder	Fix Released	Medium	Unassigned
Ubuntu Cloud Archive	Fix Released	Undecided	Unassigned
Yoga	Fix Released	High	Unassigned
Zed	Fix Released	High	Unassigned
cinder (Ubuntu)	Fix Released	Undecided	Unassigned
Jammy	Fix Released	High	Unassigned
Kinetic	Fix Released	High	Unassigned

Bug Description

* SRU TEMPLATE AT THE BOTTOM *

Brief description:
Cinder (including Wallaby release) is not able to upload a volume that was build from an image back to glance, if multistore (glance) is enabled.

Details:
After enabling glance multistore there will be two extra properties with every image. Those are `os_glance_failed_import`and `os_glance_importing_to_stores`.
If cinder creates a volume from an imageRef it will store all image_metadata with that volume, including `os_glance_failed_import`and `os_glance_importing_to_stores`.
Using the cinder action `volume_client.volumes.upload_to_image` cinder will try to upload that volume to glance including those two properties. But they are "reserved attributes" (in glance). The upload will fail with:

INFO cinder.volume.api [req-321adb05-189b-49f9-aa54-62432ee25907 917f4ddabf954b92b84babc613f0292d a69fdf3fa6654adcb8de23c803df6712 - f9f86f7344e942a5a66cec801aa60dbe f9f86f7344e942a5a66cec801aa60dbe] Volume info retrieved successfully.
INFO cinder.volume.api [req-321adb05-189b-49f9-aa54-62432ee25907 917f4ddabf954b92b84babc613f0292d a69fdf3fa6654adcb8de23c803df6712 - f9f86f7344e942a5a66cec801aa60dbe f9f86f7344e942a5a66cec801aa60dbe] Get volume image-metadata completed successfully.
DEBUG glanceclient.common.http [req-321adb05-189b-49f9-aa54-62432ee25907 917f4ddabf954b92b84babc613f0292d a69fdf3fa6654adcb8de23c803df6712 - f9f86f7344e942a5a66cec801aa60dbe f9f86f7344e942a5a66cec801aa60dbe] Request returned failure status 403. _handle_response /var/lib/kolla/venv/lib/python2.7/site-packages/glanceclient/common/http.py:125
ERROR cinder.volume.api [req-321adb05-189b-49f9-aa54-62432ee25907 917f4ddabf954b92b84babc613f0292d a69fdf3fa6654adcb8de23c803df6712 - f9f86f7344e942a5a66cec801aa60dbe f9f86f7344e942a5a66cec801aa60dbe] Error while doing something: HTTPForbidden: 403 Forbidden: Access was denied to this resource.: Attribute 'os_glance_importing_to_stores' is reserved. (HTTP 403)
ERROR cinder.volume.api Traceback (most recent call last):
ERROR cinder.volume.api File "/var/lib/kolla/venv/lib/python2.7/site-packages/cinder/volume/api.py", line 1322, in copy_volume_to_image
ERROR cinder.volume.api context, self.image_service._translate_to_glance(metadata))
ERROR cinder.volume.api File "/var/lib/kolla/venv/lib/python2.7/site-packages/cinder/image/glance.py", line 378, in create
ERROR cinder.volume.api **sent_service_image_meta)
ERROR cinder.volume.api File "/var/lib/kolla/venv/lib/python2.7/site-packages/cinder/image/glance.py", line 225, in call
ERROR cinder.volume.api return getattr(controller, method)(*args, **kwargs)
ERROR cinder.volume.api File "/var/lib/kolla/venv/lib/python2.7/site-packages/glanceclient/common/utils.py", line 598, in inner
ERROR cinder.volume.api return RequestIdProxy(wrapped(*args, **kwargs))
ERROR cinder.volume.api File "/var/lib/kolla/venv/lib/python2.7/site-packages/glanceclient/v2/images.py", line 361, in create
ERROR cinder.volume.api resp, body = self.http_client.post(url, headers=headers, data=image)
ERROR cinder.volume.api File "/var/lib/kolla/venv/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 334, in post
ERROR cinder.volume.api return self.request(url, 'POST', **kwargs)
ERROR cinder.volume.api File "/var/lib/kolla/venv/lib/python2.7/site-packages/glanceclient/common/http.py", line 377, in request
ERROR cinder.volume.api return self._handle_response(resp)
ERROR cinder.volume.api File "/var/lib/kolla/venv/lib/python2.7/site-packages/glanceclient/common/http.py", line 126, in _handle_response
ERROR cinder.volume.api raise exc.from_response(resp, resp.content)
ERROR cinder.volume.api HTTPForbidden: 403 Forbidden: Access was denied to this resource.: Attribute 'os_glance_importing_to_stores' is reserved. (HTTP 403)
ERROR cinder.volume.api
INFO cinder.api.openstack.wsgi [req-321adb05-189b-49f9-aa54-62432ee25907 917f4ddabf954b92b84babc613f0292d a69fdf3fa6654adcb8de23c803df6712 - f9f86f7344e942a5a66cec801aa60dbe f9f86f7344e942a5a66cec801aa60dbe] HTTP exception thrown: 403 Forbidden: Access was denied to this resource.: Attribute 'os_glance_importing_to_stores' is reserved. (HTTP 403)
INFO cinder.api.openstack.wsgi [req-321adb05-189b-49f9-aa54-62432ee25907 917f4ddabf954b92b84babc613f0292d a69fdf3fa6654adcb8de23c803df6712 - f9f86f7344e942a5a66cec801aa60dbe f9f86f7344e942a5a66cec801aa60dbe] http://cinder.service.stage.ewcs.ch/v2/a69fdf3fa6654adcb8de23c803df6712/volumes/16a09728-a1d9-4032-88a4-16a32536f481/action returned with HTTP 400

This issue is known by Nova and was fixed in Nova with:
https://github.com/openstack/nova/commit/dda179d3f901e4f23091f3095f1af58bc26e222e

It looks like the issue is still unknown in cinder?

Howto reproduce:
1. Install devstack stable/wallaby
2. Change glance to enable multistore:
#####################
*** /etc/glance/glance-api.conf.org 2021-09-29 16:39:41.813610795 +0200
--- /etc/glance/glance-api.conf 2021-09-29 16:40:23.397360914 +0200
*************** image_cache_dir = /opt/stack/data/glance
*** 11,16 ****
--- 11,20 ----
use_syslog = False
debug = True

+ enabled_backends = az1:file, az2:file
+ show_multiple_locations = True
+ show_image_direct_url = True
+
[database]
connection = mysql+pymysql://xxxxxxxxx:xyzxyz@127.0.0.1/glance?charset=utf8

*************** auth_type = password
*** 35,42 ****
--- 39,58 ----
[oslo_messaging_notifications]
driver = messagingv2

+ [os_glance_staging_store]
+ filesystem_store_datadir = /opt/stack/data/glance//os_glance_staging_store
+
+ [os_glance_tasks_store]
+ filesystem_store_datadir = /opt/stack/data/glance/os_glance_tasks_store
+
[glance_store]
+ default_backend = az1
+
+ [az1]
filesystem_store_datadir = /opt/stack/data/glance/images/

+ [az2]
+ filesystem_store_datadir = /opt/stack/data/glance/images2/
+
[cors]
allowed_origin = http://172.16.0.6
#######################

mkdir /opt/stack/data/glance/images2
mkdir /opt/stack/data/glance/os_glance_tasks_store
mkdir /opt/stack/data/glance/os_glance_staging_store

systemctl restart <email address hidden>

3. Copy image to second store:
glance image-import --stores az2 --import-method copy-image $(openstack image show cirros-0.5.2-x86_64-disk -c id -f value)

4. Create a volume from an image:
openstack volume create --size 1 --image cirros-0.5.2-x86_64-disk testvol

5. Try to upload that volume to glance:
openstack image create --volume testvol --disk-format raw image-from-vol-from-image --debug

This will result in a 403:
HTTP 403 Forbidden: Access was denied to this resource.: Attribute 'os_glance_failed_import' is reserved. (HTTP 400)

Fix: Best would be to not store os_glance* properties with a volume but we should also remove those properties when a volume is uploaded to glance.

============
SRU TEMPLATE
============

[Impact]

The issue impacts workflows when downloading an image from glance and then uploading it back to glance, because of the extra metadata. The easy workaround is to manually delete the metadata for every image downloaded from glance prior to uploading the volumes. The fix changed code only on the upload-volume-to-image API to not submit the metadata back. Additionally, the behavior can be controlled through a config option.

[TestCase]

1. Setting up env
1a. Deploy an environment with more than 1 store for glance, such as ceph + swift
1b. Upload cirros image to glance
1c. Add the cirros image to swift store

glance image-import <image-id> --stores swift --import-method copy-image

1d. List images including store to confirm

glance image-list --include-store

1e. Create a volume using the image

openstack volume create --size 1 --image <image-id/name> testvol

1f. Confirm the "os_glance..." image metadata is in the volume

openstack volume show testvol

2. Reproducing the issue

openstack image create --volume testvol --disk-format raw image-from-vol-from-image

Result should be:

HTTP 403 Forbidden: Access was denied to this resource.: Attribute 'os_glance_importing_to_stores' is reserved. (HTTP 400)

3. Cleanup not needed

4. Install package that contains the fixed code

5. Adjust cinder.conf as a workaround to issue in comment #21

glance_core_properties = checksum, container_format, disk_format, image_name, image_id, min_disk, min_ram, name, size, os_glance_failed_import,os_glance_importing_to_stores

6. Restart cinder services if needed

7. Repeat command in (2), result should now succeed.

[Regression Potential]

Fix has been tested in the Upstream Cinder CI (not specific scenario) and through unit tests. Behavior is configurable through config option. In case the code for the upload-volume-to-image API breaks, then there is no other way to upload a volume to an image.

See original description

Tags:

Related branches

~rodrigo-barbieri2010/ubuntu/+source/cinder:lp1945500_yoga

Merged into ~ubuntu-openstack-dev/ubuntu/+source/cinder:stable/yoga at revision 1ce0c0275136ab9508611b0f47da09fb399c0c94

Corey Bryant: Pending requested 2023-03-14

~rodrigo-barbieri2010/ubuntu/+source/cinder:lp1945500_zed

Merged into ~ubuntu-openstack-dev/ubuntu/+source/cinder:stable/zed at revision cd5730f22692586d03e754ba130a178fbaaad887

Corey Bryant: Pending requested 2023-03-14

CVE References

2023-2088

Florian Engelmann (engelmann) on 2021-09-29

description:

updated

Revision history for this message

Florian Engelmann (engelmann) wrote on 2021-10-04:

Could anybody please confirm this is a bug?

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-10-06: Fix proposed to cinder (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/cinder/+/812685

Changed in cinder:
status:	New → In Progress

Revision history for this message

Sofia Enriquez (lsofia-enriquez) wrote on 2021-10-06: Re: filter reserved image properties

Greetings,
Do you mind sharing the next information:
- backends you are using for cinder and for glance
- c-vol logs with the erros.
Thanks in advance.

Changed in cinder:
importance:	Undecided → Medium
status:	In Progress → Incomplete

Sofia Enriquez (lsofia-enriquez) on 2021-10-06

summary:

- filter reserved image properties
+ [stable/wallaby] filter reserved image properties

OpenStack Infra (hudson-openstack) on 2021-10-06

Changed in cinder:
status:	Incomplete → In Progress

Sofia Enriquez (lsofia-enriquez) on 2021-11-02

summary:	- [stable/wallaby] filter reserved image properties + It's not possible to upload a volume that was build from an image back + to glance, if multistore (glance) is enabled.
tags:	added: glance image multistore upload-to-image

Revision history for this message

Thobias Trevisan (thobiastrevisan) wrote on 2022-03-17: Re: It's not possible to upload a volume that was build from an image back to glance, if multistore (glance) is enabled.

Hi, I am facing same issue. Version: Ubuntu focal and Openstack Xena.

Dan Hill (hillpd) on 2022-04-11

tags:

added: sts

Revision history for this message

李亚冲 (879228763-6) wrote on 2022-06-28 (last edit on 2022-06-28):

bugs report: (in my view)

step 1: create a image, and upload the image by "web-download" method. in glance code, it will add two property "os_glance_failed_import" and "os_glance_importing_to_stores".

step 2: in glance code , it will execute /v2/images.py and os_glance_import_task(), I guess it a sign, to sign a import-image task status. and it can force clean "the last task" and reimport image. whatever,I don't care it anymore

step 3: so, when I use a web-download method to upload a image , it will contains property "os_glance_failed_import" and "os_glance_failed_import". if create a volume by this image, It is also included in the volume_image_metadata property of the volume.

step 4: If i use "os-volume_upload_image" action of cinder, in cinder code. "os_glance_failed_import" and "os_glance_failed_import" will be param and rejected by glance, that's so bad.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-02-01: Fix merged to cinder (master)

Reviewed: https://review.opendev.org/c/openstack/cinder/+/812685
Committed: https://opendev.org/openstack/cinder/commit/c43fb490b204aadf41a32bcb5eb075b1656e2af4
Submitter: "Zuul (22348)"
Branch: master

commit c43fb490b204aadf41a32bcb5eb075b1656e2af4
Author: Rafael Weingärtner <email address hidden>
Date: Wed Oct 6 10:57:00 2021 -0300

Filter reserved image properties

    Cinder is currently not able to upload a volume that is based on an
    image back to glance. This bug is triggered if glance multistore is
    enabled (devstack in this example).

    When enabling multistore, the following properties will be stored in Cinder:
    * os_glance_failed_import=''
    * os_glance_importing_to_stores=''

    Those properties will cause problems when Cinder tries to perform some
    actions with Glance. Error msg:
    ```
    cinderclient.exceptions.BadRequest: HTTP 403 Forbidden: Access was denied to this resource.: Attribute 'os_glance_failed_import' is reserved. (HTTP 400)
    ```

Nova had the same issue and solved it with:
https://github.com/openstack/nova/blob/50fdbc752a9ca9c31488140ef2997ed59d861a41/releasenotes/notes/absolutely-non-inheritable-image-properties-85f7f304fdc20b61.yaml

and

https://github.com/openstack/nova/commit/dda179d3f901e4f23091f3095f1af58bc26e222e

Therefore, this patch is intended to apply a similar solution in Cinder.

Change-Id: I79d70543856c01a45e2d8c083ab8df6b9c047ebc
Closes-Bug: #1945500

Changed in cinder:
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-02-02: Fix proposed to cinder (stable/zed)

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/cinder/+/872581

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-02-08: Fix merged to cinder (stable/zed)

Reviewed: https://review.opendev.org/c/openstack/cinder/+/872581
Committed: https://opendev.org/openstack/cinder/commit/826b40281123d700b3aeba5dcf076544982973a3
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 826b40281123d700b3aeba5dcf076544982973a3
Author: Rafael Weingärtner <email address hidden>
Date: Wed Oct 6 10:57:00 2021 -0300

Filter reserved image properties

    Cinder is currently not able to upload a volume that is based on an
    image back to glance. This bug is triggered if glance multistore is
    enabled (devstack in this example).

    When enabling multistore, the following properties will be stored in Cinder:
    * os_glance_failed_import=''
    * os_glance_importing_to_stores=''

and

https://github.com/openstack/nova/commit/dda179d3f901e4f23091f3095f1af58bc26e222e

Therefore, this patch is intended to apply a similar solution in Cinder.

    Change-Id: I79d70543856c01a45e2d8c083ab8df6b9c047ebc
    Closes-Bug: #1945500
    (cherry picked from commit c43fb490b204aadf41a32bcb5eb075b1656e2af4)

tags:

added: in-stable-zed

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-02-09: Fix proposed to cinder (stable/yoga)

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/cinder/+/873145

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-02-20:

#10

Fix proposed to branch: stable/yoga
Review: https://review.opendev.org/c/openstack/cinder/+/874428

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-02-20: Change abandoned on cinder (stable/yoga)

#11

Change abandoned by "Rodrigo Barbieri <email address hidden>" on branch: stable/yoga
Review: https://review.opendev.org/c/openstack/cinder/+/874428

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-02-23: Fix merged to cinder (stable/yoga)

#12

Reviewed: https://review.opendev.org/c/openstack/cinder/+/873145
Committed: https://opendev.org/openstack/cinder/commit/f2faf7d70f5cd3ace461d9de9fdfe448d78a0107
Submitter: "Zuul (22348)"
Branch: stable/yoga

commit f2faf7d70f5cd3ace461d9de9fdfe448d78a0107
Author: Rafael Weingärtner <email address hidden>
Date: Wed Oct 6 10:57:00 2021 -0300

Filter reserved image properties

    Cinder is currently not able to upload a volume that is based on an
    image back to glance. This bug is triggered if glance multistore is
    enabled (devstack in this example).

    When enabling multistore, the following properties will be stored in Cinder:
    * os_glance_failed_import=''
    * os_glance_importing_to_stores=''

and

https://github.com/openstack/nova/commit/dda179d3f901e4f23091f3095f1af58bc26e222e

Therefore, this patch is intended to apply a similar solution in Cinder.

    Change-Id: I79d70543856c01a45e2d8c083ab8df6b9c047ebc
    Closes-Bug: #1945500
    (cherry picked from commit c43fb490b204aadf41a32bcb5eb075b1656e2af4)
    (cherry picked from commit 826b40281123d700b3aeba5dcf076544982973a3)
    Conflicts: cinder/image/image_utils.py
       - Changed syntax from "dict[str, str]" to "Dict[str, str]" for
         Python <3.8 compatibility

tags:

added: in-stable-yoga

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-02-23: Fix proposed to cinder (stable/xena)

#13

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/cinder/+/874831

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-03-08: Fix included in openstack/cinder 22.0.0.0rc1

#14

This issue was fixed in the openstack/cinder 22.0.0.0rc1 release candidate.

Rodrigo Barbieri (rodrigo-barbieri2010) on 2023-03-13

summary:	- It's not possible to upload a volume that was build from an image back - to glance, if multistore (glance) is enabled. + [SRU] It's not possible to upload a volume that was build from an image + back to glance, if multistore (glance) is enabled.
description:	updated

Rodrigo Barbieri (rodrigo-barbieri2010) on 2023-03-14

tags:

added: sts-sru-needed

Corey Bryant (corey.bryant) on 2023-03-21

Changed in cloud-archive:
status:	New → Fix Released
Changed in cinder (Ubuntu):
status:	New → Fix Released
Changed in cinder (Ubuntu Jammy):
importance:	Undecided → High
Changed in cinder (Ubuntu Kinetic):
importance:	Undecided → High
status:	New → Triaged
Changed in cinder (Ubuntu Jammy):
status:	New → Triaged

Revision history for this message

Corey Bryant (corey.bryant) wrote on 2023-03-21:

#15

Uploaded to kinetic and jammy unapproved:
https://launchpad.net/ubuntu/kinetic/+queue?queue_state=1&queue_text=cinder
https://launchpad.net/ubuntu/jammy/+queue?queue_state=1&queue_text=cinder

Revision history for this message

Robie Basak (racb) wrote on 2023-04-05: Please test proposed package

#16

Hello Florian, or anyone else affected,

Accepted cinder into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cinder/2:21.1.0-0ubuntu2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in cinder (Ubuntu Kinetic):
status:	Triaged → Fix Committed
tags:	added: verification-needed verification-needed-kinetic
Changed in cinder (Ubuntu Jammy):
status:	Triaged → Fix Committed
tags:	added: verification-needed-jammy

Revision history for this message

Robie Basak (racb) wrote on 2023-04-05:

#17

Hello Florian, or anyone else affected,

Accepted cinder into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cinder/2:20.1.0-0ubuntu2 in a few hours, and then in the -proposed repository.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message

Corey Bryant (corey.bryant) wrote on 2023-04-10:

#18

Hello Florian, or anyone else affected,

Accepted cinder into zed-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

sudo add-apt-repository cloud-archive:zed-proposed
sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-zed-needed to verification-zed-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-zed-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

tags:

added: verification-zed-needed

Revision history for this message

Corey Bryant (corey.bryant) wrote on 2023-04-10:

#19

Hello Florian, or anyone else affected,

Accepted cinder into yoga-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

sudo add-apt-repository cloud-archive:yoga-proposed
sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-yoga-needed to verification-yoga-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-yoga-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

tags:

added: verification-yoga-needed

Revision history for this message

Rodrigo Barbieri (rodrigo-barbieri2010) wrote on 2023-04-12:

#20

I will be performing verification on this soon

Revision history for this message

Rodrigo Barbieri (rodrigo-barbieri2010) wrote on 2023-04-13 (last edit on 2023-04-13):

#21

Validation failed. The fix did not work. See example below:

[{'container_format': 'bare', 'disk_format': 'raw', 'name': 'image-from-vol-from-image', 'visibility': 'private', 'protected': False, 'properties': {'owner_specified.openstack.object': 'images/cirros2', 'os_glance_importing_to_stores': '', 'signature_verified': 'False', 'os_glance_failed_import': '', 'architecture': 'x86_64', 'owner_specified.openstack.sha256': '', 'owner_specified.openstack.md5': ''}}]

was filtered using the reserved name spaces [['os_glance', 'img_signature']], and the result is

The algorithm is:

for k, v in metadata.items():
____if any(k.startswith(reserved_name_space)
________for reserved_name_space in reserved_name_spaces):
______continue
____new_metadata[k] = v

LOG.debug("The metadata set [%s] was filtered using the reserved name "
"spaces [%s], and the result is [%s].", metadata,
reserved_name_spaces, new_metadata)

The os_glance properties are not filtered because they are under "properties" dict property. The bug will have to be reopened and reworked.

Brian Rosmaita (brian-rosmaita) on 2023-04-13

Changed in cinder:
status:	Fix Released → Triaged

Rodrigo Barbieri (rodrigo-barbieri2010) on 2023-04-14

tags:

added: verification-failed verification-failed-jammy verification-failed-kinetic verification-yoga-failed verification-zed-failed
removed: verification-needed verification-needed-jammy verification-needed-kinetic verification-yoga-needed verification-zed-needed

Revision history for this message

Rodrigo Barbieri (rodrigo-barbieri2010) wrote on 2023-04-28 (last edit on 2023-04-28):

#22

After a brief conversation with Brian Rosmaita over IRC that pointed me towards [1], I found out that tweaking the config option "glance_core_properties" to:

glance_core_properties = checksum, container_format, disk_format, image_name, image_id, min_disk, min_ram, name, size, os_glance_failed_import,os_glance_importing_to_stores

enables the fix to work, as a workaround. This is because at [1] the function is separating glance's properties into "core properties" at the base level, and "custom properties" inside a dict named "properties", there this "properties" dict gets overlooked by the fix logic which only goes through the base dict level that only includes the "core properties".

[1] https://opendev.org/openstack/cinder/src/commit/c0133da5914bfcdbc48270860d5941f33531a05a/cinder/volume/api.py#L1432

Revision history for this message

Rodrigo Barbieri (rodrigo-barbieri2010) wrote on 2023-04-28:

#23

As per the workaround described above, we will proceed with the SRU, I will adjust the template and perform validation again

tags:

added: verification-needed verification-needed-jammy verification-needed-kinetic verification-yoga-needed verification-zed-needed
removed: verification-failed verification-failed-jammy verification-failed-kinetic verification-yoga-failed verification-zed-failed

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-05-02: Fix included in openstack/cinder 21.2.0

#24

This issue was fixed in the openstack/cinder 21.2.0 release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-05-02: Fix included in openstack/cinder 20.2.0

#25

This issue was fixed in the openstack/cinder 20.2.0 release.

Rodrigo Barbieri (rodrigo-barbieri2010) on 2023-05-02

description:

updated

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-05-02: Fix proposed to cinder (master)

#26

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/cinder/+/882087

Changed in cinder:
status:	Triaged → In Progress

Revision history for this message

Rodrigo Barbieri (rodrigo-barbieri2010) wrote on 2023-05-03:

#27

I have another update that will flip things over with regards to the SRU (again).

I performed validation for jammy-yoga following the update SRU template, therefore applying the config option change after upgrading the package with the original failed fix, following my previous understanding from reading the code that the original failed fix enabled this config option workaround. This worked fine.

However, I proceeded to validate jammy-zed, but I decided to apply the config option change before the upgrade package and retry the image-create command, just to test. To my surprise, it worked. I performed lots of testing following this and concluded that the config option would have worked from the start and not need the original fix in the first place.

Therefore, I am once again aborting this SRU because the original failed fix as it is it is not adding anything useful, and the workaround works without it.

Talking to Brian Rosmaita a few minutes ago and sharing the new findings we agreed that the new fix is still very desirable so to "do things correctly" and avoid having to do this config option workaround approach that is not ideal.

For SRU purposes, the new fix will eventually be included in a point release SRU and no longer need a specific SRU for this. So, again, aborting this SRU.

Rodrigo Barbieri (rodrigo-barbieri2010) on 2023-05-08

tags:

Revision history for this message

Launchpad Janitor (janitor) wrote on 2023-05-11:

#28

This bug was fixed in the package cinder - 2:20.1.0-0ubuntu2.1

---------------
cinder (2:20.1.0-0ubuntu2.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access
    - debian/patches/CVE-2023-2088.patch: Reject unsafe delete
      attachment calls.
    - CVE-2023-2088

-- Corey Bryant <email address hidden> Thu, 04 May 2023 15:55:29 +0200

Changed in cinder (Ubuntu Jammy):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2023-05-11:

#29

This bug was fixed in the package cinder - 2:21.1.0-0ubuntu2.1

---------------
cinder (2:21.1.0-0ubuntu2.1) kinetic-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access
    - debian/patches/CVE-2023-2088.patch: Reject unsafe delete
      attachment calls.
    - CVE-2023-2088

-- Corey Bryant <email address hidden> Thu, 04 May 2023 15:30:12 +0200

Changed in cinder (Ubuntu Kinetic):
status:	Fix Committed → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-06-02: Fix merged to cinder (master)

#30

Reviewed: https://review.opendev.org/c/openstack/cinder/+/882087
Committed: https://opendev.org/openstack/cinder/commit/b3d3f31fa325533cf8130533e955ef43b8f38189
Submitter: "Zuul (22348)"
Branch: master

commit b3d3f31fa325533cf8130533e955ef43b8f38189
Author: Rodrigo Barbieri <email address hidden>
Date: Tue May 2 13:28:31 2023 -0300

Fix glance metadata properties filtering

    Previous patch I79d70543856c01a45e2d8c083ab8df6b9c047ebc
    implemented filtering of glance "os_glance..." metadata
    but its logic overlooked the fact that the glance metadata
    to be filtered are actually in a "properties" sub-dict
    as adjusted by the "_merge_volume_image_meta" method in
    cinder/volume/api.py.

This patch re-invokes the filtering loop on
the "properties" sub-dict when it is present.

New unit test covers filtering in both cases.

Closes-bug: #1945500
Change-Id: I06b8c363c4017adfa1ad134ad7a8a0954c005e62

Changed in cinder:
status:	In Progress → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-06-05: Fix proposed to cinder (stable/zed)

#31

Fix proposed to branch: stable/zed
Review: https://review.opendev.org/c/openstack/cinder/+/885255

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-06-05: Fix proposed to cinder (stable/2023.1)

#32

Fix proposed to branch: stable/2023.1
Review: https://review.opendev.org/c/openstack/cinder/+/885256

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-06-07: Fix merged to cinder (stable/2023.1)

#33

Reviewed: https://review.opendev.org/c/openstack/cinder/+/885256
Committed: https://opendev.org/openstack/cinder/commit/f542dd07b07162f39325a83fae67cda166e36798
Submitter: "Zuul (22348)"
Branch: stable/2023.1

commit f542dd07b07162f39325a83fae67cda166e36798
Author: Rodrigo Barbieri <email address hidden>
Date: Tue May 2 13:28:31 2023 -0300

Fix glance metadata properties filtering

This patch re-invokes the filtering loop on
the "properties" sub-dict when it is present.

New unit test covers filtering in both cases.

    Closes-bug: #1945500
    Change-Id: I06b8c363c4017adfa1ad134ad7a8a0954c005e62
    (cherry picked from commit b3d3f31fa325533cf8130533e955ef43b8f38189)

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2023-06-10: Fix merged to cinder (stable/zed)

#34

Reviewed: https://review.opendev.org/c/openstack/cinder/+/885255
Committed: https://opendev.org/openstack/cinder/commit/7dad93bff14c8966d81ea164f1c400b02747e1db
Submitter: "Zuul (22348)"
Branch: stable/zed

commit 7dad93bff14c8966d81ea164f1c400b02747e1db
Author: Rodrigo Barbieri <email address hidden>
Date: Tue May 2 13:28:31 2023 -0300

Fix glance metadata properties filtering

This patch re-invokes the filtering loop on
the "properties" sub-dict when it is present.

New unit test covers filtering in both cases.

    Closes-bug: #1945500
    Change-Id: I06b8c363c4017adfa1ad134ad7a8a0954c005e62
    (cherry picked from commit b3d3f31fa325533cf8130533e955ef43b8f38189)
    (cherry picked from commit f542dd07b07162f39325a83fae67cda166e36798)