openstack
/
ironic
Code Issues Proposed changes
A service for managing and provisioning Bare Metal servers.
9,593 Commits 19 Branches 56 Tags 296 MiB
Python 98.2%
Shell 1.8%
Go to file
Julia Kreger 25cc871450 Block ability update callback_url 
A malicious user with:

* API access normally reserved for the provisioning,
  cleaning, rescue networks.
* Insight about a node, such as a MAC address, or baremetal node
  UUID.
* Insight into the state of the node, such as the access provided
  to Compute API users, or other Bare Metal API users.

Can submit an erroneous ``heartbeat`` to the ironic-api endpoint
with a ``callback_url`` that is not of the actual intended agent.
This can potentially cause a rescue, cleaning, or deployment
operation to be derailed, or at worst commands to be sent to
to an endpoint the malicious user controls.

Story: 2006773
Task: 37295
Change-Id: I1a5e3c2b34d45c06fb74e82d0f30735ce9041914
(cherry picked from commit 931c125982)
 		2019-12-16 22:17:22 +00:00
api-ref Merge "Add api-ref for allocation update" 2019-06-07 14:11:35 +00:00
devstack CI: limit rescue testing to only two jobs 2019-10-24 01:01:26 +00:00
doc Improve iDrac Documentation 2019-10-30 15:00:38 -04:00
etc Remove sample policy and config files 2018-02-02 11:21:29 +00:00
ironic Block ability update callback_url 2019-12-16 22:17:22 +00:00
playbooks CI: stop using pyghmi from git master 2019-07-29 17:52:49 +02:00
releasenotes Block ability update callback_url 2019-12-16 22:17:22 +00:00
tools Use HTTPProxyToWSGI middleware from oslo 2019-08-02 12:29:37 +00:00
zuul.d CI: limit rescue testing to only two jobs 2019-10-24 01:01:26 +00:00
.gitignore Migrate to stestr as unit tests runner 2017-09-22 08:56:34 +00:00
.gitreview Update .gitreview for stable/train 2019-09-25 08:43:29 +00:00
.mailmap Update mailmap for Joe Gordon 2013-10-28 10:19:15 +00:00
.stestr.conf Migrate to stestr as unit tests runner 2017-09-22 08:56:34 +00:00
CONTRIBUTING.rst Update Launchpad references to Storyboard 2018-04-09 12:37:14 -07:00
LICENSE Added project infrastructure needs. 2013-05-02 14:55:43 -04:00
README.rst Add ironic-specs link to readme.rst 2019-08-30 17:16:09 +08:00
babel.cfg Run extract_messages 2013-07-22 09:51:10 +02:00
bindep.txt Add a pxe/uefi/grub2 CI job 2019-06-05 14:21:13 -07:00
driver-requirements.txt Fixed problem with UEFI iSCSI boot for nic adapters 2019-08-30 08:45:19 +00:00
lower-constraints.txt Build pdf doc 2019-09-06 14:50:02 +08:00
requirements.txt Merge "Support power state change callbacks to nova using ksa_adapter" 2019-08-24 02:20:13 +00:00
setup.cfg Add Redfish inspect interface to idrac HW type 2019-09-17 15:34:54 -04:00
setup.py Updated from global requirements 2017-03-02 11:45:27 +00:00
test-requirements.txt Support power state change callbacks to nova using ksa_adapter 2019-08-12 19:29:57 +02:00
tox.ini Update TOX/UPPER_CONSTRAINTS_FILE for stable/train 2019-09-25 08:43:32 +00:00

README.rst

Ironic

Team and repository tags

image

Overview

Ironic consists of an API and plug-ins for managing and provisioning physical machines in a security-aware and fault-tolerant manner. It can be used with nova as a hypervisor driver, or standalone service using bifrost. By default, it will use PXE and IPMI to interact with bare metal machines. Ironic also supports vendor-specific plug-ins which may implement additional functionality.

Ironic is distributed under the terms of the Apache License, Version 2.0. The full terms and conditions of this license are detailed in the LICENSE file.

Project resources

Project status, bugs, and requests for feature enhancements (RFEs) are tracked in StoryBoard: https://storyboard.openstack.org/#!/project/943

For information on how to contribute to ironic, see https://docs.openstack.org/ironic/latest/contributor