Well, since the odl-restconf feature includes both draft and RFC8040 API, I believe this bug is effectively a security hole with a non trivial workaround even for the draft users (e.g. repack the restconf feature to skip RFC8040).
So my suggest is to skip Aluminium SR2 official release. Other TSC (or not TSC) opinions?
On Jan 28, 2021, at 10:33 AM, Venkatrangan Govindarajan < gvrangan@...> wrote:
The problem occurs if the RFC8040 is used
curl http://127.0.0.1:8181/rests/data/network-topology:network-topology -v * Trying 127.0.0.1... * Connected to 127.0.0.1 (127.0.0.1) port 8181 (#0) > GET /rests/data/network-topology:network-topology HTTP/1.1 > Host: 127.0.0.1:8181> User-Agent: curl/7.47.0 > Accept: */* > < HTTP/1.1 200 OK < ETag: "2013-10-21-network-topology" < Last-Modified: 2021-Jan-28 18:31:25 < Content-Type: application/yang-data+json < Content-Length: 133 < * Connection #0 to host 127.0.0.1 left intact {"network-topology:net
It does not require authorization. The issue seems to be recreated. வியா., 28 ஜன., 2021, பிற்பகல் 11:46 அன்று, Daniel de la Rosa < ddelarosa0707@...> எழுதியது: Thanks Oleksii... IMHO, this issue is not a show stopper for Aluminium SR2 but please confirm
Hello everyone,
This issue is related only to the RFC8040 implementation of the RESTconf, so you have to use a proper endpoint for the testing, for example:
The thing is that {apiRoot}/restconf is managed by a different web initializer and doesn't have such an issue.
From: release@... <release@...> on behalf of Venkatrangan Govindarajan <gvrangan@...>
Sent: Thursday, January 28, 2021 8:01:59 PM
To: Luis Gomez
Cc: Daniel de la Rosa; THOUENON Gilles TGI/OLN; integration-dev@...; Anil Belur; Casey Cain; Jordan Conway; LAMBERT Guillaume TGI/OLN; Release; Robert Varga; TSC; Transportpce-dev@...
Subject: Re: [integration-dev] [OpenDaylight TSC] [opendaylight-dev][release] OpenDaylight - Aluminium SR2 release status
Just downloaded SR2 and installed some project that uses topology model and executed this...
******************
************
The GET seems to require authorization. Also used wrong password which was also blocked.
வியா., 28 ஜன., 2021, பிற்பகல் 10:53 அன்று, Luis Gomez < ecelgp@...> எழுதியது:
It seems like we have to stop the Aluminium SR2 release after hearing the authentication issue from Robert.
Thank you all.. @Luis Gomez please proceed with distribution at your earliest convenience
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
--
Venkatrangan Govindarajan
( When there is no wind...Row )
-- Venkatrangan Govindarajan
( When there is no wind...Row )
|
