VIP reservation follow-ups (LOW, keel#102 review) #103

New issue

Open

opened 2026-10-08 20:34:54 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-08 20:34:54 -03:00

(Migrated from github.com)

From the security re-review of keel#102 (READY), all LOW:

L1 commands.py:231: a node without an etcd member reserves nothing; collision rests on two random draws in a /112 (about 1 in 65,535 per concurrent pair). Document in docs/mesh.md.
L2 validate_overlay.py:131: subnet_of(vips) misses allowed_ips wider than the range (<prefix>::/64, ::/0). Use overlaps or warn.
L3 vipreserve.py:12-16, :123: the signed value has no expiry or nonce, and members may write the prefix without a lease, so the 24 h limit is not enforced; loads accepts the same member twice. Require two distinct members; correct the docs.
L4 vippair.py:170: signed_before_range uses any member's /112; the old rule was every member's. Use all.
L5 vippromote.py:181: unpair checks only this node's spec and can free a VIP the other member still uses; a failed kept (line 166) lets the lease lapse. reserve should also refuse when holder keys or the pair's role exist.

From the security re-review of keel#102 (READY), all LOW: - L1 commands.py:231: a node without an etcd member reserves nothing; collision rests on two random draws in a /112 (about 1 in 65,535 per concurrent pair). Document in docs/mesh.md. - L2 validate_overlay.py:131: `subnet_of(vips)` misses allowed_ips wider than the range (`<prefix>::/64`, `::/0`). Use `overlaps` or warn. - L3 vipreserve.py:12-16, :123: the signed value has no expiry or nonce, and members may write the prefix without a lease, so the 24 h limit is not enforced; `loads` accepts the same member twice. Require two distinct members; correct the docs. - L4 vippair.py:170: `signed_before_range` uses `any` member's /112; the old rule was every member's. Use `all`. - L5 vippromote.py:181: `unpair` checks only this node's spec and can free a VIP the other member still uses; a failed `kept` (line 166) lets the lease lapse. `reserve` should also refuse when holder keys or the pair's role exist.