security: block vendor.send_raw (CVE-2026-54423)

A recent security report highlighted issues with the ability
to invoke the ipmitool vendor pass-thru interface method
of ``send_raw``.

Where in the step model, this becomes "$interface_name"."$method_name",
hence, "vendor.send_raw".

This patch disables the method because standalone operators
do not have the Role Based Access Control model to fallback
on in order to prevent misuse of the interface. While the
interface may still be useful, this disables the ability for
standard API users to invoke the method by default.

Related-Bug: 2150458
Change-Id: I1f88315346ff19a4fcde34f954350b32cf02f96c
Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com>
Signed-off-by: Jay Faulkner <jay@jvf.cc>

Author: juliakreger

ironic/conf/api.py

@@ -195,15 +195,15 @@ def __call__(self, value):
                        'Each middleware must be a callable that accepts a '
                        'WSGI application and returns a wrapped application.')),
     cfg.ListOpt('disallow_deploy_steps',
-                default=[],
+                default=['vendor.send_raw'],
                 mutable=True,
                 help=_("List of steps not allowed across the deploy "
                        "workflow. Each entry should be in 'interface.step' "
                        "format, e.g. ['raid.apply_configuration']. "
                        "Applies to user-requested steps, deploy template "
                        "steps, and driver steps alike.")),
     cfg.ListOpt('disallow_service_steps',
-                default=[],
+                default=['vendor.send_raw'],
                 mutable=True,
                 help=_("List of steps not allowed across the service "
                        "workflow. Each entry should be in 'interface.step' "
@@ -212,7 +212,7 @@ def __call__(self, value):
                        "Applies to user-requested steps and driver steps "
                        "alike.")),
     cfg.ListOpt('disallow_clean_steps',
-                default=[],
+                default=['vendor.send_raw'],
                 mutable=True,
                 help=_("List of steps not allowed across the clean "
                        "workflow. Each entry should be in 'interface.step' "

ironic/tests/unit/conductor/test_manager.py

@@ -2176,6 +2176,30 @@ def test_do_node_deploy_disallowed_step_raises(self, mock_start,
         node.refresh()
         self.assertEqual(states.AVAILABLE, node.provision_state)
 
+    @mock.patch.object(deployments, 'start_deploy', autospec=True)
+    def test_do_node_deploy_disallowed_step_raises_send_raw(
+            self, mock_start, mock_iwdi):
+        mock_iwdi.return_value = False
+        self._start_service()
+        deploy_steps = [
+            {'step': 'send_raw',
+             'priority': 7,
+             'interface': 'vendor'}
+        ]
+        node = obj_utils.create_test_node(
+            self.context, driver='fake-hardware',
+            provision_state=states.AVAILABLE,
+            target_provision_state=states.NOSTATE)
+        exc = self.assertRaises(messaging.rpc.ExpectedException,
+                                self.service.do_node_deploy,
+                                self.context, node.uuid,
+                                deploy_steps=deploy_steps)
+        self.assertEqual(exception.StepNotAllowed, exc.exc_info[0])
+        # start_deploy must NOT have been called
+        self.assertFalse(mock_start.called)
+        node.refresh()
+        self.assertEqual(states.AVAILABLE, node.provision_state)
+
     @mock.patch.object(deployments, 'start_deploy', autospec=True)
     def test_do_node_deploy_allowed_step_proceeds(self, mock_start,
                                                   mock_iwdi):
@@ -3535,6 +3559,36 @@ def test_do_node_clean_disallowed_step_raises(self, mock_power_valid,
         # Node stays in original state
         self.assertEqual(states.MANAGEABLE, node.provision_state)
 
+    @mock.patch('ironic.conductor.task_manager.TaskManager.process_event',
+                autospec=True)
+    @mock.patch('ironic.drivers.modules.network.flat.FlatNetwork.validate',
+                autospec=True)
+    @mock.patch('ironic.drivers.modules.fake.FakePower.validate',
+                autospec=True)
+    def test_do_node_clean_disallowed_step_raises_send_raw(
+            self, mock_power_valid,
+            mock_network_valid,
+            mock_process):
+        node = obj_utils.create_test_node(
+            self.context, driver='fake-hardware',
+            provision_state=states.MANAGEABLE,
+            target_provision_state=states.NOSTATE)
+        self._start_service()
+        clean_steps = [
+            {'step': 'send_raw',
+             'priority': 7,
+             'interface': 'vendor'}
+        ]
+        exc = self.assertRaises(messaging.rpc.ExpectedException,
+                                self.service.do_node_clean,
+                                self.context, node.uuid, clean_steps)
+        self.assertEqual(exception.StepNotAllowed, exc.exc_info[0])
+        # process_event must NOT have been called
+        self.assertFalse(mock_process.called)
+        node.refresh()
+        # Node stays in original state
+        self.assertEqual(states.MANAGEABLE, node.provision_state)
+
     @mock.patch('ironic.conductor.task_manager.TaskManager.process_event',
                 autospec=True)
     @mock.patch('ironic.drivers.modules.network.flat.FlatNetwork.validate',
@@ -3750,15 +3804,19 @@ def test_do_node_service(self, mock_pv, mock_nv, mock_event):
             target_provision_state=states.NOSTATE)
         self._start_service()
         self.service.do_node_service(self.context,
-                                     node.uuid, {'foo': 'bar'})
+                                     node.uuid,
+                                     [{'step': 'foo',
+                                       'priority': 7,
+                                       'interface': 'management'}])
         self.assertTrue(mock_pv.called)
         self.assertTrue(mock_nv.called)
         mock_event.assert_called_once_with(
             mock.ANY,
             'service',
             callback=mock.ANY,
             call_args=(servicing.do_node_service, mock.ANY,
-                       {'foo': 'bar'}, False),
+                       [{'step': 'foo', 'priority': 7,
+                         'interface': 'management'}], False),
             err_handler=mock.ANY, target_state='active')
 
     @mock.patch('ironic.conductor.manager.ConductorManager._spawn_worker',
@@ -3805,6 +3863,33 @@ def test_do_node_service_disallowed_step_raises(self, mock_pv, mock_nv,
         node.refresh()
         self.assertEqual(states.ACTIVE, node.provision_state)
 
+    @mock.patch('ironic.conductor.task_manager.TaskManager.process_event',
+                autospec=True)
+    @mock.patch('ironic.drivers.modules.network.flat.FlatNetwork.validate',
+                autospec=True)
+    @mock.patch('ironic.drivers.modules.fake.FakePower.validate',
+                autospec=True)
+    def test_do_node_service_disallowed_step_raises_on_send_raw(
+            self, mock_pv, mock_nv,
+            mock_event):
+        node = obj_utils.create_test_node(
+            self.context, driver='fake-hardware',
+            provision_state=states.ACTIVE,
+            target_provision_state=states.NOSTATE)
+        self._start_service()
+        service_steps = [
+            {'step': 'send_raw',
+             'priority': 7,
+             'interface': 'vendor'}
+        ]
+        exc = self.assertRaises(messaging.rpc.ExpectedException,
+                                self.service.do_node_service,
+                                self.context, node.uuid, service_steps)
+        self.assertEqual(exception.StepNotAllowed, exc.exc_info[0])
+        self.assertFalse(mock_event.called)
+        node.refresh()
+        self.assertEqual(states.ACTIVE, node.provision_state)
+
     @mock.patch('ironic.conductor.task_manager.TaskManager.process_event',
                 autospec=True)
     @mock.patch('ironic.drivers.modules.network.flat.FlatNetwork.validate',

releasenotes/notes/disable_send_raw-f92217bf07c3eb38.yaml

@@ -0,0 +1,20 @@
+---
+security:
+  - |
+    The IPMI Vendor-Passthru interface method ``send_raw`` step has been
+    disabled by default due to security implications. A malicious user with
+    sufficient Ironic access could utilzie this interface to make manual
+    changes to BMCs when the ``ipmitool`` vendor-passthru interface was
+    enabled.
+fixes:
+  - |
+    Fixes a bug where ironic allowed the ability for operators to send
+    raw commands when the ``ipmitool`` vendor interface was enabled
+    and configured for a baremetal node utilizing the IPMI protocol.
+
+    The Ironic project generally recommends the use of ``redfish``
+    instead of IPMI, however recognizes that is not universally possible
+    for all operators.
+
+    More information can be found in `bug 2150458
+    <https://bugs.launchpad.net/ironic/+bug/2150458>`_.