This bug was fixed in the package neutron - 2:10.0.7-0ubuntu1~cloud1
---------------
neutron (2:10.0.7-0ubuntu1~cloud1) xenial-ocata; urgency=medium
.
* Backport security-group multiport iptables rule fix (LP: #1749667)
- d/p/Only-allow-SG-port-ranges-for-whitelisted-protocols.patch
** Changed in: cloud-archive/ocata
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1749667
Title:
[SRU] neutron doesn't correctly handle unknown protocols and should
whitelist known and handled protocols
Status in Ubuntu Cloud Archive:
Fix Released
Status in Ubuntu Cloud Archive ocata series:
Fix Released
Status in neutron:
Fix Released
Bug description:
[Impact]
Neutron allowed users to create security group rules that would translate to
invalid iptables rules thus causing neutron to fail when it attempted to apply
them. This is now fixed for >= Pike and we are backporting for Ocata.
[Test Case]
* deploy openstack ocata
* create an invalid security group rule e.g.
openstack security group rule create --protocol gre --dst-port 0:255
jmclane
* check that request is rejected with e.g.
Error while executing command: BadRequestException: Unknown error,
{"NeutronError": {"message": "Invalid protocol 47 for port range, only
supported for TCP, UDP,
UDPLITE│·········································································································
, SCTP and DCCP.", "type": "SecurityGroupInvalidProtocolForPortRange",
"detail": ""}}
[Regression Potential]
Upgrading to this patch will reject new api requests that try to create
invalid rules but will not cleanup invalid rules already extant.
Note also that the backported ocata patch is unchanged from pike.
-----------------------------------------------------------------------------
We have had problems with openvswitch agent continuously restarting
and never actually completing setup because of this:
# Completed by iptables_manager
; Stdout: ; Stderr: iptables-restore v1.4.21: multiport only works with TCP,
UDP, UDPLITE, SCTP and DCCP
Error occurred at line: 83
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
83. -I neutron-openvswi-<id> 69 -s <ip> -p 112 -m multiport --dports
1:65535 -j RETURN
---
Someone has managed to inject a rule that is, effectively, a DoS.
To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1749667/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : [email protected]
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
