** Also affects: neutron/icehouse
Importance: Undecided
Status: New
** Changed in: neutron/icehouse
Importance: Undecided => High
** Changed in: neutron/icehouse
Status: New => Fix Committed
** Changed in: neutron/icehouse
Milestone: None => 2014.1.3
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1365961
Title:
Dangerous iptables rule generated in case of protocol "any" and
source-port/destination-port usage
Status in OpenStack Neutron (virtual network service):
Fix Committed
Status in neutron icehouse series:
Fix Committed
Status in OpenStack Security Advisories:
Won't Fix
Status in OpenStack Security Notes:
Fix Released
Bug description:
Icehouse 2014.1.2, FWaas using iptables driver
In order to allow DNS (TCP and UDP) request, the following rule was defined:
neutron firewall-rule-create --protocol any --destination-port 53 --action
allow
On L3agent namespace this has been translated in the following iptables rules:
-A neutron-l3-agent-iv441c58eb2 -j ACCEPT
-A neutron-l3-agent-ov441c58eb2 -j ACCEPT
=> there is no restriction on the destination port(53), like we could expect
it !!!
There is 2 solutions to handle this issue:
1) Doesn't allow user to create a rule specifing protocol "any" AND a
source-port/destination-port.
2) Generating the following rules (like some firewalls do):
-A neutron-l3-agent-iv441c58eb2 -p tcp -m tcp --dport 53 -j ACCEPT
-A neutron-l3-agent-iv441c58eb2 -p udp -m udp --dport 53 -j ACCEPT
-A neutron-l3-agent-ov441c58eb2 -p tcp -m tcp --dport 53 -j ACCEPT
-A neutron-l3-agent-ov441c58eb2 -p udp -m udp --dport 53 -j ACCEPT
=> TCP and UDP have been completed.
The source code affected is located in
neutron/services/firewall/drivers/linux/iptables_fwaas.py (L268)
def _port_arg(self, direction, protocol, port):
if not (protocol in ['udp', 'tcp'] and port):
return ''
return '--%s %s' % (direction, port)
=> trunk code is affected too.
Nota: This is not a real Neutron security vulnerability but it is a
real security vulnerability for applications living in the Openstack
cloud... That's why I tagged it as "security vulnerability"
Regards,
To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1365961/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
