[OSSA 2014-019] IPv6 prefix shouldn't be added in the NAT table (CVE-2014-4167)

[Baodong (Robert) Li]

SNAT rules with IPv6 prefixes are added into the NAT table, which causes failure with the call to iptables-restore:

Stderr: "iptables-restore v1.4.18: invalid mask `64' specified\nError occurred at line: 22\nTry `iptables-restore -h' or 'iptables-restore --help' for more information.\n"

[Openstack Gerrit (openstack-gerrit)]

Fix proposed to branch: master
Review: https://review.openstack.org/88584

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/95938

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/havana
Review: https://review.openstack.org/95939

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/88584
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=d23bc8fa6e2d8a735a2aa75224b1bc96a3b992f5
Submitter: Jenkins
Branch: master

commit d23bc8fa6e2d8a735a2aa75224b1bc96a3b992f5
Author: Baodong Li <email address hidden>
Date: Thu Apr 24 01:47:13 2014 +0000

    Install SNAT rules for ipv4 only

    Change-Id: I37bd770aa0d54a985ac2bec708c571785084e0ec
    Closes-Bug: #1309195

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/95939
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=e5fed4812633b0e7cbcb4107b6dc04710e007edf
Submitter: Jenkins
Branch: stable/havana

commit e5fed4812633b0e7cbcb4107b6dc04710e007edf
Author: Baodong Li <email address hidden>
Date: Thu Apr 24 01:47:13 2014 +0000

    Install SNAT rules for ipv4 only

    Change-Id: I37bd770aa0d54a985ac2bec708c571785084e0ec
    Closes-Bug: #1309195
    (cherry picked from commit d23bc8fa6e2d8a735a2aa75224b1bc96a3b992f5)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/95938
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=28a26dbfd7e95ad84e8c9eeac1e5aba0b111a16c
Submitter: Jenkins
Branch: stable/icehouse

commit 28a26dbfd7e95ad84e8c9eeac1e5aba0b111a16c
Author: Baodong Li <email address hidden>
Date: Thu Apr 24 01:47:13 2014 +0000

    Install SNAT rules for ipv4 only

    Change-Id: I37bd770aa0d54a985ac2bec708c571785084e0ec
    Closes-Bug: #1309195
    (cherry picked from commit d23bc8fa6e2d8a735a2aa75224b1bc96a3b992f5)

[Tristan Cacqueray (tristan-cacqueray)]

A couple of questions:
* The L3-agent was introduced with Havana, not before right ?
* I assumed the only way to fix a broken deployment is to manually remove the faulty network directly from the database. The former bug report mentioned it was not possible to remove it using "neutron net-delete" but it didn't not provide a way out of this...

Here is the impact description draft #1:

Title: Neutron L3-agent DoS through IPv6 subnet
Reporter: Thiago Martins (HP)
Products: Neutron
Versions: 2013.2 to 2013.2.3, and 2014.1

Description:
Thiago Martins from Hewlett Packard reported a vulnerability in Neutron L3-agent. By creating an IPv6 private subnet attached to a L3 router, an authenticated user may break the L3-agent, preventing further floating IPv4 from being attached for the entire cloud. Note: removal of the faulty network can not be done using the API and must be cleaned at the database level. Only Neutron setups using IPv6 and L3-agent are affected.

[Grant Murphy (gmurphy)]

Impact description looks ok to me. Maybe don't include the note until issuing the advisory?

[Jeremy Stanley (fungi)]

Maybe say "further floating IPv4 addresses" to be a little clearer, but otherwise the draft impact description in comment #7 looks good to me.

[Thierry Carrez (ttx)]

Tristan: quantum/agent/l3_agent.py exists in Grizzly and seem to have code looking like the affected code.
Otherwise with fungi's suggestions, impact desc looks good.

[Tristan Cacqueray (tristan-cacqueray)]

Thanks for the comments,
* @grant, we used to keep such notes in impact description, so leaving it here
* @ttx, I updated the affected versions to include Grizzly

here is the impact description draft #2:

Title: Neutron L3-agent DoS through IPv6 subnet
Reporter: Thiago Martins (HP)
Products: Neutron
Versions: up to 2013.2.3, and 2014.1

Description:
Thiago Martins from Hewlett Packard reported a vulnerability in Neutron L3-agent. By creating an IPv6 private subnet attached to a L3 router, an authenticated user may break the L3-agent, preventing further floating IPv4 address from being attached for the entire cloud. Note: removal of the faulty network can not be done using the API and must be cleaned at the database level. Only Neutron setups using IPv6 and L3-agent are affected.

[Tristan Cacqueray (tristan-cacqueray)]

Oups, didn't get the whole fungi's correction.

here is the impact description draft #3:

Title: Neutron L3-agent DoS through IPv6 subnet
Reporter: Thiago Martins (HP)
Products: Neutron
Versions: up to 2013.2.3, and 2014.1

Description:
Thiago Martins from Hewlett Packard reported a vulnerability in Neutron L3-agent. By creating an IPv6 private subnet attached to a L3 router, an authenticated user may break the L3-agent, preventing further floating IPv4 addresses from being attached for the entire cloud. Note: removal of the faulty network can not be done using the API and must be cleaned at the database level. Only Neutron setups using IPv6 and L3-agent are affected.

[Thierry Carrez (ttx)]

+1 for #3