commit 767cea23de44a963c6793ffe30ea5c6827d27a38
Author: Kevin Benton <email address hidden>
Date: Tue Aug 25 22:03:27 2015 -0700
Stop device_owner from being set to 'network:*'
This patch adjusts the FieldCheck class in the policy engine to
allow a regex rule. It then leverages that to prevent users from
setting the device_owner field to anything that starts with
'network:' on networks which they do not own.
This policy adjustment is necessary because any ports with a
device_owner that starts with 'network:' will not have any security
group rules applied because it is assumed they are trusted network
devices (e.g. router ports, DHCP ports, etc). These security rules
include the anti-spoofing protection for DHCP, IPv6 ICMP messages,
and IP headers.
Without this policy adjustment, tenants can abuse this trust when
connected to a shared network with other tenants by setting their
VM port's device_owner field to 'network:<anything>' and hijack other
tenants' traffic via DHCP spoofing or MAC/IP spoofing.
Closes-Bug: #1489111
Change-Id: Ia64cf16142e0e4be44b5b0ed72c8e00792d770f9
(cherry picked from commit 959a2f28cbbfc309381ea9ffb55090da6fb9c78f)
Reviewed: https:/ /review. openstack. org/221344 /git.openstack. org/cgit/ openstack/ neutron/ commit/ ?id=767cea23de4 4a963c6793ffe30 ea5c6827d27a38
Committed: https:/
Submitter: Jenkins
Branch: stable/kilo
commit 767cea23de44a96 3c6793ffe30ea5c 6827d27a38
Author: Kevin Benton <email address hidden>
Date: Tue Aug 25 22:03:27 2015 -0700
Stop device_owner from being set to 'network:*'
This patch adjusts the FieldCheck class in the policy engine to
allow a regex rule. It then leverages that to prevent users from
setting the device_owner field to anything that starts with
'network:' on networks which they do not own.
This policy adjustment is necessary because any ports with a
device_owner that starts with 'network:' will not have any security
group rules applied because it is assumed they are trusted network
devices (e.g. router ports, DHCP ports, etc). These security rules
include the anti-spoofing protection for DHCP, IPv6 ICMP messages,
and IP headers.
Without this policy adjustment, tenants can abuse this trust when <anything> ' and hijack other
connected to a shared network with other tenants by setting their
VM port's device_owner field to 'network:
tenants' traffic via DHCP spoofing or MAC/IP spoofing.
Closes-Bug: #1489111 be44b5b0ed72c8e 00792d770f9 9381ea9ffb55090 da6fb9c78f)
Change-Id: Ia64cf16142e0e4
(cherry picked from commit 959a2f28cbbfc30