Currently any dhcp agent instance will work as an open resolver. For
deployments using publicly routed addresses for tenant networks, this
allows the agent being abused in dDoS attacks, see [1].
By setting the `--local-service` option dnsmasq will filter DNS queries
and reply only to queries from directly attached networks.
Reviewed: https:/ /review. openstack. org/633207 /git.openstack. org/cgit/ openstack/ neutron/ commit/ ?id=a7afd6e86d8 33ea44fc1752815 8e6819618d07f7
Committed: https:/
Submitter: Zuul
Branch: stable/rocky
commit a7afd6e86d833ea 44fc17528158e68 19618d07f7
Author: Jens Harbott <email address hidden>
Date: Mon Oct 29 17:08:33 2018 +0000
Secure dnsmasq process against external abuse
Currently any dhcp agent instance will work as an open resolver. For
deployments using publicly routed addresses for tenant networks, this
allows the agent being abused in dDoS attacks, see [1].
By setting the `--local-service` option dnsmasq will filter DNS queries
and reply only to queries from directly attached networks.
[1] https:/ /bugs.launchpad .net/neutron/ +bug/1501206
Conflicts:
neutron/ cmd/sanity_ check.py
Closes-Bug: 1501206 15a88bd79896301 2fa0efca74e cfb8327a86d7225 e2c3972263)
Change-Id: I76d810aad2ce0f
(cherry picked from commit 0fce3ca2c1641fb