neutron

  1. Bug #1749667
  2. Comment #0

Comment 0 for bug 1749667

Revision history for this message
Ian Kumlien (pomac) wrote : neutron doesn't correctly handle unknown protocols and should whitelist known and handled protocols

We have had problems with openvswitch agent continuously restarting and never actually completing setup because of this:

# Completed by iptables_manager
; Stdout: ; Stderr: iptables-restore v1.4.21: multiport only works with TCP, UDP, UDPLITE, SCTP and DCCP
Error occurred at line: 83
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

    83. -I neutron-openvswi-<id> 69 -s <ip> -p 112 -m multiport --dports 1:65535 -j RETURN
---

Someone has managed to inject a rule that is, effectively, a DoS.