Security Guide - Networking services - Incorrect Information

[N Dillon]

From: https://bugs.launchpad.net/neutron/+bug/1274034

"I believe the assertion is that Neutron's flat networking implementation does not provide layer 2 filtering guarantees between tenants on the same broadcast domain, unlike Nova's"

This section in the security guide is incorrect, and is giving security assurance where there is none.
-----------------------------------
Built: 2015-05-16T15:34:41 00:00
git SHA: c42cf46862483b5e7dc4a83bd8540c05b26dface
URL: http://docs.openstack.org/security-guide/content/networking-services.html

[Joseph Robinson (joseph-r-email)]

So to confirm - Two tenants on the same broadcasting domain, on layer 2, don't have filtering guarantees with the neutron services without the new patch described in bug 1274034 (https://bugs.launchpad.net/neutron/+bug/1274034). Their is potential for man in the middle attacks in it's current description of security. The docs need the information on setting up filtering and separation in multi-tenant platforms?

[N Dillon (sicarie)]

Joseph, yes, the gap needs to be documented in the Networking chapter, and then guidance should be given around how to set up that isolation.

[Edgar Magana (emagana)]

I will do my best to help!

[N Dillon (sicarie)]

Thanks Edgar! Have you been able to take a look at this at all? If we can identify sections that are or are not current I think that would help focus people who might be able to help.

[Rahul U Nair (rahulunair)]

As the security guide is discussing about this in https://docs.openstack.org/security-guide/networking/services-security-best-practices.html , I don't think this should be open. If any further details have to be added, a feature request or wish list bug can be opened.