TripleO does not correctly disable IPv6 autoconfiguration and RAs

[Dan Sneddon]

TripleO Heat Templates include sysctl settings for IPv6 that are supposed to disable autoconfiguration and accepting route advertisements (RAs). The current sysctl settings only affect the default configuration, but are overridden by the settings in net.ipv6.conf.all.

Current settings:
           net.ipv6.conf.default.accept_ra:
             value: 0
           net.ipv6.conf.default.autoconf:
             value: 0

Due to this issue, autoconf and accept_ra are enabled for every interface, even if IPV6_AUTOCONF=no in the ifcfg file.

In order to make the ifcfg files work with this setting, the following sysctl settings need to be added to puppet/services/kernel.yaml:

New settings:
+ net.ipv6.conf.all.autoconf:
+ value: 0
+ net.ipv6.conf.all.accept_ra:
+ value: 0

Without these settings, the nodes are vulnerable to traffic interception via rogue Route Advertisements.

[Dan Sneddon (dsneddon)]

This bug affects os-net-config in that without these sysctl settings, the value for IPV6AUTOCONF=no in the ifcfg files is ignored.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/385603
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=4eacf4179d03cd2102cac4abf14e80eae440c2d3
Submitter: Jenkins
Branch: master

commit 4eacf4179d03cd2102cac4abf14e80eae440c2d3
Author: Dan Sneddon <email address hidden>
Date: Wed Oct 12 12:38:21 2016 -0700

    Disable IPv6 RAs & Autoconf For All (Not Just Default)

    The current kernel sysctl settings modify the
    net.ipv6.conf.default.accept_ra and net.ipv6.conf.default.autoconf
    to both be '0'. However, this is overridden by the settings in
    net.ipv6.conf.all, so no matter what setting is in the ifcfg file
    for the IPv6 interface, autoconfiguration and accept_ra will be
    enabled. This causes a security vulnerability where rogue RAs
    could be used to intercept traffic from the controllers.

    This change sets both default and all settings to '0' for IPv6
    accept_ra and autoconf.

    Closes-Bug: 1632830
    Change-Id: I95b86c5c6feed30dfa5103ffbddb9e85ac567bbb

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/386201

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/386201
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=b5d94be6d1d4e05296ea0d57aaf9a66de5711ab5
Submitter: Jenkins
Branch: stable/newton

commit b5d94be6d1d4e05296ea0d57aaf9a66de5711ab5
Author: Dan Sneddon <email address hidden>
Date: Wed Oct 12 12:38:21 2016 -0700

    Disable IPv6 RAs & Autoconf For All (Not Just Default)

    The current kernel sysctl settings modify the
    net.ipv6.conf.default.accept_ra and net.ipv6.conf.default.autoconf
    to both be '0'. However, this is overridden by the settings in
    net.ipv6.conf.all, so no matter what setting is in the ifcfg file
    for the IPv6 interface, autoconfiguration and accept_ra will be
    enabled. This causes a security vulnerability where rogue RAs
    could be used to intercept traffic from the controllers.

    This change sets both default and all settings to '0' for IPv6
    accept_ra and autoconf.

    Closes-Bug: 1632830
    Change-Id: I95b86c5c6feed30dfa5103ffbddb9e85ac567bbb
    (cherry picked from commit 4eacf4179d03cd2102cac4abf14e80eae440c2d3)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 5.0.0.0rc3 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 5.0.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 6.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/399808

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/399808
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=dada49ad8160729384ea4ac68bb66c7752c3c732
Submitter: Jenkins
Branch: stable/mitaka

commit dada49ad8160729384ea4ac68bb66c7752c3c732
Author: Dan Sneddon <email address hidden>
Date: Wed Oct 12 12:38:21 2016 -0700

    Disable IPv6 RAs & Autoconf For All (Not Just Default)

    The current kernel sysctl settings modify the
    net.ipv6.conf.default.accept_ra and net.ipv6.conf.default.autoconf
    to both be '0'. However, this is overridden by the settings in
    net.ipv6.conf.all, so no matter what setting is in the ifcfg file
    for the IPv6 interface, autoconfiguration and accept_ra will be
    enabled. This causes a security vulnerability where rogue RAs
    could be used to intercept traffic from the controllers.

    This change sets both default and all settings to '0' for IPv6
    accept_ra and autoconf.

    Closes-Bug: 1632830
    Change-Id: I95b86c5c6feed30dfa5103ffbddb9e85ac567bbb

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 2.2.0 release.