OpenStack Security Notes

Bug #1155566
Comment #10

Comment 10 for bug 1155566

Revision history for this message

Jason Hullinger (jason-hullinger) wrote on 2013-04-04: Re: [Bug 1155566] Re: Note: Keystone Request / Header Size Limits Required to Avoid DoS

#10

Seems about right

On Apr 4, 2013, at 10:45 AM, "Robert Clark" <email address hidden> wrote:

> Requests with large POST body can crash Pre-Grizzly Keystone or underlying services.
> -----
>
> ### Summary ###
> Concurrent Keystone POST requests with large body messages are held in memory without filtering or rate limiting, this can lead to resource exhaustion on the Keystone server.
>
> ### Affected Services / Software ###
> Keystone, Databases
>
> ### Discussion ###
> Keystone stores POST messages in memory before validation, concurrent submission of multiple large POST messages can cause the Keystone process to be killed due to memory exhaustion, resulting in a remote Denial of Service.
>
> In many cases Keystone will be deployed behind a load-balancer or proxy
> that can rate limit POST messages inbound to Keystone. Grizzly is
> protected against that through the sizelimit middleware.
>
> ### Recommended Actions ###
> If you are in a situation where Keystone is directly exposed to incoming POST messages and not protected by the sizelimit middleware there are a number of load-balancing/proxy options, we suggest you consider one of the following:
>
> Nginx [Need info, one line with link is fine]
> Apache [Need info, one line with link is fine]
> [Other Options]
>
> ### Contacts / References ###
>
> --
> You received this bug notification because you are a member of OpenStack
> Security Group, which is subscribed to a duplicate bug report (1098177).
> https://bugs.launchpad.net/bugs/1155566
>
> Title:
> Note: Keystone Request / Header Size Limits Required to Avoid DoS
>
> Status in OpenStack Security Notes:
> Confirmed
>
> Bug description:
> Requests with large POST body can crash Keystone or underlying services.
> -----
>
> ### Summary ###
> Concurrent Keystone POST requests with large body messages are held in memory without filtering or rate limiting, this can lead to resource exhaustion on the Keystone server.
>
> ### Affected Services / Software ###
> Keystone, Databases
>
> ### Discussion ###
>
> ### Recommended Actions ###
>
> ### Contacts / References ###
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/osn/+bug/1155566/+subscriptions

Seems about right

On Apr 4, 2013, at 10:45 AM, "Robert Clark" <1155566@bugs.launchpad.net> wrote:

> Requests with large POST body can crash Pre-Grizzly Keystone or underlying services.
> -----
> 
> ### Summary ###
> Concurrent Keystone POST requests with large body messages are held in memory without filtering or rate limiting, this can lead to resource exhaustion on the Keystone server.
> 
> ### Affected Services / Software ###
> Keystone, Databases
> 
> ### Discussion ###
> Keystone stores POST messages in memory before validation, concurrent submission of multiple large POST messages can cause the Keystone process to be killed due to memory exhaustion, resulting in a remote Denial of Service.
> 
> In many cases Keystone will be deployed behind a load-balancer or proxy
> that can rate limit POST messages inbound to Keystone. Grizzly is
> protected against that through the sizelimit middleware.
> 
> ### Recommended Actions ###
> If you are in a situation where Keystone is directly exposed to incoming POST messages and not protected by the sizelimit middleware there are a number of load-balancing/proxy options, we suggest you consider one of the following:
> 
> Nginx [Need info, one line with link is fine]
> Apache [Need info, one line with link is fine]
> [Other Options]
> 
> ### Contacts / References ###
> 
> -- 
> You received this bug notification because you are a member of OpenStack
> Security Group, which is subscribed to a duplicate bug report (1098177).
> https://bugs.launchpad.net/bugs/1155566
> 
> Title:
>  Note: Keystone Request / Header Size Limits Required to Avoid DoS
> 
> Status in OpenStack Security Notes:
>  Confirmed
> 
> Bug description:
>  Requests with large POST body can crash Keystone or underlying services.
>  -----
> 
>  ### Summary ###
>  Concurrent Keystone POST requests with large body messages are held in memory without filtering or rate limiting, this can lead to resource exhaustion on the Keystone server.
> 
>  ### Affected Services / Software ###
>  Keystone, Databases
> 
>  ### Discussion ###
> 
>  ### Recommended Actions ###
> 
>  ### Contacts / References ###
> 
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/osn/+bug/1155566/+subscriptions