ovsfw ignores port_ranges under some conditions

[IWAMOTO Toshihiro]

ovsfw ignores port_ranges when protocol is not literal udp or tcp.
sctp and numeric protocol values don't work and result in too permissive filtering.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/490753

[Tristan Cacqueray (tristan-cacqueray)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

Back in Mitaka, OVS was an experimental security groups driver. Is it deemed production ready in Newton ?

[IWAMOTO Toshihiro (iwamoto)]

Not sure if this is a security advisory item.
If it is, bug/1708358 needs to be handled so, too.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/490753
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=effa12889ba3393ec22d9a44e21cf00768643730
Submitter: Jenkins
Branch: master

commit effa12889ba3393ec22d9a44e21cf00768643730
Author: IWAMOTO Toshihiro <email address hidden>
Date: Fri Aug 4 15:20:08 2017 +0900

    ovsfw: Fix port_ranges handling

    ovsfw ignored port_ranges when a SG rule protocol was sctp or given
    in a number rather than a token. This commit fixes that.

    Change-Id: I6c810a152990246d42d98c3673c4b5ee126ebb4b
    Closes-bug: #1708580

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/501948

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/501948
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=6d43f2b1ad0f15992364cda3a0c691de5768dfd2
Submitter: Jenkins
Branch: stable/pike

commit 6d43f2b1ad0f15992364cda3a0c691de5768dfd2
Author: IWAMOTO Toshihiro <email address hidden>
Date: Fri Aug 4 15:20:08 2017 +0900

    ovsfw: Fix port_ranges handling

    ovsfw ignored port_ranges when a SG rule protocol was sctp or given
    in a number rather than a token. This commit fixes that.

    Change-Id: I6c810a152990246d42d98c3673c4b5ee126ebb4b
    Closes-bug: #1708580
    (cherry picked from commit effa12889ba3393ec22d9a44e21cf00768643730)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 11.0.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 12.0.0.0b1 development milestone.

[Tristan Cacqueray (tristan-cacqueray)]

I suggest closing the OSSA task because of class D ( https://security.openstack.org/vmt-process.html#incident-report-taxonomy )

[IWAMOTO Toshihiro (iwamoto)]

Is there a definition of a vulnerability?
There have been a couple of security groups OSSAs. To me, it is not clear what amounts to a OSSA or note.

[Tristan Cacqueray (tristan-cacqueray)]

IWAMOTO, I guess you could use this definition: https://cve.mitre.org/about/terminology.html#vulnerability

Then regarding the OSSA task, we don't issue advisories for experimental feature, and if I understand correctly, ovsfw is still experimental/incomplete. Thus if it's not a class D, then it is at best a class B3.

I have created an OSSN task to discuss the scope of this bug, perhaps it could use a security note.

[IWAMOTO Toshihiro (iwamoto)]

Hi Tristan,

I tend to think the ovsfw is experimental but the releasenote doesn't have any "experimental" wording.

Added the ovsfw author to the bug subscribers list.

[Jeremy Stanley (fungi)]

Fixes merged so long ago that no vulnerable branches are still supported, so I've marked our security advisory task Won't Fix indicating publication of any advisory at this point is highly unlikely.