yahoo-eng-team team mailing list archive

[Ian Kumlien <1749667@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

We have had problems with openvswitch agent continuously restarting and
never actually completing setup because of this:

# Completed by iptables_manager
; Stdout: ; Stderr: iptables-restore v1.4.21: multiport only works with TCP, UDP, UDPLITE, SCTP and DCCP
Error occurred at line: 83
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

    83. -I neutron-openvswi-<id> 69 -s <ip> -p 112 -m multiport --dports 1:65535 -j RETURN
---

Someone has managed to inject a rule that is, effectively, a DoS.

** Affects: neutron
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1749667

Title:
  neutron doesn't correctly handle unknown protocols and should
  whitelist known and handled protocols

Status in neutron:
  New

Bug description:
  We have had problems with openvswitch agent continuously restarting
  and never actually completing setup because of this:

  # Completed by iptables_manager
  ; Stdout: ; Stderr: iptables-restore v1.4.21: multiport only works with TCP, UDP, UDPLITE, SCTP and DCCP
  Error occurred at line: 83
  Try `iptables-restore -h' or 'iptables-restore --help' for more information.

      83. -I neutron-openvswi-<id> 69 -s <ip> -p 112 -m multiport --dports 1:65535 -j RETURN
  ---

  Someone has managed to inject a rule that is, effectively, a DoS.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1749667/+subscriptions