yahoo-eng-team team mailing list archive

[Erik Olof Gunnar Andersson <eandersson@xxxxxxxxxxxx>]

Public bug reported:

This command should be invalid, but Neutron (Rocky) allows it to be created. 
> openstack security group rule create xxx --protocol vrrp --ingress --remote-ip <ip> --dst-port 112

Since iptables does not allow dst-port being passed. It would trigger the following error on the compute.
> unknown option "--dport"

I would have created this as a security vulnerability, but it's already
been mentioned on IRC.

** Affects: neutron
     Importance: Undecided
         Status: New

** Description changed:

- This command should be invalid, but Neutron (Rocky) allows it to be created. Since iptables does not allow dst-port being passed.
+ This command should be invalid, but Neutron (Rocky) allows it to be created. 
  > openstack security group rule create xxx --protocol vrrp --ingress --remote-ip <ip> --dst-port 112
  
- It would trigger the following error on the compute site.
+ Since iptables does not allow dst-port being passed. It would trigger the following error on the compute.
  > unknown option "--dport"
  
- I would create this as a security vulnerability, but it's already been
- mentioned on IRC.
+ I would have created this as a security vulnerability, but it's already
+ been mentioned on IRC.

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1818385

Title:
  It's possible to add a security group rule for VRRP with a dport

Status in neutron:
  New

Bug description:
  This command should be invalid, but Neutron (Rocky) allows it to be created. 
  > openstack security group rule create xxx --protocol vrrp --ingress --remote-ip <ip> --dst-port 112

  Since iptables does not allow dst-port being passed. It would trigger the following error on the compute.
  > unknown option "--dport"

  I would have created this as a security vulnerability, but it's
  already been mentioned on IRC.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1818385/+subscriptions