yahoo-eng-team team mailing list archive

[Jeremy Stanley <1736674@xxxxxxxxxxxxxxxxxx>]

Treating this as a security hardening opportunity, no advisory needed.

** Changed in: ossa
       Status: New => Won't Fix

** Information type changed from Public Security to Public

** Tags added: security

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1736674

Title:
  sg rules are sometimes not applied

Status in neutron:
  Fix Released
Status in OpenStack Security Advisory:
  Won't Fix

Bug description:
  Failure of negative test in gate:

  http://logs.openstack.org/19/523319/5/check/neutron-tempest-plugin-
  scenario-linuxbridge/47b85c6/job-
  output.txt.gz#_2017-12-01_23_09_02_843619

  Reproducing locally with a debug patch, I see that iptables_manager
  first applies the correct rules and then removes them again
  immediately after that, see http://paste.openstack.org/show/628245/

  Steps to reproduce (taken from
  neutron_tempest_plugin.scenario.test_security_groups.NetworkDefaultSecGroupTest.test_ip_prefix_negative,
  possibly not minimal):

  - create two security groups
  - add ssh access to first, icmp access to second one
  - create an instance with these two security groups applied
  - run iptables-save and discover no rules applied to the instance

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1736674/+subscriptions