[Bug 1749667] Re: [SRU] neutron doesn't correctly handle unknown protocols and should whitelist known and handled protocols

[Corey Bryant]

** Description changed:

  [Impact]
  Neutron allowed users to create security group rules that would translate to invalid iptables rules thus causing neutron to fail when it attempted to apply them. This is now fixed for >= Pike and we are backporting for Ocata.
  
  [Test Case]
-   * deploy openstack ocata
-   * create an invalid security group rule e.g.
+   * deploy openstack ocata
+   * create an invalid security group rule e.g.
  
  openstack security group rule create --protocol gre --dst-port 0:255
  jmclane
  
-   * check that request is rejected with e.g.
+   * check that request is rejected with e.g.
  
  Error while executing command: BadRequestException: Unknown error, {"NeutronError": {"message": "Invalid protocol 47 for port range, only supported for TCP, UDP, UDPLITE│·········································································································
  , SCTP and DCCP.", "type": "SecurityGroupInvalidProtocolForPortRange", "detail": ""}}
  
- [Regression Potential] 
+ [Regression Potential]
  Upgrading to this patch will reject new api requests that try to create invalid rules but will not cleanup invalid rules already extant.
-  
+ 
+ Note also that the backported ocata patch is unchanged from pike.
+ 
  -----------------------------------------------------------------------------
  
  We have had problems with openvswitch agent continuously restarting and
  never actually completing setup because of this:
  
  # Completed by iptables_manager
  ; Stdout: ; Stderr: iptables-restore v1.4.21: multiport only works with TCP, UDP, UDPLITE, SCTP and DCCP
  Error occurred at line: 83
  Try `iptables-restore -h' or 'iptables-restore --help' for more information.
  
      83. -I neutron-openvswi-<id> 69 -s <ip> -p 112 -m multiport --dports 1:65535 -j RETURN
  ---
  
  Someone has managed to inject a rule that is, effectively, a DoS.

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1749667

Title:
  [SRU] neutron doesn't correctly handle unknown protocols and should
  whitelist known and handled protocols

Status in Ubuntu Cloud Archive:
  Fix Released
Status in Ubuntu Cloud Archive ocata series:
  Triaged
Status in neutron:
  Fix Released

Bug description:
  [Impact]
  Neutron allowed users to create security group rules that would translate to invalid iptables rules thus causing neutron to fail when it attempted to apply them. This is now fixed for >= Pike and we are backporting for Ocata.

  [Test Case]
    * deploy openstack ocata
    * create an invalid security group rule e.g.

  openstack security group rule create --protocol gre --dst-port 0:255
  jmclane

    * check that request is rejected with e.g.

  Error while executing command: BadRequestException: Unknown error, {"NeutronError": {"message": "Invalid protocol 47 for port range, only supported for TCP, UDP, UDPLITE│·········································································································
  , SCTP and DCCP.", "type": "SecurityGroupInvalidProtocolForPortRange", "detail": ""}}

  [Regression Potential]
  Upgrading to this patch will reject new api requests that try to create invalid rules but will not cleanup invalid rules already extant.

  Note also that the backported ocata patch is unchanged from pike.

  -----------------------------------------------------------------------------

  We have had problems with openvswitch agent continuously restarting
  and never actually completing setup because of this:

  # Completed by iptables_manager
  ; Stdout: ; Stderr: iptables-restore v1.4.21: multiport only works with TCP, UDP, UDPLITE, SCTP and DCCP
  Error occurred at line: 83
  Try `iptables-restore -h' or 'iptables-restore --help' for more information.

      83. -I neutron-openvswi-<id> 69 -s <ip> -p 112 -m multiport --dports 1:65535 -j RETURN
  ---

  Someone has managed to inject a rule that is, effectively, a DoS.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1749667/+subscriptions