)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"04913c11a2f7e730e164d245a29f4031763b9fcd","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-09-10 11:04:13 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Adding OSSN-0027 - Neutron ARP cache poisoning vulnerability."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I57f41b1cd6e0ec06db2a0bf3f5496f28cffc64ed"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"fa98f980_88114406","line":8,"updated":"2014-09-12 04:21:28.000000000","message":"Add \"Closes-bug: #1274034\" so this updates LP properly.","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"}],"security-notes/OSSN-0027":[{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"d57e42fd3b0ef720c00458403b1e7bd2e0b276e6","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"The Neutron firewall driver \u0027iptables_firawall\u0027 does not prevent ARP"},{"line_number":6,"context_line":"cache poisoning. This driver only handles MAC and IP based anti-spoofing"},{"line_number":7,"context_line":"rules."},{"line_number":8,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_3b4ba05a","line":5,"updated":"2014-09-09 16:17:06.000000000","message":"firawall?","commit_id":"a99dfb9efd928e9fb228abe48dc2720056cc3d6e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"d57e42fd3b0ef720c00458403b1e7bd2e0b276e6","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"The Neutron firewall driver \u0027iptables_firawall\u0027 does not prevent ARP"},{"line_number":6,"context_line":"cache poisoning. This driver only handles MAC and IP based anti-spoofing"},{"line_number":7,"context_line":"rules."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"},{"line_number":10,"context_line":"Neutron, Grizzly, Havana, Icehouse, Juno"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_3b900095","line":7,"updated":"2014-09-09 16:17:06.000000000","message":"Maybe add a line in the dicussion to say that this functionality was availible in nova networking and is no longer available in neutron.","commit_id":"a99dfb9efd928e9fb228abe48dc2720056cc3d6e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"d57e42fd3b0ef720c00458403b1e7bd2e0b276e6","unresolved":false,"context_lines":[{"line_number":10,"context_line":"Neutron, Grizzly, Havana, Icehouse, Juno"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"When filtering is handled by Nova the following anti-spoofing rules are"},{"line_number":14,"context_line":"available through the libvirt network filter feature:"},{"line_number":15,"context_line":"- no-mac-spoofing"},{"line_number":16,"context_line":"- no-ip-spoofing"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_bb6dd006","line":13,"updated":"2014-09-09 16:17:06.000000000","message":"How about \u0027in deployments using Nova Networking the following anti-spoofing rules are availible...\u0027","commit_id":"a99dfb9efd928e9fb228abe48dc2720056cc3d6e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"d57e42fd3b0ef720c00458403b1e7bd2e0b276e6","unresolved":false,"context_lines":[{"line_number":18,"context_line":"- nova-no-nd-reflection"},{"line_number":19,"context_line":"- allow-dhcp-server"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"However, the \u0027iptables_firawall\u0027 driver available in Neutron handles"},{"line_number":22,"context_line":"only MAC and IP anti-spoofing rules, leaving it vulnerable to ARP"},{"line_number":23,"context_line":"poisoning based attacks. This feature disparity is a security"},{"line_number":24,"context_line":"vulnerability, especially on networks shared with other tenants or"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_9b4d6c9c","line":21,"updated":"2014-09-09 16:17:06.000000000","message":"\u0027However, in deployments using Neutron, the \u0027iptables_firewall\u0027 driver handles only...\u0027","commit_id":"a99dfb9efd928e9fb228abe48dc2720056cc3d6e"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"d57e42fd3b0ef720c00458403b1e7bd2e0b276e6","unresolved":false,"context_lines":[{"line_number":48,"context_line":"- On VM2 checking the ARP table will show that the MAC address"},{"line_number":49,"context_line":"  associated with the gateway is the MAC address of VM1."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"This technique can be used to cause a denial of service attack if VM"},{"line_number":52,"context_line":"drops packets from VM2 rather than forwarding them on to the gateway."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_f6ae8de6","line":51,"updated":"2014-09-09 16:17:06.000000000","message":"..if VM1 drops packets..","commit_id":"a99dfb9efd928e9fb228abe48dc2720056cc3d6e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Neutron ARP cache poisoning vulnerability."},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_88594437","line":1,"updated":"2014-09-12 04:16:45.000000000","message":"(nit) Take off the period here.","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"The Neutron firewall driver \u0027iptables_firewall\u0027 does not prevent ARP"},{"line_number":6,"context_line":"cache poisoning, the driver is only capable of MAC and IP based"},{"line_number":7,"context_line":"anti-spoofing rules. However, ARP filtering functionality is available"},{"line_number":8,"context_line":"in Nova Networking."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_08455442","line":6,"updated":"2014-09-12 04:16:45.000000000","message":"(nit) Split this into two sentences at the comma.  Maybe change the beginning of the second sentence to \"This driver is...\".\n\nMaybe \"...MAC address and IP address based...\" would be more specific.","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Neutron, Grizzly, Havana, Icehouse, Juno"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"In deployments using Nova Networking the following anti-spoofing rules"},{"line_number":15,"context_line":"are available through the libvirt network filter feature:"},{"line_number":16,"context_line":"- no-mac-spoofing"},{"line_number":17,"context_line":"- no-ip-spoofing"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_88a7840a","line":14,"updated":"2014-09-12 04:16:45.000000000","message":"(nit) Add a comma after \"Networking\".","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"In deployments using Nova Networking the following anti-spoofing rules"},{"line_number":15,"context_line":"are available through the libvirt network filter feature:"},{"line_number":16,"context_line":"- no-mac-spoofing"},{"line_number":17,"context_line":"- no-ip-spoofing"},{"line_number":18,"context_line":"- no-arp-spoofing"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_289cd8bf","line":15,"updated":"2014-09-12 04:16:45.000000000","message":"(nit) Add a blank line before the list here.","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":31,"context_line":"packets designed to manipulate the ARP table of another host on the same"},{"line_number":32,"context_line":"network. This manipulation can be engineered such that the malicious"},{"line_number":33,"context_line":"host will receive trafic from the target host in place of the network"},{"line_number":34,"context_line":"gateway. The malicious host has a number of options once trafic has been"},{"line_number":35,"context_line":"intercepted. It may interrogate it for sensitive information, manipulate"},{"line_number":36,"context_line":"if before passing it on to the real gateway or drop it to create a"},{"line_number":37,"context_line":"denial of service attack. This can be demonstrated as follows:"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_68798081","line":34,"updated":"2014-09-12 04:16:45.000000000","message":"(typo) s/trafic/traffic/","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":33,"context_line":"host will receive trafic from the target host in place of the network"},{"line_number":34,"context_line":"gateway. The malicious host has a number of options once trafic has been"},{"line_number":35,"context_line":"intercepted. It may interrogate it for sensitive information, manipulate"},{"line_number":36,"context_line":"if before passing it on to the real gateway or drop it to create a"},{"line_number":37,"context_line":"denial of service attack. This can be demonstrated as follows:"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"- Create a private network/subnet 10.0.0.0/24"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_a8960892","line":36,"updated":"2014-09-12 04:16:45.000000000","message":"(nit) Add a comma after \"gateway\".","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":39,"context_line":"- Create a private network/subnet 10.0.0.0/24"},{"line_number":40,"context_line":"- Start 2 VMs attached to that private network:"},{"line_number":41,"context_line":"  VM1 IP 10.0.0.3, VM2 IP 10.0.0.4"},{"line_number":42,"context_line":"- Log on to VM1 and install the ettercap tool, see references"},{"line_number":43,"context_line":"- Launch command: \u0027ettercap -T -w dump -M ARP /10.0.0.4/ // output\u0027 on"},{"line_number":44,"context_line":"  VM1 This will cause trafic from VM2 to pass through VM1 before it is"},{"line_number":45,"context_line":"  forwarded on to the gateway."}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_28ea180f","line":42,"updated":"2014-09-12 04:16:45.000000000","message":"(nit) I\u0027d put \"see references\" in parenthesis instead of just using a comma.","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  VM1 IP 10.0.0.3, VM2 IP 10.0.0.4"},{"line_number":42,"context_line":"- Log on to VM1 and install the ettercap tool, see references"},{"line_number":43,"context_line":"- Launch command: \u0027ettercap -T -w dump -M ARP /10.0.0.4/ // output\u0027 on"},{"line_number":44,"context_line":"  VM1 This will cause trafic from VM2 to pass through VM1 before it is"},{"line_number":45,"context_line":"  forwarded on to the gateway."},{"line_number":46,"context_line":"- Log on to VM2 and ping any valid internet site, the ping should"},{"line_number":47,"context_line":"  succeed."}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_48ef5c1e","line":44,"updated":"2014-09-12 04:16:45.000000000","message":"(nit) Add a period after \"VM1\".","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":45,"context_line":"  forwarded on to the gateway."},{"line_number":46,"context_line":"- Log on to VM2 and ping any valid internet site, the ping should"},{"line_number":47,"context_line":"  succeed."},{"line_number":48,"context_line":"- On VM1 the ICMP traffic generated by VM2\u0027s ping will be visible."},{"line_number":49,"context_line":"- On VM2 checking the ARP table will show that the MAC address"},{"line_number":50,"context_line":"  associated with the gateway is the MAC address of VM1."},{"line_number":51,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_c8da6c77","line":48,"updated":"2014-09-12 04:16:45.000000000","message":"(nit) Add a comma after \"VM1\", or even better would be to reorder the sentence:\n\n  \"The ICMP traffic generated by VM2\u0027s ping will be visible on VM1.\"","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":46,"context_line":"- Log on to VM2 and ping any valid internet site, the ping should"},{"line_number":47,"context_line":"  succeed."},{"line_number":48,"context_line":"- On VM1 the ICMP traffic generated by VM2\u0027s ping will be visible."},{"line_number":49,"context_line":"- On VM2 checking the ARP table will show that the MAC address"},{"line_number":50,"context_line":"  associated with the gateway is the MAC address of VM1."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This technique can be used to cause a denial of service attack if VM1"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_08e1d429","line":49,"updated":"2014-09-12 04:16:45.000000000","message":"(nit) Add a comma after \"VM2\", or even better would be to reorder the sentence:\n\n  \"Checking the ARP table on VM2 will show that the MAC address...\"","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Pay close attention to networks where Neutron based VLANs are in use."},{"line_number":57,"context_line":"Install appropriate IDS and traffic monitoring tools with a particular"},{"line_number":58,"context_line":"focus on ARP packet monitoring."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"### Contacts / References ###"},{"line_number":61,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0027"},{"line_number":62,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1274034"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_88cce4bc","line":59,"updated":"2014-09-12 04:16:45.000000000","message":"It\u0027s OK to mention that the Neutron development team plans to address this issue in a future version (and just leave it at that).","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"1bfd9c89d35f8c733a670f60f9c80083a0188554","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"### Contacts / References ###"},{"line_number":61,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0027"},{"line_number":62,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1274034"},{"line_number":63,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":64,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":65,"context_line":"Ettercap: http://ettercap.github.io/ettercap"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_683ee08c","line":62,"updated":"2014-09-12 04:16:45.000000000","message":"This link should be the Neutron bug, not the OSSN bug:\n\n  https://bugs.launchpad.net/neutron/+bug/1274034","commit_id":"96e1a42a374c6283be77d44827cb6f1ff8d0f97e"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"f41e4490a0f0f2751225147ae6df6565ed663acd","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"The Neutron firewall driver \u0027iptables_firewall\u0027 does not prevent ARP"},{"line_number":6,"context_line":"cache poisoning. This driver is only capable of MAC address and IP"},{"line_number":7,"context_line":"address based anti-spoofing rules. However, ARP filtering functionality"},{"line_number":8,"context_line":"is available in Nova Networking."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_d63badce","line":6,"updated":"2014-09-15 16:34:10.000000000","message":"\"... cache poisoning, as this driver is currently only capable...\"?","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"25737b4de57d8b07e73e39a808371ebadcfc5ec7","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"The Neutron firewall driver \u0027iptables_firewall\u0027 does not prevent ARP"},{"line_number":6,"context_line":"cache poisoning. This driver is only capable of MAC address and IP"},{"line_number":7,"context_line":"address based anti-spoofing rules. However, ARP filtering functionality"},{"line_number":8,"context_line":"is available in Nova Networking."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_cca943df","line":6,"in_reply_to":"fa98f980_2a6565ae","updated":"2014-09-16 13:41:46.000000000","message":"Done","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"9ad891c2bfbd14fd4e2bf4c21e9a3bb3497b1781","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"The Neutron firewall driver \u0027iptables_firewall\u0027 does not prevent ARP"},{"line_number":6,"context_line":"cache poisoning. This driver is only capable of MAC address and IP"},{"line_number":7,"context_line":"address based anti-spoofing rules. However, ARP filtering functionality"},{"line_number":8,"context_line":"is available in Nova Networking."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_2a6565ae","line":6,"in_reply_to":"fa98f980_d63badce","updated":"2014-09-15 21:25:40.000000000","message":"Either approach is fine with be here (two sentences as it is now, or one as Jamie has it worded).","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"65d08ab629fbb6ad9a5eed3947d2dd4a2b1ff455","unresolved":false,"context_lines":[{"line_number":5,"context_line":"The Neutron firewall driver \u0027iptables_firewall\u0027 does not prevent ARP"},{"line_number":6,"context_line":"cache poisoning. This driver is only capable of MAC address and IP"},{"line_number":7,"context_line":"address based anti-spoofing rules. However, ARP filtering functionality"},{"line_number":8,"context_line":"is available in Nova Networking."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Grizzly, Havana, Icehouse, Juno"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_5116e749","line":8,"updated":"2014-09-15 17:09:28.000000000","message":"What happens when ARP spoofing rules are specified with the Neutron driver?  Is it a silent no-op?  It might be nice to add a sentence here just for completeness.","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"9ad891c2bfbd14fd4e2bf4c21e9a3bb3497b1781","unresolved":false,"context_lines":[{"line_number":5,"context_line":"The Neutron firewall driver \u0027iptables_firewall\u0027 does not prevent ARP"},{"line_number":6,"context_line":"cache poisoning. This driver is only capable of MAC address and IP"},{"line_number":7,"context_line":"address based anti-spoofing rules. However, ARP filtering functionality"},{"line_number":8,"context_line":"is available in Nova Networking."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Grizzly, Havana, Icehouse, Juno"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_2aa645ab","line":8,"in_reply_to":"fa98f980_5116e749","updated":"2014-09-15 21:25:40.000000000","message":"I don\u0027t think that there is any such configuration that can be shown.  The issue is just that the firewall driver does not prevent against ARP poisoning in it\u0027s underlying rules.  This isn\u0027t exposed via configuration AFAIK.","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"f41e4490a0f0f2751225147ae6df6565ed663acd","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"However, in deployments using Neutron, the \u0027iptables_firewall\u0027 driver"},{"line_number":24,"context_line":"handles only MAC and IP anti-spoofing rules, leaving it vulnerable to"},{"line_number":25,"context_line":"ARP poisoning based attacks. This feature disparity is a security"},{"line_number":26,"context_line":"vulnerability, especially on networks shared with other tenants or"},{"line_number":27,"context_line":"services."},{"line_number":28,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_96076517","line":25,"updated":"2014-09-15 16:34:10.000000000","message":"\"ARP poisoning based attacks\" doesn\u0027t read well to me .. just \"ARP poisoning\", or \"ARP poisoning and associated attacks\"?","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"25737b4de57d8b07e73e39a808371ebadcfc5ec7","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"However, in deployments using Neutron, the \u0027iptables_firewall\u0027 driver"},{"line_number":24,"context_line":"handles only MAC and IP anti-spoofing rules, leaving it vulnerable to"},{"line_number":25,"context_line":"ARP poisoning based attacks. This feature disparity is a security"},{"line_number":26,"context_line":"vulnerability, especially on networks shared with other tenants or"},{"line_number":27,"context_line":"services."},{"line_number":28,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_4c9e33ba","line":25,"in_reply_to":"fa98f980_8ae571dd","updated":"2014-09-16 13:41:46.000000000","message":"Done","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"9ad891c2bfbd14fd4e2bf4c21e9a3bb3497b1781","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"However, in deployments using Neutron, the \u0027iptables_firewall\u0027 driver"},{"line_number":24,"context_line":"handles only MAC and IP anti-spoofing rules, leaving it vulnerable to"},{"line_number":25,"context_line":"ARP poisoning based attacks. This feature disparity is a security"},{"line_number":26,"context_line":"vulnerability, especially on networks shared with other tenants or"},{"line_number":27,"context_line":"services."},{"line_number":28,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_8ae571dd","line":25,"in_reply_to":"fa98f980_96076517","updated":"2014-09-15 21:25:40.000000000","message":"+1","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"f41e4490a0f0f2751225147ae6df6565ed663acd","unresolved":false,"context_lines":[{"line_number":35,"context_line":"gateway. The malicious host has a number of options once traffic has"},{"line_number":36,"context_line":"been intercepted. It may interrogate it for sensitive information,"},{"line_number":37,"context_line":"manipulate if before passing it on to the real gateway, or drop it to"},{"line_number":38,"context_line":"create a denial of service attack. This can be demonstrated as follows:"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"- Create a private network/subnet 10.0.0.0/24"},{"line_number":41,"context_line":"- Start 2 VMs attached to that private network:"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_3616b949","line":38,"updated":"2014-09-15 16:34:10.000000000","message":"New paragraph starting at \"This can be demonstrated\"?","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"9ad891c2bfbd14fd4e2bf4c21e9a3bb3497b1781","unresolved":false,"context_lines":[{"line_number":35,"context_line":"gateway. The malicious host has a number of options once traffic has"},{"line_number":36,"context_line":"been intercepted. It may interrogate it for sensitive information,"},{"line_number":37,"context_line":"manipulate if before passing it on to the real gateway, or drop it to"},{"line_number":38,"context_line":"create a denial of service attack. This can be demonstrated as follows:"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"- Create a private network/subnet 10.0.0.0/24"},{"line_number":41,"context_line":"- Start 2 VMs attached to that private network:"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_eacd1d5e","line":38,"in_reply_to":"fa98f980_3616b949","updated":"2014-09-15 21:25:40.000000000","message":"+1","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"25737b4de57d8b07e73e39a808371ebadcfc5ec7","unresolved":false,"context_lines":[{"line_number":35,"context_line":"gateway. The malicious host has a number of options once traffic has"},{"line_number":36,"context_line":"been intercepted. It may interrogate it for sensitive information,"},{"line_number":37,"context_line":"manipulate if before passing it on to the real gateway, or drop it to"},{"line_number":38,"context_line":"create a denial of service attack. This can be demonstrated as follows:"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"- Create a private network/subnet 10.0.0.0/24"},{"line_number":41,"context_line":"- Start 2 VMs attached to that private network:"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_ecb6073e","line":38,"in_reply_to":"fa98f980_eacd1d5e","updated":"2014-09-16 13:41:46.000000000","message":"Done","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"f41e4490a0f0f2751225147ae6df6565ed663acd","unresolved":false,"context_lines":[{"line_number":42,"context_line":"  VM1 IP 10.0.0.3, VM2 IP 10.0.0.4"},{"line_number":43,"context_line":"- Log on to VM1 and install the ettercap tool (see references)"},{"line_number":44,"context_line":"- Launch command: \u0027ettercap -T -w dump -M ARP /10.0.0.4/ // output\u0027 on"},{"line_number":45,"context_line":"  VM1. This will cause trafic from VM2 to pass through VM1 before it is"},{"line_number":46,"context_line":"  forwarded on to the gateway."},{"line_number":47,"context_line":"- Log on to VM2 and ping any valid internet site, the ping should"},{"line_number":48,"context_line":"  succeed."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_f35a834e","line":45,"updated":"2014-09-15 16:34:10.000000000","message":"Typo - \"trafic\" should be \"traffic\".","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"25737b4de57d8b07e73e39a808371ebadcfc5ec7","unresolved":false,"context_lines":[{"line_number":42,"context_line":"  VM1 IP 10.0.0.3, VM2 IP 10.0.0.4"},{"line_number":43,"context_line":"- Log on to VM1 and install the ettercap tool (see references)"},{"line_number":44,"context_line":"- Launch command: \u0027ettercap -T -w dump -M ARP /10.0.0.4/ // output\u0027 on"},{"line_number":45,"context_line":"  VM1. This will cause trafic from VM2 to pass through VM1 before it is"},{"line_number":46,"context_line":"  forwarded on to the gateway."},{"line_number":47,"context_line":"- Log on to VM2 and ping any valid internet site, the ping should"},{"line_number":48,"context_line":"  succeed."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_4c855358","line":45,"in_reply_to":"fa98f980_aae875b3","updated":"2014-09-16 13:41:46.000000000","message":"agreed!","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"9ad891c2bfbd14fd4e2bf4c21e9a3bb3497b1781","unresolved":false,"context_lines":[{"line_number":42,"context_line":"  VM1 IP 10.0.0.3, VM2 IP 10.0.0.4"},{"line_number":43,"context_line":"- Log on to VM1 and install the ettercap tool (see references)"},{"line_number":44,"context_line":"- Launch command: \u0027ettercap -T -w dump -M ARP /10.0.0.4/ // output\u0027 on"},{"line_number":45,"context_line":"  VM1. This will cause trafic from VM2 to pass through VM1 before it is"},{"line_number":46,"context_line":"  forwarded on to the gateway."},{"line_number":47,"context_line":"- Log on to VM2 and ping any valid internet site, the ping should"},{"line_number":48,"context_line":"  succeed."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_aae875b3","line":45,"in_reply_to":"fa98f980_f35a834e","updated":"2014-09-15 21:25:40.000000000","message":"Good catch!","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"f41e4490a0f0f2751225147ae6df6565ed663acd","unresolved":false,"context_lines":[{"line_number":54,"context_line":"drops packets from VM2 rather than forwarding them on to the gateway."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"### Recommended Actions ###"},{"line_number":57,"context_line":"Pay close attention to networks where Neutron based VLANs are in use."},{"line_number":58,"context_line":"Install appropriate IDS and traffic monitoring tools with a particular"},{"line_number":59,"context_line":"focus on ARP packet monitoring."},{"line_number":60,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_933937f4","line":57,"updated":"2014-09-15 16:34:10.000000000","message":"Hyphenate for easier parsing?  \"Neutron-based VLANs\"?","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"25737b4de57d8b07e73e39a808371ebadcfc5ec7","unresolved":false,"context_lines":[{"line_number":54,"context_line":"drops packets from VM2 rather than forwarding them on to the gateway."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"### Recommended Actions ###"},{"line_number":57,"context_line":"Pay close attention to networks where Neutron based VLANs are in use."},{"line_number":58,"context_line":"Install appropriate IDS and traffic monitoring tools with a particular"},{"line_number":59,"context_line":"focus on ARP packet monitoring."},{"line_number":60,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_0c8b4b69","line":57,"in_reply_to":"fa98f980_933937f4","updated":"2014-09-16 13:41:46.000000000","message":"Done","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"65d08ab629fbb6ad9a5eed3947d2dd4a2b1ff455","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/neutron/+bug/1274034"},{"line_number":67,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":68,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":69,"context_line":"Ettercap: http://ettercap.github.io/ettercap"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_5189876d","line":69,"updated":"2014-09-15 17:09:28.000000000","message":"A link to a nice write-up on ARP spoofing could be useful here, maybe one of these:\n\nhttp://en.wikipedia.org/wiki/ARP_spoofing\nhttp://www.watchguard.com/infocenter/editorial/135324.asp","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"9ad891c2bfbd14fd4e2bf4c21e9a3bb3497b1781","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/neutron/+bug/1274034"},{"line_number":67,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":68,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":69,"context_line":"Ettercap: http://ettercap.github.io/ettercap"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_aaff9564","line":69,"in_reply_to":"fa98f980_5189876d","updated":"2014-09-15 21:25:40.000000000","message":"+1","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"25737b4de57d8b07e73e39a808371ebadcfc5ec7","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/neutron/+bug/1274034"},{"line_number":67,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":68,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":69,"context_line":"Ettercap: http://ettercap.github.io/ettercap"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa98f980_4cec732a","line":69,"in_reply_to":"fa98f980_aaff9564","updated":"2014-09-16 13:41:46.000000000","message":"Done","commit_id":"c6b39376e46a13ad31422f84d02d8287a690bc2b"}],"security-notes/OSSN-0027.txt":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5df9035082f9e958ca406941a1863098d4c53eeb","unresolved":false,"context_lines":[{"line_number":29,"context_line":"packets designed to manipulate the ARP table of another host on the same"},{"line_number":30,"context_line":"network. This manipulation can be engineered such that the malicious"},{"line_number":31,"context_line":"host will receive trafic from the target host in place of the network"},{"line_number":32,"context_line":"gateway. This trafic can then be forwarded on to legitimate gateway, or"},{"line_number":33,"context_line":"dropped. Such a attack can be demonstrated as follows:"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- Create a private network/subnet 10.0.0.0/24"}],"source_content_type":"text/plain","patch_set":2,"id":"fa98f980_aa084e92","line":32,"updated":"2014-09-08 10:02:35.000000000","message":"This sentence can possibly be simplified a little.","commit_id":"d13f04cd83769efe3005da9ca1b9a9bfd63de419"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"1d8cee97ffb0979a826e8097b0eea2299f92c1c7","unresolved":false,"context_lines":[{"line_number":29,"context_line":"packets designed to manipulate the ARP table of another host on the same"},{"line_number":30,"context_line":"network. This manipulation can be engineered such that the malicious"},{"line_number":31,"context_line":"host will receive trafic from the target host in place of the network"},{"line_number":32,"context_line":"gateway. This trafic can then be forwarded on to legitimate gateway, or"},{"line_number":33,"context_line":"dropped. Such a attack can be demonstrated as follows:"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- Create a private network/subnet 10.0.0.0/24"}],"source_content_type":"text/plain","patch_set":2,"id":"fa98f980_aa4e8e94","line":32,"in_reply_to":"fa98f980_aa084e92","updated":"2014-09-08 10:06:45.000000000","message":"Done","commit_id":"d13f04cd83769efe3005da9ca1b9a9bfd63de419"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5df9035082f9e958ca406941a1863098d4c53eeb","unresolved":false,"context_lines":[{"line_number":45,"context_line":"- On VM2 checking the ARP table will show that the MAC address"},{"line_number":46,"context_line":"  associated with the gateway is the MAC address of VM1."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"This attack can become a denial of service attack if VM1 drops packets"},{"line_number":49,"context_line":"from VM2 rather than forwarding them on to the gateway."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"### Recommended Actions ###"}],"source_content_type":"text/plain","patch_set":2,"id":"fa98f980_0a6cfa35","line":48,"updated":"2014-09-08 10:02:35.000000000","message":"this technique can be used to cause a denial of service","commit_id":"d13f04cd83769efe3005da9ca1b9a9bfd63de419"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"1d8cee97ffb0979a826e8097b0eea2299f92c1c7","unresolved":false,"context_lines":[{"line_number":45,"context_line":"- On VM2 checking the ARP table will show that the MAC address"},{"line_number":46,"context_line":"  associated with the gateway is the MAC address of VM1."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"This attack can become a denial of service attack if VM1 drops packets"},{"line_number":49,"context_line":"from VM2 rather than forwarding them on to the gateway."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"### Recommended Actions ###"}],"source_content_type":"text/plain","patch_set":2,"id":"fa98f980_8a49ca90","line":48,"in_reply_to":"fa98f980_0a6cfa35","updated":"2014-09-08 10:06:45.000000000","message":"Done","commit_id":"d13f04cd83769efe3005da9ca1b9a9bfd63de419"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"f36e2bb493cf70e9cd5debb9171387d235f2bbde","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"The Neutron firewall driver \u0027iptabes_firawall\u0027 does not prevent ARP"},{"line_number":6,"context_line":"cache poisoning. This driver only handles MAC and IP based anti-spoofing"},{"line_number":7,"context_line":"rules."},{"line_number":8,"context_line":""}],"source_content_type":"text/plain","patch_set":3,"id":"fa98f980_b1ed1e91","line":5,"updated":"2014-09-08 14:14:16.000000000","message":"typo: iptables","commit_id":"0ded5769a7466623e164619ed94b2170a5eedbee"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"f36e2bb493cf70e9cd5debb9171387d235f2bbde","unresolved":false,"context_lines":[{"line_number":18,"context_line":"- nova-no-nd-reflection"},{"line_number":19,"context_line":"- allow-dhcp-server"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"However, the \u0027iptabes_firawall\u0027 driver available in Neutron handles only"},{"line_number":22,"context_line":"MAC and IP anti-spoofing rules, leaving it vulnerable to ARP poisoning"},{"line_number":23,"context_line":"based attacks. This feature disparity is a security vulnerability,"},{"line_number":24,"context_line":"especially on shared networks."}],"source_content_type":"text/plain","patch_set":3,"id":"fa98f980_d11c627a","line":21,"updated":"2014-09-08 14:14:16.000000000","message":"typo: iptables","commit_id":"0ded5769a7466623e164619ed94b2170a5eedbee"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"f36e2bb493cf70e9cd5debb9171387d235f2bbde","unresolved":false,"context_lines":[{"line_number":21,"context_line":"However, the \u0027iptabes_firawall\u0027 driver available in Neutron handles only"},{"line_number":22,"context_line":"MAC and IP anti-spoofing rules, leaving it vulnerable to ARP poisoning"},{"line_number":23,"context_line":"based attacks. This feature disparity is a security vulnerability,"},{"line_number":24,"context_line":"especially on shared networks."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"ARP poisoning can lead to denial of service attacks as well as man in"},{"line_number":27,"context_line":"the middle attacks that can compromise tenant separation on shared"}],"source_content_type":"text/plain","patch_set":3,"id":"fa98f980_5185d2ab","line":24,"updated":"2014-09-08 14:14:16.000000000","message":"I\u0027m not sure what you mean by \"shared networks\". Is this a well known neutron term I missed, or can it be better explained here?","commit_id":"0ded5769a7466623e164619ed94b2170a5eedbee"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"f36e2bb493cf70e9cd5debb9171387d235f2bbde","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"This technique can be used to cause a denial of service attack if VM"},{"line_number":51,"context_line":"drops packets from VM2 rather than forwarding them on to the gateway."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"### Recommended Actions ###"},{"line_number":54,"context_line":"Pay close attention to networks where Neutron based VLANs are in use."},{"line_number":55,"context_line":"Install appropriate IDS and traffic monitoring tools with a particular"}],"source_content_type":"text/plain","patch_set":3,"id":"fa98f980_91549a22","line":52,"updated":"2014-09-08 14:14:16.000000000","message":"What about multi-homed hosts? If some vm is on two networks, I guess the source ip will not match and will be caught by the no-ip-spoofing feature, but could you include an explicit statement of how does it affect hosts on network boundaries and does it allow for further attacks there.","commit_id":"0ded5769a7466623e164619ed94b2170a5eedbee"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7ad26ce0d4c29c75061e8277748e0aac24dcd828","unresolved":false,"context_lines":[{"line_number":53,"context_line":"### Recommended Actions ###"},{"line_number":54,"context_line":"Pay close attention to networks where Neutron based VLANs are in use."},{"line_number":55,"context_line":"Install appropriate IDS and traffic monitoring tools with a particular"},{"line_number":56,"context_line":"focus on ARP packet monitoring."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"### Contacts / References ###"},{"line_number":59,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0027"}],"source_content_type":"text/plain","patch_set":3,"id":"fa98f980_23e2bc03","line":56,"updated":"2014-09-08 16:19:30.000000000","message":"This is the best we can do for a recommendation?  Just watch for it?","commit_id":"0ded5769a7466623e164619ed94b2170a5eedbee"}]}