)]}'
{"security-notes/OSSN-0029":[{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"639c3b800c9c3c9cddbac3bc5ff26f3d4ab8fdbc","unresolved":false,"context_lines":[{"line_number":5,"context_line":"A bug in the Neutron firewall code results in iptables rules being"},{"line_number":6,"context_line":"generated that do not reflect desired port restrictions. This behaviour"},{"line_number":7,"context_line":"is triggered when a protocol other than \u0027udp\u0027 or \u0027tcp\u0027 is specified,"},{"line_number":8,"context_line":"i.e. \u0027any\u0027."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Grizzly, Havana, Icehouse"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_89b46636","line":8,"updated":"2014-09-17 15:33:58.000000000","message":"is \u0027any\u0027 the only option other than \u0027udp\u0027 or \u0027tcp\u0027? If not, then \u0027e.g.\u0027 may be better than \u0027i.e.\u0027.","commit_id":"5f57bbec01714b46eb188399d3588b1152423035"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"97828201b2d53f8377ad96c1d87f8523fc103c9f","unresolved":false,"context_lines":[{"line_number":5,"context_line":"A bug in the Neutron firewall code results in iptables rules being"},{"line_number":6,"context_line":"generated that do not reflect desired port restrictions. This behaviour"},{"line_number":7,"context_line":"is triggered when a protocol other than \u0027udp\u0027 or \u0027tcp\u0027 is specified,"},{"line_number":8,"context_line":"i.e. \u0027any\u0027."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Grizzly, Havana, Icehouse"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_0986b613","line":8,"in_reply_to":"fa98f980_89b46636","updated":"2014-09-17 15:41:23.000000000","message":"dont know if \u0027any\u0027 is the only other option, but anything that isnt exactly \u0027udp\u0027 or \u0027tcp\u0027 will trigger the bug so I\u0027ll change as advised.","commit_id":"5f57bbec01714b46eb188399d3588b1152423035"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"999aa35618ecea02445d5fcbf988b4489bbc8307","unresolved":false,"context_lines":[{"line_number":6,"context_line":"generated that do not reflect desired port restrictions. This behaviour"},{"line_number":7,"context_line":"is triggered when a protocol other than \u0027udp\u0027 or \u0027tcp\u0027 is specified,"},{"line_number":8,"context_line":"i.e. \u0027any\u0027."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Grizzly, Havana, Icehouse"},{"line_number":12,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_49219efb","line":9,"updated":"2014-09-17 15:45:09.000000000","message":"Note scope of note - relevant to FWaaS but not Nova security groups?","commit_id":"5f57bbec01714b46eb188399d3588b1152423035"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"274faf3dcdc21f5a14b73c8980478c8245fddd44","unresolved":false,"context_lines":[{"line_number":28,"context_line":"-A neutron-l3-agent-iv441c58eb2 -j ACCEPT"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Note that the restriction on port 53 is missing. As a result, this rule"},{"line_number":31,"context_line":"will match and accept any traffic begin processed by the generated rule"},{"line_number":32,"context_line":"chain. This will also short circuiting all filtering rules lower down in"},{"line_number":33,"context_line":"the same chain."},{"line_number":34,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_891546e7","line":31,"updated":"2014-09-17 15:38:27.000000000","message":"\"accept any traffic begin processed\" -\u003e not sure what this was supposed to say... but it needs fixing","commit_id":"5f57bbec01714b46eb188399d3588b1152423035"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"97828201b2d53f8377ad96c1d87f8523fc103c9f","unresolved":false,"context_lines":[{"line_number":28,"context_line":"-A neutron-l3-agent-iv441c58eb2 -j ACCEPT"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Note that the restriction on port 53 is missing. As a result, this rule"},{"line_number":31,"context_line":"will match and accept any traffic begin processed by the generated rule"},{"line_number":32,"context_line":"chain. This will also short circuiting all filtering rules lower down in"},{"line_number":33,"context_line":"the same chain."},{"line_number":34,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_499efe55","line":31,"in_reply_to":"fa98f980_891546e7","updated":"2014-09-17 15:41:23.000000000","message":"oops s/begin/being/ thanks Stan","commit_id":"5f57bbec01714b46eb188399d3588b1152423035"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"999aa35618ecea02445d5fcbf988b4489bbc8307","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Note that the restriction on port 53 is missing. As a result, this rule"},{"line_number":31,"context_line":"will match and accept any traffic begin processed by the generated rule"},{"line_number":32,"context_line":"chain. This will also short circuiting all filtering rules lower down in"},{"line_number":33,"context_line":"the same chain."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_c9158e9c","line":32,"updated":"2014-09-17 15:45:09.000000000","message":"Perhaps \"This will also bypass all filtering rules..\"?","commit_id":"5f57bbec01714b46eb188399d3588b1152423035"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"639c3b800c9c3c9cddbac3bc5ff26f3d4ab8fdbc","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Note that the restriction on port 53 is missing. As a result, this rule"},{"line_number":31,"context_line":"will match and accept any traffic begin processed by the generated rule"},{"line_number":32,"context_line":"chain. This will also short circuiting all filtering rules lower down in"},{"line_number":33,"context_line":"the same chain."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_c9610eaa","line":32,"updated":"2014-09-17 15:33:58.000000000","message":"circuiting should not be plural.","commit_id":"5f57bbec01714b46eb188399d3588b1152423035"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"97828201b2d53f8377ad96c1d87f8523fc103c9f","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Note that the restriction on port 53 is missing. As a result, this rule"},{"line_number":31,"context_line":"will match and accept any traffic begin processed by the generated rule"},{"line_number":32,"context_line":"chain. This will also short circuiting all filtering rules lower down in"},{"line_number":33,"context_line":"the same chain."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_a9b4cad4","line":32,"in_reply_to":"fa98f980_c9610eaa","updated":"2014-09-17 15:41:23.000000000","message":"yup","commit_id":"5f57bbec01714b46eb188399d3588b1152423035"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"60ae296eae6169347d3df35a0cd03d413f73fda3","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"A bug in the Neutron FWaaS code results in iptables rules being"},{"line_number":6,"context_line":"generated that do not reflect desired port restrictions. This behaviour"},{"line_number":7,"context_line":"is triggered when a protocol other than \u0027udp\u0027 or \u0027tcp\u0027 is specified,"},{"line_number":8,"context_line":"e.g. \u0027any\u0027."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_f09ce05d","line":5,"updated":"2014-09-18 10:24:18.000000000","message":"Potentially expand FWaaS ?","commit_id":"8724c5d510b03721e822bd646e87503834cfdfd5"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"60ae296eae6169347d3df35a0cd03d413f73fda3","unresolved":false,"context_lines":[{"line_number":5,"context_line":"A bug in the Neutron FWaaS code results in iptables rules being"},{"line_number":6,"context_line":"generated that do not reflect desired port restrictions. This behaviour"},{"line_number":7,"context_line":"is triggered when a protocol other than \u0027udp\u0027 or \u0027tcp\u0027 is specified,"},{"line_number":8,"context_line":"e.g. \u0027any\u0027."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"The scope of this bug is limited to Neutron FWaaS and systems built upon"},{"line_number":11,"context_line":"it. Security Groups are not effected."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_50b5acce","line":8,"updated":"2014-09-18 10:24:18.000000000","message":"Is it when using \u0027any\u0027 or when using anything other than \u0027udp\u0027 or \u0027tcp\u0027 ? This sentence seems to contradict the title.","commit_id":"8724c5d510b03721e822bd646e87503834cfdfd5"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"60ae296eae6169347d3df35a0cd03d413f73fda3","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    --action allow"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"However, this rule results in the generation of iptables firewall rules"},{"line_number":28,"context_line":"that do not reflect the desired port restriction. Such a generated"},{"line_number":29,"context_line":"rule might look like the following:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"-A neutron-l3-agent-iv441c58eb2 -j ACCEPT"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_30d588e5","line":28,"updated":"2014-09-18 10:24:18.000000000","message":"generated IP Tables rule","commit_id":"8724c5d510b03721e822bd646e87503834cfdfd5"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"60ae296eae6169347d3df35a0cd03d413f73fda3","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Note that the restriction on port 53 is missing. As a result, the"},{"line_number":34,"context_line":"generated rule will match and accept any traffic being processed by the"},{"line_number":35,"context_line":"rule chain to which it belongs."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Additionally, packets will be processed by the chain, rule at a time;"},{"line_number":38,"context_line":"and this rule will match and accept all packets, thus it effectively"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_70063087","line":35,"updated":"2014-09-18 10:24:18.000000000","message":"I like this.","commit_id":"8724c5d510b03721e822bd646e87503834cfdfd5"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"60ae296eae6169347d3df35a0cd03d413f73fda3","unresolved":false,"context_lines":[{"line_number":34,"context_line":"generated rule will match and accept any traffic being processed by the"},{"line_number":35,"context_line":"rule chain to which it belongs."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Additionally, packets will be processed by the chain, rule at a time;"},{"line_number":38,"context_line":"and this rule will match and accept all packets, thus it effectively"},{"line_number":39,"context_line":"short circuites any filtering rules lower down in the chain. This will"},{"line_number":40,"context_line":"result in a knock on effect that can break other firewall rules"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_30eca8bb","line":37,"updated":"2014-09-18 10:24:18.000000000","message":"Chain what chain? Is there also a padlock? colour me confuzzled.\n\nIntroduce iptables chains before you refer to them :)","commit_id":"8724c5d510b03721e822bd646e87503834cfdfd5"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"60ae296eae6169347d3df35a0cd03d413f73fda3","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Additionally, packets will be processed by the chain, rule at a time;"},{"line_number":38,"context_line":"and this rule will match and accept all packets, thus it effectively"},{"line_number":39,"context_line":"short circuites any filtering rules lower down in the chain. This will"},{"line_number":40,"context_line":"result in a knock on effect that can break other firewall rules"},{"line_number":41,"context_line":"regardless of the protocol specified when defining those rules. They"},{"line_number":42,"context_line":"simply need to apear later in the generated rule chain."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_702d50fd","line":39,"updated":"2014-09-18 10:24:18.000000000","message":"spelling in circuites","commit_id":"8724c5d510b03721e822bd646e87503834cfdfd5"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"1bad0bddec6f8a7ebdadd68344fe96910aa3ed35","unresolved":false,"context_lines":[{"line_number":14,"context_line":"Neutron FWaaS, Grizzly, Havana, Icehouse"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Discussion ###"},{"line_number":17,"context_line":"When specifying firewall rules using Neutron that should match multiple"},{"line_number":18,"context_line":"protocols, it is convenient to specify a protocol of \u0027any\u0027 in place of"},{"line_number":19,"context_line":"defining multiple specific rules."},{"line_number":20,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_f123ffbb","line":17,"updated":"2014-09-18 14:34:42.000000000","message":"I could be wrong, but I think there should be commas around \"using Neutron\" here","commit_id":"03ce136b1ee3a6b96e3fa7cbf008a1010f54e2cb"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"7d5a25a8c1d7b4ec5b3c641469997ffbc8f8a42f","unresolved":false,"context_lines":[{"line_number":14,"context_line":"Neutron FWaaS, Grizzly, Havana, Icehouse"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Discussion ###"},{"line_number":17,"context_line":"When specifying firewall rules using Neutron that should match multiple"},{"line_number":18,"context_line":"protocols, it is convenient to specify a protocol of \u0027any\u0027 in place of"},{"line_number":19,"context_line":"defining multiple specific rules."},{"line_number":20,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_547bd9bd","line":17,"in_reply_to":"fa98f980_f123ffbb","updated":"2014-09-18 14:52:22.000000000","message":"Humm, I don\u0027t think so, but you could be right. Anyone else want to weigh in on this?","commit_id":"03ce136b1ee3a6b96e3fa7cbf008a1010f54e2cb"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"1bad0bddec6f8a7ebdadd68344fe96910aa3ed35","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    --action allow"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"However, this rule results in the generation of iptables firewall rules"},{"line_number":28,"context_line":"that do not reflect the desired port restriction. Such a generated"},{"line_number":29,"context_line":"iptables rule might look like the following:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"-A neutron-l3-agent-iv441c58eb2 -j ACCEPT"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_b41fa55a","line":28,"updated":"2014-09-18 14:34:42.000000000","message":"This sentence \"Such a generated iptables rule\" is a little bit awkward.  I think it\u0027s ok to say: \"A generated iptables rule might look like\"...","commit_id":"03ce136b1ee3a6b96e3fa7cbf008a1010f54e2cb"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"7d5a25a8c1d7b4ec5b3c641469997ffbc8f8a42f","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    --action allow"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"However, this rule results in the generation of iptables firewall rules"},{"line_number":28,"context_line":"that do not reflect the desired port restriction. Such a generated"},{"line_number":29,"context_line":"iptables rule might look like the following:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"-A neutron-l3-agent-iv441c58eb2 -j ACCEPT"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_34573528","line":28,"in_reply_to":"fa98f980_b41fa55a","updated":"2014-09-18 14:52:22.000000000","message":"fair enough, i\u0027ll change it.","commit_id":"03ce136b1ee3a6b96e3fa7cbf008a1010f54e2cb"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"1bad0bddec6f8a7ebdadd68344fe96910aa3ed35","unresolved":false,"context_lines":[{"line_number":35,"context_line":"rule chain to which it belongs."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Additionally, iptables arranges sets of rules into chains and processes"},{"line_number":38,"context_line":"packets entering a chain, rule at a time. Rule matching stops at the"},{"line_number":39,"context_line":"first matched exit condition (e.g. accept or drop). Since, the generated"},{"line_number":40,"context_line":"rule above will match and accept all packets, it will effectively short"},{"line_number":41,"context_line":"circuit any filtering rules lower down in the chain. This will result"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_944f016a","line":38,"updated":"2014-09-18 14:34:42.000000000","message":"*one* rule at a time","commit_id":"03ce136b1ee3a6b96e3fa7cbf008a1010f54e2cb"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"1bad0bddec6f8a7ebdadd68344fe96910aa3ed35","unresolved":false,"context_lines":[{"line_number":39,"context_line":"first matched exit condition (e.g. accept or drop). Since, the generated"},{"line_number":40,"context_line":"rule above will match and accept all packets, it will effectively short"},{"line_number":41,"context_line":"circuit any filtering rules lower down in the chain. This will result"},{"line_number":42,"context_line":"in a knock on effect that can break other firewall rules regardless of"},{"line_number":43,"context_line":"the protocol specified when defining those rules with Neutron. They"},{"line_number":44,"context_line":"simply need to apear later in the generated iptables rule chain."},{"line_number":45,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_94d2a159","line":42,"updated":"2014-09-18 14:34:42.000000000","message":"Americans don\u0027t know about *knock on effect*","commit_id":"03ce136b1ee3a6b96e3fa7cbf008a1010f54e2cb"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"1bad0bddec6f8a7ebdadd68344fe96910aa3ed35","unresolved":false,"context_lines":[{"line_number":41,"context_line":"circuit any filtering rules lower down in the chain. This will result"},{"line_number":42,"context_line":"in a knock on effect that can break other firewall rules regardless of"},{"line_number":43,"context_line":"the protocol specified when defining those rules with Neutron. They"},{"line_number":44,"context_line":"simply need to apear later in the generated iptables rule chain."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"This bug is triggered when any protocol other than \u0027tcp\u0027 or \u0027udp\u0027 is"},{"line_number":47,"context_line":"specified in conjunction with a source or destination port number."}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa98f980_f4f76dd2","line":44,"updated":"2014-09-18 14:34:42.000000000","message":"*appear*","commit_id":"03ce136b1ee3a6b96e3fa7cbf008a1010f54e2cb"}]}