)]}'
{"security-notes/OSSN-0040":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"e7fad0457efa98d4374236929e6e369933e43e6e","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Neutron LBaaS VIP port does not enforce security groups when used with OVS (Open VSwitch) "},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"5a890539_0083a604","line":1,"updated":"2014-11-21 10:16:39.000000000","message":"Dangling whitespace.\n\nI\u0027d just write Open vSwitch in the title, you can refer to OVS below once you\u0027ve expanded it","commit_id":"74008309d50b65a21895b9c6dcc9fb74a624c679"},{"author":{"_account_id":9278,"name":"Steven Weston","email":"steve.weston@triniplex.com","username":"steven-weston"},"change_message_id":"111cf4b3de40694bf86323e30cd7def48117a6b4","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Neutron LBaaS VIP port does not enforce security groups when used with OVS (Open VSwitch) "},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"5a890539_e6414464","line":1,"in_reply_to":"5a890539_0083a604","updated":"2014-11-21 18:24:55.000000000","message":"Done","commit_id":"74008309d50b65a21895b9c6dcc9fb74a624c679"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"a507a8a098283381ed9ef93964b9b0be0034ef50","unresolved":false,"context_lines":[{"line_number":11,"context_line":"This bug is a result of using the bridge interface driver to connect the VIP port in the linux namespace to the integration bridge in OVS.  The bridge interface driver connects the VIP directly to the integration bridge, and does not create the linux bridges necessary for the application of the iptables rules."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Recommended Actions ###"},{"line_number":14,"context_line":"A patch has been created which implements the OVSHybrid interface driver to connect the VIP port to the load balancer members (see the reference below to pull the patch code).  The patch must be applied and the interface driver changed in the lbaas_agent.ini file as specified in the commit message for the patch.  This action will only be necessary until the patch is merged into the trunk."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Contacts / References ###"},{"line_number":17,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0040"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"5a890539_205c22ed","line":14,"updated":"2014-11-21 10:09:25.000000000","message":"please replicate the changes to lbaas_agent.ini in the note itself. Notes should contain as much relevant info as is reasonable.","commit_id":"74008309d50b65a21895b9c6dcc9fb74a624c679"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"e7fad0457efa98d4374236929e6e369933e43e6e","unresolved":false,"context_lines":[{"line_number":11,"context_line":"This bug is a result of using the bridge interface driver to connect the VIP port in the linux namespace to the integration bridge in OVS.  The bridge interface driver connects the VIP directly to the integration bridge, and does not create the linux bridges necessary for the application of the iptables rules."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Recommended Actions ###"},{"line_number":14,"context_line":"A patch has been created which implements the OVSHybrid interface driver to connect the VIP port to the load balancer members (see the reference below to pull the patch code).  The patch must be applied and the interface driver changed in the lbaas_agent.ini file as specified in the commit message for the patch.  This action will only be necessary until the patch is merged into the trunk."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Contacts / References ###"},{"line_number":17,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0040"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"5a890539_80db161a","line":14,"in_reply_to":"5a890539_205c22ed","updated":"2014-11-21 10:16:39.000000000","message":"+1","commit_id":"74008309d50b65a21895b9c6dcc9fb74a624c679"},{"author":{"_account_id":9278,"name":"Steven Weston","email":"steve.weston@triniplex.com","username":"steven-weston"},"change_message_id":"111cf4b3de40694bf86323e30cd7def48117a6b4","unresolved":false,"context_lines":[{"line_number":11,"context_line":"This bug is a result of using the bridge interface driver to connect the VIP port in the linux namespace to the integration bridge in OVS.  The bridge interface driver connects the VIP directly to the integration bridge, and does not create the linux bridges necessary for the application of the iptables rules."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Recommended Actions ###"},{"line_number":14,"context_line":"A patch has been created which implements the OVSHybrid interface driver to connect the VIP port to the load balancer members (see the reference below to pull the patch code).  The patch must be applied and the interface driver changed in the lbaas_agent.ini file as specified in the commit message for the patch.  This action will only be necessary until the patch is merged into the trunk."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Contacts / References ###"},{"line_number":17,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0040"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"5a890539_6655541d","line":14,"in_reply_to":"5a890539_205c22ed","updated":"2014-11-21 18:24:55.000000000","message":"Done","commit_id":"74008309d50b65a21895b9c6dcc9fb74a624c679"},{"author":{"_account_id":9278,"name":"Steven Weston","email":"steve.weston@triniplex.com","username":"steven-weston"},"change_message_id":"111cf4b3de40694bf86323e30cd7def48117a6b4","unresolved":false,"context_lines":[{"line_number":11,"context_line":"This bug is a result of using the bridge interface driver to connect the VIP port in the linux namespace to the integration bridge in OVS.  The bridge interface driver connects the VIP directly to the integration bridge, and does not create the linux bridges necessary for the application of the iptables rules."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Recommended Actions ###"},{"line_number":14,"context_line":"A patch has been created which implements the OVSHybrid interface driver to connect the VIP port to the load balancer members (see the reference below to pull the patch code).  The patch must be applied and the interface driver changed in the lbaas_agent.ini file as specified in the commit message for the patch.  This action will only be necessary until the patch is merged into the trunk."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Contacts / References ###"},{"line_number":17,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0040"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"5a890539_86524033","line":14,"in_reply_to":"5a890539_80db161a","updated":"2014-11-21 18:24:55.000000000","message":"Done","commit_id":"74008309d50b65a21895b9c6dcc9fb74a624c679"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"fd589e1b93fcdac5c88bb83390f73d521c4b0815","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Neutron LBaaS VIP port does not enforce security groups when used with Open VSwitch"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"5a890539_9766ecb9","line":1,"updated":"2014-11-21 19:23:55.000000000","message":"I believe this is where the tox-checsyntax is failing and would be fixed by moving Open VSwitch to the next line (and deleting the space.","commit_id":"a12cff8a91287bf7cdb41c58a99286f1024e16cd"},{"author":{"_account_id":9278,"name":"Steven Weston","email":"steve.weston@triniplex.com","username":"steven-weston"},"change_message_id":"9c15c0b45e8051055576ffbf1cafe20ee36d3c8b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Neutron LBaaS VIP port does not enforce security groups when used with Open VSwitch"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"5a890539_370d383f","line":1,"in_reply_to":"5a890539_9766ecb9","updated":"2014-11-21 19:48:02.000000000","message":"Done","commit_id":"a12cff8a91287bf7cdb41c58a99286f1024e16cd"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"fd589e1b93fcdac5c88bb83390f73d521c4b0815","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Therefore, the VIP port balances the traffic to the virtual machines"},{"line_number":8,"context_line":"without enforcing the security group rules applied to the virtual"},{"line_number":9,"context_line":"machines’ ports in Neutron. As a result, access to the load balancer"},{"line_number":10,"context_line":"VIP is completely open and not protected by the iptables rules. This"},{"line_number":11,"context_line":"bug only applies when using the Open VSwitch (OVS) interface driver,"},{"line_number":12,"context_line":"which is specified in the lbaas_agent.ini file."},{"line_number":13,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"5a890539_37fa98bd","line":10,"updated":"2014-11-21 19:23:55.000000000","message":"Should \u0027completely open and\u0027 be removed here? It seems redundant/ambiguous with the \u0027not protected by the iptables rules\u0027 after it.","commit_id":"a12cff8a91287bf7cdb41c58a99286f1024e16cd"},{"author":{"_account_id":9278,"name":"Steven Weston","email":"steve.weston@triniplex.com","username":"steven-weston"},"change_message_id":"9c15c0b45e8051055576ffbf1cafe20ee36d3c8b","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Therefore, the VIP port balances the traffic to the virtual machines"},{"line_number":8,"context_line":"without enforcing the security group rules applied to the virtual"},{"line_number":9,"context_line":"machines’ ports in Neutron. As a result, access to the load balancer"},{"line_number":10,"context_line":"VIP is completely open and not protected by the iptables rules. This"},{"line_number":11,"context_line":"bug only applies when using the Open VSwitch (OVS) interface driver,"},{"line_number":12,"context_line":"which is specified in the lbaas_agent.ini file."},{"line_number":13,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"5a890539_17159c48","line":10,"in_reply_to":"5a890539_37fa98bd","updated":"2014-11-21 19:48:02.000000000","message":"it is ambiguous. I will remove it.","commit_id":"a12cff8a91287bf7cdb41c58a99286f1024e16cd"},{"author":{"_account_id":10980,"name":"Doug Wiegley","email":"dougwig@parkside.io","username":"dougw"},"change_message_id":"1d94f2563f657494b520c352a5209e825e98722d","unresolved":false,"context_lines":[{"line_number":3,"context_line":"---"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"### Summary ###"},{"line_number":6,"context_line":"A bug in the  Neutron LBaaS (Load Balancer as a Service) plugin does"},{"line_number":7,"context_line":"not apply security groups to the VIP (Virtual IP) port in Neutron."},{"line_number":8,"context_line":"Therefore, the VIP port balances the traffic to the virtual machines"},{"line_number":9,"context_line":"without enforcing the security group rules applied to the virtual"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3acd31a7_80dd8544","line":6,"updated":"2015-04-30 20:11:06.000000000","message":"I would phrase this as:\n\"A bug in the reference implementation for the Neutron LBaaS plugins...\", as this is an issue with the reference namespace haproxy driver.\n\nMany hardware load-balancer drivers use the allocated neutron port for the VIP as an IP reservation of sorts, and direct plumb the ip into the network, which means the neutron security groups can *not* be enabled for them, and this is likely best left as a driver choice/vendor concern.","commit_id":"6ea9134ac271e81f16b9a2a389fe47223a88bc19"},{"author":{"_account_id":105,"name":"Kyle Mestery","email":"mestery@mestery.com","username":"mestery"},"change_message_id":"e85d6e2e9308f504a63a06b44b8bdb858576da46","unresolved":false,"context_lines":[{"line_number":13,"context_line":"specified in the lbaas_agent.ini file."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Affected Services / Software ###"},{"line_number":16,"context_line":"Neutron LBaaS, Icehouse"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"This bug is a result of using the bridge interface driver to connect"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3acd31a7_5f5f5141","line":16,"updated":"2015-04-30 17:15:24.000000000","message":"Which version of the LBaaS API does this affect? V1 or V2?","commit_id":"6ea9134ac271e81f16b9a2a389fe47223a88bc19"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"9376eef582e22576174876c252f2bbb8aeb83fbf","unresolved":false,"context_lines":[{"line_number":13,"context_line":"specified in the lbaas_agent.ini file."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Affected Services / Software ###"},{"line_number":16,"context_line":"Neutron LBaaS, Icehouse"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"This bug is a result of using the bridge interface driver to connect"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3acd31a7_aa8d0233","line":16,"in_reply_to":"3acd31a7_5f5f5141","updated":"2015-04-30 19:28:45.000000000","message":"It\u0027ll affect both since V2\u0027s VIP allocation is nearly identical to V1\u0027s right now.","commit_id":"6ea9134ac271e81f16b9a2a389fe47223a88bc19"},{"author":{"_account_id":10980,"name":"Doug Wiegley","email":"dougwig@parkside.io","username":"dougw"},"change_message_id":"1d94f2563f657494b520c352a5209e825e98722d","unresolved":false,"context_lines":[{"line_number":13,"context_line":"specified in the lbaas_agent.ini file."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Affected Services / Software ###"},{"line_number":16,"context_line":"Neutron LBaaS, Icehouse"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"This bug is a result of using the bridge interface driver to connect"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3acd31a7_40cf6d7f","line":16,"in_reply_to":"3acd31a7_aa8d0233","updated":"2015-04-30 20:11:06.000000000","message":"Agree.  Affected Services / Software:\nNeutron LBaaS, Icehouse, Juno\nNeutron LBaaS v1 and v2, Kilo","commit_id":"6ea9134ac271e81f16b9a2a389fe47223a88bc19"},{"author":{"_account_id":10980,"name":"Doug Wiegley","email":"dougwig@parkside.io","username":"dougw"},"change_message_id":"1d94f2563f657494b520c352a5209e825e98722d","unresolved":false,"context_lines":[{"line_number":23,"context_line":"for the application of the iptables rules."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"### Recommended Actions ###"},{"line_number":26,"context_line":"A patch has been created which implements the OVSHybridInterfaceDriver"},{"line_number":27,"context_line":"driver to connect the VIP port to the load balancer members.  The"},{"line_number":28,"context_line":"patch (see the references for the review link and to pull the patch"},{"line_number":29,"context_line":"code) must be applied, and the interface driver changed in the"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3acd31a7_8026a566","line":26,"updated":"2015-04-30 20:11:06.000000000","message":"This patch is in merge conflict and has been abandoned, FYI.","commit_id":"6ea9134ac271e81f16b9a2a389fe47223a88bc19"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c2e6b6e2aee6e01459e181c5afa61f4a3f95724c","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/neutron/+bug/1163569"},{"line_number":48,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":49,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":50,"context_line":"Gerrit Review (Patch) : https://review.openstack.org/#/c/109848/1"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3acd31a7_712416c4","line":50,"updated":"2015-05-05 18:23:34.000000000","message":"Is there another link to a patch implementing the fix that hasn\u0027t been abandoned?","commit_id":"6ea9134ac271e81f16b9a2a389fe47223a88bc19"}]}