)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"2c53bfaccbd33e94b58fbf7a61b1d933834c8641","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Updated OSSN-0072"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Added instructions to disable IPV6 for new interfaces in Neutron"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: I58b1d283cf1f6b9a383e159f0e65e1cb1279b9ac"},{"line_number":12,"context_line":"closes-bug: 1534652"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"1ac06dbe_46cee72e","line":9,"updated":"2016-08-22 23:04:18.000000000","message":"nit: IPv6","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"206fed371ba9e476a40d8716c11812f07b771dc0","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Updated OSSN-0069"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Added instructions to disable IPv6 for new interfaces in neutron"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: I58b1d283cf1f6b9a383e159f0e65e1cb1279b9ac"},{"line_number":12,"context_line":"closes-bug: 1534652"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":23,"id":"9a89bdaa_acb78138","line":9,"range":{"start_line":9,"start_character":57,"end_line":9,"end_character":64},"updated":"2016-09-07 16:20:31.000000000","message":"nit: Neutron","commit_id":"6741ae574aadf2fa1fba57a579129a8f511917d7"}],"security-notes/OSSN-0069":[{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"dc0f626b9cdce91bf735024aedaed03c7ca71e2a","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Nova, Neutron, Networking-midonet, Kilo release, Liberty release"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Linux assigns link-local IPv6 addresses to all the active interfaces before"},{"line_number":16,"context_line":"they are enslaved in a bridge which is different in the case of IPv4 addresses"},{"line_number":17,"context_line":"where an administrator must configure them explicitly. They are exposed in the"},{"line_number":18,"context_line":"LinuxBridgeManager calls `ensure_vlan` and `ensure_vxlan` where a new VLAN or"},{"line_number":19,"context_line":"VXLAN interface is created prior to enslaving the interfaces in the bridge."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1ac06dbe_ed668fb9","line":16,"range":{"start_line":15,"start_character":69,"end_line":16,"end_character":29},"updated":"2016-08-23 18:09:38.000000000","message":"Reading this again, I think is better as two sentences since it is describing two different parts of the IP stack behavior:\n\nLinux assigns link-local IPv6 addresses to all the active interfaces which is different in the case of IPv4 addresses where an administrator must configure them explicitly. Once an interface is enslaved in a bridge, all addresses assigned to it are ignored and only the addresses on the bridge are active.","commit_id":"41bbe54d640b035116d63d3cfe89fe41d2741502"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"6502781ce66f10429780474f008e6f522d234f40","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Nova, Neutron, Networking-midonet, Kilo release, Liberty release"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Linux assigns link-local IPv6 addresses to all the active interfaces before"},{"line_number":16,"context_line":"they are enslaved in a bridge which is different in the case of IPv4 addresses"},{"line_number":17,"context_line":"where an administrator must configure them explicitly. They are exposed in the"},{"line_number":18,"context_line":"LinuxBridgeManager calls `ensure_vlan` and `ensure_vxlan` where a new VLAN or"},{"line_number":19,"context_line":"VXLAN interface is created prior to enslaving the interfaces in the bridge."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1ac06dbe_d3ded2db","line":16,"range":{"start_line":15,"start_character":69,"end_line":16,"end_character":29},"in_reply_to":"1ac06dbe_ed668fb9","updated":"2016-08-23 19:03:23.000000000","message":"Perfect !   This sounds much better.","commit_id":"41bbe54d640b035116d63d3cfe89fe41d2741502"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"96a0509828b3cc85a8b3b254484089e260704329","unresolved":false,"context_lines":[{"line_number":47,"context_line":"However, Operators should not enable IPv6 explicitly without knowing the"},{"line_number":48,"context_line":"impact."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Here $IFACE refers to the interface for which the IPv6 is disabled by default"},{"line_number":51,"context_line":"in Neutron."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Note: The value set at /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6 is"},{"line_number":54,"context_line":"equivalent to net.ipv6.conf.$IFACE.disable_ipv6 in sysctl.conf"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1ac06dbe_ce28ee35","line":51,"range":{"start_line":50,"start_character":0,"end_line":51,"end_character":11},"updated":"2016-08-23 17:33:35.000000000","message":"just a nit, but would this be better on line 47, as you have \"Here..\" as a reference, but the another sentence in between... here is what I mean:\n\nBy default the below values for IPv6 will be set to 1 (disabled)\n\n  net.ipv6.conf.default.disable_ipv6 \u003d 1\n  net.ipv6.conf.$IFACE.disable_ipv6\u003d1\n\n\nHere $IFACE refers to the interface for which the IPv6 is disabled by default\nin Neutron.\n\nHowever, Operators should not enable IPv6 explicitly without knowing the\nimpact.","commit_id":"41bbe54d640b035116d63d3cfe89fe41d2741502"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"6502781ce66f10429780474f008e6f522d234f40","unresolved":false,"context_lines":[{"line_number":47,"context_line":"However, Operators should not enable IPv6 explicitly without knowing the"},{"line_number":48,"context_line":"impact."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Here $IFACE refers to the interface for which the IPv6 is disabled by default"},{"line_number":51,"context_line":"in Neutron."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Note: The value set at /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6 is"},{"line_number":54,"context_line":"equivalent to net.ipv6.conf.$IFACE.disable_ipv6 in sysctl.conf"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1ac06dbe_90af307c","line":51,"range":{"start_line":50,"start_character":0,"end_line":51,"end_character":11},"in_reply_to":"1ac06dbe_ce28ee35","updated":"2016-08-23 19:03:23.000000000","message":"Done","commit_id":"41bbe54d640b035116d63d3cfe89fe41d2741502"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"dc0f626b9cdce91bf735024aedaed03c7ca71e2a","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Reference:"},{"line_number":57,"context_line":"\u003chttps://github.com/openstack/neutron/blob/master/neutron/common"},{"line_number":58,"context_line":"/ipv6_utils.py#L51\u003e"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":""},{"line_number":61,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1ac06dbe_2d954732","line":58,"updated":"2016-08-23 18:09:38.000000000","message":"I didn\u0027t think we referenced line numbers on branches, since further commits to that branch may shift the function within that file. How about https://github.com/openstack/neutron/blob/38f1ec03f94fc6936fe7ea51471e89d432a68099/neutron/common/ipv6_utils.py#L51-L64 instead?","commit_id":"41bbe54d640b035116d63d3cfe89fe41d2741502"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"6502781ce66f10429780474f008e6f522d234f40","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Reference:"},{"line_number":57,"context_line":"\u003chttps://github.com/openstack/neutron/blob/master/neutron/common"},{"line_number":58,"context_line":"/ipv6_utils.py#L51\u003e"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":""},{"line_number":61,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1ac06dbe_13498ad0","line":58,"in_reply_to":"1ac06dbe_2d954732","updated":"2016-08-23 19:03:23.000000000","message":"Done","commit_id":"41bbe54d640b035116d63d3cfe89fe41d2741502"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"4e4d3092fa11f924f82484f5e6bf4eda81f884c6","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface was created, it was also brought to link up"},{"line_number":6,"context_line":"without disabling IPv6. In Linux, link-local IPv6 addresses are assigned to all"},{"line_number":7,"context_line":"active interfaces which exposes them to the tenant networks. This is a"},{"line_number":8,"context_line":"significant difference compared to the IPv4 addresses where an administrator"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"1ac06dbe_715fad75","line":5,"range":{"start_line":5,"start_character":3,"end_line":5,"end_character":10},"updated":"2016-08-25 06:23:12.000000000","message":"lowercase for project names","commit_id":"620474b15270d0c644346f1ee1f30f3bb6ed51f7"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"96d95069e9a35f1f4415952a973c0105741e2a03","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface was created, it was also brought to link up"},{"line_number":6,"context_line":"without disabling IPv6. In Linux, link-local IPv6 addresses are assigned to all"},{"line_number":7,"context_line":"active interfaces which exposes them to the tenant networks. This is a"},{"line_number":8,"context_line":"significant difference compared to the IPv4 addresses where an administrator"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"1ac06dbe_096429e3","line":5,"range":{"start_line":5,"start_character":3,"end_line":5,"end_character":10},"in_reply_to":"1ac06dbe_715fad75","updated":"2016-08-25 17:04:27.000000000","message":"Should this be lowercase even if its the beginning of the sentence ?","commit_id":"620474b15270d0c644346f1ee1f30f3bb6ed51f7"},{"author":{"_account_id":20508,"name":"Mohit Motiani","email":"mohit.motiani@intel.com","username":"mohit.motiani"},"change_message_id":"33b24e13af7fcbc02231c4cc5c48388ac05bd425","unresolved":false,"context_lines":[{"line_number":30,"context_line":"interface is brought to link up. Neutron disables IPv6 on new interfaces by"},{"line_number":31,"context_line":"default now. Neutron interfaces with the default namespace should be configured"},{"line_number":32,"context_line":"in a way that IPv6 addresses are not assigned before the interfaces are brought"},{"line_number":33,"context_line":"to link up. This avoids us from having duplicate IPv6 addresses and also"},{"line_number":34,"context_line":"prevents the host machines from being exposed to the tenant networks."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Instructions:"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"1ac06dbe_3b0edde5","line":33,"updated":"2016-08-24 15:50:48.000000000","message":"Nit: s/having duplicate/duplicated","commit_id":"620474b15270d0c644346f1ee1f30f3bb6ed51f7"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"96d95069e9a35f1f4415952a973c0105741e2a03","unresolved":false,"context_lines":[{"line_number":30,"context_line":"interface is brought to link up. Neutron disables IPv6 on new interfaces by"},{"line_number":31,"context_line":"default now. Neutron interfaces with the default namespace should be configured"},{"line_number":32,"context_line":"in a way that IPv6 addresses are not assigned before the interfaces are brought"},{"line_number":33,"context_line":"to link up. This avoids us from having duplicate IPv6 addresses and also"},{"line_number":34,"context_line":"prevents the host machines from being exposed to the tenant networks."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Instructions:"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"1ac06dbe_89d3f95e","line":33,"in_reply_to":"1ac06dbe_3b0edde5","updated":"2016-08-25 17:04:27.000000000","message":"I think in this sentence \"having duplicate\" sounds better","commit_id":"620474b15270d0c644346f1ee1f30f3bb6ed51f7"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"4e4d3092fa11f924f82484f5e6bf4eda81f884c6","unresolved":false,"context_lines":[{"line_number":50,"context_line":"Here $IFACE refers to the interface for which the IPv6 is disabled by default"},{"line_number":51,"context_line":"in Neutron."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"However, Operators should not enable IPv6 explicitly without knowing the"},{"line_number":54,"context_line":"impact."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Note: The value set at /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6 is"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"1ac06dbe_915ea974","line":53,"range":{"start_line":53,"start_character":9,"end_line":53,"end_character":18},"updated":"2016-08-25 06:23:12.000000000","message":"lowercase","commit_id":"620474b15270d0c644346f1ee1f30f3bb6ed51f7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1b0155c733310c8a4a64e00abd114151e0672d8a","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In neutron whenever a new interface was created, it was also brought to link up"},{"line_number":6,"context_line":"without disabling IPv6. In Linux, link-local IPv6 addresses are assigned to all"},{"line_number":7,"context_line":"active interfaces which exposes them to the tenant networks. This is a"},{"line_number":8,"context_line":"significant difference compared to the IPv4 addresses where an administrator"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa7ab95a_1694e140","line":5,"updated":"2016-08-30 11:02:56.000000000","message":"\"it was also brought to link up\" doesn\u0027t scan well and probably needs to be re-written.","commit_id":"376a44fec8fd99bbd5dbb3ddf74bbf5d348b68cb"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1b0155c733310c8a4a64e00abd114151e0672d8a","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In neutron whenever a new interface was created, it was also brought to link up"},{"line_number":6,"context_line":"without disabling IPv6. In Linux, link-local IPv6 addresses are assigned to all"},{"line_number":7,"context_line":"active interfaces which exposes them to the tenant networks. This is a"},{"line_number":8,"context_line":"significant difference compared to the IPv4 addresses where an administrator"},{"line_number":9,"context_line":"must configure them explicitly."},{"line_number":10,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa7ab95a_76928d4d","line":7,"updated":"2016-08-30 11:02:56.000000000","message":"This note is being written past-tense because the issue is now closed so \"exposes\" should probably read \"exposed\"","commit_id":"376a44fec8fd99bbd5dbb3ddf74bbf5d348b68cb"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1b0155c733310c8a4a64e00abd114151e0672d8a","unresolved":false,"context_lines":[{"line_number":6,"context_line":"without disabling IPv6. In Linux, link-local IPv6 addresses are assigned to all"},{"line_number":7,"context_line":"active interfaces which exposes them to the tenant networks. This is a"},{"line_number":8,"context_line":"significant difference compared to the IPv4 addresses where an administrator"},{"line_number":9,"context_line":"must configure them explicitly."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"nova, neutron, networking-midonet, Kilo release, Liberty release"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa7ab95a_b6e6d5e5","line":9,"updated":"2016-08-30 11:02:56.000000000","message":"administrator must explicitly configure access to the host from Neutron IPv4 interfaces?","commit_id":"376a44fec8fd99bbd5dbb3ddf74bbf5d348b68cb"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1b0155c733310c8a4a64e00abd114151e0672d8a","unresolved":false,"context_lines":[{"line_number":9,"context_line":"must configure them explicitly."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"nova, neutron, networking-midonet, Kilo release, Liberty release"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Linux assigns link-local IPv6 addresses to all the active interfaces which is"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa7ab95a_7607ed81","line":12,"updated":"2016-08-30 11:02:56.000000000","message":"Generally we don\u0027t include the word \"release\" here","commit_id":"376a44fec8fd99bbd5dbb3ddf74bbf5d348b68cb"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1b0155c733310c8a4a64e00abd114151e0672d8a","unresolved":false,"context_lines":[{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Linux assigns link-local IPv6 addresses to all the active interfaces which is"},{"line_number":16,"context_line":"different in the case of IPv4 addresses where an administrator must configure"},{"line_number":17,"context_line":"them explicitly. Once an interface is enslaved in a bridge, all addresses"},{"line_number":18,"context_line":"assigned to it are ignored and only the addresses on the bridge are active."},{"line_number":19,"context_line":"They are exposed in the LinuxBridgeManager calls `ensure_vlan` and"},{"line_number":20,"context_line":"`ensure_vxlan` where a new VLAN or VXLAN interface is created prior to"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa7ab95a_166ce133","line":17,"updated":"2016-08-30 11:02:56.000000000","message":"Perhaps: Linux assigns link-local IPv6 addresses to all active interfaces. This is different behaviour to IPv4 addresses where an administrator must configure them explicitly.","commit_id":"376a44fec8fd99bbd5dbb3ddf74bbf5d348b68cb"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1b0155c733310c8a4a64e00abd114151e0672d8a","unresolved":false,"context_lines":[{"line_number":20,"context_line":"`ensure_vxlan` where a new VLAN or VXLAN interface is created prior to"},{"line_number":21,"context_line":"enslaving the interfaces in the bridge."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"neutron disables IPv6 on each interface before enabling the interface."},{"line_number":24,"context_line":"This avoids leaving a time window between when the interface is enabled and"},{"line_number":25,"context_line":"when it is attached to a bridge device, during which the host could be"},{"line_number":26,"context_line":"accessible from a tenant network."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa7ab95a_1653016c","line":23,"updated":"2016-08-30 11:02:56.000000000","message":"I think we can capitalize a project name if it\u0027s the start of a sentence.","commit_id":"376a44fec8fd99bbd5dbb3ddf74bbf5d348b68cb"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1b0155c733310c8a4a64e00abd114151e0672d8a","unresolved":false,"context_lines":[{"line_number":21,"context_line":"enslaving the interfaces in the bridge."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"neutron disables IPv6 on each interface before enabling the interface."},{"line_number":24,"context_line":"This avoids leaving a time window between when the interface is enabled and"},{"line_number":25,"context_line":"when it is attached to a bridge device, during which the host could be"},{"line_number":26,"context_line":"accessible from a tenant network."},{"line_number":27,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa7ab95a_d6a19947","line":24,"updated":"2016-08-30 11:02:56.000000000","message":"Avoiding this race condition is good, I\u0027m glad the developers fixed things in this way, I\u0027m not sure the reader needs to know about it though.","commit_id":"376a44fec8fd99bbd5dbb3ddf74bbf5d348b68cb"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1b0155c733310c8a4a64e00abd114151e0672d8a","unresolved":false,"context_lines":[{"line_number":33,"context_line":"to link up. This avoids us from having duplicate IPv6 addresses and also"},{"line_number":34,"context_line":"prevents the host machines from being exposed to the tenant networks."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Instructions:"},{"line_number":37,"context_line":"IPv6 is now disabled by default using root_dev.disable_ipv6() in interface.py"},{"line_number":38,"context_line":"which calls the method common.ip_utils.is_enabled()"},{"line_number":39,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa7ab95a_b6aa5583","line":36,"updated":"2016-08-30 11:02:56.000000000","message":"A new header isn\u0027t required for \"Instructions\"","commit_id":"376a44fec8fd99bbd5dbb3ddf74bbf5d348b68cb"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1b0155c733310c8a4a64e00abd114151e0672d8a","unresolved":false,"context_lines":[{"line_number":57,"context_line":"equivalent to net.ipv6.conf.$IFACE.disable_ipv6 in sysctl.conf"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Reference:"},{"line_number":60,"context_line":"\u003chttps://github.com/openstack/neutron/blob"},{"line_number":61,"context_line":"/38f1ec03f94fc6936fe7ea51471e89d432a68099/neutron/common/ipv6_utils.py#L51-L64\u003e"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa7ab95a_9669d1fb","line":60,"updated":"2016-08-30 11:02:56.000000000","message":"The \u003c\u003e isn\u0027t required.","commit_id":"376a44fec8fd99bbd5dbb3ddf74bbf5d348b68cb"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1b0155c733310c8a4a64e00abd114151e0672d8a","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Reference:"},{"line_number":60,"context_line":"\u003chttps://github.com/openstack/neutron/blob"},{"line_number":61,"context_line":"/38f1ec03f94fc6936fe7ea51471e89d432a68099/neutron/common/ipv6_utils.py#L51-L64\u003e"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":""},{"line_number":64,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa7ab95a_f6285d9c","line":61,"updated":"2016-08-30 11:02:56.000000000","message":"This should be moved to the references section rather than being it\u0027s own line, with a header that says \"Reference\"","commit_id":"376a44fec8fd99bbd5dbb3ddf74bbf5d348b68cb"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"8b37ccb4a1945a9b4be20e461b55114d70242a40","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"In Linux, link-local IPv6 addresses are assigned to all active interfaces,"},{"line_number":10,"context_line":"unlike IPv4 addresses where an administrator must configure each interface"},{"line_number":11,"context_line":"explicitly. This lead to a time window between when the interface is enabled and"},{"line_number":12,"context_line":"when it is attached to bridge device. Within this time window the host could"},{"line_number":13,"context_line":"be accessed from a tenant network."},{"line_number":14,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":10,"id":"fa7ab95a_1d12cf62","line":11,"updated":"2016-08-31 19:19:29.000000000","message":"s/lead/leads/","commit_id":"01bc6e8f20399b0cd4c2672ac501221b8b05d11b"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"8b37ccb4a1945a9b4be20e461b55114d70242a40","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"### Recommended Actions ###"},{"line_number":37,"context_line":"IPv6 should remain disabled for each interface on an instance, before the"},{"line_number":38,"context_line":"interface is brought to link up. If an operator for any given reason, needs to"},{"line_number":39,"context_line":"re-enable link-local IPv6 adreses, they should be aware of the security"},{"line_number":40,"context_line":"implications of allowing tenant networks access of the Host."},{"line_number":41,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":10,"id":"fa7ab95a_60416e39","line":38,"updated":"2016-08-31 19:19:29.000000000","message":"i think there should be another comma here,\n\n    If an operator, for any given reason, needs to...","commit_id":"01bc6e8f20399b0cd4c2672ac501221b8b05d11b"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"4d0996d37ac0102b5c5fc4a544bba711efa28a00","unresolved":false,"context_lines":[{"line_number":42,"context_line":"IPv6 is now disabled by default using root_dev.disable_ipv6() in interface.py,"},{"line_number":43,"context_line":"which calls the method common.ip_utils.is_enabled()"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"We can verify the value of the IPv6 parameters within sysctl.conf of an instance"},{"line_number":46,"context_line":"by using the following command:"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"  $ sysctl -a | grep disable | grep ipv6"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"fa7ab95a_9d2fbfa0","line":45,"updated":"2016-08-31 22:00:32.000000000","message":"of an instance? Isn\u0027t this to configured made on the hypervisor?","commit_id":"01bc6e8f20399b0cd4c2672ac501221b8b05d11b"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"4d0996d37ac0102b5c5fc4a544bba711efa28a00","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"  $ sysctl -a | grep disable | grep ipv6"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"By default the below values for IPv6 will be set to 1 (disabled)"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"  net.ipv6.conf.default.disable_ipv6 \u003d 1"},{"line_number":53,"context_line":"  net.ipv6.conf.$IFACE.disable_ipv6 \u003d 1"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"fa7ab95a_240853d9","line":50,"updated":"2016-08-31 22:00:32.000000000","message":"Which default? On boot these are set to 0, they should be set to 1.","commit_id":"01bc6e8f20399b0cd4c2672ac501221b8b05d11b"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"8af2783b97d450606cae08d817e28f572c324e3b","unresolved":false,"context_lines":[{"line_number":42,"context_line":"IPv6 is now disabled by default using root_dev.disable_ipv6() in interface.py,"},{"line_number":43,"context_line":"which calls the method common.ip_utils.is_enabled()"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"We can verify the value of the IPv6 parameters within sysctl.conf of an instance"},{"line_number":46,"context_line":"by using the following command:"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"  $ sysctl -a | grep disable | grep ipv6"}],"source_content_type":"application/octet-stream","patch_set":11,"id":"fa7ab95a_7544c71a","line":45,"updated":"2016-08-31 23:14:19.000000000","message":"of an instance? Isn\u0027t this to configured made on the hypervisor?","commit_id":"9c5aff8cf35ec610a30a1288220b716c5852036f"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"8af2783b97d450606cae08d817e28f572c324e3b","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"  $ sysctl -a | grep disable | grep ipv6"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"By default the below values for IPv6 will be set to 1 (disabled)"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"  net.ipv6.conf.default.disable_ipv6 \u003d 1"},{"line_number":53,"context_line":"  net.ipv6.conf.$IFACE.disable_ipv6 \u003d 1"}],"source_content_type":"application/octet-stream","patch_set":11,"id":"fa7ab95a_95f94bcb","line":50,"range":{"start_line":50,"start_character":56,"end_line":50,"end_character":57},"updated":"2016-08-31 23:14:19.000000000","message":"By default when Linux boots these are set to 0 (before any distribution provided sysctl settings are applied), we are recommending the operator set them to 1.","commit_id":"9c5aff8cf35ec610a30a1288220b716c5852036f"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e7b906b155ccb51f223ca31ee1f42fe183fd4f89","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"New interfaces created by neutron in the default namespace, were done so"},{"line_number":6,"context_line":"without disabling IPv6 link-local addresses. This resulted in instances"},{"line_number":7,"context_line":"gaining the ability to directly access the Host OS, therefore breaking"},{"line_number":8,"context_line":"guest isolation."}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_9e84ca0b","line":5,"range":{"start_line":5,"start_character":26,"end_line":5,"end_character":33},"updated":"2016-09-01 21:52:13.000000000","message":"I believe the consensus was to capitalize project names in OSSNs, so this would be Neutron","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2a7705fa1ca0a7023b2c268e2e4c7bb837df1d74","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"New interfaces created by neutron in the default namespace, were done so"},{"line_number":6,"context_line":"without disabling IPv6 link-local addresses. This resulted in instances"},{"line_number":7,"context_line":"gaining the ability to directly access the Host OS, therefore breaking"},{"line_number":8,"context_line":"guest isolation."}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_51cce288","line":5,"range":{"start_line":5,"start_character":26,"end_line":5,"end_character":33},"in_reply_to":"fa7ab95a_9e84ca0b","updated":"2016-09-02 08:50:36.000000000","message":"We did originally have them capitalised, but someone made a nit about them being lower case. I am with you here and prefer them upper (it looks much better)","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e7b906b155ccb51f223ca31ee1f42fe183fd4f89","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"New interfaces created by neutron in the default namespace, were done so"},{"line_number":6,"context_line":"without disabling IPv6 link-local addresses. This resulted in instances"},{"line_number":7,"context_line":"gaining the ability to directly access the Host OS, therefore breaking"},{"line_number":8,"context_line":"guest isolation."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"In Linux, link-local IPv6 addresses are assigned to all active"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_fe73164c","line":7,"range":{"start_line":7,"start_character":43,"end_line":7,"end_character":47},"updated":"2016-09-01 21:52:13.000000000","message":"Lowercase h on host","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2a7705fa1ca0a7023b2c268e2e4c7bb837df1d74","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"New interfaces created by neutron in the default namespace, were done so"},{"line_number":6,"context_line":"without disabling IPv6 link-local addresses. This resulted in instances"},{"line_number":7,"context_line":"gaining the ability to directly access the Host OS, therefore breaking"},{"line_number":8,"context_line":"guest isolation."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"In Linux, link-local IPv6 addresses are assigned to all active"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_b1a1aeab","line":7,"range":{"start_line":7,"start_character":43,"end_line":7,"end_character":47},"in_reply_to":"fa7ab95a_fe73164c","updated":"2016-09-02 08:50:36.000000000","message":"Done","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e7b906b155ccb51f223ca31ee1f42fe183fd4f89","unresolved":false,"context_lines":[{"line_number":13,"context_line":"interface is enabled and when it is attached to bridge device. Within"},{"line_number":14,"context_line":"this time window the host could be accessed from a tenant network."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"IPv6 is now disabled automatically by both neutron and nova, prior to"},{"line_number":17,"context_line":"bringing any links up, however operators should still be aware of the"},{"line_number":18,"context_line":"security risks associated with re-enabling IPv6 link-local addresses."},{"line_number":19,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_3eb73ed9","line":16,"range":{"start_line":16,"start_character":43,"end_line":16,"end_character":50},"updated":"2016-09-01 21:52:13.000000000","message":"Neutron and Nova","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2a7705fa1ca0a7023b2c268e2e4c7bb837df1d74","unresolved":false,"context_lines":[{"line_number":13,"context_line":"interface is enabled and when it is attached to bridge device. Within"},{"line_number":14,"context_line":"this time window the host could be accessed from a tenant network."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"IPv6 is now disabled automatically by both neutron and nova, prior to"},{"line_number":17,"context_line":"bringing any links up, however operators should still be aware of the"},{"line_number":18,"context_line":"security risks associated with re-enabling IPv6 link-local addresses."},{"line_number":19,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_d1a632c0","line":16,"range":{"start_line":16,"start_character":43,"end_line":16,"end_character":50},"in_reply_to":"fa7ab95a_3eb73ed9","updated":"2016-09-02 08:50:36.000000000","message":"Done","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e7b906b155ccb51f223ca31ee1f42fe183fd4f89","unresolved":false,"context_lines":[{"line_number":18,"context_line":"security risks associated with re-enabling IPv6 link-local addresses."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### Affected Services / Software ###"},{"line_number":21,"context_line":"nova, neutron, networking-midonet, Kilo, Liberty"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"### Discussion ###"},{"line_number":24,"context_line":"Linux assigns link-local IPv6 addresses to all the active interfaces,"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_dec81258","line":21,"range":{"start_line":21,"start_character":0,"end_line":21,"end_character":4},"updated":"2016-09-01 21:52:13.000000000","message":"Nova, Neutron - I\u0027m not usre about the networking-midonet...","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2a7705fa1ca0a7023b2c268e2e4c7bb837df1d74","unresolved":false,"context_lines":[{"line_number":18,"context_line":"security risks associated with re-enabling IPv6 link-local addresses."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### Affected Services / Software ###"},{"line_number":21,"context_line":"nova, neutron, networking-midonet, Kilo, Liberty"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"### Discussion ###"},{"line_number":24,"context_line":"Linux assigns link-local IPv6 addresses to all the active interfaces,"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_5193025b","line":21,"range":{"start_line":21,"start_character":0,"end_line":21,"end_character":4},"in_reply_to":"fa7ab95a_dec81258","updated":"2016-09-02 08:50:36.000000000","message":"There was fix applied to networking-midonet as well.","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e7b906b155ccb51f223ca31ee1f42fe183fd4f89","unresolved":false,"context_lines":[{"line_number":30,"context_line":"VLAN or VXLAN interface is created prior to enslaving the interfaces in"},{"line_number":31,"context_line":"the bridge."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Both neutron and nova now disable IPv6 on all interfaces before bringing"},{"line_number":34,"context_line":"the interface up. This avoids exposing a time window between when the"},{"line_number":35,"context_line":"interface is enabled and when it is attached to a bridge device, during"},{"line_number":36,"context_line":"which time the host could be accessible from a tenant network."}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_9ee92aba","line":33,"range":{"start_line":33,"start_character":5,"end_line":33,"end_character":21},"updated":"2016-09-01 21:52:13.000000000","message":"Neutron and Nova","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2a7705fa1ca0a7023b2c268e2e4c7bb837df1d74","unresolved":false,"context_lines":[{"line_number":30,"context_line":"VLAN or VXLAN interface is created prior to enslaving the interfaces in"},{"line_number":31,"context_line":"the bridge."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Both neutron and nova now disable IPv6 on all interfaces before bringing"},{"line_number":34,"context_line":"the interface up. This avoids exposing a time window between when the"},{"line_number":35,"context_line":"interface is enabled and when it is attached to a bridge device, during"},{"line_number":36,"context_line":"which time the host could be accessible from a tenant network."}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_91990a7c","line":33,"range":{"start_line":33,"start_character":5,"end_line":33,"end_character":21},"in_reply_to":"fa7ab95a_9ee92aba","updated":"2016-09-02 08:50:36.000000000","message":"Done","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e7b906b155ccb51f223ca31ee1f42fe183fd4f89","unresolved":false,"context_lines":[{"line_number":40,"context_line":"the interface is brought to link up. If an operator, for any given"},{"line_number":41,"context_line":"reason, needs to re-enable link-local IPv6 adreses, they should be aware"},{"line_number":42,"context_line":"of the security implications of allowing tenant networks access of the"},{"line_number":43,"context_line":"Host."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"IPv6 is now disabled by default using root_dev.disable_ipv6() in"},{"line_number":46,"context_line":"interface.py, which calls the method common.ip_utils.is_enabled()"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_de8732b3","line":43,"range":{"start_line":43,"start_character":0,"end_line":43,"end_character":4},"updated":"2016-09-01 21:52:13.000000000","message":"host","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2a7705fa1ca0a7023b2c268e2e4c7bb837df1d74","unresolved":false,"context_lines":[{"line_number":40,"context_line":"the interface is brought to link up. If an operator, for any given"},{"line_number":41,"context_line":"reason, needs to re-enable link-local IPv6 adreses, they should be aware"},{"line_number":42,"context_line":"of the security implications of allowing tenant networks access of the"},{"line_number":43,"context_line":"Host."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"IPv6 is now disabled by default using root_dev.disable_ipv6() in"},{"line_number":46,"context_line":"interface.py, which calls the method common.ip_utils.is_enabled()"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_b188ce23","line":43,"range":{"start_line":43,"start_character":0,"end_line":43,"end_character":4},"in_reply_to":"fa7ab95a_de8732b3","updated":"2016-09-02 08:50:36.000000000","message":"Done","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e7b906b155ccb51f223ca31ee1f42fe183fd4f89","unresolved":false,"context_lines":[{"line_number":56,"context_line":"  net.ipv6.conf.$IFACE.disable_ipv6 \u003d 1"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Here $IFACE refers to the interface for which the IPv6 is disabled by"},{"line_number":59,"context_line":"default in neutron."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Note: The value set at /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6 is"},{"line_number":62,"context_line":"equivalent to net.ipv6.conf.$IFACE.disable_ipv6 in sysctl.conf"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_9ea12a49","line":59,"range":{"start_line":59,"start_character":11,"end_line":59,"end_character":18},"updated":"2016-09-01 21:52:13.000000000","message":"Neutron","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2a7705fa1ca0a7023b2c268e2e4c7bb837df1d74","unresolved":false,"context_lines":[{"line_number":56,"context_line":"  net.ipv6.conf.$IFACE.disable_ipv6 \u003d 1"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Here $IFACE refers to the interface for which the IPv6 is disabled by"},{"line_number":59,"context_line":"default in neutron."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Note: The value set at /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6 is"},{"line_number":62,"context_line":"equivalent to net.ipv6.conf.$IFACE.disable_ipv6 in sysctl.conf"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"fa7ab95a_d18d5232","line":59,"range":{"start_line":59,"start_character":11,"end_line":59,"end_character":18},"in_reply_to":"fa7ab95a_9ea12a49","updated":"2016-09-02 08:50:36.000000000","message":"Done","commit_id":"b16384c3f9fe040ae275176009cd3b550a22984b"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"0d81eb2b953a3c1ff4309ae4dd90d150628a98af","unresolved":false,"context_lines":[{"line_number":12,"context_line":"and when it is attached to bridge device. Within this time window the host"},{"line_number":13,"context_line":"could be accessed from a tenant network."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"IPv6 is now disabled automatically by both Neutron and nova, prior to bringing"},{"line_number":16,"context_line":"any links up, however operators should still be aware of the security risks"},{"line_number":17,"context_line":"associated with re-enabling IPv6 link-local addresses."},{"line_number":18,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":16,"id":"da7fb54a_67762640","line":15,"range":{"start_line":15,"start_character":55,"end_line":15,"end_character":59},"updated":"2016-09-02 15:57:14.000000000","message":"nit: Nova","commit_id":"45ecd716a465543b815c32e24d4f190bc55dad01"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"1db6ffcdcdb18753fec7fa99c1ab40a282e99652","unresolved":false,"context_lines":[{"line_number":12,"context_line":"and when it is attached to bridge device. Within this time window the host"},{"line_number":13,"context_line":"could be accessed from a tenant network."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"IPv6 is now disabled automatically by both Neutron and nova, prior to bringing"},{"line_number":16,"context_line":"any links up, however operators should still be aware of the security risks"},{"line_number":17,"context_line":"associated with re-enabling IPv6 link-local addresses."},{"line_number":18,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":16,"id":"da7fb54a_07171a52","line":15,"range":{"start_line":15,"start_character":55,"end_line":15,"end_character":59},"in_reply_to":"da7fb54a_67762640","updated":"2016-09-02 16:01:09.000000000","message":"Done","commit_id":"45ecd716a465543b815c32e24d4f190bc55dad01"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"0d81eb2b953a3c1ff4309ae4dd90d150628a98af","unresolved":false,"context_lines":[{"line_number":28,"context_line":"`ensure_vxlan` where a new VLAN or VXLAN interface is created prior to"},{"line_number":29,"context_line":"enslaving the interfaces in the bridge."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Both Neutron and nova now disable IPv6 on all interfaces before bringing the"},{"line_number":32,"context_line":"interface up. This avoids exposing a time window between when the interface is"},{"line_number":33,"context_line":"enabled and when it is attached to a bridge device, during which time the"},{"line_number":34,"context_line":"host could be accessible from a tenant network."}],"source_content_type":"application/octet-stream","patch_set":16,"id":"da7fb54a_c7ba92c0","line":31,"range":{"start_line":31,"start_character":17,"end_line":31,"end_character":21},"updated":"2016-09-02 15:57:14.000000000","message":"nit: Nova","commit_id":"45ecd716a465543b815c32e24d4f190bc55dad01"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"1db6ffcdcdb18753fec7fa99c1ab40a282e99652","unresolved":false,"context_lines":[{"line_number":28,"context_line":"`ensure_vxlan` where a new VLAN or VXLAN interface is created prior to"},{"line_number":29,"context_line":"enslaving the interfaces in the bridge."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Both Neutron and nova now disable IPv6 on all interfaces before bringing the"},{"line_number":32,"context_line":"interface up. This avoids exposing a time window between when the interface is"},{"line_number":33,"context_line":"enabled and when it is attached to a bridge device, during which time the"},{"line_number":34,"context_line":"host could be accessible from a tenant network."}],"source_content_type":"application/octet-stream","patch_set":16,"id":"da7fb54a_47092231","line":31,"range":{"start_line":31,"start_character":17,"end_line":31,"end_character":21},"in_reply_to":"da7fb54a_c7ba92c0","updated":"2016-09-02 16:01:09.000000000","message":"Done","commit_id":"45ecd716a465543b815c32e24d4f190bc55dad01"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"0d81eb2b953a3c1ff4309ae4dd90d150628a98af","unresolved":false,"context_lines":[{"line_number":62,"context_line":"Author: Vinay Potluri, Intel \u0026 Luke Hinds, Red Hat"},{"line_number":63,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0069"},{"line_number":64,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1534652"},{"line_number":65,"context_line":"This issue was referenced in https://bugs.launchpad.net/Neutron/+bug/1459856"},{"line_number":66,"context_line":"Related issue addressed in Nova: https://review.openstack.org/#/c/313070/"},{"line_number":67,"context_line":"OpenStack Security ML : openstack-dev@lists.openstack.org"},{"line_number":68,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":16,"id":"da7fb54a_67db861c","line":65,"range":{"start_line":65,"start_character":56,"end_line":65,"end_character":63},"updated":"2016-09-02 15:57:14.000000000","message":"nit: neutron in URL","commit_id":"45ecd716a465543b815c32e24d4f190bc55dad01"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"1db6ffcdcdb18753fec7fa99c1ab40a282e99652","unresolved":false,"context_lines":[{"line_number":62,"context_line":"Author: Vinay Potluri, Intel \u0026 Luke Hinds, Red Hat"},{"line_number":63,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0069"},{"line_number":64,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1534652"},{"line_number":65,"context_line":"This issue was referenced in https://bugs.launchpad.net/Neutron/+bug/1459856"},{"line_number":66,"context_line":"Related issue addressed in Nova: https://review.openstack.org/#/c/313070/"},{"line_number":67,"context_line":"OpenStack Security ML : openstack-dev@lists.openstack.org"},{"line_number":68,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":16,"id":"da7fb54a_67062622","line":65,"range":{"start_line":65,"start_character":56,"end_line":65,"end_character":63},"in_reply_to":"da7fb54a_67db861c","updated":"2016-09-02 16:01:09.000000000","message":"Done","commit_id":"45ecd716a465543b815c32e24d4f190bc55dad01"},{"author":{"_account_id":14611,"name":"dasm","display_name":"dasm","email":"dsmigiel@redhat.com","username":"dasm"},"change_message_id":"2faeef3387050de1e04375f1d5fd910243b34aac","unresolved":false,"context_lines":[{"line_number":17,"context_line":"associated with re-enabling IPv6 link-local addresses."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"### Affected Services / Software ###"},{"line_number":20,"context_line":"Nova, Neutron, networking-midonet, Kilo, Liberty"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### Discussion ###"},{"line_number":23,"context_line":"Linux assigns link-local IPv6 addresses to all the active interfaces, which is"}],"source_content_type":"application/octet-stream","patch_set":18,"id":"9a89bdaa_e2c9cd79","line":20,"range":{"start_line":20,"start_character":0,"end_line":20,"end_character":48},"updated":"2016-09-06 19:33:58.000000000","message":"Bugfix for this issue was backported to Kilo [1] and Liberty [2], so this is no longer affected.\nShouldn\u0027t it be reflected in Notes?\n\n[1] https://review.openstack.org/#/c/296659/ \n[2] https://review.openstack.org/#/c/291275/","commit_id":"2b0f0220f7d51d5c6d4aefdfd26c07c124cb0e40"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"b597954958f77e268bb39cc2a52368023170c751","unresolved":false,"context_lines":[{"line_number":17,"context_line":"associated with re-enabling IPv6 link-local addresses."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"### Affected Services / Software ###"},{"line_number":20,"context_line":"Nova, Neutron, networking-midonet, Kilo, Liberty"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### Discussion ###"},{"line_number":23,"context_line":"Linux assigns link-local IPv6 addresses to all the active interfaces, which is"}],"source_content_type":"application/octet-stream","patch_set":18,"id":"9a89bdaa_f1a8948e","line":20,"range":{"start_line":20,"start_character":0,"end_line":20,"end_character":48},"in_reply_to":"9a89bdaa_e2c9cd79","updated":"2016-09-07 12:01:55.000000000","message":"So the essence of this note, is highlighting the risk of re-enabling ipv6 on the default namespace to operators, more then a past tense on the fix being applied.","commit_id":"2b0f0220f7d51d5c6d4aefdfd26c07c124cb0e40"},{"author":{"_account_id":14611,"name":"dasm","display_name":"dasm","email":"dsmigiel@redhat.com","username":"dasm"},"change_message_id":"a0fae6eaa7a78ca9684a3258379a596c80510ded","unresolved":false,"context_lines":[{"line_number":17,"context_line":"associated with re-enabling IPv6 link-local addresses."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"### Affected Services / Software ###"},{"line_number":20,"context_line":"Nova, Neutron, networking-midonet, Kilo, Liberty"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### Discussion ###"},{"line_number":23,"context_line":"Linux assigns link-local IPv6 addresses to all the active interfaces, which is"}],"source_content_type":"application/octet-stream","patch_set":18,"id":"9a89bdaa_d42c5e9b","line":20,"range":{"start_line":20,"start_character":0,"end_line":20,"end_character":48},"in_reply_to":"9a89bdaa_f1a8948e","updated":"2016-09-07 12:11:23.000000000","message":"OK, gotcha :)","commit_id":"2b0f0220f7d51d5c6d4aefdfd26c07c124cb0e40"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"1e942550d2934b33f478afb1a3a9ecb46397bffe","unresolved":false,"context_lines":[{"line_number":34,"context_line":"host could be accessible from a tenant network."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"### Recommended Actions ###"},{"line_number":37,"context_line":"IPv6 should remain disabled for each interface on an instance, before the"},{"line_number":38,"context_line":"interface is brought to link up. If an operator, for any given reason, needs to"},{"line_number":39,"context_line":"re-enable link-local IPv6 addresses, they should be aware of the security"},{"line_number":40,"context_line":"implications of allowing tenant networks access of the host."}],"source_content_type":"application/octet-stream","patch_set":18,"id":"9a89bdaa_3d2af47e","line":37,"updated":"2016-09-06 19:57:12.000000000","message":"\u0027instance\u0027 doesn\u0027t seem correct here as we\u0027re talking about the host OS, I always think of instance as a VM.  Since the problem is with the VM getting access to the host OS via the IPv6 address on the tap device, maybe \"... interface associated with an instance...\" is better?","commit_id":"2b0f0220f7d51d5c6d4aefdfd26c07c124cb0e40"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"a38d46756658d37e011f1a44a86b007a154d81a1","unresolved":false,"context_lines":[{"line_number":34,"context_line":"host could be accessible from a tenant network."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"### Recommended Actions ###"},{"line_number":37,"context_line":"IPv6 should remain disabled for each interface on an instance, before the"},{"line_number":38,"context_line":"interface is brought to link up. If an operator, for any given reason, needs to"},{"line_number":39,"context_line":"re-enable link-local IPv6 addresses, they should be aware of the security"},{"line_number":40,"context_line":"implications of allowing tenant networks access of the host."}],"source_content_type":"application/octet-stream","patch_set":18,"id":"9a89bdaa_717564f8","line":37,"in_reply_to":"9a89bdaa_3d2af47e","updated":"2016-09-07 12:05:37.000000000","message":"Done","commit_id":"2b0f0220f7d51d5c6d4aefdfd26c07c124cb0e40"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"1e942550d2934b33f478afb1a3a9ecb46397bffe","unresolved":false,"context_lines":[{"line_number":52,"context_line":"  net.ipv6.conf.default.disable_ipv6 \u003d 1"},{"line_number":53,"context_line":"  net.ipv6.conf.$IFACE.disable_ipv6 \u003d 1"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Here $IFACE refers to the interface for which the IPv6 is disabled by default"},{"line_number":56,"context_line":"in Neutron."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Note: The value set at /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6 is"}],"source_content_type":"application/octet-stream","patch_set":18,"id":"9a89bdaa_bd3604e5","line":55,"updated":"2016-09-06 19:57:12.000000000","message":"s/the IPv6/IPv6","commit_id":"2b0f0220f7d51d5c6d4aefdfd26c07c124cb0e40"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"a38d46756658d37e011f1a44a86b007a154d81a1","unresolved":false,"context_lines":[{"line_number":52,"context_line":"  net.ipv6.conf.default.disable_ipv6 \u003d 1"},{"line_number":53,"context_line":"  net.ipv6.conf.$IFACE.disable_ipv6 \u003d 1"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Here $IFACE refers to the interface for which the IPv6 is disabled by default"},{"line_number":56,"context_line":"in Neutron."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Note: The value set at /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6 is"}],"source_content_type":"application/octet-stream","patch_set":18,"id":"9a89bdaa_d1663050","line":55,"in_reply_to":"9a89bdaa_bd3604e5","updated":"2016-09-07 12:05:37.000000000","message":"Done","commit_id":"2b0f0220f7d51d5c6d4aefdfd26c07c124cb0e40"},{"author":{"_account_id":14611,"name":"dasm","display_name":"dasm","email":"dsmigiel@redhat.com","username":"dasm"},"change_message_id":"e1cd7ca6f57201a76094bc52fc1b376f982600cf","unresolved":false,"context_lines":[{"line_number":12,"context_line":"and when it is attached to bridge device. Within this time window the host"},{"line_number":13,"context_line":"could be accessed from a tenant network."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"IPv6 is now disabled automatically by both Neutron and nova, prior to bringing"},{"line_number":16,"context_line":"any links up, however operators should still be aware of the security risks"},{"line_number":17,"context_line":"associated with re-enabling IPv6 link-local addresses."},{"line_number":18,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":20,"id":"9a89bdaa_7d8b69c3","line":15,"range":{"start_line":15,"start_character":55,"end_line":15,"end_character":59},"updated":"2016-09-07 15:25:07.000000000","message":"nit: i\u0027ve seen comment, that all project names should be lower case, or upper. Could you be consistent?","commit_id":"1b9a74e8e8fb2aa424feec2d1828e861a469123c"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2ec4ef8572a31093ab42f3ebd04a46b6236c5b01","unresolved":false,"context_lines":[{"line_number":12,"context_line":"and when it is attached to bridge device. Within this time window the host"},{"line_number":13,"context_line":"could be accessed from a tenant network."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"IPv6 is now disabled automatically by both Neutron and nova, prior to bringing"},{"line_number":16,"context_line":"any links up, however operators should still be aware of the security risks"},{"line_number":17,"context_line":"associated with re-enabling IPv6 link-local addresses."},{"line_number":18,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":20,"id":"9a89bdaa_605bc2f6","line":15,"range":{"start_line":15,"start_character":55,"end_line":15,"end_character":59},"in_reply_to":"9a89bdaa_7d8b69c3","updated":"2016-09-07 15:28:34.000000000","message":"Done","commit_id":"1b9a74e8e8fb2aa424feec2d1828e861a469123c"},{"author":{"_account_id":14611,"name":"dasm","display_name":"dasm","email":"dsmigiel@redhat.com","username":"dasm"},"change_message_id":"e1cd7ca6f57201a76094bc52fc1b376f982600cf","unresolved":false,"context_lines":[{"line_number":28,"context_line":"`ensure_vxlan` where a new VLAN or VXLAN interface is created prior to"},{"line_number":29,"context_line":"enslaving the interfaces in the bridge."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Both Neutron and nova now disable IPv6 on all interfaces before bringing the"},{"line_number":32,"context_line":"interface up. This avoids exposing a time window between when the interface is"},{"line_number":33,"context_line":"enabled and when it is attached to a bridge device, during which time the"},{"line_number":34,"context_line":"host could be accessible from a tenant network."}],"source_content_type":"application/octet-stream","patch_set":20,"id":"9a89bdaa_3d39e1f2","line":31,"range":{"start_line":31,"start_character":17,"end_line":31,"end_character":21},"updated":"2016-09-07 15:25:07.000000000","message":"ditto","commit_id":"1b9a74e8e8fb2aa424feec2d1828e861a469123c"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"2ec4ef8572a31093ab42f3ebd04a46b6236c5b01","unresolved":false,"context_lines":[{"line_number":28,"context_line":"`ensure_vxlan` where a new VLAN or VXLAN interface is created prior to"},{"line_number":29,"context_line":"enslaving the interfaces in the bridge."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Both Neutron and nova now disable IPv6 on all interfaces before bringing the"},{"line_number":32,"context_line":"interface up. This avoids exposing a time window between when the interface is"},{"line_number":33,"context_line":"enabled and when it is attached to a bridge device, during which time the"},{"line_number":34,"context_line":"host could be accessible from a tenant network."}],"source_content_type":"application/octet-stream","patch_set":20,"id":"9a89bdaa_a0f86ac4","line":31,"range":{"start_line":31,"start_character":17,"end_line":31,"end_character":21},"in_reply_to":"9a89bdaa_3d39e1f2","updated":"2016-09-07 15:28:34.000000000","message":"Done","commit_id":"1b9a74e8e8fb2aa424feec2d1828e861a469123c"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"206fed371ba9e476a40d8716c11812f07b771dc0","unresolved":false,"context_lines":[{"line_number":62,"context_line":"Author: Vinay Potluri, Intel \u0026 Luke Hinds, Red Hat"},{"line_number":63,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0069"},{"line_number":64,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1534652"},{"line_number":65,"context_line":"This issue was referenced in https://bugs.launchpad.net/Neutron/+bug/1459856"},{"line_number":66,"context_line":"Related issue addressed in Nova: https://review.openstack.org/#/c/313070/"},{"line_number":67,"context_line":"OpenStack Security ML : openstack-dev@lists.openstack.org"},{"line_number":68,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"}],"source_content_type":"application/octet-stream","patch_set":23,"id":"9a89bdaa_2cc8d1a7","line":65,"range":{"start_line":65,"start_character":56,"end_line":65,"end_character":63},"updated":"2016-09-07 16:20:31.000000000","message":"nit: Launchpad uses lowercase neutron in URL, but either works.","commit_id":"6741ae574aadf2fa1fba57a579129a8f511917d7"}],"security-notes/OSSN-0072":[{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"e742443265eafb78415ab43b0e5ffb96c8ef8777","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux local IPV6 addresses are assigned to all interfaces which is"},{"line_number":7,"context_line":"slightly different from IPV4 addresses where an administrator must configure"},{"line_number":8,"context_line":"explicitly."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_20eba179","line":6,"updated":"2016-08-17 21:04:25.000000000","message":"need a comma, \"In Linux, local ...\"","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a9c12c6faf60c2cbc344b055c5a2f283b7f5eb23","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux local IPV6 addresses are assigned to all interfaces which is"},{"line_number":7,"context_line":"slightly different from IPV4 addresses where an administrator must configure"},{"line_number":8,"context_line":"explicitly."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_5bc32e89","line":6,"in_reply_to":"3ac371cc_20eba179","updated":"2016-08-17 22:05:33.000000000","message":"Done","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"51fd20eb0516f7c6408b3e3fb97a953f15b2dfd4","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux local IPV6 addresses are assigned to all interfaces which is"},{"line_number":7,"context_line":"slightly different from IPV4 addresses where an administrator must configure"},{"line_number":8,"context_line":"explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_3cc4693e","line":7,"updated":"2016-08-17 21:29:38.000000000","message":"Can we add a sentence making the security impact explicit?","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a9c12c6faf60c2cbc344b055c5a2f283b7f5eb23","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux local IPV6 addresses are assigned to all interfaces which is"},{"line_number":7,"context_line":"slightly different from IPV4 addresses where an administrator must configure"},{"line_number":8,"context_line":"explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_02178648","line":7,"in_reply_to":"3ac371cc_3cc4693e","updated":"2016-08-17 22:05:33.000000000","message":"Done","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"e742443265eafb78415ab43b0e5ffb96c8ef8777","unresolved":false,"context_lines":[{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux local IPV6 addresses are assigned to all interfaces which is"},{"line_number":7,"context_line":"slightly different from IPV4 addresses where an administrator must configure"},{"line_number":8,"context_line":"explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Networking-midonet, Kilo release"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_6088f9c5","line":8,"updated":"2016-08-17 21:04:25.000000000","message":"i think this would read better as \"must configure them explicitly\"","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a9c12c6faf60c2cbc344b055c5a2f283b7f5eb23","unresolved":false,"context_lines":[{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux local IPV6 addresses are assigned to all interfaces which is"},{"line_number":7,"context_line":"slightly different from IPV4 addresses where an administrator must configure"},{"line_number":8,"context_line":"explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Networking-midonet, Kilo release"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_fb5f7ae2","line":8,"in_reply_to":"3ac371cc_6088f9c5","updated":"2016-08-17 22:05:33.000000000","message":"Done","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"e742443265eafb78415ab43b0e5ffb96c8ef8777","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Linux assigns local IPV6 addresses to all the interfaces before they are"},{"line_number":15,"context_line":"enslaved in a bridge. It is exposed in LinuxBridgeManager ensure_vlan() and"},{"line_number":16,"context_line":"ensure_vxlan() where a new VLAN or VXLAN interface is created prior to"},{"line_number":17,"context_line":"enslaving interfaces in the bridge. For compute nodes there is a certain delay"},{"line_number":18,"context_line":"from the time the interfaces connect to the tenant network and until they are"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_a0531138","line":15,"updated":"2016-08-17 21:04:25.000000000","message":"i might rephrase this as \"They are exposed in the LinuxBridgeManager calls `ensure_vlan` and `ensure_vxlan` where a new VLAN or VXLAN interface is created prior to enslaving the interfaces in the bridge\"","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a9c12c6faf60c2cbc344b055c5a2f283b7f5eb23","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Linux assigns local IPV6 addresses to all the interfaces before they are"},{"line_number":15,"context_line":"enslaved in a bridge. It is exposed in LinuxBridgeManager ensure_vlan() and"},{"line_number":16,"context_line":"ensure_vxlan() where a new VLAN or VXLAN interface is created prior to"},{"line_number":17,"context_line":"enslaving interfaces in the bridge. For compute nodes there is a certain delay"},{"line_number":18,"context_line":"from the time the interfaces connect to the tenant network and until they are"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_f6614f3a","line":15,"in_reply_to":"3ac371cc_a0531138","updated":"2016-08-17 22:05:33.000000000","message":"Done","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"e742443265eafb78415ab43b0e5ffb96c8ef8777","unresolved":false,"context_lines":[{"line_number":15,"context_line":"enslaved in a bridge. It is exposed in LinuxBridgeManager ensure_vlan() and"},{"line_number":16,"context_line":"ensure_vxlan() where a new VLAN or VXLAN interface is created prior to"},{"line_number":17,"context_line":"enslaving interfaces in the bridge. For compute nodes there is a certain delay"},{"line_number":18,"context_line":"from the time the interfaces connect to the tenant network and until they are"},{"line_number":19,"context_line":"enslaved in the bridge. If the time window is less, then a check for duplicate"},{"line_number":20,"context_line":"IPV6 addresses can be performed but it would be impractical under high loads."},{"line_number":21,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_001ae57c","line":18,"updated":"2016-08-17 21:04:25.000000000","message":"s/network and until/network until/","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a9c12c6faf60c2cbc344b055c5a2f283b7f5eb23","unresolved":false,"context_lines":[{"line_number":15,"context_line":"enslaved in a bridge. It is exposed in LinuxBridgeManager ensure_vlan() and"},{"line_number":16,"context_line":"ensure_vxlan() where a new VLAN or VXLAN interface is created prior to"},{"line_number":17,"context_line":"enslaving interfaces in the bridge. For compute nodes there is a certain delay"},{"line_number":18,"context_line":"from the time the interfaces connect to the tenant network and until they are"},{"line_number":19,"context_line":"enslaved in the bridge. If the time window is less, then a check for duplicate"},{"line_number":20,"context_line":"IPV6 addresses can be performed but it would be impractical under high loads."},{"line_number":21,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_b67517fb","line":18,"in_reply_to":"3ac371cc_001ae57c","updated":"2016-08-17 22:05:33.000000000","message":"Done","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"e742443265eafb78415ab43b0e5ffb96c8ef8777","unresolved":false,"context_lines":[{"line_number":16,"context_line":"ensure_vxlan() where a new VLAN or VXLAN interface is created prior to"},{"line_number":17,"context_line":"enslaving interfaces in the bridge. For compute nodes there is a certain delay"},{"line_number":18,"context_line":"from the time the interfaces connect to the tenant network and until they are"},{"line_number":19,"context_line":"enslaved in the bridge. If the time window is less, then a check for duplicate"},{"line_number":20,"context_line":"IPV6 addresses can be performed but it would be impractical under high loads."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_800ed538","line":19,"updated":"2016-08-17 21:04:25.000000000","message":"s/is less/is less than the delay/","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a9c12c6faf60c2cbc344b055c5a2f283b7f5eb23","unresolved":false,"context_lines":[{"line_number":16,"context_line":"ensure_vxlan() where a new VLAN or VXLAN interface is created prior to"},{"line_number":17,"context_line":"enslaving interfaces in the bridge. For compute nodes there is a certain delay"},{"line_number":18,"context_line":"from the time the interfaces connect to the tenant network and until they are"},{"line_number":19,"context_line":"enslaved in the bridge. If the time window is less, then a check for duplicate"},{"line_number":20,"context_line":"IPV6 addresses can be performed but it would be impractical under high loads."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### Recommended Actions ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_566ca334","line":19,"in_reply_to":"3ac371cc_800ed538","updated":"2016-08-17 22:05:33.000000000","message":"Done","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"e742443265eafb78415ab43b0e5ffb96c8ef8777","unresolved":false,"context_lines":[{"line_number":23,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":24,"context_line":"interface is linked up. Existing bridge interfaces disable IPV6 themselves but"},{"line_number":25,"context_line":"Neutron interfaces with default namespaces should be configured in a way that"},{"line_number":26,"context_line":"IPV6 addresses are not assigned before the interfaces are linked up."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_db2c3e9b","line":26,"updated":"2016-08-17 21:04:25.000000000","message":"this sounds kinda tricky, is there any extended advice on how an operator might perform this action?","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a9c12c6faf60c2cbc344b055c5a2f283b7f5eb23","unresolved":false,"context_lines":[{"line_number":23,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":24,"context_line":"interface is linked up. Existing bridge interfaces disable IPV6 themselves but"},{"line_number":25,"context_line":"Neutron interfaces with default namespaces should be configured in a way that"},{"line_number":26,"context_line":"IPV6 addresses are not assigned before the interfaces are linked up."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_9fd3cfd4","line":26,"in_reply_to":"3ac371cc_3cdbc91c","updated":"2016-08-17 22:05:33.000000000","message":"Done","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"51fd20eb0516f7c6408b3e3fb97a953f15b2dfd4","unresolved":false,"context_lines":[{"line_number":23,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":24,"context_line":"interface is linked up. Existing bridge interfaces disable IPV6 themselves but"},{"line_number":25,"context_line":"Neutron interfaces with default namespaces should be configured in a way that"},{"line_number":26,"context_line":"IPV6 addresses are not assigned before the interfaces are linked up."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_3cdbc91c","line":26,"in_reply_to":"3ac371cc_db2c3e9b","updated":"2016-08-17 21:29:38.000000000","message":"Also we should mention what the potential impact of this might be or at least link to further guidance so deployers can have all the information.","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a9c12c6faf60c2cbc344b055c5a2f283b7f5eb23","unresolved":false,"context_lines":[{"line_number":23,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":24,"context_line":"interface is linked up. Existing bridge interfaces disable IPV6 themselves but"},{"line_number":25,"context_line":"Neutron interfaces with default namespaces should be configured in a way that"},{"line_number":26,"context_line":"IPV6 addresses are not assigned before the interfaces are linked up."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3ac371cc_3fb9fb2e","line":26,"in_reply_to":"3ac371cc_db2c3e9b","updated":"2016-08-17 22:05:33.000000000","message":"Done","commit_id":"d7f1926afb55a423ee4f6e05062b1f362c6d16b8"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_46031410","line":5,"range":{"start_line":5,"start_character":54,"end_line":5,"end_character":60},"updated":"2016-08-19 10:47:06.000000000","message":"\"linked\" is a bit ambiguous, did you mean brought link up?","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"c0612afccef007b9d521140bce34e52f12354224","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_435f860e","line":5,"range":{"start_line":5,"start_character":36,"end_line":5,"end_character":38},"updated":"2016-08-19 10:29:30.000000000","message":"I would use \u0027was\u0027 rather then is, as its now been fixed to be disabled using root_dev.disable_ipv6(). \n\nSo for this summary you\u0027re describing what the risk was, but its past tense. We just need to make operators aware not to reverse the change by enabling it again (or if they do, to be mindful of the risk).","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_07c35639","line":5,"range":{"start_line":5,"start_character":36,"end_line":5,"end_character":38},"in_reply_to":"1ac06dbe_435f860e","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_a93619b2","line":6,"range":{"start_line":6,"start_character":16,"end_line":6,"end_character":26},"updated":"2016-08-19 10:47:06.000000000","message":"By default, link-local addresses are assigned _and_ the host will assign SLAAC addresses upon receiving router advertisements.","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_a92579af","line":6,"range":{"start_line":6,"start_character":58,"end_line":6,"end_character":72},"updated":"2016-08-19 10:47:06.000000000","message":"all active (link up) interfaces","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_09100d4e","line":6,"range":{"start_line":6,"start_character":27,"end_line":6,"end_character":31},"updated":"2016-08-19 10:47:06.000000000","message":"nit: IPv6","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_a8d8b81e","line":6,"range":{"start_line":6,"start_character":27,"end_line":6,"end_character":31},"in_reply_to":"1ac06dbe_09100d4e","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_b996ec49","line":6,"range":{"start_line":6,"start_character":58,"end_line":6,"end_character":72},"in_reply_to":"1ac06dbe_a92579af","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_0965ade0","line":7,"range":{"start_line":7,"start_character":45,"end_line":7,"end_character":53},"updated":"2016-08-19 10:47:06.000000000","message":"This is a significant difference, since it has significant security implications.","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_09376de4","line":7,"range":{"start_line":7,"start_character":69,"end_line":7,"end_character":73},"updated":"2016-08-19 10:47:06.000000000","message":"nit: IPv4","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_e808f093","line":7,"range":{"start_line":7,"start_character":69,"end_line":7,"end_character":73},"in_reply_to":"1ac06dbe_09376de4","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"In Neutron whenever a new interface is created, it is linked without disabling"},{"line_number":6,"context_line":"IPV6. In Linux, link-local IPV6 addresses are assigned to all interfaces which"},{"line_number":7,"context_line":"exposes them to the tenant networks. This is slightly different from IPV4"},{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_28032875","line":7,"range":{"start_line":7,"start_character":45,"end_line":7,"end_character":53},"in_reply_to":"1ac06dbe_0965ade0","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"c0612afccef007b9d521140bce34e52f12354224","unresolved":false,"context_lines":[{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Networking-midonet, Kilo release"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Linux assigns local IPV6 addresses to all the interfaces before they are"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_c32a562c","line":11,"range":{"start_line":11,"start_character":29,"end_line":11,"end_character":41},"updated":"2016-08-19 10:29:30.000000000","message":"Add Liberty as well, as Dustin provided a backport https://review.openstack.org/#/c/291275/","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Networking-midonet, Kilo release"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Linux assigns local IPV6 addresses to all the interfaces before they are"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_c34b5758","line":11,"range":{"start_line":11,"start_character":29,"end_line":11,"end_character":41},"in_reply_to":"1ac06dbe_89d7dd22","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Networking-midonet, Kilo release"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Linux assigns local IPV6 addresses to all the interfaces before they are"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_e84e3095","line":11,"range":{"start_line":11,"start_character":29,"end_line":11,"end_character":41},"in_reply_to":"1ac06dbe_c32a562c","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":8,"context_line":"addresses where an administrator must configure them explicitly."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Neutron, Networking-midonet, Kilo release"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Linux assigns local IPV6 addresses to all the interfaces before they are"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_89d7dd22","line":11,"range":{"start_line":11,"start_character":29,"end_line":11,"end_character":41},"in_reply_to":"1ac06dbe_c32a562c","updated":"2016-08-19 10:47:06.000000000","message":"This same behavior effects Nova as well, e.g. https://review.openstack.org/#/c/313070/","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Neutron, Networking-midonet, Kilo release"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Linux assigns local IPV6 addresses to all the interfaces before they are"},{"line_number":15,"context_line":"enslaved in a bridge. They are exposed in the LinuxBridgeManager calls"},{"line_number":16,"context_line":"`ensure_vlan` and `ensure_vxlan` where a new VLAN or VXLAN interface is created"},{"line_number":17,"context_line":"prior to enslaving the interfaces in the bridge\". For compute nodes there is a"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_09e48d0b","line":14,"range":{"start_line":14,"start_character":14,"end_line":14,"end_character":19},"updated":"2016-08-19 10:47:06.000000000","message":"nit: link-local","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Neutron, Networking-midonet, Kilo release"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"Linux assigns local IPV6 addresses to all the interfaces before they are"},{"line_number":15,"context_line":"enslaved in a bridge. They are exposed in the LinuxBridgeManager calls"},{"line_number":16,"context_line":"`ensure_vlan` and `ensure_vxlan` where a new VLAN or VXLAN interface is created"},{"line_number":17,"context_line":"prior to enslaving the interfaces in the bridge\". For compute nodes there is a"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_63ac23ee","line":14,"range":{"start_line":14,"start_character":14,"end_line":14,"end_character":19},"in_reply_to":"1ac06dbe_09e48d0b","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"f590aac482031e17f97e7ed5090f716a842ac79c","unresolved":false,"context_lines":[{"line_number":14,"context_line":"Linux assigns local IPV6 addresses to all the interfaces before they are"},{"line_number":15,"context_line":"enslaved in a bridge. They are exposed in the LinuxBridgeManager calls"},{"line_number":16,"context_line":"`ensure_vlan` and `ensure_vxlan` where a new VLAN or VXLAN interface is created"},{"line_number":17,"context_line":"prior to enslaving the interfaces in the bridge\". For compute nodes there is a"},{"line_number":18,"context_line":"certain delay from the time the interfaces connect to the tenant network until"},{"line_number":19,"context_line":"they are enslaved in the bridge. If the time window is less than the delay,"},{"line_number":20,"context_line":"then a check for duplicate IPV6 addresses can be performed but it would be"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"3ac371cc_42769e3e","line":17,"updated":"2016-08-17 22:15:39.000000000","message":"an extra \" got left in there","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":14,"context_line":"Linux assigns local IPV6 addresses to all the interfaces before they are"},{"line_number":15,"context_line":"enslaved in a bridge. They are exposed in the LinuxBridgeManager calls"},{"line_number":16,"context_line":"`ensure_vlan` and `ensure_vxlan` where a new VLAN or VXLAN interface is created"},{"line_number":17,"context_line":"prior to enslaving the interfaces in the bridge\". For compute nodes there is a"},{"line_number":18,"context_line":"certain delay from the time the interfaces connect to the tenant network until"},{"line_number":19,"context_line":"they are enslaved in the bridge. If the time window is less than the delay,"},{"line_number":20,"context_line":"then a check for duplicate IPV6 addresses can be performed but it would be"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_77c7c145","line":17,"in_reply_to":"3ac371cc_42769e3e","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":18,"context_line":"certain delay from the time the interfaces connect to the tenant network until"},{"line_number":19,"context_line":"they are enslaved in the bridge. If the time window is less than the delay,"},{"line_number":20,"context_line":"then a check for duplicate IPV6 addresses can be performed but it would be"},{"line_number":21,"context_line":"impractical under high loads."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"### Recommended Actions ###"},{"line_number":24,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_898cfd36","line":21,"range":{"start_line":21,"start_character":0,"end_line":21,"end_character":28},"updated":"2016-08-19 10:47:06.000000000","message":"impractical _except_ under high loads? Under normal load the delay before enslaving the vlan/vxlan interface is smaller than IPv6 DAD completion.","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":18,"context_line":"certain delay from the time the interfaces connect to the tenant network until"},{"line_number":19,"context_line":"they are enslaved in the bridge. If the time window is less than the delay,"},{"line_number":20,"context_line":"then a check for duplicate IPV6 addresses can be performed but it would be"},{"line_number":21,"context_line":"impractical under high loads."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"### Recommended Actions ###"},{"line_number":24,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_c2a5aca2","line":21,"range":{"start_line":21,"start_character":0,"end_line":21,"end_character":28},"in_reply_to":"1ac06dbe_898cfd36","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"### Recommended Actions ###"},{"line_number":24,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":25,"context_line":"interface is linked up. Existing bridge interfaces disable IPV6 themselves but"},{"line_number":26,"context_line":"Neutron interfaces with default namespaces should be configured in a way that"},{"line_number":27,"context_line":"IPV6 addresses are not assigned before the interfaces are linked up. This avoids"},{"line_number":28,"context_line":"us from having duplicate IPV6 addresses and also prevents the host machines from"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_293fc926","line":25,"range":{"start_line":25,"start_character":24,"end_line":25,"end_character":73},"updated":"2016-08-19 10:47:06.000000000","message":"I\u0027m confused by this -- Neutron now disabled IPv6 on new interfaces, but the bridge interface doesn\u0027t do it by itself.","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"### Recommended Actions ###"},{"line_number":24,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":25,"context_line":"interface is linked up. Existing bridge interfaces disable IPV6 themselves but"},{"line_number":26,"context_line":"Neutron interfaces with default namespaces should be configured in a way that"},{"line_number":27,"context_line":"IPV6 addresses are not assigned before the interfaces are linked up. This avoids"},{"line_number":28,"context_line":"us from having duplicate IPV6 addresses and also prevents the host machines from"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_c7cc9e6c","line":25,"range":{"start_line":25,"start_character":24,"end_line":25,"end_character":73},"in_reply_to":"1ac06dbe_293fc926","updated":"2016-08-22 20:18:37.000000000","message":"Correct me if I am wrong but the bug description says that IPv6 is disabled for bridge interfaces themselves.\nhttps://bugs.launchpad.net/ossn/+bug/1534652","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"516bd799e3455e4e58028dddd857f8352da9d99f","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"### Recommended Actions ###"},{"line_number":24,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":25,"context_line":"interface is linked up. Existing bridge interfaces disable IPV6 themselves but"},{"line_number":26,"context_line":"Neutron interfaces with default namespaces should be configured in a way that"},{"line_number":27,"context_line":"IPV6 addresses are not assigned before the interfaces are linked up. This avoids"},{"line_number":28,"context_line":"us from having duplicate IPV6 addresses and also prevents the host machines from"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_a6a99b92","line":25,"range":{"start_line":25,"start_character":24,"end_line":25,"end_character":73},"in_reply_to":"1ac06dbe_c7cc9e6c","updated":"2016-08-22 22:44:56.000000000","message":"Yes, Neutron makes the configuration change to disables IPv6 for the bridge interface, but the bridge interfaces do not make the configuration change to disabled IPv6 for themselves.","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":23,"context_line":"### Recommended Actions ###"},{"line_number":24,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":25,"context_line":"interface is linked up. Existing bridge interfaces disable IPV6 themselves but"},{"line_number":26,"context_line":"Neutron interfaces with default namespaces should be configured in a way that"},{"line_number":27,"context_line":"IPV6 addresses are not assigned before the interfaces are linked up. This avoids"},{"line_number":28,"context_line":"us from having duplicate IPV6 addresses and also prevents the host machines from"},{"line_number":29,"context_line":"being exposed to the tenant networks."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_a9dc5919","line":26,"range":{"start_line":26,"start_character":19,"end_line":26,"end_character":42},"updated":"2016-08-19 10:47:06.000000000","message":"in the default namespace (there is only one default namespace)","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":23,"context_line":"### Recommended Actions ###"},{"line_number":24,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":25,"context_line":"interface is linked up. Existing bridge interfaces disable IPV6 themselves but"},{"line_number":26,"context_line":"Neutron interfaces with default namespaces should be configured in a way that"},{"line_number":27,"context_line":"IPV6 addresses are not assigned before the interfaces are linked up. This avoids"},{"line_number":28,"context_line":"us from having duplicate IPV6 addresses and also prevents the host machines from"},{"line_number":29,"context_line":"being exposed to the tenant networks."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_192f40f7","line":26,"range":{"start_line":26,"start_character":19,"end_line":26,"end_character":42},"in_reply_to":"1ac06dbe_a9dc5919","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"f590aac482031e17f97e7ed5090f716a842ac79c","unresolved":false,"context_lines":[{"line_number":29,"context_line":"being exposed to the tenant networks."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Instructions:"},{"line_number":32,"context_line":"IPV6 can be disabled from /etc/systcl.conf file"},{"line_number":33,"context_line":"Run the command to set the value to 1 for disabling"},{"line_number":34,"context_line":"sysctl -a | grep disable | grep ipv6"},{"line_number":35,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"3ac371cc_e23d0a2c","line":32,"updated":"2016-08-17 22:15:39.000000000","message":"add an example snippet of disabling IPV6","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":29,"context_line":"being exposed to the tenant networks."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Instructions:"},{"line_number":32,"context_line":"IPV6 can be disabled from /etc/systcl.conf file"},{"line_number":33,"context_line":"Run the command to set the value to 1 for disabling"},{"line_number":34,"context_line":"sysctl -a | grep disable | grep ipv6"},{"line_number":35,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_99afab29","line":32,"in_reply_to":"1ac06dbe_6958a157","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":29,"context_line":"being exposed to the tenant networks."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Instructions:"},{"line_number":32,"context_line":"IPV6 can be disabled from /etc/systcl.conf file"},{"line_number":33,"context_line":"Run the command to set the value to 1 for disabling"},{"line_number":34,"context_line":"sysctl -a | grep disable | grep ipv6"},{"line_number":35,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_73077018","line":32,"in_reply_to":"3ac371cc_e23d0a2c","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"812b520eb7f4add7d3e3e1689bf64fea48fa0309","unresolved":false,"context_lines":[{"line_number":29,"context_line":"being exposed to the tenant networks."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Instructions:"},{"line_number":32,"context_line":"IPV6 can be disabled from /etc/systcl.conf file"},{"line_number":33,"context_line":"Run the command to set the value to 1 for disabling"},{"line_number":34,"context_line":"sysctl -a | grep disable | grep ipv6"},{"line_number":35,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_6958a157","line":32,"in_reply_to":"3ac371cc_e23d0a2c","updated":"2016-08-19 10:47:06.000000000","message":"Setting net.ipv6.conf.all.disable_ipv6\u003d1 has the side effect of completely disabling Neutron\u0027s IPv6 support: https://github.com/openstack/neutron/blob/master/neutron/common/ipv6_utils.py#L51\n\nWe do not want to do this, since it will prevent creating ip6tables rules enforcing security groups.","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"c0612afccef007b9d521140bce34e52f12354224","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Instructions:"},{"line_number":32,"context_line":"IPV6 can be disabled from /etc/systcl.conf file"},{"line_number":33,"context_line":"Run the command to set the value to 1 for disabling"},{"line_number":34,"context_line":"sysctl -a | grep disable | grep ipv6"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Reference:"},{"line_number":37,"context_line":"https://discuss.zendesk.com/hc/en-us/articles/204415133-How-to-disable-the"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_a6dc8819","line":34,"range":{"start_line":33,"start_character":0,"end_line":34,"end_character":36},"updated":"2016-08-19 10:29:30.000000000","message":"I don\u0027t think that command disables? it greps out the current value. But the code now sets that by default. We just need to make sure operators are aware of the risks, should they turn it back on.","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"f590aac482031e17f97e7ed5090f716a842ac79c","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Instructions:"},{"line_number":32,"context_line":"IPV6 can be disabled from /etc/systcl.conf file"},{"line_number":33,"context_line":"Run the command to set the value to 1 for disabling"},{"line_number":34,"context_line":"sysctl -a | grep disable | grep ipv6"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Reference:"},{"line_number":37,"context_line":"https://discuss.zendesk.com/hc/en-us/articles/204415133-How-to-disable-the"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"3ac371cc_6218fad3","line":34,"updated":"2016-08-17 22:15:39.000000000","message":"this command should be formatted so that there is an extra line above it, and indented 4 spaces","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Instructions:"},{"line_number":32,"context_line":"IPV6 can be disabled from /etc/systcl.conf file"},{"line_number":33,"context_line":"Run the command to set the value to 1 for disabling"},{"line_number":34,"context_line":"sysctl -a | grep disable | grep ipv6"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Reference:"},{"line_number":37,"context_line":"https://discuss.zendesk.com/hc/en-us/articles/204415133-How-to-disable-the"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_0f3532f6","line":34,"range":{"start_line":33,"start_character":0,"end_line":34,"end_character":36},"in_reply_to":"1ac06dbe_a6dc8819","updated":"2016-08-22 20:18:37.000000000","message":"Done. Also i think changing the values to 1 in /etc/systcl.conf will change it system wide but the solution is to disable for each interface. Any pointers on how I could do that for each interface?","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"a7503d02da5940ecc95c809942b32f1c22811664","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Instructions:"},{"line_number":32,"context_line":"IPV6 can be disabled from /etc/systcl.conf file"},{"line_number":33,"context_line":"Run the command to set the value to 1 for disabling"},{"line_number":34,"context_line":"sysctl -a | grep disable | grep ipv6"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Reference:"},{"line_number":37,"context_line":"https://discuss.zendesk.com/hc/en-us/articles/204415133-How-to-disable-the"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1ac06dbe_6f3ca6e2","line":34,"in_reply_to":"3ac371cc_6218fad3","updated":"2016-08-22 20:18:37.000000000","message":"Done","commit_id":"7c4953de40b579f473b164167b902da70e2ccca9"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"2c53bfaccbd33e94b58fbf7a61b1d933834c8641","unresolved":false,"context_lines":[{"line_number":24,"context_line":"accessible from a tenant network."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"### Recommended Actions ###"},{"line_number":27,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":28,"context_line":"interface is linked up. Neutron disables IPv6 on new interfaces by default now."},{"line_number":29,"context_line":"Neutron interfaces with the default namespace should be configured in a way"},{"line_number":30,"context_line":"that IPV6 addresses are not assigned before the interfaces are linked up."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_a6e6bbad","line":27,"updated":"2016-08-22 23:04:18.000000000","message":"nit: IPv6","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"74027b54368be4c7deb8947c2db36dd388660f73","unresolved":false,"context_lines":[{"line_number":24,"context_line":"accessible from a tenant network."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"### Recommended Actions ###"},{"line_number":27,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":28,"context_line":"interface is linked up. Neutron disables IPv6 on new interfaces by default now."},{"line_number":29,"context_line":"Neutron interfaces with the default namespace should be configured in a way"},{"line_number":30,"context_line":"that IPV6 addresses are not assigned before the interfaces are linked up."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_c16761e7","line":27,"in_reply_to":"1ac06dbe_a6e6bbad","updated":"2016-08-23 17:17:10.000000000","message":"Done","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"2c53bfaccbd33e94b58fbf7a61b1d933834c8641","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"### Recommended Actions ###"},{"line_number":27,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":28,"context_line":"interface is linked up. Neutron disables IPv6 on new interfaces by default now."},{"line_number":29,"context_line":"Neutron interfaces with the default namespace should be configured in a way"},{"line_number":30,"context_line":"that IPV6 addresses are not assigned before the interfaces are linked up."},{"line_number":31,"context_line":"This avoids us from having duplicate IPv6 addresses and also prevents the host"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_26576b27","line":28,"range":{"start_line":28,"start_character":13,"end_line":28,"end_character":19},"updated":"2016-08-22 23:04:18.000000000","message":"See comment below about \"linked\" as a verb.","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"74027b54368be4c7deb8947c2db36dd388660f73","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"### Recommended Actions ###"},{"line_number":27,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":28,"context_line":"interface is linked up. Neutron disables IPv6 on new interfaces by default now."},{"line_number":29,"context_line":"Neutron interfaces with the default namespace should be configured in a way"},{"line_number":30,"context_line":"that IPV6 addresses are not assigned before the interfaces are linked up."},{"line_number":31,"context_line":"This avoids us from having duplicate IPv6 addresses and also prevents the host"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_18a24c99","line":28,"range":{"start_line":28,"start_character":13,"end_line":28,"end_character":19},"in_reply_to":"1ac06dbe_26576b27","updated":"2016-08-23 17:17:10.000000000","message":"Done","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"2c53bfaccbd33e94b58fbf7a61b1d933834c8641","unresolved":false,"context_lines":[{"line_number":27,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":28,"context_line":"interface is linked up. Neutron disables IPv6 on new interfaces by default now."},{"line_number":29,"context_line":"Neutron interfaces with the default namespace should be configured in a way"},{"line_number":30,"context_line":"that IPV6 addresses are not assigned before the interfaces are linked up."},{"line_number":31,"context_line":"This avoids us from having duplicate IPv6 addresses and also prevents the host"},{"line_number":32,"context_line":"machines from being exposed to the tenant networks."},{"line_number":33,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_c65db748","line":30,"range":{"start_line":30,"start_character":63,"end_line":30,"end_character":69},"updated":"2016-08-22 23:04:18.000000000","message":"I haven\u0027t seen \"linked\" used as a verb to mean changing the link status to up. As a verb referring to interfaces \"linked\" would be a synonym for \"connected\".  I think it\u0027s fine to use \"link up\" as an adjective e.g. all link up interfaces, but using it as a verb to describe changing the link state seems odd to me.","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"2c53bfaccbd33e94b58fbf7a61b1d933834c8641","unresolved":false,"context_lines":[{"line_number":27,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":28,"context_line":"interface is linked up. Neutron disables IPv6 on new interfaces by default now."},{"line_number":29,"context_line":"Neutron interfaces with the default namespace should be configured in a way"},{"line_number":30,"context_line":"that IPV6 addresses are not assigned before the interfaces are linked up."},{"line_number":31,"context_line":"This avoids us from having duplicate IPv6 addresses and also prevents the host"},{"line_number":32,"context_line":"machines from being exposed to the tenant networks."},{"line_number":33,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_86a29f49","line":30,"range":{"start_line":30,"start_character":5,"end_line":30,"end_character":9},"updated":"2016-08-22 23:04:18.000000000","message":"nit: IPv6","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"74027b54368be4c7deb8947c2db36dd388660f73","unresolved":false,"context_lines":[{"line_number":27,"context_line":"IPV6 should be disabled explicitly via sysctl for each interface before the"},{"line_number":28,"context_line":"interface is linked up. Neutron disables IPv6 on new interfaces by default now."},{"line_number":29,"context_line":"Neutron interfaces with the default namespace should be configured in a way"},{"line_number":30,"context_line":"that IPV6 addresses are not assigned before the interfaces are linked up."},{"line_number":31,"context_line":"This avoids us from having duplicate IPv6 addresses and also prevents the host"},{"line_number":32,"context_line":"machines from being exposed to the tenant networks."},{"line_number":33,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_a2917949","line":30,"range":{"start_line":30,"start_character":5,"end_line":30,"end_character":9},"in_reply_to":"1ac06dbe_86a29f49","updated":"2016-08-23 17:17:10.000000000","message":"Done","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"2c53bfaccbd33e94b58fbf7a61b1d933834c8641","unresolved":false,"context_lines":[{"line_number":32,"context_line":"machines from being exposed to the tenant networks."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Instructions:"},{"line_number":35,"context_line":"IPV6 can be disabled from /etc/sysctl.conf file"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Check the value of the parameter using the command below"},{"line_number":38,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_a15505fb","line":35,"updated":"2016-08-22 23:04:18.000000000","message":"This is distribution specific, each distribution may have it\u0027s own way to persist sysctl settings.","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"2c53bfaccbd33e94b58fbf7a61b1d933834c8641","unresolved":false,"context_lines":[{"line_number":32,"context_line":"machines from being exposed to the tenant networks."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Instructions:"},{"line_number":35,"context_line":"IPV6 can be disabled from /etc/sysctl.conf file"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Check the value of the parameter using the command below"},{"line_number":38,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_211c7569","line":35,"range":{"start_line":35,"start_character":0,"end_line":35,"end_character":4},"updated":"2016-08-22 23:04:18.000000000","message":"nit: IPv6","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"74027b54368be4c7deb8947c2db36dd388660f73","unresolved":false,"context_lines":[{"line_number":32,"context_line":"machines from being exposed to the tenant networks."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Instructions:"},{"line_number":35,"context_line":"IPV6 can be disabled from /etc/sysctl.conf file"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Check the value of the parameter using the command below"},{"line_number":38,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_02a32d9e","line":35,"range":{"start_line":35,"start_character":0,"end_line":35,"end_character":4},"in_reply_to":"1ac06dbe_211c7569","updated":"2016-08-23 17:17:10.000000000","message":"Done","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"2c53bfaccbd33e94b58fbf7a61b1d933834c8641","unresolved":false,"context_lines":[{"line_number":52,"context_line":"(for disabling)"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"  net.ipv6.conf.default.disable_ipv6 \u003d 1"},{"line_number":55,"context_line":"  net.ipv6.conf.lo.disable_ipv6 \u003d 1"},{"line_number":56,"context_line":"  net.ipv6.conf.eth0.disable_ipv6 \u003d 1"},{"line_number":57,"context_line":"  net.ipv6.conf.eth1.disable_ipv6 \u003d 1"},{"line_number":58,"context_line":"  net.ipv6.conf.eth2.disable_ipv6 \u003d 1"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_a107c516","line":55,"updated":"2016-08-22 23:04:18.000000000","message":"I wouldn\u0027t disable IPv6 on the loopback interface if any IPv6 aware programs are running.","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"},{"author":{"_account_id":21297,"name":"Vinay Potluri","email":"vinaypotluri8@gmail.com","username":"vinaypotluri"},"change_message_id":"74027b54368be4c7deb8947c2db36dd388660f73","unresolved":false,"context_lines":[{"line_number":52,"context_line":"(for disabling)"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"  net.ipv6.conf.default.disable_ipv6 \u003d 1"},{"line_number":55,"context_line":"  net.ipv6.conf.lo.disable_ipv6 \u003d 1"},{"line_number":56,"context_line":"  net.ipv6.conf.eth0.disable_ipv6 \u003d 1"},{"line_number":57,"context_line":"  net.ipv6.conf.eth1.disable_ipv6 \u003d 1"},{"line_number":58,"context_line":"  net.ipv6.conf.eth2.disable_ipv6 \u003d 1"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"1ac06dbe_02f84d7a","line":55,"in_reply_to":"1ac06dbe_a107c516","updated":"2016-08-23 17:17:10.000000000","message":"Done","commit_id":"bf4456e6e8b1465bda78bff0feeeea0a635f5629"}]}