)]}'
{"puppet/services/kernel.yaml":[{"author":{"_account_id":3153,"name":"Emilien Macchi","email":"emilien@redhat.com","username":"emilienm"},"change_message_id":"990de67e6f0bc6484eaee4927f395923721b33c5","unresolved":false,"context_lines":[{"line_number":77,"context_line":"            value: 0"},{"line_number":78,"context_line":"          net.ipv4.conf.all.send_redirects:"},{"line_number":79,"context_line":"            value: 0"},{"line_number":80,"context_line":"          net.ipv4.conf.all.arp_accept:"},{"line_number":81,"context_line":"            value: 1"},{"line_number":82,"context_line":"          net.ipv4.conf.default.accept_redirects:"},{"line_number":83,"context_line":"            value: 0"},{"line_number":84,"context_line":"          net.ipv4.conf.default.secure_redirects:"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"df140735_a8747a9a","line":81,"range":{"start_line":80,"start_character":0,"end_line":81,"end_character":20},"updated":"2017-05-30 12:48:27.000000000","message":"I\u0027m wondering if we configure it only on nodes where neutron l3 agent is running. Also, is it exposing the nodes to ARP poisoning?","commit_id":"804fd3427eeb31a2846ee096dbdac924ec39bcbc"},{"author":{"_account_id":3153,"name":"Emilien Macchi","email":"emilien@redhat.com","username":"emilienm"},"change_message_id":"12f1bbf27e3a7fc8a5d4d78bee2d8a42dd344e12","unresolved":false,"context_lines":[{"line_number":77,"context_line":"            value: 0"},{"line_number":78,"context_line":"          net.ipv4.conf.all.send_redirects:"},{"line_number":79,"context_line":"            value: 0"},{"line_number":80,"context_line":"          net.ipv4.conf.all.arp_accept:"},{"line_number":81,"context_line":"            value: 1"},{"line_number":82,"context_line":"          net.ipv4.conf.default.accept_redirects:"},{"line_number":83,"context_line":"            value: 0"},{"line_number":84,"context_line":"          net.ipv4.conf.default.secure_redirects:"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"df140735_69dd4313","line":81,"range":{"start_line":80,"start_character":0,"end_line":81,"end_character":20},"in_reply_to":"df140735_63d3243a","updated":"2017-05-30 14:54:46.000000000","message":"fair enough, thanks","commit_id":"804fd3427eeb31a2846ee096dbdac924ec39bcbc"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"edb7da035a7281213da2de1fd8380787388f4e5d","unresolved":false,"context_lines":[{"line_number":77,"context_line":"            value: 0"},{"line_number":78,"context_line":"          net.ipv4.conf.all.send_redirects:"},{"line_number":79,"context_line":"            value: 0"},{"line_number":80,"context_line":"          net.ipv4.conf.all.arp_accept:"},{"line_number":81,"context_line":"            value: 1"},{"line_number":82,"context_line":"          net.ipv4.conf.default.accept_redirects:"},{"line_number":83,"context_line":"            value: 0"},{"line_number":84,"context_line":"          net.ipv4.conf.default.secure_redirects:"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"df140735_63d3243a","line":81,"range":{"start_line":80,"start_character":0,"end_line":81,"end_character":20},"in_reply_to":"df140735_a8747a9a","updated":"2017-05-30 13:56:51.000000000","message":"No, we actually want it on all nodes, especially those exposed to external network (including e.g. undercloud in ooo-q/infrared setup).\n\nAs for poisoning, I am not sure what to make out of it. ARP is itself not a particularly secure protocol, and rogue parties having access to l2 layer of external network can already issue gratuitous ARP requests and make all tables on all peers updated. (That\u0027s how Linux kernel works.)\n\nThe only two things that arp_accept enabled will change are:\n\n1. when a ARP packet for a unknown IP address is received, it will create a new record in the table (otherwise it\u0027s ignored);\n\n2. when a gratuitous ARP request is received, it will always update existing record (and won\u0027t ignore it even when received in locktime frame from previous update/state change, which is 1 second by default).\n\nI can\u0027t see how any of those two exposes additional insecurities. The first bullet point can in theory increase ARP thrashing on large l2 segments, but this should be dealt with lines 121+.","commit_id":"804fd3427eeb31a2846ee096dbdac924ec39bcbc"}]}