neutron

security groups remote_group fails with CIDR in address pairs

Bug #1382562 reported by Kevin Benton
22
This bug affects 3 people
Affects Status Importance Assigned to Milestone
OpenStack Security Advisory
Won't Fix
Undecided
Unassigned
neutron
Fix Released
High
Kevin Benton
neutron 2015.1.0 "kilo"
Juno
Fix Released
Undecided
Unassigned
neutron 2014.2.1

Bug Description

Add a CIDR to allowed address pairs of a host. RPC calls from the agents will run into this issue now when retrieving the security group members' IPs. I haven't confirmed because I came across this working on other code, but I think this may stop all members of the security groups referencing that group from getting their rules over the RPC channel.

  File "neutron/api/rpc/handlers/securitygroups_rpc.py", line 75, in security_group_info_for_devices
    return self.plugin.security_group_info_for_ports(context, ports)
  File "neutron/db/securitygroups_rpc_base.py", line 202, in security_group_info_for_ports
    return self._get_security_group_member_ips(context, sg_info)
  File "neutron/db/securitygroups_rpc_base.py", line 209, in _get_security_group_member_ips
    ethertype = 'IPv%d' % netaddr.IPAddress(ip).version
  File "/home/administrator/code/neutron/.tox/py27/local/lib/python2.7/site-packages/netaddr/ip/__init__.py", line 281, in __init__
    % self.__class__.__name__)
ValueError: IPAddress() does not support netmasks or subnet prefixes! See documentation for details.

Revision history for this message
Kevin Benton (kevinbenton) wrote :

Fix is here. https://review.openstack.org/#/c/129253/

Changed in neutron:
assignee: nobody → Kevin Benton (kevinbenton)
Revision history for this message
Jeremy Stanley (fungi) wrote :

I've added an incomplete security advisory task while the bug report is analyzed by Neutron reviewers to determine the level of risk posed. Since you pushed a patch correcting this defect to our public code review system and mentioned this bug number in the commit message, I have switched it from private security to public security (the cat is already out of the bag, as they say).

Changed in ossa:
status: New → Incomplete
information type: Private Security → Public Security
Revision history for this message
Jeremy Stanley (fungi) wrote :

Just to confirm the details of this report, you're saying that it's possible for someone who has permission to modify the security group configuration to break that security group... if so, I don't see how an attacker would actively leverage this bug to escalate permissions or cross any established trust boundary. Can you elaborate on what makes this bug a security vulnerability?

OpenStack Infra (hudson-openstack)
Changed in neutron:
status: New → In Progress
Revision history for this message
Kevin Benton (kevinbenton) wrote :

Yeah, this wouldn't be something that an attacker could leverage from what I can tell. The risk is that a user can unknowingly break their security groups.

Revision history for this message
Jeremy Stanley (fungi) wrote :

Thanks Kevin. In that case I've tagged it as a security hardening opportunity (removes a foot-cannon), and switched the advisory task to won't-fix.

information type: Public Security → Public
Changed in ossa:
status: Incomplete → Won't Fix
tags: added: security
Revision history for this message
Kevin Benton (kevinbenton) wrote :

Is that the right classification? It sounds like that is reserved for a case where users are using something wrong. This is a bug in neutron and not a mistake on the user's part.

In this case the user is using address pairs in a completely legitimate way by specifying a CIDR. The neutron function that checks the address pairs when calculating members of security groups just breaks if it's a CIDR.

Kyle Mestery (mestery)
Changed in neutron:
milestone: none → kilo-1
importance: Undecided → High
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (master)

Reviewed: https://review.openstack.org/129253
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=a1e78b2e8836053d8ffb29bce0f862e8a5f19c2f
Submitter: Jenkins
Branch: master

commit a1e78b2e8836053d8ffb29bce0f862e8a5f19c2f
Author: Kevin Benton <email address hidden>
Date: Thu Oct 16 20:53:21 2014 -0700

    Fix handling of CIDR in allowed address pairs

    A CIDR in allowed address pairs would screw up
    the calculation of remote security group member
    IP addresses due to a call that assumed each entry
    was an IP. This patch fixes that an adds a remote
    security group reference to the address pairs SG
    test case to exercise this code-path.

    Closes-Bug: #1382562
    Change-Id: I2676f4b56bce7449579d67fb221b3edb7b885103

Changed in neutron:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (stable/juno)

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/137269

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (stable/juno)

Reviewed: https://review.openstack.org/137269
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=93f2536be5fe6f136e24caa11a5cea2282fb332d
Submitter: Jenkins
Branch: stable/juno

commit 93f2536be5fe6f136e24caa11a5cea2282fb332d
Author: Kevin Benton <email address hidden>
Date: Thu Oct 16 20:53:21 2014 -0700

    Fix handling of CIDR in allowed address pairs

    A CIDR in allowed address pairs would screw up
    the calculation of remote security group member
    IP addresses due to a call that assumed each entry
    was an IP. This patch fixes that an adds a remote
    security group reference to the address pairs SG
    test case to exercise this code-path.

    Closes-Bug: #1382562
    Change-Id: I2676f4b56bce7449579d67fb221b3edb7b885103
    (cherry picked from commit a1e78b2e8836053d8ffb29bce0f862e8a5f19c2f)

tags: added: in-stable-juno
Thierry Carrez (ttx)
Changed in neutron:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in neutron:
milestone: kilo-1 → 2015.1.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.