commit aa7356b729f9672855980429677c969b6bab61a1
Author: Kevin Benton <email address hidden>
Date: Sun Mar 29 03:37:25 2015 -0700
Add simple ARP spoofing protection
Adds an option to setup OVS rules that will prevent
ports attached to the agent from sending any ARP responses
that contain an IP address not belonging to the port
(in fixed IPs or allowed_address_pairs).
It is disabled by default and requires an OVS version that
can match on ARP fields. If it is too old, traffic will
still flow but it won't have ARP spoofing protection.
There is a sanity check to verify that ARP header matching
is supported.
This prevention is specific to OVS so it will not help with
other plugins that use the reference iptables filtering. A
non-OVS-specific general approach will require something like
the ebtables integration in Ibc6d3d520c1383cf7e00f4bdeb7853a41ac4b14b.
Details:
A new table is added for ARP spoofing prevention. All ARP traffic
on the local switching table is sent to this spoofing table.
The spoofing table will allow all ARP requests because we aren't
interested in them. It will then install an ARP response allow rule
for each IP address the port is assigned. All other ARP responses are
dropped.
Reviewed: https:/ /review. openstack. org/171003 /git.openstack. org/cgit/ openstack/ neutron/ commit/ ?id=aa7356b729f 967285598042967 7c969b6bab61a1
Committed: https:/
Submitter: Jenkins
Branch: master
commit aa7356b729f9672 855980429677c96 9b6bab61a1
Author: Kevin Benton <email address hidden>
Date: Sun Mar 29 03:37:25 2015 -0700
Add simple ARP spoofing protection
Adds an option to setup OVS rules that will prevent address_ pairs).
ports attached to the agent from sending any ARP responses
that contain an IP address not belonging to the port
(in fixed IPs or allowed_
It is disabled by default and requires an OVS version that
can match on ARP fields. If it is too old, traffic will
still flow but it won't have ARP spoofing protection.
There is a sanity check to verify that ARP header matching
is supported.
This prevention is specific to OVS so it will not help with OVS-specific general approach will require something like cf7e00f4bdeb785 3a41ac4b14b.
other plugins that use the reference iptables filtering. A
non-
the ebtables integration in Ibc6d3d520c1383
Details:
A new table is added for ARP spoofing prevention. All ARP traffic
on the local switching table is sent to this spoofing table.
The spoofing table will allow all ARP requests because we aren't
interested in them. It will then install an ARP response allow rule
for each IP address the port is assigned. All other ARP responses are
dropped.
DocImpact
SecurityImpact
Partial-Bug: #1274034
Change-Id: I7c079b779245a0 af6bc793564fa8a 560e4226afe