- OpenStack-announce - lists.openstack.org

[OSSA-2016-009] Neutron IPTables firewall anti-spoof protection bypass (CVE-2016-5362, CVE-2016-5363, CVE-2015-8914)
by Tristan Cacqueray 14 Jun '16

14 Jun '16

===================================================================== OSSA-2016-009: Neutron IPTables firewall anti-spoof protection bypass ===================================================================== :Date: June 14, 2016 :CVE: CVE-2016-5362 (DHCP spoofing), CVE-2016-5363 (MAC source address spoofing), CVE-2015-8914 (ICMPv6 source address spoofing) Affects ~~~~~~~ - Neutron: <=7.0.4, >=8.0.0 <=8.1.0 Description ~~~~~~~~~~~ Romain Aviolat from Nagravision and Dustin Lundquist from Blue Box Group, Inc independently reported vulnerabilities in Neutron anti- spoof protection. By forging DHCP discovery messages or non-IP traffic, such as ARP or ICMPv6, an instance may spoof IP or MAC source addresses on attached networks resulting in denial of services and/or traffic interception. Moreover when L2population isn't used, other tenants attached to a shared network are also vulnerable. Neutron setups using the IPTables firewall driver are affected. Patches ~~~~~~~ - https://review.openstack.org/299025 (MAC) (Liberty) - https://review.openstack.org/303572 (DHCP) (Liberty) - https://review.openstack.org/310652 (ICMPv6) (Liberty) - https://review.openstack.org/299023 (MAC) (Mitaka) - https://review.openstack.org/303563 (DHCP) (Mitaka) - https://review.openstack.org/310648 (ICMPv6) (Mitaka) - https://review.openstack.org/299021 (MAC) (Newton) - https://review.openstack.org/300202 (DHCP) (Newton) - https://review.openstack.org/300233 (ICMPv6) (Newton) Credits ~~~~~~~ - Romain Aviolat from Nagravision (CVE-2015-8914) - Dustin Lundquist from Blue Box Group, Inc (CVE-2016-5362, CVE-2016-5363) References ~~~~~~~~~~ - https://bugs.launchpad.net/bugs/1502933 (ICMPv6) - https://bugs.launchpad.net/bugs/1558658 (MAC, DHCP) - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5362 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5363 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8914 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[new][ironic] python-ironicclient 0.8.2 release (liberty)
by no-reply＠openstack.org 13 Jun '16

13 Jun '16

We are delighted to announce the release of: python-ironicclient 0.8.2: OpenStack Bare Metal Provisioning API Client Library This release is part of the liberty stable release series. With source available at: http://git.openstack.org/cgit/openstack/python-ironicclient With package available at: https://pypi.python.org/pypi/python-ironicclient Please report issues through launchpad: http://bugs.launchpad.net/python-ironicclient For more details, please see below. Changes in python-ironicclient 0.8.1..0.8.2 ------------------------------------------- ae2c099 Scale back on how many warnings we issue 6d782fd Updated from global requirements 5a70a3f Update .gitreview for stable/liberty Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + ironicclient/common/http.py | 3 +-- requirements.txt | 2 +- setup.py | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 7203d39..30b3c01 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4 +4 @@ -pbr<2.0,>=1.6 +pbr>=1.6

1 0

[new][neutron] neutron-vpnaas 8.1.2 release (mitaka)
by no-reply＠openstack.org 10 Jun '16

10 Jun '16

We are tickled pink to announce the release of: neutron-vpnaas 8.1.2: OpenStack Networking VPN as a Service This release is part of the mitaka stable release series. For more details, please see below. Changes in neutron-vpnaas 8.1.0..8.1.2 -------------------------------------- caab92d Fix grenade plugin 1d48dcd Add grenade upgrade hooks to stop agent bede3a3 Set path for neutron conf dir in devstack if missing 58a5251 Ensure that PK values don't default to NULL 15b9c3d OpenSwan: handle disconnect properly for multiple subnets 1123c55 VPNaaS returns 500 INTERNAL error with long names, descriptions Diffstat (except docs and test files) ------------------------------------- devstack/settings | 1 + devstack/upgrade/resources.sh | 14 +++++++++ devstack/upgrade/settings | 1 + devstack/upgrade/shutdown.sh | 36 ++++++++++++++++++++++ devstack/upgrade/upgrade.sh | 14 +++++++++ .../contract/56893333aa52_fix_identifier_map_fk.py | 2 +- neutron_vpnaas/extensions/vpnaas.py | 16 +++++----- .../services/vpn/device_drivers/ipsec.py | 28 +++++++++++++++-- .../unit/services/vpn/device_drivers/test_ipsec.py | 20 ++++++++++++ 10 files changed, 149 insertions(+), 12 deletions(-)

1 0

[new][neutron] neutron-lbaas 8.1.2 release (mitaka)
by no-reply＠openstack.org 10 Jun '16

10 Jun '16

We are gleeful to announce the release of: neutron-lbaas 8.1.2: OpenStack Networking Load Balancing as a Service This release is part of the mitaka stable release series. For more details, please see below. Changes in neutron-lbaas 8.0.0..8.1.2 ------------------------------------- 5bcc99d correct tox.ini for coverage e866e9f Updated from global requirements 5f6794b Put sanity back into lbaas jobs Diffstat (except docs and test files) ------------------------------------- test-requirements.txt | 2 +- tox.ini | 23 ++++++++++------------- 3 files changed, 18 insertions(+), 14 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 68c50a0..62b6e44 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7 +7 @@ coverage>=3.6 # Apache-2.0 -fixtures>=1.3.1 # Apache-2.0/BSD +fixtures<2.0,>=1.3.1 # Apache-2.0/BSD

1 0

[new][neutron] neutron 8.1.2 release (mitaka)
by no-reply＠openstack.org 10 Jun '16

10 Jun '16

We are happy to announce the release of: neutron 8.1.2: OpenStack Networking This release is part of the mitaka stable release series. For more details, please see below. Changes in neutron 8.1.1..8.1.2 ------------------------------- 1eccf15 Revert "DVR: Clear SNAT namespace when agent restarts after router move" e539089 Force "out-of-band" controller connection mode f178c3a DVR: Fix check multiprefix when delete ipv4 router interface 1bef591 Pass ha_router_port flag for _snat_router_interfaces ports bd8adf3 Fixed help messages for path_mtu and global_physnet_mtus options f995169 Fix bgp-speaker-network-remove error 7a2cf43 Make deepcopy of update body in API layer fc3c8a6 OVS: compare names when checking devices both added and deleted 76c65d5 fix wrong default value of qos.notification_drivers 26cf043 Fix invalid mock name in test_ovs_neutron_agent 54f2fa5 Correct the interval between two reports 64919f2 Check for existence of snat port before deleting it 804fc18 fullstack: Use noop firewall 18bb187 DVR: Ensure fpr and rfp devices are configured correctly b6d9923 DVR: Use existing IPDevice to add address on FIP VETH 80e2974 Migration for qospolicyrbacs has hardcoded InnoDB 7d2fc6d Call ext_manager.delete_port on port removal a5e3f00 Improve handle port_update and port_delete events in ovs qos agent 5d57c7c DVR: Use IPDevice class consistently 22893d1 Fix Windows IPDevice.device_has_ip racefulness a07c68a Avoid L3 agent termination without server 1e8863a Fix for 'ofport' query retries during neutron agent start 1f44489 DVR: Moving router from dvr_snat node removes the qrouters d2f6dbf Enforce UUID of port/subnet ID for router interfaces Diffstat (except docs and test files) ------------------------------------- neutron/agent/l3/agent.py | 16 +- neutron/agent/l3/dvr_edge_router.py | 16 +- neutron/agent/l3/dvr_fip_ns.py | 43 +++-- neutron/agent/l3/dvr_local_router.py | 2 + neutron/agent/l3/dvr_snat_ns.py | 19 ++- neutron/agent/linux/ip_lib.py | 4 +- neutron/agent/windows/ip_lib.py | 8 +- neutron/api/rpc/handlers/l3_rpc.py | 6 +- neutron/api/v2/base.py | 3 +- neutron/common/config.py | 8 +- neutron/db/bgp_db.py | 5 +- neutron/db/l3_agentschedulers_db.py | 20 ++- neutron/db/l3_db.py | 6 + neutron/db/l3_dvr_db.py | 6 + .../mitaka/expand/15e43b934f81_rbac_qos_policy.py | 3 +- neutron/plugins/ml2/config.py | 17 +- .../agent/extension_drivers/qos_driver.py | 24 ++- .../agent/openflow/native/ovs_bridge.py | 16 ++ .../drivers/openvswitch/agent/ovs_neutron_agent.py | 25 +-- neutron/services/metering/agents/metering_agent.py | 10 +- .../services/qos/notification_drivers/manager.py | 2 +- .../l3_router/test_l3_dvr_router_plugin.py | 58 +++++++ .../agent/extension_drivers/test_qos_driver.py | 14 ++ .../agent/openflow/native/ovs_bridge_test_base.py | 14 ++ .../openvswitch/agent/test_ovs_neutron_agent.py | 175 +++++++++++++++++---- .../drivers/openvswitch/agent/test_ovs_tunnel.py | 12 +- .../metering/agents/test_metering_agent.py | 45 +++++- 37 files changed, 611 insertions(+), 281 deletions(-)

1 0

[new][neutron] neutron-fwaas 8.1.2 release (mitaka)
by no-reply＠openstack.org 10 Jun '16

10 Jun '16

We are glad to announce the release of: neutron-fwaas 8.1.2: OpenStack Networking FWaaS This release is part of the mitaka stable release series. For more details, please see below. Changes in neutron-fwaas 8.0.0..8.1.2 ------------------------------------- bddac14 Updated from global requirements Diffstat (except docs and test files) ------------------------------------- test-requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 165a1ce..c50b3f6 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7 +7 @@ coverage>=3.6 # Apache-2.0 -fixtures>=1.3.1 # Apache-2.0/BSD +fixtures<2.0,>=1.3.1 # Apache-2.0/BSD

1 0

[new][neutron] neutron 7.1.1 release (liberty)
by no-reply＠openstack.org 10 Jun '16

10 Jun '16

We are pleased to announce the release of: neutron 7.1.1: OpenStack Networking This release is part of the liberty stable release series. For more details, please see below. Changes in neutron 7.1.0..7.1.1 ------------------------------- 9d6b9c5 DVR: Rename dvr_vmarp_table_update 52ce23a DVR: Rename dvr_update_router_addvm function 62e31ba DVR: Remove get_port call from dvr_update_router_addvm 957e758 Revert "DVR: Clear SNAT namespace when agent restarts after router move" 483ceec Make deepcopy of update body in API layer 6d808cc fullstack: Use noop firewall bff727b Allow to control to use constraint env for functional jobs c93064c Ensure metadata agent doesn't use SSL for UNIX socket Diffstat (except docs and test files) ------------------------------------- neutron/agent/l3/dvr_edge_router.py | 16 ++-- neutron/agent/l3/dvr_snat_ns.py | 19 +++-- neutron/agent/linux/utils.py | 2 +- neutron/api/v2/base.py | 3 +- neutron/db/l3_dvr_db.py | 11 +-- neutron/db/l3_dvrscheduler_db.py | 29 ++++--- .../unit/scheduler/test_l3_agent_scheduler.py | 61 +++++++++------ neutron/wsgi.py | 12 +-- tools/configure_for_func_testing.sh | 3 +- 14 files changed, 132 insertions(+), 168 deletions(-)

1 0

[new][neutron] neutron-vpnaas 7.1.1 release (liberty)
by no-reply＠openstack.org 10 Jun '16

10 Jun '16

We are chuffed to announce the release of: neutron-vpnaas 7.1.1: OpenStack Networking VPN as a Service This release is part of the liberty stable release series. For more details, please see below. Changes in neutron-vpnaas 7.1.0..7.1.1 -------------------------------------- 865b5f7 Use constraints on all targets. Diffstat (except docs and test files) ------------------------------------- tools/configure_for_vpn_func_testing.sh | 1 + tox.ini | 63 +++++--------------------- 4 files changed, 13 insertions(+), 54 deletions(-)

1 0

[new][neutron] neutron-lbaas 7.1.1 release (liberty)
by no-reply＠openstack.org 10 Jun '16

10 Jun '16

We are delighted to announce the release of: neutron-lbaas 7.1.1: OpenStack Networking Load Balancing as a Service This release is part of the liberty stable release series. For more details, please see below. Changes in neutron-lbaas 7.0.4..7.1.1 ------------------------------------- 0674621 Make all tox targets constrained bfc8b51 Update local.conf to use Cirros 0.3.4 c65ca64 Pass config info in neutron-lbaas api v2 tempest tests 0b7b089 Fix scenario tests for octavia driver Diffstat (except docs and test files) ------------------------------------- devstack/samples/local.conf | 2 +- .../v2/scenario/test_healthmonitor_basic.py | 7 --- .../tempest/v2/scenario/test_listener_basic.py | 8 +-- tools/tox_install.sh | 14 ++++- tox.ini | 10 +++- 7 files changed, 95 insertions(+), 49 deletions(-)

1 0

[swift] OpenStack Swift 2.8.0 has been released
by John Dickinson 09 Jun '16

09 Jun '16

I'm happy to announce that OpenStack Swift 2.8.0 has been released. This release includes several feature improvements and important bug fixes, and I recommend that everyone upgrade as soon as possible. As always, you can upgrade to this version with no end-user downtime. The full release notes can be found at https://github.com/openstack/swift/blob/master/CHANGELOG. The release is available at https://tarballs.openstack.org/swift/. Feature highlights: * Concurrent bulk deletes now uses concurrency to speed up the process. This will result in faster API responses to end users. The amount of concurrency used is configurable by the operator, and it defaults to 2. * Server-side copy has been refactored to be entirely encapsulated in middleware. Not only does this make the code cleaner and make it easier to support external middleware, this change is necessary for the upcoming server-side encryption functionality. * The `fallocate_reserve` setting can now be a percent of drive capacity instead of just a fixed number of bytes. * the deprecated `threads_per_disk` setting has been removed. Deployers are encouraged to use `servers_per_port` instead. Bug-fix highlights: * Fixed an infinite recursion issue when syslog is down. * Fixed a rare case where a backend failure during a read could result in a missing byte in the response body. * `disable_fallocate` not also correctly disables `fallocate_reserve`. * Fixed an issue where a single-replica configuration for account or container DBs could result in the DB being inadvertently deleted if it was placed on a handoff node. * Reclaim isolated .meta files if they are older than the `reclaim_age`. This release is the work of 42 different developers, including 16 first-time contributors. That you to the whole community for your work during this release. --John

1 0