[NETVIRT-513] AAP with prefix 0.0.0.0/0 shouldn't be supported for remote security group rules

Mon, 3 Apr 2017 17:40:39 +0000

Supporting AAP with prefix 0.0.0.0/0 for remote security group rules would lead to a potential security breach. This would result in allowing the traffic from all the IPs.

Below is a sample flow related to remote security group rules for VM (10.10.10.3). This would include nw_src match to allow traffic from VM (10.10.10.3).

cookie=0x6900000, duration=3111.415s, table=252, n_packets=0, n_bytes=0, priority=1001,ct_state=+new+trk,ip,metadata=0x30000000000/0xfffff0000000000,nw_src=10.10.10.3 actions=ct(commit,zone=5001),resubmit(,220)

Below is a sample flow related to remote security group rules for VM having AAP with prefix 0.0.0.0/0. This doesn't have nw_src match which would result in allowing the traffic from all the IPs.

cookie=0x6900000, duration=3111.415s, table=252, n_packets=0, n_bytes=0, priority=1001,ct_state=+new+trk,ip,metadata=0x30000000000/0xfffff0000000000 actions=ct(commit,zone=5001),resubmit(,220).

This bug is raised to not support AAP with 0.0.0.0/0 as part of remote security group rules/flows.

OpenDaylight JIRA

[NETVIRT-513] AAP with prefix 0.0.0.0/0 shouldn't be supported for remote security group rules