neutron/neutron/cmd
Jens Harbott a7afd6e86d Secure dnsmasq process against external abuse
Currently any dhcp agent instance will work as an open resolver. For
deployments using publicly routed addresses for tenant networks, this
allows the agent being abused in dDoS attacks, see [1].

By setting the `--local-service` option dnsmasq will filter DNS queries
and reply only to queries from directly attached networks.

[1] https://bugs.launchpad.net/neutron/+bug/1501206

Conflicts:
    neutron/cmd/sanity_check.py

Closes-Bug: 1501206
Change-Id: I76d810aad2ce0f15a88bd798963012fa0efca74e
(cherry picked from commit 0fce3ca2c1)
2019-02-01 09:07:14 +00:00
..
eventlet use service type constants from neutron_lib plugins 2017-06-27 15:16:05 -06:00
sanity Secure dnsmasq process against external abuse 2019-02-01 09:07:14 +00:00
__init__.py Fix logging error for Guru Meditation Report 2016-02-08 16:52:17 -08:00
ipset_cleanup.py Make use of -w argument for iptables calls 2017-08-31 20:28:53 +00:00
keepalived_state_change.py Replace keepalived notifier bash script with Python ip monitor 2015-03-18 18:59:33 -04:00
linuxbridge_cleanup.py Switch IPDevice.exists() method to use pyroute2 2018-03-19 11:56:45 +01:00
netns_cleanup.py Configure privsep helper in neutron-netns-cleanup 2018-06-12 15:07:07 +02:00
ovs_cleanup.py Override ovsdb_timeout default value in ovs_cleanup tool 2018-04-17 19:36:41 +00:00
pd_notify.py neutron-lib: use replace_file from neutron lib 2016-11-07 09:18:41 +00:00
runtime_checks.py Move dhcp_release6_supported to runtime checks file 2017-02-15 16:29:01 -06:00
sanity_check.py Secure dnsmasq process against external abuse 2019-02-01 09:07:14 +00:00