No results found.
I traced the full lifecycle of an OVN ACL — from the moment you type ovn-nbctl acl-add, through northd scanning, pipeline stage generation, conntrack commitment, all the way to the OpenFlow rules hitting your datapath. Here's everything I found along the way.
A breakdown of my full exploit chain for SEKAI CTF 2026's Filtered Reality challenge. This writeup features WordPress routing desyncs, CSP evasion via SXGs, popping headless Chromium using a V8 WASM bug, and a cryptographic length extension attack.
Bypassing script-destination body stripping via HTTP/1.1 socket pooling desynchronization, followed by brute-forcing a cross-origin flag using a Chromium Range Request cache side-channel.
I built a 5-node OVN cluster on libvirt, implemented a VPC with private subnets, SNAT, and load balancing, debugging through a database crash, stale chassis references, a per-chassis conntrack design constraint, and deep OpenFlow tracing. Full technical walkthrough.
Exploiting a TOCTOU race between O_TRUNC+write and unlocked os.ReadFile to freeze a spliced SVG onload payload into a persistent file, turning the admin bot's single GET into a guaranteed XSS.
