The name of the security group rule field "source_ip_prefix" is misleading

Bug #1144426 reported by Tomoe Sugihara
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
Undecided
Aaron Rosen
neutron
Fix Released
High
Nachi Ueno
python-neutronclient
Fix Released
High
Aaron Rosen

Bug Description

By the implementation, this is interpreted as source ip prefix for ingress rules and destination ip prefix for egress rules.
This should be renamed to avoid confusions.

Apparently, there was a discussion to rename it to remote_* (cidr or ip_prefix?).

Tags: sg-fw
Revision history for this message
Akihiro Motoki (amotoki) wrote :

To make sure to track this issue, I'll target it to Grizzly-rc1. We will discuss it in the today's team meeting.
The reason of Importance High is that it is related to API attributes and it becomes difficult to change once Grizzly quantum is shipped.

Changed in quantum:
milestone: none → grizzly-rc1
importance: Undecided → High
tags: added: sg-gw
tags: added: sg-fw
removed: sg-gw
Aaron Rosen (arosen)
Changed in quantum:
assignee: nobody → Aaron Rosen (arosen)
Revision history for this message
Aaron Rosen (arosen) wrote :

What's the consensus of dropping the source on source_ip_prefix?

Revision history for this message
Aaron Rosen (arosen) wrote :

Same with source on source_group_ip. If you have a rule direction=ingress, group_id=group1 means you can receive from group1 and direction=egress,group_id=group1 means you can send to group1. Having source there is confusing as well.

Revision history for this message
Akihiro Motoki (amotoki) wrote :

In my understanding, there is no such consensus.

We need to consider both source_ip_prefix and source_group_id.

Regarding source_ip_prefix, there is no problem even when we drop "source_".

On the other hand, the situation is different in the case of source_group_id.
"group_id" is confusing since we have "security_group_id" attribute.
Thus it would be better to have some prefix which can be used for ingress and egress.
In the mail two or three months ago, I proposed "remote_" as a prefix.

There are some options:
- source_ip_prefix -> ip_prefix / cidr / remote_ip_prefix / remote_cidr ?
- source_group_id -> remote_group_id ?

Is there any other better prefix?

Revision history for this message
dan wendlandt (danwent) wrote : Re: [Bug 1144426] Re: The name of the security group rule field "source_ip_prefix" is misleading

I tend to prefer the term "remote"

On Mon, Mar 4, 2013 at 10:07 AM, Aaron Rosen <email address hidden> wrote:

> Same with source on source_group_ip. If you have a rule
> direction=ingress, group_id=group1 means you can receive from group1 and
> direction=egress,group_id=group1 means you can send to group1. Having
> source there is confusing as well.
>
> --
> You received this bug notification because you are a member of Netstack
> Core Developers, which is subscribed to quantum.
> https://bugs.launchpad.net/bugs/1144426
>
> Title:
> The name of the security group rule field "source_ip_prefix" is
> misleading
>
> Status in OpenStack Quantum (virtual network service):
> New
>
> Bug description:
> By the implementation, this is interpreted as source ip prefix for
> ingress rules and destination ip prefix for egress rules.
> This should be renamed to avoid confusions.
>
> Apparently, there was a discussion to rename it to remote_* (cidr or
> ip_prefix?).
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/quantum/+bug/1144426/+subscriptions
>

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Dan Wendlandt
Nicira, Inc: www.nicira.com
twitter: danwendlandt
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Revision history for this message
Aaron Rosen (arosen) wrote :

Hi Akihiro,

Good points. My vote would be what you propose to change source_group_id to remote_group_id and source_ip_prefix to remote_ip_prefix.

I think remote_ip_prefix is also a better choice than ip_prefix because this value is never oneself. For example:

remote_ip_prefix=1.1.1.1, direction=ingress # 1.1.1.1 can talk to you
remote_ip_prefix=1.1.1.1, direction=egress # you can talk to 1.1.1.1

I think remote_ makes things even more clear here.

dan wendlandt (danwent)
Changed in quantum:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to quantum (master)

Fix proposed to branch: master
Review: https://review.openstack.org/23451

Aaron Rosen (arosen)
Changed in python-quantumclient:
importance: Undecided → High
assignee: nobody → Aaron Rosen (arosen)
Changed in nova:
assignee: nobody → Aaron Rosen (arosen)
Changed in python-quantumclient:
milestone: none → 2.2
Revision history for this message
Aaron Rosen (arosen) wrote :

I have the changes for python-qquantumclient and quantum up that change source_group_id -> remote_group_id and source_ip_prefix -> remote_ip_prefix . It seems both Akihiro, Dan (and myself) are on board with this name change so I removed the WIP.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (master)

Fix proposed to branch: master
Review: https://review.openstack.org/23459

Changed in nova:
status: New → In Progress
Aaron Rosen (arosen)
Changed in python-quantumclient:
status: New → Incomplete
status: Incomplete → In Progress
Changed in quantum:
assignee: Aaron Rosen (arosen) → Nachi Ueno (nati-ueno)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-quantumclient (master)

Reviewed: https://review.openstack.org/23450
Committed: http://github.com/openstack/python-quantumclient/commit/77ea68e4527d41409f264286ae1cf296ab9152c2
Submitter: Jenkins
Branch: master

commit 77ea68e4527d41409f264286ae1cf296ab9152c2
Author: Aaron Rosen <email address hidden>
Date: Mon Mar 4 10:50:54 2013 -0800

    Rename source_(group_id/ip_prefix) to remote_(group_id/ip_prefix)

    Fixes bug 1144426

    Change-Id: I3c5ac92f583ffce19f5ed38219d796bc6585e123

Changed in python-quantumclient:
status: In Progress → Fix Committed
Changed in quantum:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to quantum (master)

Reviewed: https://review.openstack.org/23451
Committed: http://github.com/openstack/quantum/commit/375535e20cddefd751aea608d4f18ff7bb8e0c50
Submitter: Jenkins
Branch: master

commit 375535e20cddefd751aea608d4f18ff7bb8e0c50
Author: Aaron Rosen <email address hidden>
Date: Mon Mar 4 11:04:41 2013 -0800

    Rename source_(group_id/ip_prefix) to remote_(group_id/ip_prefix)

    Fixes bug 1144426

    Change-Id: I8b62044b6e679d923fffef69a49f4fd55751f116

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova (master)

Reviewed: https://review.openstack.org/23459
Committed: http://github.com/openstack/nova/commit/cb03ee55fb5377ef51c0682ad3a687676251b35a
Submitter: Jenkins
Branch: master

commit cb03ee55fb5377ef51c0682ad3a687676251b35a
Author: Aaron Rosen <email address hidden>
Date: Mon Mar 4 11:13:12 2013 -0800

    Rename source_(group_id/ip_prefix) to remote_(group_id/ip_prefix)

    Fixes bug 1144426

    Change-Id: I28735aea05738487861e477aaa3b0a3cec081821

Changed in nova:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in quantum:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in nova:
milestone: none → grizzly-rc1
status: Fix Committed → Fix Released
Akihiro Motoki (amotoki)
Changed in python-quantumclient:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in quantum:
milestone: grizzly-rc1 → 2013.1
Thierry Carrez (ttx)
Changed in nova:
milestone: grizzly-rc1 → 2013.1
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.