quantum driver in nova does not translate empty remote IP

[Andrea Frittoli]

The quantum driver in nova does not translate empty remote IP in security group rules into a CIDR valid for nova.

Quantum allows for an empty remote_ip_prefix to be specified in ingress rules. An empty value means "any host".

Nova instead expects the remote_ip_prefix to be non-empty:
- create an ingress SG rule with empty remote IP via quantum
- display the rule via nova API works fine
- deleting the rule via nova API fails

The quantum driver in nova shall translate the empty remote IP in the security group rule into 0.0.0.0/0.

[melanie witt (melwitt)]

Do you mean that deleting the rule via nova CLI fails?

Because I'm able to successfully delete a rule created via quantum by calling nova REST API:

DELETE v2/{tenant_id}/os-security-group-rules/{security_group_rule_id}

The nova CLI command however requires an argument for the CIDR and trying "" or 0 fail for me and I'm unable to delete the rule.

usage: nova secgroup-delete-rule <secgroup> <ip-proto> <from-port> <to-port> <cidr>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/30154

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/30154
Committed: http://github.com/openstack/nova/commit/db95ffa55cbb668e6854e25b215a7e2048e20349
Submitter: Jenkins
Branch: master

commit db95ffa55cbb668e6854e25b215a7e2048e20349
Author: Melanie Witt <email address hidden>
Date: Wed May 22 18:23:45 2013 +0000

    translates empty remote_ip_prefix to valid cidr for nova

    Quantum allows empty remote_ip_prefix to mean "any host"
    but Nova uses a CIDR as part of each rule.

    Fixes bug 1180828

    Change-Id: I4983515ccd0cc621491d63e59d6ab6ac4dd74b6a