security-groups rule add does not handle "any" protocol or port (while neutron allows it)

[Yves-Gwenael Bourhis]

Neutron allows setting port or protocol wildcard by not specifying any value for them.

example, these are allowed by neutron :

    neutron security-group-rule-create --direction egress <sec_group_id>
    neutron security-group-rule-create --direction egress --protocol tcp <sec_group_id>

Currently horizon refuses not specifying a port and does not mention that we can leave the protocol field empty as a wildcard. Meaning that the above commands can not be performed via horizon.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/440621

[Lajos Katona (lajos-katona)]

Hi,
You can use the All TCP or All UDP rules and that has the same feature as the wildcards in the CLI.

[Yves-Gwenael Bourhis (yves-gwenael-bourhis)]

ALL TCP/UDP does not handle the request like `neutron security-group-rule-create --direction egress --protocol tcp <sgid>` would.

Indeed, after creating a rune with `neutron security-group-rule-create --direction egress --protocol tcp <sgid>` you see in horizon :

    Egress IPv4 TCP 1 - None 0.0.0.0/0 -

With ALL TCP the created rule is seen this way:

    Egress IPv4 TCP Any 0.0.0.0/0

In CLI here are the differences when issuing a security-group-show:
http://paste.openstack.org/show/602511/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/440621
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=87337ff255b581a57809e7ea9d901c00b3514d45
Submitter: Jenkins
Branch: master

commit 87337ff255b581a57809e7ea9d901c00b3514d45
Author: Yves-Gwenael Bourhis <email address hidden>
Date: Thu Mar 2 16:13:18 2017 +0100

    Allow any port or protocol in security group rules

    Neutron allows setting port or protocol wildcard by not specifying any value
    for them.

    Example, these are allowed by neutron:

        neutron security-group-rule-create --direction egress <sgid>
        neutron security-group-rule-create --direction egress --protocol tcp <sgid>

    Specifying '-1' for IP protocol means a wildcard IP protocol.
    validate_ip_protocol is updated accordingly.

    'All ports' choice is added to 'Open Port' field.

    Change-Id: I4a7262eda89e3206c743fee14c78aa6b49308ce6
    Closes-Bug: 1669467

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/horizon 12.0.0.0b1 development milestone.

[Peter (fazy)]

Hi! I wrote a duplicate about this (#1711319) but I reply here since the page asked me to update only if it's not a duplicate...

So if possible, I would like to ask the backport to Ocata (or maybe Newton), since we are planning to upgrade our Mitaka soon (in separated steps, release by release), but not to Pike.

Thanks,
 Peter ERDOSI