ICMPv6 is not an available protocol when creating Firewall-Rule

[Yue Qu]

When creating IPv6 firewall rule, the network protocol that can be selected is ICMP TCP UDP or null，but in fact, ICMPv6 is the message control protocol we actually need for the firewall rule whose ip-version = 6.

I tried to create a firewall rule whose "ip-version=6 ,protocol = ICMP".
After the creation，in the ip6tables of the router, the effective rules are as follows:

-A neutron-l3-agent-ov6a99ac434 -p icmp -j ACCEPT
-A neutron-l3-agent-iv6a99ac434 -p icmp -j ACCEPT

In ip6tables, ICMP cannot control the ipv6 data packet, which means that the above two rules are invalid.

In summary: 1) I think we should list ICMPv6 as an optional protocol when creating firewall rules.

            2) Or when creating firewall rule whose "ip-version=6 ,protocol = ICMP", we should consider that the "ICMP"
            specified here refers to ICMPv6.

[Brian Haley (brian-haley)]

The first thing I noticed is that the rules you pasted are from the l3-agent, is this related to FWaaS and not the SG code in neutron?

Because the following works for me for SG:

$ openstack security group rule create --ingress --protocol icmp --ethertype IPv6 default

# ip6tables-save | grep icmp
-A neutron-openvswi-ib3229831-9 -p ipv6-icmp -j RETURN

That has 'ipv6-icmp' unlike the output you pasted, and it's the L2 agent.

So if this is FWaaS then perhaps they have a bug in how iptables rules are being generated, the base neutron code has some logic to deal with this case specially.

[Yue Qu (bruceq-)]

Yes Brian, this bug is only related to FWaaS , the SG works well

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/618388

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/618388
Committed: https://git.openstack.org/cgit/openstack/neutron-fwaas/commit/?id=fa48d16d694269b6b4245b90454448f8e9895ed8
Submitter: Zuul
Branch: master

commit fa48d16d694269b6b4245b90454448f8e9895ed8
Author: quyue <email address hidden>
Date: Fri Nov 16 10:35:04 2018 +0800

    ICMPv6 is not an available protocol when creating firewall rule

    When creating IPv6 firewall rule, the network protocol that can be
    selected is ICMP TCP UDP or null.
    But in fact, ICMPv6 is the message control protocol we actually need
    for the firewall rule whose ip-version = 6.

    This patch fixes this bug with the following logic:
    When creating firewall rule whose "ip-version = 6, protocol = ipv6-icmp"
    , we should consider that the "icmp" refers to "ipv6-icmp".

    Closes-Bug: #1799904
    Change-Id: I27cff5ba9986f30fa4c7ddb12db920300edd521b

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron-fwaas 14.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.opendev.org/680753

[Slawek Kaplonski (slaweq)]

This bug has had a related patch abandoned and has been automatically un-assigned due to inactivity. Please re-assign yourself if you are continuing work or adjust the state as appropriate if it is no longer valid.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Slawek Kaplonski (<email address hidden>) on branch: stable/rocky
Review: https://review.opendev.org/680753
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.