Security Group Rules can only be specified in one direction

[Matt]

It might save users potentially a lot of time if instead of only offering an INGRESS and an EGRESS direction, if they could specify a BOTH direction. Whenever someone needs to enter both an ingress and egress rule for the same port they have to enter it twice, remembering all of the information they need (since it can't be cloned). If they forget to flip the direction the second time from the default value, it'll error out as a duplicate and they'll have to try a third time. If they messed up the second rule, there's no edit, so they would have to delete it if they got a value wrong and do it all over again.

It would be awesome if the UI allowed for specifying both an ingress and egress rule at the same time, even if all it did was create the ingress and egress rows and put them in the table, at least they'd be guaranteed to have the same configuration.

[Matt (mreid)]

Adding in neutron and nova since this seems like a similar issue to https://bugs.launchpad.net/horizon/+bug/1326124 and that's how my other bug was labelled.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/140676

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/141039

[Elena Ezhova (eezhova)]

Hi Matt, could you please provide an example of a probable use case when a user might need to specify a BOTH direction when creating a security group rule?

[Matt (mreid)]

Elena: Back when I filed this, that was how the documentation was written for setting up CloudForms on OpenStack, if you wanted to ensure the proper ports were opened. Looking at the documentation now, it doesn't mention direction anymore, but at the time, there were many that were specified as BOTH, and I had to create two rules for each one, as I could only do INGRESS and EGRESS through the Horzion UI, and I couldn't find a way to specify direction through the nova network CLI command.

https://access.redhat.com/documentation/en-US/CloudForms/3.1/html/Installing_CloudForms_on_Red_Hat_OpenStack_Platform/sect-Security.html

[OpenStack Infra (hudson-openstack)]

Change abandoned by Elena Ezhova (<email address hidden>) on branch: master
Review: https://review.openstack.org/140676
Reason: There is no really important usecase for this change.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Elena Ezhova (<email address hidden>) on branch: master
Review: https://review.openstack.org/141039
Reason: There is no really important usecase for this change.

[Sean Dague (sdague)]

Closing an a possible, though unlikely future feature

[Akihiro Motoki (amotoki)]

Nova API drops security group support, so I mark the status of Nova as Won't Fix.

[Akihiro Motoki (amotoki)]

[comments as my neutron hat]
The demand is still not clear. Security Group behavior is stateful, so the ingress rule and egress rule are completely different.
There is no other feedback like this so far. This is the only one. Use case is not clear. So I don't add neutron to the affected project.

[comments as my horizon hat]
The feature completely depends on the backend service, i.e., neutron now, so there is nothing to do in horizon. Thus this is invalid as horizon.