cannot "open-port icmp" on GCE

[Junien F]

Hi,

Running juju 2.5.4, I'm seeing the following on GCE :

2019-05-17 12:15:11 ERROR juju.worker.dependency engine.go:636 "firewaller" manifold worker returned unexpected error: cannot respond to units changes for "machine-0": opening port(s) [-1/icmp 5666/tcp 9103/tcp]: googleapi: Error 400: Invalid value for field 'resource.allowed[0].ports[0]': '-1'. Ports may only be specified on rules whose protocol is one of [TCP, UDP, SCTP]., invalid

I suspect you can repro by doing something like :
juju deploy ubuntu
juju run --unit ubuntu/0 "open-port icmp"
juju expose ubuntu

Thanks

[Junien F (axino)]

Assigned to @wallyworld as per @thumper :)

[Tim McNamara (tim-clicks)]

Thanks for reporting this Junien. This problem occurs because Juju (incorrectly) sends a port number of -1 to the providers. Most providers ignore this, but Google requires that the port number is empty when icmp is set[0].

The code changes to address this are in process. We're looking to update Juju's code during our next available release.

[0] https://cloud.google.com/vpc/docs/firewalls#protocols_and_ports

[Tim McNamara (tim-clicks)]

For future reference, the code that sets the port number to -1 is in the uniter worker[1].

[1]: https://github.com/juju/juju/blob/a68ef5294581cffc85a74ea23cd03b7ad1e00e17/worker/uniter/runner/jujuc/ports.go#L37

[Tim McNamara (tim-clicks)]

A fix has been implemented and is currently going through code review[2]

[2] https://github.com/juju/juju/pull/10208