ICMP security group rules should have a type and code params instead of using "--port-range-min" and "--port-range-max"

[Rami Vaknin]

Version
======
Havana on rhel

Description
=========
I couldn't find a doc specifying whether icmp security group rules ignore the "--port-range-min" and "--port-range-max" params or use then as code and type as we know from nova security group rules.
I think that it should be:

i. Well documented.
ii. prohibited for use of "--port-range-min" and "--port-range-max" in icmp rules context, new switches should be created for code and type.

[Rami Vaknin (rvaknin)]

I would expect the following doc to be updated:
http://docs.openstack.org/network-admin/admin/content/securitygroup_api_abstractions.html

[Anthony Chow (vcloudernbeer)]

Is this bug available to be worked on? It is assigned to Edgar Magana but no update since Dec 2013. I can take up this task.

[Armando Migliaccio (armando-migliaccio)]

Would need to be verified on latest and supported releases Kilo and Liberty.

[Akihiro Motoki (amotoki)]

ICMP type and code is described in our API site, but the description looks wrong.
Both port_range_min and max mention ICMP type. Either of them should be ICMP code.
It is a bug in openstack manuals.
http://developer.openstack.org/api-ref-networking-v2-ext.html#createSecGroupRule

Agree that neutronclient help message can be improved.
I will add neutronclient to the affected project.

On the other hand, I don't agree we should prohibit the usage of port-range-min/max for ICMP code/type.
It breaks the backward compatibility and affects existing applications.

[Akihiro Motoki (amotoki)]

I filed a bug 1523063 in neutronclient.

[Akihiro Motoki (amotoki)]

One idea is to add icmp-type/code attribute to the security group rule resource.
We can still use port-range-min/max to specify ICMP type/code. If both are specified we can return a bad request response.
I think it is easier to understand without reading a documentation every time we need to specify ICMP.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]

[Anthony Chow (vcloudernbeer)]

amotoki

Are you working on this bug, if not I would like to make the documentation changes to the OpenStack manual

http://developer.openstack.org/api-ref-networking-v2-ext.html#createSecGroupRule

Or this is it for this bug? I am new to OpenStack.

thanks,

anthony.

[Itzik Brown (itzikb1)]

Still relevant in Newton.

[Anthony Chow (vcloudernbeer)]

I would like to work on this bug. Assigning this bug to myself for now. I will raise this on the next IRC meeting.

[Boden R (boden)]

Moving to invalid/unassigned and will timeout in 60 days as-is.

If additional work is needed and in scope please reassign.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]