Security Group specifying protocol 0 results in Error 400

[German Eichberger]

Per the documentation protocol 0 should be allowed (not sure what it does? Accept any protocol? Test?). However it results in a 400 error. Neutron should accept 0.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/511561

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/511561
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=7ff492c5bb9ce9f24f12db40c8e3a33beb47f87b
Submitter: Zuul
Branch: master

commit 7ff492c5bb9ce9f24f12db40c8e3a33beb47f87b
Author: Brian Haley <email address hidden>
Date: Thu Oct 12 15:25:26 2017 -0400

    Support protocol numbers in security group API

    Somewhere along the way we broke supporting numbers in
    the security group API that were not in our known list
    of protocols. In order to fix this properly we must
    use the correct arguments when using iptables-save, as
    it could use a name instead of a number, or vice-versa.
    Determined the list of mappings by doing:

     for num in {0..255}; do iptables -A INPUT -p $num; done
     # iptables-save

    Change-Id: I5895250b47ddf664d214cf085be693c3897e0c87
    Closes-bug: #1716045
    Closes-bug: #1716790

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 12.0.0.0b2 development milestone.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/532188

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/532460

[YAMAMOTO Takashi (yamamoto)]

is anyone working on documentation part? (make it clear what protocol 0 means)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/532188
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=d16f69b3ae925bc4f48f75c84798a8fe2198aa2e
Submitter: Zuul
Branch: stable/pike

commit d16f69b3ae925bc4f48f75c84798a8fe2198aa2e
Author: Brian Haley <email address hidden>
Date: Thu Oct 12 15:25:26 2017 -0400

    Support protocol numbers in security group API

    Somewhere along the way we broke supporting numbers in
    the security group API that were not in our known list
    of protocols. In order to fix this properly we must
    use the correct arguments when using iptables-save, as
    it could use a name instead of a number, or vice-versa.
    Determined the list of mappings by doing:

     for num in {0..255}; do iptables -A INPUT -p $num; done
     # iptables-save

    Change-Id: I5895250b47ddf664d214cf085be693c3897e0c87
    Closes-bug: #1716045
    Closes-bug: #1716790
    (cherry picked from commit 7ff492c5bb9ce9f24f12db40c8e3a33beb47f87b)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/532460
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=8442a144a230964ee88cfee43927eb1b1c94ee03
Submitter: Zuul
Branch: stable/ocata

commit 8442a144a230964ee88cfee43927eb1b1c94ee03
Author: Brian Haley <email address hidden>
Date: Thu Oct 12 15:25:26 2017 -0400

    Support protocol numbers in security group API

    Somewhere along the way we broke supporting numbers in
    the security group API that were not in our known list
    of protocols. In order to fix this properly we must
    use the correct arguments when using iptables-save, as
    it could use a name instead of a number, or vice-versa.
    Determined the list of mappings by doing:

     for num in {0..255}; do iptables -A INPUT -p $num; done
     # iptables-save

    Change-Id: I5895250b47ddf664d214cf085be693c3897e0c87
    Closes-bug: #1716045
    Closes-bug: #1716790
    (cherry picked from commit 7ff492c5bb9ce9f24f12db40c8e3a33beb47f87b)

[Brian Haley (brian-haley)]

Hi Yamamoto, sorry, didn't see your question until now.

I can update the api-ref to make it clear 0 == 'any'. The parameters.yaml file in neutron-lib is kind of a mess in this area so will need a lot of cleanup.

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/534962

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/534962
Committed: https://git.openstack.org/cgit/openstack/neutron-lib/commit/?id=fa8768aaa787e8c94f3f11bcc997560182f04061
Submitter: Zuul
Branch: master

commit fa8768aaa787e8c94f3f11bcc997560182f04061
Author: Brian Haley <email address hidden>
Date: Wed Jan 17 17:34:52 2018 -0500

    Update security group rule protocol parameter text

    Updated text to include "any"/"0" and "ipip"/"4" as
    valid parameters for protocol in security group rules,
    as well as any integer value from [0-255].

    Change-Id: I80ee9bcd885c5c0383925f8d0bb10d34335f8038
    Related-bug: #1716790

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 10.0.5 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 11.0.3 release.