* Summary
When a security group rule is created with protocol number 1, 58 or icmpv6, with port_range_min supplied as icmp-type. Iptables security group driver will fail to apply the rules.
* Environment
devstack + openvswitch-agent + securitygroup firewall_driver=iptables-hybrid
* Step-by-step reproduction steps:
1. Create a network and a subnet
2. boot a VM in the network
3. create a new security group rule as the followings in the SG of the VM's port:
- openstack security group rule create --ethertype IPv4 --icmp-type 8 --icmp-code 0 --protocol 1 --ingress <SG_ID>
- openstack security group rule create --ethertype IPv6 --icmp-type 128 --icmp-code 0 --protocol 58 --ingress <SG_ID>
- openstack security group rule create --ethertype IPv6 --icmp-type 128 --icmp-code 0 --protocol icmpv6 --ingress <SG_ID>
4. check neutron-openvswitch-agent's LOG
* Expected output:
- SG rules are successfully created and applied on the port without errors
Actual output:
- SG rules are successfully created
- Errors in neutron-openvswitch-agent's LOG about iptables/ip6tables failed to apply
- Wrong iptables/ip6tables rule is generated:
- "Stderr: iptables-restore v1.6.1: multiport only works with TCP, UDP, UDPLITE, SCTP and DCCP"
- -I neutron-openvswi-if1905f5e-9 5 -p icmp -m icmp -m multiport --dports 8:0 -j RETURN
- -I neutron-openvswi-if1905f5e-9 8 -p ipv6-icmp -m icmp6 -m multiport --dports 128:0 -j RETURN
Fix proposed to branch: master
Review: https:/