Plugin doesn't get called when explicit rules are auto-created.

[Tomoe Sugihara]

When security groups are created, explicit rules are automatically created--- allow all for egress, allow all ingress withing "default" SG. Those auto-creations are done directly through DB models, so plugin doesn't get called. Plugin would have no chances to do something upon creation of a SG rule.

[Tomoe Sugihara (tomoe)]

I should have caught this earlier when I was working on adding explicit egress rules. I'm now working on a patch to fix this.

[Aaron Rosen (arosen)]

For grizzly I would recommend backporting a pactch for you plugin to explicity add the rules and then we can do something better in Havana.

[Tomoe Sugihara (tomoe)]

Hi Aaron,

Makes sense. I'm working on a patch for H1. As for our plugin, our code in G still need more work to support SG, so I'm working on SG implementation targeted for H. Hopefully I can backport something to G in the future.

[Tomoe Sugihara (tomoe)]

Hi Aaron,

With my following change, I found a mutual recursion issue in the NVP plugin where _ensure_default_security_group() gets called infinitely.

diff --git a/quantum/db/securitygroups_db.py b/quantum/db/securitygroups_db.py
index c2b42b5..b812d20 100644
--- a/quantum/db/securitygroups_db.py
+++ b/quantum/db/securitygroups_db.py
@@ -105,22 +105,33 @@ class SecurityGroupDbMixin(ext_sg.SecurityGroupPluginBase):
             for ethertype in ext_sg.sg_supported_ethertypes:
                 if s.get('name') == 'default':
                     # Allow intercommunication
- ingress_rule = SecurityGroupRule(
- id=uuidutils.generate_uuid(), tenant_id=tenant_id,
- security_group=security_group_db,
- direction='ingress',
- ethertype=ethertype,
- source_group=security_group_db)
- context.session.add(ingress_rule)
-
- egress_rule = SecurityGroupRule(
- id=uuidutils.generate_uuid(), tenant_id=tenant_id,
- security_group=security_group_db,
- direction='egress',
- ethertype=ethertype)
- context.session.add(egress_rule)
-
- return self._make_security_group_dict(security_group_db)
+ ingress_rule = {'security_group_rule':
+ {'tenant_id': tenant_id,
+ 'security_group_id':
+ security_group_db.id,
+ 'direction': 'ingress',
+ 'ethertype': ethertype,
+ 'port_range_min': None,
+ 'port_range_max': None,
+ 'remote_group_id':
+ security_group_db.id,
+ 'protocol': None,
+ 'remote_ip_prefix': None}}
+ self.create_security_group_rule(context, ingress_rule)
+
+ egress_rule = {'security_group_rule':
+ {'tenant_id': tenant_id,
+ 'security_group_id': security_group_db.id,
+ 'direction': 'egress',
+ 'ethertype': ethertype,
+ 'port_range_min': None,
+ 'port_range_max': None,
+ 'remote_group_id': None,
+ 'protocol': None,
+ 'remote_ip_prefix': None}}
+ self.create_security_group_rule(context, egress_rule)
+
+ return self.get_security_group(context, security_group_db.id)

     def get_security_groups(self, context, filters=None, fields=None,
                             sorts=None, limit=None,

Would it make sense to remove _ensure_default_security_group() call in create_security_group_rule_bulk() as follows?
I thought it'd be OK because you wouldn't create a SG rule without having a SG and SG c...

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/25354

[Eugene Nikanorov (enikanorov)]

The patch was abandoned more than a year ago. I suggest marking it as Won't fix as community seems not to be interested in fixing this.

[Armando Migliaccio (armando-migliaccio)]

This bug is > 172 days without activity. We are unsetting assignee and milestone and setting status to Incomplete in order to allow its expiry in 60 days.

If the bug is still valid, then update the bug status.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]