IPv6 Scenario tests should use icmpv6 protocol for Security Group rule

[Sridhar Gaddam]

Currently to validate some IPv6 scenario tests, tempest uses ping6 to check the IPv6 connectivity between VMs spawned on a network.
Before validating ping6, tempest configures a Security Group rule with ethertype='IPv6' and protocol='icmp'.

While this is not a problem with the reference firewall driver in Neutron, in OpenDaylight we noticed that SG rule was configured with icmp as per the rule and IPv6 Scenario tests are failing.

Ideally, tempest should configure ICMPv6 rule with protocol='icmpv6' and not with protocol='icmp'

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/443444

[Ghanshyam Mann (ghanshyammann)]

yea icmpv6 seems right way to pass as protocol for ipv6 sec grp to avoid duplicate entry in neutron but can you please give more information on failure with 'icmp' ?

neutron should support legacy 'icmp' also.

[Sridhar Gaddam (sridhargaddam)]

Agree that Neutron should support icmp for backward compatibility. Here, I'm taking about an issue that is observed when using Neutron+OpenDaylight and not with Neutron ML2/OVS reference implementation.

API tests in Neutron would validate that icmp can be supplied for backward compatibility.
But tempest IPv6 "Scenario tests" should ideally use "icmpv6" and not icmp.

[Ghanshyam Mann (ghanshyammann)]

Sure, let's find the best way to go on this. started mail thread- http://lists.openstack.org/pipermail/openstack-dev/2017-March/114570.html

[Sridhar Gaddam (sridhargaddam)]

Thanks @Ghanshyam, I've replied to the thread.

Also, I would like to clarify that tempest should validate Neutron API is supporting the different configuration methods like icmp/icmpv6/ipv6-icmp etc for backward compatibility. But, such tests should be part of API tests and not the scenario tests. IMO, the tempest scenario test should use the right value (i.e., protocol=icmpv6).

[OpenStack Infra (hudson-openstack)]

Change abandoned by Sridhar Gaddam (<email address hidden>) on branch: master
Review: https://review.openstack.org/443444

[Ken'ichi Ohmichi (oomichi)]

The comment from the corresponding patch:

"Ideally neutron should support all of them. Anyways, as discussed in the email thread [*], the real fix should be in Neutron. So, abandoning this patch."

[*] http://lists.openstack.org/pipermail/openstack-dev/2017-March/114614.html