yahoo-eng-team team mailing list archive

[Sean Dague <sean@xxxxxxxxx>]

** Changed in: nova
       Status: Incomplete => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1218494

Title:
  Nova security policies are being ignored

Status in OpenStack Compute (Nova):
  Invalid

Bug description:
  I have a multi-node Openstack Grizzly setup: 1 front-end network node
  (3 nics) and 2 compute nodes (3 nics). Everything seems to work
  perfectly: VM's have external access, I can ping the VM's from the
  virtual router, VM's can communicate between themselves...

  However, I am unable to ping the VM's from any compute node to the
  VM's. I have added the virtual router to the routing table, I changed
  the default security permissions...

  practicas@lemarq:~$ route
  Kernel IP routing table
  Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
  default         192.168.0.1     0.0.0.0         UG    0      0        0 br-ex
  10.5.5.0        192.168.0.100   255.255.255.0   UG    0      0        0 br-ex  # VIRTUAL ROUTER
  192.168.0.0     *               255.255.255.0   U     0      0        0 br-ex
  192.168.100.0   *               255.255.255.0   U     1      0        0 eth1

  practicas@lemarq:~$ nova secgroup-list-rules default
  +-------------+-----------+---------+-----------+--------------+
  | IP Protocol | From Port | To Port | IP Range  | Source Group |
  +-------------+-----------+---------+-----------+--------------+
  | icmp        | -1        | -1      | 0.0.0.0/0 |              |
  | tcp         | 1         | 65535   | 0.0.0.0/0 |              |
  +-------------+-----------+---------+-----------+--------------+

  
  In order to prove that it is a problem with nova security permissions I have done the following experiment. I tried to ping from the compute node 192.168.0.204 to a VM 10.5.5.4. The VM's interface in br-int (in the compute node) is qvoc55f44c6-af. I executed tcpdump in qvoc55f44c6-af and I see the icmp package. However, inside the VM, I did tcpdump in eth0 and no sign of this icmp package appeared. If I ping from the virtual router this does not happen.  Thank you in advance.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1218494/+subscriptions