yahoo-eng-team team mailing list archive

[Roey Chen <roeyc@xxxxxxxxxx>]

Public bug reported:

Neutron security-group allow the user to define security groups so that only traffic matched with security group rules are allowed.
Sometimes it’s simpler to define these rules as blocking rules which matched on traffic that should not be allowed (e.g - allow all traffic except ssh).

Supporting both ‘deny’ and ‘allow’ rules combined in one security-group may impair the simplicity of the security-group API, therefore, we'd like to consider the option of allowing a new type of security-group, one which all rules implicit action is 'deny'.
This group should be constructed as any other security-group (by creating rules and assigning to ports).
A Neutron port then could be associated with one or more of both security-group types.

For each port, ’deny’ rules (when port is associated with one or more
"deny" security group) will always be matched before ‘allow’ rules.

** Affects: neutron
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1592005

Title:
  [RFE] Security-groups that blocks matched traffic

Status in neutron:
  New

Bug description:
  Neutron security-group allow the user to define security groups so that only traffic matched with security group rules are allowed.
  Sometimes it’s simpler to define these rules as blocking rules which matched on traffic that should not be allowed (e.g - allow all traffic except ssh).

  Supporting both ‘deny’ and ‘allow’ rules combined in one security-group may impair the simplicity of the security-group API, therefore, we'd like to consider the option of allowing a new type of security-group, one which all rules implicit action is 'deny'.
  This group should be constructed as any other security-group (by creating rules and assigning to ports).
  A Neutron port then could be associated with one or more of both security-group types.

  For each port, ’deny’ rules (when port is associated with one or more
  "deny" security group) will always be matched before ‘allow’ rules.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1592005/+subscriptions