yahoo-eng-team team mailing list archive

[Brian Haley <1618082@xxxxxxxxxxxxxxxxxx>]

I could not find any patch that would have changed this, and I correctly
see a rule for protocol 255 being allowed when I try this:

# iptables-save | grep 255
-A neutron-openvswi-i2232cefa-0 -p 255 -j RETURN

Since 255 is a valid, although reserved, protocol value, the code seems
to be operating normally.  For what you're trying to do you should not
be specifying any --protocol value - 255 is not a wildcard.

** Changed in: neutron
       Status: Incomplete => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1618082

Title:
  security rule with --protocol 255 does not gets programmed

Status in neutron:
  Invalid

Bug description:
  With the latest master (August 29, 2016) I see an issue with neutron
  security group, these sequence of commands should create a group
  allowign all traffic in or out:

  neutron security-group-create  all-in-all-out
  neutron security-group-rule-create --direction ingress --ethertype ipv4 --protocol 255 --remote-ip-prefix 0.0.0.0/0  all-in-all-out  
  neutron security-group-rule-create --direction ingress --ethertype ipv6 --protocol 255 --remote-ip-prefix ::/0  all-in-all-out  

  when this group gets attached to the instance, these rules do not get programmed. In order to be able to ping the instance from outside I need to add this rule:
   
  neutron  security-group-rule-create --direction ingress --ethertype ipv4 --protocol icmp --remote-ip-prefix 0.0.0.0/0 all-in-all-out

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1618082/+subscriptions