yahoo-eng-team team mailing list archive

[Yue Qu <1799904@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

When creating IPv6 firewall rule, the network protocol that can be
selected is ICMP TCP UDP or null，but in fact, ICMPv6 is the message
control protocol we actually need for the firewall rule whose ip-version
= 6.

I tried to create a firewall rule whose "ip-version=6 ,protocol = ICMP".
After the creation，in the ip6tables of the router, the effective rules are as follows:

-A neutron-l3-agent-ov6a99ac434 -p icmp -j ACCEPT
-A neutron-l3-agent-iv6a99ac434 -p icmp -j ACCEPT

In ip6tables, ICMP cannot control the ipv6 data packet, which means that
the above two rules are invalid.

In summary: 1) I think we should list ICMPv6 as an optional protocol when creating firewall rules.
            
            2) Or when creating firewall rule whose "ip-version=6 ,protocol = ICMP", we should consider that the "ICMP" 
            specified here refers to ICMPv6.

** Affects: neutron
     Importance: Undecided
     Assignee: Yue Qu (bruceq-)
         Status: New


** Tags: ipv6

** Changed in: neutron
     Assignee: (unassigned) => Yue Qu (bruceq-)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1799904

Title:
  ICMPv6 is not an available protocol when creating Firewall-Rule

Status in neutron:
  New

Bug description:
  When creating IPv6 firewall rule, the network protocol that can be
  selected is ICMP TCP UDP or null，but in fact, ICMPv6 is the message
  control protocol we actually need for the firewall rule whose ip-
  version = 6.

  I tried to create a firewall rule whose "ip-version=6 ,protocol = ICMP".
  After the creation，in the ip6tables of the router, the effective rules are as follows:

  -A neutron-l3-agent-ov6a99ac434 -p icmp -j ACCEPT
  -A neutron-l3-agent-iv6a99ac434 -p icmp -j ACCEPT

  In ip6tables, ICMP cannot control the ipv6 data packet, which means
  that the above two rules are invalid.

  In summary: 1) I think we should list ICMPv6 as an optional protocol when creating firewall rules.
              
              2) Or when creating firewall rule whose "ip-version=6 ,protocol = ICMP", we should consider that the "ICMP" 
              specified here refers to ICMPv6.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1799904/+subscriptions