security group rule listing doesn't show details by default : causes user confusion

That's intended if it's blank that means it's a wild carded. By default all egress traffic is allowed and ingress traffic is allowed only from ports that are part of the same security group.

Uhm, but its not wildcarded. See the iptables dump.

Hi Robert

basically it is blank except some spoof preventing rules.

-A quantum-openvswi-oaa210549-d -m mac ! --mac-source FA:16:3E:7F:4F:76 -j DROP <-- prevents mac spoofing
-A quantum-openvswi-oaa210549-d -p udp -m udp --sport 68 --dport 67 -j RETURN <-- allow DHCP request
-A quantum-openvswi-oaa210549-d ! -s 192.0.2.33/32 -j DROP <-- prevents ip spoofing
-A quantum-openvswi-oaa210549-d -p udp -m udp --sport 67 --dport 68 -j DROP <-- prevents DHCP spoof

Sure, I appreciate what the rules do - but the security-group-rule-list is showing no details, and the rules that are there are not described usefully. The port lists for DHCP in and out for instance, should be shown, but aren't. The IP addresses are wildcard for the most part - but not on the ip spoofing rule. So I don't understand why they shouldn't be shown in a useful manner.

Hi Robert,

I think the issue is that the python-quantumclient isn't printing ethertype for example if you do this it looks more clear what the rules do:

http://codepad.org/T9sichU8

Currently security groups allow all dhcp traffic in. I agree this is not ideal but this is the same way security groups were done in nova so we choose to do the same (sure we should probably change this).

The second thing is that in order to use security groups you need ip spoofing enabled. The reason for this is if ip spoofing was not enabled an instance could change it's source ip in order to get around a security group rule. IMO displaying the ip spoofing rules does us no good.

Two things I guess show up here; the default rendering of security-group-rule-list is confusing. I'll retitle this. I think we should show more detail by default - or at least indicate there *is* more detail to show.

Secondly, ip spoofing is definitely important - but we can modify the DHCP rule like so:

-A quantum-openvswi-oaa210549-d -m mac --mac-source FA:16:3E:7F:4F:76 -s 0.0.0.0/32 -p udp -m udp --sport 68 --dport 67 -j RETURN

To be more tight: 0.0.0.0/32 is the address for DHCP requests; only that and the assigned address may be used.

(Should I file a second bug about tightening up that rule?

I think that would be best to track this as a seperate issue.

The first thing is related to python-quantumclient. I will add python-quantumclient to this bug.

I agree it is useful if we have some information which indicates there's more detail.
Another option is to display rule list in more summarized way. One way is to merge ethertype/protocol/port_range_min/max into one field, for example: "IPv4;1000-1999/udp".

Regarding the second point, specifying the source MAC actually changes nothing since a rule preventing source mac spoofing is evaluated before DHCP request allow rule, but it is better to add the source mac since the rules becomes more robust (e.g., we can consider a case where there is no rule for source mac spoofing).

The second point is filed as neutron bug (bug 1427054).
It needs to be discussed in Neutron side.

Now this bug focuses on the first point:
security-group-rule-list does not show all information returned from the API.

Fix proposed to branch: master
Review: https://review.openstack.org/160770

Reviewed: https://review.openstack.org/160770
Committed: https://git.openstack.org/cgit/openstack/python-neutronclient/commit/?id=4829e25b6a68df0372a3b84c3cc7c9b680ced669
Submitter: Jenkins
Branch: master

commit 4829e25b6a68df0372a3b84c3cc7c9b680ced669
Author: Akihiro Motoki <email address hidden>
Date: Sun Mar 1 19:37:40 2015 +0900

    security-group-rule-list: show all info of rules briefly

    Previously security-group-rule-list does not display full
    information of rules by default (e.g., port ranges, ether types)
    and users need to use security-group-rule-show to check details.
    It is not convenient.

    This commit introduces some aggregated columns ("protocol/port" and
    "remote") to show infomration briefly and as a result full attributes
    of rules will be displayed.

    Closes-Bug: #1182629
    Change-Id: I047bf9a1ccba5b023d66f22ef5256f7786196113