Juniper Openstack

[Build 14]:Ubuntu: deleted SG rules still present in API and allowing traffic as per the rules.

Bug #1325531 reported by alok kumar on 2014-06-02

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	Juniper Openstack	Fix Committed	High	Sachin Bansal	Juniper Openstack r1.06-fcs

Bug Description

i deleted all the rules from a security group "sg-icmp" and expecting all the traffic to be denied.

but all the deleted rules are still present in api and agent.

cli doesn't show any rule for that SG "sg-icmp".

rules present in api server:

{

    "access-control-list": {
        "fq_name": [
            "default-domain",
            "admin",
            "sg-icmp",
            "egress-access-control-list"
        ],
        "uuid": "2618c853-0377-42aa-8c3a-282a21a6f041",
        "parent_uuid": "e3ef5ffe-5a53-437b-9926-82c5ba5b36a8",
        "parent_href": "http://nodeh1.englab.juniper.net:8082/security-group/e3ef5ffe-5a53-437b-9926-82c5ba5b36a8",
        "parent_type": "security-group",
        "href": "http://nodeh1.englab.juniper.net:8082/access-control-list/2618c853-0377-42aa-8c3a-282a21a6f041",
        "id_perms": {
            "enable": true,
            "uuid": {
                "uuid_mslong": 2745164231748305400,
                "uuid_lslong": 10104432875377455000
            },
            "created": "2014-05-28T07:55:33.967920",
            "description": null,
            "last_modified": "2014-05-29T09:49:29.357589",
            "permissions": {
                "owner": "cloud-admin",
                "owner_access": 7,
                "other_access": 7,
                "group": "cloud-admin-group",
                "group_access": 7
            }
        },
        "access_control_list_entries": {
            "dynamic": null,
            "acl_rule": [
                {
                    "match_condition": {
                        "src_address": {
                            "security_group": null,
                            "subnet": null,
                            "virtual_network": null
                        },
                        "protocol": "any",
                        "src_port": {
                            "end_port": 65535,
                            "start_port": 0
                        },
                        "dst_port": {
                            "end_port": 65535,
                            "start_port": 0
                        },
                        "dst_address": {
                            "security_group": null,
                            "subnet": {
                                "ip_prefix": "0.0.0.0",
                                "ip_prefix_len": 0
                            },
                            "virtual_network": null
                        }
                    },
                    "action_list": {
                        "simple_action": "pass",
                        "gateway_name": null,
                        "apply_service": [ ],
                        "mirror_to": null,
                        "assign_routing_instance": null
                    }
                }
            ]
        },
        "name": "egress-access-control-list"
    }

}

{

    "access-control-list": {
        "fq_name": [
            "default-domain",
            "admin",
            "sg-icmp",
            "ingress-access-control-list"
        ],
        "uuid": "8a4a219d-0c67-467e-935d-98da884de004",
        "parent_uuid": "e3ef5ffe-5a53-437b-9926-82c5ba5b36a8",
        "parent_href": "http://nodeh1.englab.juniper.net:8082/security-group/e3ef5ffe-5a53-437b-9926-82c5ba5b36a8",
        "parent_type": "security-group",
        "href": "http://nodeh1.englab.juniper.net:8082/access-control-list/8a4a219d-0c67-467e-935d-98da884de004",
        "id_perms": {
            "enable": true,
            "uuid": {
                "uuid_mslong": 9964814083912321000,
                "uuid_lslong": 10618811560766595000
            },
            "created": "2014-05-28T07:55:33.855678",
            "description": null,
            "last_modified": "2014-05-29T09:49:29.350992",
            "permissions": {
                "owner": "cloud-admin",
                "owner_access": 7,
                "other_access": 7,
                "group": "cloud-admin-group",
                "group_access": 7
            }
        },
        "access_control_list_entries": {
            "dynamic": null,
            "acl_rule": [
                {
                    "match_condition": {
                        "src_address": {
                            "security_group": null,
                            "subnet": {
                                "ip_prefix": "0.0.0.0",
                                "ip_prefix_len": 0
                            },
                            "virtual_network": null
                        },
                        "protocol": "1",
                        "src_port": {
                            "end_port": 65535,
                            "start_port": 0
                        },
                        "dst_port": {
                            "end_port": 65535,
                            "start_port": 0
                        },
                        "dst_address": {
                            "security_group": null,
                            "subnet": null,
                            "virtual_network": null
                        }
                    },
                    "action_list": {
                        "simple_action": "pass",
                        "gateway_name": null,
                        "apply_service": [ ],
                        "mirror_to": null,
                        "assign_routing_instance": null
                    }
                }
            ]
        },
        "name": "ingress-access-control-list"
    }

}

all logs are @nodeb11:/home/kalok/contrail/bugLogs/<bugId>

Tags:

Sachin Bansal (sbansal) on 2014-06-04

Changed in juniperopenstack:
assignee:	nobody → Sachin Bansal (bansalsachin)

Nagabhushana R (bhushana) on 2014-06-05

Changed in juniperopenstack:
milestone:	none → r1.06-fcs

Revision history for this message

Sachin Bansal (sbansal) wrote on 2014-06-13:

Could you please let me know how you deleted the rules? I tried with 'neutron security-group-rule-delete' and the acl rules were deleted correctly. Also, I could not login to nodeb11 either as myself or as root. Could you please provide access information?

Revision history for this message

Sachin Bansal (sbansal) wrote on 2014-06-13:

I was able to recreate this by setting security_group_entries to None using python API and submitted a fix for the same. If you used any other method, please update this bug.

Sachin Bansal (sbansal) on 2014-06-15

Changed in juniperopenstack:
status:	New → Fix Committed

Revision history for this message

alok kumar (kalok) wrote on 2014-06-16:

Hi Sachin,

i deleted the rules thro horizon.
I was testing security grp with many combinations, like creating/deleting SG, adding/deleting rules.
at one time after deleting rules, it was not reflected in api.

all add/delete was done thro horizon ONLY.
cli was used only to see the list.(debug purpose)

Revision history for this message

Sachin Bansal (sbansal) wrote on 2014-06-17:

Fixed with this commit in mainline:
https://github.com/Juniper/contrail-controller/commit/24ef3729f8eaa73d82e70b0c0d28622d957614e9

Ashish Ranjan (aranjan-n) on 2014-07-01

information type:

Proprietary → Public

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.