<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div>Xuhan,</div>
<div><br>
</div>
Currently, ICMP type and code are represented via port_range_min and port_range_max when icmp protocol is specified. See <a href="https://github.com/openstack/neutron/blob/master/neutron/db/securitygroups_db.py#L309">https://github.com/openstack/neutron/blob/master/neutron/db/securitygroups_db.py#L309</a> (Just
the state of things, I’m not commenting on how bad it is).
<div><br>
</div>
<div>I would also like to see improvements to the security groups API as well, with additional parameters —source-port-range-min and —source-port-range-max to specify source ports on security group rules for blueprint ovs-firewall-driver. Upon review, it was
recommended to me to create an extension on top of the existing security groups extension to not interfere with existing security groups extension API implementations. If you’d like to continue, you should probably follow that route also.<br>
<div><br>
</div>
<div>Amir Sadoughi<br>
<div><br>
</div>
<div><br>
<div>
<div>On Mar 3, 2014, at 7:39 AM, Xuhan Peng <<a href="mailto:pengxuhan@gmail.com">pengxuhan@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div dir="ltr"><span style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px">I created a new blueprint [1] which is triggered by the requirement to allow IPv6 Router Advertisement security group rule on compute node in my on-going
code review [2].</span>
<div><br style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px">
<span style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px">Currently, only security group rule direction, protocol, ethertype and port range are supported by neutron security group rule data structure. To allow Router Advertisement
coming from network node or provider network to VM on compute node, we need to specify ICMP type to only allow RA from known hosts (network node dnsmasq binded IP or known provider gateway).</span></div>
<div><br style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px">
<span style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px">To implement this and make the implementation extensible, maybe we can add an additional table name "SecurityGroupR</span><span style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px">uleData"
with Key, Value and ID in it. For ICMP type RA filter, we can add key="icmp-type" value="134", and security group rule to the table. When other ICMP type filters are needed, similar records can be stored. This table can also be used for other firewall rule
key values.</span><br style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px">
<span style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px">API change is also needed.</span><br>
</div>
<div><span style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px"><br>
</span></div>
<div style=""><span style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px">Please let me know your comments about this blueprint.</span></div>
<div><span style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px"><br>
</span></div>
<div><span style="color:rgb(51,51,51);font-family:sans-serif;font-size:12px;line-height:18px">[1] </span><font color="#333333" face="sans-serif"><span style="font-size:12px;line-height:18px"><a href="https://blueprints.launchpad.net/neutron/+spec/security-group-icmp-type-filter">https://blueprints.launchpad.net/neutron/+spec/security-group-icmp-type-filter</a></span></font></div>
<div><font color="#333333" face="sans-serif"><span style="font-size:12px;line-height:18px">[2] </span><span style="font-size:12px;line-height:18px"><a href="https://review.openstack.org/#/c/72252/">https://review.openstack.org/#/c/72252/</a></span></font></div>
<div><font color="#333333" face="sans-serif"><span style="font-size:12px;line-height:18px"><br>
</span></font></div>
<div style=""><font color="#333333" face="sans-serif"><span style="font-size:12px;line-height:18px">Thank you!</span></font></div>
<div style=""><font color="#333333" face="sans-serif"><span style="font-size:12px;line-height:18px">Xuhan Peng</span></font></div>
</div>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</body>
</html>