<div dir="ltr">Hi,<div><br></div><div>I have reported the bug but not sure how to propose that change. Any guide to propose change would be highly appreciated.</div><div><br></div><div><a href="https://bugs.launchpad.net/neutron/+bug/1949451">https://bugs.launchpad.net/neutron/+bug/1949451</a><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Nov 2, 2021 at 2:45 PM Slawek Kaplonski <<a href="mailto:skaplons@redhat.com">skaplons@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
On wtorek, 2 listopada 2021 10:04:40 CET Ammad Syed wrote:<br>
> Hi Slawek,<br>
> <br>
> Yes, after adding extension, SG created with stateful=false.<br>
<br>
That's good. Can You report an Launchpad bug for that? And You can also <br>
propose that change as fix for that bug too :)<br>
<br>
> <br>
> # neutron ext-list | grep stateful-security-group<br>
> neutron CLI is deprecated and will be removed in the Z cycle. Use openstack<br>
> CLI instead.<br>
> <br>
> | stateful-security-group | Stateful security group<br>
> <br>
> # openstack security group create --stateless sec02-stateless<br>
> +-----------------<br>
+-----------------------------------------------------------<br>
> <br>
------------------------------------------------------------------------------<br>
> ---------------------------------------+<br>
> | Field | Value<br>
> <br>
> +-----------------<br>
+-----------------------------------------------------------<br>
> <br>
------------------------------------------------------------------------------<br>
> ---------------------------------------+<br>
> | created_at | 2021-11-02T09:02:42Z<br>
> | <br>
> | <br>
> | description | sec02-stateless<br>
> | <br>
> | <br>
> | id | 29c28678-9a03-496c-8157-4afbcdc8f2af<br>
> | <br>
> | <br>
> | name | sec02-stateless<br>
> | <br>
> | <br>
> | project_id | 98687873a146418eaeeb54a01693669f<br>
> | <br>
> | <br>
> | revision_number | 1<br>
> | <br>
> | <br>
> | rules | created_at='2021-11-02T09:02:42Z', direction='egress',<br>
> <br>
> ethertype='IPv6', id='17079c04-dc1d-4fbd-9f15-e79c6e585932',<br>
> standard_attr_id='2863', updated_at='2021-11-02T09:02:42Z' |<br>
> <br>
> | | created_at='2021-11-02T09:02:42Z', direction='egress',<br>
> <br>
> ethertype='IPv4', id='fadfbf09-f759-453d-b493-e6f73077113a',<br>
> standard_attr_id='2860', updated_at='2021-11-02T09:02:42Z' |<br>
> <br>
> | stateful | False<br>
> | <br>
> | <br>
> | tags | []<br>
> | <br>
> | <br>
> | updated_at | 2021-11-02T09:02:42Z<br>
> <br>
> +-----------------<br>
+-----------------------------------------------------------<br>
> <br>
------------------------------------------------------------------------------<br>
> ---------------------------------------+<br>
> <br>
> Let me test this feature further.<br>
> <br>
> Ammad<br>
> <br>
> On Tue, Nov 2, 2021 at 1:54 PM Slawek Kaplonski <<a href="mailto:skaplons@redhat.com" target="_blank">skaplons@redhat.com</a>> wrote:<br>
> > Hi,<br>
> > <br>
> > On wtorek, 2 listopada 2021 09:29:13 CET Ammad Syed wrote:<br>
> > > Thanks Lajos,<br>
> > > <br>
> > > I was checking the release notes and found that stateless acl is<br>
> > <br>
> > supported<br>
> > <br>
> > > by ovn in xena.<br>
> > > <br>
> > > <a href="https://docs.openstack.org/releasenotes/neutron/" rel="noreferrer" target="_blank">https://docs.openstack.org/releasenotes/neutron/</a><br>
> > <br>
> > xena.html#:~:text=Support%20st<br>
> > <br>
> > > ateless%20security%20groups%20with%20the%20latest%20OVN%2021.06%2B.<br>
> > <br>
> > %20The%20st<br>
> > <br>
> > <br>
> > <br>
ateful%3DFalse%20security%20groups%20are%20mapped%20to%20the%20new%20%E2%80%<br>
> > 9C> <br>
> > > allow-stateless%E2%80%9D%20OVN%20ACL%20verb .<br>
> > <br>
> > It should be supported by the OVN driver now IIRC. Maybe we forgot about<br>
> > adding this extension to the list:<br>
> > <a href="https://github.com/openstack/neutron/blob/" rel="noreferrer" target="_blank">https://github.com/openstack/neutron/blob/</a><br>
> > master/neutron/common/ovn/extensions.py#L93<br>
> > <<a href="https://github.com/openstack/neutron/blob/master/neutron/common/ovn/" rel="noreferrer" target="_blank">https://github.com/openstack/neutron/blob/master/neutron/common/ovn/</a><br>
extensi<br>
> > ons.py#L93> Can You try to add it there and see if the extension will be<br>
> > loaded then?> <br>
> > > Ammad<br>
> > > <br>
> > > On Tue, Nov 2, 2021 at 1:25 PM Lajos Katona <<a href="mailto:katonalala@gmail.com" target="_blank">katonalala@gmail.com</a>><br>
> > <br>
> > wrote:<br>
> > > > Hi,<br>
> > > > statefull security-groups are only available with iptables based<br>
> > <br>
> > drivers:<br>
> > <br>
> > <br>
> > <a href="https://review.opendev.org/c/openstack/neutron/+/572767/53/releasenotes/" rel="noreferrer" target="_blank">https://review.opendev.org/c/openstack/neutron/+/572767/53/releasenotes/</a><br>
> > note<br>
> > <br>
> > > > s/stateful-security-group-04b2902ed9c44e4f.yaml<br>
> > > > <br>
> > > > For OVS and OVN we have open RFE, nut as I know at the moment nobody<br>
> > <br>
> > works<br>
> > <br>
> > > > on them:<br>
> > > > <a href="https://bugs.launchpad.net/neutron/+bug/1885261" rel="noreferrer" target="_blank">https://bugs.launchpad.net/neutron/+bug/1885261</a><br>
> > > > <a href="https://bugs.launchpad.net/neutron/+bug/1885262" rel="noreferrer" target="_blank">https://bugs.launchpad.net/neutron/+bug/1885262</a><br>
> > > > <br>
> > > > Regards<br>
> > > > Lajos Katona (lajoskatona)<br>
> > > > <br>
> > > > Ammad Syed <<a href="mailto:syedammad83@gmail.com" target="_blank">syedammad83@gmail.com</a>> ezt írta (időpont: 2021. nov. 2.,<br>
> > <br>
> > K,<br>
> > <br>
> > > > 9:00):<br>
> > > >> Hi,<br>
> > > >> <br>
> > > >> I have upgraded my lab to latest xena release and ovn 21.09 and ovs<br>
> > <br>
> > 2.16.<br>
> > <br>
> > > >> I am trying to create stateless security group. But its getting<br>
> > <br>
> > failed<br>
> > with<br>
> > <br>
> > > >> below error message.<br>
> > > >> <br>
> > > >> # openstack security group create --stateless sec02-stateless<br>
> > > >> Error while executing command: BadRequestException: 400, Unrecognized<br>
> > > >> attribute(s) 'stateful'<br>
> > > >> <br>
> > > >> I see below logs in neutron server logs.<br>
> > > >> <br>
> > > >> 2021-11-02 12:47:41.921 1346 DEBUG neutron.wsgi [-] (1346) accepted<br>
> > > >> ('172.16.40.45', 41272) server<br>
> > > >> /usr/lib/python3/dist-packages/eventlet/wsgi.py:992<br>
> > > >> 2021-11-02 12:47:42.166 1346 DEBUG neutron.api.v2.base<br>
> > > >> [req-b6a37fff-090f-4754-9df7-6e4314ed9481<br>
> > <br>
> > 19844bf62a7b498eb443508ef150e9b8<br>
> > <br>
> > > >> 98687873a146418eaeeb54a01693669f - default default] Request body:<br>
> > > >> {'security_group': {'name': 'sec02-stateless', 'stateful': False,<br>
> > > >> 'description': 'sec02-stateless'}} prepare_request_body<br>
> > > >> /usr/lib/python3/dist-packages/neutron/api/v2/base.py:729<br>
> > > >> 2021-11-02 12:47:42.167 1346 WARNING neutron.api.v2.base<br>
> > > >> [req-b6a37fff-090f-4754-9df7-6e4314ed9481<br>
> > <br>
> > 19844bf62a7b498eb443508ef150e9b8<br>
> > <br>
> > > >> 98687873a146418eaeeb54a01693669f - default default] An exception<br>
> > <br>
> > happened<br>
> > <br>
> > > >> while processing the request body. The exception message is<br>
> > <br>
> > [Unrecognized<br>
> > <br>
> > > >> attribute(s) 'stateful'].: webob.exc.HTTPBadRequest: Unrecognized<br>
> > > >> attribute(s) 'stateful'<br>
> > > >> 2021-11-02 12:47:42.167 1346 INFO neutron.api.v2.resource<br>
> > > >> [req-b6a37fff-090f-4754-9df7-6e4314ed9481<br>
> > <br>
> > 19844bf62a7b498eb443508ef150e9b8<br>
> > <br>
> > > >> 98687873a146418eaeeb54a01693669f - default default] create failed<br>
> > <br>
> > (client<br>
> > <br>
> > > >> error): Unrecognized attribute(s) 'stateful'<br>
> > > >> 2021-11-02 12:47:42.168 1346 INFO neutron.wsgi<br>
> > > >> [req-b6a37fff-090f-4754-9df7-6e4314ed9481<br>
> > <br>
> > 19844bf62a7b498eb443508ef150e9b8<br>
> > <br>
> > > >> 98687873a146418eaeeb54a01693669f - default default] 172.16.40.45 <br>
"POST<br>
> > > >> /v2.0/security-groups HTTP/1.1" status: 400 len: 317 time: 0.2455938<br>
> > > >> <br>
> > > >> Any advice on how to fix it ?<br>
> > > >> <br>
> > > >> Ammad<br>
> > <br>
> > --<br>
> > Slawek Kaplonski<br>
> > Principal Software Engineer<br>
> > Red Hat<br>
<br>
<br>
-- <br>
Slawek Kaplonski<br>
Principal Software Engineer<br>
Red Hat</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">Regards,<div><br></div><div><br></div><div>Syed Ammad Ali</div></div>