<html><head><base href="x-msg://5819/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">+1. This sounds like a bug. FYI there are some issues related to adding source group rules that specify ports that need to be fixed. We have also discussed whether or not the same group should be allow all by default. In ec2 it does. I personally like having it explicit like this, but I don't know if it is confusing to people coming from other clouds.<div><br></div><div>Vish</div><div><br><div><div>On Nov 28, 2011, at 8:32 PM, Hookway, Ray wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-US" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">I would like to be able to create a security group rule which allows communication between VMs within the group. Using the EC2 API this can be done as follows:<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">rjh@cloud1:~$ euca-describe-groups<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">GROUP rjhproject default default<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">PERMISSION rjhproject default ALLOWS tcp 22 22 FROM CIDR 0.0.0.0/0<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">PERMISSION rjhproject default ALLOWS icmp -1 -1 FROM CIDR 0.0.0.0/0<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">PERMISSION rjhproject default ALLOWS tcp 80 80 GRPNAME default<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">rjh@cloud1:~$ euca-add-group -d 'permissive group' rjhgroup<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">GROUP rjhgroup permissive group<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">rjh@cloud1:~$ euca-authorize -o rjhgroup rjhgroup<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">rjhgroup rjhgroup None tcp None None 0.0.0.0/0<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">GROUP rjhgroup<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">PERMISSION rjhgroup ALLOWS tcp GRPNAME rjhgroup FROM CIDR 0.0.0.0/0<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">rjh@cloud1:~$ euca-describe-groups<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">GROUP rjhproject default default<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">PERMISSION rjhproject default ALLOWS tcp 22 22 FROM CIDR 0.0.0.0/0<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">PERMISSION rjhproject default ALLOWS icmp -1 -1 FROM CIDR 0.0.0.0/0<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">PERMISSION rjhproject default ALLOWS tcp 80 80 GRPNAME default<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">GROUP rjhproject rjhgroup permissive group<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">PERMISSION rjhproject rjhgroup ALLOWS icmp -1 -1 GRPNAME rjhgroup<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">PERMISSION rjhproject rjhgroup ALLOWS tcp 1 65535 GRPNAME rjhgroup<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; font-family: 'Courier New'; ">PERMISSION rjhproject rjhgroup ALLOWS udp 1 65536 GRPNAME rjhgroup<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">So, it looks like security groups support the notion of a group with rules that mention the group containing the rule as a source. However, the security_groups.py extension contains an explicit check that the source group id is not the same as the parent group id. Why is this done? I would like to remove this restriction allowing rules to be created similar to the one created above using EC2. Any objections?<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">-Ray Hookway (rjh)<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div></div>_______________________________________________<br>Mailing list:<span class="Apple-converted-space"> </span><a href="https://launchpad.net/~openstack" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><br>Post to :<span class="Apple-converted-space"> </span><a href="mailto:openstack@lists.launchpad.net" style="color: blue; text-decoration: underline; ">openstack@lists.launchpad.net</a><br>Unsubscribe :<span class="Apple-converted-space"> </span><a href="https://launchpad.net/~openstack" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><br>More help :<span class="Apple-converted-space"> </span><a href="https://help.launchpad.net/ListHelp" style="color: blue; text-decoration: underline; ">https://help.launchpad.net/ListHelp</a><br></div></span></blockquote></div><br></div></body></html>