Comment 3 for bug 985184

For our fix we did the tolower() before writing to the db, in case there were any other similar issues in the code (we know that it works everywhere when the DB contents are lower case)

Phil

-- Sent from my HP Pre

________________________________
On 19 Apr 2012 10:15, Vish Ishaya <email address hidden> wrote:

yup appears easy. Suggested patch:

diff --git a/nova/virt/firewall.py b/nova/virt/firewall.py
index 3f53334..62de2c2 100644
--- a/nova/virt/firewall.py
+++ b/nova/virt/firewall.py
@@ -300,7 +300,7 @@ class IptablesFirewallDriver(FirewallDriver):
                 else:
                     fw_rules = ipv6_rules

- protocol = rule.protocol
+ protocol = rule.protocol.lower()
                 if version == 6 and rule.protocol == 'icmp':
                     protocol = 'icmpv6'

--
You received this bug notification because you are subscribed to the bug
report.
https://bugs.launchpad.net/bugs/985184

Title:
  Security groups fail to be set correctly if incorrect case is used for
  protocol specification

Status in OpenStack Compute (Nova):
  New

Bug description:
  The high level issue is that if a security group rule is specified
  with the protocol in uppercase (e.g. TCP instead of tcp) on a system
  using the IpTablesFirewallDriver then the security group rules may
  fail to be properly applied, leading to security groups that are more
  open than specified.

  The detail of the issue is as follows (Described from the OSAPI
  perspective, but the problem also exists on EC2)

  When a security group rule is specified with the protocol in upper case it is validated (contrig/security_groups.py: _rule_args_to_dict() regardless of case but stored in the database in the supplied case:
      if ip_protocol.upper() not in ['TCP', 'UDP', 'ICMP']:
                  raise exception.InvalidIpProtocol(protocol=ip_protocol)

    …

    values['protocol'] = ip_protocol

  When the security group refresh is triggered (virt/firewall.py – instance_rules() the protocol check is case sensitive:

                  if protocol in ['udp', 'tcp']:
                      args += self._build_tcp_udp_rule(rule, version)
                  elif protocol == 'icmp':
                      args += self._build_icmp_rule(rule, version)
                  if rule.cidr:
                      LOG.info('Using cidr %r', rule.cidr)
                      args += ['-s', rule.cidr]
                      fw_rules += [' '.join(args)]

  Because the protocol doesn’t match ‘udp’ or ‘tcp’ the protocol part of
  the rule is skipped, leading to an incomplete and invalid iptables
  command line.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/985184/+subscriptions