https://jira.opendaylight.org This file is an XML representation of an issue en-us 8.20.10 820010 22-06-2022 https://jira.opendaylight.org/browse/NEUTRON-78 neutron <p>When a security rules is created after creating a security group, the security rule list in security group object is not updated in the data store</p> <p>Steps to reproduce.<br/> 1.Create a security group<br/> neutron security-group-create SG1 --description "SG1" <br/> 2.Add a rule to the security group<br/> neutron security-group-rule-create --direction ingress --protocol udp --port-range-min 3333 --port-range-max 3333 --remote-ip-prefix 0.0.0.0/24 SG1</p> <p>If the Data store is checked the newly added rule is missing in the Security Group Model.</p> <p>Neutron DB<br/> --------------</p> <p>Security Group Table <br/> <ins>-------------------------------------<del></ins></del>-------<del><ins></del>---------------------------------------------------------------------</ins></p> <div class='table-wrap'> <table class='confluenceTable'><tbody> <tr> <td class='confluenceTd'> id </td> <td class='confluenceTd'> name </td> <td class='confluenceTd'> security_group_rules </td> </tr> </tbody></table> </div> <p><ins>-------------------------------------<del></ins></del>-------<del><ins></del>---------------------------------------------------------------------</ins></p> <div class='table-wrap'> <table class='confluenceTable'><tbody> <tr> <td class='confluenceTd'> 44f759e7-79ae-46d6-ad59-a3c1446c82f1 </td> <td class='confluenceTd'> SG1 </td> <td class='confluenceTd'> egress, IPv4 </td> </tr> <tr> <td class='confluenceTd'>&nbsp;</td> <td class='confluenceTd'>&nbsp;</td> <td class='confluenceTd'> egress, IPv6 </td> </tr> <tr> <td class='confluenceTd'>&nbsp;</td> <td class='confluenceTd'>&nbsp;</td> <td class='confluenceTd'> ingress, IPv4, 3333/udp, remote_ip_prefix: 0.0.0.0/24 </td> </tr> </tbody></table> </div> <p><ins>-------------------------------------<del></ins></del>-------<del><ins></del>---------------------------------------------------------------------</ins></p> <p>Security Rule Table<br/> <ins>-------------------------------------<del></ins></del>--------------<del><ins></del>---------<del></ins></del>---------<del><ins></del>-------------<del></ins></del>------------------+</p> <div class='table-wrap'> <table class='confluenceTable'><tbody> <tr> <td class='confluenceTd'> id </td> <td class='confluenceTd'> security_group </td> <td class='confluenceTd'> direction </td> <td class='confluenceTd'> ethertype </td> <td class='confluenceTd'> protocol/port </td> <td class='confluenceTd'> remote </td> </tr> </tbody></table> </div> <p><ins>-------------------------------------<del></ins></del>--------------<del><ins></del>---------<del></ins></del>---------<del><ins></del>-------------<del></ins></del>------------------+</p> <div class='table-wrap'> <table class='confluenceTable'><tbody> <tr> <td class='confluenceTd'> 2bf8a6cc-b40a-48d2-95f4-bd4a0953bb73 </td> <td class='confluenceTd'> SG1 </td> <td class='confluenceTd'> egress </td> <td class='confluenceTd'> IPv6 </td> <td class='confluenceTd'> any </td> <td class='confluenceTd'> any </td> </tr> <tr> <td class='confluenceTd'> b2e168eb-c35a-419e-baf0-40eeb89e6b90 </td> <td class='confluenceTd'> SG1 </td> <td class='confluenceTd'> ingress </td> <td class='confluenceTd'> IPv4 </td> <td class='confluenceTd'> 3333/udp </td> <td class='confluenceTd'> 0.0.0.0/24 (CIDR) </td> </tr> <tr> <td class='confluenceTd'> e491346d-a7dd-4c2a-8938-64163a00029e </td> <td class='confluenceTd'> SG1 </td> <td class='confluenceTd'> egress </td> <td class='confluenceTd'> IPv4 </td> <td class='confluenceTd'> any </td> <td class='confluenceTd'> any </td> </tr> </tbody></table> </div> <p><ins>-------------------------------------<del></ins></del>--------------<del><ins></del>---------<del></ins></del>---------<del><ins></del>-------------<del></ins></del>------------------+</p> <p>In Data Store<br/> ---------------</p> <p>Security Group Model</p> <p>{<br/> "security-groups": {<br/> "security-group": [</p> { "uuid": "44f759e7-79ae-46d6-ad59-a3c1446c82f1", "security-rules": [ "2bf8a6cc-b40a-48d2-95f4-bd4a0953bb73", "e491346d-a7dd-4c2a-8938-64163a00029e" ], "tenant-id": "27da8dfc-d61b-46ac-a5be-4533a4b7782c", "name": "SG1", "description": "SG1" } <p> ]<br/> }<br/> }</p> <p>Security Rule Model<br/> --------------------<br/> {<br/> "security-rules": {<br/> "security-rule": [<br/> </p> { "id": "2bf8a6cc-b40a-48d2-95f4-bd4a0953bb73", "security-group-id": "44f759e7-79ae-46d6-ad59-a3c1446c82f1", "tenant-id": "27da8dfc-d61b-46ac-a5be-4533a4b7782c", "ethertype": "neutron-constants:ethertype-v6", "direction": "neutron-constants:direction-egress" } <p>,<br/> </p> { "id": "b2e168eb-c35a-419e-baf0-40eeb89e6b90", "security-group-id": "44f759e7-79ae-46d6-ad59-a3c1446c82f1", "remote-ip-prefix": "0.0.0.0/24", "ethertype": "neutron-constants:ethertype-v4", "port-range-max": 3333, "tenant-id": "27da8dfc-d61b-46ac-a5be-4533a4b7782c", "direction": "neutron-constants:direction-ingress", "port-range-min": 3333, "protocol": "neutron-constants:protocol-udp" } <p>,</p> { "id": "e491346d-a7dd-4c2a-8938-64163a00029e", "security-group-id": "44f759e7-79ae-46d6-ad59-a3c1446c82f1", "tenant-id": "27da8dfc-d61b-46ac-a5be-4533a4b7782c", "ethertype": "neutron-constants:ethertype-v4", "direction": "neutron-constants:direction-egress" } <p> ]<br/> }<br/> }</p> <p>Operating System: All<br/> Platform: All</p> NEUTRON-78

SecurityGroupCRUD is not updated when a security rule is created/delted

Bug Resolved Done Isaku Yamahata Aswin Suryanarayanan Thu, 29 Oct 2015 07:03:48 +0000 Thu, 3 May 2018 14:37:01 +0000 Fri, 24 Mar 2017 16:52:10 +0000 master transcriber 0 2 <p>There is a workaround:</p> <p>From the horizon after adding rule to security group, the security group needs to be modified (modify the SG description). After this the ODL data store gets updated. </p> <p>With out modifying the SG if we associate it with a VM then the rules will not be available in SG object and hence no flows gets added.</p> <p>Isaku, is there any idea why the mdsal does not update for this case?</p> <p>Sam, let me look into this.</p> <p>This is the result of the effort of transparent Neutron Northbound.<br/> The change set of 906836c289a7e4c3d33669d90515d77e75cfb6da in ODL neutron caused it.</p> <p>Basically the list of security group rule in security group isn't updated.<br/> Instead, we have to check the security group id in security group rule should be checked. <br/> In long term, security group rule in security group would be deleted.<br/> (And other similar relationship would be deleted.)</p> <p>So what can ODL Neutron northbound do for Beryllium release?<br/> At least I'm willing to provide a patch for ovsdb/netvirt.</p> <p>If the plan is to permanently remove the attribute from SecurityGroup, I think we may change the logic in net-virt to use the security group id in the security rule.</p> <p><a href="https://git.opendaylight.org/gerrit/#/c/33957/" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/33957/</a><br/> <a href="https://git.opendaylight.org/gerrit/#/c/34003/" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/34003/</a></p> <p>Do the above patches help?<br/> Can you please give them a try?</p> <p>patch for ovsdb/netvirt <a href="https://git.opendaylight.org/gerrit/#/c/34003/" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/34003/</a> was merged for Beryllium.</p> <p>The patch for neutron targets Beryllium-SR1.</p> <p>The patch for master(Boron) of neutron<br/> <a href="https://git.opendaylight.org/gerrit/#/c/33957" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/33957</a></p> <p>The patch for Beryllium-SR1 of neutron<br/> <a href="https://git.opendaylight.org/gerrit/#/c/34586" class="external-link" target="_blank" rel="nofollow noopener">https://git.opendaylight.org/gerrit/#/c/34586</a></p> Development External issue ID 4550 External issue URL ODL SR Target Milestone Priority Rank 0|i02ukn: