VMwareAPI-Team

VMware: VC driver lacks support for firewall rules

Bug #1269448 reported by Jaroslav Henner
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
High
Gary Kotton
OpenStack Compute (nova) 2014.1 "icehouse"
Havana
Fix Released
High
Yaguang Tang
OpenStack Compute (nova) 2013.2.4
VMwareAPI-Team
Confirmed
High
Unassigned

Bug Description

Issuing
[root@jhenner-node ~(keystone_admin)]# nova secgroup-add-rule default tcp 33 33 0.0.0.0/0
+-------------+-----------+---------+-----------+--------------+
| IP Protocol | From Port | To Port | IP Range | Source Group |
+-------------+-----------+---------+-----------+--------------+
| tcp | 33 | 33 | 0.0.0.0/0 | |
+-------------+-----------+---------+-----------+--------------+

causes:
[root@jhenner-node ~(keystone_admin)]# tail -f /var/log/nova/compute.log | grep -v DEBUG
2014-01-15 14:43:33.040 19359 ERROR nova.openstack.common.rpc.amqp [req-8273843f-cf2f-4638-8e41-ad7b5278773b c617ab6c5a9c45ac97d59b3d799e431e 89cec4e2039c4344b30e74575444afd1] Exception during message handling
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp Traceback (most recent call last):
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp File "/usr/lib/python2.6/site-packages/nova/openstack/common/rpc/amqp.py", line 461, in _process_data
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp **args)
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp File "/usr/lib/python2.6/site-packages/nova/openstack/common/rpc/dispatcher.py", line 172, in dispatch
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp result = getattr(proxyobj, method)(ctxt, **kwargs)
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp File "/usr/lib/python2.6/site-packages/nova/exception.py", line 90, in wrapped
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp payload)
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp File "/usr/lib/python2.6/site-packages/nova/exception.py", line 73, in wrapped
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp return f(self, context, *args, **kw)
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp File "/usr/lib/python2.6/site-packages/nova/compute/manager.py", line 857, in refresh_instance_security_rules
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp return _sync_refresh()
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp File "/usr/lib/python2.6/site-packages/nova/openstack/common/lockutils.py", line 246, in inner
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp return f(*args, **kwargs)
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp File "/usr/lib64/python2.6/contextlib.py", line 34, in __exit__
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp self.gen.throw(type, value, traceback)
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp File "/usr/lib/python2.6/site-packages/nova/openstack/common/lockutils.py", line 210, in lock
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp yield sem
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp File "/usr/lib/python2.6/site-packages/nova/openstack/common/lockutils.py", line 246, in inner
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp return f(*args, **kwargs)
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp File "/usr/lib/python2.6/site-packages/nova/compute/manager.py", line 856, in _sync_refresh
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp return self.driver.refresh_instance_security_rules(instance)
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp AttributeError: 'VMwareVCDriver' object has no attribute 'refresh_instance_security_rules'
2014-01-15 14:43:33.040 19359 TRACE nova.openstack.common.rpc.amqp

The secgroups seems to be ineffective, there seems to be no firewalling.

Tags: vmware
Jaroslav Henner (jhenner)
tags: added: vmware
Jaroslav Henner (jhenner)
summary: - VC driver lacks support for secgroups
+ VC driver lacks support for firewall rules
Maithem (maithem)
summary: - VC driver lacks support for firewall rules
+ VMware: VC driver lacks support for firewall rules
Revision history for this message
Jaroslav Henner (jhenner) wrote :

https://bugzilla.redhat.com/show_bug.cgi?id=1055529

Revision history for this message
dan wendlandt (danwent) wrote :

We should certainly clean up this error message, but security groups with vSphere require the use of Neutron. See the limitations section of http://docs.openstack.org/trunk/config-reference/content/vmware.html

Gary Kotton (garyk)
Changed in nova:
status: New → Confirmed
importance: Undecided → High
assignee: nobody → Gary Kotton (garyk)
milestone: none → icehouse-3
tags: added: havana-backport-potential
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (master)

Fix proposed to branch: master
Review: https://review.openstack.org/69600

Changed in nova:
status: Confirmed → In Progress
Revision history for this message
Gary Kotton (garyk) wrote :

Addressed by https://review.openstack.org/69600

Gary Kotton (garyk)
Changed in nova:
importance: High → Critical
Joe Gordon (jogo)
Changed in nova:
importance: Critical → High
Thierry Carrez (ttx)
Changed in nova:
milestone: icehouse-3 → icehouse-rc1
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova (master)

Reviewed: https://review.openstack.org/69600
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=5a98d7b61fa6adb1557e69f2f234406be0e2739c
Submitter: Jenkins
Branch: master

commit 5a98d7b61fa6adb1557e69f2f234406be0e2739c
Author: Gary Kotton <email address hidden>
Date: Tue Jan 28 05:43:12 2014 -0800

    Add declaration of 'refresh_instance_security_rules' to virt driver

    The method 'refresh_instance_security_rules' was not defined
    in the virt driver ComputeDriver class. In cases where the
    underlying virt driver does not support security groups
    an exception would be encountered indication that the driver
    class does not have the specific attribute.

    In addition to adding the method the patch set also catches the
    exception NotImplementedError and logs a warning.

    Change-Id: Ia36b0dfb54a3ede86467d87f0650a0902adb6d46
    Closes-bug: #1269448

Changed in nova:
status: In Progress → Fix Committed
Tracy Jones (tjones-i)
Changed in openstack-vmwareapi-team:
status: New → Confirmed
importance: Undecided → High
Thierry Carrez (ttx)
Changed in nova:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in nova:
milestone: icehouse-rc1 → 2014.1
Revision history for this message
Openstack Gerrit (openstack-gerrit) wrote : Fix proposed to nova (stable/havana)

Fix proposed to branch: stable/havana
Review: https://review.openstack.org/91262

Alan Pevec (apevec)
tags: removed: havana-backport-potential
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova (stable/havana)

Reviewed: https://review.openstack.org/91262
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=ce354f595b897ac26548c535e6378b9cc9c7b110
Submitter: Jenkins
Branch: stable/havana

commit ce354f595b897ac26548c535e6378b9cc9c7b110
Author: Gary Kotton <email address hidden>
Date: Tue Jan 28 05:43:12 2014 -0800

    Add declaration of 'refresh_instance_security_rules' to virt driver

    The method 'refresh_instance_security_rules' was not defined
    in the virt driver ComputeDriver class. In cases where the
    underlying virt driver does not support security groups
    an exception would be encountered indication that the driver
    class does not have the specific attribute.

    In addition to adding the method the patch set also catches the
    exception NotImplementedError and logs a warning.

    Closes-bug: #1269448
    (cherry picked from commit 5a98d7b61fa6adb1557e69f2f234406be0e2739c)

    Conflicts:
     nova/tests/virt/hyperv/test_hypervapi.py

    Change-Id: Ia36b0dfb54a3ede86467d87f0650a0902adb6d46

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.