Skip to content

Commit bfa032c

Browse files
Zuulopenstack-gerrit
Zuul
authored and
openstack-gerrit
committed
Merge "Support remote-address-group in SG rules"
2 parents 6905e97 + e01e59c commit bfa032c

4 files changed

Lines changed: 67 additions & 0 deletions

File tree

‎openstackclient/network/v2/security_group_rule.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,12 @@ def update_parser_common(self, parser):
126126
metavar="<group>",
127127
help=_("Remote security group (name or ID)"),
128128
)
129+
if self.is_neutron:
130+
remote_group.add_argument(
131+
"--remote-address-group",
132+
metavar="<group>",
133+
help=_("Remote address group (name or ID)"),
134+
)
129135

130136
# NOTE(efried): The --dst-port, --protocol, and --proto options exist
131137
# for both nova-network and neutron, but differ slightly. For the sake
@@ -328,6 +334,11 @@ def take_action_network(self, client, parsed_args):
328334
parsed_args.remote_group,
329335
ignore_missing=False
330336
).id
337+
elif parsed_args.remote_address_group is not None:
338+
attrs['remote_address_group_id'] = client.find_address_group(
339+
parsed_args.remote_address_group,
340+
ignore_missing=False
341+
).id
331342
elif parsed_args.remote_ip is not None:
332343
attrs['remote_ip_prefix'] = parsed_args.remote_ip
333344
elif attrs['ethertype'] == 'IPv4':
@@ -507,6 +518,8 @@ def _get_column_headers(self, parsed_args):
507518
'Direction',
508519
'Remote Security Group',
509520
)
521+
if self.is_neutron:
522+
column_headers = column_headers + ('Remote Address Group',)
510523
if parsed_args.group is None:
511524
column_headers = column_headers + ('Security Group',)
512525
return column_headers
@@ -526,6 +539,7 @@ def take_action_network(self, client, parsed_args):
526539
'port_range',
527540
'direction',
528541
'remote_group_id',
542+
'remote_address_group_id',
529543
)
530544

531545
# Get the security group rules using the requested query.

‎openstackclient/tests/unit/network/v2/fakes.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1382,6 +1382,7 @@ def create_one_security_group_rule(attrs=None):
13821382
'port_range_min': None,
13831383
'protocol': None,
13841384
'remote_group_id': None,
1385+
'remote_address_group_id': None,
13851386
'remote_ip_prefix': '0.0.0.0/0',
13861387
'security_group_id': 'security-group-id-' + uuid.uuid4().hex,
13871388
'tenant_id': 'project-id-' + uuid.uuid4().hex,

‎openstackclient/tests/unit/network/v2/test_security_group_rule_network.py‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@ class TestCreateSecurityGroupRuleNetwork(TestSecurityGroupRuleNetwork):
4646
_security_group = \
4747
network_fakes.FakeSecurityGroup.create_one_security_group()
4848

49+
# The address group to be used in security group rules
50+
_address_group = network_fakes.FakeAddressGroup.create_one_address_group()
51+
4952
expected_columns = (
5053
'description',
5154
'direction',
@@ -55,6 +58,7 @@ class TestCreateSecurityGroupRuleNetwork(TestSecurityGroupRuleNetwork):
5558
'port_range_min',
5659
'project_id',
5760
'protocol',
61+
'remote_address_group_id',
5862
'remote_group_id',
5963
'remote_ip_prefix',
6064
'security_group_id',
@@ -77,6 +81,7 @@ def _setup_security_group_rule(self, attrs=None):
7781
self._security_group_rule.port_range_min,
7882
self._security_group_rule.project_id,
7983
self._security_group_rule.protocol,
84+
self._security_group_rule.remote_address_group_id,
8085
self._security_group_rule.remote_group_id,
8186
self._security_group_rule.remote_ip_prefix,
8287
self._security_group_rule.security_group_id,
@@ -88,6 +93,9 @@ def setUp(self):
8893
self.network.find_security_group = mock.Mock(
8994
return_value=self._security_group)
9095

96+
self.network.find_address_group = mock.Mock(
97+
return_value=self._address_group)
98+
9199
self.projects_mock.get.return_value = self.project
92100
self.domains_mock.get.return_value = self.domain
93101

@@ -103,6 +111,7 @@ def test_create_all_remote_options(self):
103111
arglist = [
104112
'--remote-ip', '10.10.0.0/24',
105113
'--remote-group', self._security_group.id,
114+
'--remote-address-group', self._address_group.id,
106115
self._security_group.id,
107116
]
108117
self.assertRaises(tests_utils.ParserException,
@@ -258,6 +267,34 @@ def test_create_protocol_any(self):
258267
self.assertEqual(self.expected_columns, columns)
259268
self.assertEqual(self.expected_data, data)
260269

270+
def test_create_remote_address_group(self):
271+
self._setup_security_group_rule({
272+
'protocol': 'icmp',
273+
'remote_address_group_id': self._address_group.id,
274+
})
275+
arglist = [
276+
'--protocol', 'icmp',
277+
'--remote-address-group', self._address_group.name,
278+
self._security_group.id,
279+
]
280+
verifylist = [
281+
('remote_address_group', self._address_group.name),
282+
('group', self._security_group.id),
283+
]
284+
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
285+
286+
columns, data = self.cmd.take_action(parsed_args)
287+
288+
self.network.create_security_group_rule.assert_called_once_with(**{
289+
'direction': self._security_group_rule.direction,
290+
'ethertype': self._security_group_rule.ether_type,
291+
'protocol': self._security_group_rule.protocol,
292+
'remote_address_group_id': self._address_group.id,
293+
'security_group_id': self._security_group.id,
294+
})
295+
self.assertEqual(self.expected_columns, columns)
296+
self.assertEqual(self.expected_data, data)
297+
261298
def test_create_remote_group(self):
262299
self._setup_security_group_rule({
263300
'protocol': 'tcp',
@@ -878,6 +915,7 @@ class TestListSecurityGroupRuleNetwork(TestSecurityGroupRuleNetwork):
878915
'Port Range',
879916
'Direction',
880917
'Remote Security Group',
918+
'Remote Address Group',
881919
)
882920
expected_columns_no_group = (
883921
'ID',
@@ -887,6 +925,7 @@ class TestListSecurityGroupRuleNetwork(TestSecurityGroupRuleNetwork):
887925
'Port Range',
888926
'Direction',
889927
'Remote Security Group',
928+
'Remote Address Group',
890929
'Security Group',
891930
)
892931

@@ -902,6 +941,7 @@ class TestListSecurityGroupRuleNetwork(TestSecurityGroupRuleNetwork):
902941
_security_group_rule),
903942
_security_group_rule.direction,
904943
_security_group_rule.remote_group_id,
944+
_security_group_rule.remote_address_group_id,
905945
))
906946
expected_data_no_group.append((
907947
_security_group_rule.id,
@@ -912,6 +952,7 @@ class TestListSecurityGroupRuleNetwork(TestSecurityGroupRuleNetwork):
912952
_security_group_rule),
913953
_security_group_rule.direction,
914954
_security_group_rule.remote_group_id,
955+
_security_group_rule.remote_address_group_id,
915956
_security_group_rule.security_group_id,
916957
))
917958

@@ -1041,6 +1082,7 @@ class TestShowSecurityGroupRuleNetwork(TestSecurityGroupRuleNetwork):
10411082
'port_range_min',
10421083
'project_id',
10431084
'protocol',
1085+
'remote_address_group_id',
10441086
'remote_group_id',
10451087
'remote_ip_prefix',
10461088
'security_group_id',
@@ -1055,6 +1097,7 @@ class TestShowSecurityGroupRuleNetwork(TestSecurityGroupRuleNetwork):
10551097
_security_group_rule.port_range_min,
10561098
_security_group_rule.project_id,
10571099
_security_group_rule.protocol,
1100+
_security_group_rule.remote_address_group_id,
10581101
_security_group_rule.remote_group_id,
10591102
_security_group_rule.remote_ip_prefix,
10601103
_security_group_rule.security_group_id,

‎releasenotes/notes/bp-address-groups-in-sg-rules-b3b7742e4e6f5745.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
features:
3+
- |
4+
Add ``--remote-address-group`` option to ``security group rule create``
5+
command for using an address group as the source/destination in security
6+
group rules. Also add field ``remote_address_group_id`` to the output of
7+
``security group rule show`` and add column ``Remote Address Group`` to
8+
the output of ``security group rule list``.
9+
[Blueprint `address-groups-in-sg-rules <https://blueprints.launchpad.net/neutron/+spec/address-groups-in-sg-rules>`_]

0 commit comments

Comments
 (0)