Skip to content

Commit 85c26ca

Browse files
Jenkinsopenstack-gerrit
Jenkins
authored and
openstack-gerrit
committed
Merge "Not appropriate name sg rule attribute"
2 parents 85f2afd + 3a915b5 commit 85c26ca

4 files changed

Lines changed: 190 additions & 22 deletions

File tree

‎doc/source/command-objects/security-group-rule.rst‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ Create a new security group rule
1616
.. code:: bash
1717
1818
os security group rule create
19-
[--src-ip <ip-address> | --src-group <group>]
19+
[--remote-ip <ip-address> | --remote-group <group>]
2020
[--dst-port <port-range> | [--icmp-type <icmp-type> [--icmp-code <icmp-code>]]]
2121
[--protocol <protocol>]
2222
[--ingress | --egress]
@@ -25,14 +25,14 @@ Create a new security group rule
2525
[--description <description>]
2626
<group>
2727
28-
.. option:: --src-ip <ip-address>
28+
.. option:: --remote-ip <ip-address>
2929
30-
Source IP address block
30+
Remote IP address block
3131
(may use CIDR notation; default for IPv4 rule: 0.0.0.0/0)
3232
33-
.. option:: --src-group <group>
33+
.. option:: --remote-group <group>
3434
35-
Source security group (name or ID)
35+
Remote security group (name or ID)
3636
3737
.. option:: --dst-port <port-range>
3838

‎openstackclient/network/v2/security_group_rule.py‎

Lines changed: 38 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -94,14 +94,31 @@ def update_parser_common(self, parser):
9494
metavar='<group>',
9595
help=_("Create rule in this security group (name or ID)")
9696
)
97-
source_group = parser.add_mutually_exclusive_group()
98-
source_group.add_argument(
97+
# NOTE(yujie): Support either remote-ip option name for now.
98+
# However, consider deprecating and then removing --src-ip in
99+
# a future release.
100+
remote_group = parser.add_mutually_exclusive_group()
101+
remote_group.add_argument(
102+
"--remote-ip",
103+
metavar="<ip-address>",
104+
help=_("Remote IP address block (may use CIDR notation; "
105+
"default for IPv4 rule: 0.0.0.0/0)")
106+
)
107+
remote_group.add_argument(
99108
"--src-ip",
100109
metavar="<ip-address>",
101110
help=_("Source IP address block (may use CIDR notation; "
102111
"default for IPv4 rule: 0.0.0.0/0)")
103112
)
104-
source_group.add_argument(
113+
# NOTE(yujie): Support either remote-group option name for now.
114+
# However, consider deprecating and then removing --src-group in
115+
# a future release.
116+
remote_group.add_argument(
117+
"--remote-group",
118+
metavar="<group>",
119+
help=_("Remote security group (name or ID)")
120+
)
121+
remote_group.add_argument(
105122
"--src-group",
106123
metavar="<group>",
107124
help=_("Source security group (name or ID)")
@@ -285,13 +302,16 @@ def take_action_network(self, client, parsed_args):
285302
if parsed_args.icmp_code:
286303
attrs['port_range_max'] = parsed_args.icmp_code
287304

288-
if parsed_args.src_group is not None:
305+
if not (parsed_args.remote_group is None and
306+
parsed_args.src_group is None):
289307
attrs['remote_group_id'] = client.find_security_group(
290-
parsed_args.src_group,
308+
parsed_args.remote_group or parsed_args.src_group,
291309
ignore_missing=False
292310
).id
293-
elif parsed_args.src_ip is not None:
294-
attrs['remote_ip_prefix'] = parsed_args.src_ip
311+
elif not (parsed_args.remote_ip is None and
312+
parsed_args.src_ip is None):
313+
attrs['remote_ip_prefix'] = (parsed_args.remote_ip or
314+
parsed_args.src_ip)
295315
elif attrs['ethertype'] == 'IPv4':
296316
attrs['remote_ip_prefix'] = '0.0.0.0/0'
297317
attrs['security_group_id'] = security_group_id
@@ -320,23 +340,25 @@ def take_action_compute(self, client, parsed_args):
320340
from_port, to_port = -1, -1
321341
else:
322342
from_port, to_port = parsed_args.dst_port
323-
src_ip = None
324-
if parsed_args.src_group is not None:
325-
parsed_args.src_group = utils.find_resource(
343+
remote_ip = None
344+
if not (parsed_args.remote_group is None and
345+
parsed_args.src_group is None):
346+
parsed_args.remote_group = utils.find_resource(
326347
client.security_groups,
327-
parsed_args.src_group,
348+
parsed_args.remote_group or parsed_args.src_group,
328349
).id
329-
if parsed_args.src_ip is not None:
330-
src_ip = parsed_args.src_ip
350+
if not (parsed_args.remote_ip is None and
351+
parsed_args.src_ip is None):
352+
remote_ip = parsed_args.remote_ip or parsed_args.src_ip
331353
else:
332-
src_ip = '0.0.0.0/0'
354+
remote_ip = '0.0.0.0/0'
333355
obj = client.security_group_rules.create(
334356
group.id,
335357
protocol,
336358
from_port,
337359
to_port,
338-
src_ip,
339-
parsed_args.src_group,
360+
remote_ip,
361+
parsed_args.remote_group,
340362
)
341363
return _format_security_group_rule_show(obj._info)
342364

‎openstackclient/tests/unit/network/v2/test_security_group_rule.py‎

Lines changed: 140 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,15 @@ def test_create_all_source_options(self):
121121
self.assertRaises(tests_utils.ParserException,
122122
self.check_parser, self.cmd, arglist, [])
123123

124+
def test_create_all_remote_options(self):
125+
arglist = [
126+
'--remote-ip', '10.10.0.0/24',
127+
'--remote-group', self._security_group.id,
128+
self._security_group.id,
129+
]
130+
self.assertRaises(tests_utils.ParserException,
131+
self.check_parser, self.cmd, arglist, [])
132+
124133
def test_create_bad_ethertype(self):
125134
arglist = [
126135
'--ethertype', 'foo',
@@ -215,7 +224,7 @@ def test_create_proto_option(self):
215224
self.assertEqual(self.expected_columns, columns)
216225
self.assertEqual(self.expected_data, data)
217226

218-
def test_create_source_group(self):
227+
def test_create_remote_group(self):
219228
self._setup_security_group_rule({
220229
'port_range_max': 22,
221230
'port_range_min': 22,
@@ -250,6 +259,34 @@ def test_create_source_group(self):
250259
self.assertEqual(self.expected_columns, columns)
251260
self.assertEqual(self.expected_data, data)
252261

262+
def test_create_source_group(self):
263+
self._setup_security_group_rule({
264+
'remote_group_id': self._security_group.id,
265+
})
266+
arglist = [
267+
'--ingress',
268+
'--src-group', self._security_group.name,
269+
self._security_group.id,
270+
]
271+
verifylist = [
272+
('ingress', True),
273+
('src_group', self._security_group.name),
274+
('group', self._security_group.id),
275+
]
276+
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
277+
278+
columns, data = self.cmd.take_action(parsed_args)
279+
280+
self.network.create_security_group_rule.assert_called_once_with(**{
281+
'direction': self._security_group_rule.direction,
282+
'ethertype': self._security_group_rule.ethertype,
283+
'protocol': self._security_group_rule.protocol,
284+
'remote_group_id': self._security_group_rule.remote_group_id,
285+
'security_group_id': self._security_group.id,
286+
})
287+
self.assertEqual(self.expected_columns, columns)
288+
self.assertEqual(self.expected_data, data)
289+
253290
def test_create_source_ip(self):
254291
self._setup_security_group_rule({
255292
'protocol': 'icmp',
@@ -279,6 +316,35 @@ def test_create_source_ip(self):
279316
self.assertEqual(self.expected_columns, columns)
280317
self.assertEqual(self.expected_data, data)
281318

319+
def test_create_remote_ip(self):
320+
self._setup_security_group_rule({
321+
'protocol': 'icmp',
322+
'remote_ip_prefix': '10.0.2.0/24',
323+
})
324+
arglist = [
325+
'--protocol', self._security_group_rule.protocol,
326+
'--remote-ip', self._security_group_rule.remote_ip_prefix,
327+
self._security_group.id,
328+
]
329+
verifylist = [
330+
('protocol', self._security_group_rule.protocol),
331+
('remote_ip', self._security_group_rule.remote_ip_prefix),
332+
('group', self._security_group.id),
333+
]
334+
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
335+
336+
columns, data = self.cmd.take_action(parsed_args)
337+
338+
self.network.create_security_group_rule.assert_called_once_with(**{
339+
'direction': self._security_group_rule.direction,
340+
'ethertype': self._security_group_rule.ethertype,
341+
'protocol': self._security_group_rule.protocol,
342+
'remote_ip_prefix': self._security_group_rule.remote_ip_prefix,
343+
'security_group_id': self._security_group.id,
344+
})
345+
self.assertEqual(self.expected_columns, columns)
346+
self.assertEqual(self.expected_data, data)
347+
282348
def test_create_network_options(self):
283349
self._setup_security_group_rule({
284350
'direction': 'egress',
@@ -527,6 +593,15 @@ def test_create_all_source_options(self):
527593
self.assertRaises(tests_utils.ParserException,
528594
self.check_parser, self.cmd, arglist, [])
529595

596+
def test_create_all_remote_options(self):
597+
arglist = [
598+
'--remote-ip', '10.10.0.0/24',
599+
'--remote-group', self._security_group.id,
600+
self._security_group.id,
601+
]
602+
self.assertRaises(tests_utils.ParserException,
603+
self.check_parser, self.cmd, arglist, [])
604+
530605
def test_create_bad_protocol(self):
531606
arglist = [
532607
'--protocol', 'foo',
@@ -617,6 +692,38 @@ def test_create_source_group(self):
617692
self.assertEqual(expected_columns, columns)
618693
self.assertEqual(expected_data, data)
619694

695+
def test_create_remote_group(self):
696+
expected_columns, expected_data = self._setup_security_group_rule({
697+
'from_port': 22,
698+
'to_port': 22,
699+
'group': {'name': self._security_group.name},
700+
})
701+
arglist = [
702+
'--dst-port', str(self._security_group_rule.from_port),
703+
'--remote-group', self._security_group.name,
704+
self._security_group.id,
705+
]
706+
verifylist = [
707+
('dst_port', (self._security_group_rule.from_port,
708+
self._security_group_rule.to_port)),
709+
('remote_group', self._security_group.name),
710+
('group', self._security_group.id),
711+
]
712+
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
713+
714+
columns, data = self.cmd.take_action(parsed_args)
715+
716+
self.compute.security_group_rules.create.assert_called_once_with(
717+
self._security_group.id,
718+
self._security_group_rule.ip_protocol,
719+
self._security_group_rule.from_port,
720+
self._security_group_rule.to_port,
721+
self._security_group_rule.ip_range['cidr'],
722+
self._security_group.id,
723+
)
724+
self.assertEqual(expected_columns, columns)
725+
self.assertEqual(expected_data, data)
726+
620727
def test_create_source_ip(self):
621728
expected_columns, expected_data = self._setup_security_group_rule({
622729
'ip_protocol': 'icmp',
@@ -649,6 +756,38 @@ def test_create_source_ip(self):
649756
self.assertEqual(expected_columns, columns)
650757
self.assertEqual(expected_data, data)
651758

759+
def test_create_remote_ip(self):
760+
expected_columns, expected_data = self._setup_security_group_rule({
761+
'ip_protocol': 'icmp',
762+
'from_port': -1,
763+
'to_port': -1,
764+
'ip_range': {'cidr': '10.0.2.0/24'},
765+
})
766+
arglist = [
767+
'--protocol', self._security_group_rule.ip_protocol,
768+
'--remote-ip', self._security_group_rule.ip_range['cidr'],
769+
self._security_group.id,
770+
]
771+
verifylist = [
772+
('protocol', self._security_group_rule.ip_protocol),
773+
('remote_ip', self._security_group_rule.ip_range['cidr']),
774+
('group', self._security_group.id),
775+
]
776+
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
777+
778+
columns, data = self.cmd.take_action(parsed_args)
779+
780+
self.compute.security_group_rules.create.assert_called_once_with(
781+
self._security_group.id,
782+
self._security_group_rule.ip_protocol,
783+
self._security_group_rule.from_port,
784+
self._security_group_rule.to_port,
785+
self._security_group_rule.ip_range['cidr'],
786+
None,
787+
)
788+
self.assertEqual(expected_columns, columns)
789+
self.assertEqual(expected_data, data)
790+
652791
def test_create_proto_option(self):
653792
expected_columns, expected_data = self._setup_security_group_rule({
654793
'ip_protocol': 'icmp',

‎releasenotes/notes/bug-1637365-b90cdcc05ffc7d3a.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
upgrade:
2+
-
3+
Changed the ``security group rule create`` command ``--src-ip``
4+
option to ``--remote-ip``, ``--src-group`` option to ``--remote-group``.
5+
Using the ``--src-ip`` ``--src-group`` option is still supported, but
6+
is no longer documented and may be deprecated in a future release.
7+
[Bug `1637365 <https://bugs.launchpad.net/python-openstackclient/+bug/1637365>`_]

0 commit comments

Comments
 (0)