{"action":"created","issue":{"url":"https://api.github.com/repos/projectcalico/calico/issues/777","labels_url":"https://api.github.com/repos/projectcalico/calico/issues/777/labels{/name}","comments_url":"https://api.github.com/repos/projectcalico/calico/issues/777/comments","events_url":"https://api.github.com/repos/projectcalico/calico/issues/777/events","html_url":"https://github.com/projectcalico/calico/issues/777","id":102418401,"number":777,"title":"Filtering on IP protocol 0 causes all rules to be silently rejected","user":{"login":"Brook-Roberts","id":11869297,"avatar_url":"https://avatars.githubusercontent.com/u/11869297?v=3","gravatar_id":"","url":"https://api.github.com/users/Brook-Roberts","html_url":"https://github.com/Brook-Roberts","followers_url":"https://api.github.com/users/Brook-Roberts/followers","following_url":"https://api.github.com/users/Brook-Roberts/following{/other_user}","gists_url":"https://api.github.com/users/Brook-Roberts/gists{/gist_id}","starred_url":"https://api.github.com/users/Brook-Roberts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Brook-Roberts/subscriptions","organizations_url":"https://api.github.com/users/Brook-Roberts/orgs","repos_url":"https://api.github.com/users/Brook-Roberts/repos","events_url":"https://api.github.com/users/Brook-Roberts/events{/privacy}","received_events_url":"https://api.github.com/users/Brook-Roberts/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/projectcalico/calico/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/projectcalico/calico/labels/felix","name":"felix","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-21T16:43:44Z","updated_at":"2015-09-03T10:06:22Z","closed_at":null,"body":"Adding a security group rule in Openstack, through Horizon, that filters on IP protocol 0, causes all other rules in that security group to stop taking affect.\r\n\r\nI believe it's expected that we can't implement this rule, however:\r\na) The user isn't informed that their rule wasn't allowed, so if they intended to put in a different rule (e.g. allowing a different protocol) it won't be obvious that they put in the wrong thing\r\nb) Since the user isn't informed, they won't realise straight away that the rest of their rules also aren't working.\r\n\r\nLikely to be a particular pain for people using scripts, which could well mistakenly enter such rules."},"comment":{"url":"https://api.github.com/repos/projectcalico/calico/issues/comments/137398422","html_url":"https://github.com/projectcalico/calico/issues/777#issuecomment-137398422","issue_url":"https://api.github.com/repos/projectcalico/calico/issues/777","id":137398422,"user":{"login":"fasaxc","id":469264,"avatar_url":"https://avatars.githubusercontent.com/u/469264?v=3","gravatar_id":"","url":"https://api.github.com/users/fasaxc","html_url":"https://github.com/fasaxc","followers_url":"https://api.github.com/users/fasaxc/followers","following_url":"https://api.github.com/users/fasaxc/following{/other_user}","gists_url":"https://api.github.com/users/fasaxc/gists{/gist_id}","starred_url":"https://api.github.com/users/fasaxc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fasaxc/subscriptions","organizations_url":"https://api.github.com/users/fasaxc/orgs","repos_url":"https://api.github.com/users/fasaxc/repos","events_url":"https://api.github.com/users/fasaxc/events{/privacy}","received_events_url":"https://api.github.com/users/fasaxc/received_events","type":"User","site_admin":false},"created_at":"2015-09-03T10:06:22Z","updated_at":"2015-09-03T10:06:22Z","body":"Two approaches we can take here:\r\n\r\n* Find a way to police this in the neutron plugin.  Does it just work if we raise an exception when we stop a bad rule?\r\n* Wait for status reporting in felix which will let us report the failure to program back up to neutron.  This may not be very visible in the UI, though."}}