Make validation for security groups in nova's EC2 API less aggressive

Registered by Alexej Ababilov

Currently EC2 API in nova forces security group names to match '^[-a-zA-Z0-9_ ]+$' (https://code.launchpad.net/~davewalker/nova/validate_groupname_create_security_group/+merge/68197). However, Amazon and Eucalyptus allow far more symbols - here is an example for Amazon:

$ euca-add-group 'f(sg)!@#$%^&*' -d 'test name'
GROUP f(sg)!@#$%^&* test name

According to Eucalyptus source, the security group name is not validated - all symbols are acceptable.

This nova behavior can break client libraries. For instance, jclouds usually creates groups like jclouds#spam-eggs.dbnode.1#eu-west-1. This library was finally patched on 2012-03-27 (https://github.com/jclouds/jclouds/issues/330, https://github.com/jclouds/jclouds/commit/49e475edcd6dbf706250c05c90210476d7e43900), but the same problem can occur for any client that was developed for Amazon or Eucalyptus and tries to interact with nova.

Native Nova API (nova.api.openstack.contrib.security_groups) doesn't perform any validation. So, we can create a group like "group/1" (the name is send in JSON during creation) that should not cause problems since API calls expect IDs (not names) in URLs.

I propose to allow using ASCII characters from 0x20 to 0x7E in security group names in Nova EC2 API - that includes spaces, letters, digits, and symbols like ! " # $ % & ' ( ) * + and so on.

Blueprint information

Status:
Complete
Approver:
None
Priority:
Undefined
Drafter:
None
Direction:
Approved
Assignee:
None
Definition:
Obsolete
Series goal:
None
Implementation:
Unknown
Milestone target:
None
Completed by
Vish Ishaya

Related branches

Sprints

Whiteboard

would you mind making this as a bug? This is a small change and it is definitely bugworthy.

Done! https://bugs.launchpad.net/nova/+bug/1000673

(?)

Work Items

This blueprint contains Public information 
Everyone can see this information.