fog/fog — Issue #775: Fog::Compute::AWS::SecurityGroups ip_permissions - variance
Author: earthgecko
Created: 2012-03-02 08:09:28+00:00
State: open

I am pretty sure that there is a reason for this it may even be the expected behaviour and a result of how the EC2 API returns the data.

When I query AWS eu-west-1 using `security.groups.all` with the following:

#AWS.security_groups.get("default")
# Get a list of the zpf EC2 security groups
zpf_security_groups = connection.security_groups.all

# If this is not run in the zpf shell context, it is in a script context, so
# return in format so that the data can be used in the shell
# script context.
if $script_call == '1'
zpf_security_groups.each { |i| puts "#{i.name}, #{i.ip_permissions}" };nil
end

I get the results back on the `zpf_security_groups.each { |i| puts "#{i.name}, #{i.ip_permissions}" };nil` with varying order in the structure of the ip_permissions strings. Sometimes the ip_permissions string begins with `ipProtocol` metadata, sometimes it is the `toPort`, etc.

To highlight this here is an example:

This is 3 different `security_groups.all ` executions I have just highlighted the one security group and anonymised the IP strings.

gary@mc9:~$ cat /home/gary/admin/rm/bug5785/zpf-controller-dev-1.fog.ip_permissions.variance.txt | sed -e 's/\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}/123\.124\.125\.126/g'
[root@zpf-controller-dev-1-10g-ruk ~]# cat $CURRENT_PERMISSIONS_FILE.raw.20120302071000 | grep "zpf-controller-dev"
zpf-controller-dev, toPort22ipProtocoltcpfromPort22ipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/26groupstoPort6163ipProtocoltcpfromPort6163ipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32groupstoPort6164ipProtocoltcpfromPort6164ipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32groupstoPort8140ipProtocoltcpfromPort8140ipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32groupstoPort6166ipProtocoltcpfromPort6166ipRangescidrIp123.124.125.126/32groupstoPort162ipProtocoludpfromPort161ipRangescidrIp123.124.125.126/32groups
[root@zpf-controller-dev-1-10g-ruk ~]#
[root@zpf-controller-dev-1-10g-ruk ~]#
[root@zpf-controller-dev-1-10g-ruk ~]#
[root@zpf-controller-dev-1-10g-ruk ~]# cat $CURRENT_PERMISSIONS_FILE.raw | grep "zpf-controller-dev"
zpf-controller-dev, ipProtocoltcpfromPort22toPort22groupsipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/26ipProtocoltcpfromPort6163toPort6163groupsipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32ipProtocoltcpfromPort6164toPort6164groupsipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32ipProtocoltcpfromPort8140toPort8140groupsipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32ipProtocoltcpfromPort6166toPort6166groupsipRangescidrIp123.124.125.126/32ipProtocoludpfromPort161toPort162groupsipRangescidrIp123.124.125.126/32
[root@zpf-controller-dev-1-10g-ruk ~]#
[root@zpf-controller-dev-1-10g-ruk ~]#
[root@zpf-controller-dev-1-10g-ruk ~]#
[root@zpf-controller-dev-1-10g-ruk ~]# /opt/zpf/scripts/fog/fog.check.ec2.security.groups.permission.rb $i_region $SECURITY_GROUP script > $CURRENT_PERMISSIONS_FILE.raw.20120302073032
[root@zpf-controller-dev-1-10g-ruk ~]# cat $CURRENT_PERMISSIONS_FILE.raw.20120302073032 | grep "zpf-controller-dev"
zpf-controller-dev, fromPort22groupsipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/26ipProtocoltcptoPort22fromPort6163groupsipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32ipProtocoltcptoPort6163fromPort6164groupsipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32ipProtocoltcptoPort6164fromPort8140groupsipRangescidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32cidrIp123.124.125.126/32ipProtocoltcptoPort8140fromPort6166groupsipRangescidrIp123.124.125.126/32ipProtocoltcptoPort6166fromPort161groupsipRangescidrIp123.124.125.126/32ipProtocoludptoPort162
[root@zpf-controller-dev-1-10g-ruk ~]#