[Bug 1813007] Fix merged to neutron (stable/queens)

[OpenStack Infra]

Reviewed:  https://review.openstack.org/648004
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=9751ebd36dc24f99b1951e928f8b910e7e0e01f7
Submitter: Zuul
Branch:    stable/queens

commit 9751ebd36dc24f99b1951e928f8b910e7e0e01f7
Author: Brian Haley <bhaley at redhat.com>
Date:   Thu Feb 28 22:19:16 2019 -0500

    Fix KeyError in OVS firewall
    
    When merging port ranges, the code never assumed the
    conjunction ID might not be present in the set due to
    already being removed.
    
    In this case there were two security groups, both using
    the same remote security group, but the first security
    group does not define a port range and the second one does.
    Or more generally, the first SG port range is a subset
    of the second, as no port-range means the full range.
    
    Change-Id: I17ab643abbd2ec21eda4ae1dfb9abf2d4b0657f2
    Closes-bug: #1813007
    (cherry picked from commit 18c578aa10c19a6befdf1f1510645200f173eb44)

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/1813007

Title:
  [SRU] Unable to install new flows on compute nodes when having broken
  security group rules

Status in Ubuntu Cloud Archive:
  Fix Released
Status in Ubuntu Cloud Archive pike series:
  Fix Committed
Status in Ubuntu Cloud Archive queens series:
  Fix Committed
Status in Ubuntu Cloud Archive rocky series:
  Fix Committed
Status in Ubuntu Cloud Archive stein series:
  Fix Released
Status in neutron:
  Fix Released
Status in OpenStack Security Advisory:
  Confirmed
Status in neutron package in Ubuntu:
  Fix Committed
Status in neutron source package in Bionic:
  Fix Committed
Status in neutron source package in Cosmic:
  Fix Committed
Status in neutron source package in Disco:
  Fix Committed

Bug description:
  It appears that we have found that neutron-openvswitch-agent appears to have a bug where two security group rules that have two different port ranges that overlap tied to the same parent security group will cause neutron to not be able to configure networks on the compute nodes where those security groups are present.
  Those are the broken security rules: https://pastebin.canonical.com/p/wSy8RSXt85/
  Here is the log when we discovered the issue: https://pastebin.canonical.com/p/wvFKjNWydr/

  
  Ubuntu SRU Details
  ------------------
  [Impact]
  Neutron openvswitch agent crashes due to creation of two security groups that both use the same remote security group, where the first group doesn't define a port range and the second one does (one is a subset of the other; specifying no port range is the same as a full port range).

  [Test case]
  See comment #18 below.

  [Regression Potential]
  The fix is fairly minimal and has landed upstream in master branch. It has therefore passed all unit and function tests that get run in the upstream gate and has been reviewed by upstream neutron core reviewers. This all helps to minimize the regression potential.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1813007/+subscriptions