[Bug 1813007] Re: Unable to install new flows on compute nodes when having broken security group rules

[Brian Haley]

I'll work on this change, think I have a fix, just need to get some
reviews.

** Changed in: neutron
   Importance: Undecided => Critical

** Changed in: neutron
       Status: New => Confirmed

** Changed in: neutron
     Assignee: (unassigned) => Brian Haley (brian-haley)

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/1813007

Title:
  Unable to install new flows on compute nodes when having broken
  security group rules

Status in Ubuntu Cloud Archive:
  Triaged
Status in Ubuntu Cloud Archive pike series:
  Triaged
Status in Ubuntu Cloud Archive queens series:
  Triaged
Status in Ubuntu Cloud Archive rocky series:
  Triaged
Status in Ubuntu Cloud Archive stein series:
  Triaged
Status in neutron:
  Confirmed
Status in OpenStack Security Advisory:
  Incomplete
Status in neutron package in Ubuntu:
  Triaged
Status in neutron source package in Xenial:
  Triaged
Status in neutron source package in Bionic:
  Triaged
Status in neutron source package in Cosmic:
  Triaged
Status in neutron source package in Disco:
  Triaged

Bug description:
  It appears that we have found that neutron-openvswitch-agent appears to have a bug where two security group rules that have two different port ranges that overlap tied to the same parent security group will cause neutron to not be able to configure networks on the compute nodes where those security groups are present.
  Those are the broken security rules: https://pastebin.canonical.com/p/wSy8RSXt85/
  Here is the log when we discovered the issue: https://pastebin.canonical.com/p/wvFKjNWydr/

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1813007/+subscriptions