_validate_security_groups_on_port does not validating external_ids

[Aaron Rosen]

The function _validate_security_groups_on_port was not validating a ports security group id if the id was an external id.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/18929

[Salvatore Orlando (salvatore-orlando)]

Are we advocating the possibility of associating an external security group id to a port?
This would make sense if we were not storing security groups in quantum db as well, but since we have a quantum db record for each nova security group, it seems it should always be possible to use it.

The reason for it is that probably you want nova users to specify nova security groups when creating quantum ports. But then it seems you're claiming we should store the nova security group id in the quantum port object, whereas maybe quantum should work out automatically the corresponding quantum security group id.

But that's clumsy as well, as we will end up with the user getting a different id for the security groups in the response. E.g.: you create a port with security group id x and then when you fetch it its value is y.

I'm stopping here because I think I went far beyond the scope of this bug.
To cut a long story short, I think we should find another way of passing external security group ids to quantum ports.

[dan wendlandt (danwent)]

Hi Aaron,

At this point, I don't think there's a version of the security group handler stuff merged into nova, and I believe the plan is to actually change Nova so that it truly proxies security group calls to quantum, rather than having a nova-id and a quantum-id. At that point, wouldn't the need for the external-id go away? Or am I misunderstanding what external-id is used for?

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/18929
Committed: http://github.com/openstack/quantum/commit/26332dcbd8c25fb581c27ced1eb175bcd209c1fa
Submitter: Jenkins
Branch: master

commit 26332dcbd8c25fb581c27ced1eb175bcd209c1fa
Author: Aaron Rosen <email address hidden>
Date: Wed Jan 9 15:08:02 2013 -0800

    _validate_security_groups_on_port was not validating external_ids

    The function _validate_security_groups_on_port was not validating a ports
    security group id if the id was an external id. The unit tests now use
    set_override() rather than setting cfg values directly. Lastly, quantum.conf
    now has the proxy_mode option exposed.
    Fixes bug 1095864

    Change-Id: I0ec7f9ed36f1a46156c47a115be936bb41ef75d9