Intersecting port ranges in security-group-rules

[Inessa Vasilevskaya]

Seen on: newton devstack

Currently it is possible to create security-group-rules with intersecting port ranges (like [769, 781] and [770, 777] http://paste.openstack.org/show/597980/). This works for any type of firewall_driver, both iptables and ovsfw.

I believe this can be optimized a bit.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/456591

[Kevin Benton (kevinbenton)]

To be clear, we don't want to prevent this at the API level because it's convenient for the user. This bug can be used to optimize inside the firewall implementations though.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Armando Migliaccio (<email address hidden>) on branch: master
Review: https://review.openstack.org/456591
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Reedip (reedip-banerjee-deactivatedaccount)]

Since I am not active anymore, I would like to remove myself from the assignee. Its open for anyone else to take up.