Port update disabling port security fails

[Petr Jediný]

neutron port-update 2aded095-fdb6-4e4c-8ca9-a105c3fc0cdc --port_security_enabled=false
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
An unknown exception occurred.

The api log:
<pre>Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/vnc_openstack/neutron_plugin_interface.py", line 415, in plugin_update_port
    port['resource'])
  File "/usr/lib/python2.7/dist-packages/vnc_openstack/neutron_plugin_db.py", line 2381, in wrapper
    return func(self, *args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/vnc_openstack/neutron_plugin_db.py", line 3749, in port_update
    port_obj = self._port_neutron_to_vnc(port_q, None, UPDATE)
  File "/usr/lib/python2.7/dist-packages/vnc_openstack/neutron_plugin_db.py", line 1897, in _port_neutron_to_vnc
    self._raise_contrail_exception('PortSecurityPortHasSecurityGroup', port_id=port_obj.uuid)
  File "/usr/lib/python2.7/dist-packages/vnc_openstack/neutron_plugin_db.py", line 223, in _raise_contrail_exception
    bottle.abort(400, json.dumps(exc_info))
  File "/usr/lib/python2.7/dist-packages/bottle.py", line 2310, in abort
    raise HTTPError(code, text)
HTTPError
</pre>

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/35688
Submitter: Petr Jedin? (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/35690
Submitter: Petr Jedin? (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/35691
Submitter: Petr Jedin? (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/35692
Submitter: Petr Jedin? (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/35693
Submitter: Petr Jedin? (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/35694
Submitter: Petr Jedin? (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/35688
Submitter: Petr Jedin? (<email address hidden>)

[Abhay Joshi (abhayj)]

We can't and shouldn't disable security groups implicitly. It is better to let the user remove SG if they want to disable port-security. Also, ignoring SG is not an option because that is one of the things the port security flags controls. IMHO, the current behavior is correct one, but if you find that stock neutron/devstack behaves differently, please let us know.