unable to add allow all ingress traffic security group rule

[Aaron Rosen]

The following rule is unable to be installed:

$ neutron security-group-rule-create --direction ingress default
409-{u'NeutronError': {u'message': u'Security group rule already exists. Group id is 29dc1837-75d3-457a-8a90-14f4b6ea6db9.', u'type': u'SecurityGroupRuleExists', u'detail': u''}}

The reason for this is when the db query is done it passes this in as a filter:

{'tenant_id': [u'577a2f0c78fb4e36b76902977a5c1708'], 'direction': [u'ingress'], 'ethertype': ['IPv4'], 'security_group_id': [u'0fb10163-81b2-4538-bd11-dbbd3878db51']}

and the remote_group_id is wild carded thus it matches this rule:

[ {'direction': u'ingress',
  'ethertype': u'IPv4',
  'id': u'8d5c3429-f4ef-4258-8140-5ff3247f9dd6',
  'port_range_max': None,
  'port_range_min': None,
  'protocol': None,
  'remote_group_id': None,
  'remote_ip_prefix': None,
  'security_group_id': u'0fb10163-81b2-4538-bd11-dbbd3878db51',
  'tenant_id': u'577a2f0c78fb4e36b76902977a5c1708'}]

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/57670

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/57670
Committed: http://github.com/openstack/neutron/commit/9335ffd7c3eaad0d66d7d19e7760ae12476a5ea2
Submitter: Jenkins
Branch: master

commit 9335ffd7c3eaad0d66d7d19e7760ae12476a5ea2
Author: Aaron Rosen <email address hidden>
Date: Thu Nov 21 05:28:28 2013 -0800

    Fix unable to add allow all IPv4/6 security group rule

    Previously, if one tried to add a rule to allow all ingress ipv4 neutron
    would respond that the rule was already part of the security group.
    This happened as the filter for querying existing rules uses a wildcard for
    remote_group_id thus returning a false match. This patch addresses
    this issue.

    Change-Id: I0320013a3869d25fb424995354721929465d2848
    Closes-bug: #1252806

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/havana
Review: https://review.openstack.org/60587

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/grizzly
Review: https://review.openstack.org/60589

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/60587
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=94d1dee76629aea63afa6bff98a8bfb855f07e45
Submitter: Jenkins
Branch: stable/havana

commit 94d1dee76629aea63afa6bff98a8bfb855f07e45
Author: Aaron Rosen <email address hidden>
Date: Thu Nov 21 05:28:28 2013 -0800

    Fix unable to add allow all IPv4/6 security group rule

    Previously, if one tried to add a rule to allow all ingress ipv4 neutron
    would respond that the rule was already part of the security group.
    This happened as the filter for querying existing rules uses a wildcard for
    remote_group_id thus returning a false match. This patch addresses
    this issue.

    Change-Id: I0320013a3869d25fb424995354721929465d2848
    Closes-bug: #1252806
    (cherry picked from commit 9335ffd7c3eaad0d66d7d19e7760ae12476a5ea2)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/60589
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=e2c2fc675aa224a844dc08c60edbbb5b2e03b97c
Submitter: Jenkins
Branch: stable/grizzly

commit e2c2fc675aa224a844dc08c60edbbb5b2e03b97c
Author: Aaron Rosen <email address hidden>
Date: Thu Nov 21 05:28:28 2013 -0800

    Fix unable to add allow all IPv4/6 security group rule

    Previously, if one tried to add a rule to allow all ingress ipv4 neutron
    would respond that the rule was already part of the security group.
    This happened as the filter for querying existing rules uses a wildcard for
    remote_group_id thus returning a false match. This patch addresses
    this issue.

    Change-Id: I0320013a3869d25fb424995354721929465d2848
    Closes-bug: #1252806
    (cherry picked from commit 9335ffd7c3eaad0d66d7d19e7760ae12476a5ea2)