Security group rules are erroneously applied to all ports having same ip addresses in different networks

[Zhiyuan Cai]

The following steps happen in the same host machine.

1. tenant1 create vm1 with network net1 and ip 199.168.1.2
2. tenant1 create vm2 with network net1 and ip 199.168.1.4
3. configure security group of vm1 and vm2 so they can communicate with tcp connetion
4. tenant2 create vm3 with network net2 and ip 199.168.1.2
5. tenant2 create vm4 with network net2 and ip 199.168.1.4
6. configure security group of vm3 and vm4 so they can't communicate with tcp connetion
7. create tcp connetion between vm1 and vm2, success
8. create tcp connetion betwwen vm3 and vm4 when vm1 and vm2 are still connecting, success, which failure is expected

This problem is caused since these two connections share the same 5-tuple, so conntrack let the packets between vm3 and vm4 pass.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/118274

[Brian Haley (brian-haley)]

Does this only happen when you don't use namespaces?

[Eugene Nikanorov (enikanorov)]

Brian, compute hosts don't use namespaces, so the bug is valid.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/118274
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=bd5373b670cdd7f21f8a1ece98fde6be9fda71ab
Submitter: Jenkins
Branch: master

commit bd5373b670cdd7f21f8a1ece98fde6be9fda71ab
Author: yangxurong <email address hidden>
Date: Tue Aug 26 15:15:40 2014 +0800

    Use iptables zone to separate different ip_conntrack

    ip_conntrack causes security group rule failures when packets share
    the same 5-tuple. Use iptables zone option to separate different
    conntrack zone. Currently this patch only works for OVS agent.

    Co-authored-by: shihanzhang <email address hidden>

    Change-Id: I90b4d2485e3e491f496dfb7bdee03d57f393be35
    Partial-Bug: #1359523

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: neutron-pecan
Review: https://review.openstack.org/185072

[Jay Pipes (jaypipes)]

Should this be considered a security issue?

[yalei wang (yalei-wang)]

what else should be done in this bug? is it fixed?