Create sg rule or delete sg rule, iptalbes can't be reloaded

[shihanzhang]

when we create a new sg rule or delete a sg rule, the iptables can't be reload in compute node, this bug is introduced by patch: https://review.openstack.org/118274

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/181272

[Kevin Benton (kevinbenton)]

What do you mean iptables can't be reloaded?

There is a tempest test that modifies security group rules and verifies the resulting connectivity here: https://github.com/openstack/tempest/blob/master/tempest/scenario/test_security_groups_basic_ops.py#L463

Can you please explain why that passed if iptables is not being reloaded?

[shihanzhang (shihanzhang)]

reproduce:
1. create a VM in security group A
2. create a new sg rule for security group A
3. the compute node which this VM residing on can't reload it's iptables

the reason it that when a sg rule change, l2 agent will put the devices to 'self.devices_to_refilter' firstly, in ovs agent next 'rpc_loop' , it handle these devices in 'setup_port_filters' function.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/181272
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=39af7fb15ef5abe9402d80da207c2c43ca905d23
Submitter: Jenkins
Branch: master

commit 39af7fb15ef5abe9402d80da207c2c43ca905d23
Author: shihanzhang <email address hidden>
Date: Fri May 8 08:51:19 2015 +0800

    setup port filters when sg rules change

    when security group rules change, the l2 agents which have the
    ports in this security group should reload iptables, this bug
    was introduced by patch#118274.

    Closes-bug: #1452718
    Change-Id: Idb1577128be5d8812024467f599166bc131d57ea

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: neutron-pecan
Review: https://review.openstack.org/185072