Comment 12 for bug 2058138

Reviewed: https://review.opendev.org/c/openstack/neutron/+/913708
Committed: https://opendev.org/openstack/neutron/commit/5e1188ef38da3f196aadf82a3842fa982c9a0c83
Submitter: "Zuul (22348)"
Branch: master

commit 5e1188ef38da3f196aadf82a3842fa982c9a0c83
Author: Robert Breker <email address hidden>
Date: Sun Mar 17 14:43:50 2024 +0000

    Enhance IptablesFirewallDriver with remote address groups

    This change enhances the IptablesFirewallDriver with support for remote
    address groups. Previously, this feature was only available in the
    OVSFirewallDriver. This commit harmonizes the capabilities across both
    firewall drivers, and by inheritance also to OVSHybridIptablesFirewallDriver.

    Background -
    The Neutron API allows operators to configure remote address groups [1],
    however the OVSHybridIptablesFirewallDriver and IptablesFirewallDriver do
    not implement these remote group restrictions. When configuring security
    group rules with remote address groups, connections get enabled
    based on other rule parameters, ignoring the configured remote address
    group restrictions.
    This behaviour undocumented, and may lead to more-open-than-configured network
    access.

    Closes-Bug: #2058138
    Change-Id: I76b3cb46ee603fa5e829537af41316bb42a6f30f