Comment 22 for bug 2058138

Reviewed: https://review.opendev.org/c/openstack/neutron/+/914586
Committed: https://opendev.org/openstack/neutron/commit/ca25eb96f16dbe5ff1ca4446534f9a1d12fa7035
Submitter: "Zuul (22348)"
Branch: stable/zed

commit ca25eb96f16dbe5ff1ca4446534f9a1d12fa7035
Author: Robert Breker <email address hidden>
Date: Sun Mar 17 14:43:50 2024 +0000

    Enhance IptablesFirewallDriver with remote address groups

    This change enhances the IptablesFirewallDriver with support for remote
    address groups. Previously, this feature was only available in the
    OVSFirewallDriver. This commit harmonizes the capabilities across both
    firewall drivers, and by inheritance also to OVSHybridIptablesFirewallDriver.

    Background -
    The Neutron API allows operators to configure remote address groups [1],
    however the OVSHybridIptablesFirewallDriver and IptablesFirewallDriver do
    not implement these remote group restrictions. When configuring security
    group rules with remote address groups, connections get enabled
    based on other rule parameters, ignoring the configured remote address
    group restrictions.
    This behaviour undocumented, and may lead to more-open-than-configured network
    access.

    Closes-Bug: #2058138
    Change-Id: I76b3cb46ee603fa5e829537af41316bb42a6f30f
    (cherry picked from commit 5e1188ef38da3f196aadf82a3842fa982c9a0c83)