Bug 1787933

Summary: Succeed to create new security group if security group rule quota is exceeded
Product: Red Hat OpenStack Reporter: Alex Katz <akatz>
Component: openstack-neutronAssignee: Rodolfo Alonso <ralonsoh>
Status: CLOSED CURRENTRELEASE QA Contact: Alex Katz <akatz>
Severity: medium Docs Contact:
Priority: low    
Version: 16.0 (Train)CC: amuller, chrisw, njohnston, scohen
Target Milestone: z2Keywords: TestOnly, Triaged
Target Release: 16.0 (Train on RHEL 8.1)   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: openstack-neutron-15.0.1-0.20191129040411.998d93b.el8ost.noarch Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-04-06 10:37:14 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Alex Katz 2020-01-05 16:13:11 UTC 
Description of problem:

New security groups with two default rules can be created successfully if the security group rule quota is exceeded.


How reproducible:

OS_PROJECT_NAME=admin
CREATED=`openstack security group list --project $OS_PROJECT_NAME -f json | jq -r '.[] | .ID' | xargs -I {} openstack security group rule list {} -f value | wc -l`
let "CREATED +=1"
SG=`openstack security group list --project $OS_PROJECT_NAME -f json | jq -r '.[0] | .ID'`
QUOTA=`openstack quota show $OS_PROJECT_NAME -f json | jq -r '.["secgroup-rules"]'`
for ((i=CREATED; i<=QUOTA; i++)); do
   PORT=`printf "%04d" $i`
   openstack security group rule create --ingress --protocol tcp --dst-port 5$PORT:5$PORT $SG
done
openstack security group create --project $OS_PROJECT_NAME sec_group_with_excess_rules


Actual results:

Security group "sec_group_with_excess_rules" created successfully


Expected results:

Security group creation should fail with the error that quota for "security_group_rules" exceed


Additional info:

Looks similar to https://bugs.launchpad.net/heat/+bug/1403092
Comment 6 Lon Hohberger 2020-02-26 12:15:52 UTC 
According to our records, this should be resolved by openstack-neutron-15.0.1-0.20191129040411.998d93b.el8ost.  This build is available now.