Created attachment 1249013 [details]
openflow_rule

Description of problem:
Apply both allow-to and allow-from policies to a single project, it will make the pods in the project accept all the traffics.

Version-Release number of selected component (if applicable):
oc v3.5.0.18+9a5d1aa
kubernetes v1.5.2+43a9be4
ovs 2.5.0

How reproducible:
always

Steps to Reproduce:
1. Setup multinode env with openshift-ovs-networkpolicy plugin

2. Create two projects with pod

3. Add the annotation to project 1
# oc annotate namespace u1p1 net.beta.kubernetes.io/network-policy='{"ingress":{"isolation":"DefaultDeny"}}'

4. Apply the allow-to and allow-from policy to the project separately.
# oc get networkpolicy -n u1p1 -o yaml
apiVersion: v1
items:
- apiVersion: extensions/v1beta1 
  kind: NetworkPolicy
  metadata:
    creationTimestamp: 2017-02-10T10:08:06Z
    generation: 1
    name: allow-from-red
    namespace: u1p1
    resourceVersion: "22126"
    selfLink: /apis/extensions/v1beta1/namespaces/u1p1/networkpolicies/allow-from-red
    uid: d1602670-ef78-11e6-b7b7-525400dd3698
  spec:
    ingress:
    - from:
      - podSelector:
          matchLabels:
            type: red
    podSelector: {}
- apiVersion: extensions/v1beta1
  kind: NetworkPolicy
  metadata:
    creationTimestamp: 2017-02-10T10:08:01Z
    generation: 1
    name: allow-to-blue
    namespace: u1p1
    resourceVersion: "22123"
    selfLink: /apis/extensions/v1beta1/namespaces/u1p1/networkpolicies/allow-to-blue
    uid: ce14914f-ef78-11e6-b7b7-525400dd3698
  spec:
    ingress:
    - {}
    podSelector:
      matchLabels:
        type: blue
kind: List
metadata: {}
resourceVersion: ""
selfLink: ""

5. Try to access any pod in the project from inside or outside the project


Actual results:
5. All can access.

Expected results: 
Only the pod with label type=red can be accessed via pod inside the project and pod with label type=blue can be accessed globally.

Additional info:
Full openflow rules attached.