Description of problem:

New security groups with two default rules can be created successfully if the security group rule quota is exceeded.


How reproducible:

OS_PROJECT_NAME=admin
CREATED=`openstack security group list --project $OS_PROJECT_NAME -f json | jq -r '.[] | .ID' | xargs -I {} openstack security group rule list {} -f value | wc -l`
let "CREATED +=1"
SG=`openstack security group list --project $OS_PROJECT_NAME -f json | jq -r '.[0] | .ID'`
QUOTA=`openstack quota show $OS_PROJECT_NAME -f json | jq -r '.["secgroup-rules"]'`
for ((i=CREATED; i<=QUOTA; i++)); do
   PORT=`printf "%04d" $i`
   openstack security group rule create --ingress --protocol tcp --dst-port 5$PORT:5$PORT $SG
done
openstack security group create --project $OS_PROJECT_NAME sec_group_with_excess_rules


Actual results:

Security group "sec_group_with_excess_rules" created successfully


Expected results:

Security group creation should fail with the error that quota for "security_group_rules" exceed


Additional info:

Looks similar to https://bugs.launchpad.net/heat/+bug/1403092