CVE-2019-9735: OpenStack Neutron's unsupported dport option prevents applying security groups

The vulnerability stems from improper validation of protocol-port compatibility when generating iptables rules. The primary issue lies in the iptables driver's rule construction logic (_build_rule), which appended '--dport' without verifying protocol support (e.g., VRRP). The secondary issue is in the security group processing layer (_process_security_group_rule), which did not filter invalid rules before passing them to the firewall driver. Patches addressed these by adding protocol-specific checks and omitting '--dport' where unsupported. The high confidence for _build_rule is based on direct linkage to iptables command generation, while _process_security_group_rule is marked medium due to indirect involvement in validation.