From c800b240d47558a6d50d54915324c2474853a5a0 Mon Sep 17 00:00:00 2001
From: Yousong Zhou <zhouyousong@yunionyun.com>
Date: Thu, 15 Apr 2021 15:56:22 +0800
Subject: [PATCH] vpcagent: ovn: fix port match condition formation

---
 pkg/vpcagent/ovn/secgrouprules_acl.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkg/vpcagent/ovn/secgrouprules_acl.go b/pkg/vpcagent/ovn/secgrouprules_acl.go
index d75348312a..9875a914e9 100644
--- a/pkg/vpcagent/ovn/secgrouprules_acl.go
+++ b/pkg/vpcagent/ovn/secgrouprules_acl.go
@@ -121,7 +121,11 @@ func ruleToAcl(lport string, rule *agentmodels.SecurityGroupRule) (*ovn_nb.ACL,
 
 		matches = append(matches, l4proto)
 		if len(portMatches) > 0 {
-			matches = append(matches, strings.Join(portMatches, " || "))
+			portMatch := strings.Join(portMatches, " || ")
+			if len(portMatches) > 1 {
+				portMatch = "( " + portMatch + " )"
+			}
+			matches = append(matches, portMatch)
 		}
 	}
 	switch rule.Protocol {