Direct Routed networks: let VM deploys with security groups target L3 networks

Deploying an Instance with securitygroupids into an L3 (Direct Routed)
network failed with

  'Can't create vm with security groups; security group feature is not
   enabled per zone'

The message is misleading: the zone flag is only the first half of the
gate. checkSecurityGroupSupportForNetwork() also accepts a deploy when
one of the requested networks itself supports the SecurityGroup service
- but that check compared the guest type against Shared only, so an L3
network carrying the SecurityGroup service (as DefaultL3NetworkOffering
does) never qualified and the deploy fell through to the error.

Accept GuestType.L3 alongside Shared. Every other security group
touchpoint already treats L3 like Shared (offering validation, the
secondary-IP paths, the security_group.py dispatch); this deploy-time
gate was the one spot left behind. The zone-level securitygroupenabled
flag stays untouched - it selects the legacy shared-only zone mode,
which forbids public IP ranges and is exactly what a direct routed zone
must not be.

Author: wido

server/src/main/java/com/cloud/network/NetworkModelImpl.java

@@ -3097,7 +3097,8 @@ public boolean checkSecurityGroupSupportForNetwork(Account account, DataCenter z
                 if (network == null) {
                     throw new InvalidParameterValueException("Unable to find network by id " + networkId);
                 }
-                if (network.getGuestType() == Network.GuestType.Shared && isSecurityGroupSupportedInNetwork(network)) {
+                if ((network.getGuestType() == Network.GuestType.Shared || network.getGuestType() == Network.GuestType.L3)
+                        && isSecurityGroupSupportedInNetwork(network)) {
                     return true;
                 }
             }

server/src/test/java/com/cloud/network/NetworkModelImplTest.java

@@ -452,4 +452,35 @@ public void listSupportedNetworkServiceProvidersExcludesExtensionBackedProviders
         Mockito.verify(physicalNetworkServiceProviderDao, Mockito.times(1)).listAll();
         Mockito.verify(physicalNetworkServiceProviderDao, Mockito.never()).listBy(Mockito.anyLong());
     }
+
+    private boolean checkSecurityGroupSupportFor(Network.GuestType guestType, boolean sgSupportedInNetwork) {
+        DataCenter zone = mock(DataCenter.class);
+        when(zone.isSecurityGroupEnabled()).thenReturn(false);
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getGuestType()).thenReturn(guestType);
+        when(_networksDao.findById(42L)).thenReturn(network);
+        doReturn(sgSupportedInNetwork).when(networkModel).isSecurityGroupSupportedInNetwork(network);
+        return networkModel.checkSecurityGroupSupportForNetwork(mock(com.cloud.user.Account.class), zone, List.of(42L), null);
+    }
+
+    @Test
+    public void checkSecurityGroupSupportForNetworkAcceptsSharedNetworkWithSecurityGroupService() {
+        assertTrue(checkSecurityGroupSupportFor(Network.GuestType.Shared, true));
+    }
+
+    /**
+     * Regression: deploying with securitygroupids into an L3 (Direct Routed) network failed with
+     * "security group feature is not enabled per zone" because the guest-type check accepted
+     * only Shared, while L3 offerings carry the SecurityGroup service per network.
+     */
+    @Test
+    public void checkSecurityGroupSupportForNetworkAcceptsL3NetworkWithSecurityGroupService() {
+        assertTrue(checkSecurityGroupSupportFor(Network.GuestType.L3, true));
+    }
+
+    @Test
+    public void checkSecurityGroupSupportForNetworkRejectsNetworkWithoutSecurityGroupService() {
+        assertFalse(checkSecurityGroupSupportFor(Network.GuestType.L3, false));
+        assertFalse(checkSecurityGroupSupportFor(Network.GuestType.Isolated, true));
+    }
 }