'Create security group.
If default_sg is true that means we are a default security group for
a given tenant if it does not exist.'

@db_api.retry_if_session_inactive()
def create_security_group(self, context, security_group, default_sg=False):

    s = security_group['security_group']
    kwargs = {'context': context, 'security_group': s, 'is_default': default_sg}
    self._registry_notify(resources.SECURITY_GROUP, events.BEFORE_CREATE, exc_cls=ext_sg.SecurityGroupConflict, **kwargs)
    tenant_id = s['tenant_id']
    if (not default_sg):
        self._ensure_default_security_group(context, tenant_id)
    else:
        existing_def_sg_id = self._get_default_sg_id(context, tenant_id)
        if (existing_def_sg_id is not None):
            return self.get_security_group(context, existing_def_sg_id)
    with db_api.context_manager.writer.using(context):
        sg = sg_obj.SecurityGroup(context, id=(s.get('id') or uuidutils.generate_uuid()), description=s['description'], project_id=tenant_id, name=s['name'], is_default=default_sg)
        sg.create()
        for ethertype in ext_sg.sg_supported_ethertypes:
            if default_sg:
                ingress_rule = sg_obj.SecurityGroupRule(context, id=uuidutils.generate_uuid(), project_id=tenant_id, security_group_id=sg.id, direction='ingress', ethertype=ethertype, remote_group_id=sg.id)
                ingress_rule.create()
                sg.rules.append(ingress_rule)
            egress_rule = sg_obj.SecurityGroupRule(context, id=uuidutils.generate_uuid(), project_id=tenant_id, security_group_id=sg.id, direction='egress', ethertype=ethertype)
            egress_rule.create()
            sg.rules.append(egress_rule)
        sg.obj_reset_changes(['rules'])
        context.session.expunge_all()
        sg = sg_obj.SecurityGroup.get_object(context, id=sg.id)
        secgroup_dict = self._make_security_group_dict(sg)
        kwargs['security_group'] = secgroup_dict
        self._registry_notify(resources.SECURITY_GROUP, events.PRECOMMIT_CREATE, exc_cls=ext_sg.SecurityGroupConflict, **kwargs)
    registry.notify(resources.SECURITY_GROUP, events.AFTER_CREATE, self, **kwargs)
    return secgroup_dict
