)]}'
{"playbooks/roles/iptables/templates/rules.v4.j2":[{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"14e603407e106c8ae7948955eb3f40cab7e0e13a","unresolved":false,"context_lines":[{"line_number":26,"context_line":"{% endfor -%}"},{"line_number":27,"context_line":"{% for rule in iptables_egress_rules_v4 -%}"},{"line_number":28,"context_line":"-A openstack-OUTPUT {{ rule }}"},{"line_number":29,"context_line":"{% endfor -%}"},{"line_number":30,"context_line":"{% for host in iptables_allowed_hosts -%}"},{"line_number":31,"context_line":"{% for addr in host.hostname | dns_a -%}"},{"line_number":32,"context_line":"-A openstack-INPUT {% if host.protocol \u003d\u003d \u0027tcp\u0027 %}-m state --state NEW {% endif %} -m {{ host.protocol }} -p {{ host.protocol }} -s {{ addr }} --dport {{ host.port }} -j ACCEPT"}],"source_content_type":"text/x-jinja2","patch_set":8,"id":"6f053e77_a253b206","line":29,"updated":"2021-12-09 17:26:32.000000000","message":"Happy to move them if you prefer. I tried to group host-specific rules for both chains together, but if this is confusing I have no problem changing it.","commit_id":"079f89f9d8c00be3d304624ee06a24b088889f91"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"9b9676d829795d3e33b42b229366f763031c9ecb","unresolved":true,"context_lines":[{"line_number":26,"context_line":"{% endfor -%}"},{"line_number":27,"context_line":"{% for rule in iptables_egress_rules_v4 -%}"},{"line_number":28,"context_line":"-A openstack-OUTPUT {{ rule }}"},{"line_number":29,"context_line":"{% endfor -%}"},{"line_number":30,"context_line":"{% for host in iptables_allowed_hosts -%}"},{"line_number":31,"context_line":"{% for addr in host.hostname | dns_a -%}"},{"line_number":32,"context_line":"-A openstack-INPUT {% if host.protocol \u003d\u003d \u0027tcp\u0027 %}-m state --state NEW {% endif %} -m {{ host.protocol }} -p {{ host.protocol }} -s {{ addr }} --dport {{ host.port }} -j ACCEPT"}],"source_content_type":"text/x-jinja2","patch_set":8,"id":"7a8e4824_ecb76477","line":29,"updated":"2021-12-09 17:21:57.000000000","message":"Should we put the openstack-OUTPUT rules below the openstack-INPUT rules to avoid confusion when reading the raw ruleset? Currently these will go in the middle and might make it difficult to read the raw info. iptables itself shouldn\u0027t care.","commit_id":"079f89f9d8c00be3d304624ee06a24b088889f91"}],"playbooks/roles/iptables/templates/rules.v6.j2":[{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"9b9676d829795d3e33b42b229366f763031c9ecb","unresolved":true,"context_lines":[{"line_number":25,"context_line":"{% endfor -%}"},{"line_number":26,"context_line":"{% for rule in iptables_egress_rules_v6 -%}"},{"line_number":27,"context_line":"-A openstack-OUTPUT {{ rule }}"},{"line_number":28,"context_line":"{% endfor -%}"},{"line_number":29,"context_line":"{% for host in iptables_allowed_hosts -%}"},{"line_number":30,"context_line":"{% for addr in host.hostname | dns_aaaa -%}"},{"line_number":31,"context_line":"-A openstack-INPUT {% if host.protocol \u003d\u003d \u0027tcp\u0027 %}-m state --state NEW {% endif %}-m {{ host.protocol }} -p {{ host.protocol }} -s {{ addr }} --dport {{ host.port }} -j ACCEPT"}],"source_content_type":"text/x-jinja2","patch_set":8,"id":"49b27c99_7a5c1a25","line":28,"updated":"2021-12-09 17:21:57.000000000","message":"See question on the ipv4 rules.","commit_id":"079f89f9d8c00be3d304624ee06a24b088889f91"}],"testinfra/util.py":[{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"14e603407e106c8ae7948955eb3f40cab7e0e13a","unresolved":false,"context_lines":[{"line_number":89,"context_line":"def verify_iptables(host):"},{"line_number":90,"context_line":"    rules \u003d host.iptables.rules()"},{"line_number":91,"context_line":"    rules \u003d [x.strip() for x in rules]"},{"line_number":92,"context_line":"    print(\u0027Comparing against rules:\\n%s\u0027 % rules)"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    needed_rules \u003d ["},{"line_number":95,"context_line":"        \u0027-P INPUT ACCEPT\u0027,"}],"source_content_type":"text/x-python","patch_set":8,"id":"2fd37cf0_8b56cd4e","line":92,"updated":"2021-12-09 17:26:32.000000000","message":"Ahh, yes I could have removed it. The underlying issue was that the assert itself truncates the comparison, making it impossible to determine what was actually there in order to adjust the match accordingly. I see benefit to leaving it in, but please check the log for yourself to determine if it seems like too much verbosity.","commit_id":"079f89f9d8c00be3d304624ee06a24b088889f91"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"9b9676d829795d3e33b42b229366f763031c9ecb","unresolved":true,"context_lines":[{"line_number":89,"context_line":"def verify_iptables(host):"},{"line_number":90,"context_line":"    rules \u003d host.iptables.rules()"},{"line_number":91,"context_line":"    rules \u003d [x.strip() for x in rules]"},{"line_number":92,"context_line":"    print(\u0027Comparing against rules:\\n%s\u0027 % rules)"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    needed_rules \u003d ["},{"line_number":95,"context_line":"        \u0027-P INPUT ACCEPT\u0027,"}],"source_content_type":"text/x-python","patch_set":8,"id":"df85acf6_e6584132","line":92,"updated":"2021-12-09 17:21:57.000000000","message":"This was for debugging. I\u0027m happy to keep them in place but does this make the logs super verbose?","commit_id":"079f89f9d8c00be3d304624ee06a24b088889f91"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"704820a6385f8b6fa81cd5b4d7037e45c3172066","unresolved":false,"context_lines":[{"line_number":89,"context_line":"def verify_iptables(host):"},{"line_number":90,"context_line":"    rules \u003d host.iptables.rules()"},{"line_number":91,"context_line":"    rules \u003d [x.strip() for x in rules]"},{"line_number":92,"context_line":"    print(\u0027Comparing against rules:\\n%s\u0027 % rules)"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    needed_rules \u003d ["},{"line_number":95,"context_line":"        \u0027-P INPUT ACCEPT\u0027,"}],"source_content_type":"text/x-python","patch_set":8,"id":"21a6577c_ce0830f2","line":92,"in_reply_to":"2fd37cf0_8b56cd4e","updated":"2021-12-09 19:12:17.000000000","message":"I\u0027ve double checked the pytest output and it seems printed values are only included if that test fails. For this reason I think having this in place is fine (and helpful!)","commit_id":"079f89f9d8c00be3d304624ee06a24b088889f91"}]}