)]}'
{"doc/source/specs/allowed_address_pairs.rst":[{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"2ff6b77aa012407e33fd745d4a553ff0fe069a52","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode\r"},{"line_number":6,"context_line":"\r"},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\r"},{"line_number":8,"context_line":"Allowed address pairs \r"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\r"},{"line_number":10,"context_line":"\r"},{"line_number":11,"context_line":"https://blueprints.launchpad.net/dragonflow/+spec/allowed-address-pairs\r"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_d84dca73","line":8,"range":{"start_line":8,"start_character":21,"end_line":8,"end_character":22},"updated":"2016-05-30 13:15:07.000000000","message":"Please remove all the trialing white spaces","commit_id":"3d74871b109b19afa0da8adb54744f292432fcf7"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"9d626107260aa066ac5ac51b0430c8887d51bb94","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode\r"},{"line_number":6,"context_line":"\r"},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\r"},{"line_number":8,"context_line":"Allowed address pairs \r"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\r"},{"line_number":10,"context_line":"\r"},{"line_number":11,"context_line":"https://blueprints.launchpad.net/dragonflow/+spec/allowed-address-pairs\r"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_384e7f96","line":8,"range":{"start_line":8,"start_character":21,"end_line":8,"end_character":22},"in_reply_to":"9abb7d3a_d84dca73","updated":"2016-05-31 02:51:43.000000000","message":"Done","commit_id":"3d74871b109b19afa0da8adb54744f292432fcf7"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"2ff6b77aa012407e33fd745d4a553ff0fe069a52","unresolved":false,"context_lines":[{"line_number":58,"context_line":"address pairs. In L2/L3 Lookup table, we could simply send the packets of \r"},{"line_number":59,"context_line":"which dstination address are this address to all VM ports which have this \r"},{"line_number":60,"context_line":"address in their allowed address pairs field, or we could only send those \r"},{"line_number":61,"context_line":"packets to the VM port of which this address is active (VRRP master router). \r"},{"line_number":62,"context_line":"The later may be a better choice, only if we could know which VM port is the \r"},{"line_number":63,"context_line":"active one.\r"},{"line_number":64,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_389216a0","line":61,"range":{"start_line":61,"start_character":9,"end_line":61,"end_character":55},"updated":"2016-05-30 13:15:07.000000000","message":"How can we know which one is the active one ? it can run inside a VM with no connection to the infrastructure","commit_id":"3d74871b109b19afa0da8adb54744f292432fcf7"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"9d626107260aa066ac5ac51b0430c8887d51bb94","unresolved":false,"context_lines":[{"line_number":58,"context_line":"address pairs. In L2/L3 Lookup table, we could simply send the packets of \r"},{"line_number":59,"context_line":"which dstination address are this address to all VM ports which have this \r"},{"line_number":60,"context_line":"address in their allowed address pairs field, or we could only send those \r"},{"line_number":61,"context_line":"packets to the VM port of which this address is active (VRRP master router). \r"},{"line_number":62,"context_line":"The later may be a better choice, only if we could know which VM port is the \r"},{"line_number":63,"context_line":"active one.\r"},{"line_number":64,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_783f67d6","line":61,"range":{"start_line":61,"start_character":9,"end_line":61,"end_character":55},"in_reply_to":"9abb7d3a_389216a0","updated":"2016-05-31 02:51:43.000000000","message":"Maybe we could use some ways to detect the master","commit_id":"3d74871b109b19afa0da8adb54744f292432fcf7"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"dd3dfe004d5f33eff9203ba328b7b162b58d9ae4","unresolved":false,"context_lines":[{"line_number":56,"context_line":"As a tenant may configured for the use of VRRP, one or more VM ports could\r"},{"line_number":57,"context_line":"share a same ip address (and a same mac address in some scenes) in allowed\r"},{"line_number":58,"context_line":"address pairs. In L2/L3 Lookup table, we could simply send the packets of\r"},{"line_number":59,"context_line":"which dstination address are this address to all VM ports which have this\r"},{"line_number":60,"context_line":"address in their allowed address pairs field, or we could only send those\r"},{"line_number":61,"context_line":"packets to the VM port of which this address is active (VRRP master router).\r"},{"line_number":62,"context_line":"The later may be a better choice, only if we could know which VM port is the\r"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_7e72afae","line":59,"range":{"start_line":59,"start_character":6,"end_line":59,"end_character":16},"updated":"2016-05-31 03:30:36.000000000","message":"destination","commit_id":"f2c6575d90e82bbaa1adbb47731a3815a32e0dd1"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"dd3dfe004d5f33eff9203ba328b7b162b58d9ae4","unresolved":false,"context_lines":[{"line_number":56,"context_line":"As a tenant may configured for the use of VRRP, one or more VM ports could\r"},{"line_number":57,"context_line":"share a same ip address (and a same mac address in some scenes) in allowed\r"},{"line_number":58,"context_line":"address pairs. In L2/L3 Lookup table, we could simply send the packets of\r"},{"line_number":59,"context_line":"which dstination address are this address to all VM ports which have this\r"},{"line_number":60,"context_line":"address in their allowed address pairs field, or we could only send those\r"},{"line_number":61,"context_line":"packets to the VM port of which this address is active (VRRP master router).\r"},{"line_number":62,"context_line":"The later may be a better choice, only if we could know which VM port is the\r"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_3e9f87b5","line":59,"range":{"start_line":59,"start_character":25,"end_line":59,"end_character":28},"updated":"2016-05-31 03:30:36.000000000","message":"is","commit_id":"f2c6575d90e82bbaa1adbb47731a3815a32e0dd1"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"75f888a43219a5a6eacab76f4607af10e3d2fda5","unresolved":false,"context_lines":[{"line_number":56,"context_line":"As a tenant may configured for the use of VRRP, one or more VM ports could\r"},{"line_number":57,"context_line":"share a same ip address (and a same mac address in some scenes) in allowed\r"},{"line_number":58,"context_line":"address pairs. In L2/L3 Lookup table, we could simply send the packets of\r"},{"line_number":59,"context_line":"which dstination address are this address to all VM ports which have this\r"},{"line_number":60,"context_line":"address in their allowed address pairs field, or we could only send those\r"},{"line_number":61,"context_line":"packets to the VM port of which this address is active (VRRP master router).\r"},{"line_number":62,"context_line":"The later may be a better choice, only if we could know which VM port is the\r"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_fe1cdfc2","line":59,"range":{"start_line":59,"start_character":25,"end_line":59,"end_character":28},"in_reply_to":"9abb7d3a_3e9f87b5","updated":"2016-05-31 03:45:18.000000000","message":"Done","commit_id":"f2c6575d90e82bbaa1adbb47731a3815a32e0dd1"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"75f888a43219a5a6eacab76f4607af10e3d2fda5","unresolved":false,"context_lines":[{"line_number":56,"context_line":"As a tenant may configured for the use of VRRP, one or more VM ports could\r"},{"line_number":57,"context_line":"share a same ip address (and a same mac address in some scenes) in allowed\r"},{"line_number":58,"context_line":"address pairs. In L2/L3 Lookup table, we could simply send the packets of\r"},{"line_number":59,"context_line":"which dstination address are this address to all VM ports which have this\r"},{"line_number":60,"context_line":"address in their allowed address pairs field, or we could only send those\r"},{"line_number":61,"context_line":"packets to the VM port of which this address is active (VRRP master router).\r"},{"line_number":62,"context_line":"The later may be a better choice, only if we could know which VM port is the\r"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_5e7a4bf2","line":59,"range":{"start_line":59,"start_character":6,"end_line":59,"end_character":16},"in_reply_to":"9abb7d3a_7e72afae","updated":"2016-05-31 03:45:18.000000000","message":"Done","commit_id":"f2c6575d90e82bbaa1adbb47731a3815a32e0dd1"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"dd3dfe004d5f33eff9203ba328b7b162b58d9ae4","unresolved":false,"context_lines":[{"line_number":57,"context_line":"share a same ip address (and a same mac address in some scenes) in allowed\r"},{"line_number":58,"context_line":"address pairs. In L2/L3 Lookup table, we could simply send the packets of\r"},{"line_number":59,"context_line":"which dstination address are this address to all VM ports which have this\r"},{"line_number":60,"context_line":"address in their allowed address pairs field, or we could only send those\r"},{"line_number":61,"context_line":"packets to the VM port of which this address is active (VRRP master router).\r"},{"line_number":62,"context_line":"The later may be a better choice, only if we could know which VM port is the\r"},{"line_number":63,"context_line":"active one.\r"},{"line_number":64,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_5e5febe4","line":61,"range":{"start_line":60,"start_character":46,"end_line":61,"end_character":54},"updated":"2016-05-31 03:30:36.000000000","message":"How could df know the master node? If you have the plan on mind, please share it in the spec. In my opinion, the first method is clear.","commit_id":"f2c6575d90e82bbaa1adbb47731a3815a32e0dd1"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"dd3dfe004d5f33eff9203ba328b7b162b58d9ae4","unresolved":false,"context_lines":[{"line_number":66,"context_line":"---------------\r"},{"line_number":67,"context_line":"Because more than one VM ports\u0027 allowed address pairs could have a same ip\r"},{"line_number":68,"context_line":"address but different mac addresses, arp responder can hardly know which mac\r"},{"line_number":69,"context_line":"address should be reponsed to a arp request to this ip. We could simply\r"},{"line_number":70,"context_line":"continue to boardcast those arp requests rather than try to response them in\r"},{"line_number":71,"context_line":"arp table.\r"},{"line_number":72,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_5e836b56","line":69,"range":{"start_line":69,"start_character":30,"end_line":69,"end_character":32},"updated":"2016-05-31 03:30:36.000000000","message":"an","commit_id":"f2c6575d90e82bbaa1adbb47731a3815a32e0dd1"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"dd3dfe004d5f33eff9203ba328b7b162b58d9ae4","unresolved":false,"context_lines":[{"line_number":66,"context_line":"---------------\r"},{"line_number":67,"context_line":"Because more than one VM ports\u0027 allowed address pairs could have a same ip\r"},{"line_number":68,"context_line":"address but different mac addresses, arp responder can hardly know which mac\r"},{"line_number":69,"context_line":"address should be reponsed to a arp request to this ip. We could simply\r"},{"line_number":70,"context_line":"continue to boardcast those arp requests rather than try to response them in\r"},{"line_number":71,"context_line":"arp table.\r"},{"line_number":72,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_1ebba328","line":69,"range":{"start_line":69,"start_character":18,"end_line":69,"end_character":26},"updated":"2016-05-31 03:30:36.000000000","message":"responded","commit_id":"f2c6575d90e82bbaa1adbb47731a3815a32e0dd1"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"75f888a43219a5a6eacab76f4607af10e3d2fda5","unresolved":false,"context_lines":[{"line_number":66,"context_line":"---------------\r"},{"line_number":67,"context_line":"Because more than one VM ports\u0027 allowed address pairs could have a same ip\r"},{"line_number":68,"context_line":"address but different mac addresses, arp responder can hardly know which mac\r"},{"line_number":69,"context_line":"address should be reponsed to a arp request to this ip. We could simply\r"},{"line_number":70,"context_line":"continue to boardcast those arp requests rather than try to response them in\r"},{"line_number":71,"context_line":"arp table.\r"},{"line_number":72,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_3e7dc7e7","line":69,"range":{"start_line":69,"start_character":18,"end_line":69,"end_character":26},"in_reply_to":"9abb7d3a_1ebba328","updated":"2016-05-31 03:45:18.000000000","message":"Done","commit_id":"f2c6575d90e82bbaa1adbb47731a3815a32e0dd1"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"75f888a43219a5a6eacab76f4607af10e3d2fda5","unresolved":false,"context_lines":[{"line_number":66,"context_line":"---------------\r"},{"line_number":67,"context_line":"Because more than one VM ports\u0027 allowed address pairs could have a same ip\r"},{"line_number":68,"context_line":"address but different mac addresses, arp responder can hardly know which mac\r"},{"line_number":69,"context_line":"address should be reponsed to a arp request to this ip. We could simply\r"},{"line_number":70,"context_line":"continue to boardcast those arp requests rather than try to response them in\r"},{"line_number":71,"context_line":"arp table.\r"},{"line_number":72,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_9e84b3d4","line":69,"range":{"start_line":69,"start_character":30,"end_line":69,"end_character":32},"in_reply_to":"9abb7d3a_5e836b56","updated":"2016-05-31 03:45:18.000000000","message":"Done","commit_id":"f2c6575d90e82bbaa1adbb47731a3815a32e0dd1"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"8f8192407a735b2bb8b6299be2c670e4547f6f27","unresolved":false,"context_lines":[{"line_number":15,"context_line":"\r"},{"line_number":16,"context_line":"Problem Description\r"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\r"},{"line_number":18,"context_line":"Allowed address pairs feature allows one to add additional ip/mac address\r"},{"line_number":19,"context_line":"pairs on a port to allow traffic that matches those specified values.\r"},{"line_number":20,"context_line":"\r"},{"line_number":21,"context_line":"In Neutron original implement, ip address in allowed address pairs could be\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_85c9e428","line":18,"range":{"start_line":18,"start_character":59,"end_line":18,"end_character":65},"updated":"2016-05-31 14:14:41.000000000","message":"In a document (as opposed to code) IP and MAC should be all caps because they are acronyms.","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":15,"context_line":"\r"},{"line_number":16,"context_line":"Problem Description\r"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\r"},{"line_number":18,"context_line":"Allowed address pairs feature allows one to add additional ip/mac address\r"},{"line_number":19,"context_line":"pairs on a port to allow traffic that matches those specified values.\r"},{"line_number":20,"context_line":"\r"},{"line_number":21,"context_line":"In Neutron original implement, ip address in allowed address pairs could be\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_d91bb071","line":18,"range":{"start_line":18,"start_character":59,"end_line":18,"end_character":65},"in_reply_to":"9abb7d3a_85c9e428","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Allowed address pairs feature allows one to add additional ip/mac address\r"},{"line_number":19,"context_line":"pairs on a port to allow traffic that matches those specified values.\r"},{"line_number":20,"context_line":"\r"},{"line_number":21,"context_line":"In Neutron original implement, ip address in allowed address pairs could be\r"},{"line_number":22,"context_line":"a prefix, and this ip address prefix may even not in the subnet of this port\u0027s\r"},{"line_number":23,"context_line":"fixed ip. This wide tolerance will great increase efforts to support allowed\r"},{"line_number":24,"context_line":"address pairs, and we don\u0027t see any requirement for now to using it. So in\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_9e077c17","line":21,"updated":"2016-05-31 11:50:07.000000000","message":"Neutron reference implementation","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Allowed address pairs feature allows one to add additional ip/mac address\r"},{"line_number":19,"context_line":"pairs on a port to allow traffic that matches those specified values.\r"},{"line_number":20,"context_line":"\r"},{"line_number":21,"context_line":"In Neutron original implement, ip address in allowed address pairs could be\r"},{"line_number":22,"context_line":"a prefix, and this ip address prefix may even not in the subnet of this port\u0027s\r"},{"line_number":23,"context_line":"fixed ip. This wide tolerance will great increase efforts to support allowed\r"},{"line_number":24,"context_line":"address pairs, and we don\u0027t see any requirement for now to using it. So in\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_996ac8b1","line":21,"in_reply_to":"9abb7d3a_9e077c17","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":19,"context_line":"pairs on a port to allow traffic that matches those specified values.\r"},{"line_number":20,"context_line":"\r"},{"line_number":21,"context_line":"In Neutron original implement, ip address in allowed address pairs could be\r"},{"line_number":22,"context_line":"a prefix, and this ip address prefix may even not in the subnet of this port\u0027s\r"},{"line_number":23,"context_line":"fixed ip. This wide tolerance will great increase efforts to support allowed\r"},{"line_number":24,"context_line":"address pairs, and we don\u0027t see any requirement for now to using it. So in\r"},{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_1e4a6c55","line":22,"updated":"2016-05-31 11:50:07.000000000","message":"\"this ip address prefix may even not in the subnet\" \u003d\u003e the IP prefix might not be in the port\u0027s fixed ip subnet","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":19,"context_line":"pairs on a port to allow traffic that matches those specified values.\r"},{"line_number":20,"context_line":"\r"},{"line_number":21,"context_line":"In Neutron original implement, ip address in allowed address pairs could be\r"},{"line_number":22,"context_line":"a prefix, and this ip address prefix may even not in the subnet of this port\u0027s\r"},{"line_number":23,"context_line":"fixed ip. This wide tolerance will great increase efforts to support allowed\r"},{"line_number":24,"context_line":"address pairs, and we don\u0027t see any requirement for now to using it. So in\r"},{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_99c64898","line":22,"in_reply_to":"9abb7d3a_1e4a6c55","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\r"},{"line_number":21,"context_line":"In Neutron original implement, ip address in allowed address pairs could be\r"},{"line_number":22,"context_line":"a prefix, and this ip address prefix may even not in the subnet of this port\u0027s\r"},{"line_number":23,"context_line":"fixed ip. This wide tolerance will great increase efforts to support allowed\r"},{"line_number":24,"context_line":"address pairs, and we don\u0027t see any requirement for now to using it. So in\r"},{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"},{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_1e338cf7","line":23,"updated":"2016-05-31 11:50:07.000000000","message":"greatly","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\r"},{"line_number":21,"context_line":"In Neutron original implement, ip address in allowed address pairs could be\r"},{"line_number":22,"context_line":"a prefix, and this ip address prefix may even not in the subnet of this port\u0027s\r"},{"line_number":23,"context_line":"fixed ip. This wide tolerance will great increase efforts to support allowed\r"},{"line_number":24,"context_line":"address pairs, and we don\u0027t see any requirement for now to using it. So in\r"},{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"},{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_79c3a489","line":23,"in_reply_to":"9abb7d3a_1e338cf7","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"8f8192407a735b2bb8b6299be2c670e4547f6f27","unresolved":false,"context_lines":[{"line_number":21,"context_line":"In Neutron original implement, ip address in allowed address pairs could be\r"},{"line_number":22,"context_line":"a prefix, and this ip address prefix may even not in the subnet of this port\u0027s\r"},{"line_number":23,"context_line":"fixed ip. This wide tolerance will great increase efforts to support allowed\r"},{"line_number":24,"context_line":"address pairs, and we don\u0027t see any requirement for now to using it. So in\r"},{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"},{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"},{"line_number":27,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_05285499","line":24,"updated":"2016-05-31 14:14:41.000000000","message":"If the complexity impacts performance then port security may need to be disabled for router-type VNFs, but if it were possible to provide port security for router-type VNFs then allowing prefixes for allowed addresses would be mandatory.","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":23,"context_line":"fixed ip. This wide tolerance will great increase efforts to support allowed\r"},{"line_number":24,"context_line":"address pairs, and we don\u0027t see any requirement for now to using it. So in\r"},{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"},{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"},{"line_number":27,"context_line":"\r"},{"line_number":28,"context_line":"In current implement, security module like port security and security group\r"},{"line_number":29,"context_line":"will restrict packets sent/received from a VM port must have the fixed ip/mac\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_5eeb5413","line":26,"updated":"2016-05-31 11:50:07.000000000","message":"I really dont see why is matching on the prefix is really complicated, its just security flows that need to be added but i am ok with this first step if you think its needed","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":23,"context_line":"fixed ip. This wide tolerance will great increase efforts to support allowed\r"},{"line_number":24,"context_line":"address pairs, and we don\u0027t see any requirement for now to using it. So in\r"},{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"},{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"},{"line_number":27,"context_line":"\r"},{"line_number":28,"context_line":"In current implement, security module like port security and security group\r"},{"line_number":29,"context_line":"will restrict packets sent/received from a VM port must have the fixed ip/mac\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_2a0ffc88","line":26,"in_reply_to":"9abb7d3a_5eeb5413","updated":"2016-06-01 07:59:28.000000000","message":"OK, matching on the prefix is not complicated if we don\u0027t want to detect the VRRP master router. but the limit of being in the same subnet is necessary, otherwise those packets couldn\u0027t pass through L3 lookup table in current implementation.","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"},{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"},{"line_number":27,"context_line":"\r"},{"line_number":28,"context_line":"In current implement, security module like port security and security group\r"},{"line_number":29,"context_line":"will restrict packets sent/received from a VM port must have the fixed ip/mac\r"},{"line_number":30,"context_line":"address of this VM port. Besides, L2 and L3 transmission will forward packets\r"},{"line_number":31,"context_line":"only according those fixed addresses. Those module should make some changes\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_7ef618fa","line":28,"updated":"2016-05-31 11:50:07.000000000","message":"implementation","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"8f8192407a735b2bb8b6299be2c670e4547f6f27","unresolved":false,"context_lines":[{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"},{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"},{"line_number":27,"context_line":"\r"},{"line_number":28,"context_line":"In current implement, security module like port security and security group\r"},{"line_number":29,"context_line":"will restrict packets sent/received from a VM port must have the fixed ip/mac\r"},{"line_number":30,"context_line":"address of this VM port. Besides, L2 and L3 transmission will forward packets\r"},{"line_number":31,"context_line":"only according those fixed addresses. Those module should make some changes\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_c0075a16","line":28,"range":{"start_line":28,"start_character":31,"end_line":28,"end_character":37},"updated":"2016-05-31 14:14:41.000000000","message":"module -\u003e modules","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"},{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"},{"line_number":27,"context_line":"\r"},{"line_number":28,"context_line":"In current implement, security module like port security and security group\r"},{"line_number":29,"context_line":"will restrict packets sent/received from a VM port must have the fixed ip/mac\r"},{"line_number":30,"context_line":"address of this VM port. Besides, L2 and L3 transmission will forward packets\r"},{"line_number":31,"context_line":"only according those fixed addresses. Those module should make some changes\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_99e928e9","line":28,"in_reply_to":"9abb7d3a_7ef618fa","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":25,"context_line":"dragonflow, we will only support allowed address pairs using ip addresses (not\r"},{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"},{"line_number":27,"context_line":"\r"},{"line_number":28,"context_line":"In current implement, security module like port security and security group\r"},{"line_number":29,"context_line":"will restrict packets sent/received from a VM port must have the fixed ip/mac\r"},{"line_number":30,"context_line":"address of this VM port. Besides, L2 and L3 transmission will forward packets\r"},{"line_number":31,"context_line":"only according those fixed addresses. Those module should make some changes\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_b9ececf3","line":28,"range":{"start_line":28,"start_character":31,"end_line":28,"end_character":37},"in_reply_to":"9abb7d3a_c0075a16","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"8f8192407a735b2bb8b6299be2c670e4547f6f27","unresolved":false,"context_lines":[{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"},{"line_number":27,"context_line":"\r"},{"line_number":28,"context_line":"In current implement, security module like port security and security group\r"},{"line_number":29,"context_line":"will restrict packets sent/received from a VM port must have the fixed ip/mac\r"},{"line_number":30,"context_line":"address of this VM port. Besides, L2 and L3 transmission will forward packets\r"},{"line_number":31,"context_line":"only according those fixed addresses. Those module should make some changes\r"},{"line_number":32,"context_line":"to support allowed address pairs.\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_c0559afa","line":29,"range":{"start_line":29,"start_character":5,"end_line":29,"end_character":13},"updated":"2016-05-31 14:14:41.000000000","message":"restrict -\u003e require that","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":26,"context_line":"ip address prefixes) in the same subnet of the port\u0027s fixed ip.\r"},{"line_number":27,"context_line":"\r"},{"line_number":28,"context_line":"In current implement, security module like port security and security group\r"},{"line_number":29,"context_line":"will restrict packets sent/received from a VM port must have the fixed ip/mac\r"},{"line_number":30,"context_line":"address of this VM port. Besides, L2 and L3 transmission will forward packets\r"},{"line_number":31,"context_line":"only according those fixed addresses. Those module should make some changes\r"},{"line_number":32,"context_line":"to support allowed address pairs.\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_f9a794ba","line":29,"range":{"start_line":29,"start_character":5,"end_line":29,"end_character":13},"in_reply_to":"9abb7d3a_c0559afa","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"8f8192407a735b2bb8b6299be2c670e4547f6f27","unresolved":false,"context_lines":[{"line_number":28,"context_line":"In current implement, security module like port security and security group\r"},{"line_number":29,"context_line":"will restrict packets sent/received from a VM port must have the fixed ip/mac\r"},{"line_number":30,"context_line":"address of this VM port. Besides, L2 and L3 transmission will forward packets\r"},{"line_number":31,"context_line":"only according those fixed addresses. Those module should make some changes\r"},{"line_number":32,"context_line":"to support allowed address pairs.\r"},{"line_number":33,"context_line":"\r"},{"line_number":34,"context_line":"Proposed Change\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_a07176aa","line":31,"range":{"start_line":31,"start_character":44,"end_line":31,"end_character":50},"updated":"2016-05-31 14:14:41.000000000","message":"module -\u003e modules","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":28,"context_line":"In current implement, security module like port security and security group\r"},{"line_number":29,"context_line":"will restrict packets sent/received from a VM port must have the fixed ip/mac\r"},{"line_number":30,"context_line":"address of this VM port. Besides, L2 and L3 transmission will forward packets\r"},{"line_number":31,"context_line":"only according those fixed addresses. Those module should make some changes\r"},{"line_number":32,"context_line":"to support allowed address pairs.\r"},{"line_number":33,"context_line":"\r"},{"line_number":34,"context_line":"Proposed Change\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_d9ef30e7","line":31,"range":{"start_line":31,"start_character":44,"end_line":31,"end_character":50},"in_reply_to":"9abb7d3a_a07176aa","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Proposed Change\r"},{"line_number":35,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\r"},{"line_number":36,"context_line":"A VM port could send or receive packets using the addresses configured in\r"},{"line_number":37,"context_line":"allowed address pairs. So, in some aspects, allowed address pairs play a role\r"},{"line_number":38,"context_line":"which is similar with fixed ip/mac address pair in a port, and functional\r"},{"line_number":39,"context_line":"modules should also handle them like fixed ip/mac address pair.\r"},{"line_number":40,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_feb96816","line":37,"updated":"2016-05-31 11:50:07.000000000","message":"remove \"So\"","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Proposed Change\r"},{"line_number":35,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\r"},{"line_number":36,"context_line":"A VM port could send or receive packets using the addresses configured in\r"},{"line_number":37,"context_line":"allowed address pairs. So, in some aspects, allowed address pairs play a role\r"},{"line_number":38,"context_line":"which is similar with fixed ip/mac address pair in a port, and functional\r"},{"line_number":39,"context_line":"modules should also handle them like fixed ip/mac address pair.\r"},{"line_number":40,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_d99d7067","line":37,"in_reply_to":"9abb7d3a_feb96816","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":36,"context_line":"A VM port could send or receive packets using the addresses configured in\r"},{"line_number":37,"context_line":"allowed address pairs. So, in some aspects, allowed address pairs play a role\r"},{"line_number":38,"context_line":"which is similar with fixed ip/mac address pair in a port, and functional\r"},{"line_number":39,"context_line":"modules should also handle them like fixed ip/mac address pair.\r"},{"line_number":40,"context_line":"\r"},{"line_number":41,"context_line":"Port Security\r"},{"line_number":42,"context_line":"----------------------\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_3e65b0b4","line":39,"updated":"2016-05-31 11:50:07.000000000","message":"what do you mean \"functional modules\" ? allowed address pairs in Neutron as far as i am aware is only for \"Port security\" concerns","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":36,"context_line":"A VM port could send or receive packets using the addresses configured in\r"},{"line_number":37,"context_line":"allowed address pairs. So, in some aspects, allowed address pairs play a role\r"},{"line_number":38,"context_line":"which is similar with fixed ip/mac address pair in a port, and functional\r"},{"line_number":39,"context_line":"modules should also handle them like fixed ip/mac address pair.\r"},{"line_number":40,"context_line":"\r"},{"line_number":41,"context_line":"Port Security\r"},{"line_number":42,"context_line":"----------------------\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_aa676cb5","line":39,"in_reply_to":"9abb7d3a_3e65b0b4","updated":"2016-06-01 07:59:28.000000000","message":"besides port security and security group, if L2/L3 lookup don\u0027t make some changes, the packets with a IP/MAC pair in allowed-address-pairs will be broadcast to all VM ports which is inefficient.","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":40,"context_line":"\r"},{"line_number":41,"context_line":"Port Security\r"},{"line_number":42,"context_line":"----------------------\r"},{"line_number":43,"context_line":"Port security should let not only packets with the fixed ip/mac address pair\r"},{"line_number":44,"context_line":"but also packets with address pairs configured in allowed address pairs field\r"},{"line_number":45,"context_line":"of a port. That is already done in the blueprint of mac-spoofing-protection.\r"},{"line_number":46,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_1ef0acc8","line":43,"updated":"2016-05-31 11:50:07.000000000","message":"Port security module should allow packets with ... AND also packets with..","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":40,"context_line":"\r"},{"line_number":41,"context_line":"Port Security\r"},{"line_number":42,"context_line":"----------------------\r"},{"line_number":43,"context_line":"Port security should let not only packets with the fixed ip/mac address pair\r"},{"line_number":44,"context_line":"but also packets with address pairs configured in allowed address pairs field\r"},{"line_number":45,"context_line":"of a port. That is already done in the blueprint of mac-spoofing-protection.\r"},{"line_number":46,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_79a2849a","line":43,"in_reply_to":"9abb7d3a_1ef0acc8","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"8f8192407a735b2bb8b6299be2c670e4547f6f27","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Security Group\r"},{"line_number":48,"context_line":"----------------------\r"},{"line_number":49,"context_line":"Security group module transform remote group field in a rule to flows\r"},{"line_number":50,"context_line":"according ip addresses of VM ports associating with this remote group.\r"},{"line_number":51,"context_line":"To support allowed address pairs, those IP addresses should include both\r"},{"line_number":52,"context_line":"fixed ip address and the ip addresses in allowed address pairs.\r"},{"line_number":53,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_40bd2a01","line":50,"range":{"start_line":50,"start_character":35,"end_line":50,"end_character":46},"updated":"2016-05-31 14:14:41.000000000","message":"associating -\u003e associated","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Security Group\r"},{"line_number":48,"context_line":"----------------------\r"},{"line_number":49,"context_line":"Security group module transform remote group field in a rule to flows\r"},{"line_number":50,"context_line":"according ip addresses of VM ports associating with this remote group.\r"},{"line_number":51,"context_line":"To support allowed address pairs, those IP addresses should include both\r"},{"line_number":52,"context_line":"fixed ip address and the ip addresses in allowed address pairs.\r"},{"line_number":53,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_9eb2dc04","line":50,"updated":"2016-05-31 11:50:07.000000000","message":"to","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Security Group\r"},{"line_number":48,"context_line":"----------------------\r"},{"line_number":49,"context_line":"Security group module transform remote group field in a rule to flows\r"},{"line_number":50,"context_line":"according ip addresses of VM ports associating with this remote group.\r"},{"line_number":51,"context_line":"To support allowed address pairs, those IP addresses should include both\r"},{"line_number":52,"context_line":"fixed ip address and the ip addresses in allowed address pairs.\r"},{"line_number":53,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_19dff80d","line":50,"range":{"start_line":50,"start_character":35,"end_line":50,"end_character":46},"in_reply_to":"9abb7d3a_40bd2a01","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Security Group\r"},{"line_number":48,"context_line":"----------------------\r"},{"line_number":49,"context_line":"Security group module transform remote group field in a rule to flows\r"},{"line_number":50,"context_line":"according ip addresses of VM ports associating with this remote group.\r"},{"line_number":51,"context_line":"To support allowed address pairs, those IP addresses should include both\r"},{"line_number":52,"context_line":"fixed ip address and the ip addresses in allowed address pairs.\r"},{"line_number":53,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_b9bfcca8","line":50,"in_reply_to":"9abb7d3a_9eb2dc04","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":49,"context_line":"Security group module transform remote group field in a rule to flows\r"},{"line_number":50,"context_line":"according ip addresses of VM ports associating with this remote group.\r"},{"line_number":51,"context_line":"To support allowed address pairs, those IP addresses should include both\r"},{"line_number":52,"context_line":"fixed ip address and the ip addresses in allowed address pairs.\r"},{"line_number":53,"context_line":"\r"},{"line_number":54,"context_line":"L2/L3 Lookup\r"},{"line_number":55,"context_line":"----------------------\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_9e801cf9","line":52,"updated":"2016-05-31 11:50:07.000000000","message":"Is this the behavior in Neutron? does allowed address pairs by-pass security group rules?","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":49,"context_line":"Security group module transform remote group field in a rule to flows\r"},{"line_number":50,"context_line":"according ip addresses of VM ports associating with this remote group.\r"},{"line_number":51,"context_line":"To support allowed address pairs, those IP addresses should include both\r"},{"line_number":52,"context_line":"fixed ip address and the ip addresses in allowed address pairs.\r"},{"line_number":53,"context_line":"\r"},{"line_number":54,"context_line":"L2/L3 Lookup\r"},{"line_number":55,"context_line":"----------------------\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_8c43a841","line":52,"in_reply_to":"9abb7d3a_9e801cf9","updated":"2016-06-01 07:59:28.000000000","message":"Yes, Neutron will put those IP addresses in allowed address pairs into the ipset group which is corresponding to the security group the VM port associated to.","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":56,"context_line":"As a tenant may configured for the use of VRRP, one or more VM ports could\r"},{"line_number":57,"context_line":"share a same ip address (and a same mac address in some scenes) in allowed\r"},{"line_number":58,"context_line":"address pairs. In L2/L3 Lookup table, we could simply send the packets of\r"},{"line_number":59,"context_line":"which destination address is this address to all VM ports which have this\r"},{"line_number":60,"context_line":"address in their allowed address pairs field, or we could only send those\r"},{"line_number":61,"context_line":"packets to the VM port of which this address is active (VRRP master router).\r"},{"line_number":62,"context_line":"The later may be a better choice, only if we could know which VM port is the\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_febfa8a7","line":59,"updated":"2016-05-31 11:50:07.000000000","message":"Not sure what you mean by VRRP, this is a use case that needs it own spec, you are talking about VMs that share the same IP on the same network if i understand correctly.\nHow Dragonflow will know which VM the traffic needs to go to?","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":56,"context_line":"As a tenant may configured for the use of VRRP, one or more VM ports could\r"},{"line_number":57,"context_line":"share a same ip address (and a same mac address in some scenes) in allowed\r"},{"line_number":58,"context_line":"address pairs. In L2/L3 Lookup table, we could simply send the packets of\r"},{"line_number":59,"context_line":"which destination address is this address to all VM ports which have this\r"},{"line_number":60,"context_line":"address in their allowed address pairs field, or we could only send those\r"},{"line_number":61,"context_line":"packets to the VM port of which this address is active (VRRP master router).\r"},{"line_number":62,"context_line":"The later may be a better choice, only if we could know which VM port is the\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_2a7ffc66","line":59,"in_reply_to":"9abb7d3a_febfa8a7","updated":"2016-06-01 07:59:28.000000000","message":"OK, I deleted those words about VRRP and the detecting of the active router, and I will implement this by sending packets to all ports which were configured this IP/MAC in allowed-address-pairs for the first step.","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"efe3f6faebd52563e4609cbe3215e598aa1ae3a4","unresolved":false,"context_lines":[{"line_number":64,"context_line":"\r"},{"line_number":65,"context_line":"Arp Responder\r"},{"line_number":66,"context_line":"---------------\r"},{"line_number":67,"context_line":"Because more than one VM ports\u0027 allowed address pairs could have a same ip\r"},{"line_number":68,"context_line":"address but different mac addresses, arp responder can hardly know which mac\r"},{"line_number":69,"context_line":"address should be responded to an arp request to this ip. We could simply\r"},{"line_number":70,"context_line":"continue to broadcast those arp requests rather than try to response them in\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_1e1f0cb8","line":67,"updated":"2016-05-31 11:50:07.000000000","message":"I dont understand how ARP responder is relevant here, allowed address pairs as i understand it are just for security measure, is this talking about the previous case with VRRP?\nI dont think this is a \"normal\" Neutron behavior and we need to better define and understand the requirement. \n\nEither way, dont think it relates to allowed address pairs","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"8f8192407a735b2bb8b6299be2c670e4547f6f27","unresolved":false,"context_lines":[{"line_number":65,"context_line":"Arp Responder\r"},{"line_number":66,"context_line":"---------------\r"},{"line_number":67,"context_line":"Because more than one VM ports\u0027 allowed address pairs could have a same ip\r"},{"line_number":68,"context_line":"address but different mac addresses, arp responder can hardly know which mac\r"},{"line_number":69,"context_line":"address should be responded to an arp request to this ip. We could simply\r"},{"line_number":70,"context_line":"continue to broadcast those arp requests rather than try to response them in\r"},{"line_number":71,"context_line":"arp table.\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_c0563acd","line":68,"range":{"start_line":68,"start_character":37,"end_line":68,"end_character":40},"updated":"2016-05-31 14:14:41.000000000","message":"arp -\u003e ARP (this is another acronym and should be in all caps everywhere it\u0027s used)","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"ca001cc35b93b90fba458c0f247c3ccb0e178232","unresolved":false,"context_lines":[{"line_number":65,"context_line":"Arp Responder\r"},{"line_number":66,"context_line":"---------------\r"},{"line_number":67,"context_line":"Because more than one VM ports\u0027 allowed address pairs could have a same ip\r"},{"line_number":68,"context_line":"address but different mac addresses, arp responder can hardly know which mac\r"},{"line_number":69,"context_line":"address should be responded to an arp request to this ip. We could simply\r"},{"line_number":70,"context_line":"continue to broadcast those arp requests rather than try to response them in\r"},{"line_number":71,"context_line":"arp table.\r"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_39ebdc79","line":68,"range":{"start_line":68,"start_character":37,"end_line":68,"end_character":40},"in_reply_to":"9abb7d3a_c0563acd","updated":"2016-06-01 07:59:28.000000000","message":"Done","commit_id":"3134414a599990fcc2d7482d210b0ee61befa58e"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"8475f23314e587ad2b96d8df6b8b20b5007aaf43","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Security Group\r"},{"line_number":48,"context_line":"----------------------\r"},{"line_number":49,"context_line":"Security group module transform remote group field in a rule to flows\r"},{"line_number":50,"context_line":"according IP addresses of VM ports associated to this remote group.\r"},{"line_number":51,"context_line":"To support allowed address pairs, those IP addresses should include both\r"},{"line_number":52,"context_line":"fixed IP address and the IP addresses in allowed address pairs.\r"},{"line_number":53,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9abb7d3a_033e5927","line":50,"updated":"2016-06-01 11:49:44.000000000","message":"minor grammatical corrections, change to: \"The security group module transforms the remote group field in a rule to flows according to IP addresses of VM ports associated with the remote group.\"","commit_id":"8db664362c504ea28dab40f6d48974d0cc402df2"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"bd7c0b2ea0e213a08b540521298fd211de4bd802","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Security Group\r"},{"line_number":48,"context_line":"----------------------\r"},{"line_number":49,"context_line":"Security group module transform remote group field in a rule to flows\r"},{"line_number":50,"context_line":"according IP addresses of VM ports associated to this remote group.\r"},{"line_number":51,"context_line":"To support allowed address pairs, those IP addresses should include both\r"},{"line_number":52,"context_line":"fixed IP address and the IP addresses in allowed address pairs.\r"},{"line_number":53,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7aa08908_d277ab00","line":50,"in_reply_to":"9abb7d3a_033e5927","updated":"2016-06-06 06:32:24.000000000","message":"Done","commit_id":"8db664362c504ea28dab40f6d48974d0cc402df2"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"8475f23314e587ad2b96d8df6b8b20b5007aaf43","unresolved":false,"context_lines":[{"line_number":54,"context_line":"L2/L3 Lookup\r"},{"line_number":55,"context_line":"----------------------\r"},{"line_number":56,"context_line":"One or more VM ports could share a same IP address (and a same MAC address in\r"},{"line_number":57,"context_line":"some scenes) in allowed address pairs. In L2/L3 Lookup table, we could simply\r"},{"line_number":58,"context_line":"send the packets of which destination address is this address to all VM ports\r"},{"line_number":59,"context_line":"which have this address in their allowed address pairs field.\r"},{"line_number":60,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9abb7d3a_232a7ddb","line":57,"range":{"start_line":57,"start_character":5,"end_line":57,"end_character":11},"updated":"2016-06-01 11:49:44.000000000","message":"scenes -\u003e scenarios","commit_id":"8db664362c504ea28dab40f6d48974d0cc402df2"},{"author":{"_account_id":21007,"name":"yuan wei","email":"wei.yuan@huawei.com","username":"yuanwei"},"change_message_id":"bd7c0b2ea0e213a08b540521298fd211de4bd802","unresolved":false,"context_lines":[{"line_number":54,"context_line":"L2/L3 Lookup\r"},{"line_number":55,"context_line":"----------------------\r"},{"line_number":56,"context_line":"One or more VM ports could share a same IP address (and a same MAC address in\r"},{"line_number":57,"context_line":"some scenes) in allowed address pairs. In L2/L3 Lookup table, we could simply\r"},{"line_number":58,"context_line":"send the packets of which destination address is this address to all VM ports\r"},{"line_number":59,"context_line":"which have this address in their allowed address pairs field.\r"},{"line_number":60,"context_line":"\r"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7aa08908_f264674a","line":57,"range":{"start_line":57,"start_character":5,"end_line":57,"end_character":11},"in_reply_to":"9abb7d3a_232a7ddb","updated":"2016-06-06 06:32:24.000000000","message":"Done","commit_id":"8db664362c504ea28dab40f6d48974d0cc402df2"}]}