)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":10,"context_line":"spec decribes the design of firewal for Dragonflow"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Co-Authored-By: hujie \u003cmike.hu@huawei.com\u003e"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I27746cb11a55132b72c704c586305daf6b32e9f9"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"fa31d9ce_74c4ca5e","line":13,"updated":"2017-02-13 02:09:09.000000000","message":"pls link the bp","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"}],"doc/source/specs/fwaas.rst":[{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"88ef78a4d3ad44d87a4aa88d1d0ac723ed43a128","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Firewall is a necessary functionality in cloud infrastructure. It can provide"},{"line_number":15,"context_line":"a barrier between a trusted internal network and another outside network."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Currently, Dragonflow supports security groups, which can supply filtering"},{"line_number":18,"context_line":"based on whitelists. A firewall can provide more functionalities and more"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da4df55a_a86d8bcd","line":15,"range":{"start_line":15,"start_character":57,"end_line":15,"end_character":64},"updated":"2016-12-29 03:01:02.000000000","message":"nit: external?","commit_id":"7c83d8299c33ccecda5239f113c94fbe9ae77820"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"88ef78a4d3ad44d87a4aa88d1d0ac723ed43a128","unresolved":false,"context_lines":[{"line_number":26,"context_line":"Our goal is to support all the functionalities in the Neutron FwaaS v2 spec."},{"line_number":27,"context_line":"Given FwaaS v2 is still under development, a few features are not ready, this"},{"line_number":28,"context_line":"spec only covers the basic firewall functionalities, including map the Neutron"},{"line_number":29,"context_line":"FaaS v2 data model to Dragonflow controller and apply the firewall rules to"},{"line_number":30,"context_line":"router interfaces."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Address group, service group and applying firewall rules to VM ports, SFC ports"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da4df55a_28627bd8","line":29,"range":{"start_line":29,"start_character":0,"end_line":29,"end_character":4},"updated":"2016-12-29 03:01:02.000000000","message":"FwaaS?","commit_id":"7c83d8299c33ccecda5239f113c94fbe9ae77820"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"88ef78a4d3ad44d87a4aa88d1d0ac723ed43a128","unresolved":false,"context_lines":[{"line_number":128,"context_line":""},{"line_number":129,"context_line":"::"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":" # firewall port table"},{"line_number":132,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":133,"context_line":"                actions\u003dload:GRP-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":" # firewall rule table"},{"line_number":136,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dGRP-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":137,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d9800, reg5\u003dGRP-KEY,ip,nw_dst\u003d192.168.1.10 action\u003dresubmit(,\u003cEGRESS SEC GRP\u003e)"},{"line_number":138,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da4df55a_c8cc8fbd","line":136,"range":{"start_line":131,"start_character":0,"end_line":136,"end_character":100},"updated":"2016-12-29 03:01:02.000000000","message":"I might be missing something here, but it looks like router_inf_mac has a one-one relationship with reg5. So, can\u0027t this 2 table be merged into one?\n\ncookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, dl_dst\u003drouter_inf_mac,ip,nw_src\u003d192.168.0.4 action\u003ddrop","commit_id":"7c83d8299c33ccecda5239f113c94fbe9ae77820"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"a4220e2f60315e1c40fbe65fd5446a9e6e977632","unresolved":false,"context_lines":[{"line_number":128,"context_line":""},{"line_number":129,"context_line":"::"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":" # firewall port table"},{"line_number":132,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":133,"context_line":"                actions\u003dload:GRP-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":" # firewall rule table"},{"line_number":136,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dGRP-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":137,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d9800, reg5\u003dGRP-KEY,ip,nw_dst\u003d192.168.1.10 action\u003dresubmit(,\u003cEGRESS SEC GRP\u003e)"},{"line_number":138,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba5201f7_36ac60ed","line":136,"range":{"start_line":131,"start_character":0,"end_line":136,"end_character":100},"in_reply_to":"da4df55a_c8cc8fbd","updated":"2016-12-29 06:43:55.000000000","message":"The 2 tables could be merged into one. But as line 84 said, I want to decouple ports and rules in the firewall group. Multiple router interfaces could be in a single firewall group, so they are N:1.\n\nLet\u0027s say we have 20 rules in the firewall group already, and then we add another port to the firewall group, we only need to install 1 rule to the port table. But we have to install another 20 rules if we merge the 2 tables,","commit_id":"7c83d8299c33ccecda5239f113c94fbe9ae77820"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"88ef78a4d3ad44d87a4aa88d1d0ac723ed43a128","unresolved":false,"context_lines":[{"line_number":137,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d9800, reg5\u003dGRP-KEY,ip,nw_dst\u003d192.168.1.10 action\u003dresubmit(,\u003cEGRESS SEC GRP\u003e)"},{"line_number":138,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"The priority of the flow entry in firewall rule table in corresponding to the"},{"line_number":141,"context_line":"order of firewall rules. The rules come first have the higher priority."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"To support inserting firewall rules, we use a big number as the priority when"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da4df55a_488b3f68","line":140,"range":{"start_line":140,"start_character":54,"end_line":140,"end_character":56},"updated":"2016-12-29 03:01:02.000000000","message":"is?","commit_id":"7c83d8299c33ccecda5239f113c94fbe9ae77820"},{"author":{"_account_id":20153,"name":"Duan Kebo","email":"duankebo@gmail.com"},"change_message_id":"f0e792164f1fcd23758b5985752f45b28a7e9cf7","unresolved":false,"context_lines":[{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Support firewall as a service (FWaaS)"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Problem Description"},{"line_number":12,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_0687d1d7","line":10,"updated":"2017-01-04 03:10:30.000000000","message":"You need to create a blueprint and put the link here","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Support firewall as a service (FWaaS)"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Problem Description"},{"line_number":12,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_56a319b2","line":10,"in_reply_to":"ba5201f7_0687d1d7","updated":"2017-01-05 01:00:39.000000000","message":"Ok, I will add it later","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"43c38c65771d01e707577588619dcf4919d392bd","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Firewall is a necessary functionality in cloud infrastructure. It can provide"},{"line_number":15,"context_line":"a barrier between a trusted internal network and another erternal network."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Currently, Dragonflow supports security groups, which can supply filtering"},{"line_number":18,"context_line":"based on whitelists. A firewall can provide more functionalities and more"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_2a5737cf","line":15,"range":{"start_line":15,"start_character":57,"end_line":15,"end_character":65},"updated":"2017-01-04 05:53:47.000000000","message":"external","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Firewall is a necessary functionality in cloud infrastructure. It can provide"},{"line_number":15,"context_line":"a barrier between a trusted internal network and another erternal network."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Currently, Dragonflow supports security groups, which can supply filtering"},{"line_number":18,"context_line":"based on whitelists. A firewall can provide more functionalities and more"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_f61fad05","line":15,"range":{"start_line":15,"start_character":57,"end_line":15,"end_character":65},"in_reply_to":"ba5201f7_2a5737cf","updated":"2017-01-05 01:00:39.000000000","message":"ok","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"43c38c65771d01e707577588619dcf4919d392bd","unresolved":false,"context_lines":[{"line_number":15,"context_line":"a barrier between a trusted internal network and another erternal network."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Currently, Dragonflow supports security groups, which can supply filtering"},{"line_number":18,"context_line":"based on whitelists. A firewall can provide more functionalities and more"},{"line_number":19,"context_line":"granular for users, just as the Openstack Neutron spec described："},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"https://specs.openstack.org/openstack/neutron-specs/specs/mitaka/fwaas-api-2.0.html"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_ca130b0c","line":18,"updated":"2017-01-04 05:53:47.000000000","message":"So we do not need security group any more as fwaas v2 is able to deal with any port-level control?","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":15,"context_line":"a barrier between a trusted internal network and another erternal network."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Currently, Dragonflow supports security groups, which can supply filtering"},{"line_number":18,"context_line":"based on whitelists. A firewall can provide more functionalities and more"},{"line_number":19,"context_line":"granular for users, just as the Openstack Neutron spec described："},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"https://specs.openstack.org/openstack/neutron-specs/specs/mitaka/fwaas-api-2.0.html"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_dfde606c","line":18,"in_reply_to":"ba5201f7_ca130b0c","updated":"2017-01-05 01:00:39.000000000","message":"Not for now, there are two reasons why we need both of them in the Neutron Fwaas spec:\nhttps://specs.openstack.org/openstack/neutron-specs/specs/mitaka/fwaas-api-2.0.html#relationship-between-fwaas-and-security-groups","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"43c38c65771d01e707577588619dcf4919d392bd","unresolved":false,"context_lines":[{"line_number":30,"context_line":"router interfaces."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Address group, service group and applying firewall rules to VM ports, SFC ports"},{"line_number":33,"context_line":"are not implemented in Neutron FaaS v2 yet, so they will not be covered in"},{"line_number":34,"context_line":"this spec."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_2af3b7d7","line":33,"range":{"start_line":33,"start_character":31,"end_line":33,"end_character":35},"updated":"2017-01-04 05:53:47.000000000","message":"FWaaS","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":30,"context_line":"router interfaces."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Address group, service group and applying firewall rules to VM ports, SFC ports"},{"line_number":33,"context_line":"are not implemented in Neutron FaaS v2 yet, so they will not be covered in"},{"line_number":34,"context_line":"this spec."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_76dadd4d","line":33,"range":{"start_line":33,"start_character":31,"end_line":33,"end_character":35},"in_reply_to":"ba5201f7_2af3b7d7","updated":"2017-01-05 01:00:39.000000000","message":"ok","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":20153,"name":"Duan Kebo","email":"duankebo@gmail.com"},"change_message_id":"f0e792164f1fcd23758b5985752f45b28a7e9cf7","unresolved":false,"context_lines":[{"line_number":42,"context_line":"The firewall plugin"},{"line_number":43,"context_line":"-------------------"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"The firewall plugin OpenStack Neutron FwaaS provided manipulates the firewall"},{"line_number":46,"context_line":"data objects and talks to Neutron agents via RPC. However, Dragonflow needs a"},{"line_number":47,"context_line":"plugin can talk to NB DB and publish events to Dragonflow controllers."},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_46fe3939","line":45,"range":{"start_line":45,"start_character":44,"end_line":45,"end_character":64},"updated":"2017-01-04 03:10:30.000000000","message":"provides manipulation of ?","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":42,"context_line":"The firewall plugin"},{"line_number":43,"context_line":"-------------------"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"The firewall plugin OpenStack Neutron FwaaS provided manipulates the firewall"},{"line_number":46,"context_line":"data objects and talks to Neutron agents via RPC. However, Dragonflow needs a"},{"line_number":47,"context_line":"plugin can talk to NB DB and publish events to Dragonflow controllers."},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_16f0b1c8","line":45,"range":{"start_line":45,"start_character":44,"end_line":45,"end_character":64},"in_reply_to":"ba5201f7_46fe3939","updated":"2017-01-05 01:00:39.000000000","message":"I will make it clear","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":20153,"name":"Duan Kebo","email":"duankebo@gmail.com"},"change_message_id":"f0e792164f1fcd23758b5985752f45b28a7e9cf7","unresolved":false,"context_lines":[{"line_number":51,"context_line":"To leverage the firewall objects and logic Neutron FwaaS defined, the new"},{"line_number":52,"context_line":"firewall plugin will inherit the Neutron firewall plugin and implement the"},{"line_number":53,"context_line":"communication with NB DB, including publishing events. In this way, Dragonflow"},{"line_number":54,"context_line":"firewall plugin can work both with Dragonflow local controller and other"},{"line_number":55,"context_line":"Neutron agents."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Firewall APP for Dragonflow controller"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_26b13590","line":54,"range":{"start_line":54,"start_character":24,"end_line":54,"end_character":31},"updated":"2017-01-04 03:10:30.000000000","message":"Not clear. The new plugin will send rpc messages also?","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":51,"context_line":"To leverage the firewall objects and logic Neutron FwaaS defined, the new"},{"line_number":52,"context_line":"firewall plugin will inherit the Neutron firewall plugin and implement the"},{"line_number":53,"context_line":"communication with NB DB, including publishing events. In this way, Dragonflow"},{"line_number":54,"context_line":"firewall plugin can work both with Dragonflow local controller and other"},{"line_number":55,"context_line":"Neutron agents."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Firewall APP for Dragonflow controller"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_dffae0bc","line":54,"range":{"start_line":54,"start_character":24,"end_line":54,"end_character":31},"in_reply_to":"ba5201f7_26b13590","updated":"2017-01-05 01:00:39.000000000","message":"Because the new plugin will inherit the Neutron firewall plugin, which can send RPC message, the new plugin can do it also","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":20153,"name":"Duan Kebo","email":"duankebo@gmail.com"},"change_message_id":"f0e792164f1fcd23758b5985752f45b28a7e9cf7","unresolved":false,"context_lines":[{"line_number":78,"context_line":"                                ----\u003e Egress Policy +----\u003e Firewall Rules|"},{"line_number":79,"context_line":"                                    +---------------+    +---------------+"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"According to the data model, a firewall group port table and a firewall rule"},{"line_number":82,"context_line":"table will be added to the Dragonflow ingress and egress pipelines."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"To decouple ports and firewall rules, the firewall group port table only handle"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_c45b022d","line":81,"range":{"start_line":81,"start_character":51,"end_line":81,"end_character":56},"updated":"2017-01-04 03:10:30.000000000","message":"NB DB table or ovs openflow table? I guess the later. But being more specific will be better.","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":20153,"name":"Duan Kebo","email":"duankebo@gmail.com"},"change_message_id":"f0e792164f1fcd23758b5985752f45b28a7e9cf7","unresolved":false,"context_lines":[{"line_number":86,"context_line":"the firewall rules to Openflow flow entries without caring adding/removing ports."},{"line_number":87,"context_line":"When a port is added or deleted from a firewall group, only the firewall group"},{"line_number":88,"context_line":"port table is updated and the traffic from/to other ports in the firewall group"},{"line_number":89,"context_line":"will not be affected during the updating."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Egress:"},{"line_number":92,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_a45b5e86","line":89,"range":{"start_line":89,"start_character":21,"end_line":89,"end_character":27},"updated":"2017-01-04 03:10:30.000000000","message":"Besides using two tables, conjunction is also option. Think about it.","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"f03d9875e67571558edda89e9b1ba4fa15cc9a19","unresolved":false,"context_lines":[{"line_number":86,"context_line":"the firewall rules to Openflow flow entries without caring adding/removing ports."},{"line_number":87,"context_line":"When a port is added or deleted from a firewall group, only the firewall group"},{"line_number":88,"context_line":"port table is updated and the traffic from/to other ports in the firewall group"},{"line_number":89,"context_line":"will not be affected during the updating."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Egress:"},{"line_number":92,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_d6d38902","line":89,"range":{"start_line":89,"start_character":21,"end_line":89,"end_character":27},"in_reply_to":"ba5201f7_a45b5e86","updated":"2017-01-05 01:10:38.000000000","message":"I have thought about it. But one conjunction can only have a single action, so we can not put rules with different rule actions into one conjunction","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":20153,"name":"Duan Kebo","email":"duankebo@gmail.com"},"change_message_id":"f0e792164f1fcd23758b5985752f45b28a7e9cf7","unresolved":false,"context_lines":[{"line_number":95,"context_line":"unique key of the firewall group will be loaded to REG5 and the flow will be"},{"line_number":96,"context_line":"resubmit to firewall rule table."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"In the firewall rule table, the firewall rules in the firewall group REG5"},{"line_number":99,"context_line":"specified are applied to the flow."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"The pipeline looks like:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_04ad0a31","line":98,"range":{"start_line":98,"start_character":69,"end_line":98,"end_character":73},"updated":"2017-01-04 03:10:30.000000000","message":"specified by REG5?","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":95,"context_line":"unique key of the firewall group will be loaded to REG5 and the flow will be"},{"line_number":96,"context_line":"resubmit to firewall rule table."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"In the firewall rule table, the firewall rules in the firewall group REG5"},{"line_number":99,"context_line":"specified are applied to the flow."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"The pipeline looks like:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_f6cded85","line":98,"range":{"start_line":98,"start_character":69,"end_line":98,"end_character":73},"in_reply_to":"ba5201f7_04ad0a31","updated":"2017-01-05 01:00:39.000000000","message":"yes, I will make it clear","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":20153,"name":"Duan Kebo","email":"duankebo@gmail.com"},"change_message_id":"f0e792164f1fcd23758b5985752f45b28a7e9cf7","unresolved":false,"context_lines":[{"line_number":112,"context_line":"                                  |                                      |"},{"line_number":113,"context_line":"                                  |   +----------------+   Port not in   |"},{"line_number":114,"context_line":"                                  |   | Egress router  |   any FW group  |"},{"line_number":115,"context_line":"                                  ----\u003e ports FW group |--------\u003e------|"},{"line_number":116,"context_line":"                                      +----------------+                 |"},{"line_number":117,"context_line":"                             load firewall   |                           |"},{"line_number":118,"context_line":"                           group key to REG5 |                           |"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_844e5a94","line":115,"range":{"start_line":115,"start_character":68,"end_line":115,"end_character":69},"updated":"2017-01-04 03:10:30.000000000","message":"need more \u0027-\u0027 to align","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":112,"context_line":"                                  |                                      |"},{"line_number":113,"context_line":"                                  |   +----------------+   Port not in   |"},{"line_number":114,"context_line":"                                  |   | Egress router  |   any FW group  |"},{"line_number":115,"context_line":"                                  ----\u003e ports FW group |--------\u003e------|"},{"line_number":116,"context_line":"                                      +----------------+                 |"},{"line_number":117,"context_line":"                             load firewall   |                           |"},{"line_number":118,"context_line":"                           group key to REG5 |                           |"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_b629a539","line":115,"range":{"start_line":115,"start_character":68,"end_line":115,"end_character":69},"in_reply_to":"ba5201f7_844e5a94","updated":"2017-01-05 01:00:39.000000000","message":"ok","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"43c38c65771d01e707577588619dcf4919d392bd","unresolved":false,"context_lines":[{"line_number":122,"context_line":"                                      +----------------+  rule Action\u003dallow"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Let\u0027s say we add a rule that drop all traffic from IP address 192.168.0.4,"},{"line_number":125,"context_line":"and then then add a rule allow the traffic to IP address 192.168.1.10, at last"},{"line_number":126,"context_line":"we add the rules to a policy, then we add the policy and a router port to a"},{"line_number":127,"context_line":"firewall group, the flows look like:"},{"line_number":128,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_f8d265ff","line":125,"range":{"start_line":125,"start_character":9,"end_line":125,"end_character":13},"updated":"2017-01-04 05:53:47.000000000","message":"remove it.","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":122,"context_line":"                                      +----------------+  rule Action\u003dallow"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Let\u0027s say we add a rule that drop all traffic from IP address 192.168.0.4,"},{"line_number":125,"context_line":"and then then add a rule allow the traffic to IP address 192.168.1.10, at last"},{"line_number":126,"context_line":"we add the rules to a policy, then we add the policy and a router port to a"},{"line_number":127,"context_line":"firewall group, the flows look like:"},{"line_number":128,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_9624a160","line":125,"range":{"start_line":125,"start_character":9,"end_line":125,"end_character":13},"in_reply_to":"ba5201f7_f8d265ff","updated":"2017-01-05 01:00:39.000000000","message":"ok","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"43c38c65771d01e707577588619dcf4919d392bd","unresolved":false,"context_lines":[{"line_number":130,"context_line":""},{"line_number":131,"context_line":" # firewall port table"},{"line_number":132,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":133,"context_line":"                actions\u003dload:GRP-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":" # firewall rule table"},{"line_number":136,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dGRP-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_98087993","line":133,"range":{"start_line":133,"start_character":29,"end_line":133,"end_character":32},"updated":"2017-01-04 05:53:47.000000000","message":"group router port??","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":130,"context_line":""},{"line_number":131,"context_line":" # firewall port table"},{"line_number":132,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":133,"context_line":"                actions\u003dload:GRP-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":" # firewall rule table"},{"line_number":136,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dGRP-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_3f176cee","line":133,"range":{"start_line":133,"start_character":29,"end_line":133,"end_character":32},"in_reply_to":"ba5201f7_98087993","updated":"2017-01-05 01:00:39.000000000","message":"firewall group, I will make it clear","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":20153,"name":"Duan Kebo","email":"duankebo@gmail.com"},"change_message_id":"f0e792164f1fcd23758b5985752f45b28a7e9cf7","unresolved":false,"context_lines":[{"line_number":193,"context_line":"and egress firewall policy, as well a list of ports. Each firewall policy"},{"line_number":194,"context_line":"tables contains a list of firewall rules in the policy."},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"To make it easy to update the firewall rules, each firewall rule table contains"},{"line_number":197,"context_line":"a list of policies that associated to the rule, and each firewall policy table"},{"line_number":198,"context_line":"contains a list of firewall IDs associated to the policy."},{"line_number":199,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_47b6343e","line":196,"range":{"start_line":196,"start_character":45,"end_line":196,"end_character":70},"updated":"2017-01-04 03:10:30.000000000","message":"is this necessary? because firewall rule is light-weighted, we may not need to reuse it.","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"485d3e8fa40b4d95103e9d13a0ce714227fe73ba","unresolved":false,"context_lines":[{"line_number":193,"context_line":"and egress firewall policy, as well a list of ports. Each firewall policy"},{"line_number":194,"context_line":"tables contains a list of firewall rules in the policy."},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"To make it easy to update the firewall rules, each firewall rule table contains"},{"line_number":197,"context_line":"a list of policies that associated to the rule, and each firewall policy table"},{"line_number":198,"context_line":"contains a list of firewall IDs associated to the policy."},{"line_number":199,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5201f7_7633bdab","line":196,"range":{"start_line":196,"start_character":45,"end_line":196,"end_character":70},"in_reply_to":"ba5201f7_47b6343e","updated":"2017-01-05 01:00:39.000000000","message":"Neutron Fwaas v2 allows people associate a rule to multiple firewall policies and to make it easy to update a rule I think need to record the policies.","commit_id":"f4bcf9ed0d67f07ab51c38005365ea7bf3dc8864"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"24afcdf863b32c009c3c763287ff3a3e40183bb6","unresolved":false,"context_lines":[{"line_number":119,"context_line":"                                      +--------\u003e-------+                 |"},{"line_number":120,"context_line":"                                      |  Egress router |                 |"},{"line_number":121,"context_line":"                                      |  FW rules      |--------\u003e--------|"},{"line_number":122,"context_line":"                                      +----------------+  rule Action\u003dallow"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Let\u0027s say we add a rule that drop all traffic from IP address 192.168.0.4,"},{"line_number":125,"context_line":"and then add a rule to allow the traffic to IP address 192.168.1.10, at last"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba5201f7_c02e9c41","line":122,"updated":"2017-01-10 18:05:23.000000000","message":"Some of the arrows in this diagram are unclear. e.g. Do all packets go through Egress Security Group?","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"cc73e1f3a4e7ef7d35dc46ef7cb05e4f6b25e198","unresolved":false,"context_lines":[{"line_number":119,"context_line":"                                      +--------\u003e-------+                 |"},{"line_number":120,"context_line":"                                      |  Egress router |                 |"},{"line_number":121,"context_line":"                                      |  FW rules      |--------\u003e--------|"},{"line_number":122,"context_line":"                                      +----------------+  rule Action\u003dallow"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Let\u0027s say we add a rule that drop all traffic from IP address 192.168.0.4,"},{"line_number":125,"context_line":"and then add a rule to allow the traffic to IP address 192.168.1.10, at last"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_476d9fcb","line":122,"in_reply_to":"5a3905b3_6b62ef3f","updated":"2017-02-03 01:57:07.000000000","message":"Done","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"467dfe944ffb91e3fdfeb03569d2db9f0f2acf0d","unresolved":false,"context_lines":[{"line_number":119,"context_line":"                                      +--------\u003e-------+                 |"},{"line_number":120,"context_line":"                                      |  Egress router |                 |"},{"line_number":121,"context_line":"                                      |  FW rules      |--------\u003e--------|"},{"line_number":122,"context_line":"                                      +----------------+  rule Action\u003dallow"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Let\u0027s say we add a rule that drop all traffic from IP address 192.168.0.4,"},{"line_number":125,"context_line":"and then add a rule to allow the traffic to IP address 192.168.1.10, at last"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_6b62ef3f","line":122,"in_reply_to":"5a3905b3_9a420c67","updated":"2017-01-22 07:09:07.000000000","message":"This is good. But please add it to the document.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"0f11cbc58a227c95aae946c674a3c708a65d19bf","unresolved":false,"context_lines":[{"line_number":119,"context_line":"                                      +--------\u003e-------+                 |"},{"line_number":120,"context_line":"                                      |  Egress router |                 |"},{"line_number":121,"context_line":"                                      |  FW rules      |--------\u003e--------|"},{"line_number":122,"context_line":"                                      +----------------+  rule Action\u003dallow"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Let\u0027s say we add a rule that drop all traffic from IP address 192.168.0.4,"},{"line_number":125,"context_line":"and then add a rule to allow the traffic to IP address 192.168.1.10, at last"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_9a420c67","line":122,"in_reply_to":"ba5201f7_c02e9c41","updated":"2017-01-22 00:50:04.000000000","message":"All packets go through Egress Security Group except packets are dropped/rejected in Egress router FW rules table.\nIn other words, packets are not send to a firewall and allowed by a firewall rules will be send to Security Group table.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"24afcdf863b32c009c3c763287ff3a3e40183bb6","unresolved":false,"context_lines":[{"line_number":129,"context_line":"::"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":" # firewall port table"},{"line_number":132,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":133,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":" # firewall rule table"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba5201f7_806734b6","line":132,"range":{"start_line":132,"start_character":51,"end_line":132,"end_character":72},"updated":"2017-01-10 18:05:23.000000000","message":"Does this mean FW rules only apply for routed packets (as opposed to L2 only packets)? Is this intentional? I think I missed this when reading the spec.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"467dfe944ffb91e3fdfeb03569d2db9f0f2acf0d","unresolved":false,"context_lines":[{"line_number":129,"context_line":"::"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":" # firewall port table"},{"line_number":132,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":133,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":" # firewall rule table"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_ab58578b","line":132,"range":{"start_line":132,"start_character":51,"end_line":132,"end_character":72},"in_reply_to":"5a3905b3_1a57fc26","updated":"2017-01-22 07:09:07.000000000","message":"All right. I think this should be mentioned.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"33fc6cc4af9dc2df7afbbdc1f849f5484399f68f","unresolved":false,"context_lines":[{"line_number":129,"context_line":"::"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":" # firewall port table"},{"line_number":132,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":133,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":" # firewall rule table"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_6336eae8","line":132,"range":{"start_line":132,"start_character":51,"end_line":132,"end_character":72},"in_reply_to":"5a3905b3_2751730f","updated":"2017-02-05 07:51:46.000000000","message":"I see it. Thanks.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"cc73e1f3a4e7ef7d35dc46ef7cb05e4f6b25e198","unresolved":false,"context_lines":[{"line_number":129,"context_line":"::"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":" # firewall port table"},{"line_number":132,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":133,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":" # firewall rule table"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_2751730f","line":132,"range":{"start_line":132,"start_character":51,"end_line":132,"end_character":72},"in_reply_to":"5a3905b3_ab58578b","updated":"2017-02-03 01:57:07.000000000","message":"Yes, I think it is mentioned in line 27 to 29.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"0f11cbc58a227c95aae946c674a3c708a65d19bf","unresolved":false,"context_lines":[{"line_number":129,"context_line":"::"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":" # firewall port table"},{"line_number":132,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":133,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":" # firewall rule table"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_1a57fc26","line":132,"range":{"start_line":132,"start_character":51,"end_line":132,"end_character":72},"in_reply_to":"ba5201f7_806734b6","updated":"2017-01-22 00:50:04.000000000","message":"Yes. For now, Neutron Fwaas v2 is still developing, so this spec only covers the routed packets.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":20439,"name":"night_elf1020","email":"lijunwu2@huawei.com","username":"JunwuLi"},"change_message_id":"41fed74e09eed20ec97235ddbd1a3a3925be12a6","unresolved":false,"context_lines":[{"line_number":157,"context_line":"    +-----------+                           +---------+    +---------+"},{"line_number":158,"context_line":"    |           |                           |         |    |         |    +-----+"},{"line_number":159,"context_line":"    | Ingress   |                           | Ingress |    | Ingress |    |     |"},{"line_number":160,"context_line":"    | Connection+---------------------------\u003e Security+--\u003e | Dispatch+--\u003e | VM  |"},{"line_number":161,"context_line":"    | Tracking  |                           | Group   |    |         |    |     |"},{"line_number":162,"context_line":"    |           |                           |         |    |         |    +-----+"},{"line_number":163,"context_line":"    +-----------+                           +----\u003e----+    +---------+"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba5201f7_904fdb32","line":160,"range":{"start_line":160,"start_character":6,"end_line":160,"end_character":16},"updated":"2017-01-09 03:30:59.000000000","message":"It is not good for FW and sg sharing the contrak table, because it will increase the difficulty for using.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"0f11cbc58a227c95aae946c674a3c708a65d19bf","unresolved":false,"context_lines":[{"line_number":157,"context_line":"    +-----------+                           +---------+    +---------+"},{"line_number":158,"context_line":"    |           |                           |         |    |         |    +-----+"},{"line_number":159,"context_line":"    | Ingress   |                           | Ingress |    | Ingress |    |     |"},{"line_number":160,"context_line":"    | Connection+---------------------------\u003e Security+--\u003e | Dispatch+--\u003e | VM  |"},{"line_number":161,"context_line":"    | Tracking  |                           | Group   |    |         |    |     |"},{"line_number":162,"context_line":"    |           |                           |         |    |         |    +-----+"},{"line_number":163,"context_line":"    +-----------+                           +----\u003e----+    +---------+"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_9ab4cc82","line":160,"range":{"start_line":160,"start_character":6,"end_line":160,"end_character":16},"in_reply_to":"ba5201f7_7d2af991","updated":"2017-01-22 00:50:04.000000000","message":"I agree with Omer. For a single connection, we should not keep two conntrack entries.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"24afcdf863b32c009c3c763287ff3a3e40183bb6","unresolved":false,"context_lines":[{"line_number":157,"context_line":"    +-----------+                           +---------+    +---------+"},{"line_number":158,"context_line":"    |           |                           |         |    |         |    +-----+"},{"line_number":159,"context_line":"    | Ingress   |                           | Ingress |    | Ingress |    |     |"},{"line_number":160,"context_line":"    | Connection+---------------------------\u003e Security+--\u003e | Dispatch+--\u003e | VM  |"},{"line_number":161,"context_line":"    | Tracking  |                           | Group   |    |         |    |     |"},{"line_number":162,"context_line":"    |           |                           |         |    |         |    +-----+"},{"line_number":163,"context_line":"    +-----------+                           +----\u003e----+    +---------+"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba5201f7_7d2af991","line":160,"range":{"start_line":160,"start_character":6,"end_line":160,"end_character":16},"in_reply_to":"ba5201f7_904fdb32","updated":"2017-01-10 18:05:23.000000000","message":"I am not sure I understand.\n\nIn any case, why do connection tracking twice? It\u0027s the same information. If it can be reused, it would minimise memory usage (entries in conntrac table) and zones (since FW and SG zones will have to be separate)","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":20439,"name":"night_elf1020","email":"lijunwu2@huawei.com","username":"JunwuLi"},"change_message_id":"41fed74e09eed20ec97235ddbd1a3a3925be12a6","unresolved":false,"context_lines":[{"line_number":163,"context_line":"    +-----------+                           +----\u003e----+    +---------+"},{"line_number":164,"context_line":"          |                                      |"},{"line_number":165,"context_line":"          |   +----------------+  Port not in    |"},{"line_number":166,"context_line":"          |   | Ingress router |  any FW group   |"},{"line_number":167,"context_line":"          ----\u003e ports FW group |--------\u003e--------|"},{"line_number":168,"context_line":"              +----------------+                 |"},{"line_number":169,"context_line":"     load firewall   |                           |"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba5201f7_f024a760","line":166,"range":{"start_line":166,"start_character":30,"end_line":166,"end_character":31},"updated":"2017-01-09 03:30:59.000000000","message":"Are there some cases for using fw and sg at the same time, and the right order of rule priority.For example, how to drop a packet with esblished state in case of attacking.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"24afcdf863b32c009c3c763287ff3a3e40183bb6","unresolved":false,"context_lines":[{"line_number":163,"context_line":"    +-----------+                           +----\u003e----+    +---------+"},{"line_number":164,"context_line":"          |                                      |"},{"line_number":165,"context_line":"          |   +----------------+  Port not in    |"},{"line_number":166,"context_line":"          |   | Ingress router |  any FW group   |"},{"line_number":167,"context_line":"          ----\u003e ports FW group |--------\u003e--------|"},{"line_number":168,"context_line":"              +----------------+                 |"},{"line_number":169,"context_line":"     load firewall   |                           |"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba5201f7_3d59515c","line":166,"range":{"start_line":166,"start_character":30,"end_line":166,"end_character":31},"in_reply_to":"ba5201f7_f024a760","updated":"2017-01-10 18:05:23.000000000","message":"If I understand correctly, both FW and SG allow packets if it belongs to an established connection.\n\nThe security product that drops packets in an established connection requires deep packet inspection (e.g. IPS, IDS) to detect an attack.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":20439,"name":"night_elf1020","email":"lijunwu2@huawei.com","username":"JunwuLi"},"change_message_id":"41fed74e09eed20ec97235ddbd1a3a3925be12a6","unresolved":false,"context_lines":[{"line_number":200,"context_line":"TODO"},{"line_number":201,"context_line":"\u003d\u003d\u003d\u003d"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"Firewalls support the three actions, allow, drop, reject. But for now,"},{"line_number":204,"context_line":"the reject action is not supported by Openvswitch, so we leave a as a TODO."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba5201f7_10f5abeb","line":203,"range":{"start_line":203,"start_character":50,"end_line":203,"end_character":56},"updated":"2017-01-09 03:30:59.000000000","message":"Can the \"reject aciton\" rule  be repalced by packet-in to the fw-app, and then the fw-app sends icmp-unreachable or an RST packet?","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"0f11cbc58a227c95aae946c674a3c708a65d19bf","unresolved":false,"context_lines":[{"line_number":200,"context_line":"TODO"},{"line_number":201,"context_line":"\u003d\u003d\u003d\u003d"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"Firewalls support the three actions, allow, drop, reject. But for now,"},{"line_number":204,"context_line":"the reject action is not supported by Openvswitch, so we leave a as a TODO."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_5a97c4eb","line":203,"range":{"start_line":203,"start_character":50,"end_line":203,"end_character":56},"in_reply_to":"ba5201f7_10f5abeb","updated":"2017-01-22 00:50:04.000000000","message":"I think we can just leave reject action as a TODO. If we implement it by packet-in, we have to re-implement it when openvswitch supports it. For now the reject action is already a TODO in Openvswitch preject.","commit_id":"b8709c36a790a14670c64aa0a0369a36e557a295"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"8652b2b29d6150250ab721a260b081089bcab5c1","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Egress:"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"A unique key will be allocated for each firewall group from NB DB. If a flow is"},{"line_number":94,"context_line":"sent to a router interface that has been add to a firewall group, then the"},{"line_number":95,"context_line":"unique key of the firewall group will be loaded to REG5 and the flow will be"},{"line_number":96,"context_line":"resubmit to firewall rule table. Otherwise, the flow will be sent to Egress"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a430d35_e8782a92","line":93,"range":{"start_line":93,"start_character":0,"end_line":93,"end_character":2},"updated":"2017-02-03 08:03:17.000000000","message":"An","commit_id":"6259ba898cf56a2e8c069003dc0be69b4f5ebe03"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"8652b2b29d6150250ab721a260b081089bcab5c1","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Egress:"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"A unique key will be allocated for each firewall group from NB DB. If a flow is"},{"line_number":94,"context_line":"sent to a router interface that has been add to a firewall group, then the"},{"line_number":95,"context_line":"unique key of the firewall group will be loaded to REG5 and the flow will be"},{"line_number":96,"context_line":"resubmit to firewall rule table. Otherwise, the flow will be sent to Egress"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a430d35_a88d427d","line":93,"range":{"start_line":93,"start_character":72,"end_line":93,"end_character":76},"updated":"2017-02-03 08:03:17.000000000","message":"will \"packet\" be more appropriate here?","commit_id":"6259ba898cf56a2e8c069003dc0be69b4f5ebe03"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"8652b2b29d6150250ab721a260b081089bcab5c1","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"* If the action is drop, the flow will be dropped silently"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"* If the action is reject, the flow will be dropped silently for now, because"},{"line_number":108,"context_line":"  Openvswitch does not support this action, we will support it in the future"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a430d35_08cad6a1","line":107,"range":{"start_line":107,"start_character":1,"end_line":107,"end_character":53},"updated":"2017-02-03 08:03:17.000000000","message":"If the action is reject, the firewall is supposed to return something like \"ICMP admin prohibit\", right? Is this the difference between reject and drop?","commit_id":"6259ba898cf56a2e8c069003dc0be69b4f5ebe03"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"0ab3fb27897346a2a2f0878eb06e40210c1a04a3","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"* If the action is drop, the flow will be dropped silently"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"* If the action is reject, the flow will be dropped silently for now, because"},{"line_number":108,"context_line":"  Openvswitch does not support this action, we will support it in the future"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a430d35_8f3bfaea","line":107,"range":{"start_line":107,"start_character":1,"end_line":107,"end_character":53},"in_reply_to":"1a430d35_08cad6a1","updated":"2017-02-05 07:51:40.000000000","message":"Specifically in TCP, the firewall is supposed to return a TCP packet with the RST flag set. But this is not related to other protocols, e.g. UDP.","commit_id":"6259ba898cf56a2e8c069003dc0be69b4f5ebe03"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"2089725e1c7aa9a464cbbdcc07712ade2a3d02a4","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"               +---------+    +-----------+                        +---------+"},{"line_number":116,"context_line":"    +-----+    |         |    |           |                        |         |"},{"line_number":117,"context_line":"    |     |    | Port    |    | Egress    |     FW is disabled     | Egress  |"},{"line_number":118,"context_line":"    | VM  +--\u003e | Security+--\u003e | Connection+------------------------\u003e Security|"},{"line_number":119,"context_line":"    |     |    |         |    | Tracking  |                        | Group   |"},{"line_number":120,"context_line":"    +-----+    |         |    |           |                        |         |"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a430d35_63937da4","line":117,"range":{"start_line":117,"start_character":46,"end_line":117,"end_character":63},"updated":"2017-02-03 08:06:48.000000000","message":"How to know if fw is disabled?","commit_id":"6259ba898cf56a2e8c069003dc0be69b4f5ebe03"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"0ab3fb27897346a2a2f0878eb06e40210c1a04a3","unresolved":false,"context_lines":[{"line_number":118,"context_line":"    | VM  +--\u003e | Security+--\u003e | Connection+------------------------\u003e Security|"},{"line_number":119,"context_line":"    |     |    |         |    | Tracking  |                        | Group   |"},{"line_number":120,"context_line":"    +-----+    |         |    |           |                        |         |"},{"line_number":121,"context_line":"               +---------+    +-----------+                        +-----\u003e---+"},{"line_number":122,"context_line":"                                  |                                      |"},{"line_number":123,"context_line":"                                  |   +----------------+   Port not in   |"},{"line_number":124,"context_line":"                                  |   | Egress router  |   any FW group  |"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a430d35_2f2da6a7","line":121,"range":{"start_line":121,"start_character":73,"end_line":121,"end_character":74},"updated":"2017-02-05 07:51:40.000000000","message":"This arrow should be ^ or:\n---\n ^\n |","commit_id":"6259ba898cf56a2e8c069003dc0be69b4f5ebe03"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"0ab3fb27897346a2a2f0878eb06e40210c1a04a3","unresolved":false,"context_lines":[{"line_number":126,"context_line":"                                      +----------------+                 |"},{"line_number":127,"context_line":"                             load firewall   |                           |"},{"line_number":128,"context_line":"                           group key to REG5 |                           |"},{"line_number":129,"context_line":"                                      +--------\u003e-------+                 |"},{"line_number":130,"context_line":"                                      |  Egress router |                 |"},{"line_number":131,"context_line":"                                      |  FW rules      |--------\u003e--------|"},{"line_number":132,"context_line":"                                      +----------------+  rule Action\u003dallow"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a430d35_4f183285","line":129,"range":{"start_line":129,"start_character":45,"end_line":129,"end_character":48},"updated":"2017-02-05 07:51:40.000000000","message":"The arrow here is wrong","commit_id":"6259ba898cf56a2e8c069003dc0be69b4f5ebe03"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"8652b2b29d6150250ab721a260b081089bcab5c1","unresolved":false,"context_lines":[{"line_number":142,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":143,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":" # firewall rule table"},{"line_number":146,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dFwGroup-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":147,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d9800, reg5\u003dFwGroup,ip,nw_dst\u003d192.168.1.10 action\u003dresubmit(,\u003cEGRESS SECURITY GROUP\u003e)"},{"line_number":148,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"The priority of the flow entry in firewall rule table is corresponding to the"},{"line_number":151,"context_line":"order of firewall rules. The rules come first have the higher priority."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a430d35_6310dd4f","line":148,"range":{"start_line":145,"start_character":0,"end_line":148,"end_character":62},"updated":"2017-02-03 08:03:17.000000000","message":"are you going to use the state in conntrack? If so, it would be more clear to add information about the state. For example, you will only filter the first packet of a new connection.","commit_id":"6259ba898cf56a2e8c069003dc0be69b4f5ebe03"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"8652b2b29d6150250ab721a260b081089bcab5c1","unresolved":false,"context_lines":[{"line_number":198,"context_line":"--------------------"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Three tables will be added to the Dragonflow Northbound DB, firewall group table,"},{"line_number":201,"context_line":"firewall policy table, firewall rule table. Similar to the Neutron FwaaS data"},{"line_number":202,"context_line":"model, firewall group tables contains ingress firewall policy"},{"line_number":203,"context_line":"and egress firewall policy, as well a list of ports. Each firewall policy"},{"line_number":204,"context_line":"tables contains a list of firewall rules in the policy."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a430d35_28e23204","line":201,"range":{"start_line":201,"start_character":22,"end_line":201,"end_character":43},"updated":"2017-02-03 08:03:17.000000000","message":"I don\u0027t know if I raised the question before. Is it possible to put firewall rule inside firewall policy? just like we do for security group.","commit_id":"6259ba898cf56a2e8c069003dc0be69b4f5ebe03"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Currently, Dragonflow supports security groups, which can supply filtering"},{"line_number":18,"context_line":"based on whitelists. A firewall can provide more functionalities and more"},{"line_number":19,"context_line":"granular for users, just as the Openstack Neutron spec described："},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"https://specs.openstack.org/openstack/neutron-specs/specs/mitaka/fwaas-api-2.0.html"},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_f4aefa96","line":19,"range":{"start_line":19,"start_character":32,"end_line":19,"end_character":41},"updated":"2017-02-13 02:09:09.000000000","message":"nit: OpenStack","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"35a733168cce1845a75006d1a82e9c854abe2b93","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Currently, Dragonflow supports security groups, which can supply filtering"},{"line_number":18,"context_line":"based on whitelists. A firewall can provide more functionalities and more"},{"line_number":19,"context_line":"granular for users, just as the Openstack Neutron spec described："},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"https://specs.openstack.org/openstack/neutron-specs/specs/mitaka/fwaas-api-2.0.html"},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_e029cd8a","line":19,"range":{"start_line":19,"start_character":32,"end_line":19,"end_character":41},"in_reply_to":"fa31d9ce_f4aefa96","updated":"2017-02-13 08:53:33.000000000","message":"Done","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":70,"context_line":"                                |"},{"line_number":71,"context_line":"                                |"},{"line_number":72,"context_line":" +-----------------+      +--------------+"},{"line_number":73,"context_line":" | Ports(VM/Router)+------\u003e Firwall Group|"},{"line_number":74,"context_line":" +-----------------+      +--------------+"},{"line_number":75,"context_line":"                                |"},{"line_number":76,"context_line":"                                |"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_749bea72","line":73,"range":{"start_line":73,"start_character":28,"end_line":73,"end_character":35},"updated":"2017-02-13 02:09:09.000000000","message":"nit: Firewall","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"35a733168cce1845a75006d1a82e9c854abe2b93","unresolved":false,"context_lines":[{"line_number":70,"context_line":"                                |"},{"line_number":71,"context_line":"                                |"},{"line_number":72,"context_line":" +-----------------+      +--------------+"},{"line_number":73,"context_line":" | Ports(VM/Router)+------\u003e Firwall Group|"},{"line_number":74,"context_line":" +-----------------+      +--------------+"},{"line_number":75,"context_line":"                                |"},{"line_number":76,"context_line":"                                |"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_e03aad97","line":73,"range":{"start_line":73,"start_character":28,"end_line":73,"end_character":35},"in_reply_to":"fa31d9ce_749bea72","updated":"2017-02-13 08:53:33.000000000","message":"Done","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":84,"context_line":"To decouple ports and firewall rules, the firewall group port table only handle"},{"line_number":85,"context_line":"ports that has been added to a firewall group, and the firewall rule table maps"},{"line_number":86,"context_line":"the firewall rules to Openflow flow entries without caring adding/removing ports."},{"line_number":87,"context_line":"When a port is added or deleted from a firewall group, only the firewall group"},{"line_number":88,"context_line":"port table is updated and the traffic from/to other ports in the firewall group"},{"line_number":89,"context_line":"will not be affected during the updating."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Egress:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_94793eff","line":88,"range":{"start_line":87,"start_character":54,"end_line":88,"end_character":21},"updated":"2017-02-13 02:09:09.000000000","message":"Will the Openflow rule for that port be added/deleted too?","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"35a733168cce1845a75006d1a82e9c854abe2b93","unresolved":false,"context_lines":[{"line_number":84,"context_line":"To decouple ports and firewall rules, the firewall group port table only handle"},{"line_number":85,"context_line":"ports that has been added to a firewall group, and the firewall rule table maps"},{"line_number":86,"context_line":"the firewall rules to Openflow flow entries without caring adding/removing ports."},{"line_number":87,"context_line":"When a port is added or deleted from a firewall group, only the firewall group"},{"line_number":88,"context_line":"port table is updated and the traffic from/to other ports in the firewall group"},{"line_number":89,"context_line":"will not be affected during the updating."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Egress:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_20804546","line":88,"range":{"start_line":87,"start_character":54,"end_line":88,"end_character":21},"in_reply_to":"fa31d9ce_94793eff","updated":"2017-02-13 08:53:33.000000000","message":"No. We decouple ports and rules, so rules will not be updated/deleted when ports is updated/deleted","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":97,"context_line":"Egress Security Group table directly."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"In the firewall rule table, the firewall rules in the firewall group specified"},{"line_number":100,"context_line":"by REG5 are applied to the flow."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* If the action of the rule is allow, the flow will be resubmitted to Egress"},{"line_number":103,"context_line":"  Security Group table"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_f486fad9","line":100,"range":{"start_line":100,"start_character":27,"end_line":100,"end_character":31},"updated":"2017-02-13 02:09:09.000000000","message":"packet?","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"35a733168cce1845a75006d1a82e9c854abe2b93","unresolved":false,"context_lines":[{"line_number":97,"context_line":"Egress Security Group table directly."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"In the firewall rule table, the firewall rules in the firewall group specified"},{"line_number":100,"context_line":"by REG5 are applied to the flow."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* If the action of the rule is allow, the flow will be resubmitted to Egress"},{"line_number":103,"context_line":"  Security Group table"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_00426110","line":100,"range":{"start_line":100,"start_character":27,"end_line":100,"end_character":31},"in_reply_to":"fa31d9ce_f486fad9","updated":"2017-02-13 08:53:33.000000000","message":"Done","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":105,"context_line":"* If the action is drop, the flow will be dropped silently"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"* If the action is reject, the flow should be dropped and an ICMP destination-"},{"line_number":108,"context_line":"  unreachable packet should be sent back. However, Openvswitch does not support"},{"line_number":109,"context_line":"  this action for now, we will just drop the packets silently. Once Openvswitch"},{"line_number":110,"context_line":"  support the reject action, we will fix this."},{"line_number":111,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_3478922b","line":108,"range":{"start_line":108,"start_character":51,"end_line":108,"end_character":62},"updated":"2017-02-13 02:09:09.000000000","message":"nit: OpenvSwitch","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"35a733168cce1845a75006d1a82e9c854abe2b93","unresolved":false,"context_lines":[{"line_number":105,"context_line":"* If the action is drop, the flow will be dropped silently"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"* If the action is reject, the flow should be dropped and an ICMP destination-"},{"line_number":108,"context_line":"  unreachable packet should be sent back. However, Openvswitch does not support"},{"line_number":109,"context_line":"  this action for now, we will just drop the packets silently. Once Openvswitch"},{"line_number":110,"context_line":"  support the reject action, we will fix this."},{"line_number":111,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_2045a516","line":108,"range":{"start_line":108,"start_character":51,"end_line":108,"end_character":62},"in_reply_to":"fa31d9ce_3478922b","updated":"2017-02-13 08:53:33.000000000","message":"Done","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"* If the action is reject, the flow should be dropped and an ICMP destination-"},{"line_number":108,"context_line":"  unreachable packet should be sent back. However, Openvswitch does not support"},{"line_number":109,"context_line":"  this action for now, we will just drop the packets silently. Once Openvswitch"},{"line_number":110,"context_line":"  support the reject action, we will fix this."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"In addition, the Egress Security Group commits the flow to conntrack and the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_5477c639","line":109,"range":{"start_line":109,"start_character":68,"end_line":109,"end_character":79},"updated":"2017-02-13 02:09:09.000000000","message":"ditto","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"35a733168cce1845a75006d1a82e9c854abe2b93","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"* If the action is reject, the flow should be dropped and an ICMP destination-"},{"line_number":108,"context_line":"  unreachable packet should be sent back. However, Openvswitch does not support"},{"line_number":109,"context_line":"  this action for now, we will just drop the packets silently. Once Openvswitch"},{"line_number":110,"context_line":"  support the reject action, we will fix this."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"In addition, the Egress Security Group commits the flow to conntrack and the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_404c5942","line":109,"range":{"start_line":109,"start_character":68,"end_line":109,"end_character":79},"in_reply_to":"fa31d9ce_5477c639","updated":"2017-02-13 08:53:33.000000000","message":"Done","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":"In addition, the Egress Security Group commits the flow to conntrack and the"},{"line_number":113,"context_line":"Egress Connection Tracking table handles flows according the state in"},{"line_number":114,"context_line":"conntrack. So the firewall can reuse the contrack state."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"The pipeline looks like:"},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_948f7e22","line":114,"range":{"start_line":114,"start_character":41,"end_line":114,"end_character":49},"updated":"2017-02-13 02:09:09.000000000","message":"nit: conntrack","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"35a733168cce1845a75006d1a82e9c854abe2b93","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":"In addition, the Egress Security Group commits the flow to conntrack and the"},{"line_number":113,"context_line":"Egress Connection Tracking table handles flows according the state in"},{"line_number":114,"context_line":"conntrack. So the firewall can reuse the contrack state."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"The pipeline looks like:"},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_80e81112","line":114,"range":{"start_line":114,"start_character":41,"end_line":114,"end_character":49},"in_reply_to":"fa31d9ce_948f7e22","updated":"2017-02-13 08:53:33.000000000","message":"Done","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":148,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":" # firewall rule table"},{"line_number":151,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dFwGroup-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":152,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d9800, reg5\u003dFwGroup,ip,nw_dst\u003d192.168.1.10 action\u003dresubmit(,\u003cEGRESS SECURITY GROUP\u003e)"},{"line_number":153,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":154,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_6f16b3f2","line":151,"range":{"start_line":151,"start_character":1,"end_line":151,"end_character":104},"updated":"2017-02-13 02:09:09.000000000","message":"Will this be applied to the first packet of connection(+new-est-rel-inv+trk), or it will be applied to all packets of the connection?\n\nFrom the example, it looks like latter one. But from above the description, it looks like the first one.","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"35a733168cce1845a75006d1a82e9c854abe2b93","unresolved":false,"context_lines":[{"line_number":148,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG5[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":" # firewall rule table"},{"line_number":151,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dFwGroup-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":152,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d9800, reg5\u003dFwGroup,ip,nw_dst\u003d192.168.1.10 action\u003dresubmit(,\u003cEGRESS SECURITY GROUP\u003e)"},{"line_number":153,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":154,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_c0b689db","line":151,"range":{"start_line":151,"start_character":1,"end_line":151,"end_character":104},"in_reply_to":"fa31d9ce_6f16b3f2","updated":"2017-02-13 08:53:33.000000000","message":"I will try to make it more clear","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":212,"context_line":"a list of policies that associated to the rule, and each firewall policy table"},{"line_number":213,"context_line":"contains a list of firewall IDs associated to the policy."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"TODO"},{"line_number":216,"context_line":"\u003d\u003d\u003d\u003d"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"Firewalls support the three actions, allow, drop, reject. But for now,"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_6fe31334","line":215,"range":{"start_line":215,"start_character":0,"end_line":215,"end_character":4},"updated":"2017-02-13 02:09:09.000000000","message":"Is there any link(patch or mail list) for it?","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"35a733168cce1845a75006d1a82e9c854abe2b93","unresolved":false,"context_lines":[{"line_number":212,"context_line":"a list of policies that associated to the rule, and each firewall policy table"},{"line_number":213,"context_line":"contains a list of firewall IDs associated to the policy."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"TODO"},{"line_number":216,"context_line":"\u003d\u003d\u003d\u003d"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"Firewalls support the three actions, allow, drop, reject. But for now,"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_76fda739","line":215,"range":{"start_line":215,"start_character":0,"end_line":215,"end_character":4},"in_reply_to":"fa31d9ce_6fe31334","updated":"2017-02-13 08:53:33.000000000","message":"Done","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"9cc298f9e79415c3d3479e6ab600b48efee2df1c","unresolved":false,"context_lines":[{"line_number":216,"context_line":"\u003d\u003d\u003d\u003d"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"Firewalls support the three actions, allow, drop, reject. But for now,"},{"line_number":219,"context_line":"the reject action is not supported by Openvswitch, so we leave a as a TODO."},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"References"},{"line_number":222,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_b492c249","line":219,"range":{"start_line":219,"start_character":38,"end_line":219,"end_character":49},"updated":"2017-02-13 02:09:09.000000000","message":"nit: OpenvSwitch","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"35a733168cce1845a75006d1a82e9c854abe2b93","unresolved":false,"context_lines":[{"line_number":216,"context_line":"\u003d\u003d\u003d\u003d"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"Firewalls support the three actions, allow, drop, reject. But for now,"},{"line_number":219,"context_line":"the reject action is not supported by Openvswitch, so we leave a as a TODO."},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"References"},{"line_number":222,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa31d9ce_00cb41a6","line":219,"range":{"start_line":219,"start_character":38,"end_line":219,"end_character":49},"in_reply_to":"fa31d9ce_b492c249","updated":"2017-02-13 08:53:33.000000000","message":"Done","commit_id":"bdc95895a7e3342e3f721c9495d2c9817b3638a0"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"6a7688ccb5546e551a95dcd53189666aa7cdf83e","unresolved":false,"context_lines":[{"line_number":97,"context_line":"Egress Security Group table directly."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"In the firewall rule table, the firewall rules in the firewall group specified"},{"line_number":100,"context_line":"by REG5 are applied to the packet."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* If the action of the rule is allow, the flow will be resubmitted to Egress"},{"line_number":103,"context_line":"  Security Group table"}],"source_content_type":"text/x-rst","patch_set":11,"id":"fa31d9ce_18056ebb","line":100,"range":{"start_line":100,"start_character":3,"end_line":100,"end_character":7},"updated":"2017-02-13 18:53:41.000000000","message":"This reg is now taken by router\u0027s unique ID. Maybe select another register to verify there are no collisions? Or can we be certain the two things will not collide? ( https://review.openstack.org/#/c/429602/ )","commit_id":"fa8efa61c4ba354309b5f3ddce9df2b9f28379aa"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"77ade569de874b37dcce5f044895432988c05ea9","unresolved":false,"context_lines":[{"line_number":97,"context_line":"Egress Security Group table directly."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"In the firewall rule table, the firewall rules in the firewall group specified"},{"line_number":100,"context_line":"by REG5 are applied to the packet."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* If the action of the rule is allow, the flow will be resubmitted to Egress"},{"line_number":103,"context_line":"  Security Group table"}],"source_content_type":"text/x-rst","patch_set":11,"id":"fa31d9ce_f7b7a737","line":100,"range":{"start_line":100,"start_character":3,"end_line":100,"end_character":7},"in_reply_to":"fa31d9ce_18056ebb","updated":"2017-02-14 01:23:26.000000000","message":"Thx, I will use Reg4.","commit_id":"fa8efa61c4ba354309b5f3ddce9df2b9f28379aa"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"e5fec451320e7a1f2ba733307e102544629afe51","unresolved":false,"context_lines":[{"line_number":97,"context_line":"Egress Security Group table directly."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"In the firewall rule table, the firewall rules in the firewall group specified"},{"line_number":100,"context_line":"by REG5 are applied to the packet."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* If the action of the rule is allow, the flow will be resubmitted to Egress"},{"line_number":103,"context_line":"  Security Group table"}],"source_content_type":"text/x-rst","patch_set":11,"id":"fa31d9ce_f7040719","line":100,"range":{"start_line":100,"start_character":3,"end_line":100,"end_character":7},"in_reply_to":"fa31d9ce_b77e0f17","updated":"2017-02-14 01:45:35.000000000","message":"Yes, they will not collide. But to make it clear, I prefer to use a new one :)","commit_id":"fa8efa61c4ba354309b5f3ddce9df2b9f28379aa"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"ea623bc3040d42f4e855f6844838f311429777dc","unresolved":false,"context_lines":[{"line_number":97,"context_line":"Egress Security Group table directly."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"In the firewall rule table, the firewall rules in the firewall group specified"},{"line_number":100,"context_line":"by REG5 are applied to the packet."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* If the action of the rule is allow, the flow will be resubmitted to Egress"},{"line_number":103,"context_line":"  Security Group table"}],"source_content_type":"text/x-rst","patch_set":11,"id":"fa31d9ce_b77e0f17","line":100,"range":{"start_line":100,"start_character":3,"end_line":100,"end_character":7},"in_reply_to":"fa31d9ce_f7b7a737","updated":"2017-02-14 01:32:51.000000000","message":"I think they will not collide, router unique id will be used at L2_LOOKUP_TABLE and L3_LOOKUP_TABLE. But it is your choice to use with reg.","commit_id":"fa8efa61c4ba354309b5f3ddce9df2b9f28379aa"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"6a7688ccb5546e551a95dcd53189666aa7cdf83e","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"* If the action is drop, the flow will be dropped silently"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"* If the action is reject, the flow should be dropped and an ICMP destination-"},{"line_number":108,"context_line":"  unreachable packet should be sent back. However, OpenvSwitch does not support"},{"line_number":109,"context_line":"  this action for now, we will just drop the packets silently. Once OpenvSwitch"},{"line_number":110,"context_line":"  support the reject action, we will fix this."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"In addition, the Egress Security Group commits the flow to conntrack and the"},{"line_number":113,"context_line":"Egress Connection Tracking table handles flows according the state in"}],"source_content_type":"text/x-rst","patch_set":11,"id":"fa31d9ce_d896764b","line":110,"range":{"start_line":107,"start_character":0,"end_line":110,"end_character":46},"updated":"2017-02-13 18:53:41.000000000","message":"The infrastructure for this has been added. Is it a lot of work to do this part as well? ( https://github.com/openstack/dragonflow/blob/master/dragonflow/controller/common/icmp_error_generator.py )","commit_id":"fa8efa61c4ba354309b5f3ddce9df2b9f28379aa"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"77ade569de874b37dcce5f044895432988c05ea9","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"* If the action is drop, the flow will be dropped silently"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"* If the action is reject, the flow should be dropped and an ICMP destination-"},{"line_number":108,"context_line":"  unreachable packet should be sent back. However, OpenvSwitch does not support"},{"line_number":109,"context_line":"  this action for now, we will just drop the packets silently. Once OpenvSwitch"},{"line_number":110,"context_line":"  support the reject action, we will fix this."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"In addition, the Egress Security Group commits the flow to conntrack and the"},{"line_number":113,"context_line":"Egress Connection Tracking table handles flows according the state in"}],"source_content_type":"text/x-rst","patch_set":11,"id":"fa31d9ce_b7b1af49","line":110,"range":{"start_line":107,"start_character":0,"end_line":110,"end_character":46},"in_reply_to":"fa31d9ce_d896764b","updated":"2017-02-14 01:23:26.000000000","message":"Great, I think we can do this by packet-out","commit_id":"fa8efa61c4ba354309b5f3ddce9df2b9f28379aa"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"f366a17cfb43a7a496031cebf70e68c54e165a79","unresolved":false,"context_lines":[{"line_number":143,"context_line":"::"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":" # firewall port table"},{"line_number":146,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d-new+est-rel-inv+trk actions\u003dresubmit(,9)"},{"line_number":147,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d-new+rel-inv+trk actions\u003dresubmit(,9)"},{"line_number":148,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+new+rel-inv+trk,ip actions\u003dct(commit,table\u003d9,zone\u003dNXM_NX_CT_ZONE[])"},{"line_number":149,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+inv+trk actions\u003ddrop"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_4bbfb5a9","line":148,"range":{"start_line":146,"start_character":0,"end_line":148,"end_character":130},"updated":"2017-02-15 03:28:36.000000000","message":"I think the state filter belongs to firewall rule table. And note that the table id has been updated recently.","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"60ba669fbf3d74e62ea68e4ec35bf3398d42011d","unresolved":false,"context_lines":[{"line_number":143,"context_line":"::"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":" # firewall port table"},{"line_number":146,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d-new+est-rel-inv+trk actions\u003dresubmit(,9)"},{"line_number":147,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d-new+rel-inv+trk actions\u003dresubmit(,9)"},{"line_number":148,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+new+rel-inv+trk,ip actions\u003dct(commit,table\u003d9,zone\u003dNXM_NX_CT_ZONE[])"},{"line_number":149,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+inv+trk actions\u003ddrop"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_f7ea0ada","line":148,"range":{"start_line":146,"start_character":0,"end_line":148,"end_character":130},"in_reply_to":"fa31d9ce_4bbfb5a9","updated":"2017-02-15 06:26:36.000000000","message":"I think either port table or rule table is OK. But we need to filter the state as early as possible, so I choose port table. Why do you think it belongs to rule table?","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"6c4b02ce90a2cedc55a220291d03b90a4005847b","unresolved":false,"context_lines":[{"line_number":143,"context_line":"::"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":" # firewall port table"},{"line_number":146,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d-new+est-rel-inv+trk actions\u003dresubmit(,9)"},{"line_number":147,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d-new+rel-inv+trk actions\u003dresubmit(,9)"},{"line_number":148,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+new+rel-inv+trk,ip actions\u003dct(commit,table\u003d9,zone\u003dNXM_NX_CT_ZONE[])"},{"line_number":149,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+inv+trk actions\u003ddrop"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_e95a2ef1","line":148,"range":{"start_line":146,"start_character":0,"end_line":148,"end_character":130},"in_reply_to":"fa31d9ce_57ed96b5","updated":"2017-02-15 07:01:11.000000000","message":"I still prefer the port table. Once we can filter the flows by state, we do not need to identify the firewall group.","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"84ce0d09a676a1705ac12b76dde162407632625e","unresolved":false,"context_lines":[{"line_number":143,"context_line":"::"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":" # firewall port table"},{"line_number":146,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d-new+est-rel-inv+trk actions\u003dresubmit(,9)"},{"line_number":147,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d-new+rel-inv+trk actions\u003dresubmit(,9)"},{"line_number":148,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+new+rel-inv+trk,ip actions\u003dct(commit,table\u003d9,zone\u003dNXM_NX_CT_ZONE[])"},{"line_number":149,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+inv+trk actions\u003ddrop"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_57ed96b5","line":148,"range":{"start_line":146,"start_character":0,"end_line":148,"end_character":130},"in_reply_to":"fa31d9ce_f7ea0ada","updated":"2017-02-15 06:34:57.000000000","message":"I think the rule table is where the packets are filtered. While the firewall port table is where the firewall is identified.","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"f366a17cfb43a7a496031cebf70e68c54e165a79","unresolved":false,"context_lines":[{"line_number":152,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG4[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":" # firewall rule table"},{"line_number":155,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dFwGroup-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":156,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d9800, reg5\u003dFwGroup,ip,nw_dst\u003d192.168.1.10 action\u003dresubmit(,\u003cEGRESS SECURITY GROUP\u003e)"},{"line_number":157,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":158,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_4b717543","line":155,"range":{"start_line":155,"start_character":54,"end_line":155,"end_character":58},"updated":"2017-02-15 03:28:36.000000000","message":"it is still reg5 here.","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"60ba669fbf3d74e62ea68e4ec35bf3398d42011d","unresolved":false,"context_lines":[{"line_number":152,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG4[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":" # firewall rule table"},{"line_number":155,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dFwGroup-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":156,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d9800, reg5\u003dFwGroup,ip,nw_dst\u003d192.168.1.10 action\u003dresubmit(,\u003cEGRESS SECURITY GROUP\u003e)"},{"line_number":157,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":158,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_57ecb6f2","line":155,"range":{"start_line":155,"start_character":54,"end_line":155,"end_character":58},"in_reply_to":"fa31d9ce_4b717543","updated":"2017-02-15 06:26:36.000000000","message":"will do","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"f366a17cfb43a7a496031cebf70e68c54e165a79","unresolved":false,"context_lines":[{"line_number":153,"context_line":""},{"line_number":154,"context_line":" # firewall rule table"},{"line_number":155,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dFwGroup-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":156,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d9800, reg5\u003dFwGroup,ip,nw_dst\u003d192.168.1.10 action\u003dresubmit(,\u003cEGRESS SECURITY GROUP\u003e)"},{"line_number":157,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"The priority of the flow entry in firewall rule table is corresponding to the"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_6b92b94d","line":156,"range":{"start_line":156,"start_character":53,"end_line":156,"end_character":57},"updated":"2017-02-15 03:28:36.000000000","message":"ditto","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"60ba669fbf3d74e62ea68e4ec35bf3398d42011d","unresolved":false,"context_lines":[{"line_number":153,"context_line":""},{"line_number":154,"context_line":" # firewall rule table"},{"line_number":155,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d10000, reg5\u003dFwGroup-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":156,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d9800, reg5\u003dFwGroup,ip,nw_dst\u003d192.168.1.10 action\u003dresubmit(,\u003cEGRESS SECURITY GROUP\u003e)"},{"line_number":157,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"The priority of the flow entry in firewall rule table is corresponding to the"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_f7d12a24","line":156,"range":{"start_line":156,"start_character":53,"end_line":156,"end_character":57},"in_reply_to":"fa31d9ce_6b92b94d","updated":"2017-02-15 06:26:36.000000000","message":"will do","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"f366a17cfb43a7a496031cebf70e68c54e165a79","unresolved":false,"context_lines":[{"line_number":199,"context_line":"                actions\u003dload:GRP-KEY-\u003eNXM_NX_REG4[], resubmit(,\u003cFW EGRESS RULE\u003e)"},{"line_number":200,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS PORT\u003e, priority\u003d1, actions\u003dresubmit(,\u003cSec-Grp\u003e)"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":" # rule table"},{"line_number":203,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS RULE\u003e, priority\u003d10000, reg5\u003dGRP-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":204,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":205,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_abe671e5","line":202,"range":{"start_line":202,"start_character":0,"end_line":202,"end_character":13},"updated":"2017-02-15 03:28:36.000000000","message":"There should be state filter here, right?","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"f366a17cfb43a7a496031cebf70e68c54e165a79","unresolved":false,"context_lines":[{"line_number":200,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS PORT\u003e, priority\u003d1, actions\u003dresubmit(,\u003cSec-Grp\u003e)"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":" # rule table"},{"line_number":203,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS RULE\u003e, priority\u003d10000, reg5\u003dGRP-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":204,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"NB Data Model Impact"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_4b9a556f","line":203,"range":{"start_line":203,"start_character":55,"end_line":203,"end_character":59},"updated":"2017-02-15 03:28:36.000000000","message":"ditto","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"60ba669fbf3d74e62ea68e4ec35bf3398d42011d","unresolved":false,"context_lines":[{"line_number":200,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS PORT\u003e, priority\u003d1, actions\u003dresubmit(,\u003cSec-Grp\u003e)"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":" # rule table"},{"line_number":203,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS RULE\u003e, priority\u003d10000, reg5\u003dGRP-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"},{"line_number":204,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS RULE\u003e, priority\u003d1, actions\u003ddrop"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"NB Data Model Impact"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa31d9ce_174a3e26","line":203,"range":{"start_line":203,"start_character":55,"end_line":203,"end_character":59},"in_reply_to":"fa31d9ce_4b9a556f","updated":"2017-02-15 06:26:36.000000000","message":"will do","commit_id":"6747b06b755f804d67a4ae3749f12f71fe800864"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"2b4f74a3ef453fa81f8666ee464918224e63d11a","unresolved":false,"context_lines":[{"line_number":148,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+new+rel-inv+trk,ip actions\u003dct(commit,table\u003d9,zone\u003dNXM_NX_CT_ZONE[])"},{"line_number":149,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+inv+trk actions\u003ddrop"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":152,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG4[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":" # firewall rule table"}],"source_content_type":"text/x-rst","patch_set":16,"id":"da36d5c6_c7702cdf","line":151,"range":{"start_line":151,"start_character":0,"end_line":151,"end_character":75},"updated":"2017-02-23 02:25:41.000000000","message":"If you are going to add state filter at port table, then this rule should match the new state, +new-est-rel-inv+trk","commit_id":"3ed444144b82b7b40aa43bb5451189bcb267fb8e"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"7daa6b37a86978d8d54936d320e05e5c221796ea","unresolved":false,"context_lines":[{"line_number":148,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+new+rel-inv+trk,ip actions\u003dct(commit,table\u003d9,zone\u003dNXM_NX_CT_ZONE[])"},{"line_number":149,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d65534,ct_state\u003d+inv+trk actions\u003ddrop"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW EGRESS PORT\u003e, priority\u003d100,dl_dst\u003drouter_inf_mac,ip"},{"line_number":152,"context_line":"                actions\u003dload:FwGroup-KEY-\u003eNXM_NX_REG4[], resubmit(,\u003cFW INGRESS RULE\u003e)"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":" # firewall rule table"}],"source_content_type":"text/x-rst","patch_set":16,"id":"9a30ddce_3a3e8d8c","line":151,"range":{"start_line":151,"start_character":0,"end_line":151,"end_character":75},"in_reply_to":"da36d5c6_c7702cdf","updated":"2017-03-09 12:15:25.000000000","message":"Done","commit_id":"3ed444144b82b7b40aa43bb5451189bcb267fb8e"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"2b4f74a3ef453fa81f8666ee464918224e63d11a","unresolved":false,"context_lines":[{"line_number":195,"context_line":"::"},{"line_number":196,"context_line":""},{"line_number":197,"context_line":" # firewall group table"},{"line_number":198,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS PORT\u003e, priority\u003d100,dl_src\u003drouter_inf_mac, ip"},{"line_number":199,"context_line":"                actions\u003dload:GRP-KEY-\u003eNXM_NX_REG4[], resubmit(,\u003cFW EGRESS RULE\u003e)"},{"line_number":200,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS PORT\u003e, priority\u003d1, actions\u003dresubmit(,\u003cSec-Grp\u003e)"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":" # rule table"},{"line_number":203,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS RULE\u003e, priority\u003d10000, reg4\u003dGRP-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"}],"source_content_type":"text/x-rst","patch_set":16,"id":"da36d5c6_a710985a","line":200,"range":{"start_line":198,"start_character":0,"end_line":200,"end_character":79},"updated":"2017-02-23 02:25:41.000000000","message":"missing state description here.","commit_id":"3ed444144b82b7b40aa43bb5451189bcb267fb8e"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"7daa6b37a86978d8d54936d320e05e5c221796ea","unresolved":false,"context_lines":[{"line_number":195,"context_line":"::"},{"line_number":196,"context_line":""},{"line_number":197,"context_line":" # firewall group table"},{"line_number":198,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS PORT\u003e, priority\u003d100,dl_src\u003drouter_inf_mac, ip"},{"line_number":199,"context_line":"                actions\u003dload:GRP-KEY-\u003eNXM_NX_REG4[], resubmit(,\u003cFW EGRESS RULE\u003e)"},{"line_number":200,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS PORT\u003e, priority\u003d1, actions\u003dresubmit(,\u003cSec-Grp\u003e)"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":" # rule table"},{"line_number":203,"context_line":" cookie\u003d0xXX, table\u003d\u003cFW INGRESS RULE\u003e, priority\u003d10000, reg4\u003dGRP-KEY,ip,nw_src\u003d192.168.0.4 action\u003ddrop"}],"source_content_type":"text/x-rst","patch_set":16,"id":"9a30ddce_57423c69","line":200,"range":{"start_line":198,"start_character":0,"end_line":200,"end_character":79},"in_reply_to":"da36d5c6_a710985a","updated":"2017-03-09 12:15:25.000000000","message":"Done","commit_id":"3ed444144b82b7b40aa43bb5451189bcb267fb8e"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"a64428c0ab33aa97de00257633b69ded6c0d4f05","unresolved":false,"context_lines":[{"line_number":216,"context_line":"a list of policies that associated to the rule, and each firewall policy table"},{"line_number":217,"context_line":"contains a list of firewall IDs associated to the policy."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"TODO"},{"line_number":220,"context_line":"\u003d\u003d\u003d\u003d"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Implement reject action by OpenFlow entry once OpenvSwitch can support it."}],"source_content_type":"text/x-rst","patch_set":16,"id":"9a30ddce_22a5f603","line":219,"range":{"start_line":219,"start_character":0,"end_line":219,"end_character":4},"updated":"2017-03-07 08:49:41.000000000","message":"I don\u0027t think this title is accurate anymore. Possibly \u0027Future Work\u0027","commit_id":"3ed444144b82b7b40aa43bb5451189bcb267fb8e"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"2b4f74a3ef453fa81f8666ee464918224e63d11a","unresolved":false,"context_lines":[{"line_number":219,"context_line":"TODO"},{"line_number":220,"context_line":"\u003d\u003d\u003d\u003d"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Implement reject action by OpenFlow entry once OpenvSwitch can support it."},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"References"},{"line_number":225,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":16,"id":"da36d5c6_671a207f","line":222,"range":{"start_line":222,"start_character":0,"end_line":222,"end_character":74},"updated":"2017-02-23 02:25:41.000000000","message":"Maybe I bring this question before, is there any link for this work so that we can track it? I doubt that openflow can do such thing, I can\u0027t find related description from openflow 1.3 specification.","commit_id":"3ed444144b82b7b40aa43bb5451189bcb267fb8e"},{"author":{"_account_id":9044,"name":"Will","email":"wangjian.ika@bytedance.com","username":"Will"},"change_message_id":"7daa6b37a86978d8d54936d320e05e5c221796ea","unresolved":false,"context_lines":[{"line_number":219,"context_line":"TODO"},{"line_number":220,"context_line":"\u003d\u003d\u003d\u003d"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Implement reject action by OpenFlow entry once OpenvSwitch can support it."},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"References"},{"line_number":225,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":16,"id":"9a30ddce_f72a508f","line":222,"range":{"start_line":222,"start_character":0,"end_line":222,"end_character":74},"in_reply_to":"da36d5c6_671a207f","updated":"2017-03-09 12:15:25.000000000","message":"@Omer, @Hong Hui Xiao， there is not link for this work. I will remove this section","commit_id":"3ed444144b82b7b40aa43bb5451189bcb267fb8e"}],"wj.txt":[{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"2b4f74a3ef453fa81f8666ee464918224e63d11a","unresolved":false,"context_lines":[{"line_number":1,"context_line":":spell"},{"line_number":2,"context_line":"z\u003d"},{"line_number":3,"context_line":":spellr"},{"line_number":4,"context_line":"u   ctrl-r"}],"source_content_type":"text/plain","patch_set":16,"id":"da36d5c6_478fdccb","line":1,"updated":"2017-02-23 02:25:41.000000000","message":"what is this :)?","commit_id":"3ed444144b82b7b40aa43bb5451189bcb267fb8e"}]}