)]}'
{"networking_ovn/common/config.py":[{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"78b78b768476e303f79a2f67703be862ee47081d","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    cfg.BoolOpt(\u0027ovn_l3_mode\u0027,"},{"line_number":41,"context_line":"                default\u003dFalse,"},{"line_number":42,"context_line":"                help\u003d_(\u0027Whether to use OVN L3 support\u0027)),"},{"line_number":43,"context_line":"    cfg.BoolOpt(\u0027remote_group_match_ip\u0027,"},{"line_number":44,"context_line":"                default\u003dTrue,"},{"line_number":45,"context_line":"                help\u003d_(\u0027When remote_group_id is specified, match remote IP \u0027"},{"line_number":46,"context_line":"                       \u0027rather than OVN port name. This is required for \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa69d971_387e756a","line":43,"updated":"2016-01-06 21:13:44.000000000","message":"I don\u0027t think we should expose this option to change the behavior of this as it changes how the underlying security groups work. We should just be consistent with how neutron/aws handles this.","commit_id":"68dc2685d00acca939813b482fc0b5558e1f743c"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"230ea1ae1720892404f806c8f752572071f84474","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    cfg.BoolOpt(\u0027ovn_l3_mode\u0027,"},{"line_number":41,"context_line":"                default\u003dFalse,"},{"line_number":42,"context_line":"                help\u003d_(\u0027Whether to use OVN L3 support\u0027)),"},{"line_number":43,"context_line":"    cfg.BoolOpt(\u0027remote_group_match_ip\u0027,"},{"line_number":44,"context_line":"                default\u003dTrue,"},{"line_number":45,"context_line":"                help\u003d_(\u0027When remote_group_id is specified, match remote IP \u0027"},{"line_number":46,"context_line":"                       \u0027rather than OVN port name. This is required for \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa69d971_4af4a459","line":43,"in_reply_to":"fa69d971_0f59de34","updated":"2016-01-07 01:11:09.000000000","message":"Yes, for example, port-based solution doesn\u0027t need to update anything when IP address changes on a port.","commit_id":"68dc2685d00acca939813b482fc0b5558e1f743c"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"dda5418b32099be869cef69296135ae924ee8b6f","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    cfg.BoolOpt(\u0027ovn_l3_mode\u0027,"},{"line_number":41,"context_line":"                default\u003dFalse,"},{"line_number":42,"context_line":"                help\u003d_(\u0027Whether to use OVN L3 support\u0027)),"},{"line_number":43,"context_line":"    cfg.BoolOpt(\u0027remote_group_match_ip\u0027,"},{"line_number":44,"context_line":"                default\u003dTrue,"},{"line_number":45,"context_line":"                help\u003d_(\u0027When remote_group_id is specified, match remote IP \u0027"},{"line_number":46,"context_line":"                       \u0027rather than OVN port name. This is required for \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa69d971_0f59de34","line":43,"in_reply_to":"fa69d971_1e29168a","updated":"2016-01-07 00:29:53.000000000","message":"This is how the aws security group rules work (and also nova-network). \n\nWhy does it achieve better performance?  because it has to update less things?","commit_id":"68dc2685d00acca939813b482fc0b5558e1f743c"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"bd337c568fcb8e5ef936b1345c4278e4c2d1d9d9","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    cfg.BoolOpt(\u0027ovn_l3_mode\u0027,"},{"line_number":41,"context_line":"                default\u003dFalse,"},{"line_number":42,"context_line":"                help\u003d_(\u0027Whether to use OVN L3 support\u0027)),"},{"line_number":43,"context_line":"    cfg.BoolOpt(\u0027remote_group_match_ip\u0027,"},{"line_number":44,"context_line":"                default\u003dTrue,"},{"line_number":45,"context_line":"                help\u003d_(\u0027When remote_group_id is specified, match remote IP \u0027"},{"line_number":46,"context_line":"                       \u0027rather than OVN port name. This is required for \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa69d971_1e29168a","line":43,"in_reply_to":"fa69d971_387e756a","updated":"2016-01-06 23:11:26.000000000","message":"I was thinking that it would be better to keep the port-based solution as an option so that user can use it to achieve better performance if they are sure that there is no cross-network remote-group requirement in their deployment. And we set the default behaviour as IP based for correctness, and use should be clear about what they are doing when change the option. Isn\u0027t it good?\n\nIn fact, I didn\u0027t find any specification for the remote-group requirement for cross-networks. One could even argue that the remote port is the router port for cross-network traffic. Do you know any pointer to specify this for Neutron?","commit_id":"68dc2685d00acca939813b482fc0b5558e1f743c"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"f72424f05467267195490d94be77f4e83ddae690","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                      \u0027 that are no longer in Neutron.\u0027)),"},{"line_number":40,"context_line":"    cfg.BoolOpt(\u0027ovn_l3_mode\u0027,"},{"line_number":41,"context_line":"                default\u003dFalse,"},{"line_number":42,"context_line":"                help\u003d_(\u0027Whether to use OVN L3 support\u0027))"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"cfg.CONF.register_opts(ovn_opts, group\u003d\u0027ovn\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa69d971_a9bdfd03","line":42,"updated":"2016-01-07 22:47:51.000000000","message":"whoops unneeed , drop.","commit_id":"0135107dcacb86f1571cd83da44d910f73474fbd"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"76642eb8f0740215e418ff0052a84f48a30003bd","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                      \u0027 that are no longer in Neutron.\u0027)),"},{"line_number":40,"context_line":"    cfg.BoolOpt(\u0027ovn_l3_mode\u0027,"},{"line_number":41,"context_line":"                default\u003dFalse,"},{"line_number":42,"context_line":"                help\u003d_(\u0027Whether to use OVN L3 support\u0027))"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"cfg.CONF.register_opts(ovn_opts, group\u003d\u0027ovn\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa69d971_9a863964","line":42,"in_reply_to":"fa69d971_a9bdfd03","updated":"2016-01-07 23:41:08.000000000","message":"whoops, do you want me to restore the \u0027,\u0027?","commit_id":"0135107dcacb86f1571cd83da44d910f73474fbd"},{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"26e72692c04fb57c61c377892e858b9c638ae561","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                      \u0027 that are no longer in Neutron.\u0027)),"},{"line_number":40,"context_line":"    cfg.BoolOpt(\u0027ovn_l3_mode\u0027,"},{"line_number":41,"context_line":"                default\u003dFalse,"},{"line_number":42,"context_line":"                help\u003d_(\u0027Whether to use OVN L3 support\u0027))"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"cfg.CONF.register_opts(ovn_opts, group\u003d\u0027ovn\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa69d971_26af8b2b","line":42,"updated":"2016-01-10 14:42:48.000000000","message":"in general the comma is used so that the next time someone adds a value it will not have a diff over two lines.\nthis is unrelated to this patch","commit_id":"b079150981b7564151283d43e772b102b491052a"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"178aaca82d9d4937f127ee51c9ca4a81d42c231e","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                      \u0027 that are no longer in Neutron.\u0027)),"},{"line_number":40,"context_line":"    cfg.BoolOpt(\u0027ovn_l3_mode\u0027,"},{"line_number":41,"context_line":"                default\u003dFalse,"},{"line_number":42,"context_line":"                help\u003d_(\u0027Whether to use OVN L3 support\u0027))"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"cfg.CONF.register_opts(ovn_opts, group\u003d\u0027ovn\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa69d971_6bad4b83","line":42,"in_reply_to":"fa69d971_26af8b2b","updated":"2016-01-10 21:03:49.000000000","message":"Done","commit_id":"b079150981b7564151283d43e772b102b491052a"}],"networking_ovn/plugin.py":[{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"78b78b768476e303f79a2f67703be862ee47081d","unresolved":false,"context_lines":[{"line_number":500,"context_line":"        ip_version_map \u003d {\u0027ip4\u0027: 4,"},{"line_number":501,"context_line":"                          \u0027ip6\u0027: 6}"},{"line_number":502,"context_line":"        match \u003d \u0027\u0027"},{"line_number":503,"context_line":"        for sg_port in sg_ports:"},{"line_number":504,"context_line":"            port \u003d self.get_port(context, sg_port[\u0027port_id\u0027])"},{"line_number":505,"context_line":"            if port:"},{"line_number":506,"context_line":"                for fixed_ip in port[\u0027fixed_ips\u0027]:"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa69d971_587c89eb","line":503,"updated":"2016-01-06 21:13:44.000000000","message":"I think we could better optimize this loop.  Currently it\u0027s querying for each port as we loop though and then for each subnet. \n\nI think you can do the following to get all the ports in one query to optimize that. \n\nports \u003d self.get_ports(context, filters\u003d{id: [sg_port[\u0027id\u0027] in sg_ports]})\n\nYou can also use a similar caching thing for the subnet that Russell did above to avoid having to fetch those each time.\n\n\nIf you prefer i\u0027m okay with putting a FIXME in here so we can at least have the correct behavior and then optimize this later.","commit_id":"68dc2685d00acca939813b482fc0b5558e1f743c"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"bd337c568fcb8e5ef936b1345c4278e4c2d1d9d9","unresolved":false,"context_lines":[{"line_number":500,"context_line":"        ip_version_map \u003d {\u0027ip4\u0027: 4,"},{"line_number":501,"context_line":"                          \u0027ip6\u0027: 6}"},{"line_number":502,"context_line":"        match \u003d \u0027\u0027"},{"line_number":503,"context_line":"        for sg_port in sg_ports:"},{"line_number":504,"context_line":"            port \u003d self.get_port(context, sg_port[\u0027port_id\u0027])"},{"line_number":505,"context_line":"            if port:"},{"line_number":506,"context_line":"                for fixed_ip in port[\u0027fixed_ips\u0027]:"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa69d971_de7a9e76","line":503,"in_reply_to":"fa69d971_587c89eb","updated":"2016-01-06 23:11:26.000000000","message":"Thanks for the suggestion. I will optimize it in set2","commit_id":"68dc2685d00acca939813b482fc0b5558e1f743c"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"f72424f05467267195490d94be77f4e83ddae690","unresolved":false,"context_lines":[{"line_number":499,"context_line":"                          \u0027ip6\u0027: 6}"},{"line_number":500,"context_line":"        match \u003d \u0027\u0027"},{"line_number":501,"context_line":"        port_ids \u003d [sg_port[\u0027port_id\u0027] for sg_port in sg_ports]"},{"line_number":502,"context_line":"        ports \u003d self.get_ports(context, filters\u003d{\u0027id\u0027: port_ids})"},{"line_number":503,"context_line":"        for port in ports:"},{"line_number":504,"context_line":"            for fixed_ip in port[\u0027fixed_ips\u0027]:"},{"line_number":505,"context_line":"                subnet \u003d self._acl_get_subnet_from_cache(context,"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa69d971_290eede5","line":502,"updated":"2016-01-07 22:47:51.000000000","message":"nit: we could also optimize fetching all the subnets at once here from getting the set() of setups from the ports above. This would allow us to get everything from the db in one query.","commit_id":"0135107dcacb86f1571cd83da44d910f73474fbd"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"76642eb8f0740215e418ff0052a84f48a30003bd","unresolved":false,"context_lines":[{"line_number":499,"context_line":"                          \u0027ip6\u0027: 6}"},{"line_number":500,"context_line":"        match \u003d \u0027\u0027"},{"line_number":501,"context_line":"        port_ids \u003d [sg_port[\u0027port_id\u0027] for sg_port in sg_ports]"},{"line_number":502,"context_line":"        ports \u003d self.get_ports(context, filters\u003d{\u0027id\u0027: port_ids})"},{"line_number":503,"context_line":"        for port in ports:"},{"line_number":504,"context_line":"            for fixed_ip in port[\u0027fixed_ips\u0027]:"},{"line_number":505,"context_line":"                subnet \u003d self._acl_get_subnet_from_cache(context,"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa69d971_ba61bdd5","line":502,"in_reply_to":"fa69d971_290eede5","updated":"2016-01-07 23:41:08.000000000","message":"Aaron, sorry that I don\u0027t understand. In this version subnets are already cached outside of this function. There will be only one query for each subnet overall, and the number of subnets is far less than number of ports, so I think this is the most optimized approach already. Could you give more details of how would you do it?","commit_id":"0135107dcacb86f1571cd83da44d910f73474fbd"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"b7fdcdec4f0d40dd4043576fdc76bef687af7bcc","unresolved":false,"context_lines":[{"line_number":499,"context_line":"                          \u0027ip6\u0027: 6}"},{"line_number":500,"context_line":"        match \u003d \u0027\u0027"},{"line_number":501,"context_line":"        port_ids \u003d [sg_port[\u0027port_id\u0027] for sg_port in sg_ports]"},{"line_number":502,"context_line":"        ports \u003d self.get_ports(context, filters\u003d{\u0027id\u0027: port_ids})"},{"line_number":503,"context_line":"        for port in ports:"},{"line_number":504,"context_line":"            for fixed_ip in port[\u0027fixed_ips\u0027]:"},{"line_number":505,"context_line":"                subnet \u003d self._acl_get_subnet_from_cache(context,"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa69d971_056e1a2f","line":502,"in_reply_to":"fa69d971_ba61bdd5","updated":"2016-01-08 18:36:39.000000000","message":"i was just saying we could optimize the subnet caching more doing a query like above. That said, I think this should be done in a different patch anyways.","commit_id":"0135107dcacb86f1571cd83da44d910f73474fbd"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"f72424f05467267195490d94be77f4e83ddae690","unresolved":false,"context_lines":[{"line_number":505,"context_line":"                subnet \u003d self._acl_get_subnet_from_cache(context,"},{"line_number":506,"context_line":"                                                         subnet_cache,"},{"line_number":507,"context_line":"                                                         fixed_ip[\u0027subnet_id\u0027])"},{"line_number":508,"context_line":"                if subnet[\u0027ip_version\u0027] \u003d\u003d ip_version_map.get(ip):"},{"line_number":509,"context_line":"                    match +\u003d \u0027%s.%s \u003d\u003d %s || \u0027 % (ip,"},{"line_number":510,"context_line":"                                                  src_or_dst,"},{"line_number":511,"context_line":"                                                  fixed_ip[\u0027ip_address\u0027])"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa69d971_4c724faf","line":508,"updated":"2016-01-07 22:47:51.000000000","message":"nit: I\u0027d add a comment here that says only add rule if subnet_ip_version matches ip version. That said, this code took me a little time to understand as I didn\u0027t realize that ip being passed around was ip_version. I\u0027ll push to review that renames ip -\u003e ip_version which would have made this more understandable to me.","commit_id":"0135107dcacb86f1571cd83da44d910f73474fbd"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"76642eb8f0740215e418ff0052a84f48a30003bd","unresolved":false,"context_lines":[{"line_number":505,"context_line":"                subnet \u003d self._acl_get_subnet_from_cache(context,"},{"line_number":506,"context_line":"                                                         subnet_cache,"},{"line_number":507,"context_line":"                                                         fixed_ip[\u0027subnet_id\u0027])"},{"line_number":508,"context_line":"                if subnet[\u0027ip_version\u0027] \u003d\u003d ip_version_map.get(ip):"},{"line_number":509,"context_line":"                    match +\u003d \u0027%s.%s \u003d\u003d %s || \u0027 % (ip,"},{"line_number":510,"context_line":"                                                  src_or_dst,"},{"line_number":511,"context_line":"                                                  fixed_ip[\u0027ip_address\u0027])"}],"source_content_type":"text/x-python","patch_set":3,"id":"fa69d971_7a9a65c7","line":508,"in_reply_to":"fa69d971_4c724faf","updated":"2016-01-07 23:41:08.000000000","message":"ok","commit_id":"0135107dcacb86f1571cd83da44d910f73474fbd"},{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"26e72692c04fb57c61c377892e858b9c638ae561","unresolved":false,"context_lines":[{"line_number":495,"context_line":""},{"line_number":496,"context_line":"    def _acl_remote_match_ip(self, context, sg_ports, subnet_cache,"},{"line_number":497,"context_line":"                             ip, src_or_dst):"},{"line_number":498,"context_line":"        ip_version_map \u003d {\u0027ip4\u0027: 4,"},{"line_number":499,"context_line":"                          \u0027ip6\u0027: 6}"},{"line_number":500,"context_line":"        match \u003d \u0027\u0027"},{"line_number":501,"context_line":"        port_ids \u003d [sg_port[\u0027port_id\u0027] for sg_port in sg_ports]"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa69d971_a6693bfb","line":498,"updated":"2016-01-10 14:42:48.000000000","message":"would it be worth while creating this at __init__ say for example self._ip_version_map?","commit_id":"b079150981b7564151283d43e772b102b491052a"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"178aaca82d9d4937f127ee51c9ca4a81d42c231e","unresolved":false,"context_lines":[{"line_number":495,"context_line":""},{"line_number":496,"context_line":"    def _acl_remote_match_ip(self, context, sg_ports, subnet_cache,"},{"line_number":497,"context_line":"                             ip, src_or_dst):"},{"line_number":498,"context_line":"        ip_version_map \u003d {\u0027ip4\u0027: 4,"},{"line_number":499,"context_line":"                          \u0027ip6\u0027: 6}"},{"line_number":500,"context_line":"        match \u003d \u0027\u0027"},{"line_number":501,"context_line":"        port_ids \u003d [sg_port[\u0027port_id\u0027] for sg_port in sg_ports]"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa69d971_a896e9ed","line":498,"in_reply_to":"fa69d971_a6693bfb","updated":"2016-01-10 21:03:49.000000000","message":"I\u0027d prefer creating an utils function to do it, but let\u0027s keep it here until this same logic is needed somewhere else.","commit_id":"b079150981b7564151283d43e772b102b491052a"},{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"26e72692c04fb57c61c377892e858b9c638ae561","unresolved":false,"context_lines":[{"line_number":499,"context_line":"                          \u0027ip6\u0027: 6}"},{"line_number":500,"context_line":"        match \u003d \u0027\u0027"},{"line_number":501,"context_line":"        port_ids \u003d [sg_port[\u0027port_id\u0027] for sg_port in sg_ports]"},{"line_number":502,"context_line":"        ports \u003d self.get_ports(context, filters\u003d{\u0027id\u0027: port_ids})"},{"line_number":503,"context_line":"        for port in ports:"},{"line_number":504,"context_line":"            for fixed_ip in port[\u0027fixed_ips\u0027]:"},{"line_number":505,"context_line":"                subnet \u003d self._acl_get_subnet_from_cache(context,"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa69d971_666fc3fc","line":502,"updated":"2016-01-10 14:42:48.000000000","message":"could there be a case where we need the elevated context here?","commit_id":"b079150981b7564151283d43e772b102b491052a"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"178aaca82d9d4937f127ee51c9ca4a81d42c231e","unresolved":false,"context_lines":[{"line_number":499,"context_line":"                          \u0027ip6\u0027: 6}"},{"line_number":500,"context_line":"        match \u003d \u0027\u0027"},{"line_number":501,"context_line":"        port_ids \u003d [sg_port[\u0027port_id\u0027] for sg_port in sg_ports]"},{"line_number":502,"context_line":"        ports \u003d self.get_ports(context, filters\u003d{\u0027id\u0027: port_ids})"},{"line_number":503,"context_line":"        for port in ports:"},{"line_number":504,"context_line":"            for fixed_ip in port[\u0027fixed_ips\u0027]:"},{"line_number":505,"context_line":"                subnet \u003d self._acl_get_subnet_from_cache(context,"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa69d971_abb7c3d6","line":502,"in_reply_to":"fa69d971_666fc3fc","updated":"2016-01-10 21:03:49.000000000","message":"Good catch!! In fact, elevated context is required when we start remote-group-id handling when doing port_create/update/delete.\n\nThis deserves a new bug since it is not directly related to the purpose of this patch (the bug should have already existed by matching port-name)","commit_id":"b079150981b7564151283d43e772b102b491052a"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"178aaca82d9d4937f127ee51c9ca4a81d42c231e","unresolved":false,"context_lines":[{"line_number":817,"context_line":"        # we\u0027re deleting.  However, it\u0027s harmless to leave it for now and saves"},{"line_number":818,"context_line":"        # some additional churn in the OVN db.  References to this port will"},{"line_number":819,"context_line":"        # get automatically removed the next time something else triggers a"},{"line_number":820,"context_line":"        # refresh of ACLs for ports on that security group."},{"line_number":821,"context_line":""},{"line_number":822,"context_line":"        with context.session.begin(subtransactions\u003dTrue):"},{"line_number":823,"context_line":"            self.disassociate_floatingips(context, port_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa69d971_cbbc77bd","line":820,"updated":"2016-01-10 21:03:49.000000000","message":"This is not true any more when matching with IP. If we do not refresh the related ACLs, when a new port is created with same IP but without joining the same group can still accessing other ports in the group. This would be a security hole.\n\nI will provide next patch set to fix it.","commit_id":"b079150981b7564151283d43e772b102b491052a"},{"author":{"_account_id":1561,"name":"Russell Bryant","email":"rbryant@redhat.com","username":"russellb"},"change_message_id":"b8f957825dcf4af947b0171c1d50cb1269958fe5","unresolved":false,"context_lines":[{"line_number":318,"context_line":"                context, sg_id,"},{"line_number":319,"context_line":"                sg_ports_cache\u003dsg_ports_cache,"},{"line_number":320,"context_line":"                exclude_ports\u003d[port[\u0027id\u0027]],"},{"line_number":321,"context_line":"                subnet_cache\u003dsubnet_cache)"},{"line_number":322,"context_line":""},{"line_number":323,"context_line":"        # Refresh remote security groups if remote_group_match_ip is set"},{"line_number":324,"context_line":"        if original_port.get(\u0027fixed_ips\u0027) !\u003d port.get(\u0027fixed_ips\u0027):"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_62553ef8","line":321,"updated":"2016-01-11 20:52:36.000000000","message":"This isn\u0027t a problem, but it looks like this could be collapsed a bit with a loop that does ...\n\n    for sg_id in (detached_sg_ids + attached_sg_ids):\n        ...","commit_id":"57f08384dac3626df3e35a202705b94a065f99e1"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"552b0b73e898e5ac7422602c9fadedf7331a9a07","unresolved":false,"context_lines":[{"line_number":304,"context_line":"        new_sg_ids \u003d set(port.get(\u0027security_groups\u0027, []))"},{"line_number":305,"context_line":"        detached_sg_ids \u003d old_sg_ids - new_sg_ids"},{"line_number":306,"context_line":"        attached_sg_ids \u003d new_sg_ids - old_sg_ids"},{"line_number":307,"context_line":"        for sg_id in (attached_sg_ids | detached_sg_ids):"},{"line_number":308,"context_line":"            self._refresh_remote_security_group("},{"line_number":309,"context_line":"                context, sg_id,"},{"line_number":310,"context_line":"                sg_ports_cache\u003dsg_ports_cache,"}],"source_content_type":"text/x-python","patch_set":6,"id":"da6ed579_b786cab7","line":307,"updated":"2016-01-12 07:39:37.000000000","message":"thanks for the clean up :)","commit_id":"8b3f894e407c59709a1100a2c6aa27d5df0437dd"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"6dd262b4ce80fb54dedfa67d759c8fa063e8bae7","unresolved":false,"context_lines":[{"line_number":760,"context_line":"                           sg_ports_cache\u003dsg_ports_cache,"},{"line_number":761,"context_line":"                           subnet_cache\u003dsubnet_cache)"},{"line_number":762,"context_line":""},{"line_number":763,"context_line":"        for sg_id in port.get(\u0027security_group\u0027, []):"},{"line_number":764,"context_line":"            self._refresh_remote_security_group(context, sg_id,"},{"line_number":765,"context_line":"                                                sg_ports_cache\u003dsg_ports_cache,"},{"line_number":766,"context_line":"                                                exclude_ports\u003d[port[\u0027id\u0027]],"}],"source_content_type":"text/x-python","patch_set":6,"id":"da6ed579_b7224ab8","line":763,"updated":"2016-01-12 07:43:49.000000000","message":"\u0027security_group\u0027 should be \u0027security_groups\u0027. This is introduced by an earlier commit from myself :(, so will fix in a separate patch.","commit_id":"8b3f894e407c59709a1100a2c6aa27d5df0437dd"}],"networking_ovn/tests/unit/test_ovn_plugin.py":[{"author":{"_account_id":1561,"name":"Russell Bryant","email":"rbryant@redhat.com","username":"russellb"},"change_message_id":"5480e5591d59f02d234c53330427fe4009cf151a","unresolved":false,"context_lines":[{"line_number":384,"context_line":"        def _get_port(context, id):"},{"line_number":385,"context_line":"            return ports[id]"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"        with utils.nested("},{"line_number":388,"context_line":"            mock.patch(\u0027neutron.db.securitygroups_db.SecurityGroupDbMixin.\u0027"},{"line_number":389,"context_line":"                       \u0027_get_port_security_group_bindings\u0027,"},{"line_number":390,"context_line":"                       return_value\u003dsg_ports),"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa69d971_c5388dd5","line":387,"updated":"2016-01-06 21:48:04.000000000","message":"Another patch merged that removed this.","commit_id":"68dc2685d00acca939813b482fc0b5558e1f743c"},{"author":{"_account_id":11762,"name":"Han Zhou","email":"zhouhan@gmail.com","username":"hanzhou"},"change_message_id":"bd337c568fcb8e5ef936b1345c4278e4c2d1d9d9","unresolved":false,"context_lines":[{"line_number":384,"context_line":"        def _get_port(context, id):"},{"line_number":385,"context_line":"            return ports[id]"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"        with utils.nested("},{"line_number":388,"context_line":"            mock.patch(\u0027neutron.db.securitygroups_db.SecurityGroupDbMixin.\u0027"},{"line_number":389,"context_line":"                       \u0027_get_port_security_group_bindings\u0027,"},{"line_number":390,"context_line":"                       return_value\u003dsg_ports),"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa69d971_7e8a9265","line":387,"in_reply_to":"fa69d971_c5388dd5","updated":"2016-01-06 23:11:26.000000000","message":"Ok, I will rebase.","commit_id":"68dc2685d00acca939813b482fc0b5558e1f743c"}]}