)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"7dc1437d536dbee7e4b6e349f35f205aaf0aaa0b","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     shihanzhang \u003cshihanzhang@huawei.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-06-18 17:41:37 +0800"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Spec for adding ipset to security group"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I8b9a849c6a4612f6e043c70ca1269cdd6cdc0afb"},{"line_number":10,"context_line":"Implements blueprint add-ipset-to-security"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"1ae5cdf2_a8a39241","line":7,"range":{"start_line":7,"start_character":9,"end_line":7,"end_character":15},"updated":"2014-06-18 15:59:47.000000000","message":"i guess \"using ipset for security group\" is more appropriate","commit_id":"3c9e869dd69c1ba00c5f32207ab6e991f302fe4b"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"4075e92f30ca47370c87bec084620cbff4c48c59","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     shihanzhang \u003cshihanzhang@huawei.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-06-18 17:41:37 +0800"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Spec for adding ipset to security group"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I8b9a849c6a4612f6e043c70ca1269cdd6cdc0afb"},{"line_number":10,"context_line":"Implements blueprint add-ipset-to-security"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"1ae5cdf2_ef8bcd66","line":7,"in_reply_to":"1ae5cdf2_a8a39241","updated":"2014-06-19 00:42:51.000000000","message":"thanks for your suggestion","commit_id":"3c9e869dd69c1ba00c5f32207ab6e991f302fe4b"}],"specs/juno/add-ipset-to-security.rst":[{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"a2a79fd1ff910c365e947bfec0212d7bbc0904be","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/neutron/+spec/add-ipset-to-security"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Now in neturon, use iptable achieve security group functions, but iptables"},{"line_number":14,"context_line":"chain is linear storage and filtering, we can use ipset to improve performance"},{"line_number":15,"context_line":"of the security group performance."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_8f4d17c7","line":13,"range":{"start_line":13,"start_character":7,"end_line":13,"end_character":14},"updated":"2014-06-18 04:51:12.000000000","message":"neutron","commit_id":"7b9f48bab0c8cae2545c66be53418bc44fc925c2"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"7edca2aaaf530c9bdf5efd1b52cd9bedd383ccdb","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/neutron/+spec/add-ipset-to-security"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Now in neturon, use iptable achieve security group functions, but iptables"},{"line_number":14,"context_line":"chain is linear storage and filtering, we can use ipset to improve performance"},{"line_number":15,"context_line":"of the security group performance."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_4f0b0f2b","line":13,"in_reply_to":"1ae5cdf2_8f4d17c7","updated":"2014-06-18 04:55:01.000000000","message":"Done","commit_id":"7b9f48bab0c8cae2545c66be53418bc44fc925c2"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"a2a79fd1ff910c365e947bfec0212d7bbc0904be","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Iptables chain is linear storage and filtering, when a security group has many"},{"line_number":28,"context_line":"rules between other security group, this would affect performance of"},{"line_number":29,"context_line":"the security group."},{"line_number":30,"context_line":"When a port is updated, the security group chain relevented to that port will"},{"line_number":31,"context_line":"be destroyed and rebuilded, this would affect performance of the security group"},{"line_number":32,"context_line":"agent."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_4f014f38","line":30,"range":{"start_line":30,"start_character":49,"end_line":30,"end_character":59},"updated":"2014-06-18 04:51:12.000000000","message":"related?","commit_id":"7b9f48bab0c8cae2545c66be53418bc44fc925c2"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"7edca2aaaf530c9bdf5efd1b52cd9bedd383ccdb","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Iptables chain is linear storage and filtering, when a security group has many"},{"line_number":28,"context_line":"rules between other security group, this would affect performance of"},{"line_number":29,"context_line":"the security group."},{"line_number":30,"context_line":"When a port is updated, the security group chain relevented to that port will"},{"line_number":31,"context_line":"be destroyed and rebuilded, this would affect performance of the security group"},{"line_number":32,"context_line":"agent."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_6f060b23","line":30,"in_reply_to":"1ae5cdf2_4f014f38","updated":"2014-06-18 04:55:01.000000000","message":"Done","commit_id":"7b9f48bab0c8cae2545c66be53418bc44fc925c2"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"a2a79fd1ff910c365e947bfec0212d7bbc0904be","unresolved":false,"context_lines":[{"line_number":28,"context_line":"rules between other security group, this would affect performance of"},{"line_number":29,"context_line":"the security group."},{"line_number":30,"context_line":"When a port is updated, the security group chain relevented to that port will"},{"line_number":31,"context_line":"be destroyed and rebuilded, this would affect performance of the security group"},{"line_number":32,"context_line":"agent."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_0f9f4704","line":31,"range":{"start_line":31,"start_character":17,"end_line":31,"end_character":26},"updated":"2014-06-18 04:51:12.000000000","message":"rebuilt","commit_id":"7b9f48bab0c8cae2545c66be53418bc44fc925c2"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"7edca2aaaf530c9bdf5efd1b52cd9bedd383ccdb","unresolved":false,"context_lines":[{"line_number":28,"context_line":"rules between other security group, this would affect performance of"},{"line_number":29,"context_line":"the security group."},{"line_number":30,"context_line":"When a port is updated, the security group chain relevented to that port will"},{"line_number":31,"context_line":"be destroyed and rebuilded, this would affect performance of the security group"},{"line_number":32,"context_line":"agent."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_d2fee404","line":31,"in_reply_to":"1ae5cdf2_0f9f4704","updated":"2014-06-18 04:55:01.000000000","message":"Done","commit_id":"7b9f48bab0c8cae2545c66be53418bc44fc925c2"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"a2a79fd1ff910c365e947bfec0212d7bbc0904be","unresolved":false,"context_lines":[{"line_number":124,"context_line":"References"},{"line_number":125,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"None."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_8f80b78c","line":127,"updated":"2014-06-18 04:51:12.000000000","message":"a pointer to ipset?\n\nthis? http://ipset.netfilter.org","commit_id":"7b9f48bab0c8cae2545c66be53418bc44fc925c2"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"7edca2aaaf530c9bdf5efd1b52cd9bedd383ccdb","unresolved":false,"context_lines":[{"line_number":124,"context_line":"References"},{"line_number":125,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"None."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_0f12e761","line":127,"in_reply_to":"1ae5cdf2_8f80b78c","updated":"2014-06-18 04:55:01.000000000","message":"thanks very much for your reveiw!","commit_id":"7b9f48bab0c8cae2545c66be53418bc44fc925c2"},{"author":{"_account_id":1935,"name":"Tomoe Sugihara","email":"tomoe.sugihara@gmail.com","username":"tomoe"},"change_message_id":"5c0b040ee868f81e18439ba02cdd5378cdb746f5","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Proposed change"},{"line_number":35,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"The proposal is to introduce ipset to security group, when a port is created,"},{"line_number":38,"context_line":"security group agent will add a additonal ipset chain to it\u0027s iptables chain,"},{"line_number":39,"context_line":"if the security group that this port belongs to has rules between other"},{"line_number":40,"context_line":"security group, the member of that security group will add to ipset chain."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_c32a98e6","line":37,"updated":"2014-06-18 07:16:05.000000000","message":"IIUC, this proposes to implement security groups by making use of ipset. \n\"introduce ipset to security group\" doesn\u0027t sound right to me. \n\nAlso, you may want to clarify that this is not a feature proposal, so not user facing changes), but improvements in implementation.","commit_id":"1b28b3928d411822b5424c629899d9ffa537c3dd"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"60af2477348cd209e42beeafb42edd44655f708d","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Proposed change"},{"line_number":35,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"The proposal is to introduce ipset to security group, when a port is created,"},{"line_number":38,"context_line":"security group agent will add a additonal ipset chain to it\u0027s iptables chain,"},{"line_number":39,"context_line":"if the security group that this port belongs to has rules between other"},{"line_number":40,"context_line":"security group, the member of that security group will add to ipset chain."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_a8300408","line":37,"in_reply_to":"1ae5cdf2_c32a98e6","updated":"2014-06-18 09:11:04.000000000","message":"thanks for your review, I agree with you, this BP is to improve the performance of security groups.","commit_id":"1b28b3928d411822b5424c629899d9ffa537c3dd"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"5bc84054bebc847bc175b7d3e1660d89f4ef08db","unresolved":false,"context_lines":[{"line_number":22,"context_line":"linear storage and filtering, it seriously affects the performance of the"},{"line_number":23,"context_line":"security group."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Problem 1: Iptables affect performance of the security group"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Iptables chain is linear storage and filtering, when a security group has many"},{"line_number":28,"context_line":"rules between other security group, this would affect performance of"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_0b857206","line":25,"updated":"2014-06-18 09:23:55.000000000","message":"are there other problems as you\u0027re numbering them?","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"ced5bd3f2ddaf43c7762df4ae6e942cc47204f78","unresolved":false,"context_lines":[{"line_number":22,"context_line":"linear storage and filtering, it seriously affects the performance of the"},{"line_number":23,"context_line":"security group."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Problem 1: Iptables affect performance of the security group"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Iptables chain is linear storage and filtering, when a security group has many"},{"line_number":28,"context_line":"rules between other security group, this would affect performance of"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_0b7012db","line":25,"in_reply_to":"1ae5cdf2_0b857206","updated":"2014-06-18 09:37:27.000000000","message":"thanks for your review, the main purpose of this BP is to improve performance of security group, I will modify this.","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"5bc84054bebc847bc175b7d3e1660d89f4ef08db","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Iptables chain is linear storage and filtering, when a security group has many"},{"line_number":28,"context_line":"rules between other security group, this would affect performance of"},{"line_number":29,"context_line":"the security group."},{"line_number":30,"context_line":"When a port is updated, the security group chain related to that port will"},{"line_number":31,"context_line":"be destroyed and rebuilt, this would affect performance of the security group"},{"line_number":32,"context_line":"agent."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_2b7b0e2a","line":29,"updated":"2014-06-18 09:23:55.000000000","message":"please avoid repeating paragraphs by cut \u0026 paste","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"ced5bd3f2ddaf43c7762df4ae6e942cc47204f78","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Iptables chain is linear storage and filtering, when a security group has many"},{"line_number":28,"context_line":"rules between other security group, this would affect performance of"},{"line_number":29,"context_line":"the security group."},{"line_number":30,"context_line":"When a port is updated, the security group chain related to that port will"},{"line_number":31,"context_line":"be destroyed and rebuilt, this would affect performance of the security group"},{"line_number":32,"context_line":"agent."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_2b76aed8","line":29,"in_reply_to":"1ae5cdf2_2b7b0e2a","updated":"2014-06-18 09:37:27.000000000","message":"ok","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"5bc84054bebc847bc175b7d3e1660d89f4ef08db","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Implementation"},{"line_number":90,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Assignee(s)"},{"line_number":93,"context_line":"-----------"},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_2ba22e9a","line":91,"updated":"2014-06-18 09:23:55.000000000","message":"you can\u0027t leave this empty for this specification. Please provide implementation details.","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"ced5bd3f2ddaf43c7762df4ae6e942cc47204f78","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Implementation"},{"line_number":90,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Assignee(s)"},{"line_number":93,"context_line":"-----------"},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_a62595af","line":91,"in_reply_to":"1ae5cdf2_2ba22e9a","updated":"2014-06-18 09:37:27.000000000","message":"ok, i do it as soon as possible!","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"5bc84054bebc847bc175b7d3e1660d89f4ef08db","unresolved":false,"context_lines":[{"line_number":99,"context_line":"Work Items"},{"line_number":100,"context_line":"----------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* sercurity group agent code"},{"line_number":103,"context_line":"* Unit tests"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_abb55ed1","line":102,"updated":"2014-06-18 09:23:55.000000000","message":"security","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"ced5bd3f2ddaf43c7762df4ae6e942cc47204f78","unresolved":false,"context_lines":[{"line_number":99,"context_line":"Work Items"},{"line_number":100,"context_line":"----------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* sercurity group agent code"},{"line_number":103,"context_line":"* Unit tests"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_cb4c6aa0","line":102,"in_reply_to":"1ae5cdf2_abb55ed1","updated":"2014-06-18 09:37:27.000000000","message":"Done","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"5bc84054bebc847bc175b7d3e1660d89f4ef08db","unresolved":false,"context_lines":[{"line_number":100,"context_line":"----------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* sercurity group agent code"},{"line_number":103,"context_line":"* Unit tests"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_4bc4da40","line":103,"updated":"2014-06-18 09:23:55.000000000","message":"is there devstack work needed? Like a new security group firewall driver to specify?","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"ced5bd3f2ddaf43c7762df4ae6e942cc47204f78","unresolved":false,"context_lines":[{"line_number":100,"context_line":"----------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"* sercurity group agent code"},{"line_number":103,"context_line":"* Unit tests"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_66b8ed2a","line":103,"in_reply_to":"1ae5cdf2_4bc4da40","updated":"2014-06-18 09:37:27.000000000","message":"Done","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"5bc84054bebc847bc175b7d3e1660d89f4ef08db","unresolved":false,"context_lines":[{"line_number":112,"context_line":"Testing"},{"line_number":113,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Continuous integration testing to test the sercurity group at the gate will be"},{"line_number":116,"context_line":"considered."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_ebe686e7","line":115,"updated":"2014-06-18 09:23:55.000000000","message":"security","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"ced5bd3f2ddaf43c7762df4ae6e942cc47204f78","unresolved":false,"context_lines":[{"line_number":112,"context_line":"Testing"},{"line_number":113,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Continuous integration testing to test the sercurity group at the gate will be"},{"line_number":116,"context_line":"considered."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_86b3394c","line":115,"in_reply_to":"1ae5cdf2_ebe686e7","updated":"2014-06-18 09:37:27.000000000","message":"Done","commit_id":"4532c87fb6963131fafa1cccd2fc994103545605"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"7dc1437d536dbee7e4b6e349f35f205aaf0aaa0b","unresolved":false,"context_lines":[{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"The proposal is to implement security groups by making use of ipset, when a"},{"line_number":34,"context_line":"port is created, security group agent will add a additonal ipset chain to it\u0027s"},{"line_number":35,"context_line":"iptable chain, if the security group that this port belongs to has rules"},{"line_number":36,"context_line":"between other security group, the member of that security group will add to"},{"line_number":37,"context_line":"ipset chain."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_c818de86","line":34,"range":{"start_line":34,"start_character":49,"end_line":34,"end_character":58},"updated":"2014-06-18 15:59:47.000000000","message":"additional","commit_id":"3c9e869dd69c1ba00c5f32207ab6e991f302fe4b"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"4075e92f30ca47370c87bec084620cbff4c48c59","unresolved":false,"context_lines":[{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"The proposal is to implement security groups by making use of ipset, when a"},{"line_number":34,"context_line":"port is created, security group agent will add a additonal ipset chain to it\u0027s"},{"line_number":35,"context_line":"iptable chain, if the security group that this port belongs to has rules"},{"line_number":36,"context_line":"between other security group, the member of that security group will add to"},{"line_number":37,"context_line":"ipset chain."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_0f89d96e","line":34,"in_reply_to":"1ae5cdf2_c818de86","updated":"2014-06-19 00:42:51.000000000","message":"Done","commit_id":"3c9e869dd69c1ba00c5f32207ab6e991f302fe4b"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"7dc1437d536dbee7e4b6e349f35f205aaf0aaa0b","unresolved":false,"context_lines":[{"line_number":34,"context_line":"port is created, security group agent will add a additonal ipset chain to it\u0027s"},{"line_number":35,"context_line":"iptable chain, if the security group that this port belongs to has rules"},{"line_number":36,"context_line":"between other security group, the member of that security group will add to"},{"line_number":37,"context_line":"ipset chain."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Alternatives"},{"line_number":40,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_0306291c","line":37,"updated":"2014-06-18 15:59:47.000000000","message":"if your plan is to improve performance without making functionality changes, please state so explicitly.","commit_id":"3c9e869dd69c1ba00c5f32207ab6e991f302fe4b"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"4075e92f30ca47370c87bec084620cbff4c48c59","unresolved":false,"context_lines":[{"line_number":34,"context_line":"port is created, security group agent will add a additonal ipset chain to it\u0027s"},{"line_number":35,"context_line":"iptable chain, if the security group that this port belongs to has rules"},{"line_number":36,"context_line":"between other security group, the member of that security group will add to"},{"line_number":37,"context_line":"ipset chain."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Alternatives"},{"line_number":40,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_efe2ed2e","line":37,"in_reply_to":"1ae5cdf2_0306291c","updated":"2014-06-19 00:42:51.000000000","message":"Done","commit_id":"3c9e869dd69c1ba00c5f32207ab6e991f302fe4b"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"7dc1437d536dbee7e4b6e349f35f205aaf0aaa0b","unresolved":false,"context_lines":[{"line_number":95,"context_line":"Work Items"},{"line_number":96,"context_line":"----------"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"* security group agent code"},{"line_number":99,"context_line":"* Unit tests"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_4825aec0","line":98,"updated":"2014-06-18 15:59:47.000000000","message":"are you going to modify an existing firewall driver?\nor are you introducing a new one?","commit_id":"3c9e869dd69c1ba00c5f32207ab6e991f302fe4b"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"4075e92f30ca47370c87bec084620cbff4c48c59","unresolved":false,"context_lines":[{"line_number":95,"context_line":"Work Items"},{"line_number":96,"context_line":"----------"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"* security group agent code"},{"line_number":99,"context_line":"* Unit tests"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_8ff409f2","line":98,"in_reply_to":"1ae5cdf2_4825aec0","updated":"2014-06-19 00:42:51.000000000","message":"I plan to modify the existing firewall driver.","commit_id":"3c9e869dd69c1ba00c5f32207ab6e991f302fe4b"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"6e4938f95118f94a3cfc18e30933ed7e94755ec1","unresolved":false,"context_lines":[{"line_number":11,"context_line":"https://blueprints.launchpad.net/neutron/+spec/add-ipset-to-security"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Now in neutron, use iptable achieve security group functions, but iptables"},{"line_number":14,"context_line":"chain is linear storage and filtering, we can use ipset to improve performance"},{"line_number":15,"context_line":"of the security group performance."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_64a220fe","line":14,"updated":"2014-06-23 11:22:27.000000000","message":"(warning: take my advice with caution as I\u0027m not a native speaker)\n\nI think it\u0027s \n\"to improve security group\u0027s performance.\"","commit_id":"69f30929c648c5cf4e55a30ca774a806f1879cfa"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"5ca3cd67cafacd344e6e63c05dabbd984f95e77d","unresolved":false,"context_lines":[{"line_number":11,"context_line":"https://blueprints.launchpad.net/neutron/+spec/add-ipset-to-security"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Now in neutron, use iptable achieve security group functions, but iptables"},{"line_number":14,"context_line":"chain is linear storage and filtering, we can use ipset to improve performance"},{"line_number":15,"context_line":"of the security group performance."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_b3cc63bd","line":14,"in_reply_to":"1ae5cdf2_64a220fe","updated":"2014-06-23 12:16:59.000000000","message":"ok, thanks for your review and suggestion","commit_id":"69f30929c648c5cf4e55a30ca774a806f1879cfa"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"6e4938f95118f94a3cfc18e30933ed7e94755ec1","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Now neutron use iptable achieve security group functions, iptables chain is"},{"line_number":22,"context_line":"linear storage and filtering, it seriously affects the performance of the"},{"line_number":23,"context_line":"security group."},{"line_number":24,"context_line":"When a security group has many rules between other security group, this would"},{"line_number":25,"context_line":"affect performance of the security group."},{"line_number":26,"context_line":"When a port is updated, the security group chain related to that port will"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_04b31c4e","line":23,"updated":"2014-06-23 11:22:27.000000000","message":"I think there\u0027s no need to repeat the same text here ^","commit_id":"69f30929c648c5cf4e55a30ca774a806f1879cfa"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"5ca3cd67cafacd344e6e63c05dabbd984f95e77d","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Now neutron use iptable achieve security group functions, iptables chain is"},{"line_number":22,"context_line":"linear storage and filtering, it seriously affects the performance of the"},{"line_number":23,"context_line":"security group."},{"line_number":24,"context_line":"When a security group has many rules between other security group, this would"},{"line_number":25,"context_line":"affect performance of the security group."},{"line_number":26,"context_line":"When a port is updated, the security group chain related to that port will"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_73d2db5c","line":23,"in_reply_to":"1ae5cdf2_04b31c4e","updated":"2014-06-23 12:16:59.000000000","message":"Done","commit_id":"69f30929c648c5cf4e55a30ca774a806f1879cfa"},{"author":{"_account_id":11367,"name":"keshava","email":"keshava.a@hp.com","username":"keshava-a"},"change_message_id":"af1e43f42093883f2eab6f8c48313514cd8d78ad","unresolved":false,"context_lines":[{"line_number":35,"context_line":"ipset, when a port is created, security group agent will add a additional ipset"},{"line_number":36,"context_line":"chain to it\u0027s iptable chain, if the security group that this port belongs to"},{"line_number":37,"context_line":"has rules between other security group, the member of that security group will"},{"line_number":38,"context_line":"add to ipset chain."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Alternatives"},{"line_number":41,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_4904b97d","line":38,"updated":"2014-06-19 05:57:19.000000000","message":"What the is impact on locks here ? How is its design and amount of time w.r.t to lock ?","commit_id":"69f30929c648c5cf4e55a30ca774a806f1879cfa"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"5ca3cd67cafacd344e6e63c05dabbd984f95e77d","unresolved":false,"context_lines":[{"line_number":35,"context_line":"ipset, when a port is created, security group agent will add a additional ipset"},{"line_number":36,"context_line":"chain to it\u0027s iptable chain, if the security group that this port belongs to"},{"line_number":37,"context_line":"has rules between other security group, the member of that security group will"},{"line_number":38,"context_line":"add to ipset chain."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Alternatives"},{"line_number":41,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_33b85311","line":38,"in_reply_to":"1ae5cdf2_4904b97d","updated":"2014-06-23 12:16:59.000000000","message":"Done","commit_id":"69f30929c648c5cf4e55a30ca774a806f1879cfa"},{"author":{"_account_id":11825,"name":"Sudhakar Babu Gariganti","email":"sudhakar.gariganti@gmail.com","username":"sudhakar-gariganti"},"change_message_id":"7be829149034440dd5d61f1a00c531b20b1c2099","unresolved":false,"context_lines":[{"line_number":96,"context_line":"Work Items"},{"line_number":97,"context_line":"----------"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* security group agent code"},{"line_number":100,"context_line":"* Unit tests"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_9efec204","line":99,"updated":"2014-06-20 11:28:35.000000000","message":"Is there no impact on the iptables_manager code when we bring in ipset? \n\nMore than the agent code, I feel the iptables_manager code which needs to be revamped to accomodate the new way of adding and deleting rules? \n\nBut its a very good change to have. Thanks for bringing this up.","commit_id":"69f30929c648c5cf4e55a30ca774a806f1879cfa"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"20a692eabed660cfa1dbfbfc864e754325ba47e1","unresolved":false,"context_lines":[{"line_number":96,"context_line":"Work Items"},{"line_number":97,"context_line":"----------"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* security group agent code"},{"line_number":100,"context_line":"* Unit tests"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_555fa3e4","line":99,"in_reply_to":"1ae5cdf2_9efec204","updated":"2014-06-21 02:14:05.000000000","message":"thanks for your review, the code of iptables_manager alse need modify, I will modify this spec as soon as possilbe!","commit_id":"69f30929c648c5cf4e55a30ca774a806f1879cfa"},{"author":{"_account_id":11825,"name":"Sudhakar Babu Gariganti","email":"sudhakar.gariganti@gmail.com","username":"sudhakar-gariganti"},"change_message_id":"7be829149034440dd5d61f1a00c531b20b1c2099","unresolved":false,"context_lines":[{"line_number":109,"context_line":"Testing"},{"line_number":110,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Continuous integration testing to test the sercurity group at the gate will be"},{"line_number":113,"context_line":"considered."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_6136bbe8","line":112,"updated":"2014-06-20 11:28:35.000000000","message":"security","commit_id":"69f30929c648c5cf4e55a30ca774a806f1879cfa"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"20a692eabed660cfa1dbfbfc864e754325ba47e1","unresolved":false,"context_lines":[{"line_number":109,"context_line":"Testing"},{"line_number":110,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Continuous integration testing to test the sercurity group at the gate will be"},{"line_number":113,"context_line":"considered."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_d572d37a","line":112,"in_reply_to":"1ae5cdf2_6136bbe8","updated":"2014-06-21 02:14:05.000000000","message":"Done","commit_id":"69f30929c648c5cf4e55a30ca774a806f1879cfa"},{"author":{"_account_id":11825,"name":"Sudhakar Babu Gariganti","email":"sudhakar.gariganti@gmail.com","username":"sudhakar-gariganti"},"change_message_id":"f6e9d320902c3a63ebe7bce4dcb253f6adb3031b","unresolved":false,"context_lines":[{"line_number":111,"context_line":"----------"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"* Optimize mechanism for the OVS agent in \u0027security_group_rules_for_devices\u0027"},{"line_number":114,"context_line":"* Add ipset chain in \u0027_add_rule_by_security_group\u0027"},{"line_number":115,"context_line":"* Unit tests"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_e48f0b75","line":114,"updated":"2014-06-23 09:43:26.000000000","message":"There will be no changes required when we need to remove the rules??\n\nAnd one minor suggestion is , it will be good to add the module name where these methods are present for easier reference.","commit_id":"d700ecf9f5554d772631c2c8036d1c2b7ee3dfb5"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"5c196d3c9342fb222c2a115deda238fcf9736891","unresolved":false,"context_lines":[{"line_number":111,"context_line":"----------"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"* Optimize mechanism for the OVS agent in \u0027security_group_rules_for_devices\u0027"},{"line_number":114,"context_line":"* Add ipset chain in \u0027_add_rule_by_security_group\u0027"},{"line_number":115,"context_line":"* Unit tests"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_8709e986","line":114,"in_reply_to":"1ae5cdf2_e48f0b75","updated":"2014-06-23 10:23:45.000000000","message":"thanks for your suggestion","commit_id":"d700ecf9f5554d772631c2c8036d1c2b7ee3dfb5"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"f2694053012d2e07e1fe294ea3dc68d780ac4d81","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/neutron/+spec/add-ipset-to-security"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Now in neutron, use iptable achieve security group functions, but iptables"},{"line_number":14,"context_line":"chain is linear storage and filtering, we can use ipset to improve security"},{"line_number":15,"context_line":"group\u0027s performance."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"baada198_7e90c2ec","line":13,"updated":"2014-07-01 13:00:48.000000000","message":"I\u0027m not a native speaker, but:\n\nin neutron, we use\n\nor \n\nneutron uses","commit_id":"478459bdf17cb6f85cf6e4ceab13ab9cc16e229e"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"e07815fca06c6dd8e2d9b7f5cecf2f7b96bfbd1b","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/neutron/+spec/add-ipset-to-security"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Now in neutron, use iptable achieve security group functions, but iptables"},{"line_number":14,"context_line":"chain is linear storage and filtering, we can use ipset to improve security"},{"line_number":15,"context_line":"group\u0027s performance."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"baada198_468f9ecc","line":13,"in_reply_to":"baada198_7e90c2ec","updated":"2014-07-02 01:20:54.000000000","message":"thanks for your review.","commit_id":"478459bdf17cb6f85cf6e4ceab13ab9cc16e229e"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"f2694053012d2e07e1fe294ea3dc68d780ac4d81","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Now neutron use iptable achieve security group functions, but there are"},{"line_number":22,"context_line":"following problems."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem 1:"}],"source_content_type":"text/x-rst","patch_set":14,"id":"baada198_9ebcb66e","line":21,"updated":"2014-07-01 13:00:48.000000000","message":"neutron uses","commit_id":"478459bdf17cb6f85cf6e4ceab13ab9cc16e229e"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"e07815fca06c6dd8e2d9b7f5cecf2f7b96bfbd1b","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Now neutron use iptable achieve security group functions, but there are"},{"line_number":22,"context_line":"following problems."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem 1:"}],"source_content_type":"text/x-rst","patch_set":14,"id":"baada198_a6b79a85","line":21,"in_reply_to":"baada198_9ebcb66e","updated":"2014-07-02 01:20:54.000000000","message":"Done","commit_id":"478459bdf17cb6f85cf6e4ceab13ab9cc16e229e"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"f2694053012d2e07e1fe294ea3dc68d780ac4d81","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Problem 3:"},{"line_number":33,"context_line":"When a port is created, the \"security_group_rules_for_devices\" RPC call from"},{"line_number":34,"context_line":"ovs-agent to neutron-server grows in X^2 for a tenant."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":14,"id":"baada198_be689af6","line":34,"updated":"2014-07-01 13:00:48.000000000","message":"for a tenant when using neutron default security rules.","commit_id":"478459bdf17cb6f85cf6e4ceab13ab9cc16e229e"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"f2694053012d2e07e1fe294ea3dc68d780ac4d81","unresolved":false,"context_lines":[{"line_number":108,"context_line":"Work Items"},{"line_number":109,"context_line":"----------"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"* Optimize mechanism for the OVS agent in \u0027security_group_rules_for_devices\u0027"},{"line_number":112,"context_line":"* Add ipset chain in \u0027_add_rule_by_security_group\u0027"},{"line_number":113,"context_line":"* Unit tests"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"baada198_9e31160e","line":111,"updated":"2014-07-01 13:00:48.000000000","message":"I have time for this, and I\u0027m going to open a new spec for this certain problem\nwith Édouard Thuleau\u0027s idea of using fanouts for security groups.\n\nDo you mind to remove this from this spec, and leave it only for \u0027ipsets\u0027, while I work on the security group rules for devices RPC optimization on a different spec?\n\nMay be that goes together with \"problem 3\" \n\nBest,\nMiguel Ángel.","commit_id":"478459bdf17cb6f85cf6e4ceab13ab9cc16e229e"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"e07815fca06c6dd8e2d9b7f5cecf2f7b96bfbd1b","unresolved":false,"context_lines":[{"line_number":108,"context_line":"Work Items"},{"line_number":109,"context_line":"----------"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"* Optimize mechanism for the OVS agent in \u0027security_group_rules_for_devices\u0027"},{"line_number":112,"context_line":"* Add ipset chain in \u0027_add_rule_by_security_group\u0027"},{"line_number":113,"context_line":"* Unit tests"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"baada198_a90a0d1f","line":111,"in_reply_to":"baada198_9e31160e","updated":"2014-07-02 01:20:54.000000000","message":"hi Miguel Ángel, thanks for your review, if you want do it, I can remove from my BP, but I will also optimization  the RPC from security group agent to neutron server, now the modle is port[rule1,rule2...],port..., I will change it to port[sg1, sg2..]","commit_id":"478459bdf17cb6f85cf6e4ceab13ab9cc16e229e"},{"author":{"_account_id":9820,"name":"Liping Mao","email":"limao@cisco.com","username":"LipingMao"},"change_message_id":"2726d78bbd3d262138f011feb5f7fd369b0afa7d","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/neutron/+spec/add-ipset-to-security"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Now neutron uses iptable achieve security group functions, but iptables"},{"line_number":14,"context_line":"chain is linear storage and filtering, we can use ipset to improve security"},{"line_number":15,"context_line":"group\u0027s performance."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_d5f7cef3","line":13,"updated":"2014-07-02 05:19:17.000000000","message":"iptable -\u003e iptables","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"77d6df000afe087ea06aa1c5ee8b302f3b80dc52","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/neutron/+spec/add-ipset-to-security"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Now neutron uses iptable achieve security group functions, but iptables"},{"line_number":14,"context_line":"chain is linear storage and filtering, we can use ipset to improve security"},{"line_number":15,"context_line":"group\u0027s performance."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_6751f9d7","line":13,"in_reply_to":"baada198_d5f7cef3","updated":"2014-07-02 06:12:23.000000000","message":"thanks for your review!","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":9820,"name":"Liping Mao","email":"limao@cisco.com","username":"LipingMao"},"change_message_id":"2726d78bbd3d262138f011feb5f7fd369b0afa7d","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Now neutron uses iptable achieve security group functions, but there are"},{"line_number":22,"context_line":"following problems."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem 1:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_95d47648","line":21,"updated":"2014-07-02 05:19:17.000000000","message":"iptable -\u003e iptables","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"77d6df000afe087ea06aa1c5ee8b302f3b80dc52","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Now neutron uses iptable achieve security group functions, but there are"},{"line_number":22,"context_line":"following problems."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem 1:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_875fede4","line":21,"in_reply_to":"baada198_95d47648","updated":"2014-07-02 06:12:23.000000000","message":"Done","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":9820,"name":"Liping Mao","email":"limao@cisco.com","username":"LipingMao"},"change_message_id":"2726d78bbd3d262138f011feb5f7fd369b0afa7d","unresolved":false,"context_lines":[{"line_number":22,"context_line":"following problems."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem 1:"},{"line_number":25,"context_line":"When a security group has many rules between other security group, this would"},{"line_number":26,"context_line":"affect security group\u0027s performance."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Problem 2:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_f5c4d293","line":25,"updated":"2014-07-02 05:19:17.000000000","message":"What do you mean by \"between other security group\" ?","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"77d6df000afe087ea06aa1c5ee8b302f3b80dc52","unresolved":false,"context_lines":[{"line_number":22,"context_line":"following problems."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem 1:"},{"line_number":25,"context_line":"When a security group has many rules between other security group, this would"},{"line_number":26,"context_line":"affect security group\u0027s performance."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Problem 2:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_671659f3","line":25,"in_reply_to":"baada198_f5c4d293","updated":"2014-07-02 06:12:23.000000000","message":"a security group  which has rule with other security group","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"bb99b9a6a86a1a09943c9407452ce6122b4d7530","unresolved":false,"context_lines":[{"line_number":30,"context_line":"be destroyed and rebuilt, this would affect security group agent\u0027s performance."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Problem 3:"},{"line_number":33,"context_line":"In current implementation, nuetron generate rules for per port in server side."},{"line_number":34,"context_line":"It is something like this: port1[SG_Rule1, SG_Rule2] .. port2, when a security"},{"line_number":35,"context_line":"group have many members, the RPC message from neutron server to security"},{"line_number":36,"context_line":"group agent are very large."}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_55301ee8","line":33,"range":{"start_line":33,"start_character":27,"end_line":33,"end_character":34},"updated":"2014-07-02 05:10:27.000000000","message":"neutron","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":9820,"name":"Liping Mao","email":"limao@cisco.com","username":"LipingMao"},"change_message_id":"2726d78bbd3d262138f011feb5f7fd369b0afa7d","unresolved":false,"context_lines":[{"line_number":30,"context_line":"be destroyed and rebuilt, this would affect security group agent\u0027s performance."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Problem 3:"},{"line_number":33,"context_line":"In current implementation, nuetron generate rules for per port in server side."},{"line_number":34,"context_line":"It is something like this: port1[SG_Rule1, SG_Rule2] .. port2, when a security"},{"line_number":35,"context_line":"group have many members, the RPC message from neutron server to security"},{"line_number":36,"context_line":"group agent are very large."}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_35bf2afd","line":33,"updated":"2014-07-02 05:19:17.000000000","message":"nuetron -\u003e neutron\ngenerate -\u003e generates","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"77d6df000afe087ea06aa1c5ee8b302f3b80dc52","unresolved":false,"context_lines":[{"line_number":30,"context_line":"be destroyed and rebuilt, this would affect security group agent\u0027s performance."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Problem 3:"},{"line_number":33,"context_line":"In current implementation, nuetron generate rules for per port in server side."},{"line_number":34,"context_line":"It is something like this: port1[SG_Rule1, SG_Rule2] .. port2, when a security"},{"line_number":35,"context_line":"group have many members, the RPC message from neutron server to security"},{"line_number":36,"context_line":"group agent are very large."}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_a7d79122","line":33,"in_reply_to":"baada198_35bf2afd","updated":"2014-07-02 06:12:23.000000000","message":"Done","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"77d6df000afe087ea06aa1c5ee8b302f3b80dc52","unresolved":false,"context_lines":[{"line_number":30,"context_line":"be destroyed and rebuilt, this would affect security group agent\u0027s performance."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Problem 3:"},{"line_number":33,"context_line":"In current implementation, nuetron generate rules for per port in server side."},{"line_number":34,"context_line":"It is something like this: port1[SG_Rule1, SG_Rule2] .. port2, when a security"},{"line_number":35,"context_line":"group have many members, the RPC message from neutron server to security"},{"line_number":36,"context_line":"group agent are very large."}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_87d44d21","line":33,"in_reply_to":"baada198_55301ee8","updated":"2014-07-02 06:12:23.000000000","message":"Done","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"7dd8e90790ec1b98fa8025d57dec0b18dc235067","unresolved":false,"context_lines":[{"line_number":33,"context_line":"In current implementation, nuetron generate rules for per port in server side."},{"line_number":34,"context_line":"It is something like this: port1[SG_Rule1, SG_Rule2] .. port2, when a security"},{"line_number":35,"context_line":"group have many members, the RPC message from neutron server to security"},{"line_number":36,"context_line":"group agent are very large."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_717d2fb1","line":36,"updated":"2014-07-02 09:21:30.000000000","message":"I really believe we should split this in a separate spec, those are related problems, but not the same one. And also we\u0027re decreasing our chances to have this for Juno.\n\nIdeally with separate specs, we should cross review both to make sure the approaches work well together.","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"6c4d5b19e32bdba9cfcb270ee4ba92ee9e439953","unresolved":false,"context_lines":[{"line_number":33,"context_line":"In current implementation, nuetron generate rules for per port in server side."},{"line_number":34,"context_line":"It is something like this: port1[SG_Rule1, SG_Rule2] .. port2, when a security"},{"line_number":35,"context_line":"group have many members, the RPC message from neutron server to security"},{"line_number":36,"context_line":"group agent are very large."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_0c3bfcd1","line":36,"in_reply_to":"baada198_717d2fb1","updated":"2014-07-02 09:26:14.000000000","message":"yes, I agree with you. I will explain this in this spec. Now I am modifing it.","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"bb99b9a6a86a1a09943c9407452ce6122b4d7530","unresolved":false,"context_lines":[{"line_number":42,"context_line":"The proposal is to improve security group performance based on existing"},{"line_number":43,"context_line":"security group agent codes."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"In ovs-agent, it makes use of ipset to optimize the iptable rule chain. When a"},{"line_number":46,"context_line":"port is created, security group agent will add a additional ipset chain to it\u0027s"},{"line_number":47,"context_line":"iptable chain, if the security group that this port belongs to has rules"},{"line_number":48,"context_line":"between other security group, the member of that security group will add to"}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_15ab06d7","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":12},"updated":"2014-07-02 05:10:27.000000000","message":"In IptablesFirewallDriver you mean?\n\nthe driver can be used for other agents.","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"77d6df000afe087ea06aa1c5ee8b302f3b80dc52","unresolved":false,"context_lines":[{"line_number":42,"context_line":"The proposal is to improve security group performance based on existing"},{"line_number":43,"context_line":"security group agent codes."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"In ovs-agent, it makes use of ipset to optimize the iptable rule chain. When a"},{"line_number":46,"context_line":"port is created, security group agent will add a additional ipset chain to it\u0027s"},{"line_number":47,"context_line":"iptable chain, if the security group that this port belongs to has rules"},{"line_number":48,"context_line":"between other security group, the member of that security group will add to"}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_67ed79ef","line":45,"in_reply_to":"baada198_15ab06d7","updated":"2014-07-02 06:12:23.000000000","message":"yes, this is not just for openvswitch agent, it is for IptablesFirewallDriver","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"bb99b9a6a86a1a09943c9407452ce6122b4d7530","unresolved":false,"context_lines":[{"line_number":49,"context_line":"ipset chain."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"In neutron server, it can be improved by using the payload data model"},{"line_number":52,"context_line":"port1[ SG1_Rules, SG2_Rules]."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Alternatives"},{"line_number":55,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_d5450e18","line":52,"updated":"2014-07-02 05:10:27.000000000","message":"i failed to understand the difference between this and L.34.\ncan you enlighten?","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"77d6df000afe087ea06aa1c5ee8b302f3b80dc52","unresolved":false,"context_lines":[{"line_number":49,"context_line":"ipset chain."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"In neutron server, it can be improved by using the payload data model"},{"line_number":52,"context_line":"port1[ SG1_Rules, SG2_Rules]."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Alternatives"},{"line_number":55,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":15,"id":"baada198_a7beb1d2","line":52,"in_reply_to":"baada198_d5450e18","updated":"2014-07-02 06:12:23.000000000","message":"ok, I will enlighten this in my spes","commit_id":"bc0d7f43f7ee25da1fc0133792bf64c56f8a89e4"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"2cbc34702d0a673a083c009aa3cdf0e1d1ea5139","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/neutron/+spec/add-ipset-to-security"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Now neutron uses iptables achieve security group functions, but iptables"},{"line_number":14,"context_line":"chain is linear storage and filtering, we can use ipset to improve security"},{"line_number":15,"context_line":"group\u0027s performance."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_0339c6f2","line":13,"updated":"2014-07-03 17:42:33.000000000","message":"iptables *to* achieve","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"b939c806f021bc36020b24519ec814c4ac78ea2d","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/neutron/+spec/add-ipset-to-security"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Now neutron uses iptables achieve security group functions, but iptables"},{"line_number":14,"context_line":"chain is linear storage and filtering, we can use ipset to improve security"},{"line_number":15,"context_line":"group\u0027s performance."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_796cdfd0","line":13,"in_reply_to":"baada198_0339c6f2","updated":"2014-07-04 07:05:25.000000000","message":"thanks for your review.","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"2cbc34702d0a673a083c009aa3cdf0e1d1ea5139","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Now neutron uses iptables achieve security group functions, but there are"},{"line_number":22,"context_line":"following problems."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem 1:"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_8324f6c5","line":21,"updated":"2014-07-03 17:42:33.000000000","message":"iptables *to* achieve","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"b939c806f021bc36020b24519ec814c4ac78ea2d","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Now neutron uses iptables achieve security group functions, but there are"},{"line_number":22,"context_line":"following problems."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Problem 1:"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_99a8d3dc","line":21,"in_reply_to":"baada198_8324f6c5","updated":"2014-07-04 07:05:25.000000000","message":"Done","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"2cbc34702d0a673a083c009aa3cdf0e1d1ea5139","unresolved":false,"context_lines":[{"line_number":42,"context_line":"The proposal is to improve security group performance based on existing"},{"line_number":43,"context_line":"security group agent codes."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"In security group agent, it makes use of ipset to optimize the iptables rule"},{"line_number":46,"context_line":"chain. When a port is created, security group agent will add a additional ipset"},{"line_number":47,"context_line":"chain to it\u0027s iptables chain, if the security group that this port belongs to"},{"line_number":48,"context_line":"has rules between other security group, the member of that security group will"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_830b1629","line":45,"updated":"2014-07-03 17:42:33.000000000","message":"It\u0027s not the \"security group agent\" but \"l2 agent\"? \n\nNot sure if some plugins have different agents for that.","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"b939c806f021bc36020b24519ec814c4ac78ea2d","unresolved":false,"context_lines":[{"line_number":42,"context_line":"The proposal is to improve security group performance based on existing"},{"line_number":43,"context_line":"security group agent codes."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"In security group agent, it makes use of ipset to optimize the iptables rule"},{"line_number":46,"context_line":"chain. When a port is created, security group agent will add a additional ipset"},{"line_number":47,"context_line":"chain to it\u0027s iptables chain, if the security group that this port belongs to"},{"line_number":48,"context_line":"has rules between other security group, the member of that security group will"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_59655bb3","line":45,"in_reply_to":"baada198_6b7970c7","updated":"2014-07-04 07:05:25.000000000","message":"thanks for your explanation.","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"b939c806f021bc36020b24519ec814c4ac78ea2d","unresolved":false,"context_lines":[{"line_number":42,"context_line":"The proposal is to improve security group performance based on existing"},{"line_number":43,"context_line":"security group agent codes."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"In security group agent, it makes use of ipset to optimize the iptables rule"},{"line_number":46,"context_line":"chain. When a port is created, security group agent will add a additional ipset"},{"line_number":47,"context_line":"chain to it\u0027s iptables chain, if the security group that this port belongs to"},{"line_number":48,"context_line":"has rules between other security group, the member of that security group will"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_b997578f","line":45,"in_reply_to":"baada198_830b1629","updated":"2014-07-04 07:05:25.000000000","message":"I agree with Salvatore Orlando.","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"b9d19c20fbf9de0ef4faa1d6d539e67fbadbd1a0","unresolved":false,"context_lines":[{"line_number":42,"context_line":"The proposal is to improve security group performance based on existing"},{"line_number":43,"context_line":"security group agent codes."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"In security group agent, it makes use of ipset to optimize the iptables rule"},{"line_number":46,"context_line":"chain. When a port is created, security group agent will add a additional ipset"},{"line_number":47,"context_line":"chain to it\u0027s iptables chain, if the security group that this port belongs to"},{"line_number":48,"context_line":"has rules between other security group, the member of that security group will"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_6b7970c7","line":45,"in_reply_to":"baada198_830b1629","updated":"2014-07-03 23:45:47.000000000","message":"techinically there is a security group agent module that runs as a part of the l2 agent","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"2cbc34702d0a673a083c009aa3cdf0e1d1ea5139","unresolved":false,"context_lines":[{"line_number":52,"context_line":"port1[ SG1_Rules{protocol, direction, ip_prefix...},"},{"line_number":53,"context_line":"SG2_Rules{protocol, direction, remote_group_member{ip1, ip2...}...}]"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"for example:"},{"line_number":56,"context_line":"SG2:member[192.168.85.1, 192.168.85.4]"},{"line_number":57,"context_line":"SG1:rules[{tcp, ingress, 192.168.83.0/24...},{tcp, ingress, SG2_ID...}]"},{"line_number":58,"context_line":"then neutron server generates rules for SG1 member like this:"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_8e609dd0","line":55,"updated":"2014-07-03 17:42:33.000000000","message":"This is left into this spec now https://review.openstack.org/#/c/104522/, \n\nMay be it\u0027s good to clear this here, to make your spec clearer, and \ndiscuss those details over the other review.","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"b939c806f021bc36020b24519ec814c4ac78ea2d","unresolved":false,"context_lines":[{"line_number":52,"context_line":"port1[ SG1_Rules{protocol, direction, ip_prefix...},"},{"line_number":53,"context_line":"SG2_Rules{protocol, direction, remote_group_member{ip1, ip2...}...}]"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"for example:"},{"line_number":56,"context_line":"SG2:member[192.168.85.1, 192.168.85.4]"},{"line_number":57,"context_line":"SG1:rules[{tcp, ingress, 192.168.83.0/24...},{tcp, ingress, SG2_ID...}]"},{"line_number":58,"context_line":"then neutron server generates rules for SG1 member like this:"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_f900efac","line":55,"in_reply_to":"baada198_8e609dd0","updated":"2014-07-04 07:05:25.000000000","message":"ok","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"b9d19c20fbf9de0ef4faa1d6d539e67fbadbd1a0","unresolved":false,"context_lines":[{"line_number":93,"context_line":"Performance Impact"},{"line_number":94,"context_line":"------------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"None."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Other deployer impact"},{"line_number":99,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_4b3f4cd6","line":96,"updated":"2014-07-03 23:45:47.000000000","message":"Uhm... you mentioned this will remove performance bottlenecks connected with large RPC payloads and need to recreate chaings","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"b939c806f021bc36020b24519ec814c4ac78ea2d","unresolved":false,"context_lines":[{"line_number":93,"context_line":"Performance Impact"},{"line_number":94,"context_line":"------------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"None."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Other deployer impact"},{"line_number":99,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_59339baa","line":96,"in_reply_to":"baada198_4b3f4cd6","updated":"2014-07-04 07:05:25.000000000","message":"Done","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"b9d19c20fbf9de0ef4faa1d6d539e67fbadbd1a0","unresolved":false,"context_lines":[{"line_number":98,"context_line":"Other deployer impact"},{"line_number":99,"context_line":"---------------------"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"None."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Developer impact"},{"line_number":104,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_ab2d48aa","line":101,"updated":"2014-07-03 23:45:47.000000000","message":"we need to smoothly transition from iptables to ipset - and most importantly, let people have an option to run iptables if they wish so.\n\nPlease use this section to describe how you think this should be done - and if you think it should not be done please state somewhere else why you think so.","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"82211a63badcb8fa64d2f79fd5073fc784cf9a50","unresolved":false,"context_lines":[{"line_number":98,"context_line":"Other deployer impact"},{"line_number":99,"context_line":"---------------------"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"None."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Developer impact"},{"line_number":104,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_41fc8172","line":101,"in_reply_to":"baada198_19c3e357","updated":"2014-07-04 08:35:43.000000000","message":"Yes, but what if a deployer doesn\u0027t provide ipset in their system, or\nit doesn\u0027t work well.\n\nI agree with Salvatore, it may make sense to let the user select between iptables or iptables+ipset.\n\nAny ideas regarding this?","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"b939c806f021bc36020b24519ec814c4ac78ea2d","unresolved":false,"context_lines":[{"line_number":98,"context_line":"Other deployer impact"},{"line_number":99,"context_line":"---------------------"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"None."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Developer impact"},{"line_number":104,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_19c3e357","line":101,"in_reply_to":"baada198_ab2d48aa","updated":"2014-07-04 07:05:25.000000000","message":"hi Salvatore Orlando, my implemention is not to replace iptables with ipset,  my approach is to use a combination of iptables and ipset optimize the implementation of the security group.","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"b9d19c20fbf9de0ef4faa1d6d539e67fbadbd1a0","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Work Items"},{"line_number":120,"context_line":"----------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Improve \u0027security_group_rules_for_devices\u0027"},{"line_number":123,"context_line":"* Add ipset chain in \u0027_add_rule_by_security_group\u0027"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_4b166c56","line":120,"updated":"2014-07-03 23:45:47.000000000","message":"I would prefer to have a distinct firewall driver for ipsets. What would be the argument for not going this way?","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"2cbc34702d0a673a083c009aa3cdf0e1d1ea5139","unresolved":false,"context_lines":[{"line_number":119,"context_line":"Work Items"},{"line_number":120,"context_line":"----------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Improve \u0027security_group_rules_for_devices\u0027"},{"line_number":123,"context_line":"* Add ipset chain in \u0027_add_rule_by_security_group\u0027"},{"line_number":124,"context_line":"* Unit tests"},{"line_number":125,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_8eb7bd39","line":122,"updated":"2014-07-03 17:42:33.000000000","message":"https://review.openstack.org/#/c/104522/","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"b939c806f021bc36020b24519ec814c4ac78ea2d","unresolved":false,"context_lines":[{"line_number":119,"context_line":"Work Items"},{"line_number":120,"context_line":"----------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Improve \u0027security_group_rules_for_devices\u0027"},{"line_number":123,"context_line":"* Add ipset chain in \u0027_add_rule_by_security_group\u0027"},{"line_number":124,"context_line":"* Unit tests"},{"line_number":125,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_d9cfab54","line":122,"in_reply_to":"baada198_8eb7bd39","updated":"2014-07-04 07:05:25.000000000","message":"Done","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"2cbc34702d0a673a083c009aa3cdf0e1d1ea5139","unresolved":false,"context_lines":[{"line_number":120,"context_line":"----------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Improve \u0027security_group_rules_for_devices\u0027"},{"line_number":123,"context_line":"* Add ipset chain in \u0027_add_rule_by_security_group\u0027"},{"line_number":124,"context_line":"* Unit tests"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_4e9845c0","line":123,"updated":"2014-07-03 17:42:33.000000000","message":"This is in the agent side, right?","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"b939c806f021bc36020b24519ec814c4ac78ea2d","unresolved":false,"context_lines":[{"line_number":120,"context_line":"----------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Improve \u0027security_group_rules_for_devices\u0027"},{"line_number":123,"context_line":"* Add ipset chain in \u0027_add_rule_by_security_group\u0027"},{"line_number":124,"context_line":"* Unit tests"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_59e47be0","line":123,"in_reply_to":"baada198_4e9845c0","updated":"2014-07-04 07:05:25.000000000","message":"yes, it is in the agent side.","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"2cbc34702d0a673a083c009aa3cdf0e1d1ea5139","unresolved":false,"context_lines":[{"line_number":134,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Continuous integration testing to test the security group at the gate will be"},{"line_number":137,"context_line":"considered."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_ceeb7511","line":137,"updated":"2014-07-03 17:42:33.000000000","message":"Don\u0027t we have that already in tempest? we may write something there if we don\u0027t \nhave that kind of tests there.","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"b939c806f021bc36020b24519ec814c4ac78ea2d","unresolved":false,"context_lines":[{"line_number":134,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Continuous integration testing to test the security group at the gate will be"},{"line_number":137,"context_line":"considered."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":17,"id":"baada198_f9e2af9e","line":137,"in_reply_to":"baada198_ceeb7511","updated":"2014-07-04 07:05:25.000000000","message":"yes, there already  have tests in tempest.","commit_id":"7f41b943ec6c719b4686f9baca0b08bceea23020"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"0964e49dc49884a8841a83048a5c3586376f87e9","unresolved":false,"context_lines":[{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Performance Impact"},{"line_number":77,"context_line":"------------------"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"None."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Other deployer impact"}],"source_content_type":"text/x-rst","patch_set":18,"id":"baada198_8155b951","line":78,"updated":"2014-07-04 08:43:59.000000000","message":"Do we have any numbers to \"sell\" how good is going this feature to be?\n\nI suppose there are two gains:\n\n1) iptables-save / iptables-load time will be greatly reduced, as we just need\nto modify one ipset per security group, and not all the bunch of duplicated rules per port.\n\n2) Kernel evaluation time for IP packets, there are any numbers from ipset or any benchmark of this?\n\nI know with iptables, kernel has to linearly go evaluating after all iptables rules in chain order, while for an ipset in iptables, a lots of rules will become into a \"hash\" with much faster evaluation, am I correct?","commit_id":"0281b2f89d5b9f881ec7d9bcd2110da67ebee2d6"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"2b7b0f212ee3ca6ffdde5564bedab9cd9930e750","unresolved":false,"context_lines":[{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Performance Impact"},{"line_number":77,"context_line":"------------------"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"None."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Other deployer impact"}],"source_content_type":"text/x-rst","patch_set":18,"id":"baada198_4c2e6644","line":78,"in_reply_to":"baada198_8155b951","updated":"2014-07-05 05:46:32.000000000","message":"thanks for your good suggestion, I will add these two gains.\nI agree with you that kernel has to linearly go evaluating after all iptables rules in chain order, but for ipset, a lots of rules will become into a \"hash\".","commit_id":"0281b2f89d5b9f881ec7d9bcd2110da67ebee2d6"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"0964e49dc49884a8841a83048a5c3586376f87e9","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Other deployer impact"},{"line_number":82,"context_line":"---------------------"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"None."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":18,"id":"baada198_e143d5ac","line":83,"updated":"2014-07-04 08:43:59.000000000","message":"Bringing forward the conversation of the previous patchset:\n\nSalvatore Orlando\t\t1:45 AM\nwe need to smoothly transition from iptables to ipset - and most importantly, let \n\npeople have an option to run iptables if they wish so.\n\nPlease use this section to describe how you think this should be done - and if you \n\nthink it should not be done please state somewhere else why you think so.\n\t\t\t\n\nshihanzhang\t\t9:05 AM\n\nhi Salvatore Orlando, my implemention is not to replace iptables with ipset, my \n\napproach is to use a combination of iptables and ipset optimize the implementation of \n\nthe security group.\n\n\nMiguel Angel Ajo:\nYes, but what if a deployer doesn\u0027t provide ipset in their system, or it doesn\u0027t work well.\nI agree with Salvatore, it may make sense to let the user select between iptables or iptables+ipset.\nAny ideas regarding this?","commit_id":"0281b2f89d5b9f881ec7d9bcd2110da67ebee2d6"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"2b7b0f212ee3ca6ffdde5564bedab9cd9930e750","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Other deployer impact"},{"line_number":82,"context_line":"---------------------"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"None."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":18,"id":"baada198_ac29c238","line":83,"in_reply_to":"baada198_e143d5ac","updated":"2014-07-05 05:46:32.000000000","message":"I think that \u0027iptables+ipset\u0027 is the best implemention for security group, but I agree with you that this can be optional if a deployer doesn\u0027t provide ipset in their system.","commit_id":"0281b2f89d5b9f881ec7d9bcd2110da67ebee2d6"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"9e98f7bd7192204f852cfba7f726458247fb44c3","unresolved":false,"context_lines":[{"line_number":40,"context_line":"chain. When a port is created, security group agent will add a additional ipset"},{"line_number":41,"context_line":"chain to it\u0027s iptables chain, if the security group that this port belongs to"},{"line_number":42,"context_line":"has rules between other security group, the member of that security group will"},{"line_number":43,"context_line":"add to ipset chain."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":19,"id":"baada198_66255bc1","line":43,"updated":"2014-07-10 18:10:00.000000000","message":"An example showing how ip tables rules will be different and how they will be more efficient would help me to understand what you intend to implement.","commit_id":"bdae4320a59d33c958e94ced7dadc563151ea1b7"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"bb75f8b44d24d52ba24fc0847757bbc2cc11625c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"chain. When a port is created, security group agent will add a additional ipset"},{"line_number":41,"context_line":"chain to it\u0027s iptables chain, if the security group that this port belongs to"},{"line_number":42,"context_line":"has rules between other security group, the member of that security group will"},{"line_number":43,"context_line":"add to ipset chain."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":19,"id":"baada198_e3b94ecc","line":43,"in_reply_to":"baada198_66255bc1","updated":"2014-07-11 00:33:51.000000000","message":"thanks for your review, I will make an example","commit_id":"bdae4320a59d33c958e94ced7dadc563151ea1b7"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"9e98f7bd7192204f852cfba7f726458247fb44c3","unresolved":false,"context_lines":[{"line_number":88,"context_line":"Other deployer impact"},{"line_number":89,"context_line":"---------------------"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Consindered a deployer doesn\u0027t provide ipset in their system, using"},{"line_number":92,"context_line":"\u0027iptables+ipset\u0027 to enhance security group will be optional."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"baada198_86f34f9e","line":91,"updated":"2014-07-10 18:10:00.000000000","message":"Not: Considered","commit_id":"bdae4320a59d33c958e94ced7dadc563151ea1b7"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"bb75f8b44d24d52ba24fc0847757bbc2cc11625c","unresolved":false,"context_lines":[{"line_number":88,"context_line":"Other deployer impact"},{"line_number":89,"context_line":"---------------------"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Consindered a deployer doesn\u0027t provide ipset in their system, using"},{"line_number":92,"context_line":"\u0027iptables+ipset\u0027 to enhance security group will be optional."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"baada198_03b1e2e0","line":91,"in_reply_to":"baada198_86f34f9e","updated":"2014-07-11 00:33:51.000000000","message":"Done","commit_id":"bdae4320a59d33c958e94ced7dadc563151ea1b7"},{"author":{"_account_id":261,"name":"Salvatore Orlando","email":"salv.orlando@gmail.com","username":"salvatore-orlando"},"change_message_id":"1c4206c6b7beea0406248454cca7410750c69a0e","unresolved":false,"context_lines":[{"line_number":118,"context_line":"---------------------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Considered a deployer doesn\u0027t provide ipset in their system, using"},{"line_number":121,"context_line":"\u0027iptables+ipset\u0027 to enhance security group will be optional."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":21,"id":"baada198_303d00de","line":121,"updated":"2014-07-14 09:49:02.000000000","message":"can you provide more details about how to make it optional?\n\nIs it something you can achieve just with a configuration flag?","commit_id":"6d2e91c1b4c4bd6dd6a337c2d13f0b5b617fdf4e"},{"author":{"_account_id":8976,"name":"shihanzhang","email":"ayshihanzhang@gmail.com","username":"shihanzhang"},"change_message_id":"4008c091d65e9609de9aa4fb34407dd6d601ae0d","unresolved":false,"context_lines":[{"line_number":118,"context_line":"---------------------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Considered a deployer doesn\u0027t provide ipset in their system, using"},{"line_number":121,"context_line":"\u0027iptables+ipset\u0027 to enhance security group will be optional."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":21,"id":"baada198_793763e3","line":121,"in_reply_to":"baada198_303d00de","updated":"2014-07-14 10:44:14.000000000","message":"yes, I will add a configuration flag in ovs_neutron_plugin.ini or linuxbridge_conf.ini, for example:\n[securitygroup]\nenable_ipset_enhance \u003d False","commit_id":"6d2e91c1b4c4bd6dd6a337c2d13f0b5b617fdf4e"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"937da8e2f7c4458404b9826c056a7472e578d7f2","unresolved":false,"context_lines":[{"line_number":122,"context_line":"A configuration flag will be added to L2 agent configuration file:"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"[securitygroup]"},{"line_number":125,"context_line":"enable_ipset_enhancement \u003d False"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Developer impact"},{"line_number":128,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":22,"id":"1abeadc6_84e1799c","line":125,"updated":"2014-08-20 12:18:20.000000000","message":"-1 to adding a new option for this. There\u0027s no need, IMO. You should just disable ipset use if ipset is not found on the system, and always enable it if it is.","commit_id":"2bc957d4c41fc48115c6513cd10eb88b40ea32a1"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"d98ac94db3258fba40dcd90cbf5f19d37f62e0bb","unresolved":false,"context_lines":[{"line_number":122,"context_line":"A configuration flag will be added to L2 agent configuration file:"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"[securitygroup]"},{"line_number":125,"context_line":"enable_ipset_enhancement \u003d False"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Developer impact"},{"line_number":128,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":22,"id":"1abeadc6_83af8f29","line":125,"in_reply_to":"1abeadc6_84e1799c","updated":"2014-08-21 05:54:24.000000000","message":"Not sure Jay, as it\u0027s a new feature, may be there are existing bugs that makes an operator wanting to disable it.\n\nMay be, Enabled by default, but auto-rollback (with error log) to no ipset if disabled... ?","commit_id":"2bc957d4c41fc48115c6513cd10eb88b40ea32a1"}]}