)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":14844,"name":"John Joyce","email":"joycej@cisco.com","username":"john_a_joyce"},"change_message_id":"9209d1230bd4041d7facf209a74caff384cfd32c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"3ab451fb_86049215","updated":"2015-04-17 15:10:18.000000000","message":"Why are these protections really necessary.    The network to VM path is protected by only allowing RAs from the default gateway.   So this patch is only providing protection to bare metal servers on provider networks.   I would argue that if the tenants are not trusted those bare metal servers would need much tighter security than this patch alone can handle.   Therefore this patch only serves to make openstack more restrictive,  while only providing a tiny bit of additional protection for those bare metal servers.","commit_id":"f425df1513113c59f1954fd3195847a40c1ec7fc"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"a9971fe1f675b12eab925d37c154d2076cee3ec0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"3ab451fb_bdfc343f","in_reply_to":"3ab451fb_86049215","updated":"2015-04-17 18:34:07.000000000","message":"Reg your statement: Network to VM path is protected by \"only\" allowing RAs from default gw.\nI\u0027m afraid its not \"ONLY\", what we do in Neutron is we add an ingress policy to allow a Router Advt from the default gw port. For Networks where LLA of the gateway cannot be derived, Neutron would not add any ingress policy and user is expected to add the corresponding ingress policy.\n\nYou also mentioned that bare metal servers need more security when tenants cannot be trusted, agreed. The patch is one step in the direction to protect the bare metal servers. What are the other security measures you think that are required? Depending on the feasibility, we can implement them in Neutron using additional patches. \n\nAs mentioned in the commit message, if a user desires not to have this protection he/she can use the port-security extension.","commit_id":"f425df1513113c59f1954fd3195847a40c1ec7fc"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"9cf4601252c198299630cf018a1ee184cdc1fc3c","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Advts from VMs assuming that it would be useful in Service VM use-cases."},{"line_number":22,"context_line":"In order to properly implement IPv6 router as a Service VM, one needs"},{"line_number":23,"context_line":"to use the port_security_extension [1] which allows us to disable"},{"line_number":24,"context_line":"security group rules/anti-spoofing filters on the VM ports."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"[1]https://review.openstack.org/#/c/99873/22/specs/kilo/ml2-ovs-portsecurity.rst"},{"line_number":27,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"bab921fb_5b22f7ba","line":24,"updated":"2015-04-22 18:03:44.000000000","message":"I\u0027m not sure what you\u0027re saying here.  So, are you saying that if I use the portsecurity extensions that this new rule will not be applied and I can run an ipv6 routing service vm?\n\nI don\u0027t see anything about router advertisements in the port security extension spec.  Would I need to turn off port security at both the port sending the RA and the port receiving it to have it work?\n\nThis might be getting outside of the scope of this patch but since you have a paragraph attempting to justify this patch based on this, I want to understand.","commit_id":"f425df1513113c59f1954fd3195847a40c1ec7fc"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"ec200710b5e2e104504036e13916e84a0af6d8cb","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Advts from VMs assuming that it would be useful in Service VM use-cases."},{"line_number":22,"context_line":"In order to properly implement IPv6 router as a Service VM, one needs"},{"line_number":23,"context_line":"to use the port_security_extension [1] which allows us to disable"},{"line_number":24,"context_line":"security group rules/anti-spoofing filters on the VM ports."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"[1]https://review.openstack.org/#/c/99873/22/specs/kilo/ml2-ovs-portsecurity.rst"},{"line_number":27,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"bab921fb_6a8f0e24","line":24,"in_reply_to":"bab921fb_5b22f7ba","updated":"2015-04-23 08:52:57.000000000","message":"Yes @Carl, if we disable port-security, the new rule (which will be part of anti-spoofing rules) will not be applied on the port. Since Anti-spoofing rules are not applied on the port, a VM will be able to forward traffic and provide router services inside the VM.\n\nOn the sender side, we will have to disable the port-security but on the receiver side it need not be disabled. \nThe traffic (like Router Advts) would be an ingress traffic to the receiver VMs. For VMs which are under the control of Neutron/Nova, users would have to configure the corresponding ingress firewall rules to allow the RAs. For bare-metal hosts on the provider network, since they are not under the control of Neutron, this patch would help in protecting such nodes (i.e., by not allowing a regular VM to transmit Router Advts and allowing such traffic if port-security is disabled, which BTW is an admin operation). Hope it is clear.\n\nThanks for reviewing the patch.","commit_id":"f425df1513113c59f1954fd3195847a40c1ec7fc"}],"neutron/agent/linux/iptables_firewall.py":[{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"f8967e34f52e48019a2d1a26bc629b07f29a8c55","unresolved":false,"context_lines":[{"line_number":253,"context_line":"        ipv4_rules +\u003d [comment_rule(\u0027-p udp -m udp --sport 68 --dport 67 \u0027"},{"line_number":254,"context_line":"                                    \u0027-j RETURN\u0027, comment\u003dic.DHCP_CLIENT)]"},{"line_number":255,"context_line":"        # Drop RAs if the port is part of a provider network"},{"line_number":256,"context_line":"        if port.get(\u0027provider:physical_network\u0027):"},{"line_number":257,"context_line":"            ipv6_rules +\u003d [comment_rule(\u0027-p icmpv6 --icmpv6-type %s \u0027"},{"line_number":258,"context_line":"                                        \u0027-j DROP\u0027 % constants.ICMPV6_TYPE_RA,"},{"line_number":259,"context_line":"                                        comment\u003dic.IPV6_RA_DROP)]"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a961159_22862c66","line":256,"updated":"2014-12-29 19:27:34.000000000","message":"It\u0027s defined as: neutron/extensions/providernet.py:PHYSICAL_NETWORK","commit_id":"52a8148bb478a9abd3f16adb09b3f5edfe90f6c3"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"33cdeb45c3957352f962d70ab980c23948a437e8","unresolved":false,"context_lines":[{"line_number":253,"context_line":"        ipv4_rules +\u003d [comment_rule(\u0027-p udp -m udp --sport 68 --dport 67 \u0027"},{"line_number":254,"context_line":"                                    \u0027-j RETURN\u0027, comment\u003dic.DHCP_CLIENT)]"},{"line_number":255,"context_line":"        # Drop RAs if the port is part of a provider network"},{"line_number":256,"context_line":"        if port.get(\u0027provider:physical_network\u0027):"},{"line_number":257,"context_line":"            ipv6_rules +\u003d [comment_rule(\u0027-p icmpv6 --icmpv6-type %s \u0027"},{"line_number":258,"context_line":"                                        \u0027-j DROP\u0027 % constants.ICMPV6_TYPE_RA,"},{"line_number":259,"context_line":"                                        comment\u003dic.IPV6_RA_DROP)]"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a961159_fc5e8378","line":256,"in_reply_to":"3a961159_22862c66","updated":"2014-12-30 10:16:00.000000000","message":"Done","commit_id":"52a8148bb478a9abd3f16adb09b3f5edfe90f6c3"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"9cf4601252c198299630cf018a1ee184cdc1fc3c","unresolved":false,"context_lines":[{"line_number":311,"context_line":"            mac_ipv6_pairs.append((mac, ip_address))"},{"line_number":312,"context_line":""},{"line_number":313,"context_line":"    def _spoofing_rule(self, port, ipv4_rules, ipv6_rules):"},{"line_number":314,"context_line":"        #Note(nati) allow dhcp or RA packet"},{"line_number":315,"context_line":"        ipv4_rules +\u003d [comment_rule(\u0027-p udp -m udp --sport 68 --dport 67 \u0027"},{"line_number":316,"context_line":"                                    \u0027-j RETURN\u0027, comment\u003dic.DHCP_CLIENT)]"},{"line_number":317,"context_line":"        # Drop Router Advts from the port."}],"source_content_type":"text/x-python","patch_set":9,"id":"bab921fb_1bc11f2f","line":314,"updated":"2015-04-22 18:03:44.000000000","message":"Should this note be adjusted?  It hints that RAs will be allowed.  Maybe the comment should be changed to \"allow dhcp client packets\".","commit_id":"f425df1513113c59f1954fd3195847a40c1ec7fc"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"ec200710b5e2e104504036e13916e84a0af6d8cb","unresolved":false,"context_lines":[{"line_number":311,"context_line":"            mac_ipv6_pairs.append((mac, ip_address))"},{"line_number":312,"context_line":""},{"line_number":313,"context_line":"    def _spoofing_rule(self, port, ipv4_rules, ipv6_rules):"},{"line_number":314,"context_line":"        #Note(nati) allow dhcp or RA packet"},{"line_number":315,"context_line":"        ipv4_rules +\u003d [comment_rule(\u0027-p udp -m udp --sport 68 --dport 67 \u0027"},{"line_number":316,"context_line":"                                    \u0027-j RETURN\u0027, comment\u003dic.DHCP_CLIENT)]"},{"line_number":317,"context_line":"        # Drop Router Advts from the port."}],"source_content_type":"text/x-python","patch_set":9,"id":"bab921fb_2ae7d6e5","line":314,"in_reply_to":"bab921fb_1bc11f2f","updated":"2015-04-23 08:52:57.000000000","message":"Sure I can modify the note.","commit_id":"f425df1513113c59f1954fd3195847a40c1ec7fc"}],"neutron/api/rpc/handlers/securitygroups_rpc.py":[{"author":{"_account_id":4656,"name":"Sean M. Collins","email":"sean@coreitpro.com","username":"scollins"},"change_message_id":"22cbf9dfbb9d387f1b76fdf57c461df0c0e92f18","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def _update_physical_network_info(self, context, ports):"},{"line_number":47,"context_line":"        physnet \u003d \u0027provider:physical_network\u0027"},{"line_number":48,"context_line":"        for port in ports.values():"},{"line_number":49,"context_line":"            physical_net \u003d self.plugin.get_network(context, port[\u0027network_id\u0027],"},{"line_number":50,"context_line":"                                                   fields\u003dphysnet)"},{"line_number":51,"context_line":"            port[physnet] \u003d physical_net[physnet]"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a961159_ebef9fae","line":48,"updated":"2014-12-09 01:20:24.000000000","message":"I prefer the shorter form:\n\nfor port in ports:\n\nI know there are some parts of the code that use ports.values(), but I think that\u0027s verbose as well as redundant.","commit_id":"40a0262566dcf7cef8b5c4de359ba89f0c6b6c5b"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"02aa7576adc345569c0058e739cf025c534b86cc","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def _update_physical_network_info(self, context, ports):"},{"line_number":47,"context_line":"        physnet \u003d \u0027provider:physical_network\u0027"},{"line_number":48,"context_line":"        for port in ports.values():"},{"line_number":49,"context_line":"            physical_net \u003d self.plugin.get_network(context, port[\u0027network_id\u0027],"},{"line_number":50,"context_line":"                                                   fields\u003dphysnet)"},{"line_number":51,"context_line":"            port[physnet] \u003d physical_net[physnet]"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a961159_58c87522","line":48,"in_reply_to":"3a961159_ebef9fae","updated":"2014-12-09 13:02:02.000000000","message":"Its a dictionary and is constructed in _get_devices_info() Line:40","commit_id":"40a0262566dcf7cef8b5c4de359ba89f0c6b6c5b"},{"author":{"_account_id":11061,"name":"Alexey I. Froloff","email":"raorn@raorn.name","username":"raorn"},"change_message_id":"53df9a61df7b2a40ef2d1198a59e245aaf1f649b","unresolved":false,"context_lines":[{"line_number":47,"context_line":"        physnet \u003d \u0027provider:physical_network\u0027"},{"line_number":48,"context_line":"        for port in ports.values():"},{"line_number":49,"context_line":"            physical_net \u003d self.plugin.get_network(context, port[\u0027network_id\u0027],"},{"line_number":50,"context_line":"                                                   fields\u003dphysnet)"},{"line_number":51,"context_line":"            port[physnet] \u003d physical_net[physnet]"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    def security_group_rules_for_devices(self, context, **kwargs):"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a961159_272b8c95","line":50,"updated":"2014-12-09 11:30:52.000000000","message":"You are querying database for each Port.  Isn\u0027t it better to \"cache\" networks somehow, so get_network() is called once for each distinct network_id?  Like:\n\n    nets \u003d {}\n    for port in ports:\n        physical_net \u003d nets.get(port[\u0027network_id\u0027])\n        if physical_net is None:\n            physical_net \u003d self.plugin.get_network(...)\n            nets[port[\u0027network_id\u0027]] \u003d physical_net\n        ...","commit_id":"40a0262566dcf7cef8b5c4de359ba89f0c6b6c5b"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"02aa7576adc345569c0058e739cf025c534b86cc","unresolved":false,"context_lines":[{"line_number":47,"context_line":"        physnet \u003d \u0027provider:physical_network\u0027"},{"line_number":48,"context_line":"        for port in ports.values():"},{"line_number":49,"context_line":"            physical_net \u003d self.plugin.get_network(context, port[\u0027network_id\u0027],"},{"line_number":50,"context_line":"                                                   fields\u003dphysnet)"},{"line_number":51,"context_line":"            port[physnet] \u003d physical_net[physnet]"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    def security_group_rules_for_devices(self, context, **kwargs):"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a961159_b8d5d9ba","line":50,"in_reply_to":"3a961159_272b8c95","updated":"2014-12-09 13:02:02.000000000","message":"Thanks Alexey. Its a good suggestion.","commit_id":"40a0262566dcf7cef8b5c4de359ba89f0c6b6c5b"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"f8967e34f52e48019a2d1a26bc629b07f29a8c55","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        )"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def _update_physical_network_info(self, context, ports):"},{"line_number":47,"context_line":"        physnet \u003d \u0027provider:physical_network\u0027"},{"line_number":48,"context_line":"        nets \u003d {}"},{"line_number":49,"context_line":"        for port in ports.values():"},{"line_number":50,"context_line":"            physical_network \u003d nets.get(port[\u0027network_id\u0027])"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a961159_427b387b","line":47,"updated":"2014-12-29 19:27:34.000000000","message":"There is a constant for that: neutron/extensions/providernet.py:PHYSICAL_NETWORK","commit_id":"52a8148bb478a9abd3f16adb09b3f5edfe90f6c3"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"33cdeb45c3957352f962d70ab980c23948a437e8","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        )"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def _update_physical_network_info(self, context, ports):"},{"line_number":47,"context_line":"        physnet \u003d \u0027provider:physical_network\u0027"},{"line_number":48,"context_line":"        nets \u003d {}"},{"line_number":49,"context_line":"        for port in ports.values():"},{"line_number":50,"context_line":"            physical_network \u003d nets.get(port[\u0027network_id\u0027])"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a961159_1c642f48","line":47,"in_reply_to":"3a961159_427b387b","updated":"2014-12-30 10:16:00.000000000","message":"Done","commit_id":"52a8148bb478a9abd3f16adb09b3f5edfe90f6c3"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"f8967e34f52e48019a2d1a26bc629b07f29a8c55","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    def _update_physical_network_info(self, context, ports):"},{"line_number":47,"context_line":"        physnet \u003d \u0027provider:physical_network\u0027"},{"line_number":48,"context_line":"        nets \u003d {}"},{"line_number":49,"context_line":"        for port in ports.values():"},{"line_number":50,"context_line":"            physical_network \u003d nets.get(port[\u0027network_id\u0027])"},{"line_number":51,"context_line":"            if physical_network is None:"},{"line_number":52,"context_line":"                physical_network \u003d self.plugin.get_network(context,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a961159_62803447","line":49,"updated":"2014-12-29 19:27:34.000000000","message":"Do you really need to construct a new list here? Probably not, so better use six.itervalues().","commit_id":"52a8148bb478a9abd3f16adb09b3f5edfe90f6c3"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"33cdeb45c3957352f962d70ab980c23948a437e8","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    def _update_physical_network_info(self, context, ports):"},{"line_number":47,"context_line":"        physnet \u003d \u0027provider:physical_network\u0027"},{"line_number":48,"context_line":"        nets \u003d {}"},{"line_number":49,"context_line":"        for port in ports.values():"},{"line_number":50,"context_line":"            physical_network \u003d nets.get(port[\u0027network_id\u0027])"},{"line_number":51,"context_line":"            if physical_network is None:"},{"line_number":52,"context_line":"                physical_network \u003d self.plugin.get_network(context,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a961159_d7536037","line":49,"in_reply_to":"3a961159_62803447","updated":"2014-12-30 10:16:00.000000000","message":"Done","commit_id":"52a8148bb478a9abd3f16adb09b3f5edfe90f6c3"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"f8967e34f52e48019a2d1a26bc629b07f29a8c55","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        \"\"\""},{"line_number":67,"context_line":"        devices_info \u003d kwargs.get(\u0027devices\u0027)"},{"line_number":68,"context_line":"        ports \u003d self._get_devices_info(devices_info)"},{"line_number":69,"context_line":"        self._update_physical_network_info(context, ports)"},{"line_number":70,"context_line":"        return self.plugin.security_group_rules_for_ports(context, ports)"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    def security_group_info_for_devices(self, context, **kwargs):"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a961159_8294408d","line":69,"updated":"2014-12-29 19:27:34.000000000","message":"It seems to me assuming too much, f.e. that self.plugin call won\u0027t drop provider:physical_network values from the list of ports. How about extending the list after self.plugin call is complete to make sure no plugin breaks your assumptions?","commit_id":"52a8148bb478a9abd3f16adb09b3f5edfe90f6c3"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"33cdeb45c3957352f962d70ab980c23948a437e8","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        \"\"\""},{"line_number":67,"context_line":"        devices_info \u003d kwargs.get(\u0027devices\u0027)"},{"line_number":68,"context_line":"        ports \u003d self._get_devices_info(devices_info)"},{"line_number":69,"context_line":"        self._update_physical_network_info(context, ports)"},{"line_number":70,"context_line":"        return self.plugin.security_group_rules_for_ports(context, ports)"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    def security_group_info_for_devices(self, context, **kwargs):"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a961159_a94cbcc9","line":69,"in_reply_to":"3a961159_8294408d","updated":"2014-12-30 10:16:00.000000000","message":"ok @Ihar, will update the same. Thanks for reviewing the patch.","commit_id":"52a8148bb478a9abd3f16adb09b3f5edfe90f6c3"},{"author":{"_account_id":6524,"name":"Henry Gessau","email":"HenryG@gessau.net","username":"gessau"},"change_message_id":"49b82f65a5f67b4f0b3bb3652067f9e2065a19d7","unresolved":false,"context_lines":[{"line_number":53,"context_line":"            if physical_network is None:"},{"line_number":54,"context_line":"                physical_network \u003d self.plugin.get_network(context,"},{"line_number":55,"context_line":"                                                           port[\u0027network_id\u0027],"},{"line_number":56,"context_line":"                                                           fields\u003dphysnet)"},{"line_number":57,"context_line":"                nets[port[\u0027network_id\u0027]] \u003d physical_network"},{"line_number":58,"context_line":"            port[physnet] \u003d physical_network.get(physnet)"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3a961159_b2a1a648","line":56,"updated":"2015-01-10 15:26:43.000000000","message":"Are you sure about this? Because of neutron.plugins.ml2.managers.TypeManager._extend_network_dict_provider(), even non-provider network dicts have a physnet field. Is the value of the physnet field guaranteed to be None for tenant networks?\n\nAlso, what about multi-segment networks?","commit_id":"2707f5d171526a5e4f1dd314a52dd7ab6b544811"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"c76aa0dab33a23af862bdc6b454f57aea60c696d","unresolved":false,"context_lines":[{"line_number":53,"context_line":"            if physical_network is None:"},{"line_number":54,"context_line":"                physical_network \u003d self.plugin.get_network(context,"},{"line_number":55,"context_line":"                                                           port[\u0027network_id\u0027],"},{"line_number":56,"context_line":"                                                           fields\u003dphysnet)"},{"line_number":57,"context_line":"                nets[port[\u0027network_id\u0027]] \u003d physical_network"},{"line_number":58,"context_line":"            port[physnet] \u003d physical_network.get(physnet)"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3a961159_508cc1d7","line":56,"in_reply_to":"3a961159_b2a1a648","updated":"2015-01-13 10:43:27.000000000","message":"Hi Henry,\n\nAFAIU \"provider:physical_network\", is used to map the existing physical network into Neutron Virtual network. I\u0027ve seen it used only for provider networks. For the tenant networks, I\u0027ve seen that this value is always None. Please let me know if this is not the case. \n\nThanks for pointing the multi-segment networks. I will update the patch to include multi-segments.\n\n--Sridhar.","commit_id":"2707f5d171526a5e4f1dd314a52dd7ab6b544811"},{"author":{"_account_id":6524,"name":"Henry Gessau","email":"HenryG@gessau.net","username":"gessau"},"change_message_id":"49b82f65a5f67b4f0b3bb3652067f9e2065a19d7","unresolved":false,"context_lines":[{"line_number":68,"context_line":"        \"\"\""},{"line_number":69,"context_line":"        devices_info \u003d kwargs.get(\u0027devices\u0027)"},{"line_number":70,"context_line":"        ports \u003d self._get_devices_info(devices_info)"},{"line_number":71,"context_line":"        sg_rules \u003d self.plugin.security_group_rules_for_ports(context, ports)"},{"line_number":72,"context_line":"        self._update_physical_network_info(context, sg_rules)"},{"line_number":73,"context_line":"        return sg_rules"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3a961159_32df76d8","line":71,"updated":"2015-01-10 15:26:43.000000000","message":"Nit: This is a little confusing. It took me some digging around to figure out that security_group_rules_for_ports() doesn\u0027t return rules, but returns the same ports dict (updated with the sg rule info for each port). So I think this would be much clearer if you just re-used the ports variable instead of sg_rules.","commit_id":"2707f5d171526a5e4f1dd314a52dd7ab6b544811"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"c76aa0dab33a23af862bdc6b454f57aea60c696d","unresolved":false,"context_lines":[{"line_number":68,"context_line":"        \"\"\""},{"line_number":69,"context_line":"        devices_info \u003d kwargs.get(\u0027devices\u0027)"},{"line_number":70,"context_line":"        ports \u003d self._get_devices_info(devices_info)"},{"line_number":71,"context_line":"        sg_rules \u003d self.plugin.security_group_rules_for_ports(context, ports)"},{"line_number":72,"context_line":"        self._update_physical_network_info(context, sg_rules)"},{"line_number":73,"context_line":"        return sg_rules"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3a961159_d05991fe","line":71,"in_reply_to":"3a961159_32df76d8","updated":"2015-01-13 10:43:27.000000000","message":"Done","commit_id":"2707f5d171526a5e4f1dd314a52dd7ab6b544811"},{"author":{"_account_id":6524,"name":"Henry Gessau","email":"HenryG@gessau.net","username":"gessau"},"change_message_id":"49b82f65a5f67b4f0b3bb3652067f9e2065a19d7","unresolved":false,"context_lines":[{"line_number":85,"context_line":"        \"\"\""},{"line_number":86,"context_line":"        devices_info \u003d kwargs.get(\u0027devices\u0027)"},{"line_number":87,"context_line":"        ports \u003d self._get_devices_info(devices_info)"},{"line_number":88,"context_line":"        sg_info \u003d self.plugin.security_group_info_for_ports(context, ports)"},{"line_number":89,"context_line":"        self._update_physical_network_info(context, sg_info[\u0027devices\u0027])"},{"line_number":90,"context_line":"        return sg_info"}],"source_content_type":"text/x-python","patch_set":5,"id":"3a961159_52eb227b","line":88,"updated":"2015-01-10 15:26:43.000000000","message":"Ditto","commit_id":"2707f5d171526a5e4f1dd314a52dd7ab6b544811"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"c76aa0dab33a23af862bdc6b454f57aea60c696d","unresolved":false,"context_lines":[{"line_number":85,"context_line":"        \"\"\""},{"line_number":86,"context_line":"        devices_info \u003d kwargs.get(\u0027devices\u0027)"},{"line_number":87,"context_line":"        ports \u003d self._get_devices_info(devices_info)"},{"line_number":88,"context_line":"        sg_info \u003d self.plugin.security_group_info_for_ports(context, ports)"},{"line_number":89,"context_line":"        self._update_physical_network_info(context, sg_info[\u0027devices\u0027])"},{"line_number":90,"context_line":"        return sg_info"}],"source_content_type":"text/x-python","patch_set":5,"id":"3a961159_306ad581","line":88,"in_reply_to":"3a961159_52eb227b","updated":"2015-01-13 10:43:27.000000000","message":"Done","commit_id":"2707f5d171526a5e4f1dd314a52dd7ab6b544811"}],"neutron/tests/unit/test_iptables_firewall.py":[{"author":{"_account_id":7183,"name":"Xu Han Peng","email":"xuhanp@linux.vnet.ibm.com","username":"xuhanp"},"change_message_id":"b2892082e674917cdfa885555af1c62c044b1103","unresolved":false,"context_lines":[{"line_number":909,"context_line":"            if port.get(\u0027provider:physical_network\u0027):"},{"line_number":910,"context_line":"                dhcp_rule +\u003d [mock.call.add_rule(\u0027ofake_dev\u0027, \u0027-p icmpv6 \u0027"},{"line_number":911,"context_line":"                                                 \u0027--icmpv6-type 134 \u0027"},{"line_number":912,"context_line":"                                                 \u0027-j DROP\u0027, comment\u003dNone)]"},{"line_number":913,"context_line":"            dhcp_rule +\u003d [mock.call.add_rule(\u0027ofake_dev\u0027,"},{"line_number":914,"context_line":"                                            \u0027-p icmpv6 -j RETURN\u0027,"},{"line_number":915,"context_line":"                                            comment\u003dNone),"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a961159_f116ac57","line":912,"updated":"2014-12-30 05:54:42.000000000","message":"Why the comment here is not ic.IPV6_RA_DROP?","commit_id":"52a8148bb478a9abd3f16adb09b3f5edfe90f6c3"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"33cdeb45c3957352f962d70ab980c23948a437e8","unresolved":false,"context_lines":[{"line_number":909,"context_line":"            if port.get(\u0027provider:physical_network\u0027):"},{"line_number":910,"context_line":"                dhcp_rule +\u003d [mock.call.add_rule(\u0027ofake_dev\u0027, \u0027-p icmpv6 \u0027"},{"line_number":911,"context_line":"                                                 \u0027--icmpv6-type 134 \u0027"},{"line_number":912,"context_line":"                                                 \u0027-j DROP\u0027, comment\u003dNone)]"},{"line_number":913,"context_line":"            dhcp_rule +\u003d [mock.call.add_rule(\u0027ofake_dev\u0027,"},{"line_number":914,"context_line":"                                            \u0027-p icmpv6 -j RETURN\u0027,"},{"line_number":915,"context_line":"                                            comment\u003dNone),"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a961159_8cf38e9e","line":912,"in_reply_to":"3a961159_f116ac57","updated":"2014-12-30 10:16:00.000000000","message":"We are overriding the comment_iptables_rules to False at \nhttps://github.com/openstack/neutron/blob/master/neutron/tests/unit/test_iptables_firewall.py#L44\n\nThanks for reviewing the patch.","commit_id":"52a8148bb478a9abd3f16adb09b3f5edfe90f6c3"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"4c45aa800e644b2cff82ad8e791a8204909dfeac","unresolved":false,"context_lines":[{"line_number":906,"context_line":"            dhcp_rule \u003d []"},{"line_number":907,"context_line":"            if port.get(pnet.PHYSICAL_NETWORK):"},{"line_number":908,"context_line":"                dhcp_rule +\u003d [mock.call.add_rule(\u0027ofake_dev\u0027, \u0027-p icmpv6 \u0027"},{"line_number":909,"context_line":"                                                 \u0027--icmpv6-type 134 \u0027"},{"line_number":910,"context_line":"                                                 \u0027-j DROP\u0027, comment\u003dNone)]"},{"line_number":911,"context_line":"            dhcp_rule +\u003d [mock.call.add_rule(\u0027ofake_dev\u0027,"},{"line_number":912,"context_line":"                                            \u0027-p icmpv6 -j RETURN\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a961159_0341f20a","line":909,"updated":"2015-01-05 09:33:38.000000000","message":"I think you should use constants.ICMPV6_TYPE_RA here instead.","commit_id":"19ab023f65a9014a2bd7311a14fc0e62f193b8e1"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"f93bdd2f2ea32f9d615b0638be22459d25b0ff63","unresolved":false,"context_lines":[{"line_number":906,"context_line":"            dhcp_rule \u003d []"},{"line_number":907,"context_line":"            if port.get(pnet.PHYSICAL_NETWORK):"},{"line_number":908,"context_line":"                dhcp_rule +\u003d [mock.call.add_rule(\u0027ofake_dev\u0027, \u0027-p icmpv6 \u0027"},{"line_number":909,"context_line":"                                                 \u0027--icmpv6-type 134 \u0027"},{"line_number":910,"context_line":"                                                 \u0027-j DROP\u0027, comment\u003dNone)]"},{"line_number":911,"context_line":"            dhcp_rule +\u003d [mock.call.add_rule(\u0027ofake_dev\u0027,"},{"line_number":912,"context_line":"                                            \u0027-p icmpv6 -j RETURN\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a961159_49a95bdc","line":909,"in_reply_to":"3a961159_0341f20a","updated":"2015-01-05 11:13:13.000000000","message":"Done","commit_id":"19ab023f65a9014a2bd7311a14fc0e62f193b8e1"}],"neutron/tests/unit/test_security_groups_rpc.py":[{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"4c45aa800e644b2cff82ad8e791a8204909dfeac","unresolved":false,"context_lines":[{"line_number":280,"context_line":"            not in plugin_obj.supported_extension_aliases):"},{"line_number":281,"context_line":"            self.skipTest(\"Test depends on provider extension\")"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"        physical_net \u003d \u0027provider:physical_network\u0027"},{"line_number":284,"context_line":"        segment \u003d {\u0027provider:network_type\u0027: \u0027flat\u0027,"},{"line_number":285,"context_line":"                   physical_net: \u0027physnet\u0027}"},{"line_number":286,"context_line":"        with self.network(segment\u003dsegment) as n:"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a961159_636c769e","line":283,"updated":"2015-01-05 09:33:38.000000000","message":"You should use constant here too.","commit_id":"19ab023f65a9014a2bd7311a14fc0e62f193b8e1"},{"author":{"_account_id":10257,"name":"Sridhar Gaddam","email":"sgaddam@redhat.com","username":"sridhargaddam"},"change_message_id":"f93bdd2f2ea32f9d615b0638be22459d25b0ff63","unresolved":false,"context_lines":[{"line_number":280,"context_line":"            not in plugin_obj.supported_extension_aliases):"},{"line_number":281,"context_line":"            self.skipTest(\"Test depends on provider extension\")"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"        physical_net \u003d \u0027provider:physical_network\u0027"},{"line_number":284,"context_line":"        segment \u003d {\u0027provider:network_type\u0027: \u0027flat\u0027,"},{"line_number":285,"context_line":"                   physical_net: \u0027physnet\u0027}"},{"line_number":286,"context_line":"        with self.network(segment\u003dsegment) as n:"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a961159_4945db13","line":283,"in_reply_to":"3a961159_636c769e","updated":"2015-01-05 11:13:13.000000000","message":"Done","commit_id":"19ab023f65a9014a2bd7311a14fc0e62f193b8e1"}]}