)]}'
{"neutron/agent/linux/iptables_comments.py":[{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"02f5b70afda02301fa59e45b0ad3f17cfaa6fbc9","unresolved":false,"context_lines":[{"line_number":28,"context_line":"DHCP_CLIENT \u003d \u0027Allow DHCP client traffic.\u0027"},{"line_number":29,"context_line":"DHCP_SPOOF \u003d \u0027Prevent DHCP Spoofing by VM.\u0027"},{"line_number":30,"context_line":"UNMATCHED \u003d \u0027Send unmatched traffic to the fallback chain.\u0027"},{"line_number":31,"context_line":"STATELESS_DROP \u003d (\"Drop TCP packets that don\u0027t have the SYN flag and don\u0027t \""},{"line_number":32,"context_line":"                  \"match an entry in conntrack.\")"},{"line_number":33,"context_line":"ALLOW_ASSOC \u003d (\u0027Direct packets associated with a known session to the RETURN \u0027"},{"line_number":34,"context_line":"               \u0027chain.\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a961159_528e26d2","line":31,"updated":"2015-01-15 14:34:08.000000000","message":"It is true for most cases, but precisely speaking, conntrack supports UDP and ICMP, so this comment seems too limited. I think Neutron uses conntrack for UDP connection too. My just idea is:\n\n  Drop packets whose connection is not established in a proper way and whose entry is not found in conntrack table.","commit_id":"56464b73e558b7681d6d4aac361471d743469c23"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"049a48554c551cc4ac0db62fd9f040356d75cd96","unresolved":false,"context_lines":[{"line_number":28,"context_line":"DHCP_CLIENT \u003d \u0027Allow DHCP client traffic.\u0027"},{"line_number":29,"context_line":"DHCP_SPOOF \u003d \u0027Prevent DHCP Spoofing by VM.\u0027"},{"line_number":30,"context_line":"UNMATCHED \u003d \u0027Send unmatched traffic to the fallback chain.\u0027"},{"line_number":31,"context_line":"STATELESS_DROP \u003d (\"Drop TCP packets that don\u0027t have the SYN flag and don\u0027t \""},{"line_number":32,"context_line":"                  \"match an entry in conntrack.\")"},{"line_number":33,"context_line":"ALLOW_ASSOC \u003d (\u0027Direct packets associated with a known session to the RETURN \u0027"},{"line_number":34,"context_line":"               \u0027chain.\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a961159_5bf7215a","line":31,"in_reply_to":"3a961159_528e26d2","updated":"2015-01-15 15:44:15.000000000","message":"Probably should not use \"don\u0027t\" in the string, and how about something even simpler:\n\n\"Drop packets that do not match an existing conntrack entry.\"","commit_id":"56464b73e558b7681d6d4aac361471d743469c23"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"50c5b1d05dcb08d777cb22314073aff5e0e761c8","unresolved":false,"context_lines":[{"line_number":28,"context_line":"DHCP_CLIENT \u003d \u0027Allow DHCP client traffic.\u0027"},{"line_number":29,"context_line":"DHCP_SPOOF \u003d \u0027Prevent DHCP Spoofing by VM.\u0027"},{"line_number":30,"context_line":"UNMATCHED \u003d \u0027Send unmatched traffic to the fallback chain.\u0027"},{"line_number":31,"context_line":"STATELESS_DROP \u003d (\"Drop TCP packets that don\u0027t have the SYN flag and don\u0027t \""},{"line_number":32,"context_line":"                  \"match an entry in conntrack.\")"},{"line_number":33,"context_line":"ALLOW_ASSOC \u003d (\u0027Direct packets associated with a known session to the RETURN \u0027"},{"line_number":34,"context_line":"               \u0027chain.\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a961159_c16962c1","line":31,"in_reply_to":"3a961159_5bf7215a","updated":"2015-01-15 16:10:05.000000000","message":"I either like Brian\u0027s or, even leave it as it is.","commit_id":"56464b73e558b7681d6d4aac361471d743469c23"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"ab4533904756ae278050aee61fe2587607103412","unresolved":false,"context_lines":[{"line_number":28,"context_line":"DHCP_CLIENT \u003d \u0027Allow DHCP client traffic.\u0027"},{"line_number":29,"context_line":"DHCP_SPOOF \u003d \u0027Prevent DHCP Spoofing by VM.\u0027"},{"line_number":30,"context_line":"UNMATCHED \u003d \u0027Send unmatched traffic to the fallback chain.\u0027"},{"line_number":31,"context_line":"STATELESS_DROP \u003d (\"Drop TCP packets that don\u0027t have the SYN flag and don\u0027t \""},{"line_number":32,"context_line":"                  \"match an entry in conntrack.\")"},{"line_number":33,"context_line":"ALLOW_ASSOC \u003d (\u0027Direct packets associated with a known session to the RETURN \u0027"},{"line_number":34,"context_line":"               \u0027chain.\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a961159_28fbdb7b","line":31,"in_reply_to":"3a961159_c16962c1","updated":"2015-01-15 23:59:00.000000000","message":"That\u0027s not right and it\u0027s why I\u0027m changing the comment. If it just dropped packets with no state in the table, we wouldn\u0027t have functioning rules because this rule occurs before the other user-defined ALLOW rules.\n\nMatching INVALID is different from no entry. It means the packet looks like it should have an entry (e.g. TCP FIN/ACK), but it doesn\u0027t.\n\nhttp://unix.stackexchange.com/questions/57423/how-to-understand-why-the-packet-was-considered-invalid-by-the-iptables","commit_id":"56464b73e558b7681d6d4aac361471d743469c23"}]}