)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"df6b20e6333b2b0b66d144f5b8b26ee8fe84d915","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Ensure netfilter is enabled for bridges with OVS-Hybrid Driver"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Since security-groups use iptables rules on Linux bridges with"},{"line_number":10,"context_line":"OVSHybridIptablesFirewallDriver, we need to ensure that netfilter is"},{"line_number":11,"context_line":"enabled for bridges.  Unfortunately, there seems to be a long history"},{"line_number":12,"context_line":"of distributions having differing defaults for this, best described in"},{"line_number":13,"context_line":"[1]."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9af37de9_a4f54e84","line":10,"updated":"2015-05-11 09:03:31.000000000","message":"It seems to affect more generally IptablesFirewallDriver as the 3 commandsyou added are not called when using linuxbridge agent","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"89789c0f47443439a0291a0147c051aae1f108fb","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Ensure netfilter is enabled for bridges with OVS-Hybrid Driver"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Since security-groups use iptables rules on Linux bridges with"},{"line_number":10,"context_line":"OVSHybridIptablesFirewallDriver, we need to ensure that netfilter is"},{"line_number":11,"context_line":"enabled for bridges.  Unfortunately, there seems to be a long history"},{"line_number":12,"context_line":"of distributions having differing defaults for this, best described in"},{"line_number":13,"context_line":"[1]."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9af37de9_ad1aca15","line":10,"in_reply_to":"9af37de9_10657044","updated":"2015-05-11 13:05:53.000000000","message":"Cedric is right: https://github.com/openstack-dev/devstack/blob/master/lib/neutron_plugins/linuxbridge_agent#L47","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"89308d25b073d5c9583420d0e1644f7cfaed10fb","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Ensure netfilter is enabled for bridges with OVS-Hybrid Driver"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Since security-groups use iptables rules on Linux bridges with"},{"line_number":10,"context_line":"OVSHybridIptablesFirewallDriver, we need to ensure that netfilter is"},{"line_number":11,"context_line":"enabled for bridges.  Unfortunately, there seems to be a long history"},{"line_number":12,"context_line":"of distributions having differing defaults for this, best described in"},{"line_number":13,"context_line":"[1]."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9af37de9_8d1a666d","line":10,"in_reply_to":"9af37de9_10657044","updated":"2015-05-11 13:09:18.000000000","message":"so tihs does not work in IptablesFirewallDriver.__init__, because at that point no bridges may have been created, so the bridge module may not be loaded and thus the proc nodes aren\u0027t there (happens on some ci system, i think with older ubuntu maybe, depends on the distro)\n\nSo you think IptablesFirewallDriver.prepare_port_filter() is a better place?","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"3d9e2b9e89921c1fbda773240777ac1755fb8f5f","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Ensure netfilter is enabled for bridges with OVS-Hybrid Driver"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Since security-groups use iptables rules on Linux bridges with"},{"line_number":10,"context_line":"OVSHybridIptablesFirewallDriver, we need to ensure that netfilter is"},{"line_number":11,"context_line":"enabled for bridges.  Unfortunately, there seems to be a long history"},{"line_number":12,"context_line":"of distributions having differing defaults for this, best described in"},{"line_number":13,"context_line":"[1]."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9af37de9_b520d64a","line":10,"in_reply_to":"9af37de9_a4f54e84","updated":"2015-05-11 10:26:28.000000000","message":"I believe this only affects OVSHybridIptablesFirewallDriver, as that is where the hybrid model of applying the rules to an interface in the bridge happens.   for example, ryu CI uses the IptablesFirewallDriver and doesn\u0027t seem to load the bridge module at all","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"e69467369129c6ef04ef2deded5f45d28df304df","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Ensure netfilter is enabled for bridges with OVS-Hybrid Driver"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Since security-groups use iptables rules on Linux bridges with"},{"line_number":10,"context_line":"OVSHybridIptablesFirewallDriver, we need to ensure that netfilter is"},{"line_number":11,"context_line":"enabled for bridges.  Unfortunately, there seems to be a long history"},{"line_number":12,"context_line":"of distributions having differing defaults for this, best described in"},{"line_number":13,"context_line":"[1]."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9af37de9_10657044","line":10,"in_reply_to":"9af37de9_b520d64a","updated":"2015-05-11 11:23:19.000000000","message":"but linuxbridge uses it for sure","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"df6b20e6333b2b0b66d144f5b8b26ee8fe84d915","unresolved":false,"context_lines":[{"line_number":26,"context_line":"calls."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"[1] http://wiki.libvirt.org/page/Net.bridge-nf-call_and_sysctl.conf"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Change-Id: If2d316eb8c422dc1e4f34b17a50b93dd72993a99"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9af37de9_64d8861e","line":29,"updated":"2015-05-11 09:03:31.000000000","message":"please, create a bug for the change","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"3d9e2b9e89921c1fbda773240777ac1755fb8f5f","unresolved":false,"context_lines":[{"line_number":26,"context_line":"calls."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"[1] http://wiki.libvirt.org/page/Net.bridge-nf-call_and_sysctl.conf"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Change-Id: If2d316eb8c422dc1e4f34b17a50b93dd72993a99"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9af37de9_b5e7b611","line":29,"in_reply_to":"9af37de9_64d8861e","updated":"2015-05-11 10:26:28.000000000","message":"i\u0027m not sure what i\u0027d say in the bug other than what\u0027s here","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"e69467369129c6ef04ef2deded5f45d28df304df","unresolved":false,"context_lines":[{"line_number":26,"context_line":"calls."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"[1] http://wiki.libvirt.org/page/Net.bridge-nf-call_and_sysctl.conf"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Change-Id: If2d316eb8c422dc1e4f34b17a50b93dd72993a99"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9af37de9_b05ea443","line":29,"in_reply_to":"9af37de9_b5e7b611","updated":"2015-05-11 11:23:19.000000000","message":"It\u0027s not a trouble, the aim of a commit message is to describe what the commit does, creating a bug allows to trace its status from identification to resolution","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"}],"neutron/agent/linux/iptables_firewall.py":[{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"c0e5f0787a797ba6d54d2b7daff2538c336ccaba","unresolved":false,"context_lines":[{"line_number":76,"context_line":"        # These proc values ensure that netfilter is enabled on"},{"line_number":77,"context_line":"        # bridges; essential for enforcing security groups rules."},{"line_number":78,"context_line":"        # Distributions can differ on whether this is enabled by"},{"line_number":79,"context_line":"        # default or not (Ubuntu - yes, Redhat - no, for example)."},{"line_number":80,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":81,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":82,"context_line":"                      run_as_root\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_af3d09bd","line":79,"updated":"2015-05-07 11:25:30.000000000","message":"Just a nit: I would move this block out to a separate function.","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"7320945b9fe041bcc77a0de8322e69682b64958f","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        # Distributions can differ on whether this is enabled by"},{"line_number":79,"context_line":"        # default or not (Ubuntu - yes, Redhat - no, for example)."},{"line_number":80,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":81,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":82,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":83,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":84,"context_line":"                       \u0027net.bridge.bridge-nf-call-ip6tables\u003d1\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_410d333d","line":81,"updated":"2015-05-07 08:54:31.000000000","message":"I think we don\u0027t use arptables anywhere in the code and there is no guarantee that arptables module is loaded in kernel and could lead to exceptions.","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"ff9345013ccc8b75d54e958055711d3adf0aa159","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        # Distributions can differ on whether this is enabled by"},{"line_number":79,"context_line":"        # default or not (Ubuntu - yes, Redhat - no, for example)."},{"line_number":80,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":81,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":82,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":83,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":84,"context_line":"                       \u0027net.bridge.bridge-nf-call-ip6tables\u003d1\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_15cbeca6","line":81,"updated":"2015-05-07 12:20:15.000000000","message":"I\u0027m still thinking whether this is correct place to set it. Don\u0027t we need it only on computes? e.g. if we use firewall driver in namespace like fwaas does, it\u0027s not needed, right?\n\nMaybe ovs-agent would be more convenient?","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"7c945b0ecb141ea62338353c706aa10323fe900f","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        # Distributions can differ on whether this is enabled by"},{"line_number":79,"context_line":"        # default or not (Ubuntu - yes, Redhat - no, for example)."},{"line_number":80,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":81,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":82,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":83,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":84,"context_line":"                       \u0027net.bridge.bridge-nf-call-ip6tables\u003d1\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_8430efe9","line":81,"in_reply_to":"1aca2d91_15cbeca6","updated":"2015-05-07 12:56:01.000000000","message":"Thanks Miguel for pointing out. The one that is used by fwaas is iptables manager and not driver. So maybe this IS a correct place :)","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"5a900c2a265cbe40a0997b461f9a0cb0ea54a8b4","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        # Distributions can differ on whether this is enabled by"},{"line_number":79,"context_line":"        # default or not (Ubuntu - yes, Redhat - no, for example)."},{"line_number":80,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":81,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":82,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":83,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":84,"context_line":"                       \u0027net.bridge.bridge-nf-call-ip6tables\u003d1\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_7b77b73a","line":81,"in_reply_to":"1aca2d91_410d333d","updated":"2015-05-07 09:55:48.000000000","message":"All of these are provided by the bridge module [1] ... so they all exist.\n\nIf you\u0027re saying that we can ignore bridge-nf-call-arptables because it\u0027s not used in the code -- that may be correct.  but the documentation and also the other deployment methods (fuel, packstack) are doing this\n\n[1] http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/net/bridge/br_netfilter.c#n1065","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"92b9f2258784a9eca8b5e5762b0d6462ebf1565f","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        # Distributions can differ on whether this is enabled by"},{"line_number":79,"context_line":"        # default or not (Ubuntu - yes, Redhat - no, for example)."},{"line_number":80,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":81,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":82,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":83,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":84,"context_line":"                       \u0027net.bridge.bridge-nf-call-ip6tables\u003d1\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_3551480f","line":81,"in_reply_to":"1aca2d91_7b77b73a","updated":"2015-05-07 12:18:30.000000000","message":"Oh, my apologies. Thanks for the link, for some reason I thought it\u0027s part of arptables package (I was checking in Fedora) but I see it\u0027s just a userspace tool. Though I still think we should provide more user-friendly info in case module is not inserted.","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"7320945b9fe041bcc77a0de8322e69682b64958f","unresolved":false,"context_lines":[{"line_number":81,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":82,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":83,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":84,"context_line":"                       \u0027net.bridge.bridge-nf-call-ip6tables\u003d1\u0027],"},{"line_number":85,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":86,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":87,"context_line":"                       \u0027net.bridge.bridge-nf-call-iptables\u003d1\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_5c0e3635","line":84,"updated":"2015-05-07 08:54:31.000000000","message":"This is also not necessary as there might be systems running with ipv4 only. IptablesManager behaves accordingly and if this is the case, ip6tables are not called.","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"92b9f2258784a9eca8b5e5762b0d6462ebf1565f","unresolved":false,"context_lines":[{"line_number":81,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":82,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":83,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":84,"context_line":"                       \u0027net.bridge.bridge-nf-call-ip6tables\u003d1\u0027],"},{"line_number":85,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":86,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":87,"context_line":"                       \u0027net.bridge.bridge-nf-call-iptables\u003d1\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_559cc4bf","line":84,"in_reply_to":"1aca2d91_5bc07b2a","updated":"2015-05-07 12:18:30.000000000","message":"Apologies again, I mixed that with net.ipv6.conf.default.disable_ipv6","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"5a900c2a265cbe40a0997b461f9a0cb0ea54a8b4","unresolved":false,"context_lines":[{"line_number":81,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":82,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":83,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":84,"context_line":"                       \u0027net.bridge.bridge-nf-call-ip6tables\u003d1\u0027],"},{"line_number":85,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":86,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":87,"context_line":"                       \u0027net.bridge.bridge-nf-call-iptables\u003d1\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_5bc07b2a","line":84,"in_reply_to":"1aca2d91_5c0e3635","updated":"2015-05-07 09:55:48.000000000","message":"this should just be left for coverage of the ipv6 case.  as above, it\u0027s there because it\u0027s always provided by the bridge module","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"7320945b9fe041bcc77a0de8322e69682b64958f","unresolved":false,"context_lines":[{"line_number":84,"context_line":"                       \u0027net.bridge.bridge-nf-call-ip6tables\u003d1\u0027],"},{"line_number":85,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":86,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":87,"context_line":"                       \u0027net.bridge.bridge-nf-call-iptables\u003d1\u0027],"},{"line_number":88,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    @property"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_3c425a3f","line":87,"updated":"2015-05-07 08:54:31.000000000","message":"Maybe we should provide more user friendly message in case iptables is not loaded in kernel.","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"5a900c2a265cbe40a0997b461f9a0cb0ea54a8b4","unresolved":false,"context_lines":[{"line_number":84,"context_line":"                       \u0027net.bridge.bridge-nf-call-ip6tables\u003d1\u0027],"},{"line_number":85,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":86,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":87,"context_line":"                       \u0027net.bridge.bridge-nf-call-iptables\u003d1\u0027],"},{"line_number":88,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    @property"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_7bc5773a","line":87,"in_reply_to":"1aca2d91_3c425a3f","updated":"2015-05-07 09:55:48.000000000","message":"again, this comes from the bridge module.  i don\u0027t see how it can\u0027t be loaded at this point.  i think extra checks is probably overkill since there\u0027s nothing now","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"526158b8f8fa69dfe0a02e94f73b0edd1101c798","unresolved":false,"context_lines":[{"line_number":85,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":86,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":87,"context_line":"                       \u0027net.bridge.bridge-nf-call-iptables\u003d1\u0027],"},{"line_number":88,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    @property"},{"line_number":91,"context_line":"    def ports(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_2f99f91f","line":88,"updated":"2015-05-07 11:43:52.000000000","message":"Can any of this code raise an exception?\nIf yes, maybe its best to catch it and log.","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"92b9f2258784a9eca8b5e5762b0d6462ebf1565f","unresolved":false,"context_lines":[{"line_number":85,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":86,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":87,"context_line":"                       \u0027net.bridge.bridge-nf-call-iptables\u003d1\u0027],"},{"line_number":88,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    @property"},{"line_number":91,"context_line":"    def ports(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_aa3bb737","line":88,"in_reply_to":"1aca2d91_2f99f91f","updated":"2015-05-07 12:18:30.000000000","message":"Yeah, that\u0027s what I meant by my last comment :)","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"f0eec237379994abfe3c1561bf9ec7ea106c8aa6","unresolved":false,"context_lines":[{"line_number":85,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":86,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":87,"context_line":"                       \u0027net.bridge.bridge-nf-call-iptables\u003d1\u0027],"},{"line_number":88,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    @property"},{"line_number":91,"context_line":"    def ports(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_8a1ebb61","line":88,"in_reply_to":"1aca2d91_2f99f91f","updated":"2015-05-07 11:57:31.000000000","message":"You\u0027re totally right Gal!","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"c8e5d5b9b585ec00ee6d972b5ceff4b185bce5d9","unresolved":false,"context_lines":[{"line_number":85,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":86,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":87,"context_line":"                       \u0027net.bridge.bridge-nf-call-iptables\u003d1\u0027],"},{"line_number":88,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    @property"},{"line_number":91,"context_line":"    def ports(self):"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aca2d91_ead40fbe","line":88,"in_reply_to":"1aca2d91_2f99f91f","updated":"2015-05-07 12:09:54.000000000","message":"utils.execute() is pretty good about catching failing commands and logging the issue as an error ... i believe a runtime error is probably appropriate, because if this isn\u0027t set, then security groups won\u0027t work","commit_id":"b8489aa33a6d061980bec3cc15cd6ba73f4a1ea3"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"df6b20e6333b2b0b66d144f5b8b26ee8fe84d915","unresolved":false,"context_lines":[{"line_number":691,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":692,"context_line":"        # example)."},{"line_number":693,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":694,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":695,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":696,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":697,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"9af37de9_6473e64e","line":694,"updated":"2015-05-11 09:03:31.000000000","message":"(OVSHybrid)IptablesFirewallDriver constructor takes a namespace argument so you should use ip_lib.IPWrapper().netns.execute not utils.execute?","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"fbcf551a0ae4f4f05653b4a1a3452fad1e515250","unresolved":false,"context_lines":[{"line_number":691,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":692,"context_line":"        # example)."},{"line_number":693,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":694,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":695,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":696,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":697,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"9af37de9_a05531c7","line":694,"in_reply_to":"9af37de9_2d825a01","updated":"2015-05-11 13:27:57.000000000","message":"That was agreement with you Ian, I meant it\u0027s correct to run utils.execute() :)","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"473c1f63664b28b5a284be28fbe8f257d8633494","unresolved":false,"context_lines":[{"line_number":691,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":692,"context_line":"        # example)."},{"line_number":693,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":694,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":695,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":696,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":697,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"9af37de9_5b00b9aa","line":694,"in_reply_to":"9af37de9_55e40a3a","updated":"2015-05-11 11:33:33.000000000","message":"they are that\u0027s the aim of  (network) namespaces\n\n  sudo ip netns add red\n  sudo ip netns add blue\n  sudo ip netns exec red sysctl -w net.ipv4.ip_forward\u003d0\n  sudo ip netns exec blue sysctl -w net.ipv4.ip_forward\u003d1\n  sudo ip netns exec red sysctl net.ipv4.ip_forward # \u003d\u003d\u003e 0\n  sudo ip netns exec blue sysctl -w net.ipv4.ip_forward #  \u003d\u003d\u003e 1","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"89789c0f47443439a0291a0147c051aae1f108fb","unresolved":false,"context_lines":[{"line_number":691,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":692,"context_line":"        # example)."},{"line_number":693,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":694,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":695,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":696,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":697,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"9af37de9_adbe4afd","line":694,"in_reply_to":"9af37de9_5b00b9aa","updated":"2015-05-11 13:05:53.000000000","message":"Bridges created by nova are in root namespace.","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"89308d25b073d5c9583420d0e1644f7cfaed10fb","unresolved":false,"context_lines":[{"line_number":691,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":692,"context_line":"        # example)."},{"line_number":693,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":694,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":695,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":696,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":697,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"9af37de9_2d825a01","line":694,"in_reply_to":"9af37de9_5b00b9aa","updated":"2015-05-11 13:09:18.000000000","message":"yes, but even so they\u0027re not available in the namespace\n\n [root@fedora19 linux]# sysctl -a | grep bridge\n net.bridge.bridge-nf-call-arptables \u003d 1\n net.bridge.bridge-nf-call-ip6tables \u003d 1\n net.bridge.bridge-nf-call-iptables \u003d 1\n net.bridge.bridge-nf-filter-pppoe-tagged \u003d 0\n net.bridge.bridge-nf-filter-vlan-tagged \u003d 0\n net.bridge.bridge-nf-pass-vlan-input-dev \u003d 0\n [root@fedora19 linux]# ip netns add red\n [root@fedora19 linux]# ip netns exec red sysctl -a | grep bridge\n [root@fedora19 linux]#","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"3d9e2b9e89921c1fbda773240777ac1755fb8f5f","unresolved":false,"context_lines":[{"line_number":691,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":692,"context_line":"        # example)."},{"line_number":693,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":694,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":695,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":696,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":697,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"9af37de9_55e40a3a","line":694,"in_reply_to":"9af37de9_6473e64e","updated":"2015-05-11 10:26:28.000000000","message":"I do not believe these settings are affected by namespaces","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"914150ffe9b64354a7bf1c3df515b08bd33262ec","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":82,"context_line":"        # example)."},{"line_number":83,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":84,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":85,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":86,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":87,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9af37de9_6382b354","line":84,"updated":"2015-05-11 13:49:05.000000000","message":"you still should take into account namespace attribute, ie: use IPWrapper(...).netns.execute(...)","commit_id":"31acf7e6ab26544096c407f7e77aa74aa06e8937"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"6e77578431425c6d4257079fda80e7ca7bc7b0f4","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":82,"context_line":"        # example)."},{"line_number":83,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":84,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":85,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":86,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":87,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9af37de9_fee196ff","line":84,"in_reply_to":"9af37de9_6382b354","updated":"2015-05-11 14:15:29.000000000","message":"no, it must be used in root namespace, this code is correct. If it will be executed in namespace, it would fail.","commit_id":"31acf7e6ab26544096c407f7e77aa74aa06e8937"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"1f349ee5846514ff1215761c58032641d6a50b5f","unresolved":false,"context_lines":[{"line_number":22,"context_line":"from neutron.agent.linux import ipset_manager"},{"line_number":23,"context_line":"from neutron.agent.linux import iptables_comments as ic"},{"line_number":24,"context_line":"from neutron.agent.linux import iptables_manager"},{"line_number":25,"context_line":"from neutron.agent.linux import utils"},{"line_number":26,"context_line":"from neutron.common import constants"},{"line_number":27,"context_line":"from neutron.common import ipv6_utils"},{"line_number":28,"context_line":"from neutron.extensions import portsecurity as psec"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a0c5dc1_0a555b1c","line":25,"updated":"2015-05-12 02:08:30.000000000","message":"even if this module is linux-specific, it\u0027s better to use neutron.agent.common.utils.","commit_id":"c45e910ea73edd9d8c9550468b6282fd8b26ddaf"},{"author":{"_account_id":7715,"name":"Hirofumi Ichihara","email":"ichihara.hirofumi@gmail.com","username":"Hirofumi-Ichihara"},"change_message_id":"c96c51322e82ca8aa3d01e23e7000d5bcf23ce0e","unresolved":false,"context_lines":[{"line_number":72,"context_line":"            lambda: collections.defaultdict(list))"},{"line_number":73,"context_line":"        self.pre_sg_members \u003d None"},{"line_number":74,"context_line":"        self.enable_ipset \u003d cfg.CONF.SECURITYGROUP.enable_ipset"},{"line_number":75,"context_line":"        self._enabled_netfilter_for_bridges \u003d False"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    def _enable_netfilter_for_bridges(self):"},{"line_number":78,"context_line":"        # These proc values ensure that netfilter is enabled on"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a0c5dc1_bbdc5f47","line":75,"updated":"2015-05-12 04:19:14.000000000","message":"I get confused names between _enabled_netfilter_for_bridges and _enable_netfilter_for_bridges because they\u0027re more similar. Can you pick a name so that they are easily distinguished?","commit_id":"c45e910ea73edd9d8c9550468b6282fd8b26ddaf"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"cb101391720146589a80cbfb40083bc0873d13a7","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":82,"context_line":"        # example)."},{"line_number":83,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":84,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":85,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":86,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":87,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a016987_12c9e278","line":84,"updated":"2015-05-15 05:39:04.000000000","message":"it still does not respect namespace argument ... which implies at least: dsvm-functional test will pollute the root namespace and the configuration will never be cleaned after an iptables_firewall test.","commit_id":"c45e910ea73edd9d8c9550468b6282fd8b26ddaf"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"fa3e2a29637b09523b1d4f41f780948ea1ffd46c","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":82,"context_line":"        # example)."},{"line_number":83,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":84,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":85,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":86,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":87,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a016987_f2aac66f","line":84,"in_reply_to":"7a016987_12c9e278","updated":"2015-05-15 05:43:52.000000000","message":"good point.","commit_id":"c45e910ea73edd9d8c9550468b6282fd8b26ddaf"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"3d45891f52e79abff6d10e40cf90967c73479555","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":82,"context_line":"        # example)."},{"line_number":83,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":84,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":85,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":86,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":87,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a016987_52b19a8e","line":84,"in_reply_to":"7a016987_12c9e278","updated":"2015-05-15 05:58:20.000000000","message":"please see my prior point ... these nodes are *not* available within a namespace. \n\ni don\u0027t see what pollution you mean here.  these settings should be made globally.  3 different deployment solutions (packstack, fuel \u0026 in the documentation, if you consider \"by hand\" a deployment solution) already set this up.","commit_id":"c45e910ea73edd9d8c9550468b6282fd8b26ddaf"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"86053c4a35134c38dd337887ef3257c21f852ced","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":82,"context_line":"        # example)."},{"line_number":83,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":84,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":85,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":86,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":87,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a016987_ff1a8e16","line":84,"in_reply_to":"7a016987_52b19a8e","updated":"2015-05-15 07:09:51.000000000","message":"oops, you\u0027re right.\nthese are implemented as global vars in kernel.","commit_id":"c45e910ea73edd9d8c9550468b6282fd8b26ddaf"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"1f349ee5846514ff1215761c58032641d6a50b5f","unresolved":false,"context_lines":[{"line_number":123,"context_line":"        self._remove_chains()"},{"line_number":124,"context_line":"        self._set_ports(port)"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"        if not self._enabled_netfilter_for_bridges:"},{"line_number":127,"context_line":"            # do this here just once to ensure that a bridge has been"},{"line_number":128,"context_line":"            # created \u0026 the proc nodes are available."},{"line_number":129,"context_line":"            self._enable_netfilter_for_bridges()"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a0c5dc1_6d13d15d","line":126,"updated":"2015-05-12 02:08:30.000000000","message":"i personally prefer to move _enabled_netfilter_for_bridges handling into _enable_netfilter_for_bridges() itself.","commit_id":"c45e910ea73edd9d8c9550468b6282fd8b26ddaf"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"08c7e8c6125f4fa1d54301eab373dc63d11f77ab","unresolved":false,"context_lines":[{"line_number":123,"context_line":"        self._remove_chains()"},{"line_number":124,"context_line":"        self._set_ports(port)"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"        if not self._enabled_netfilter_for_bridges:"},{"line_number":127,"context_line":"            # do this here just once to ensure that a bridge has been"},{"line_number":128,"context_line":"            # created \u0026 the proc nodes are available."},{"line_number":129,"context_line":"            self._enable_netfilter_for_bridges()"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a016987_1d4bcb88","line":126,"in_reply_to":"9a0c5dc1_6d13d15d","updated":"2015-05-29 11:10:58.000000000","message":"Done","commit_id":"c45e910ea73edd9d8c9550468b6282fd8b26ddaf"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"de16c51af6fe4937bfca9c745d8d499cb46a8b6e","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":90,"context_line":"        # example)."},{"line_number":91,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":92,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":93,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":94,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":95,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":9,"id":"7a016987_206e2800","line":92,"updated":"2015-06-01 10:04:28.000000000","message":"Is there a way to limit the scope of the hooks to specific bridges? That would solve the issue that Maru has with global state changes.","commit_id":"359b7c971a88f6dff64e8e4d558210a880f3ee0f"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"fa651eb8e9c39a3c819553ff90dd0d92303b3c81","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        # enabled by default or not (Ubuntu - yes, Redhat - no, for"},{"line_number":90,"context_line":"        # example)."},{"line_number":91,"context_line":"        LOG.debug(\"Enabling netfilter for bridges\")"},{"line_number":92,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"},{"line_number":93,"context_line":"                       \u0027net.bridge.bridge-nf-call-arptables\u003d1\u0027],"},{"line_number":94,"context_line":"                      run_as_root\u003dTrue)"},{"line_number":95,"context_line":"        utils.execute([\u0027sysctl\u0027, \u0027-w\u0027,"}],"source_content_type":"text/x-python","patch_set":9,"id":"fa32b979_ae96eb3b","line":92,"in_reply_to":"7a016987_206e2800","updated":"2015-06-17 13:27:43.000000000","message":"no, it\u0027s a global setting AFAIK. No specific per bridge.","commit_id":"359b7c971a88f6dff64e8e4d558210a880f3ee0f"}],"neutron/tests/unit/agent/test_securitygroups_rpc.py":[{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"fba3123faeb506dbf0f1c1f11e4c2b0aed31b95d","unresolved":false,"context_lines":[{"line_number":2507,"context_line":"        cfg.CONF.set_override(\u0027comment_iptables_rules\u0027, False, group\u003d\u0027AGENT\u0027)"},{"line_number":2508,"context_line":""},{"line_number":2509,"context_line":"        self.utils_exec_p \u003d mock.patch(\u0027neutron.agent.linux.utils.execute\u0027)"},{"line_number":2510,"context_line":"        self.utils_exec \u003d self.utils_exec_p.start()"},{"line_number":2511,"context_line":""},{"line_number":2512,"context_line":"        self.rpc \u003d mock.Mock()"},{"line_number":2513,"context_line":"        self._init_agent(defer_refresh_firewall)"}],"source_content_type":"text/x-python","patch_set":6,"id":"9af37de9_ddb5c67e","line":2510,"updated":"2015-05-11 07:46:53.000000000","message":"Is utils_exec_p used anywhere? You can use\n\n self.utils_exec \u003d mock.patch(\u0027...\u0027).start()","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"6c355e100612a2ec4ee1be2fe011c66a3a1fffa1","unresolved":false,"context_lines":[{"line_number":2507,"context_line":"        cfg.CONF.set_override(\u0027comment_iptables_rules\u0027, False, group\u003d\u0027AGENT\u0027)"},{"line_number":2508,"context_line":""},{"line_number":2509,"context_line":"        self.utils_exec_p \u003d mock.patch(\u0027neutron.agent.linux.utils.execute\u0027)"},{"line_number":2510,"context_line":"        self.utils_exec \u003d self.utils_exec_p.start()"},{"line_number":2511,"context_line":""},{"line_number":2512,"context_line":"        self.rpc \u003d mock.Mock()"},{"line_number":2513,"context_line":"        self._init_agent(defer_refresh_firewall)"}],"source_content_type":"text/x-python","patch_set":6,"id":"9af37de9_8d4b86b0","line":2510,"in_reply_to":"9af37de9_ddb5c67e","updated":"2015-05-11 13:15:56.000000000","message":"Done","commit_id":"e11c70de2b846fb742505c92f553b5dfb5ca8595"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"6e77578431425c6d4257079fda80e7ca7bc7b0f4","unresolved":false,"context_lines":[{"line_number":2507,"context_line":"        cfg.CONF.set_override(\u0027comment_iptables_rules\u0027, False, group\u003d\u0027AGENT\u0027)"},{"line_number":2508,"context_line":""},{"line_number":2509,"context_line":"        self.utils_exec \u003d \\"},{"line_number":2510,"context_line":"            mock.patch(\u0027neutron.agent.linux.utils.execute\u0027).start()"},{"line_number":2511,"context_line":""},{"line_number":2512,"context_line":"        self.rpc \u003d mock.Mock()"},{"line_number":2513,"context_line":"        self._init_agent(defer_refresh_firewall)"}],"source_content_type":"text/x-python","patch_set":7,"id":"9af37de9_fe2ab62b","line":2510,"updated":"2015-05-11 14:15:29.000000000","message":"Please use \n \n self.utils_exec \u003d mock.patch(\n     \u0027neutron.agent...\u0027).start()\n\nhttp://docs.openstack.org/developer/hacking/#general","commit_id":"31acf7e6ab26544096c407f7e77aa74aa06e8937"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"8f01ee13049fb131e42d066fb9dde695eb93c9dd","unresolved":false,"context_lines":[{"line_number":2507,"context_line":"        cfg.CONF.set_override(\u0027comment_iptables_rules\u0027, False, group\u003d\u0027AGENT\u0027)"},{"line_number":2508,"context_line":""},{"line_number":2509,"context_line":"        self.utils_exec \u003d \\"},{"line_number":2510,"context_line":"            mock.patch(\u0027neutron.agent.linux.utils.execute\u0027).start()"},{"line_number":2511,"context_line":""},{"line_number":2512,"context_line":"        self.rpc \u003d mock.Mock()"},{"line_number":2513,"context_line":"        self._init_agent(defer_refresh_firewall)"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a0c5dc1_676d3232","line":2510,"in_reply_to":"9af37de9_fe2ab62b","updated":"2015-05-12 01:07:34.000000000","message":"Done","commit_id":"31acf7e6ab26544096c407f7e77aa74aa06e8937"}]}