)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"700bae23244a095032cbd67e9996f628349ea298","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"da6ed579_7ce445e0","line":22,"updated":"2016-01-13 21:37:59.000000000","message":"DocImpact","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"3fe354c7b34f5ef099c030c6d9bd1c0468d9b6af","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"da6ed579_beb84c76","line":22,"in_reply_to":"da6ed579_7ce445e0","updated":"2016-01-14 15:30:01.000000000","message":"Done","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":1561,"name":"Russell Bryant","email":"rbryant@redhat.com","username":"russellb"},"change_message_id":"14357240ecba357206af2dee3efc21a3ae112dff","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Jakub Libosvar \u003clibosvar@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-01-29 10:52:02 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"OpenVSwitch conntrack based firewall driver"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This firewall requires OVS 2.5+ version supporting conntrack. Functional"},{"line_number":10,"context_line":"tests are passing now. Note that OVS2.5 is not present in the gate,"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"5a5ae5dd_a6ce40b2","line":7,"updated":"2016-02-04 15:37:27.000000000","message":"Sorry for the nit, but: \"Open vSwitch\"","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"10c43b94517684e4c7aec15ff583b986b90954a4","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Jakub Libosvar \u003clibosvar@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-01-29 10:52:02 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"OpenVSwitch conntrack based firewall driver"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This firewall requires OVS 2.5+ version supporting conntrack. Functional"},{"line_number":10,"context_line":"tests are passing now. Note that OVS2.5 is not present in the gate,"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"5a5ae5dd_ba673424","line":7,"in_reply_to":"5a5ae5dd_a6ce40b2","updated":"2016-02-04 16:03:43.000000000","message":"I always want to fix it and always forget! :)","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"d60a5c4cf20fa70fc45eb47610f50bff0d235dd7","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This firewall requires OVS 2.5+ version supporting conntrack. Functional"},{"line_number":10,"context_line":"tests are passing now. Note that OVS2.5 is not present in the gate,"},{"line_number":11,"context_line":"we\u0027ll likely need to compile it for functional jobs."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"As part of this new entry points for current reference firewalls were"},{"line_number":14,"context_line":"added."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"7a5de9d1_36f76f8c","line":11,"updated":"2016-02-01 15:47:36.000000000","message":"Probably we need to fix the wording here and explain which jobs test it and how. :)\n\ncongrats!!!","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"10c43b94517684e4c7aec15ff583b986b90954a4","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This firewall requires OVS 2.5+ version supporting conntrack. Functional"},{"line_number":10,"context_line":"tests are passing now. Note that OVS2.5 is not present in the gate,"},{"line_number":11,"context_line":"we\u0027ll likely need to compile it for functional jobs."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"As part of this new entry points for current reference firewalls were"},{"line_number":14,"context_line":"added."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"5a5ae5dd_1a60c800","line":11,"in_reply_to":"5a5ae5dd_46742c67","updated":"2016-02-04 16:03:43.000000000","message":"Thanks","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":1561,"name":"Russell Bryant","email":"rbryant@redhat.com","username":"russellb"},"change_message_id":"14357240ecba357206af2dee3efc21a3ae112dff","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This firewall requires OVS 2.5+ version supporting conntrack. Functional"},{"line_number":10,"context_line":"tests are passing now. Note that OVS2.5 is not present in the gate,"},{"line_number":11,"context_line":"we\u0027ll likely need to compile it for functional jobs."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"As part of this new entry points for current reference firewalls were"},{"line_number":14,"context_line":"added."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"5a5ae5dd_46742c67","line":11,"in_reply_to":"7a5de9d1_1143526d","updated":"2016-02-04 15:37:27.000000000","message":"It also requires kernel support.  The easiest way to document that is to just link to the FAQ which covers where conntrack datapath support is available: https://github.com/openvswitch/ovs/blob/master/FAQ.md\n\nSee \"Q: Are all features available with all datapaths?\" for the feature \"connection tracking\".","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"ae0acd17881d228d419719dcaaf8ec4743c82932","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This firewall requires OVS 2.5+ version supporting conntrack. Functional"},{"line_number":10,"context_line":"tests are passing now. Note that OVS2.5 is not present in the gate,"},{"line_number":11,"context_line":"we\u0027ll likely need to compile it for functional jobs."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"As part of this new entry points for current reference firewalls were"},{"line_number":14,"context_line":"added."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"7a5de9d1_1143526d","line":11,"in_reply_to":"7a5de9d1_36f76f8c","updated":"2016-02-01 19:38:35.000000000","message":"Yes! and thanks :)","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":1561,"name":"Russell Bryant","email":"rbryant@redhat.com","username":"russellb"},"change_message_id":"14357240ecba357206af2dee3efc21a3ae112dff","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Closes-bug: #1461000"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Co-Authored-By: Miguel Angel Ajo Pelayo \u003cmangelajo@redhat.com\u003e"},{"line_number":20,"context_line":"Co-Authored-By: Amir Sadoughi \u003c ....\u003e"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Change-Id: I13e5cda8b5f3a13a60b14d80e54f198f32d7a529"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"5a5ae5dd_c62d7c47","line":20,"updated":"2016-02-04 15:37:27.000000000","message":"Are you chasing down an email address for this?","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"10c43b94517684e4c7aec15ff583b986b90954a4","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Closes-bug: #1461000"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Co-Authored-By: Miguel Angel Ajo Pelayo \u003cmangelajo@redhat.com\u003e"},{"line_number":20,"context_line":"Co-Authored-By: Amir Sadoughi \u003c ....\u003e"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Change-Id: I13e5cda8b5f3a13a60b14d80e54f198f32d7a529"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"5a5ae5dd_7a169c56","line":20,"in_reply_to":"5a5ae5dd_c62d7c47","updated":"2016-02-04 16:03:43.000000000","message":"Done","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"947332c9b92a4f1098a73c66f811bbcddbac6449","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Jakub Libosvar \u003clibosvar@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-02-06 18:29:12 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Open VSwitch conntrack based firewall driver"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This firewall requires OVS 2.5+ version supporting conntrack and kernel"},{"line_number":10,"context_line":"conntrack datapath support (kernel\u003e\u003d4.3). For more information, see"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"5a5ae5dd_e03364f4","line":7,"range":{"start_line":7,"start_character":5,"end_line":7,"end_character":12},"updated":"2016-02-06 20:14:50.000000000","message":"vSwitch","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"d5477d56359d55fd318a5fb4d09cfc4422740b36","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Jakub Libosvar \u003clibosvar@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-02-06 18:29:12 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Open VSwitch conntrack based firewall driver"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This firewall requires OVS 2.5+ version supporting conntrack and kernel"},{"line_number":10,"context_line":"conntrack datapath support (kernel\u003e\u003d4.3). For more information, see"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"5a5ae5dd_5f66c52a","line":7,"range":{"start_line":7,"start_character":5,"end_line":7,"end_character":12},"in_reply_to":"5a5ae5dd_e03364f4","updated":"2016-02-08 08:53:46.000000000","message":"Done","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"3c9554f98ef4e037dc4171369760ac3862de8710","unresolved":false,"context_lines":[{"line_number":13,"context_line":"As part of this new entry points for current reference firewalls were"},{"line_number":14,"context_line":"added."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"DocImpact"},{"line_number":17,"context_line":"Closes-bug: #1461000"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Co-Authored-By: Miguel Angel Ajo Pelayo \u003cmangelajo@redhat.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"5a5ae5dd_0be7b440","line":16,"updated":"2016-02-08 04:47:20.000000000","message":"Would it be worth having here the configuration required to get this working?\n\nAre then plans for this to have CI gating?","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"d5477d56359d55fd318a5fb4d09cfc4422740b36","unresolved":false,"context_lines":[{"line_number":13,"context_line":"As part of this new entry points for current reference firewalls were"},{"line_number":14,"context_line":"added."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"DocImpact"},{"line_number":17,"context_line":"Closes-bug: #1461000"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Co-Authored-By: Miguel Angel Ajo Pelayo \u003cmangelajo@redhat.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"5a5ae5dd_d44ffc31","line":16,"in_reply_to":"5a5ae5dd_0be7b440","updated":"2016-02-08 08:53:46.000000000","message":"Good idea with configuration, added.\n\nwrt CI gating: you mean turning this driver by default or having another job with different driver in e.g. tempest job? I think it makes sense to have that once 2.5 ovs is released and we start using that.","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"de31f14d606fc8ea4266243079f52642d822c354","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Configuration:"},{"line_number":17,"context_line":"in openvswitch_agent.ini:"},{"line_number":18,"context_line":"    - in agent section set prevent_arp_spoofing to False"},{"line_number":19,"context_line":"    - in securitygroup section set firewall_driver to openvswitch"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"DocImpact"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":18,"id":"5a5ae5dd_902b8794","line":18,"range":{"start_line":18,"start_character":27,"end_line":18,"end_character":47},"updated":"2016-02-09 10:11:15.000000000","message":"why do we need to set prevent_arp_spoofing off? (Haven\u0027t looked into it).","commit_id":"68284adacd442de58678e482d9e01e5031477ab2"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"5e2e251fbe545c21cc5b0616fd9206411e879bdb","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Configuration:"},{"line_number":17,"context_line":"in openvswitch_agent.ini:"},{"line_number":18,"context_line":"    - in agent section set prevent_arp_spoofing to False"},{"line_number":19,"context_line":"    - in securitygroup section set firewall_driver to openvswitch"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"DocImpact"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":18,"id":"5a5ae5dd_9abaaf6d","line":18,"range":{"start_line":18,"start_character":27,"end_line":18,"end_character":47},"in_reply_to":"5a5ae5dd_012427ad","updated":"2016-02-09 16:15:48.000000000","message":"I think the a.2) is too specific. The firewall driver should be generic, correct thing to do is to have arp_spoofing not influencing ovs fw driver.","commit_id":"68284adacd442de58678e482d9e01e5031477ab2"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"fe60c3cb7e1a6ab513955f84da375e4330798e5f","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Configuration:"},{"line_number":17,"context_line":"in openvswitch_agent.ini:"},{"line_number":18,"context_line":"    - in agent section set prevent_arp_spoofing to False"},{"line_number":19,"context_line":"    - in securitygroup section set firewall_driver to openvswitch"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"DocImpact"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":18,"id":"5a5ae5dd_012427ad","line":18,"range":{"start_line":18,"start_character":27,"end_line":18,"end_character":47},"in_reply_to":"5a5ae5dd_2b36e2b4","updated":"2016-02-09 10:49:45.000000000","message":"Ok, it seems reasonable,\n\na) Could we find a way to fix (2) regardless of the setting?,\n\nOtherwise: \na.2) exit with an error log if prevent_arp_spoofing is set but we are using the openvswitch firewall driver?\n\nand \n\nb) Is there any value in honoring the setting if set to False?  I guess we could simple ignore those rules per port when port security is off.","commit_id":"68284adacd442de58678e482d9e01e5031477ab2"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"58d7d5b1e8641b09674979157a9f81fb9c4f2b0d","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Configuration:"},{"line_number":17,"context_line":"in openvswitch_agent.ini:"},{"line_number":18,"context_line":"    - in agent section set prevent_arp_spoofing to False"},{"line_number":19,"context_line":"    - in securitygroup section set firewall_driver to openvswitch"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"DocImpact"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":18,"id":"5a5ae5dd_2b36e2b4","line":18,"range":{"start_line":18,"start_character":27,"end_line":18,"end_character":47},"in_reply_to":"5a5ae5dd_902b8794","updated":"2016-02-09 10:16:22.000000000","message":"Good question, maybe I should also explain it in commit message.\n\n1) This driver implements it itself. No explicit need for other mechanism implemented in ovs_agent which got it due to previous mechanism in iptables wasn\u0027t working.\n\n2) delete_arp_spoofing_allow_rules() with port number is called upon arp_spoofing setup which lead to drop of multiple rules in ovs firewall.","commit_id":"68284adacd442de58678e482d9e01e5031477ab2"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"b43b3352893db89180071648d72188d7cc38aaf2","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Configuration:"},{"line_number":17,"context_line":"in openvswitch_agent.ini:"},{"line_number":18,"context_line":"    - in agent section set prevent_arp_spoofing to False"},{"line_number":19,"context_line":"    - in securitygroup section set firewall_driver to openvswitch"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"DocImpact"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":22,"id":"3a57f1b5_5ce7c5ab","line":18,"updated":"2016-02-12 17:43:14.000000000","message":"I think we need to find another way to avoid messing with this config value because I want to deprecate and remove it completely at some point so it can\u0027t be disabled.\n\nI would even rather prefer that you killed the ARP rule it installs while it\u0027s enabled since you offer the protection with the firewall.","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"122e6a701196ec609c9f76a43956d9283155d464","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Configuration:"},{"line_number":17,"context_line":"in openvswitch_agent.ini:"},{"line_number":18,"context_line":"    - in agent section set prevent_arp_spoofing to False"},{"line_number":19,"context_line":"    - in securitygroup section set firewall_driver to openvswitch"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"DocImpact"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":22,"id":"1a54edaf_fdbae7bf","line":18,"in_reply_to":"1a54edaf_9da41309","updated":"2016-02-13 11:19:38.000000000","message":"Actually I need to try it, I haven\u0027t tried it for a while.","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"f70f19794f32daafb3400be73ed5da30a50e7e90","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Configuration:"},{"line_number":17,"context_line":"in openvswitch_agent.ini:"},{"line_number":18,"context_line":"    - in agent section set prevent_arp_spoofing to False"},{"line_number":19,"context_line":"    - in securitygroup section set firewall_driver to openvswitch"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"DocImpact"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":22,"id":"1a54edaf_9da41309","line":18,"in_reply_to":"3a57f1b5_5ce7c5ab","updated":"2016-02-13 10:20:42.000000000","message":"I had the opposite problem - arp_spoofing was killing rules generated by firewall driver. Otherwise the code doesn\u0027t work with prevent_arp_spoofing option so once it\u0027s removed no harm will be done.","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"7b7630a626f7cc9491e1b31d442d9cca78ea98a1","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    - in agent section set prevent_arp_spoofing to False"},{"line_number":19,"context_line":"    - in securitygroup section set firewall_driver to openvswitch"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"DocImpact"},{"line_number":22,"context_line":"Closes-bug: #1461000"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Co-Authored-By: Miguel Angel Ajo Pelayo \u003cmangelajo@redhat.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":22,"id":"dae33548_294f8c93","line":21,"updated":"2016-02-15 14:36:00.000000000","message":"I think that this requires a release note. In that we should state what the requirements are for the feature","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"21e67f38017f272c39980596d52b0ca02723f4e8","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    - in agent section set prevent_arp_spoofing to False"},{"line_number":19,"context_line":"    - in securitygroup section set firewall_driver to openvswitch"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"DocImpact"},{"line_number":22,"context_line":"Closes-bug: #1461000"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Co-Authored-By: Miguel Angel Ajo Pelayo \u003cmangelajo@redhat.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":22,"id":"dae33548_0ba1d794","line":21,"in_reply_to":"dae33548_294f8c93","updated":"2016-02-15 16:53:02.000000000","message":"Done","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"}],"doc/source/devref/openvswitch_firewall.rst":[{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"700bae23244a095032cbd67e9996f628349ea298","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"OpenVSwitch Firewall Driver"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The driver keeps the API with current iptables firewall driver and keeps the"},{"line_number":28,"context_line":"state of security groups and ports inside of the firewall. For keeping "}],"source_content_type":"text/x-rst","patch_set":5,"id":"da6ed579_dc6f7129","line":25,"updated":"2016-01-13 21:37:59.000000000","message":"There are some grammatical issues in the text, instead of pointing them out one-by-one I\u0027d be happy to push out an update with them all.  Just let me know.","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"3fe354c7b34f5ef099c030c6d9bd1c0468d9b6af","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"OpenVSwitch Firewall Driver"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The driver keeps the API with current iptables firewall driver and keeps the"},{"line_number":28,"context_line":"state of security groups and ports inside of the firewall. For keeping "}],"source_content_type":"text/x-rst","patch_set":5,"id":"da6ed579_de642023","line":25,"in_reply_to":"da6ed579_dc6f7129","updated":"2016-01-14 15:30:01.000000000","message":"That would be awesome, thanks! :)","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"700bae23244a095032cbd67e9996f628349ea298","unresolved":false,"context_lines":[{"line_number":157,"context_line":"is paused and thus no traffic is going on, we can delete qvo interface from"},{"line_number":158,"context_line":"integration bridge, detach tap device from qbr bridge and plug tap device back"},{"line_number":159,"context_line":"to integration bridge. Once this is done, firewall rules are applied for OVS"},{"line_number":160,"context_line":"interface and instance is started back from paused state."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"2) Nodes can be upgraded one by one. Free node is switched to OVS firewall and"},{"line_number":163,"context_line":"instances from other node are live-migrated to this node. Once second node is"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da6ed579_bcedddb8","line":160,"updated":"2016-01-13 21:37:59.000000000","message":"Is it possible to install a drop rule for the port, plug it in, wire the new rules, then remove the drop rule?","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"3fe354c7b34f5ef099c030c6d9bd1c0468d9b6af","unresolved":false,"context_lines":[{"line_number":157,"context_line":"is paused and thus no traffic is going on, we can delete qvo interface from"},{"line_number":158,"context_line":"integration bridge, detach tap device from qbr bridge and plug tap device back"},{"line_number":159,"context_line":"to integration bridge. Once this is done, firewall rules are applied for OVS"},{"line_number":160,"context_line":"interface and instance is started back from paused state."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"2) Nodes can be upgraded one by one. Free node is switched to OVS firewall and"},{"line_number":163,"context_line":"instances from other node are live-migrated to this node. Once second node is"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da6ed579_23a8bcda","line":160,"in_reply_to":"da6ed579_bcedddb8","updated":"2016-01-14 15:30:01.000000000","message":"I think this is a good idea. I\u0027ll add it to the document.","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"85c13885cc81fa416bee982beb447269f5fbdbaf","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Firewall API calls"},{"line_number":35,"context_line":"------------------"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"There are two main calls performed by the firewall driver in order to either"},{"line_number":38,"context_line":"create or update a port with security groups - ``prepare_port_filter`` and"},{"line_number":39,"context_line":"``update_port_filter``. Both methods rely on the security group objects that"},{"line_number":40,"context_line":"are already defined in the driver and work similarly to their iptables counterparts."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da6ed579_b7003403","line":37,"range":{"start_line":37,"start_character":35,"end_line":37,"end_character":41},"updated":"2016-01-15 13:08:49.000000000","message":"This is supposed to tell, that caller calls prepare_port_filter or update_port_filter, driver doesn\u0027t call anything outside of it. So maybe \"to\" or \"towards\"?","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"a38054327be88aa824d5891a304920116975dab6","unresolved":false,"context_lines":[{"line_number":143,"context_line":"   rules needed for remote security groups"},{"line_number":144,"context_line":" - Masking the port range can be used to avoid generating a single rule per"},{"line_number":145,"context_line":"   port number being filtered. For example, if the port range is 1 to 5, one"},{"line_number":146,"context_line":"   rule can be generated instead of 5"},{"line_number":147,"context_line":" - During the update of firewall rules, we can use bundles to make the changes"},{"line_number":148,"context_line":"   atomic"},{"line_number":149,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a5ae5dd_d79299f5","line":146,"updated":"2016-02-08 10:51:08.000000000","message":"how one rule can match the range?","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"fb72bfda1a3c7bc64a9ea8d059f30daa96ec09c5","unresolved":false,"context_lines":[{"line_number":143,"context_line":"   rules needed for remote security groups"},{"line_number":144,"context_line":" - Masking the port range can be used to avoid generating a single rule per"},{"line_number":145,"context_line":"   port number being filtered. For example, if the port range is 1 to 5, one"},{"line_number":146,"context_line":"   rule can be generated instead of 5"},{"line_number":147,"context_line":" - During the update of firewall rules, we can use bundles to make the changes"},{"line_number":148,"context_line":"   atomic"},{"line_number":149,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a5ae5dd_4ae7dcab","line":146,"in_reply_to":"5a5ae5dd_d79299f5","updated":"2016-02-08 11:16:13.000000000","message":"See http://openvswitch.org/support/dist-docs/ovs-ofctl.8.txt (search for tcp_src\u003dport/mask)- you can mask the port with range. It\u0027s not always one rule but it will decrease the number of rules depending on the range.","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"a38054327be88aa824d5891a304920116975dab6","unresolved":false,"context_lines":[{"line_number":147,"context_line":" - During the update of firewall rules, we can use bundles to make the changes"},{"line_number":148,"context_line":"   atomic"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Upgrade path"},{"line_number":151,"context_line":"~~~~~~~~~~~~"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"During an upgrade, the agent will need to re-plug each instance\u0027s tap device"}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a5ae5dd_d72e19a4","line":150,"range":{"start_line":150,"start_character":0,"end_line":150,"end_character":7},"updated":"2016-02-08 10:51:08.000000000","message":"upgrade from what to what?\n\nswitching firewall driver from iptables_hybrid to the new driver?","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"fb72bfda1a3c7bc64a9ea8d059f30daa96ec09c5","unresolved":false,"context_lines":[{"line_number":147,"context_line":" - During the update of firewall rules, we can use bundles to make the changes"},{"line_number":148,"context_line":"   atomic"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Upgrade path"},{"line_number":151,"context_line":"~~~~~~~~~~~~"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"During an upgrade, the agent will need to re-plug each instance\u0027s tap device"}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a5ae5dd_cafbcc45","line":150,"range":{"start_line":150,"start_character":0,"end_line":150,"end_character":7},"in_reply_to":"5a5ae5dd_d72e19a4","updated":"2016-02-08 11:16:13.000000000","message":"Yes, I\u0027m also thinking about automating the process in security group rpc code before calling prepare_port_filter(). I\u0027ll find a better wording for this if it\u0027s confusing.","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"7b7630a626f7cc9491e1b31d442d9cca78ea98a1","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Open vSwitch Firewall Driver"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The OVS driver has the same API as the current iptables firewall driver,"},{"line_number":28,"context_line":"keeping the state of security groups and ports inside of the firewall."}],"source_content_type":"text/x-rst","patch_set":22,"id":"dae33548_e955a41d","line":25,"updated":"2016-02-15 14:36:00.000000000","message":"missing one \u003d","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"ce8f3ca14ae4787d89e9a4672f03d7ef623c3f55","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Open vSwitch Firewall Driver"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The OVS driver has the same API as the current iptables firewall driver,"},{"line_number":28,"context_line":"keeping the state of security groups and ports inside of the firewall."}],"source_content_type":"text/x-rst","patch_set":22,"id":"dae33548_0544c447","line":25,"in_reply_to":"dae33548_e955a41d","updated":"2016-02-17 10:09:46.000000000","message":"Oops, sorry. I missed your comment. I\u0027ll add it if respin is needed.","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":15554,"name":"Bence Romsics","email":"bence.romsics@gmail.com","username":"ebenrom","status":"inactive contributor"},"change_message_id":"e9e0128e5a6d8a0293e6c25d93cc00dcd4242c6a","unresolved":false,"context_lines":[{"line_number":151,"context_line":"Upgrade path from iptables hybrid driver"},{"line_number":152,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"During an upgrade, the agent will need to re-plug each instance\u0027s tap device"},{"line_number":155,"context_line":"into the integration bridge while trying to not break existing connections. One"},{"line_number":156,"context_line":"of the following approaches can be taken:"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"dae33548_20820895","line":154,"range":{"start_line":154,"start_character":42,"end_line":154,"end_character":76},"updated":"2016-02-15 12:02:28.000000000","message":"Something to consider. libvirt plugged the tap originally. The nice thing would be to re-plug via libvirt. But I don\u0027t think libvirt can do that. However if we re-plug behind the back of libvirt, the domain xml will still contain the old bridge and libvirt can bite us. For example does nova delete and re-generate the domain xml during nova stop/start?","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":15554,"name":"Bence Romsics","email":"bence.romsics@gmail.com","username":"ebenrom","status":"inactive contributor"},"change_message_id":"c19376a79a6d288f7f0daf5c46f39bad7d5b1ddf","unresolved":false,"context_lines":[{"line_number":151,"context_line":"Upgrade path from iptables hybrid driver"},{"line_number":152,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"During an upgrade, the agent will need to re-plug each instance\u0027s tap device"},{"line_number":155,"context_line":"into the integration bridge while trying to not break existing connections. One"},{"line_number":156,"context_line":"of the following approaches can be taken:"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"dae33548_89a8f4dc","line":154,"range":{"start_line":154,"start_character":42,"end_line":154,"end_character":76},"in_reply_to":"dae33548_176aa880","updated":"2016-02-17 08:54:50.000000000","message":"Good to know that libvirt already complains at nova delete. Thanks.\n\nHot-plugging could be an option, though it does a bit too much. Ideally we\u0027d need to remove the tap from one bridge and add it to another. While doing this the guest should notice nothing else, but the loss of connectivity for a few milliseconds.\n\nHowever if we hot-plug, the guest OS must be prepared to handle the disappearance of one NIC, discovering a new one, and so on. Sounds complicated and not really fit for migration, where we want the old guests be able to migrate without preparation.\n\nI\u0027m interested in which solution you\u0027ll choose and how that will work for you because I may have to face a very similar migration later.","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"1cda4a52e81db50e1b4a929dc9c238c2035805e0","unresolved":false,"context_lines":[{"line_number":151,"context_line":"Upgrade path from iptables hybrid driver"},{"line_number":152,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"During an upgrade, the agent will need to re-plug each instance\u0027s tap device"},{"line_number":155,"context_line":"into the integration bridge while trying to not break existing connections. One"},{"line_number":156,"context_line":"of the following approaches can be taken:"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"dae33548_176aa880","line":154,"range":{"start_line":154,"start_character":42,"end_line":154,"end_character":76},"in_reply_to":"dae33548_20820895","updated":"2016-02-15 13:24:37.000000000","message":"Bence, you\u0027re totally right! I have already played a bit with this migration plan (https://github.com/cubeek/neutron/blob/replug_ovs_fw/tools/replug_port_with_ovs_fw.py) that does it without any libvirt interaction and I hit the issue you described. Libvirt didn\u0027t play nice with tap device attached to ovs during instance removal.\n\nI also read some nova code for libvirt vif driver and that\u0027s also an option. The con is dependence on nova code which implicates the migration script can\u0027t be part of Neutron. I was thinking about scenario with libvirt hotplug feature but I haven\u0027t tried whether it will destroy existing connections.","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"ce8f3ca14ae4787d89e9a4672f03d7ef623c3f55","unresolved":false,"context_lines":[{"line_number":151,"context_line":"Upgrade path from iptables hybrid driver"},{"line_number":152,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"During an upgrade, the agent will need to re-plug each instance\u0027s tap device"},{"line_number":155,"context_line":"into the integration bridge while trying to not break existing connections. One"},{"line_number":156,"context_line":"of the following approaches can be taken:"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"dae33548_a57fd864","line":154,"range":{"start_line":154,"start_character":42,"end_line":154,"end_character":76},"in_reply_to":"dae33548_89a8f4dc","updated":"2016-02-17 10:09:46.000000000","message":"Let\u0027s stay in touch then :) I talked with some people that are involved in libvirt so we\u0027ll see what can be done to make it transparent to guest OS.","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"b7c4586ae413c6e63a2bdf0547e35c57da0a3b2c","unresolved":false,"context_lines":[{"line_number":86,"context_line":"Rules example with explanation:"},{"line_number":87,"context_line":"-------------------------------"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"TODO: Rules below will be awesomly explained"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"::"},{"line_number":92,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"dae33548_fac1db81","line":89,"updated":"2016-02-15 18:21:24.000000000","message":"I\u0027m looking forward to the explanation...","commit_id":"705470faea78772593e63e9cf98a5c4ee8b9ee26"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"4b7c785b7110c3ffe1def885c336488283e68277","unresolved":false,"context_lines":[{"line_number":86,"context_line":"Rules example with explanation:"},{"line_number":87,"context_line":"-------------------------------"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"TODO: Rules below will be awesomly explained"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"::"},{"line_number":92,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"dae33548_da997770","line":89,"in_reply_to":"dae33548_fac1db81","updated":"2016-02-15 18:24:30.000000000","message":"Coming soon, stay tuned :)","commit_id":"705470faea78772593e63e9cf98a5c4ee8b9ee26"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"b7c4586ae413c6e63a2bdf0547e35c57da0a3b2c","unresolved":false,"context_lines":[{"line_number":95,"context_line":" table\u003d0, priority\u003d90,dl_dst\u003dfa:16:3e:9b:67:b2 actions\u003dload:0x2-\u003eNXM_NX_REG5[],resubmit(,81)"},{"line_number":96,"context_line":" table\u003d0, priority\u003d90,dl_dst\u003dfa:16:3e:44:de:7a actions\u003dload:0x1-\u003eNXM_NX_REG5[],resubmit(,81)"},{"line_number":97,"context_line":" table\u003d0, priority\u003d0 actions\u003dNORMAL"},{"line_number":98,"context_line":" table\u003d0, priority\u003d1 actions\u003dNORMAL"},{"line_number":99,"context_line":" table\u003d71, priority\u003d95,arp,in_port\u003d2,dl_src\u003dfa:16:3e:9b:67:b2,arp_spa\u003d192.168.0.2 actions\u003dNORMAL"},{"line_number":100,"context_line":" table\u003d71, priority\u003d95,arp,in_port\u003d1,dl_src\u003dfa:16:3e:44:de:7a,arp_spa\u003d192.168.0.1 actions\u003dNORMAL"},{"line_number":101,"context_line":" table\u003d71, priority\u003d90,ct_state\u003d-trk,in_port\u003d2,dl_src\u003dfa:16:3e:9b:67:b2 actions\u003dct(table\u003d72,zone\u003dNXM_NX_REG5[0..15])"}],"source_content_type":"text/x-rst","patch_set":24,"id":"dae33548_da0fb7df","line":98,"updated":"2016-02-15 18:21:24.000000000","message":"Why are there two entries with no filters and the same action?","commit_id":"705470faea78772593e63e9cf98a5c4ee8b9ee26"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"4b7c785b7110c3ffe1def885c336488283e68277","unresolved":false,"context_lines":[{"line_number":95,"context_line":" table\u003d0, priority\u003d90,dl_dst\u003dfa:16:3e:9b:67:b2 actions\u003dload:0x2-\u003eNXM_NX_REG5[],resubmit(,81)"},{"line_number":96,"context_line":" table\u003d0, priority\u003d90,dl_dst\u003dfa:16:3e:44:de:7a actions\u003dload:0x1-\u003eNXM_NX_REG5[],resubmit(,81)"},{"line_number":97,"context_line":" table\u003d0, priority\u003d0 actions\u003dNORMAL"},{"line_number":98,"context_line":" table\u003d0, priority\u003d1 actions\u003dNORMAL"},{"line_number":99,"context_line":" table\u003d71, priority\u003d95,arp,in_port\u003d2,dl_src\u003dfa:16:3e:9b:67:b2,arp_spa\u003d192.168.0.2 actions\u003dNORMAL"},{"line_number":100,"context_line":" table\u003d71, priority\u003d95,arp,in_port\u003d1,dl_src\u003dfa:16:3e:44:de:7a,arp_spa\u003d192.168.0.1 actions\u003dNORMAL"},{"line_number":101,"context_line":" table\u003d71, priority\u003d90,ct_state\u003d-trk,in_port\u003d2,dl_src\u003dfa:16:3e:9b:67:b2 actions\u003dct(table\u003d72,zone\u003dNXM_NX_REG5[0..15])"}],"source_content_type":"text/x-rst","patch_set":24,"id":"dae33548_1a7d9f1c","line":98,"in_reply_to":"dae33548_da0fb7df","updated":"2016-02-15 18:24:30.000000000","message":"Old tables dump :)","commit_id":"705470faea78772593e63e9cf98a5c4ee8b9ee26"},{"author":{"_account_id":1561,"name":"Russell Bryant","email":"rbryant@redhat.com","username":"russellb"},"change_message_id":"dfd29d7d17e951afb4794fd8210ce286705e7323","unresolved":false,"context_lines":[{"line_number":146,"context_line":"   rule can be generated instead of 5."},{"line_number":147,"context_line":"   e.g. tcp,tcp_src\u003d0x03e8/0xfff8"},{"line_number":148,"context_line":" - During the update of firewall rules, we can use bundles to make the changes"},{"line_number":149,"context_line":"   atomic"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Upgrade path from iptables hybrid driver"},{"line_number":152,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":27,"id":"dae33548_ed6e0c95","line":149,"updated":"2016-02-16 17:51:08.000000000","message":"Do you want to add \"apply security group changes to existing connections\" here?","commit_id":"ef29f7eb9a2a37133eacdb7f019b48ec3f9a42c3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"42d32b77b9a3c9e25865ac1749534b5e0b15258f","unresolved":false,"context_lines":[{"line_number":146,"context_line":"   rule can be generated instead of 5."},{"line_number":147,"context_line":"   e.g. tcp,tcp_src\u003d0x03e8/0xfff8"},{"line_number":148,"context_line":" - During the update of firewall rules, we can use bundles to make the changes"},{"line_number":149,"context_line":"   atomic"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Upgrade path from iptables hybrid driver"},{"line_number":152,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":27,"id":"dae33548_4da1f8a2","line":149,"in_reply_to":"dae33548_ed6e0c95","updated":"2016-02-16 17:53:49.000000000","message":"Yep, I\u0027ll add it with devref update with rules explanation. Probably also ipv6 requires more work. I think it all can go as update patches.","commit_id":"ef29f7eb9a2a37133eacdb7f019b48ec3f9a42c3"}],"neutron/agent/common/ovs_lib.py":[{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"c5b938e99478600a3ecb852d8901d121541b39d8","unresolved":false,"context_lines":[{"line_number":308,"context_line":"        return retval"},{"line_number":309,"context_line":""},{"line_number":310,"context_line":"    def mod_table_miss_action(self, table, miss_action):"},{"line_number":311,"context_line":"        self.run_ofctl(\u0027mod-table\u0027, [\"%s\" % table, miss_action], protocol\u003dOF12)"},{"line_number":312,"context_line":""},{"line_number":313,"context_line":"    def dump_all_flows(self):"},{"line_number":314,"context_line":"        return [f for f in self.run_ofctl(\"dump-flows\", []).splitlines()"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_eea55fb5","line":311,"updated":"2015-12-04 12:37:32.000000000","message":"I know I introduced those, but we could get rid of them by just introducing a final rule on every table with a very low priority.","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"230e808077fc43d740f5056abe1211d830de55df","unresolved":false,"context_lines":[{"line_number":308,"context_line":"        return retval"},{"line_number":309,"context_line":""},{"line_number":310,"context_line":"    def mod_table_miss_action(self, table, miss_action):"},{"line_number":311,"context_line":"        self.run_ofctl(\u0027mod-table\u0027, [\"%s\" % table, miss_action], protocol\u003dOF12)"},{"line_number":312,"context_line":""},{"line_number":313,"context_line":"    def dump_all_flows(self):"},{"line_number":314,"context_line":"        return [f for f in self.run_ofctl(\"dump-flows\", []).splitlines()"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_87d6c7c3","line":311,"in_reply_to":"7a740942_eea55fb5","updated":"2015-12-04 12:56:19.000000000","message":"What would be the benefit? Dropping not-matching packets seems like a good idea here, can you please explain more?","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"}],"neutron/agent/firewall.py":[{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"3bd2bd820db233cfe23cdae57647f1d7306ffbd7","unresolved":false,"context_lines":[{"line_number":28,"context_line":"                       EGRESS_DIRECTION: \u0027dest_ip_prefix\u0027}"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"def ps_enabled(port):"},{"line_number":32,"context_line":"    return port.get(psec.PORTSECURITY, True)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_58ad7b99","line":31,"updated":"2016-01-15 05:29:42.000000000","message":"nit: group module functions together rather than before and after classes","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"66ef574613caa4b8e9c4d6053cf221444dadc3a2","unresolved":false,"context_lines":[{"line_number":28,"context_line":"                       EGRESS_DIRECTION: \u0027dest_ip_prefix\u0027}"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"def ps_enabled(port):"},{"line_number":32,"context_line":"    return port.get(psec.PORTSECURITY, True)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_c7541fcb","line":31,"in_reply_to":"da6ed579_58ad7b99","updated":"2016-01-15 12:02:19.000000000","message":"Oops, sorry. I should teach myself some manners.","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":6788,"name":"Rossella Sblendido","email":"rsblendido@suse.com","username":"rossella-o"},"change_message_id":"a2bdcd7ca07c81033c8d3a36b726420f55ac9c5c","unresolved":false,"context_lines":[{"line_number":28,"context_line":"                       EGRESS_DIRECTION: \u0027dest_ip_prefix\u0027}"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"def ps_enabled(port):"},{"line_number":32,"context_line":"    return port.get(psec.PORTSECURITY, True)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_acd1efcf","line":31,"updated":"2016-02-15 14:27:27.000000000","message":"ps_enabled is a bit vague...port_sec_enabled is better I think...","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"21e67f38017f272c39980596d52b0ca02723f4e8","unresolved":false,"context_lines":[{"line_number":28,"context_line":"                       EGRESS_DIRECTION: \u0027dest_ip_prefix\u0027}"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"def ps_enabled(port):"},{"line_number":32,"context_line":"    return port.get(psec.PORTSECURITY, True)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_ebee34eb","line":31,"in_reply_to":"dae33548_acd1efcf","updated":"2016-02-15 16:53:02.000000000","message":"Done","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"}],"neutron/agent/linux/iptables_firewall.py":[{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"459ccd9219f377b8c72209c7b9190a18353cccd1","unresolved":false,"context_lines":[{"line_number":64,"context_line":"            use_ipv6\u003dipv6_utils.is_enabled(),"},{"line_number":65,"context_line":"            namespace\u003dnamespace)"},{"line_number":66,"context_line":"        # TODO(majopela, shihanzhang): refactor out ipset to a separate"},{"line_number":67,"context_line":"        # driver composed over this one"},{"line_number":68,"context_line":"        self.ipset \u003d ipset_manager.IpsetManager(namespace\u003dnamespace)"},{"line_number":69,"context_line":"        self.ipconntrack \u003d ip_conntrack.IpConntrackManager("},{"line_number":70,"context_line":"            self.get_device_zone, namespace\u003dnamespace)"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_f345d7b2","line":67,"range":{"start_line":67,"start_character":17,"end_line":67,"end_character":25},"updated":"2016-02-04 16:51:04.000000000","message":"I shall probably remove that, and cleanup all the non ipset paths...at this point...","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"}],"neutron/agent/linux/openvswitch_firewall.py":[{"author":{"_account_id":15070,"name":"Ruijing","email":"ruijing.guo@intel.com","username":"ruijing"},"change_message_id":"5ff3fd39417747b2bb60984220a8be0b6a4d596b","unresolved":false,"context_lines":[{"line_number":24,"context_line":"# Protocol constants for dl_type (see man ovs-ofctl for more info)"},{"line_number":25,"context_line":"ARP_PROTO \u003d \u00270x0806\u0027"},{"line_number":26,"context_line":"IP_PROTO \u003d \u00270x0800\u0027"},{"line_number":27,"context_line":"IP6_PROTO \u003d \u00270x86dd\u0027"},{"line_number":28,"context_line":"UDP_PROTO \u003d \u002717\u0027"},{"line_number":29,"context_line":"TCP_PROTO \u003d \u0027132\u0027"},{"line_number":30,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"9a8ffd7b_377dca1c","line":27,"updated":"2015-11-25 07:22:00.000000000","message":"Refer to http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml\n\n\n IP_PROTOCOL_ICMP: 1;\n IP_PROTOCOL_TCP: 6;\n IP_PROTOCOL_UDP: 17;\n IP_PROTOCOL_SCTP:132","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"230e808077fc43d740f5056abe1211d830de55df","unresolved":false,"context_lines":[{"line_number":24,"context_line":"# Protocol constants for dl_type (see man ovs-ofctl for more info)"},{"line_number":25,"context_line":"ARP_PROTO \u003d \u00270x0806\u0027"},{"line_number":26,"context_line":"IP_PROTO \u003d \u00270x0800\u0027"},{"line_number":27,"context_line":"IP6_PROTO \u003d \u00270x86dd\u0027"},{"line_number":28,"context_line":"UDP_PROTO \u003d \u002717\u0027"},{"line_number":29,"context_line":"TCP_PROTO \u003d \u0027132\u0027"},{"line_number":30,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_c7a04ff7","line":27,"in_reply_to":"7a740942_8ee61be7","updated":"2015-12-04 12:56:19.000000000","message":"I think he mean the TCP should be 6 and not 132. It\u0027s the same in ovs-ofctl man, I have it fixed locally. Thanks.","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"c5b938e99478600a3ecb852d8901d121541b39d8","unresolved":false,"context_lines":[{"line_number":24,"context_line":"# Protocol constants for dl_type (see man ovs-ofctl for more info)"},{"line_number":25,"context_line":"ARP_PROTO \u003d \u00270x0806\u0027"},{"line_number":26,"context_line":"IP_PROTO \u003d \u00270x0800\u0027"},{"line_number":27,"context_line":"IP6_PROTO \u003d \u00270x86dd\u0027"},{"line_number":28,"context_line":"UDP_PROTO \u003d \u002717\u0027"},{"line_number":29,"context_line":"TCP_PROTO \u003d \u0027132\u0027"},{"line_number":30,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_8ee61be7","line":27,"in_reply_to":"9a8ffd7b_377dca1c","updated":"2015-12-04 12:37:32.000000000","message":"What do you mean Ruijing? is there anything wrong in these constants ?","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"c5b938e99478600a3ecb852d8901d121541b39d8","unresolved":false,"context_lines":[{"line_number":104,"context_line":"    def populate_egress(cls, rule, port):"},{"line_number":105,"context_line":"        cls.flow[\u0027table\u0027] \u003d TABLE_TRACKED_EGRESS"},{"line_number":106,"context_line":"        cls.flow[\u0027dl_src\u0027] \u003d port.mac"},{"line_number":107,"context_line":"        cls.flow[\u0027actions\u0027] \u003d \u0027ct(commit,recirc,zone\u003d%d)\u0027 % port.vlan"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"    @classmethod"},{"line_number":110,"context_line":"    def populate_ingress(cls, rule, port):"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_d530fc58","line":107,"updated":"2015-12-04 12:37:32.000000000","message":"note in liberty we started using one zone per port, we need to grab that mapping somehow, or recreate one ourselves.","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"230e808077fc43d740f5056abe1211d830de55df","unresolved":false,"context_lines":[{"line_number":104,"context_line":"    def populate_egress(cls, rule, port):"},{"line_number":105,"context_line":"        cls.flow[\u0027table\u0027] \u003d TABLE_TRACKED_EGRESS"},{"line_number":106,"context_line":"        cls.flow[\u0027dl_src\u0027] \u003d port.mac"},{"line_number":107,"context_line":"        cls.flow[\u0027actions\u0027] \u003d \u0027ct(commit,recirc,zone\u003d%d)\u0027 % port.vlan"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"    @classmethod"},{"line_number":110,"context_line":"    def populate_ingress(cls, rule, port):"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_27b03343","line":107,"in_reply_to":"7a740942_d530fc58","updated":"2015-12-04 12:56:19.000000000","message":"I\u0027ll look at that, thanks.","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"c5b938e99478600a3ecb852d8901d121541b39d8","unresolved":false,"context_lines":[{"line_number":183,"context_line":"        return int_br.deferred(full_ordered\u003dTrue)"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"    def create_ofport(self, port):"},{"line_number":186,"context_line":"        ovs_port \u003d self.int_br.br.get_vif_port_by_id(port[\u0027device\u0027])"},{"line_number":187,"context_line":"        vlan_id \u003d (self.int_br.br.db_get_val(\u0027Port\u0027, ovs_port.port_name, \u0027tag\u0027)"},{"line_number":188,"context_line":"                   or 4095)"},{"line_number":189,"context_line":"        of_port \u003d OFPort(port, ovs_port, vlan_id)"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_7a449773","line":186,"updated":"2015-12-04 12:37:32.000000000","message":"nit: why not moving vs_port and vlan_id logic inside OFPort, and we pass the bridge in?\n\nThe firewall driver does not need to know itself about those specifics. :)","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"230e808077fc43d740f5056abe1211d830de55df","unresolved":false,"context_lines":[{"line_number":183,"context_line":"        return int_br.deferred(full_ordered\u003dTrue)"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"    def create_ofport(self, port):"},{"line_number":186,"context_line":"        ovs_port \u003d self.int_br.br.get_vif_port_by_id(port[\u0027device\u0027])"},{"line_number":187,"context_line":"        vlan_id \u003d (self.int_br.br.db_get_val(\u0027Port\u0027, ovs_port.port_name, \u0027tag\u0027)"},{"line_number":188,"context_line":"                   or 4095)"},{"line_number":189,"context_line":"        of_port \u003d OFPort(port, ovs_port, vlan_id)"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_c7ee0f22","line":186,"in_reply_to":"7a740942_7a449773","updated":"2015-12-04 12:56:19.000000000","message":"I was thinking about that and my conclusion was that requiring bridge for OFPort initialisation doesn\u0027t make sense to me.","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"c5b938e99478600a3ecb852d8901d121541b39d8","unresolved":false,"context_lines":[{"line_number":253,"context_line":"            )"},{"line_number":254,"context_line":"            self._add_flow("},{"line_number":255,"context_line":"                table\u003dTABLE_BASE_EGRESS,"},{"line_number":256,"context_line":"                ct_state\u003dOF_STATE_NOT_TRACKED,"},{"line_number":257,"context_line":"                dl_type\u003dIP_PROTO,"},{"line_number":258,"context_line":"                in_port\u003dport.ofport,"},{"line_number":259,"context_line":"                dl_src\u003dport.mac,"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_f5be58fe","line":256,"updated":"2015-12-04 12:37:32.000000000","message":"no priority for this one? :)","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"c5b938e99478600a3ecb852d8901d121541b39d8","unresolved":false,"context_lines":[{"line_number":356,"context_line":"    def add_flows_from_rules(self, port):"},{"line_number":357,"context_line":"        rules_generator \u003d self.create_rules_generator_for_port(port)"},{"line_number":358,"context_line":"        for rule in rules_generator:"},{"line_number":359,"context_line":"            for flow in FlowsFromRule(rule, port):"},{"line_number":360,"context_line":"                self._add_flow(**flow)"},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"    def create_rules_generator_for_port(self, port):"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_b50530c3","line":359,"updated":"2015-12-04 12:37:32.000000000","message":"beautiful! :D","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"230e808077fc43d740f5056abe1211d830de55df","unresolved":false,"context_lines":[{"line_number":356,"context_line":"    def add_flows_from_rules(self, port):"},{"line_number":357,"context_line":"        rules_generator \u003d self.create_rules_generator_for_port(port)"},{"line_number":358,"context_line":"        for rule in rules_generator:"},{"line_number":359,"context_line":"            for flow in FlowsFromRule(rule, port):"},{"line_number":360,"context_line":"                self._add_flow(**flow)"},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"    def create_rules_generator_for_port(self, port):"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_c7d5af43","line":359,"in_reply_to":"7a740942_b50530c3","updated":"2015-12-04 12:56:19.000000000","message":"I redone that to pure functions, plan to move them outside of firewall module to some \"flows\" module. Reads better I think.","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"c5b938e99478600a3ecb852d8901d121541b39d8","unresolved":false,"context_lines":[{"line_number":375,"context_line":"                _LE(\"Updating port %s that is not managed by this bridge\"),"},{"line_number":376,"context_line":"                of_port.id_)"},{"line_number":377,"context_line":"            return"},{"line_number":378,"context_line":"        # TODO(jlibosva):: Handle firewall blink"},{"line_number":379,"context_line":"        self.delete_flows(of_port)"},{"line_number":380,"context_line":"        self.initialize_port_flows(of_port)"},{"line_number":381,"context_line":"        self.add_flows_from_rules(of_port)"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_557acc25","line":378,"updated":"2015-12-04 12:37:32.000000000","message":"Is there any unused field we could target later for deletes? so\n\n1) add new flows (with new mark -random !\u003d old_random-)\n\n2) del flows with mark\u003dold_random\n\n?\n\nI know OF and OVS have now transactions, but I\u0027ve never used those:\n\n\novs-ofctl man says: (note this would require enablement of OF14 and then my other comments about removing the changes done already are rendered useless) :)\n\n    --bundle\n              Execute flow mods as an OpenFlow 1.4 atomic bundle transaction.\n\n              ·      Within a bundle, all flow mods are processed in the order they appear and as a single atomic transaction, meaning that if one of them fails, the whole transaction fails and none\n                     of  the changes are made to the switch\u0027s flow table, and that each given datapath packet traversing the OpenFlow tables sees the flow tables either as before the transaction, or\n                     after all the flow mods in the bundle have been successfully applied.\n\n              ·      The beginning and the end of the flow table modification commands in a bundle are delimited with OpenFlow 1.4 bundle control messages, which makes  it  possible  to  stream  the\n                     included commands without explicit OpenFlow barriers, which are otherwise used after each flow table modification command.  This may make large modifications execute faster as a\n                     bundle.\n\n              ·      Bundles require OpenFlow 1.4 or higher.  An explicit -O OpenFlow14 option is not needed, but you may need to enable OpenFlow 1.4 support for OVS by setting the  OVSDB  protocols\n                     column in the bridge table.","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"230e808077fc43d740f5056abe1211d830de55df","unresolved":false,"context_lines":[{"line_number":375,"context_line":"                _LE(\"Updating port %s that is not managed by this bridge\"),"},{"line_number":376,"context_line":"                of_port.id_)"},{"line_number":377,"context_line":"            return"},{"line_number":378,"context_line":"        # TODO(jlibosva):: Handle firewall blink"},{"line_number":379,"context_line":"        self.delete_flows(of_port)"},{"line_number":380,"context_line":"        self.initialize_port_flows(of_port)"},{"line_number":381,"context_line":"        self.add_flows_from_rules(of_port)"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_0718971c","line":378,"in_reply_to":"7a740942_557acc25","updated":"2015-12-04 12:56:19.000000000","message":"Bundles sounds good as long as \"mods\" are \"add and del\" :) Thanks for revealing this secret to me! :)","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":15130,"name":"Sonu","email":"sonu.sudhakaran@gmail.com","username":"sonu"},"change_message_id":"2c4b301cd59fed752709c533a7429a24c3ae2b46","unresolved":false,"context_lines":[{"line_number":54,"context_line":"class SecurityGroup(object):"},{"line_number":55,"context_line":"    def __init__(self, id_):"},{"line_number":56,"context_line":"        self.id_ \u003d id_"},{"line_number":57,"context_line":"        self.naked_rules \u003d []"},{"line_number":58,"context_line":"        self.remote_rules \u003d []"},{"line_number":59,"context_line":"        self.members \u003d []"},{"line_number":60,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"fa69d971_a83477fb","line":57,"range":{"start_line":57,"start_character":13,"end_line":57,"end_character":24},"updated":"2016-01-06 06:32:30.000000000","message":"if possible, rename naked_rules to raw _rules or any other suitable term.","commit_id":"6073541be172d53b5120914721c655eaf86c8982"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"1272252434988972e7ccf7c10bcab23d87d8c855","unresolved":false,"context_lines":[{"line_number":54,"context_line":"class SecurityGroup(object):"},{"line_number":55,"context_line":"    def __init__(self, id_):"},{"line_number":56,"context_line":"        self.id_ \u003d id_"},{"line_number":57,"context_line":"        self.naked_rules \u003d []"},{"line_number":58,"context_line":"        self.remote_rules \u003d []"},{"line_number":59,"context_line":"        self.members \u003d []"},{"line_number":60,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"fa69d971_c9d68a27","line":57,"range":{"start_line":57,"start_character":13,"end_line":57,"end_character":24},"in_reply_to":"fa69d971_a83477fb","updated":"2016-01-06 09:13:16.000000000","message":"Yes, thanks for suggestion.","commit_id":"6073541be172d53b5120914721c655eaf86c8982"}],"neutron/agent/linux/openvswitch_firewall/__init__.py":[{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"7b7630a626f7cc9491e1b31d442d9cca78ea98a1","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2015"},{"line_number":2,"context_line":"# All Rights Reserved."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_fc1d6467","line":1,"updated":"2016-02-15 14:36:00.000000000","message":"in general the __init__ files are meant to be empty","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"21e67f38017f272c39980596d52b0ca02723f4e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2015"},{"line_number":2,"context_line":"# All Rights Reserved."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_4b4c7fc7","line":1,"in_reply_to":"dae33548_fc1d6467","updated":"2016-02-15 16:53:02.000000000","message":"Is it OpenStack specific? Can you link me to any document? It\u0027s not said in official Python docs: https://docs.python.org/2/tutorial/modules.html#packages","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"}],"neutron/agent/linux/openvswitch_firewall/constants.py":[{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"700bae23244a095032cbd67e9996f628349ea298","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"ARP_PROTO \u003d \u00270x0806\u0027"},{"line_number":22,"context_line":"IP_PROTO \u003d \u00270x0800\u0027"},{"line_number":23,"context_line":"IP6_PROTO \u003d \u00270x86dd\u0027"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"NW_ICMP_PROTO \u003d 1"},{"line_number":26,"context_line":"NW_TCP_PROTO \u003d 6"}],"source_content_type":"text/x-python","patch_set":5,"id":"da6ed579_19cf5b2a","line":23,"updated":"2016-01-13 21:37:59.000000000","message":"neutron/common/constants.py defines ETHTERTYPE_IPV6, so you should define ARP and IP there and use that.","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"3fe354c7b34f5ef099c030c6d9bd1c0468d9b6af","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"ARP_PROTO \u003d \u00270x0806\u0027"},{"line_number":22,"context_line":"IP_PROTO \u003d \u00270x0800\u0027"},{"line_number":23,"context_line":"IP6_PROTO \u003d \u00270x86dd\u0027"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"NW_ICMP_PROTO \u003d 1"},{"line_number":26,"context_line":"NW_TCP_PROTO \u003d 6"}],"source_content_type":"text/x-python","patch_set":5,"id":"da6ed579_c3b20094","line":23,"in_reply_to":"da6ed579_19cf5b2a","updated":"2016-01-14 15:30:01.000000000","message":"Done","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"700bae23244a095032cbd67e9996f628349ea298","unresolved":false,"context_lines":[{"line_number":26,"context_line":"NW_TCP_PROTO \u003d 6"},{"line_number":27,"context_line":"NW_UDP_PROTO \u003d 17"},{"line_number":28,"context_line":"NW_ICMP6_PROTO \u003d 58"},{"line_number":29,"context_line":"NW_SCTP_PROTO \u003d 132"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"DIRECTION_IP_PREFIX \u003d {firewall.INGRESS_DIRECTION: \u0027source_ip_prefix\u0027,"},{"line_number":32,"context_line":"                       firewall.EGRESS_DIRECTION: \u0027dest_ip_prefix\u0027}"}],"source_content_type":"text/x-python","patch_set":5,"id":"da6ed579_594cf39d","line":29,"updated":"2016-01-13 21:37:59.000000000","message":"These are in neutron/common/constants.py as well, or proposed in https://review.openstack.org/#/c/252155/ which should merge soon","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"3fe354c7b34f5ef099c030c6d9bd1c0468d9b6af","unresolved":false,"context_lines":[{"line_number":26,"context_line":"NW_TCP_PROTO \u003d 6"},{"line_number":27,"context_line":"NW_UDP_PROTO \u003d 17"},{"line_number":28,"context_line":"NW_ICMP6_PROTO \u003d 58"},{"line_number":29,"context_line":"NW_SCTP_PROTO \u003d 132"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"DIRECTION_IP_PREFIX \u003d {firewall.INGRESS_DIRECTION: \u0027source_ip_prefix\u0027,"},{"line_number":32,"context_line":"                       firewall.EGRESS_DIRECTION: \u0027dest_ip_prefix\u0027}"}],"source_content_type":"text/x-python","patch_set":5,"id":"da6ed579_a6ecbaf3","line":29,"in_reply_to":"da6ed579_594cf39d","updated":"2016-01-14 15:30:01.000000000","message":"Done","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"700bae23244a095032cbd67e9996f628349ea298","unresolved":false,"context_lines":[{"line_number":29,"context_line":"NW_SCTP_PROTO \u003d 132"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"DIRECTION_IP_PREFIX \u003d {firewall.INGRESS_DIRECTION: \u0027source_ip_prefix\u0027,"},{"line_number":32,"context_line":"                       firewall.EGRESS_DIRECTION: \u0027dest_ip_prefix\u0027}"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"BASE_TABLE \u003d 0"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"da6ed579_d92783c8","line":32,"updated":"2016-01-13 21:37:59.000000000","message":"Looks like duplicate with the iptables_firewall.py code, can move to firewall.py","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"3fe354c7b34f5ef099c030c6d9bd1c0468d9b6af","unresolved":false,"context_lines":[{"line_number":29,"context_line":"NW_SCTP_PROTO \u003d 132"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"DIRECTION_IP_PREFIX \u003d {firewall.INGRESS_DIRECTION: \u0027source_ip_prefix\u0027,"},{"line_number":32,"context_line":"                       firewall.EGRESS_DIRECTION: \u0027dest_ip_prefix\u0027}"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"BASE_TABLE \u003d 0"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"da6ed579_864736bb","line":32,"in_reply_to":"da6ed579_d92783c8","updated":"2016-01-14 15:30:01.000000000","message":"Done","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"3bd2bd820db233cfe23cdae57647f1d7306ffbd7","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"ARP_PROTO \u003d \u00270x0806\u0027"},{"line_number":21,"context_line":"IP_PROTO \u003d \u00270x0800\u0027"},{"line_number":22,"context_line":"IP6_PROTO \u003d \u00270x86dd\u0027"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"BASE_TABLE \u003d 0"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_187b8329","line":22,"updated":"2016-01-15 05:29:42.000000000","message":"These are not OVS specific. Maybe they would be better to generate these constants from existing constants in neutron.common.constants rather than having two sources of truth?","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"66ef574613caa4b8e9c4d6053cf221444dadc3a2","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"ARP_PROTO \u003d \u00270x0806\u0027"},{"line_number":21,"context_line":"IP_PROTO \u003d \u00270x0800\u0027"},{"line_number":22,"context_line":"IP6_PROTO \u003d \u00270x86dd\u0027"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"BASE_TABLE \u003d 0"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_07d557e6","line":22,"in_reply_to":"da6ed579_187b8329","updated":"2016-01-15 12:02:19.000000000","message":"I must have screwed something up. I was supposed to get rid of it in this PS. Thanks for catching my faults.","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"a38054327be88aa824d5891a304920116975dab6","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"# Protocol constants for dl_type (see man ovs-ofctl for more info)"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"from neutron.common import constants"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_3771ad76","line":16,"updated":"2016-02-08 10:51:08.000000000","message":"stale or misplaced comment?","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"fb72bfda1a3c7bc64a9ea8d059f30daa96ec09c5","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"# Protocol constants for dl_type (see man ovs-ofctl for more info)"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"from neutron.common import constants"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_0d9a5eb9","line":16,"in_reply_to":"5a5ae5dd_3771ad76","updated":"2016-02-08 11:16:13.000000000","message":"Oops, right. I moved constants in one of previous PS.","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"a38054327be88aa824d5891a304920116975dab6","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"from neutron.common import constants"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"BASE_TABLE \u003d 0"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"OF_STATE_NOT_TRACKED \u003d \"-trk\""},{"line_number":23,"context_line":"OF_STATE_ESTABLISHED \u003d \"+trk+est-rel-inv\""}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_7743a513","line":20,"updated":"2016-02-08 10:51:08.000000000","message":"it\u0027s confusing to have another name for LOCAL_SWITCHING.","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"fb72bfda1a3c7bc64a9ea8d059f30daa96ec09c5","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"from neutron.common import constants"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"BASE_TABLE \u003d 0"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"OF_STATE_NOT_TRACKED \u003d \"-trk\""},{"line_number":23,"context_line":"OF_STATE_ESTABLISHED \u003d \"+trk+est-rel-inv\""}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_8d772e9f","line":20,"in_reply_to":"5a5ae5dd_7743a513","updated":"2016-02-08 11:16:13.000000000","message":"Yes, I missed that constant. Thanks.","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"}],"neutron/agent/linux/openvswitch_firewall/firewall.py":[{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"00655bc809bf0aa89a906902c239ed7be4f2fe63","unresolved":false,"context_lines":[{"line_number":280,"context_line":"        )"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"        # Let the switch decide what to do with all other packets"},{"line_number":283,"context_line":"#        self._add_flow("},{"line_number":284,"context_line":"#            table\u003dBASE_TABLE,"},{"line_number":285,"context_line":"#            priority\u003d1,"},{"line_number":286,"context_line":"#            actions\u003d\u0027normal\u0027"},{"line_number":287,"context_line":"#        )"},{"line_number":288,"context_line":""},{"line_number":289,"context_line":"        self._initialize_egress(port)"},{"line_number":290,"context_line":"        self._initialize_ingress(port)"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa69d971_8e31d40d","line":287,"range":{"start_line":283,"start_character":0,"end_line":287,"end_character":10},"updated":"2016-01-08 16:09:47.000000000","message":"This should probably go away if table0 will be the table where traffic is matched.","commit_id":"816d9b6e0c12ddb61529ba676be58bf2ad3eb946"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"247780ce90adf526249c339f0b623f972dc75722","unresolved":false,"context_lines":[{"line_number":278,"context_line":"            table\u003dovsfw_consts.BASE_TABLE,"},{"line_number":279,"context_line":"            priority\u003d90,"},{"line_number":280,"context_line":"            dl_dst\u003dport.mac,"},{"line_number":281,"context_line":"            actions\u003d\u0027set_field:0x%d-\u003ereg5,resubmit(,%s)\u0027 % ("},{"line_number":282,"context_line":"                port.ofport, ovs_consts.BASE_INGRESS_TABLE),"},{"line_number":283,"context_line":"        )"},{"line_number":284,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"da6ed579_09d2dcd2","line":281,"updated":"2016-01-13 04:52:41.000000000","message":"Did you mean \u00270x%x\u0027 rather than \u00270x%d\u0027? (I could be missing OVS subtleties, but prefixing a decimal number with 0x seems odd.","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e0cf737f03f5c60e893f40aec4f1068af6357ce8","unresolved":false,"context_lines":[{"line_number":278,"context_line":"            table\u003dovsfw_consts.BASE_TABLE,"},{"line_number":279,"context_line":"            priority\u003d90,"},{"line_number":280,"context_line":"            dl_dst\u003dport.mac,"},{"line_number":281,"context_line":"            actions\u003d\u0027set_field:0x%d-\u003ereg5,resubmit(,%s)\u0027 % ("},{"line_number":282,"context_line":"                port.ofport, ovs_consts.BASE_INGRESS_TABLE),"},{"line_number":283,"context_line":"        )"},{"line_number":284,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"da6ed579_59cbbd53","line":281,"in_reply_to":"da6ed579_09d2dcd2","updated":"2016-01-13 08:55:50.000000000","message":"Good catch! I think it makes sense to put \"set_field:%d\" for reading purposes.","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"3bd2bd820db233cfe23cdae57647f1d7306ffbd7","unresolved":false,"context_lines":[{"line_number":146,"context_line":""},{"line_number":147,"context_line":"        The current driver only supports enhanced rpc calls into security group"},{"line_number":148,"context_line":"        agent. This method is never called from that place."},{"line_number":149,"context_line":"        \"\"\""},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    def _add_flow(self, **kwargs):"},{"line_number":152,"context_line":"        dl_type \u003d kwargs.get(\u0027dl_type\u0027)"}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_b84837cd","line":149,"updated":"2016-01-15 05:29:42.000000000","message":"Is it an error if it is called, or should we silently do nothing?","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"66ef574613caa4b8e9c4d6053cf221444dadc3a2","unresolved":false,"context_lines":[{"line_number":146,"context_line":""},{"line_number":147,"context_line":"        The current driver only supports enhanced rpc calls into security group"},{"line_number":148,"context_line":"        agent. This method is never called from that place."},{"line_number":149,"context_line":"        \"\"\""},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    def _add_flow(self, **kwargs):"},{"line_number":152,"context_line":"        dl_type \u003d kwargs.get(\u0027dl_type\u0027)"}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_42dc9d45","line":149,"in_reply_to":"da6ed579_b84837cd","updated":"2016-01-15 12:02:19.000000000","message":"I think I just wrote a confusing doc string. This method doesn\u0027t need to be explicitly called as the firewall keeps a consistent state between security groups and ports using SGPortMap instance. I\u0027ll re-write it.","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"3bd2bd820db233cfe23cdae57647f1d7306ffbd7","unresolved":false,"context_lines":[{"line_number":166,"context_line":"    @staticmethod"},{"line_number":167,"context_line":"    def initialize_bridge(int_br):"},{"line_number":168,"context_line":"        int_br.set_protocols("},{"line_number":169,"context_line":"            \"OpenFlow10,OpenFlow11,OpenFlow12,OpenFlow13,OpenFlow14\")"},{"line_number":170,"context_line":"        return int_br.deferred(full_ordered\u003dTrue)"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    def _drop_all_unmatched_flows(self):"}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_186ce333","line":169,"updated":"2016-01-15 05:29:42.000000000","message":"These look like constants.","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"66ef574613caa4b8e9c4d6053cf221444dadc3a2","unresolved":false,"context_lines":[{"line_number":166,"context_line":"    @staticmethod"},{"line_number":167,"context_line":"    def initialize_bridge(int_br):"},{"line_number":168,"context_line":"        int_br.set_protocols("},{"line_number":169,"context_line":"            \"OpenFlow10,OpenFlow11,OpenFlow12,OpenFlow13,OpenFlow14\")"},{"line_number":170,"context_line":"        return int_br.deferred(full_ordered\u003dTrue)"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    def _drop_all_unmatched_flows(self):"}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_c2764d05","line":169,"in_reply_to":"da6ed579_186ce333","updated":"2016-01-15 12:02:19.000000000","message":"Done","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"3bd2bd820db233cfe23cdae57647f1d7306ffbd7","unresolved":false,"context_lines":[{"line_number":175,"context_line":"                ovs_consts.BASE_INGRESS_TABLE,"},{"line_number":176,"context_line":"                ovs_consts.RULES_EGRESS_TABLE,"},{"line_number":177,"context_line":"                ovs_consts.RULES_INGRESS_TABLE,"},{"line_number":178,"context_line":"        ):"},{"line_number":179,"context_line":"            self.int_br.br.add_flow(table\u003dtable, priority\u003d0, actions\u003d\u0027drop\u0027)"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    def get_or_create_ofport(self, port):"}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_78cabf1c","line":178,"updated":"2016-01-15 05:29:42.000000000","message":"nit: this would be easier to read if you created a variable for the list of tables.","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"66ef574613caa4b8e9c4d6053cf221444dadc3a2","unresolved":false,"context_lines":[{"line_number":175,"context_line":"                ovs_consts.BASE_INGRESS_TABLE,"},{"line_number":176,"context_line":"                ovs_consts.RULES_EGRESS_TABLE,"},{"line_number":177,"context_line":"                ovs_consts.RULES_INGRESS_TABLE,"},{"line_number":178,"context_line":"        ):"},{"line_number":179,"context_line":"            self.int_br.br.add_flow(table\u003dtable, priority\u003d0, actions\u003d\u0027drop\u0027)"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    def get_or_create_ofport(self, port):"}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_62d3e1d5","line":178,"in_reply_to":"da6ed579_78cabf1c","updated":"2016-01-15 12:02:19.000000000","message":"Done","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":9200,"name":"IWAMOTO Toshihiro","email":"iwamoto@valinux.co.jp","username":"toshii"},"change_message_id":"114a9dae5772dac582fc80e4ecd45f6ba58108fe","unresolved":false,"context_lines":[{"line_number":176,"context_line":"                ovs_consts.RULES_EGRESS_TABLE,"},{"line_number":177,"context_line":"                ovs_consts.RULES_INGRESS_TABLE,"},{"line_number":178,"context_line":"        ):"},{"line_number":179,"context_line":"            self.int_br.br.add_flow(table\u003dtable, priority\u003d0, actions\u003d\u0027drop\u0027)"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    def get_or_create_ofport(self, port):"},{"line_number":182,"context_line":"        port_id \u003d port[\u0027device\u0027]"}],"source_content_type":"text/x-python","patch_set":7,"id":"ba63e191_a4468dbd","line":179,"updated":"2016-01-19 03:22:13.000000000","message":"To take advantage of the native of_interface, please consider using install_drop instead.","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"845b39e245571430bd6e54e6ebc4dd12ee2f6661","unresolved":false,"context_lines":[{"line_number":176,"context_line":"                ovs_consts.RULES_EGRESS_TABLE,"},{"line_number":177,"context_line":"                ovs_consts.RULES_INGRESS_TABLE,"},{"line_number":178,"context_line":"        ):"},{"line_number":179,"context_line":"            self.int_br.br.add_flow(table\u003dtable, priority\u003d0, actions\u003d\u0027drop\u0027)"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"    def get_or_create_ofport(self, port):"},{"line_number":182,"context_line":"        port_id \u003d port[\u0027device\u0027]"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a68dd71_17c4b73d","line":179,"in_reply_to":"ba63e191_a4468dbd","updated":"2016-01-26 12:40:44.000000000","message":"Done","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":9200,"name":"IWAMOTO Toshihiro","email":"iwamoto@valinux.co.jp","username":"toshii"},"change_message_id":"114a9dae5772dac582fc80e4ecd45f6ba58108fe","unresolved":false,"context_lines":[{"line_number":274,"context_line":"            priority\u003d100,"},{"line_number":275,"context_line":"            in_port\u003dport.ofport,"},{"line_number":276,"context_line":"            actions\u003d\u0027set_field:%d-\u003ereg5,resubmit(,%s)\u0027 % ("},{"line_number":277,"context_line":"                port.ofport, ovs_consts.BASE_EGRESS_TABLE)"},{"line_number":278,"context_line":"        )"},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"        # Identify ingress flows after egress filtering"}],"source_content_type":"text/x-python","patch_set":7,"id":"ba63e191_0483d9cd","line":277,"updated":"2016-01-19 03:22:13.000000000","message":"It seems several install_something need to be defined in ofswitch.py.","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"845b39e245571430bd6e54e6ebc4dd12ee2f6661","unresolved":false,"context_lines":[{"line_number":274,"context_line":"            priority\u003d100,"},{"line_number":275,"context_line":"            in_port\u003dport.ofport,"},{"line_number":276,"context_line":"            actions\u003d\u0027set_field:%d-\u003ereg5,resubmit(,%s)\u0027 % ("},{"line_number":277,"context_line":"                port.ofport, ovs_consts.BASE_EGRESS_TABLE)"},{"line_number":278,"context_line":"        )"},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"        # Identify ingress flows after egress filtering"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a68dd71_bce30b05","line":277,"in_reply_to":"ba63e191_0483d9cd","updated":"2016-01-26 12:40:44.000000000","message":"I see a reason in having install_something for common things like dropping. But is it really necessary for custom actions? For such custom things it\u0027s imho better to use parameters.","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"459ccd9219f377b8c72209c7b9190a18353cccd1","unresolved":false,"context_lines":[{"line_number":345,"context_line":"                    ovs_consts.ACCEPT_OR_INGRESS_TABLE)"},{"line_number":346,"context_line":"            )"},{"line_number":347,"context_line":"        # Ban dhcp service running on an instance"},{"line_number":348,"context_line":"        # FIXME(jlibosva): Should we do that by default or admin to create"},{"line_number":349,"context_line":"        # security group rules?"},{"line_number":350,"context_line":"        for dl_type, src_port, dst_port in ("},{"line_number":351,"context_line":"                (constants.ETHERTYPE_IP, 67, 68),"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_1315133f","line":348,"range":{"start_line":348,"start_character":48,"end_line":348,"end_character":55},"updated":"2016-02-04 16:51:04.000000000","message":"This is fixed rules, no need to \"FIXME\" :)\n\nThere\u0027s a patch to introduce limited port security, in that case, all those rules go away, and only MAC matching stay: https://review.openstack.org/#/c/250036/\n\nWe fix it regardless of the security group settings, because the tenants can modify does, and therefor inflict pain in their network neighbours.","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"95b1130a991a2f95b4a5f02291e95eb5571abc25","unresolved":false,"context_lines":[{"line_number":345,"context_line":"                    ovs_consts.ACCEPT_OR_INGRESS_TABLE)"},{"line_number":346,"context_line":"            )"},{"line_number":347,"context_line":"        # Ban dhcp service running on an instance"},{"line_number":348,"context_line":"        # FIXME(jlibosva): Should we do that by default or admin to create"},{"line_number":349,"context_line":"        # security group rules?"},{"line_number":350,"context_line":"        for dl_type, src_port, dst_port in ("},{"line_number":351,"context_line":"                (constants.ETHERTYPE_IP, 67, 68),"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_91ea29ab","line":348,"range":{"start_line":348,"start_character":48,"end_line":348,"end_character":55},"in_reply_to":"5a5ae5dd_1315133f","updated":"2016-02-05 16:10:29.000000000","message":"Done","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"3c9554f98ef4e037dc4171369760ac3862de8710","unresolved":false,"context_lines":[{"line_number":16,"context_line":"import netaddr"},{"line_number":17,"context_line":"from oslo_log import log as logging"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"from neutron._i18n import _LE"},{"line_number":20,"context_line":"from neutron.agent import firewall"},{"line_number":21,"context_line":"from neutron.agent.linux.openvswitch_firewall import constants as ovsfw_consts"},{"line_number":22,"context_line":"from neutron.agent.linux.openvswitch_firewall import rules"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_4bb36c50","line":19,"updated":"2016-02-08 04:47:20.000000000","message":"missing _ (used in line 32)","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"d5477d56359d55fd318a5fb4d09cfc4422740b36","unresolved":false,"context_lines":[{"line_number":16,"context_line":"import netaddr"},{"line_number":17,"context_line":"from oslo_log import log as logging"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"from neutron._i18n import _LE"},{"line_number":20,"context_line":"from neutron.agent import firewall"},{"line_number":21,"context_line":"from neutron.agent.linux.openvswitch_firewall import constants as ovsfw_consts"},{"line_number":22,"context_line":"from neutron.agent.linux.openvswitch_firewall import rules"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_9fe43dac","line":19,"in_reply_to":"5a5ae5dd_4bb36c50","updated":"2016-02-08 08:53:46.000000000","message":"Done","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"a38054327be88aa824d5891a304920116975dab6","unresolved":false,"context_lines":[{"line_number":125,"context_line":"        ovs_consts.OPENFLOW11,"},{"line_number":126,"context_line":"        ovs_consts.OPENFLOW12,"},{"line_number":127,"context_line":"        ovs_consts.OPENFLOW13,"},{"line_number":128,"context_line":"        ovs_consts.OPENFLOW14,"},{"line_number":129,"context_line":"    ])"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    def __init__(self, integration_bridge):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_74a16345","line":128,"updated":"2016-02-08 10:51:08.000000000","message":"why this many versions are listed?","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"fb72bfda1a3c7bc64a9ea8d059f30daa96ec09c5","unresolved":false,"context_lines":[{"line_number":125,"context_line":"        ovs_consts.OPENFLOW11,"},{"line_number":126,"context_line":"        ovs_consts.OPENFLOW12,"},{"line_number":127,"context_line":"        ovs_consts.OPENFLOW13,"},{"line_number":128,"context_line":"        ovs_consts.OPENFLOW14,"},{"line_number":129,"context_line":"    ])"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    def __init__(self, integration_bridge):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_8a663428","line":128,"in_reply_to":"5a5ae5dd_74a16345","updated":"2016-02-08 11:16:13.000000000","message":"Hmm, simply because I wasn\u0027t looking which parameters require which version :) Does it have any performance impact?","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":6788,"name":"Rossella Sblendido","email":"rsblendido@suse.com","username":"rossella-o"},"change_message_id":"a2bdcd7ca07c81033c8d3a36b726420f55ac9c5c","unresolved":false,"context_lines":[{"line_number":41,"context_line":"        self.ports \u003d set()"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    def update_rules(self, rules):"},{"line_number":44,"context_line":"        \"\"\"Seperate raw and remote rules.\"\"\""},{"line_number":45,"context_line":"        self.raw_rules \u003d [rule for rule in rules"},{"line_number":46,"context_line":"                          if \u0027remote_group_id\u0027 not in rule]"},{"line_number":47,"context_line":"        self.remote_rules \u003d [rule for rule in rules"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_910ec832","line":44,"updated":"2016-02-15 14:27:27.000000000","message":"nit if you have to respin, separate not seperate","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"21e67f38017f272c39980596d52b0ca02723f4e8","unresolved":false,"context_lines":[{"line_number":41,"context_line":"        self.ports \u003d set()"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    def update_rules(self, rules):"},{"line_number":44,"context_line":"        \"\"\"Seperate raw and remote rules.\"\"\""},{"line_number":45,"context_line":"        self.raw_rules \u003d [rule for rule in rules"},{"line_number":46,"context_line":"                          if \u0027remote_group_id\u0027 not in rule]"},{"line_number":47,"context_line":"        self.remote_rules \u003d [rule for rule in rules"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_2b03fb43","line":44,"in_reply_to":"dae33548_910ec832","updated":"2016-02-15 16:53:02.000000000","message":"Done","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":6788,"name":"Rossella Sblendido","email":"rsblendido@suse.com","username":"rossella-o"},"change_message_id":"a2bdcd7ca07c81033c8d3a36b726420f55ac9c5c","unresolved":false,"context_lines":[{"line_number":183,"context_line":"        for table in ovs_consts.OVS_FIREWALL_TABLES:"},{"line_number":184,"context_line":"            self.int_br.br.add_flow(table\u003dtable, priority\u003d0, actions\u003d\u0027drop\u0027)"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"    def get_or_create_ofport(self, port):"},{"line_number":187,"context_line":"        port_id \u003d port[\u0027device\u0027]"},{"line_number":188,"context_line":"        try:"},{"line_number":189,"context_line":"            of_port \u003d self.sg_port_map.ports[port_id]"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_112d98a7","line":186,"updated":"2016-02-15 14:27:27.000000000","message":"I wonder why this method is not in SGPortMap, since it\u0027s in that class that you define the ports map. update_port and delete_port are also there, I think it makes sense to move this method there too","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"21e67f38017f272c39980596d52b0ca02723f4e8","unresolved":false,"context_lines":[{"line_number":183,"context_line":"        for table in ovs_consts.OVS_FIREWALL_TABLES:"},{"line_number":184,"context_line":"            self.int_br.br.add_flow(table\u003dtable, priority\u003d0, actions\u003d\u0027drop\u0027)"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"    def get_or_create_ofport(self, port):"},{"line_number":187,"context_line":"        port_id \u003d port[\u0027device\u0027]"},{"line_number":188,"context_line":"        try:"},{"line_number":189,"context_line":"            of_port \u003d self.sg_port_map.ports[port_id]"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_8e04d515","line":186,"in_reply_to":"dae33548_112d98a7","updated":"2016-02-15 16:53:02.000000000","message":"That\u0027s because the creation of OFPort requires information from ovsdb. SGPortMap is only a keeper of consistent mapping between security groups and ports and thus doesn\u0027t have an access to needed data.","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":6788,"name":"Rossella Sblendido","email":"rsblendido@suse.com","username":"rossella-o"},"change_message_id":"0d9cd2165a1f335f05d8951b675e4c8009c421f8","unresolved":false,"context_lines":[{"line_number":183,"context_line":"        for table in ovs_consts.OVS_FIREWALL_TABLES:"},{"line_number":184,"context_line":"            self.int_br.br.add_flow(table\u003dtable, priority\u003d0, actions\u003d\u0027drop\u0027)"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"    def get_or_create_ofport(self, port):"},{"line_number":187,"context_line":"        port_id \u003d port[\u0027device\u0027]"},{"line_number":188,"context_line":"        try:"},{"line_number":189,"context_line":"            of_port \u003d self.sg_port_map.ports[port_id]"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_f409ef32","line":186,"in_reply_to":"dae33548_8e04d515","updated":"2016-02-15 20:18:15.000000000","message":"I see what you mean but still SGPortMap has self.ports as member. I wonder then if we really need self.ports there, why is that useful?","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"ab18c73b80de12e9ad87c83ba10cae99c1f94bf7","unresolved":false,"context_lines":[{"line_number":183,"context_line":"        for table in ovs_consts.OVS_FIREWALL_TABLES:"},{"line_number":184,"context_line":"            self.int_br.br.add_flow(table\u003dtable, priority\u003d0, actions\u003d\u0027drop\u0027)"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"    def get_or_create_ofport(self, port):"},{"line_number":187,"context_line":"        port_id \u003d port[\u0027device\u0027]"},{"line_number":188,"context_line":"        try:"},{"line_number":189,"context_line":"            of_port \u003d self.sg_port_map.ports[port_id]"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_1c473b1e","line":186,"in_reply_to":"dae33548_f409ef32","updated":"2016-02-16 12:11:06.000000000","message":"Done","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":6788,"name":"Rossella Sblendido","email":"rsblendido@suse.com","username":"rossella-o"},"change_message_id":"a2bdcd7ca07c81033c8d3a36b726420f55ac9c5c","unresolved":false,"context_lines":[{"line_number":206,"context_line":"        port_exists \u003d self.is_port_managed(port)"},{"line_number":207,"context_line":"        of_port \u003d self.get_or_create_ofport(port)"},{"line_number":208,"context_line":"        if port_exists:"},{"line_number":209,"context_line":"            LOG.error(_LE(\"Initializing port %s that is already initialized\"),"},{"line_number":210,"context_line":"                      port[\u0027device\u0027])"},{"line_number":211,"context_line":"            self.delete_all_port_flows(of_port)"},{"line_number":212,"context_line":"        self.sg_port_map.update_port(of_port, port[\u0027security_groups\u0027])"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_ecaf77e1","line":209,"updated":"2016-02-15 14:27:27.000000000","message":"nit: s/is/was","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"21e67f38017f272c39980596d52b0ca02723f4e8","unresolved":false,"context_lines":[{"line_number":206,"context_line":"        port_exists \u003d self.is_port_managed(port)"},{"line_number":207,"context_line":"        of_port \u003d self.get_or_create_ofport(port)"},{"line_number":208,"context_line":"        if port_exists:"},{"line_number":209,"context_line":"            LOG.error(_LE(\"Initializing port %s that is already initialized\"),"},{"line_number":210,"context_line":"                      port[\u0027device\u0027])"},{"line_number":211,"context_line":"            self.delete_all_port_flows(of_port)"},{"line_number":212,"context_line":"        self.sg_port_map.update_port(of_port, port[\u0027security_groups\u0027])"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_ee20019e","line":209,"in_reply_to":"dae33548_ecaf77e1","updated":"2016-02-15 16:53:02.000000000","message":"Done","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":6788,"name":"Rossella Sblendido","email":"rsblendido@suse.com","username":"rossella-o"},"change_message_id":"a2bdcd7ca07c81033c8d3a36b726420f55ac9c5c","unresolved":false,"context_lines":[{"line_number":227,"context_line":"            self.prepare_port_filter(port)"},{"line_number":228,"context_line":"            return"},{"line_number":229,"context_line":"        of_port \u003d self.get_or_create_ofport(port)"},{"line_number":230,"context_line":"        of_port.update(port)"},{"line_number":231,"context_line":"        self.sg_port_map.update_port(of_port, port[\u0027security_groups\u0027])"},{"line_number":232,"context_line":"        # TODO(jlibosva): Handle firewall blink"},{"line_number":233,"context_line":"        self.delete_all_port_flows(of_port)"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_f7a3c49c","line":230,"updated":"2016-02-15 14:27:27.000000000","message":"can we call this line in self.sg_port_map.update_port ? I think it\u0027s more clear to perform all the updates needed in one place.","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"ab18c73b80de12e9ad87c83ba10cae99c1f94bf7","unresolved":false,"context_lines":[{"line_number":227,"context_line":"            self.prepare_port_filter(port)"},{"line_number":228,"context_line":"            return"},{"line_number":229,"context_line":"        of_port \u003d self.get_or_create_ofport(port)"},{"line_number":230,"context_line":"        of_port.update(port)"},{"line_number":231,"context_line":"        self.sg_port_map.update_port(of_port, port[\u0027security_groups\u0027])"},{"line_number":232,"context_line":"        # TODO(jlibosva): Handle firewall blink"},{"line_number":233,"context_line":"        self.delete_all_port_flows(of_port)"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_a7d281fe","line":230,"in_reply_to":"dae33548_347fd7ab","updated":"2016-02-16 12:11:06.000000000","message":"Done","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":6788,"name":"Rossella Sblendido","email":"rsblendido@suse.com","username":"rossella-o"},"change_message_id":"0d9cd2165a1f335f05d8951b675e4c8009c421f8","unresolved":false,"context_lines":[{"line_number":227,"context_line":"            self.prepare_port_filter(port)"},{"line_number":228,"context_line":"            return"},{"line_number":229,"context_line":"        of_port \u003d self.get_or_create_ofport(port)"},{"line_number":230,"context_line":"        of_port.update(port)"},{"line_number":231,"context_line":"        self.sg_port_map.update_port(of_port, port[\u0027security_groups\u0027])"},{"line_number":232,"context_line":"        # TODO(jlibosva): Handle firewall blink"},{"line_number":233,"context_line":"        self.delete_all_port_flows(of_port)"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_347fd7ab","line":230,"in_reply_to":"dae33548_ae0559c3","updated":"2016-02-15 20:18:15.000000000","message":"yes I think it makes more sense to create one method then :)","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"21e67f38017f272c39980596d52b0ca02723f4e8","unresolved":false,"context_lines":[{"line_number":227,"context_line":"            self.prepare_port_filter(port)"},{"line_number":228,"context_line":"            return"},{"line_number":229,"context_line":"        of_port \u003d self.get_or_create_ofport(port)"},{"line_number":230,"context_line":"        of_port.update(port)"},{"line_number":231,"context_line":"        self.sg_port_map.update_port(of_port, port[\u0027security_groups\u0027])"},{"line_number":232,"context_line":"        # TODO(jlibosva): Handle firewall blink"},{"line_number":233,"context_line":"        self.delete_all_port_flows(of_port)"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_ae0559c3","line":230,"in_reply_to":"dae33548_f7a3c49c","updated":"2016-02-15 16:53:02.000000000","message":"I don\u0027t think it belongs to sg_port_map.update_port as this method updates the relations of security groups and ports, while of_port.update() updates the state of of_port object. Maybe it makes more sense to create another method to OVSFirewall, that would call it at one place?\n\nAlso the update_port() might not be the best name. Maybe update_map() will be better.","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":6788,"name":"Rossella Sblendido","email":"rsblendido@suse.com","username":"rossella-o"},"change_message_id":"a2bdcd7ca07c81033c8d3a36b726420f55ac9c5c","unresolved":false,"context_lines":[{"line_number":228,"context_line":"            return"},{"line_number":229,"context_line":"        of_port \u003d self.get_or_create_ofport(port)"},{"line_number":230,"context_line":"        of_port.update(port)"},{"line_number":231,"context_line":"        self.sg_port_map.update_port(of_port, port[\u0027security_groups\u0027])"},{"line_number":232,"context_line":"        # TODO(jlibosva): Handle firewall blink"},{"line_number":233,"context_line":"        self.delete_all_port_flows(of_port)"},{"line_number":234,"context_line":"        self.initialize_port_flows(of_port)"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_37040cbf","line":231,"updated":"2016-02-15 14:27:27.000000000","message":"isn\u0027t that done already at line 197?","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"21e67f38017f272c39980596d52b0ca02723f4e8","unresolved":false,"context_lines":[{"line_number":228,"context_line":"            return"},{"line_number":229,"context_line":"        of_port \u003d self.get_or_create_ofport(port)"},{"line_number":230,"context_line":"        of_port.update(port)"},{"line_number":231,"context_line":"        self.sg_port_map.update_port(of_port, port[\u0027security_groups\u0027])"},{"line_number":232,"context_line":"        # TODO(jlibosva): Handle firewall blink"},{"line_number":233,"context_line":"        self.delete_all_port_flows(of_port)"},{"line_number":234,"context_line":"        self.initialize_port_flows(of_port)"}],"source_content_type":"text/x-python","patch_set":22,"id":"dae33548_2e42e93e","line":231,"in_reply_to":"dae33548_37040cbf","updated":"2016-02-15 16:53:02.000000000","message":"Good catch!","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":6788,"name":"Rossella Sblendido","email":"rsblendido@suse.com","username":"rossella-o"},"change_message_id":"cc657ac13f01e78c35ac39d37fc8fc9fd0851f1d","unresolved":false,"context_lines":[{"line_number":206,"context_line":""},{"line_number":207,"context_line":"    def update_port(self, of_port, port):"},{"line_number":208,"context_line":"        self.sg_port_map.update_port(of_port, port[\u0027security_groups\u0027])"},{"line_number":209,"context_line":"        of_port.update(port)"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"    def is_port_managed(self, port):"},{"line_number":212,"context_line":"        return port[\u0027device\u0027] in self.sg_port_map.ports"}],"source_content_type":"text/x-python","patch_set":25,"id":"dae33548_5a7d3e1b","line":209,"updated":"2016-02-16 14:06:38.000000000","message":"looking at the code now, of_port.update(port) should be called in SGPortMap.update_port since now we are handling all the changes to SGPortMap.ports in methods of that class. So we don\u0027t need this method here, sorry for my confusing previous comment.","commit_id":"ef5f63cb94c66c69e79ac101861672b65391ebc1"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"ffea4588a5dbf9abc950c7d9524f7d55981d8933","unresolved":false,"context_lines":[{"line_number":206,"context_line":""},{"line_number":207,"context_line":"    def update_port(self, of_port, port):"},{"line_number":208,"context_line":"        self.sg_port_map.update_port(of_port, port[\u0027security_groups\u0027])"},{"line_number":209,"context_line":"        of_port.update(port)"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"    def is_port_managed(self, port):"},{"line_number":212,"context_line":"        return port[\u0027device\u0027] in self.sg_port_map.ports"}],"source_content_type":"text/x-python","patch_set":25,"id":"dae33548_de365d51","line":209,"in_reply_to":"dae33548_5a7d3e1b","updated":"2016-02-16 15:25:39.000000000","message":"Done","commit_id":"ef5f63cb94c66c69e79ac101861672b65391ebc1"}],"neutron/agent/linux/openvswitch_firewall/rules.py":[{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"87d3a88d821da23d9a3e022a948a4fd69cc98e22","unresolved":false,"context_lines":[{"line_number":96,"context_line":"            flow[src_port_match] \u003d port"},{"line_number":97,"context_line":"            try:"},{"line_number":98,"context_line":"                for port in six.moves.range(dst_port_min, dst_port_max + 1):"},{"line_number":99,"context_line":"                    dst_flow \u003d flow.copy()"},{"line_number":100,"context_line":"                    dst_flow[dst_port_match] \u003d port"},{"line_number":101,"context_line":"                    flows.append(dst_flow)"},{"line_number":102,"context_line":"            except TypeError:"}],"source_content_type":"text/x-python","patch_set":10,"id":"7a5de9d1_569eab07","line":99,"range":{"start_line":99,"start_character":31,"end_line":99,"end_character":35},"updated":"2016-02-01 15:51:41.000000000","message":"probably we shall look at some algorithm to expand masks allowing us do the same thing without 1 rule per port :)","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"0b2dcbd0e23d4be3ebf3022f8672141edd081fb3","unresolved":false,"context_lines":[{"line_number":96,"context_line":"            flow[src_port_match] \u003d port"},{"line_number":97,"context_line":"            try:"},{"line_number":98,"context_line":"                for port in six.moves.range(dst_port_min, dst_port_max + 1):"},{"line_number":99,"context_line":"                    dst_flow \u003d flow.copy()"},{"line_number":100,"context_line":"                    dst_flow[dst_port_match] \u003d port"},{"line_number":101,"context_line":"                    flows.append(dst_flow)"},{"line_number":102,"context_line":"            except TypeError:"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a5ae5dd_724e13c3","line":99,"range":{"start_line":99,"start_character":31,"end_line":99,"end_character":35},"in_reply_to":"7a5de9d1_5166aa2a","updated":"2016-02-03 11:51:44.000000000","message":"Agreed!, incremental enhancements FTW.","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"ae0acd17881d228d419719dcaaf8ec4743c82932","unresolved":false,"context_lines":[{"line_number":96,"context_line":"            flow[src_port_match] \u003d port"},{"line_number":97,"context_line":"            try:"},{"line_number":98,"context_line":"                for port in six.moves.range(dst_port_min, dst_port_max + 1):"},{"line_number":99,"context_line":"                    dst_flow \u003d flow.copy()"},{"line_number":100,"context_line":"                    dst_flow[dst_port_match] \u003d port"},{"line_number":101,"context_line":"                    flows.append(dst_flow)"},{"line_number":102,"context_line":"            except TypeError:"}],"source_content_type":"text/x-python","patch_set":10,"id":"7a5de9d1_5166aa2a","line":99,"range":{"start_line":99,"start_character":31,"end_line":99,"end_character":35},"in_reply_to":"7a5de9d1_569eab07","updated":"2016-02-01 19:38:35.000000000","message":"Something like https://github.com/openstack/networking-ovs-dpdk/blob/master/networking_ovs_dpdk/agent/ovs_dpdk_firewall.py#L878  :)\n\nI agree, though I think we should focus on making happen a small basic functionality and then extend that. Agile MVP ftw :)","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"459ccd9219f377b8c72209c7b9190a18353cccd1","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    dst_port_min \u003d rule.get(\u0027port_range_min\u0027)"},{"line_number":91,"context_line":"    dst_port_max \u003d rule.get(\u0027port_range_max\u0027)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    if src_port_min and src_port_max:"},{"line_number":94,"context_line":"        for port in six.moves.range(src_port_min, src_port_max + 1):"},{"line_number":95,"context_line":"            flow \u003d flow_template.copy()"},{"line_number":96,"context_line":"            flow[src_port_match] \u003d port"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_d3569bd1","line":93,"updated":"2016-02-04 16:51:04.000000000","message":"this is in the firewall drivers, but never on the security groups. Shall we ignore the src parts? or are those functionally tested now?.\n\nWe could do it later, or keep it for the future, but I suspect it will be YAGNI.","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"82c8429f138bae5458a4b6db2db108116cada8e2","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    dst_port_min \u003d rule.get(\u0027port_range_min\u0027)"},{"line_number":91,"context_line":"    dst_port_max \u003d rule.get(\u0027port_range_max\u0027)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    if src_port_min and src_port_max:"},{"line_number":94,"context_line":"        for port in six.moves.range(src_port_min, src_port_max + 1):"},{"line_number":95,"context_line":"            flow \u003d flow_template.copy()"},{"line_number":96,"context_line":"            flow[src_port_match] \u003d port"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_85cf4728","line":93,"in_reply_to":"5a5ae5dd_d3569bd1","updated":"2016-02-05 14:23:44.000000000","message":"Yes, I think this should be dropped. It comes from security group rpc but never exposed to neutron server\u0027s api.","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"3c9554f98ef4e037dc4171369760ac3862de8710","unresolved":false,"context_lines":[{"line_number":22,"context_line":"from neutron.common import constants"},{"line_number":23,"context_line":"from neutron.plugins.ml2.drivers.openvswitch.agent.common import constants \\"},{"line_number":24,"context_line":"        as ovs_consts"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"LOG \u003d logging.getLogger(__name__)"},{"line_number":28,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_cb851c5a","line":25,"updated":"2016-02-08 04:47:20.000000000","message":"one too many new lines","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"d5477d56359d55fd318a5fb4d09cfc4422740b36","unresolved":false,"context_lines":[{"line_number":22,"context_line":"from neutron.common import constants"},{"line_number":23,"context_line":"from neutron.plugins.ml2.drivers.openvswitch.agent.common import constants \\"},{"line_number":24,"context_line":"        as ovs_consts"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"LOG \u003d logging.getLogger(__name__)"},{"line_number":28,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_bff6d95a","line":25,"in_reply_to":"5a5ae5dd_cb851c5a","updated":"2016-02-08 08:53:46.000000000","message":"Done","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"}],"neutron/agent/securitygroups_rpc.py":[{"author":{"_account_id":15130,"name":"Sonu","email":"sonu.sudhakaran@gmail.com","username":"sonu"},"change_message_id":"2c4b301cd59fed752709c533a7429a24c3ae2b46","unresolved":false,"context_lines":[{"line_number":165,"context_line":"            if self.use_enhanced_rpc:"},{"line_number":166,"context_line":"                LOG.debug(\"Update security group information for ports %s\","},{"line_number":167,"context_line":"                          devices.keys())"},{"line_number":168,"context_line":"                self._update_security_group_info("},{"line_number":169,"context_line":"                    security_groups, security_group_member_ips)"},{"line_number":170,"context_line":"            for device in devices.values():"},{"line_number":171,"context_line":"                self.firewall.prepare_port_filter(device)"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa69d971_c56994fa","line":168,"range":{"start_line":168,"start_character":0,"end_line":168,"end_character":16},"updated":"2016-01-06 06:32:30.000000000","message":"This change is covered under this patch which is WIP - https://review.openstack.org/#/c/240577/","commit_id":"6073541be172d53b5120914721c655eaf86c8982"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"1272252434988972e7ccf7c10bcab23d87d8c855","unresolved":false,"context_lines":[{"line_number":165,"context_line":"            if self.use_enhanced_rpc:"},{"line_number":166,"context_line":"                LOG.debug(\"Update security group information for ports %s\","},{"line_number":167,"context_line":"                          devices.keys())"},{"line_number":168,"context_line":"                self._update_security_group_info("},{"line_number":169,"context_line":"                    security_groups, security_group_member_ips)"},{"line_number":170,"context_line":"            for device in devices.values():"},{"line_number":171,"context_line":"                self.firewall.prepare_port_filter(device)"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa69d971_69cd1e84","line":168,"range":{"start_line":168,"start_character":0,"end_line":168,"end_character":16},"in_reply_to":"fa69d971_c56994fa","updated":"2016-01-06 09:13:16.000000000","message":"Great, thanks. I expect that patch to be merged sooner than mine so I\u0027ll either rebase or will get merge conflict.","commit_id":"6073541be172d53b5120914721c655eaf86c8982"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"700bae23244a095032cbd67e9996f628349ea298","unresolved":false,"context_lines":[{"line_number":100,"context_line":"            LOG.warn(_LW(\"Driver configuration doesn\u0027t match \""},{"line_number":101,"context_line":"                         \"with enable_security_group\"))"},{"line_number":102,"context_line":"        firewall_class \u003d firewall.load_firewall_driver_class(firewall_driver)"},{"line_number":103,"context_line":"        if firewall_driver \u003d\u003d \u0027openvswitch\u0027:"},{"line_number":104,"context_line":"            self.firewall \u003d firewall_class(integration_bridge)"},{"line_number":105,"context_line":"        else:"},{"line_number":106,"context_line":"            self.firewall \u003d firewall_class()"}],"source_content_type":"text/x-python","patch_set":5,"id":"da6ed579_9cc6d966","line":103,"updated":"2016-01-13 21:37:59.000000000","message":"This doesn\u0027t seem right as this file is driver-agnostic, maybe just change the iptables driver to accept the bridge argument but ignore it","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"3fe354c7b34f5ef099c030c6d9bd1c0468d9b6af","unresolved":false,"context_lines":[{"line_number":100,"context_line":"            LOG.warn(_LW(\"Driver configuration doesn\u0027t match \""},{"line_number":101,"context_line":"                         \"with enable_security_group\"))"},{"line_number":102,"context_line":"        firewall_class \u003d firewall.load_firewall_driver_class(firewall_driver)"},{"line_number":103,"context_line":"        if firewall_driver \u003d\u003d \u0027openvswitch\u0027:"},{"line_number":104,"context_line":"            self.firewall \u003d firewall_class(integration_bridge)"},{"line_number":105,"context_line":"        else:"},{"line_number":106,"context_line":"            self.firewall \u003d firewall_class()"}],"source_content_type":"text/x-python","patch_set":5,"id":"da6ed579_c660ce03","line":103,"in_reply_to":"da6ed579_9cc6d966","updated":"2016-01-14 15:30:01.000000000","message":"That would require change for abstract firewall class and in theory won\u0027t be compatible with any 3rd party firewall drivers.\n\nThere is also possibility to load the integration bridge from configuration file like everywhere else. But it makes more sense to me that you provide a bridge to driver then magically appearing there from some global object :-/","commit_id":"e4c35a2ac62a8850ecec8abb2278cc0187bb9a06"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"459ccd9219f377b8c72209c7b9190a18353cccd1","unresolved":false,"context_lines":[{"line_number":100,"context_line":"            LOG.warn(_LW(\"Driver configuration doesn\u0027t match \""},{"line_number":101,"context_line":"                         \"with enable_security_group\"))"},{"line_number":102,"context_line":"        firewall_class \u003d firewall.load_firewall_driver_class(firewall_driver)"},{"line_number":103,"context_line":"        if firewall_driver \u003d\u003d \u0027openvswitch\u0027:"},{"line_number":104,"context_line":"            self.firewall \u003d firewall_class(integration_bridge)"},{"line_number":105,"context_line":"        else:"},{"line_number":106,"context_line":"            self.firewall \u003d firewall_class()"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_735ec777","line":103,"range":{"start_line":103,"start_character":31,"end_line":103,"end_character":42},"updated":"2016-02-04 16:51:04.000000000","message":"could this be the longer path to the driver too?","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"82c8429f138bae5458a4b6db2db108116cada8e2","unresolved":false,"context_lines":[{"line_number":100,"context_line":"            LOG.warn(_LW(\"Driver configuration doesn\u0027t match \""},{"line_number":101,"context_line":"                         \"with enable_security_group\"))"},{"line_number":102,"context_line":"        firewall_class \u003d firewall.load_firewall_driver_class(firewall_driver)"},{"line_number":103,"context_line":"        if firewall_driver \u003d\u003d \u0027openvswitch\u0027:"},{"line_number":104,"context_line":"            self.firewall \u003d firewall_class(integration_bridge)"},{"line_number":105,"context_line":"        else:"},{"line_number":106,"context_line":"            self.firewall \u003d firewall_class()"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_25f8d348","line":103,"range":{"start_line":103,"start_character":31,"end_line":103,"end_character":42},"in_reply_to":"5a5ae5dd_735ec777","updated":"2016-02-05 14:23:44.000000000","message":"Right. I plan to do:\n\n try:\n     self.firewall \u003d firewall_class(integration_bridge)\n except TypeError:\n    self.firewall \u003d firewall_class()\n\nto be more robust.","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"3c9554f98ef4e037dc4171369760ac3862de8710","unresolved":false,"context_lines":[{"line_number":104,"context_line":"            self.firewall \u003d firewall_class("},{"line_number":105,"context_line":"                integration_bridge\u003dintegration_bridge)"},{"line_number":106,"context_line":"        except TypeError as e:"},{"line_number":107,"context_line":"            LOG.warn(_LW(\"Firewall driver {fw_driver} doesn\u0027t accept \""},{"line_number":108,"context_line":"                         \"integration_bridge parameter in __init__(): {err}\"),"},{"line_number":109,"context_line":"                     fw_driver\u003dfirewall_driver,"},{"line_number":110,"context_line":"                     err\u003de)"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_ab7ea067","line":107,"updated":"2016-02-08 04:47:20.000000000","message":"please use LOG.warning warn should have been deprecated (not sure whatever happened to that patch)","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"d5477d56359d55fd318a5fb4d09cfc4422740b36","unresolved":false,"context_lines":[{"line_number":104,"context_line":"            self.firewall \u003d firewall_class("},{"line_number":105,"context_line":"                integration_bridge\u003dintegration_bridge)"},{"line_number":106,"context_line":"        except TypeError as e:"},{"line_number":107,"context_line":"            LOG.warn(_LW(\"Firewall driver {fw_driver} doesn\u0027t accept \""},{"line_number":108,"context_line":"                         \"integration_bridge parameter in __init__(): {err}\"),"},{"line_number":109,"context_line":"                     fw_driver\u003dfirewall_driver,"},{"line_number":110,"context_line":"                     err\u003de)"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_bf8d79d4","line":107,"in_reply_to":"5a5ae5dd_ab7ea067","updated":"2016-02-08 08:53:46.000000000","message":"Done","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e30eddd0903f2b4643c1d7ca05c08a2a87001c8b","unresolved":false,"context_lines":[{"line_number":241,"context_line":"    @skip_if_noopfirewall_or_firewall_disabled"},{"line_number":242,"context_line":"    def refresh_firewall(self, device_ids\u003dNone):"},{"line_number":243,"context_line":"        LOG.info(_LI(\"Refresh firewall rules\"))"},{"line_number":244,"context_line":"        device_ids \u003d device_ids or self.firewall.ports.keys()"},{"line_number":245,"context_line":"        if not device_ids:"},{"line_number":246,"context_line":"            LOG.info(_LI(\"No ports here to refresh firewall\"))"},{"line_number":247,"context_line":"            return"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_2d015a38","line":244,"range":{"start_line":244,"start_character":7,"end_line":244,"end_character":61},"updated":"2016-02-08 11:27:58.000000000","message":"This is unrelated","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"}],"neutron/cmd/sanity/checks.py":[{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"3bd2bd820db233cfe23cdae57647f1d7306ffbd7","unresolved":false,"context_lines":[{"line_number":332,"context_line":"    return False"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":""},{"line_number":335,"context_line":"def ovs_conntrack():"},{"line_number":336,"context_line":"    random_str \u003d utils.get_random_string(6)"},{"line_number":337,"context_line":"    br_name \u003d \"ovs-test-\" + random_str"},{"line_number":338,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_9869b3fb","line":335,"updated":"2016-01-15 05:29:42.000000000","message":"ovs_conntrack_supported?","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"66ef574613caa4b8e9c4d6053cf221444dadc3a2","unresolved":false,"context_lines":[{"line_number":332,"context_line":"    return False"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":""},{"line_number":335,"context_line":"def ovs_conntrack():"},{"line_number":336,"context_line":"    random_str \u003d utils.get_random_string(6)"},{"line_number":337,"context_line":"    br_name \u003d \"ovs-test-\" + random_str"},{"line_number":338,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"da6ed579_3759a435","line":335,"in_reply_to":"da6ed579_9869b3fb","updated":"2016-01-15 12:02:19.000000000","message":"Done","commit_id":"18a30e7dcbc0f2a49110d64a1279a2f2744a41cc"}],"neutron/cmd/sanity_check.py":[{"author":{"_account_id":1561,"name":"Russell Bryant","email":"rbryant@redhat.com","username":"russellb"},"change_message_id":"14357240ecba357206af2dee3efc21a3ae112dff","unresolved":false,"context_lines":[{"line_number":198,"context_line":"    if not result:"},{"line_number":199,"context_line":"        LOG.error(_LE(\u0027Check for Open vSwitch support of conntrack support \u0027"},{"line_number":200,"context_line":"                      \u0027failed. OVS/CT firewall will not work. A newer \u0027"},{"line_number":201,"context_line":"                      \u0027version of OVS is required (2.5+).\u0027))"},{"line_number":202,"context_line":"    return result"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"5a5ae5dd_e61678a6","line":201,"updated":"2016-02-04 15:37:27.000000000","message":"It also needs datapath support.  I\u0027d add the FAQ link here, as well.","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"10c43b94517684e4c7aec15ff583b986b90954a4","unresolved":false,"context_lines":[{"line_number":198,"context_line":"    if not result:"},{"line_number":199,"context_line":"        LOG.error(_LE(\u0027Check for Open vSwitch support of conntrack support \u0027"},{"line_number":200,"context_line":"                      \u0027failed. OVS/CT firewall will not work. A newer \u0027"},{"line_number":201,"context_line":"                      \u0027version of OVS is required (2.5+).\u0027))"},{"line_number":202,"context_line":"    return result"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"5a5ae5dd_9d759299","line":201,"in_reply_to":"5a5ae5dd_e61678a6","updated":"2016-02-04 16:03:43.000000000","message":"I think I will need to add adding rule with ct_state to check kernel support.","commit_id":"8afcdc7f2406348b88ad650b06edd54318c9145c"}],"neutron/common/constants.py":[{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"0008c8fd85c414ee25ade280ed85b4a4db246b22","unresolved":false,"context_lines":[{"line_number":125,"context_line":"# Neighbor Solicitation (135),"},{"line_number":126,"context_line":"ICMPV6_TYPE_NC \u003d 135"},{"line_number":127,"context_line":"# Neighbor Advertisement (136)"},{"line_number":128,"context_line":"ICMPV6_TYPE_NA \u003d 136"},{"line_number":129,"context_line":"ICMPV6_ALLOWED_TYPES \u003d [130, 131, 132, 135, 136]"},{"line_number":130,"context_line":"ICMPV6_TYPE_RA \u003d 134"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"3a57f1b5_6c9a2f70","line":128,"range":{"start_line":128,"start_character":17,"end_line":128,"end_character":20},"updated":"2016-02-12 09:51:49.000000000","message":"nit: Why don\u0027t we just take all the \"ICMPV6_ALLOWED_TYPES\" ?","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"6237db65c0d47635d8f67ce924ff4aa6a83bb959","unresolved":false,"context_lines":[{"line_number":125,"context_line":"# Neighbor Solicitation (135),"},{"line_number":126,"context_line":"ICMPV6_TYPE_NC \u003d 135"},{"line_number":127,"context_line":"# Neighbor Advertisement (136)"},{"line_number":128,"context_line":"ICMPV6_TYPE_NA \u003d 136"},{"line_number":129,"context_line":"ICMPV6_ALLOWED_TYPES \u003d [130, 131, 132, 135, 136]"},{"line_number":130,"context_line":"ICMPV6_TYPE_RA \u003d 134"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"3a57f1b5_ac01073a","line":128,"range":{"start_line":128,"start_character":17,"end_line":128,"end_character":20},"in_reply_to":"3a57f1b5_6c9a2f70","updated":"2016-02-12 09:57:27.000000000","message":"You mean why not allowing all those values? It made sense to me to allow Neighbor Solicitation to ingress and Neighbor Advertisement to egress. But I\u0027m quite ipv6 n00b so if you think we should allow all, I can implement that.\n\nAlso I should add to devref that ipv6 security groups probably won\u0027t work as they need special care (nw_src vs ipv6_src etc).","commit_id":"5d7ff19bba1bb55de216aad13fafbf853fac8f73"}],"neutron/plugins/ml2/drivers/openvswitch/agent/common/constants.py":[{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"a38054327be88aa824d5891a304920116975dab6","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"### end of OpenFlow table IDs"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"# Tables used for ovs firewall"},{"line_number":78,"context_line":"BASE_EGRESS_TABLE \u003d 71"},{"line_number":79,"context_line":"RULES_EGRESS_TABLE \u003d 72"},{"line_number":80,"context_line":"ACCEPT_OR_INGRESS_TABLE \u003d 73"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_94f17f6d","line":77,"updated":"2016-02-08 10:51:08.000000000","message":"these should be around L52.","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"fb72bfda1a3c7bc64a9ea8d059f30daa96ec09c5","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"### end of OpenFlow table IDs"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"# Tables used for ovs firewall"},{"line_number":78,"context_line":"BASE_EGRESS_TABLE \u003d 71"},{"line_number":79,"context_line":"RULES_EGRESS_TABLE \u003d 72"},{"line_number":80,"context_line":"ACCEPT_OR_INGRESS_TABLE \u003d 73"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_ca574c24","line":77,"in_reply_to":"5a5ae5dd_94f17f6d","updated":"2016-02-08 11:16:13.000000000","message":"Done","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"}],"neutron/plugins/ml2/drivers/openvswitch/agent/ovs_neutron_agent.py":[{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"be1015f843dae0fce604cb6e43ef26d795da2ade","unresolved":false,"context_lines":[{"line_number":280,"context_line":""},{"line_number":281,"context_line":"        self.prevent_arp_spoofing \u003d ("},{"line_number":282,"context_line":"            agent_conf.prevent_arp_spoofing and"},{"line_number":283,"context_line":"            not self.sg_agent.firewall.provides_arp_spoofing_protection)"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"        # Initialize iteration counter"},{"line_number":286,"context_line":"        self.iter_num \u003d 0"}],"source_content_type":"text/x-python","patch_set":24,"id":"dae33548_8a04a1c0","line":283,"range":{"start_line":283,"start_character":16,"end_line":283,"end_character":20},"updated":"2016-02-16 10:33:42.000000000","message":"cool, I like it :)","commit_id":"705470faea78772593e63e9cf98a5c4ee8b9ee26"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"88171a3b30a42cd12afe4b879f061c45e23207b6","unresolved":false,"context_lines":[{"line_number":280,"context_line":""},{"line_number":281,"context_line":"        self.prevent_arp_spoofing \u003d ("},{"line_number":282,"context_line":"            agent_conf.prevent_arp_spoofing and"},{"line_number":283,"context_line":"            not self.sg_agent.firewall.provides_arp_spoofing_protection)"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"        # Initialize iteration counter"},{"line_number":286,"context_line":"        self.iter_num \u003d 0"}],"source_content_type":"text/x-python","patch_set":24,"id":"dae33548_fb8261ff","line":283,"range":{"start_line":283,"start_character":16,"end_line":283,"end_character":20},"in_reply_to":"dae33548_8a04a1c0","updated":"2016-02-16 11:19:52.000000000","message":"Kevin\u0027s idea ;)","commit_id":"705470faea78772593e63e9cf98a5c4ee8b9ee26"}],"neutron/plugins/ml2/drivers/openvswitch/mech_driver/mech_openvswitch.py":[{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"3c9554f98ef4e037dc4171369760ac3862de8710","unresolved":false,"context_lines":[{"line_number":26,"context_line":"from neutron.plugins.ml2.drivers.openvswitch.agent.common \\"},{"line_number":27,"context_line":"    import constants as a_const"},{"line_number":28,"context_line":"from neutron.services.qos import qos_consts"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"IPTABLES_FW_DRIVER_FULL \u003d (\"neutron.agent.linux.iptables_firewall.\""},{"line_number":32,"context_line":"                           \"OVSHybridIptablesFirewallDriver\")"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_ebefb81b","line":29,"updated":"2016-02-08 04:47:20.000000000","message":"one too many new lines","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"d5477d56359d55fd318a5fb4d09cfc4422740b36","unresolved":false,"context_lines":[{"line_number":26,"context_line":"from neutron.plugins.ml2.drivers.openvswitch.agent.common \\"},{"line_number":27,"context_line":"    import constants as a_const"},{"line_number":28,"context_line":"from neutron.services.qos import qos_consts"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"IPTABLES_FW_DRIVER_FULL \u003d (\"neutron.agent.linux.iptables_firewall.\""},{"line_number":32,"context_line":"                           \"OVSHybridIptablesFirewallDriver\")"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_3fb8a974","line":29,"in_reply_to":"5a5ae5dd_ebefb81b","updated":"2016-02-08 08:53:46.000000000","message":"Done","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e0d658af8fd4e69eac4a648ba04dec1ca7b0d602","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    def __init__(self):"},{"line_number":48,"context_line":"        sg_enabled \u003d securitygroups_rpc.is_firewall_enabled()"},{"line_number":49,"context_line":"        hybrid_plug_required \u003d (cfg.CONF.SECURITYGROUP.firewall_driver in ("},{"line_number":50,"context_line":"            IPTABLES_FW_DRIVER_FULL, \u0027iptables\u0027)) and sg_enabled"},{"line_number":51,"context_line":"        vif_details \u003d {portbindings.CAP_PORT_FILTER: sg_enabled,"},{"line_number":52,"context_line":"                       portbindings.OVS_HYBRID_PLUG: hybrid_plug_required}"},{"line_number":53,"context_line":"        super(OpenvswitchMechanismDriver, self).__init__("}],"source_content_type":"text/x-python","patch_set":15,"id":"5a5ae5dd_659e90ba","line":50,"range":{"start_line":50,"start_character":38,"end_line":50,"end_character":46},"updated":"2016-02-08 09:31:05.000000000","message":"iptables_hybrid","commit_id":"94a6a497a21941f85be497be3e7aeaeb775ba21f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"b712a513f61994535091bb76b85bd68586c01d36","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def __init__(self):"},{"line_number":47,"context_line":"        sg_enabled \u003d securitygroups_rpc.is_firewall_enabled()"},{"line_number":48,"context_line":"        hybrid_plug_required \u003d (cfg.CONF.SECURITYGROUP.firewall_driver in ("},{"line_number":49,"context_line":"            IPTABLES_FW_DRIVER_FULL, \u0027iptables_hybrid\u0027)) and sg_enabled"},{"line_number":50,"context_line":"        vif_details \u003d {portbindings.CAP_PORT_FILTER: sg_enabled,"},{"line_number":51,"context_line":"                       portbindings.OVS_HYBRID_PLUG: hybrid_plug_required}"},{"line_number":52,"context_line":"        super(OpenvswitchMechanismDriver, self).__init__("}],"source_content_type":"text/x-python","patch_set":24,"id":"dae33548_9f79a1ff","line":49,"range":{"start_line":48,"start_character":8,"end_line":49,"end_character":71},"updated":"2016-02-15 18:04:44.000000000","message":"Maybe we should do what was done with arp_spoofing here as well. Having some interface in the firewall defining whether hybrid plug should be enabled","commit_id":"705470faea78772593e63e9cf98a5c4ee8b9ee26"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"88171a3b30a42cd12afe4b879f061c45e23207b6","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def __init__(self):"},{"line_number":47,"context_line":"        sg_enabled \u003d securitygroups_rpc.is_firewall_enabled()"},{"line_number":48,"context_line":"        hybrid_plug_required \u003d (cfg.CONF.SECURITYGROUP.firewall_driver in ("},{"line_number":49,"context_line":"            IPTABLES_FW_DRIVER_FULL, \u0027iptables_hybrid\u0027)) and sg_enabled"},{"line_number":50,"context_line":"        vif_details \u003d {portbindings.CAP_PORT_FILTER: sg_enabled,"},{"line_number":51,"context_line":"                       portbindings.OVS_HYBRID_PLUG: hybrid_plug_required}"},{"line_number":52,"context_line":"        super(OpenvswitchMechanismDriver, self).__init__("}],"source_content_type":"text/x-python","patch_set":24,"id":"dae33548_dbb31de8","line":49,"range":{"start_line":48,"start_character":8,"end_line":49,"end_character":71},"in_reply_to":"dae33548_2a9f5551","updated":"2016-02-16 11:19:52.000000000","message":"It\u0027s a class attribute so you can import the class and you don\u0027t need to instantiate it.","commit_id":"705470faea78772593e63e9cf98a5c4ee8b9ee26"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"be1015f843dae0fce604cb6e43ef26d795da2ade","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def __init__(self):"},{"line_number":47,"context_line":"        sg_enabled \u003d securitygroups_rpc.is_firewall_enabled()"},{"line_number":48,"context_line":"        hybrid_plug_required \u003d (cfg.CONF.SECURITYGROUP.firewall_driver in ("},{"line_number":49,"context_line":"            IPTABLES_FW_DRIVER_FULL, \u0027iptables_hybrid\u0027)) and sg_enabled"},{"line_number":50,"context_line":"        vif_details \u003d {portbindings.CAP_PORT_FILTER: sg_enabled,"},{"line_number":51,"context_line":"                       portbindings.OVS_HYBRID_PLUG: hybrid_plug_required}"},{"line_number":52,"context_line":"        super(OpenvswitchMechanismDriver, self).__init__("}],"source_content_type":"text/x-python","patch_set":24,"id":"dae33548_2a9f5551","line":49,"range":{"start_line":48,"start_character":8,"end_line":49,"end_character":71},"in_reply_to":"dae33548_9f79a1ff","updated":"2016-02-16 10:33:42.000000000","message":"But I\u0027m not sure if you have access to the FirewallDriver instance in the mechanism (server side), you could inspect the class because you have the name.\n\nMay be a NOTE here, and an iterative enhancement later ? :)","commit_id":"705470faea78772593e63e9cf98a5c4ee8b9ee26"}],"neutron/tests/common/conn_testers.py":[{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"c5b938e99478600a3ecb852d8901d121541b39d8","unresolved":false,"context_lines":[{"line_number":282,"context_line":""},{"line_number":283,"context_line":"    NOTE: The OVS ports are connected from the namespace. This connection is"},{"line_number":284,"context_line":"    currently not supported in OVS and may lead to unpredicted behavior:"},{"line_number":285,"context_line":"    https://bugzilla.redhat.com/show_bug.cgi?id\u003d1160340"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"    \"\"\""},{"line_number":288,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_9aece3c8","line":285,"updated":"2015-12-04 12:37:32.000000000","message":"why don\u0027t we plug in veths instead?, that it\u0027s know to work well :) , by the way, it seems the issue is with traffic and packet counters, or if you add interfaces with the same name on the root namespace.\n\nIt shall be ok, but if we don\u0027t move to namespaces may be we should add those two details here.","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"230e808077fc43d740f5056abe1211d830de55df","unresolved":false,"context_lines":[{"line_number":282,"context_line":""},{"line_number":283,"context_line":"    NOTE: The OVS ports are connected from the namespace. This connection is"},{"line_number":284,"context_line":"    currently not supported in OVS and may lead to unpredicted behavior:"},{"line_number":285,"context_line":"    https://bugzilla.redhat.com/show_bug.cgi?id\u003d1160340"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"    \"\"\""},{"line_number":288,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_4793ff5b","line":285,"in_reply_to":"7a740942_9aece3c8","updated":"2015-12-04 12:56:19.000000000","message":"Yeah, my plan was to work with veths. That requires modifications to PeerMachines. It\u0027s in my todo list","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"}],"neutron/tests/functional/agent/test_firewall.py":[{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"c5b938e99478600a3ecb852d8901d121541b39d8","unresolved":false,"context_lines":[{"line_number":48,"context_line":"class FirewallTestCase(base.BaseSudoTestCase):"},{"line_number":49,"context_line":"    FAKE_SECURITY_GROUP_ID \u003d \u0027fake_sg_id\u0027"},{"line_number":50,"context_line":"    scenarios \u003d [(\u0027IptablesFirewallDriver without ipset\u0027,"},{"line_number":51,"context_line":"                  {\u0027enable_ipset\u0027: False}),"},{"line_number":52,"context_line":"                 (\u0027IptablesFirewallDriver with ipset\u0027,"},{"line_number":53,"context_line":"                  {\u0027enable_ipset\u0027: True,"},{"line_number":54,"context_line":"                   \u0027initialize\u0027: \u0027initialize_iptables\u0027}),"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_ba2bdfea","line":51,"updated":"2015-12-04 12:37:32.000000000","message":"this one (without ipset) does not need initialize_iptables too?","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"230e808077fc43d740f5056abe1211d830de55df","unresolved":false,"context_lines":[{"line_number":48,"context_line":"class FirewallTestCase(base.BaseSudoTestCase):"},{"line_number":49,"context_line":"    FAKE_SECURITY_GROUP_ID \u003d \u0027fake_sg_id\u0027"},{"line_number":50,"context_line":"    scenarios \u003d [(\u0027IptablesFirewallDriver without ipset\u0027,"},{"line_number":51,"context_line":"                  {\u0027enable_ipset\u0027: False}),"},{"line_number":52,"context_line":"                 (\u0027IptablesFirewallDriver with ipset\u0027,"},{"line_number":53,"context_line":"                  {\u0027enable_ipset\u0027: True,"},{"line_number":54,"context_line":"                   \u0027initialize\u0027: \u0027initialize_iptables\u0027}),"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a740942_477a1f26","line":51,"in_reply_to":"7a740942_ba2bdfea","updated":"2015-12-04 12:56:19.000000000","message":"It does :) Thanks","commit_id":"591b61fdeb521ccc8c19a6a1e7a12751178d85d3"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"7edc22a341053edf1893fb4dd708bd0e6e204707","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    def initialize_ovs(self):"},{"line_number":95,"context_line":"        tester \u003d self.useFixture(conn_testers.OVSConnectionTester())"},{"line_number":96,"context_line":"        self.assign_vlan_to_peers()"},{"line_number":97,"context_line":"        firewall_drv \u003d openvswitch_firewall.OVSFirewallDriver(tester.bridge)"},{"line_number":98,"context_line":"        return tester, firewall_drv"},{"line_number":99,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_f3e1579b","line":96,"range":{"start_line":96,"start_character":8,"end_line":96,"end_character":35},"updated":"2016-02-04 16:40:21.000000000","message":"This is not supposed to be here. Pushed by mistake","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"459ccd9219f377b8c72209c7b9190a18353cccd1","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    def initialize_ovs(self):"},{"line_number":95,"context_line":"        tester \u003d self.useFixture(conn_testers.OVSConnectionTester())"},{"line_number":96,"context_line":"        self.assign_vlan_to_peers()"},{"line_number":97,"context_line":"        firewall_drv \u003d openvswitch_firewall.OVSFirewallDriver(tester.bridge)"},{"line_number":98,"context_line":"        return tester, firewall_drv"},{"line_number":99,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_0e1ac66e","line":96,"range":{"start_line":96,"start_character":8,"end_line":96,"end_character":35},"in_reply_to":"5a5ae5dd_f3e1579b","updated":"2016-02-04 16:51:04.000000000","message":":)","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"459ccd9219f377b8c72209c7b9190a18353cccd1","unresolved":false,"context_lines":[{"line_number":142,"context_line":"            self.firewall.update_port_filter(self.src_port_desc)"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    @skip_if_not_iptables"},{"line_number":145,"context_line":"    def test_rule_application_converges(self):"},{"line_number":146,"context_line":"        sg_rules \u003d [{\u0027ethertype\u0027: \u0027IPv4\u0027, \u0027direction\u0027: \u0027egress\u0027},"},{"line_number":147,"context_line":"                    {\u0027ethertype\u0027: \u0027IPv6\u0027, \u0027direction\u0027: \u0027egress\u0027},"},{"line_number":148,"context_line":"                    {\u0027ethertype\u0027: \u0027IPv4\u0027, \u0027direction\u0027: \u0027ingress\u0027,"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_8ef796f4","line":145,"updated":"2016-02-04 16:51:04.000000000","message":"I guess we may want to follow up separating the iptables specific ones to a separate test?","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"82c8429f138bae5458a4b6db2db108116cada8e2","unresolved":false,"context_lines":[{"line_number":142,"context_line":"            self.firewall.update_port_filter(self.src_port_desc)"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    @skip_if_not_iptables"},{"line_number":145,"context_line":"    def test_rule_application_converges(self):"},{"line_number":146,"context_line":"        sg_rules \u003d [{\u0027ethertype\u0027: \u0027IPv4\u0027, \u0027direction\u0027: \u0027egress\u0027},"},{"line_number":147,"context_line":"                    {\u0027ethertype\u0027: \u0027IPv6\u0027, \u0027direction\u0027: \u0027egress\u0027},"},{"line_number":148,"context_line":"                    {\u0027ethertype\u0027: \u0027IPv4\u0027, \u0027direction\u0027: \u0027ingress\u0027,"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_a57043dd","line":145,"in_reply_to":"5a5ae5dd_8ef796f4","updated":"2016-02-05 14:23:44.000000000","message":"I think better will be to refactor to code to be generic to firewall. That means it shouldn\u0027t call iptables specific calls.","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"459ccd9219f377b8c72209c7b9190a18353cccd1","unresolved":false,"context_lines":[{"line_number":206,"context_line":"                # and the new one was inserted in the correct position"},{"line_number":207,"context_line":"                self.assertEqual([], self.firewall.iptables._apply())"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"    @skip_if_not_iptables"},{"line_number":210,"context_line":"    def test_rule_ordering_correct(self):"},{"line_number":211,"context_line":"        sg_rules \u003d ["},{"line_number":212,"context_line":"            {\u0027ethertype\u0027: \u0027IPv4\u0027, \u0027direction\u0027: \u0027egress\u0027, \u0027protocol\u0027: \u0027tcp\u0027,"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_4ec19e7f","line":209,"updated":"2016-02-04 16:51:04.000000000","message":"why skipped?","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"82c8429f138bae5458a4b6db2db108116cada8e2","unresolved":false,"context_lines":[{"line_number":206,"context_line":"                # and the new one was inserted in the correct position"},{"line_number":207,"context_line":"                self.assertEqual([], self.firewall.iptables._apply())"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"    @skip_if_not_iptables"},{"line_number":210,"context_line":"    def test_rule_ordering_correct(self):"},{"line_number":211,"context_line":"        sg_rules \u003d ["},{"line_number":212,"context_line":"            {\u0027ethertype\u0027: \u0027IPv4\u0027, \u0027direction\u0027: \u0027egress\u0027, \u0027protocol\u0027: \u0027tcp\u0027,"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_603a39ce","line":209,"in_reply_to":"5a5ae5dd_4ec19e7f","updated":"2016-02-05 14:23:44.000000000","message":"Because this uses _assert_sg_out_tcp_rules_appear_in_order() that accesses self.firewall.iptables. That is specific to implementation of iptables firewall driver.","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"459ccd9219f377b8c72209c7b9190a18353cccd1","unresolved":false,"context_lines":[{"line_number":279,"context_line":"        self.tester.assert_no_connection(protocol\u003dself.tester.ICMP,"},{"line_number":280,"context_line":"                                         direction\u003dself.tester.EGRESS)"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"    @skip_if_not_iptables"},{"line_number":283,"context_line":"    def test_mac_spoofing_works_without_port_security_enabled(self):"},{"line_number":284,"context_line":"        self.src_port_desc[\u0027port_security_enabled\u0027] \u003d False"},{"line_number":285,"context_line":"        self.firewall.update_port_filter(self.src_port_desc)"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_6e59fafd","line":282,"updated":"2016-02-04 16:51:04.000000000","message":"why skipped?, port_security is ignored?","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"82c8429f138bae5458a4b6db2db108116cada8e2","unresolved":false,"context_lines":[{"line_number":279,"context_line":"        self.tester.assert_no_connection(protocol\u003dself.tester.ICMP,"},{"line_number":280,"context_line":"                                         direction\u003dself.tester.EGRESS)"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"    @skip_if_not_iptables"},{"line_number":283,"context_line":"    def test_mac_spoofing_works_without_port_security_enabled(self):"},{"line_number":284,"context_line":"        self.src_port_desc[\u0027port_security_enabled\u0027] \u003d False"},{"line_number":285,"context_line":"        self.firewall.update_port_filter(self.src_port_desc)"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_6068f9b9","line":282,"in_reply_to":"5a5ae5dd_6e59fafd","updated":"2016-02-05 14:23:44.000000000","message":"Because mac spoofing is part of ovs firewall driver. In iptables firewall driver mac spoofing is still done with openflow. That\u0027s why mac spoofing must be disabled for ovs firewall driver.","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"459ccd9219f377b8c72209c7b9190a18353cccd1","unresolved":false,"context_lines":[{"line_number":331,"context_line":"        self.tester.assert_no_connection(protocol\u003dself.tester.ICMP,"},{"line_number":332,"context_line":"                                         direction\u003dself.tester.EGRESS)"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"    @skip_if_not_iptables"},{"line_number":335,"context_line":"    def test_ip_spoofing_works_without_port_security_enabled(self):"},{"line_number":336,"context_line":"        self.src_port_desc[\u0027port_security_enabled\u0027] \u003d False"},{"line_number":337,"context_line":"        self.firewall.update_port_filter(self.src_port_desc)"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_8e13160d","line":334,"updated":"2016-02-04 16:51:04.000000000","message":"ditto,","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"82c8429f138bae5458a4b6db2db108116cada8e2","unresolved":false,"context_lines":[{"line_number":331,"context_line":"        self.tester.assert_no_connection(protocol\u003dself.tester.ICMP,"},{"line_number":332,"context_line":"                                         direction\u003dself.tester.EGRESS)"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"    @skip_if_not_iptables"},{"line_number":335,"context_line":"    def test_ip_spoofing_works_without_port_security_enabled(self):"},{"line_number":336,"context_line":"        self.src_port_desc[\u0027port_security_enabled\u0027] \u003d False"},{"line_number":337,"context_line":"        self.firewall.update_port_filter(self.src_port_desc)"}],"source_content_type":"text/x-python","patch_set":11,"id":"5a5ae5dd_a0a831dc","line":334,"in_reply_to":"5a5ae5dd_8e13160d","updated":"2016-02-05 14:23:44.000000000","message":"Same reason but ip spoofing instead of mac spoofing :)","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"b72100bc04b1ac4b95d9cb3139a0713f40bf69b3","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"DEVICE_OWNER_COMPUTE \u003d constants.DEVICE_OWNER_COMPUTE_PREFIX + \u0027fake\u0027"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"VLAN_COUNT \u003d 1024"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"def skip_if_not_iptables(f):"}],"source_content_type":"text/x-python","patch_set":18,"id":"5a5ae5dd_cb694e27","line":52,"range":{"start_line":52,"start_character":0,"end_line":52,"end_character":17},"updated":"2016-02-09 10:24:30.000000000","message":"Nah, this should be gone.","commit_id":"68284adacd442de58678e482d9e01e5031477ab2"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"2764d7ebf9e9ac066140d2e0c04a9f36108f5d9c","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"DEVICE_OWNER_COMPUTE \u003d constants.DEVICE_OWNER_COMPUTE_PREFIX + \u0027fake\u0027"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"VLAN_COUNT \u003d 1024"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"def skip_if_not_iptables(f):"}],"source_content_type":"text/x-python","patch_set":18,"id":"5a5ae5dd_e1b46b83","line":52,"range":{"start_line":52,"start_character":0,"end_line":52,"end_character":17},"in_reply_to":"5a5ae5dd_81e1f79c","updated":"2016-02-09 11:02:34.000000000","message":"three LITTLE vlans","commit_id":"68284adacd442de58678e482d9e01e5031477ab2"},{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"f4cb47da41c3652665707bf7a0b8e3d52723bb23","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"DEVICE_OWNER_COMPUTE \u003d constants.DEVICE_OWNER_COMPUTE_PREFIX + \u0027fake\u0027"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"VLAN_COUNT \u003d 1024"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"def skip_if_not_iptables(f):"}],"source_content_type":"text/x-python","patch_set":18,"id":"5a5ae5dd_81e1f79c","line":52,"range":{"start_line":52,"start_character":0,"end_line":52,"end_character":17},"in_reply_to":"5a5ae5dd_cb694e27","updated":"2016-02-09 11:01:15.000000000","message":"one VLAN, two VLANs, three VLANS","commit_id":"68284adacd442de58678e482d9e01e5031477ab2"}],"setup.cfg":[{"author":{"_account_id":8788,"name":"Miguel Angel Ajo","email":"mangelajo@redhat.com","username":"mangelajo"},"change_message_id":"459ccd9219f377b8c72209c7b9190a18353cccd1","unresolved":false,"context_lines":[{"line_number":147,"context_line":"    openvswitch \u003d neutron.agent.linux.interface:OVSInterfaceDriver"},{"line_number":148,"context_line":"neutron.agent.firewall_drivers \u003d"},{"line_number":149,"context_line":"    noop \u003d neutron.agent.firewall:NoopFirewallDriver"},{"line_number":150,"context_line":"    iptables \u003d neutron.agent.linux.iptables_firewall:OVSHybridIptablesFirewallDriver"},{"line_number":151,"context_line":"    openvswitch \u003d neutron.agent.linux.openvswitch_firewall:OVSFirewallDriver"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"[build_sphinx]"}],"source_content_type":"text/x-ttcn-cfg","patch_set":11,"id":"5a5ae5dd_ce8cae37","line":150,"updated":"2016-02-04 16:51:04.000000000","message":"we have also the iptables non-hybrid (linuxbridge)\n\nmay be we should add\niptables (for non hybrid)\niptables_hybrid (for hybrid)","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"82c8429f138bae5458a4b6db2db108116cada8e2","unresolved":false,"context_lines":[{"line_number":147,"context_line":"    openvswitch \u003d neutron.agent.linux.interface:OVSInterfaceDriver"},{"line_number":148,"context_line":"neutron.agent.firewall_drivers \u003d"},{"line_number":149,"context_line":"    noop \u003d neutron.agent.firewall:NoopFirewallDriver"},{"line_number":150,"context_line":"    iptables \u003d neutron.agent.linux.iptables_firewall:OVSHybridIptablesFirewallDriver"},{"line_number":151,"context_line":"    openvswitch \u003d neutron.agent.linux.openvswitch_firewall:OVSFirewallDriver"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"[build_sphinx]"}],"source_content_type":"text/x-ttcn-cfg","patch_set":11,"id":"5a5ae5dd_c0844d5f","line":150,"in_reply_to":"5a5ae5dd_ce8cae37","updated":"2016-02-05 14:23:44.000000000","message":"Correct! Will do","commit_id":"047e06f90cc095e5f47ceda7c7b2db03001d594f"}]}