)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"78c81a468acd6b4975f70b35462dc731fbcf2d0e","unresolved":false,"context_lines":[{"line_number":20,"context_line":"|       +-------+--+  |       |   +-------+----+       |"},{"line_number":21,"context_line":"|       |fixed ip A+-------------^+floatingip B|       |"},{"line_number":22,"context_line":"|       +----------+  |       |   +------------+       |"},{"line_number":23,"context_line":"+---------------------+       |                        |"},{"line_number":24,"context_line":"                              | +--------+  +--------+ |"},{"line_number":25,"context_line":"                              | |internal|  |internal| |"},{"line_number":26,"context_line":"                              | +-----+--+  +----+---+ |"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"5aef4532_236e7c2f","line":23,"updated":"2016-03-08 00:13:09.000000000","message":"I\u0027d rather have this in a devref for developer consumption. This is gonna get lost if left in the commit message.","commit_id":"c7e972ce4a5d61cfcdff5b2fc4ba62a94905003a"}],"neutron/agent/l3/dvr_local_router.py":[{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"39c1e4711d59478b775f5d376b30be3276899749","unresolved":false,"context_lines":[{"line_number":415,"context_line":"        internal_ports \u003d self.router.get(l3_constants.INTERFACE_KEY, [])"},{"line_number":416,"context_line":"        ports_scopemark \u003d self._get_port_devicename_scopemark("},{"line_number":417,"context_line":"            internal_ports, self.get_internal_device_name)"},{"line_number":418,"context_line":"        # DVR local router will use rfp port as external port"},{"line_number":419,"context_line":"        ext_port \u003d self.get_ex_gw_port()"},{"line_number":420,"context_line":"        if not ext_port:"},{"line_number":421,"context_line":"            return ports_scopemark"}],"source_content_type":"text/x-python","patch_set":5,"id":"7af24918_8dae7f83","line":418,"updated":"2016-03-02 11:49:29.000000000","message":"The packet that comes in from rfp device can only be dest to floatingip. It was marked by the \"neutron-l3-agent-floatingip\" chain in mangle table. But given the change in router_info.py, not all floating ip will be marked at there. So, mark all ingress packets from rfp device here.","commit_id":"31877615147784f78430daaacf7fd9a24e77d6ac"},{"author":{"_account_id":13667,"name":"ZongKai LI","email":"onionpiece@163.com","username":"lzklibj"},"change_message_id":"cc1c271b2ae32a0f0c8a02c6d8fcb818f823f793","unresolved":false,"context_lines":[{"line_number":415,"context_line":"        internal_ports \u003d self.router.get(l3_constants.INTERFACE_KEY, [])"},{"line_number":416,"context_line":"        ports_scopemark \u003d self._get_port_devicename_scopemark("},{"line_number":417,"context_line":"            internal_ports, self.get_internal_device_name)"},{"line_number":418,"context_line":"        # DVR local router will use rfp port as external port"},{"line_number":419,"context_line":"        ext_port \u003d self.get_ex_gw_port()"},{"line_number":420,"context_line":"        if not ext_port:"},{"line_number":421,"context_line":"            return ports_scopemark"}],"source_content_type":"text/x-python","patch_set":5,"id":"7af24918_a4db5b4e","line":418,"in_reply_to":"7af24918_8dae7f83","updated":"2016-03-03 02:46:09.000000000","message":"I think this comment is not clear. What does \"rfp port\" do here, the following code is not going to use it.","commit_id":"31877615147784f78430daaacf7fd9a24e77d6ac"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"5f1e76d0544a290ac8d6bc593c79a35377761ae9","unresolved":false,"context_lines":[{"line_number":415,"context_line":"        internal_ports \u003d self.router.get(l3_constants.INTERFACE_KEY, [])"},{"line_number":416,"context_line":"        ports_scopemark \u003d self._get_port_devicename_scopemark("},{"line_number":417,"context_line":"            internal_ports, self.get_internal_device_name)"},{"line_number":418,"context_line":"        # DVR local router will use rfp port as external port"},{"line_number":419,"context_line":"        ext_port \u003d self.get_ex_gw_port()"},{"line_number":420,"context_line":"        if not ext_port:"},{"line_number":421,"context_line":"            return ports_scopemark"}],"source_content_type":"text/x-python","patch_set":5,"id":"7af24918_3a1f666d","line":418,"in_reply_to":"7af24918_a4db5b4e","updated":"2016-03-03 04:35:43.000000000","message":"The following code will push rfp port into ports_scopemark. The router will use ports_scopemark to build filter table and mangle table.","commit_id":"31877615147784f78430daaacf7fd9a24e77d6ac"}],"neutron/agent/l3/router_info.py":[{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"25fab6b93d6099421ba408b8ba1895111c21d118","unresolved":false,"context_lines":[{"line_number":152,"context_line":"            \u0027floatingip\u0027, \u0027-d %s -j MARK --set-mark %s\u0027 % ("},{"line_number":153,"context_line":"                floating_ip, internal_mark))"},{"line_number":154,"context_line":"        mark_traffic_from_fixed_ip \u003d ("},{"line_number":155,"context_line":"            \u0027FORWARD\u0027, \u0027-s %s -o %s -j $float-snat\u0027 % ("},{"line_number":156,"context_line":"                fixed_ip, external_devicename))"},{"line_number":157,"context_line":"        return [mark_traffic_to_floating_ip, mark_traffic_from_fixed_ip]"},{"line_number":158,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_e3ee13b3","side":"PARENT","line":155,"range":{"start_line":155,"start_character":30,"end_line":155,"end_character":35},"updated":"2016-02-22 17:59:28.000000000","message":"This \"-o %s\" was making it so that only traffic destined for the external network was considered to be allowed to cross over to the external address scope.  I think it makes sense to remove this.","commit_id":"efe8b548bc4e64049df673d36838f29a7431046d"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"25fab6b93d6099421ba408b8ba1895111c21d118","unresolved":false,"context_lines":[{"line_number":234,"context_line":"            external_devicename \u003d self.get_external_device_interface_name("},{"line_number":235,"context_line":"                external_port)"},{"line_number":236,"context_line":"            mangle_rules \u003d self.floating_mangle_rules(fip_ip, fixed_ip,"},{"line_number":237,"context_line":"                                                      external_devicename,"},{"line_number":238,"context_line":"                                                      internal_mark)"},{"line_number":239,"context_line":"            for chain, rule in mangle_rules:"},{"line_number":240,"context_line":"                self.iptables_manager.ipv4[\u0027mangle\u0027].add_rule("}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_830d8792","side":"PARENT","line":237,"range":{"start_line":237,"start_character":54,"end_line":237,"end_character":73},"updated":"2016-02-22 17:59:28.000000000","message":"These four lines of change are related to L155.","commit_id":"efe8b548bc4e64049df673d36838f29a7431046d"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"25fab6b93d6099421ba408b8ba1895111c21d118","unresolved":false,"context_lines":[{"line_number":451,"context_line":"                external_port[\u0027id\u0027])"},{"line_number":452,"context_line":"            if external_device_name \u003d\u003d device_name:"},{"line_number":453,"context_line":"                return (\u0027-i %s -m connmark --mark 0x0/0xffff0000 \u0027"},{"line_number":454,"context_line":"                        \u0027-j CONNMARK --set-mark %s\u0027"},{"line_number":455,"context_line":"                        % (device_name, mark_mask))"},{"line_number":456,"context_line":"        return \u0027-i %s -j MARK --set-mark %s\u0027 % (device_name, mark_mask)"},{"line_number":457,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_66a971df","side":"PARENT","line":454,"range":{"start_line":454,"start_character":28,"end_line":454,"end_character":36},"updated":"2016-02-22 17:59:28.000000000","message":"Honestly, I don\u0027t remember what this particular CONNMARK was for.  Was this added shortly before merging?  So, it would CONNMARK anything new ingressing on the external gateway port.  It would MARK packets for anything else.  What was the purpose of that?","commit_id":"efe8b548bc4e64049df673d36838f29a7431046d"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"a1a675468e00eb97a5620269fd3b27c737e04aaf","unresolved":false,"context_lines":[{"line_number":451,"context_line":"                external_port[\u0027id\u0027])"},{"line_number":452,"context_line":"            if external_device_name \u003d\u003d device_name:"},{"line_number":453,"context_line":"                return (\u0027-i %s -m connmark --mark 0x0/0xffff0000 \u0027"},{"line_number":454,"context_line":"                        \u0027-j CONNMARK --set-mark %s\u0027"},{"line_number":455,"context_line":"                        % (device_name, mark_mask))"},{"line_number":456,"context_line":"        return \u0027-i %s -j MARK --set-mark %s\u0027 % (device_name, mark_mask)"},{"line_number":457,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_09c4dc8e","side":"PARENT","line":454,"range":{"start_line":454,"start_character":28,"end_line":454,"end_character":36},"in_reply_to":"bae84128_66a971df","updated":"2016-02-23 08:25:04.000000000","message":"The CONNMARK was for floatingip ingress through external device. Because line 152, the MARK might be changed to the fixed ip\u0027s address scope, record CONNMARK here can make the returning packet be able to find the way back.\n\nBut I find it is duplicated because the returning packet will be set to the external scope. It matches \"-s fixed_ip -o external_device\" in iptables, as line 155. So, I remove it here to make code simpler.","commit_id":"efe8b548bc4e64049df673d36838f29a7431046d"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"25fab6b93d6099421ba408b8ba1895111c21d118","unresolved":false,"context_lines":[{"line_number":223,"context_line":"            for device in devices_in_ext_scope:"},{"line_number":224,"context_line":"                self.iptables_manager.ipv4[\u0027mangle\u0027].add_rule("},{"line_number":225,"context_line":"                    \u0027float-snat\u0027,"},{"line_number":226,"context_line":"                    \u0027-o %s -j MARK --set-xmark %s\u0027"},{"line_number":227,"context_line":"                    % (device, ext_scope_mark),"},{"line_number":228,"context_line":"                    tag\u003d\u0027floating_ip\u0027)"},{"line_number":229,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_a61c1914","line":226,"range":{"start_line":226,"start_character":21,"end_line":226,"end_character":26},"updated":"2016-02-22 17:59:28.000000000","message":"Per L155, this rule used to only apply to packets egressing on the external gateway interface.  With the change up there, this now applies to all traffic regardless of interface.  So, it makes sense to include the egress interface here to limit this MARK to packets destined for any network in the same address scope as the external network.","commit_id":"3a251a9efe04311fd6a15bceb15daa53cb842096"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"25fab6b93d6099421ba408b8ba1895111c21d118","unresolved":false,"context_lines":[{"line_number":883,"context_line":"        external_devicename \u003d self.get_external_device_name("},{"line_number":884,"context_line":"            external_port[\u0027id\u0027])"},{"line_number":885,"context_line":""},{"line_number":886,"context_line":"        # Records snat egress address scope"},{"line_number":887,"context_line":"        rule \u003d (\u0027-o %s -m connmark --mark 0x0/0xffff0000 \u0027"},{"line_number":888,"context_line":"                \u0027-j CONNMARK --save-mark \u0027"},{"line_number":889,"context_line":"                \u0027--nfmask 0xffff0000 --ctmask 0xffff0000\u0027 %"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_a69ff94e","line":886,"range":{"start_line":886,"start_character":10,"end_line":886,"end_character":43},"updated":"2016-02-22 17:59:28.000000000","message":"I might have written this comment but it doesn\u0027t make much sense anymore.  I wonder if we should clarify it in this patch since it is somewhat related to the change we\u0027re making.\n\n\"Saves the originating address scope by saving the packet MARK to the CONNMARK for new connections so that returning traffic can be match to it.\"","commit_id":"3a251a9efe04311fd6a15bceb15daa53cb842096"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"a1a675468e00eb97a5620269fd3b27c737e04aaf","unresolved":false,"context_lines":[{"line_number":883,"context_line":"        external_devicename \u003d self.get_external_device_name("},{"line_number":884,"context_line":"            external_port[\u0027id\u0027])"},{"line_number":885,"context_line":""},{"line_number":886,"context_line":"        # Records snat egress address scope"},{"line_number":887,"context_line":"        rule \u003d (\u0027-o %s -m connmark --mark 0x0/0xffff0000 \u0027"},{"line_number":888,"context_line":"                \u0027-j CONNMARK --save-mark \u0027"},{"line_number":889,"context_line":"                \u0027--nfmask 0xffff0000 --ctmask 0xffff0000\u0027 %"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_e956d8cc","line":886,"range":{"start_line":886,"start_character":10,"end_line":886,"end_character":43},"in_reply_to":"bae84128_a69ff94e","updated":"2016-02-23 08:25:04.000000000","message":"Done","commit_id":"3a251a9efe04311fd6a15bceb15daa53cb842096"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"25fab6b93d6099421ba408b8ba1895111c21d118","unresolved":false,"context_lines":[{"line_number":889,"context_line":"                \u0027--nfmask 0xffff0000 --ctmask 0xffff0000\u0027 %"},{"line_number":890,"context_line":"                external_devicename)"},{"line_number":891,"context_line":""},{"line_number":892,"context_line":"        iptables_manager.ipv4[\u0027mangle\u0027].add_rule(\u0027FORWARD\u0027, rule)"},{"line_number":893,"context_line":""},{"line_number":894,"context_line":"        address_scope \u003d self._get_external_address_scope()"},{"line_number":895,"context_line":"        if not address_scope:"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_e373b313","line":892,"range":{"start_line":892,"start_character":50,"end_line":892,"end_character":57},"updated":"2016-02-22 17:59:28.000000000","message":"It isn\u0027t clear to me why this is changing to FORWARD from POSTROUTING.  These iptables rules can be difficult to visualize, even for me who came up with many of them in the first place.  Could you help us figure it out?","commit_id":"3a251a9efe04311fd6a15bceb15daa53cb842096"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"a1a675468e00eb97a5620269fd3b27c737e04aaf","unresolved":false,"context_lines":[{"line_number":889,"context_line":"                \u0027--nfmask 0xffff0000 --ctmask 0xffff0000\u0027 %"},{"line_number":890,"context_line":"                external_devicename)"},{"line_number":891,"context_line":""},{"line_number":892,"context_line":"        iptables_manager.ipv4[\u0027mangle\u0027].add_rule(\u0027FORWARD\u0027, rule)"},{"line_number":893,"context_line":""},{"line_number":894,"context_line":"        address_scope \u003d self._get_external_address_scope()"},{"line_number":895,"context_line":"        if not address_scope:"}],"source_content_type":"text/x-python","patch_set":1,"id":"bae84128_a91a107b","line":892,"range":{"start_line":892,"start_character":50,"end_line":892,"end_character":57},"in_reply_to":"bae84128_e373b313","updated":"2016-02-23 08:25:04.000000000","message":"Carl, thanks for pointing this out. This is a non-functional change. In this patch, there are 2 places that the CONNMARK will be set. One is at [1], the other is here. The rule here is the same in FORWARD chain or in POSTROUTING chain. I change to FORWARD just to make it close to [1]. I think it is more acceptable for user to see the same behavior iptables rules together, but I won\u0027t insist on it.\n\n\n[1] https://github.com/openstack/neutron/blob/03e24280f18edb7011161b7fd14e0b3116425674/neutron/agent/linux/iptables_manager.py#L430","commit_id":"3a251a9efe04311fd6a15bceb15daa53cb842096"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"39c1e4711d59478b775f5d376b30be3276899749","unresolved":false,"context_lines":[{"line_number":447,"context_line":"            namespace\u003dself.ns_name)"},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"    def address_scope_mangle_rule(self, device_name, mark_mask):"},{"line_number":450,"context_line":"        external_port \u003d self.get_ex_gw_port()"},{"line_number":451,"context_line":"        if external_port:"},{"line_number":452,"context_line":"            external_device_name \u003d self.get_external_device_name("},{"line_number":453,"context_line":"                external_port[\u0027id\u0027])"},{"line_number":454,"context_line":"            if external_device_name \u003d\u003d device_name:"},{"line_number":455,"context_line":"                return (\u0027-i %s -m connmark --mark 0x0/0xffff0000 \u0027"},{"line_number":456,"context_line":"                        \u0027-j CONNMARK --set-mark %s\u0027"},{"line_number":457,"context_line":"                        % (device_name, mark_mask))"},{"line_number":458,"context_line":"        return \u0027-i %s -j MARK --set-mark %s\u0027 % (device_name, mark_mask)"},{"line_number":459,"context_line":""},{"line_number":460,"context_line":"    def address_scope_filter_rule(self, device_name, mark_mask):"}],"source_content_type":"text/x-python","patch_set":5,"id":"7af24918_6dba130c","side":"PARENT","line":457,"range":{"start_line":450,"start_character":0,"end_line":457,"end_character":51},"updated":"2016-03-02 11:49:29.000000000","message":"This was for recording the ingress mark that starts from external network to floating ip. So that the reply from fixed IP can reach the external device(external scope). This is unnecessary now, because the packet from fixed IP to external scope will be allowed now. So remove it.","commit_id":"399950502f095c867f30a1f45eeaf81d96f68c01"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"39c1e4711d59478b775f5d376b30be3276899749","unresolved":false,"context_lines":[{"line_number":215,"context_line":"        # Filter out the floating ips that have fixed ip in the same address"},{"line_number":216,"context_line":"        # scope. Because the packets for them will always be in one address"},{"line_number":217,"context_line":"        # scope, no need to manipulate MARK/CONNMARK for them."},{"line_number":218,"context_line":"        floating_ips \u003d [fip for fip in all_floating_ips"},{"line_number":219,"context_line":"                        if fip.get(\u0027fixed_ip_address_scope\u0027) !\u003d ext_scope]"},{"line_number":220,"context_line":"        if floating_ips:"},{"line_number":221,"context_line":"            ext_scope_mark \u003d self.get_address_scope_mark_mask(ext_scope)"},{"line_number":222,"context_line":"            ports_scopemark \u003d self._get_address_scope_mark()"}],"source_content_type":"text/x-python","patch_set":5,"id":"7af24918_6d5e9313","line":219,"range":{"start_line":218,"start_character":0,"end_line":219,"end_character":74},"updated":"2016-03-02 11:49:29.000000000","message":"The filter here can reduce the number of iptables rules, especially when address scope is not enabled and there are lots of floating ips.","commit_id":"31877615147784f78430daaacf7fd9a24e77d6ac"}]}