)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"7e367dd081623c8c122619cfa3d8fe50c3296b48","unresolved":false,"context_lines":[{"line_number":10,"context_line":"system and the desired rule state. If the format generated in"},{"line_number":11,"context_line":"Neutron does not match the format of iptables-save, Neutron will"},{"line_number":12,"context_line":"generate unnecessary deletions and adds for rules that it thinks"},{"line_number":13,"context_line":"are different when they are actually the same."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"A simple way to detect mismatches is to run the _apply function"},{"line_number":16,"context_line":"twice each time and generate an error if the second one results"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_50b15946","line":13,"updated":"2016-08-11 00:29:00.000000000","message":"can you provide an example of a mismatch?","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"defc16a85d34502d89f7cabf97f55d790a97e3c9","unresolved":false,"context_lines":[{"line_number":10,"context_line":"system and the desired rule state. If the format generated in"},{"line_number":11,"context_line":"Neutron does not match the format of iptables-save, Neutron will"},{"line_number":12,"context_line":"generate unnecessary deletions and adds for rules that it thinks"},{"line_number":13,"context_line":"are different when they are actually the same."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"A simple way to detect mismatches is to run the _apply function"},{"line_number":16,"context_line":"twice each time and generate an error if the second one results"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_54f14400","line":13,"updated":"2016-08-11 06:39:55.000000000","message":"https://review.openstack.org/#/c/348805/","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"7e367dd081623c8c122619cfa3d8fe50c3296b48","unresolved":false,"context_lines":[{"line_number":13,"context_line":"are different when they are actually the same."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"A simple way to detect mismatches is to run the _apply function"},{"line_number":16,"context_line":"twice each time and generate an error if the second one results"},{"line_number":17,"context_line":"in changes since that implies that the rules the first one applied"},{"line_number":18,"context_line":"did not match the format of iptables-save. However, this comes at"},{"line_number":19,"context_line":"a performance cost and doesn\u0027t offer benefits to operators."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_f0116d05","line":16,"updated":"2016-08-11 00:29:00.000000000","message":"isn\u0027t there a chance that the added delay may cause us not to converge on the rules generation?","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"defc16a85d34502d89f7cabf97f55d790a97e3c9","unresolved":false,"context_lines":[{"line_number":13,"context_line":"are different when they are actually the same."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"A simple way to detect mismatches is to run the _apply function"},{"line_number":16,"context_line":"twice each time and generate an error if the second one results"},{"line_number":17,"context_line":"in changes since that implies that the rules the first one applied"},{"line_number":18,"context_line":"did not match the format of iptables-save. However, this comes at"},{"line_number":19,"context_line":"a performance cost and doesn\u0027t offer benefits to operators."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_34f650f9","line":16,"updated":"2016-08-11 06:39:55.000000000","message":"it holds the lock during this time so we won\u0027t get concurrent writes","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"a85637765ace6d3528498c12761ae4062104ae3b","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Change-Id: I6bee1d51155488e91857ee8bc45470d6a224fa37"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_340c903a","line":26,"updated":"2016-08-11 06:31:44.000000000","message":"Well it\u0027s not that we won\u0027t restore them. it will just be less efficient because we will generate drop and add statements to replace rules that the iptables manager thinks is different on every iptables-save call.","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"defc16a85d34502d89f7cabf97f55d790a97e3c9","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Change-Id: I6bee1d51155488e91857ee8bc45470d6a224fa37"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_94df3c68","line":26,"updated":"2016-08-11 06:39:55.000000000","message":"Well it\u0027s not that we won\u0027t restore them. it will just be less efficient because we will generate drop and add statements to replace rules that the iptables manager thinks is different on every iptables-save call.","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"7e367dd081623c8c122619cfa3d8fe50c3296b48","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Change-Id: I6bee1d51155488e91857ee8bc45470d6a224fa37"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_10c881a7","line":26,"updated":"2016-08-11 00:29:00.000000000","message":"where does this patch stems from? Give me more.","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"e3fa6169655db2e0274ce10a4804b41e59bd1db3","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Change-Id: I6bee1d51155488e91857ee8bc45470d6a224fa37"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_46436342","line":26,"in_reply_to":"9ad45d7e_10c881a7","updated":"2016-08-11 01:29:18.000000000","message":"Armando - this is one example that was just fixed:\n\nhttps://review.openstack.org/#/c/348805/1/neutron/agent/l3/dvr_local_router.py\n\nBasically, we need to use the format iptables-save will output them, else we might not restore the rules properly.  There\u0027s a note over in iptables_firewall to this effect that always gets overlooked, this option would let us catch offenders during review.","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"8b793c6cc20c5a4a6272991c46786804602fc96d","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Change-Id: I6bee1d51155488e91857ee8bc45470d6a224fa37"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_fdcd9866","line":26,"in_reply_to":"9ad45d7e_94df3c68","updated":"2016-08-11 16:32:31.000000000","message":"Kevin - yes, I was thinking of the old code, which could mess-up the packet:byte counts in the rules.","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"ebc4f3976e1bc54c737fcc67c134784889afc07c","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Change-Id: I6bee1d51155488e91857ee8bc45470d6a224fa37"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_ef101e02","line":26,"in_reply_to":"9ad45d7e_b3f05aca","updated":"2016-08-12 06:34:57.000000000","message":"Yep. I\u0027ll clarify that it\u0027s only for development.","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"5f0fedda4512176aa2cbd031e70c0824448b6076","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Change-Id: I6bee1d51155488e91857ee8bc45470d6a224fa37"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9ad45d7e_b3f05aca","line":26,"in_reply_to":"9ad45d7e_fdcd9866","updated":"2016-08-12 01:16:02.000000000","message":"If this is meant to be an aid to the reviewer/developer to spot errors that would not be caught otherwise when playing with iptables, then I am ok with this. Though I\u0027d like to stress the fact that no operators should toggle this ON.","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"ce98e4ab03ccf5d81caf5be83e184db4a7720fdf","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"This is only meant to assist catching development errors of"},{"line_number":29,"context_line":"iptables, it SHOULD NOT be turned on by operators."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"9ad45d7e_6c36d8e8","line":26,"updated":"2016-08-12 16:27:28.000000000","message":"coming to think of it, isn\u0027t it better to toggle this in unit/functional tests only?","commit_id":"e2d5d1902b5defcce78757a6b152079f69582ebe"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"2b630a9e7244d7c9a844317efc6c70358c38a1cf","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"This is only meant to assist catching development errors of"},{"line_number":29,"context_line":"iptables, it SHOULD NOT be turned on by operators."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"9ad45d7e_c7619fd5","line":26,"in_reply_to":"9ad45d7e_6c36d8e8","updated":"2016-08-12 16:42:41.000000000","message":"No, I actually want this to run on as many real tests as possible. In unit tests it doesn\u0027t do much good because we don\u0027t call the real iptables-save/restore on the system so it\u0027s not testing the output.\n\nFunctional tests are good, but they aren\u0027t really enough because we don\u0027t have functional tests for all of the different iptables paths used by some of the L3 code and DHCP agent stuff.","commit_id":"e2d5d1902b5defcce78757a6b152079f69582ebe"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"10dd13362880ef3ec454ba0f6524022ac13d110c","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"This is only meant to assist catching development errors of"},{"line_number":29,"context_line":"iptables, it SHOULD NOT be turned on by operators."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"9ad45d7e_c78fdf73","line":26,"in_reply_to":"9ad45d7e_c7619fd5","updated":"2016-08-12 16:44:02.000000000","message":"yes, but we should improve our coverage.","commit_id":"e2d5d1902b5defcce78757a6b152079f69582ebe"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"72d02f2538bb3e91ef48db49f03243f44d08a104","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the secondary check described above."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This enables it for all of the jobs that call the gate_hook.sh"},{"line_number":26,"context_line":"script."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"This is only meant to assist catching development errors of"},{"line_number":29,"context_line":"iptables, it SHOULD NOT be turned on by operators."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"9ad45d7e_275cfbec","line":26,"in_reply_to":"9ad45d7e_c78fdf73","updated":"2016-08-12 16:45:30.000000000","message":"bear in mind that api jobs do not exercise the system, so we may want to flip this for the other jobs too.","commit_id":"e2d5d1902b5defcce78757a6b152079f69582ebe"}],"neutron/agent/common/config.py":[{"author":{"_account_id":1653,"name":"garyk","email":"gkotton@vmware.com","username":"garyk"},"change_message_id":"161f123e1a22a68be181eec9b57104d14aa26be1","unresolved":false,"context_lines":[{"line_number":64,"context_line":"                       \"generated iptables rules that describe each rule\u0027s \""},{"line_number":65,"context_line":"                       \"purpose. System must support the iptables comments \""},{"line_number":66,"context_line":"                       \"module for addition of comments.\")),"},{"line_number":67,"context_line":"    cfg.BoolOpt(\u0027verify_iptables_rules\u0027, default\u003dFalse,"},{"line_number":68,"context_line":"                help\u003d_(\"Duplicate every iptables difference calculation to \""},{"line_number":69,"context_line":"                       \"ensure the format being generated matches the format \""},{"line_number":70,"context_line":"                       \"of iptables-save. This option should only be used \""}],"source_content_type":"text/x-python","patch_set":2,"id":"bacf61ea_a4d254d0","line":67,"updated":"2016-07-29 11:12:16.000000000","message":"please add a release note for this","commit_id":"2052f8e5e0731886b48f288dbb6a2a034eb65050"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"57fdd4e8dd35b302ec9837199e3f3f2e48009865","unresolved":false,"context_lines":[{"line_number":64,"context_line":"                       \"generated iptables rules that describe each rule\u0027s \""},{"line_number":65,"context_line":"                       \"purpose. System must support the iptables comments \""},{"line_number":66,"context_line":"                       \"module for addition of comments.\")),"},{"line_number":67,"context_line":"    cfg.BoolOpt(\u0027verify_iptables_rules\u0027, default\u003dFalse,"},{"line_number":68,"context_line":"                help\u003d_(\"Duplicate every iptables difference calculation to \""},{"line_number":69,"context_line":"                       \"ensure the format being generated matches the format \""},{"line_number":70,"context_line":"                       \"of iptables-save. This option should only be used \""}],"source_content_type":"text/x-python","patch_set":2,"id":"bacf61ea_bda197fa","line":67,"in_reply_to":"bacf61ea_a4d254d0","updated":"2016-07-30 23:40:10.000000000","message":"I was thinking about this. Is this something we really want to even advertise to deployers or operators? It\u0027s only really useful to developers.","commit_id":"2052f8e5e0731886b48f288dbb6a2a034eb65050"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"5f0fedda4512176aa2cbd031e70c0824448b6076","unresolved":false,"context_lines":[{"line_number":64,"context_line":"                       \"generated iptables rules that describe each rule\u0027s \""},{"line_number":65,"context_line":"                       \"purpose. System must support the iptables comments \""},{"line_number":66,"context_line":"                       \"module for addition of comments.\")),"},{"line_number":67,"context_line":"    cfg.BoolOpt(\u0027verify_iptables_rules\u0027, default\u003dFalse,"},{"line_number":68,"context_line":"                help\u003d_(\"Duplicate every iptables difference calculation to \""},{"line_number":69,"context_line":"                       \"ensure the format being generated matches the format \""},{"line_number":70,"context_line":"                       \"of iptables-save. This option should only be used \""}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad45d7e_53cc7e88","line":67,"updated":"2016-08-12 01:16:02.000000000","message":"what if we called this debug_iptables_rules? Would it resonate more with operators?","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"ebc4f3976e1bc54c737fcc67c134784889afc07c","unresolved":false,"context_lines":[{"line_number":64,"context_line":"                       \"generated iptables rules that describe each rule\u0027s \""},{"line_number":65,"context_line":"                       \"purpose. System must support the iptables comments \""},{"line_number":66,"context_line":"                       \"module for addition of comments.\")),"},{"line_number":67,"context_line":"    cfg.BoolOpt(\u0027verify_iptables_rules\u0027, default\u003dFalse,"},{"line_number":68,"context_line":"                help\u003d_(\"Duplicate every iptables difference calculation to \""},{"line_number":69,"context_line":"                       \"ensure the format being generated matches the format \""},{"line_number":70,"context_line":"                       \"of iptables-save. This option should only be used \""}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad45d7e_2ff7d6d3","line":67,"in_reply_to":"9ad45d7e_53cc7e88","updated":"2016-08-12 06:34:57.000000000","message":"Done","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"5f0fedda4512176aa2cbd031e70c0824448b6076","unresolved":false,"context_lines":[{"line_number":68,"context_line":"                help\u003d_(\"Duplicate every iptables difference calculation to \""},{"line_number":69,"context_line":"                       \"ensure the format being generated matches the format \""},{"line_number":70,"context_line":"                       \"of iptables-save. This option should only be used \""},{"line_number":71,"context_line":"                       \"when developing Neutron.\")),"},{"line_number":72,"context_line":"]"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"PROCESS_MONITOR_OPTS \u003d ["}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad45d7e_33aaaa85","line":71,"updated":"2016-08-12 01:16:02.000000000","message":"I\u0027d add: do not turn it ON in prod. But meh.","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"ebc4f3976e1bc54c737fcc67c134784889afc07c","unresolved":false,"context_lines":[{"line_number":68,"context_line":"                help\u003d_(\"Duplicate every iptables difference calculation to \""},{"line_number":69,"context_line":"                       \"ensure the format being generated matches the format \""},{"line_number":70,"context_line":"                       \"of iptables-save. This option should only be used \""},{"line_number":71,"context_line":"                       \"when developing Neutron.\")),"},{"line_number":72,"context_line":"]"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"PROCESS_MONITOR_OPTS \u003d ["}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad45d7e_8f0242b2","line":71,"in_reply_to":"9ad45d7e_33aaaa85","updated":"2016-08-12 06:34:57.000000000","message":"Done","commit_id":"98f59158928ef1c88ef86c811ed40543683bb644"}],"neutron/tests/contrib/gate_hook.sh":[{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"67850928c32ecf8e9859835eb1a27f4c80212a5b","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    load_rc_hook qos"},{"line_number":70,"context_line":"    load_rc_hook trunk"},{"line_number":71,"context_line":"    load_conf_hook osprofiler"},{"line_number":72,"context_line":"    if [[ \"$VENV\" \u003d~ \"dsvm-scenario\" ]]; then"},{"line_number":73,"context_line":"        load_conf_hook iptables_verify"},{"line_number":74,"context_line":"    fi"},{"line_number":75,"context_line":"    if [[ \"$VENV\" \u003d~ \"pecan\" ]]; then"}],"source_content_type":"text/x-sh","patch_set":5,"id":"9ad45d7e_866cc809","line":72,"updated":"2016-08-12 17:31:47.000000000","message":"this is perhaps telling us we\u0027d want another case-switch which is more compact, but it\u0027s a style nit.","commit_id":"19dbbe6f003f3659e561068b6edbb252d435dba7"}]}