)]}'
{"neutron/tests/functional/agent/test_firewall.py":[{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a13f5feb688e22499071b4099be77b64d5bae269","unresolved":false,"context_lines":[{"line_number":582,"context_line":"        self.firewall.update_security_group_rules(all_allowed_sg_id,"},{"line_number":583,"context_line":"                                                  all_allowed_sg_rules)"},{"line_number":584,"context_line":"        self.firewall.update_security_group_members(all_allowed_sg_id,"},{"line_number":585,"context_line":"                                                    {\u0027IPv4\u0027: [aap_vm.ip]})"},{"line_number":586,"context_line":"        self.firewall.update_port_filter(aap_port_desc)"},{"line_number":587,"context_line":"        # assign FAKE_SECURITY_GROUP to peer and vm"},{"line_number":588,"context_line":"        peer_port_desc \u003d _create_port_description(peer,"}],"source_content_type":"text/x-python","patch_set":6,"id":"ba2be162_3fd9a2f3","line":585,"range":{"start_line":585,"start_character":62,"end_line":585,"end_character":71},"updated":"2017-03-06 15:42:42.000000000","message":"This should be empty as all_allowed_sg_id doesn\u0027t have any remote group","commit_id":"5ebbaf3bfd9e8893063f0f6c01e9816710d8201f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a13f5feb688e22499071b4099be77b64d5bae269","unresolved":false,"context_lines":[{"line_number":583,"context_line":"                                                  all_allowed_sg_rules)"},{"line_number":584,"context_line":"        self.firewall.update_security_group_members(all_allowed_sg_id,"},{"line_number":585,"context_line":"                                                    {\u0027IPv4\u0027: [aap_vm.ip]})"},{"line_number":586,"context_line":"        self.firewall.update_port_filter(aap_port_desc)"},{"line_number":587,"context_line":"        # assign FAKE_SECURITY_GROUP to peer and vm"},{"line_number":588,"context_line":"        peer_port_desc \u003d _create_port_description(peer,"},{"line_number":589,"context_line":"                                                  self.FAKE_SECURITY_GROUP_ID)"}],"source_content_type":"text/x-python","patch_set":6,"id":"ba2be162_df58868c","line":586,"range":{"start_line":586,"start_character":0,"end_line":586,"end_character":55},"updated":"2017-03-06 15:42:42.000000000","message":"I think this is not needed as you haven\u0027t changed anything.","commit_id":"5ebbaf3bfd9e8893063f0f6c01e9816710d8201f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a13f5feb688e22499071b4099be77b64d5bae269","unresolved":false,"context_lines":[{"line_number":595,"context_line":"                          \u0027remote_group_id\u0027: all_allowed_sg_id},"},{"line_number":596,"context_line":"                         {\u0027ethertype\u0027: \u0027IPv4\u0027, \u0027direction\u0027: \u0027egress\u0027,"},{"line_number":597,"context_line":"                          \u0027remote_group_id\u0027: all_allowed_sg_id}]"},{"line_number":598,"context_line":"        fake_sg_members \u003d {\u0027IPv4\u0027: [vm.ip, peer.ip]}"},{"line_number":599,"context_line":"        self.firewall.update_security_group_rules(self.FAKE_SECURITY_GROUP_ID,"},{"line_number":600,"context_line":"                                                  fake_sg_rules)"},{"line_number":601,"context_line":"        self.firewall.update_security_group_members("}],"source_content_type":"text/x-python","patch_set":6,"id":"ba2be162_bfccb235","line":598,"range":{"start_line":598,"start_character":36,"end_line":598,"end_character":50},"updated":"2017-03-06 15:42:42.000000000","message":"This should be aap_vm.ip as that\u0027s the only member in all_allowed_sg_id","commit_id":"5ebbaf3bfd9e8893063f0f6c01e9816710d8201f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"4fa1146e1675e85c6a2e39de0f9b3896c67811bb","unresolved":false,"context_lines":[{"line_number":595,"context_line":"                          \u0027remote_group_id\u0027: all_allowed_sg_id},"},{"line_number":596,"context_line":"                         {\u0027ethertype\u0027: \u0027IPv4\u0027, \u0027direction\u0027: \u0027egress\u0027,"},{"line_number":597,"context_line":"                          \u0027remote_group_id\u0027: all_allowed_sg_id}]"},{"line_number":598,"context_line":"        fake_sg_members \u003d {\u0027IPv4\u0027: [vm.ip, peer.ip]}"},{"line_number":599,"context_line":"        self.firewall.update_security_group_rules(self.FAKE_SECURITY_GROUP_ID,"},{"line_number":600,"context_line":"                                                  fake_sg_rules)"},{"line_number":601,"context_line":"        self.firewall.update_security_group_members("}],"source_content_type":"text/x-python","patch_set":6,"id":"9a30ddce_e2111eb1","line":598,"range":{"start_line":598,"start_character":36,"end_line":598,"end_character":50},"in_reply_to":"ba2be162_abe0f5cd","updated":"2017-03-07 09:08:18.000000000","message":"Yes, I think I got your intent. What I\u0027m trying to say is that fake_sg_members should contain ip addresses of the all_allowed_sg - which is only the aap_vm. What you wrote here means that fake_sg has a remote group fake_sg, so vms peer and vm should be able to ping each other.","commit_id":"5ebbaf3bfd9e8893063f0f6c01e9816710d8201f"},{"author":{"_account_id":13717,"name":"Inessa Vasilevskaya","email":"ivasilevskaya@mirantis.com","username":"ivasilevskaya"},"change_message_id":"ed6a0c63f237691969f6a5e7e7a93f4cae24f92e","unresolved":false,"context_lines":[{"line_number":595,"context_line":"                          \u0027remote_group_id\u0027: all_allowed_sg_id},"},{"line_number":596,"context_line":"                         {\u0027ethertype\u0027: \u0027IPv4\u0027, \u0027direction\u0027: \u0027egress\u0027,"},{"line_number":597,"context_line":"                          \u0027remote_group_id\u0027: all_allowed_sg_id}]"},{"line_number":598,"context_line":"        fake_sg_members \u003d {\u0027IPv4\u0027: [vm.ip, peer.ip]}"},{"line_number":599,"context_line":"        self.firewall.update_security_group_rules(self.FAKE_SECURITY_GROUP_ID,"},{"line_number":600,"context_line":"                                                  fake_sg_rules)"},{"line_number":601,"context_line":"        self.firewall.update_security_group_members("}],"source_content_type":"text/x-python","patch_set":6,"id":"ba2be162_abe0f5cd","line":598,"range":{"start_line":598,"start_character":36,"end_line":598,"end_character":50},"in_reply_to":"ba2be162_bfccb235","updated":"2017-03-06 16:55:04.000000000","message":"I\u0027m trying to achieve the following setup (sorry for weird names, just wanted them to align with the bash script reproduction in http://paste.openstack.org/show/601257/):\n\n- 2 security groups \u0027fake_sg_id\u0027 and \u0027all_allowed_sg_id\u0027, \u0027fake_sg_id\u0027 has icmp allowed for members of \u0027all_allowed_sg_id\u0027 only via setting remote_group_id; \u0027all_allowed_sg_id\u0027 allows any traffic.\n- 2 vms (peer and vm) in \u0027fake_sg_id\u0027 and 1 vm (aap_vm) in \u0027all_allowed_sg_id\u0027\n\nThen I verify that peer and vm can\u0027t ping one another. But after defining allowed_address_pairs for aap_vm\u0027s port with cidr that includes ips of both peer and vm (the ones that belong to \u0027fake_sg_id\u0027 group and should not be able to reach one another) pings start to pass.\n\nThe behavior does reproduce manually (please see the snippet I mentioned above) but I\u0027ve had no luck covering it with a test so far.\n\nHope I made my intentions a bit clearer.","commit_id":"5ebbaf3bfd9e8893063f0f6c01e9816710d8201f"}]}