)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"69985db72668113e2358eefec6994755e130104e","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Move conntrack zones to IPTablesFirewall"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The regular IPTablesFirewall needs zones to support safely"},{"line_number":10,"context_line":"clearly conntrack entries."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: Ie88237d3fe4807b712a7ec61eb932748c38952cc"},{"line_number":13,"context_line":"Closes-Bug: #1668958"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"ba2be162_067bf628","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":7},"updated":"2017-03-03 19:42:06.000000000","message":"s/clearing\n\nthat\u0027s probably what you\u0027re looking for :)","commit_id":"93f0c6e64abaef8c43446edc4ff2c178672e5e39"},{"author":{"_account_id":9656,"name":"Ihar Hrachyshka","email":"ihrachys@redhat.com","username":"ihrachys","status":"Red Hat Networking Systems Engineer"},"change_message_id":"58ad6dbcd88fba70bd1c08dfc543dc4caefe658e","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Move conntrack zones to IPTablesFirewall"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The regular IPTablesFirewall needs zones to support safely"},{"line_number":10,"context_line":"clearly conntrack entries."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: Ie88237d3fe4807b712a7ec61eb932748c38952cc"},{"line_number":13,"context_line":"Closes-Bug: #1668958"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"ba2be162_e3c7b493","line":10,"range":{"start_line":9,"start_character":41,"end_line":10,"end_character":17},"updated":"2017-03-03 19:31:13.000000000","message":"there is something messed here but I am not sure what","commit_id":"93f0c6e64abaef8c43446edc4ff2c178672e5e39"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"4c690715896c86822d52b2fe1085356787c50ebc","unresolved":false,"context_lines":[{"line_number":25,"context_line":"1. Ibe9e49653b2a280ea72cb95c2da64cd94c7739da"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Change-Id: Ie88237d3fe4807b712a7ec61eb932748c38952cc"},{"line_number":28,"context_line":"Closes-Bug: #1668958"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"3a1ff146_3995d7dd","line":28,"updated":"2017-03-16 13:55:30.000000000","message":"I re-opened https://bugs.launchpad.net/neutron/+bug/1657260 - it was reintroduced after Ia4ee9b3305e89c958ac927980d80119c53ea519b. This patch should fix it.","commit_id":"2a5729abb5b2e516081f56b73ced7bfafc6b4c33"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"2dbec3a07a5847863ee59e482c67e0792c03fd21","unresolved":false,"context_lines":[{"line_number":25,"context_line":"1. Ibe9e49653b2a280ea72cb95c2da64cd94c7739da"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Change-Id: Ie88237d3fe4807b712a7ec61eb932748c38952cc"},{"line_number":28,"context_line":"Closes-Bug: #1668958"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"1a1ced50_c5a511b6","line":28,"updated":"2017-03-16 21:07:34.000000000","message":"ack, thx","commit_id":"2a5729abb5b2e516081f56b73ced7bfafc6b4c33"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"67d569029af0acb1edeb649277d784fc1a98002b","unresolved":false,"context_lines":[{"line_number":25,"context_line":"1. Ibe9e49653b2a280ea72cb95c2da64cd94c7739da"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Change-Id: Ie88237d3fe4807b712a7ec61eb932748c38952cc"},{"line_number":28,"context_line":"Closes-Bug: #1668958"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"1a1ced50_1411345d","line":28,"in_reply_to":"1a1ced50_868f5acb","updated":"2017-03-23 10:17:33.000000000","message":"Done","commit_id":"2a5729abb5b2e516081f56b73ced7bfafc6b4c33"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"4c4e13db3b2e806b8e0acff51b90c72a7ece9676","unresolved":false,"context_lines":[{"line_number":25,"context_line":"1. Ibe9e49653b2a280ea72cb95c2da64cd94c7739da"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Change-Id: Ie88237d3fe4807b712a7ec61eb932748c38952cc"},{"line_number":28,"context_line":"Closes-Bug: #1668958"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"1a1ced50_868f5acb","line":28,"in_reply_to":"1a1ced50_c5a511b6","updated":"2017-03-20 09:35:18.000000000","message":"So maybe this patch should Closes-bug: #1657260 as well? :) Or do you want me to close 1657260 and deal with the issue only in the context of 1668958","commit_id":"2a5729abb5b2e516081f56b73ced7bfafc6b4c33"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"4890c089bd2edc3b7f775e7a3c618c01d989a8c8","unresolved":false,"context_lines":[{"line_number":18,"context_line":"to distinguish which zone traffic should be checked against when"},{"line_number":19,"context_line":"traffic enters the bridge from outside the system."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"A zone per network is adequate for the single bridge per network"},{"line_number":22,"context_line":"solution since it implicitly does not suffer from the double-bridge"},{"line_number":23,"context_line":"cross in a single network that led to per port usage in OVS.[1]"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"bff0334d_f176e4d8","line":21,"range":{"start_line":21,"start_character":39,"end_line":21,"end_character":64},"updated":"2017-04-06 12:49:23.000000000","message":"Is there a reason to use zone-per-port for hybrid driver? If we\u0027d go with zone-per-network for hybrid driver as well, we\u0027d still have a unique 5-tuple for traffic, no? Then we won\u0027t need to distinguish in IpConntrackManager.","commit_id":"c76164c058a0cfeee3eb46b523a9ad012f93dd51"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"258e11726e1bf1ca519e5a98f68d9b92a0bc8920","unresolved":false,"context_lines":[{"line_number":18,"context_line":"to distinguish which zone traffic should be checked against when"},{"line_number":19,"context_line":"traffic enters the bridge from outside the system."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"A zone per network is adequate for the single bridge per network"},{"line_number":22,"context_line":"solution since it implicitly does not suffer from the double-bridge"},{"line_number":23,"context_line":"cross in a single network that led to per port usage in OVS.[1]"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"bff0334d_08d6b9c6","line":21,"range":{"start_line":21,"start_character":39,"end_line":21,"end_character":64},"in_reply_to":"bff0334d_3d8f7d2b","updated":"2017-04-06 14:17:28.000000000","message":"Ok, I see. Thanks for explanation.","commit_id":"c76164c058a0cfeee3eb46b523a9ad012f93dd51"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"236d70b667da2836efa6a31458ba68053ca760cf","unresolved":false,"context_lines":[{"line_number":18,"context_line":"to distinguish which zone traffic should be checked against when"},{"line_number":19,"context_line":"traffic enters the bridge from outside the system."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"A zone per network is adequate for the single bridge per network"},{"line_number":22,"context_line":"solution since it implicitly does not suffer from the double-bridge"},{"line_number":23,"context_line":"cross in a single network that led to per port usage in OVS.[1]"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"bff0334d_3d8f7d2b","line":21,"range":{"start_line":21,"start_character":39,"end_line":21,"end_character":64},"in_reply_to":"bff0334d_f176e4d8","updated":"2017-04-06 13:50:13.000000000","message":"Yes, otherwise we can end up in a scenario where traffic on the same network and same host between VMs will go through conntrack twice (once for each VMs hybrid bridge). That leads to the RST packets getting dropped.\n\nIt was the reason we had to use zone per port in the first place. https://review.openstack.org/#/c/207464/","commit_id":"c76164c058a0cfeee3eb46b523a9ad012f93dd51"}],"neutron/agent/linux/iptables_firewall.py":[{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"121db540fd6146d9bb696a239128d69522fc4e03","unresolved":false,"context_lines":[{"line_number":379,"context_line":""},{"line_number":380,"context_line":"    def _get_jump_rule(self, port, direction):"},{"line_number":381,"context_line":"        if direction \u003d\u003d firewall.INGRESS_DIRECTION:"},{"line_number":382,"context_line":"            device \u003d self._get_br_device_name(port)"},{"line_number":383,"context_line":"        else:"},{"line_number":384,"context_line":"            device \u003d self._get_device_name(port)"},{"line_number":385,"context_line":"        jump_rule \u003d \u0027-m physdev --physdev-in %s -j CT --zone %s\u0027 % ("}],"source_content_type":"text/x-python","patch_set":3,"id":"ba2be162_294b6d5a","line":382,"updated":"2017-03-03 19:54:12.000000000","message":"whoops, this is OVSHybrid-specific, test explosion","commit_id":"93f0c6e64abaef8c43446edc4ff2c178672e5e39"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"4890c089bd2edc3b7f775e7a3c618c01d989a8c8","unresolved":false,"context_lines":[{"line_number":358,"context_line":"        for jump_rule in self._get_jump_rules(port):"},{"line_number":359,"context_line":"            self._remove_raw_rule(\u0027PREROUTING\u0027, jump_rule)"},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"    def _add_raw_rule(self, chain, rule, comment\u003dNone):"},{"line_number":362,"context_line":"        self.iptables.ipv4[\u0027raw\u0027].add_rule(chain, rule, comment\u003dcomment)"},{"line_number":363,"context_line":"        self.iptables.ipv6[\u0027raw\u0027].add_rule(chain, rule, comment\u003dcomment)"},{"line_number":364,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"bff0334d_748ac21b","line":361,"range":{"start_line":361,"start_character":39,"end_line":361,"end_character":53},"updated":"2017-04-06 12:49:23.000000000","message":"Is it used? On L344 the comment is already part of the rule in rules.","commit_id":"c76164c058a0cfeee3eb46b523a9ad012f93dd51"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"236d70b667da2836efa6a31458ba68053ca760cf","unresolved":false,"context_lines":[{"line_number":358,"context_line":"        for jump_rule in self._get_jump_rules(port):"},{"line_number":359,"context_line":"            self._remove_raw_rule(\u0027PREROUTING\u0027, jump_rule)"},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"    def _add_raw_rule(self, chain, rule, comment\u003dNone):"},{"line_number":362,"context_line":"        self.iptables.ipv4[\u0027raw\u0027].add_rule(chain, rule, comment\u003dcomment)"},{"line_number":363,"context_line":"        self.iptables.ipv6[\u0027raw\u0027].add_rule(chain, rule, comment\u003dcomment)"},{"line_number":364,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"bff0334d_3d941d37","line":361,"range":{"start_line":361,"start_character":39,"end_line":361,"end_character":53},"in_reply_to":"bff0334d_748ac21b","updated":"2017-04-06 13:50:13.000000000","message":"no, i just left it in to match the format of the other add_rule helper (_add_rules_to_chain_v4v6)","commit_id":"c76164c058a0cfeee3eb46b523a9ad012f93dd51"}],"neutron/tests/functional/agent/test_firewall.py":[{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"4890c089bd2edc3b7f775e7a3c618c01d989a8c8","unresolved":false,"context_lines":[{"line_number":115,"context_line":"    def initialize_iptables(self):"},{"line_number":116,"context_line":"        cfg.CONF.set_override(\u0027enable_ipset\u0027, self.enable_ipset,"},{"line_number":117,"context_line":"                              \u0027SECURITYGROUP\u0027)"},{"line_number":118,"context_line":"        br_name \u003d (\u0027brq\u0027 + self.net_id)[:n_const.LINUX_DEV_LEN]"},{"line_number":119,"context_line":"        tester \u003d self.useFixture("},{"line_number":120,"context_line":"            conn_testers.LinuxBridgeConnectionTester(self.ip_cidr,"},{"line_number":121,"context_line":"                                                     bridge_name\u003dbr_name))"}],"source_content_type":"text/x-python","patch_set":15,"id":"bff0334d_74f08268","line":118,"range":{"start_line":118,"start_character":8,"end_line":118,"end_character":63},"updated":"2017-04-06 12:49:23.000000000","message":"I think this all including L100 should go to LinuxBridgeConnectionTester - and that should provide an interface to access net_id. The idea is that ConnectionTester creates all needed resources for testing connectivity and provides data back to the caller. That way in the test, you just create ConnectionTester and you don\u0027t care about internal values.","commit_id":"c76164c058a0cfeee3eb46b523a9ad012f93dd51"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"258e11726e1bf1ca519e5a98f68d9b92a0bc8920","unresolved":false,"context_lines":[{"line_number":115,"context_line":"    def initialize_iptables(self):"},{"line_number":116,"context_line":"        cfg.CONF.set_override(\u0027enable_ipset\u0027, self.enable_ipset,"},{"line_number":117,"context_line":"                              \u0027SECURITYGROUP\u0027)"},{"line_number":118,"context_line":"        br_name \u003d (\u0027brq\u0027 + self.net_id)[:n_const.LINUX_DEV_LEN]"},{"line_number":119,"context_line":"        tester \u003d self.useFixture("},{"line_number":120,"context_line":"            conn_testers.LinuxBridgeConnectionTester(self.ip_cidr,"},{"line_number":121,"context_line":"                                                     bridge_name\u003dbr_name))"}],"source_content_type":"text/x-python","patch_set":15,"id":"bff0334d_c8521168","line":118,"range":{"start_line":118,"start_character":8,"end_line":118,"end_character":63},"in_reply_to":"bff0334d_1d35d946","updated":"2017-04-06 14:17:28.000000000","message":"Via provided interface for accessing net_id, similarly to vm_mac_address etc.\n\n self.src_port_desc \u003d self._create_port_description(\n    ...,\n    self.tester.net_id)","commit_id":"c76164c058a0cfeee3eb46b523a9ad012f93dd51"},{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"236d70b667da2836efa6a31458ba68053ca760cf","unresolved":false,"context_lines":[{"line_number":115,"context_line":"    def initialize_iptables(self):"},{"line_number":116,"context_line":"        cfg.CONF.set_override(\u0027enable_ipset\u0027, self.enable_ipset,"},{"line_number":117,"context_line":"                              \u0027SECURITYGROUP\u0027)"},{"line_number":118,"context_line":"        br_name \u003d (\u0027brq\u0027 + self.net_id)[:n_const.LINUX_DEV_LEN]"},{"line_number":119,"context_line":"        tester \u003d self.useFixture("},{"line_number":120,"context_line":"            conn_testers.LinuxBridgeConnectionTester(self.ip_cidr,"},{"line_number":121,"context_line":"                                                     bridge_name\u003dbr_name))"}],"source_content_type":"text/x-python","patch_set":15,"id":"bff0334d_1d35d946","line":118,"range":{"start_line":118,"start_character":8,"end_line":118,"end_character":63},"in_reply_to":"bff0334d_74f08268","updated":"2017-04-06 13:50:13.000000000","message":"How do we get the net_id for L159 in that case?","commit_id":"c76164c058a0cfeee3eb46b523a9ad012f93dd51"}]}