)]}'
{"neutron/agent/linux/iptables_firewall.py":[{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"841d76b2d1ce3840ef525e364eadab113b2eec6e","unresolved":false,"context_lines":[{"line_number":372,"context_line":"            if rule.get(\u0027ethertype\u0027) \u003d\u003d constants.IPv4:"},{"line_number":373,"context_line":"                ipv4_sg_rules.append(rule)"},{"line_number":374,"context_line":"            elif rule.get(\u0027ethertype\u0027) \u003d\u003d constants.IPv6:"},{"line_number":375,"context_line":"                # this can be removed"},{"line_number":376,"context_line":"                if rule.get(\u0027protocol\u0027) in n_const.IPV6_ICMP_LEGACY_PROTO_LIST:"},{"line_number":377,"context_line":"                    rule[\u0027protocol\u0027] \u003d \u0027ipv6-icmp\u0027"},{"line_number":378,"context_line":"                ipv6_sg_rules.append(rule)"}],"source_content_type":"text/x-python","patch_set":5,"id":"3f1d235d_a26362b1","line":375,"updated":"2017-06-30 19:56:53.000000000","message":"Then why is it here? :)","commit_id":"5e5e7e7253b9ba6e292e2432dc25eb90c456568b"}],"neutron/db/securitygroups_db.py":[{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"869036fee7f5dc4a543d4b3125e6d0a38fbb729d","unresolved":false,"context_lines":[{"line_number":365,"context_line":"                    ret.append(res_rule_dict)"},{"line_number":366,"context_line":"        if dup:"},{"line_number":367,"context_line":"            self._update_if_icmpv6_protocol_in_rule(context, dup)"},{"line_number":368,"context_line":"            raise ext_sg.SecurityGroupRuleExists(rule_id\u003ddup.get(\u0027id\u0027))"},{"line_number":369,"context_line":"        for rdict in ret:"},{"line_number":370,"context_line":"            registry.notify("},{"line_number":371,"context_line":"                resources.SECURITY_GROUP_RULE, events.AFTER_CREATE, self,"}],"source_content_type":"text/x-python","patch_set":10,"id":"bfb3d3c7_39630d1d","line":368,"updated":"2019-05-20 20:58:29.000000000","message":"So I\u0027m now thinking I went too far on this, updating the DB on error seems excessive, and could lead to unknown failures.  I think it\u0027s going to be better to just always force the incoming and outgoing rule from an API perspective to be \u0027ipv6-icmp\u0027, and the duplicate check to do the same.  And then just document that behavior.","commit_id":"bfe2192b2e770a259b80e57ceadf9bc004181888"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"869036fee7f5dc4a543d4b3125e6d0a38fbb729d","unresolved":false,"context_lines":[{"line_number":465,"context_line":"        protocol \u003d str(protocol)"},{"line_number":466,"context_line":"        # Force all legacy IPv6 ICMP protocol names to be \u0027ipv6-icmp\u0027"},{"line_number":467,"context_line":"        if protocol in const.IPV6_ICMP_LEGACY_PROTO_LIST:"},{"line_number":468,"context_line":"            protocol \u003d constants.PROTO_NAME_IPV6_ICMP"},{"line_number":469,"context_line":"        if protocol in constants.IP_PROTOCOL_MAP:"},{"line_number":470,"context_line":"            return [protocol, str(constants.IP_PROTOCOL_MAP.get(protocol))]"},{"line_number":471,"context_line":"        elif protocol in constants.IP_PROTOCOL_NUM_TO_NAME_MAP:"}],"source_content_type":"text/x-python","patch_set":10,"id":"bfb3d3c7_fc56c306","line":468,"updated":"2019-05-20 20:58:29.000000000","message":"This is wrong and will munge IPv4 rules.","commit_id":"bfe2192b2e770a259b80e57ceadf9bc004181888"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"2910e2205d4f69cabfd4000f4f9776afcfe16898","unresolved":false,"context_lines":[{"line_number":610,"context_line":"        # protocol field will get corresponding name and number"},{"line_number":611,"context_line":"        value \u003d sgr.get(\u0027protocol\u0027)"},{"line_number":612,"context_line":"        if value:"},{"line_number":613,"context_line":"            res[\u0027protocol\u0027] \u003d self._get_ip_proto_name_and_num(value)"},{"line_number":614,"context_line":"        return res"},{"line_number":615,"context_line":""},{"line_number":616,"context_line":"    def _rule_to_key(self, rule):"}],"source_content_type":"text/x-python","patch_set":13,"id":"bfb3d3c7_b511e75f","line":613,"updated":"2019-05-24 15:53:17.000000000","message":"out of scope: looking for \"_get_ip_proto_name_and_num\" uses, seems that \"_make_security_group_rule_filter_dict\" is not used anymore. I\u0027ll propose a patch to remove it.","commit_id":"b114bb0f0834e87310d6a5f24b259dddf1befe93"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"b6ee38ff30c515a70c6ee6289756423380e9551c","unresolved":false,"context_lines":[{"line_number":610,"context_line":"        # protocol field will get corresponding name and number"},{"line_number":611,"context_line":"        value \u003d sgr.get(\u0027protocol\u0027)"},{"line_number":612,"context_line":"        if value:"},{"line_number":613,"context_line":"            res[\u0027protocol\u0027] \u003d self._get_ip_proto_name_and_num(value)"},{"line_number":614,"context_line":"        return res"},{"line_number":615,"context_line":""},{"line_number":616,"context_line":"    def _rule_to_key(self, rule):"}],"source_content_type":"text/x-python","patch_set":13,"id":"bfb3d3c7_a97c321f","line":613,"in_reply_to":"bfb3d3c7_b511e75f","updated":"2019-05-24 19:47:05.000000000","message":"Yeah, guess it should have been removed in Doug\u0027s performance change, follow-on is good, thanks Rodolfo.","commit_id":"b114bb0f0834e87310d6a5f24b259dddf1befe93"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"2910e2205d4f69cabfd4000f4f9776afcfe16898","unresolved":false,"context_lines":[{"line_number":626,"context_line":"                return none_char"},{"line_number":627,"context_line":"            elif key \u003d\u003d \u0027protocol\u0027:"},{"line_number":628,"context_line":"                return str(self._get_ip_proto_name_and_num(value,"},{"line_number":629,"context_line":"                               ethertype\u003drule.get(\u0027ethertype\u0027)))"},{"line_number":630,"context_line":"            return str(value)"},{"line_number":631,"context_line":""},{"line_number":632,"context_line":"        comparison_keys \u003d ["}],"source_content_type":"text/x-python","patch_set":13,"id":"bfb3d3c7_357417fe","line":629,"updated":"2019-05-24 15:53:17.000000000","message":"hmm this indentation is weird (but seems to be valid!)","commit_id":"b114bb0f0834e87310d6a5f24b259dddf1befe93"},{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"0cc20d996516a5c36a070020bd517ef17dccb9e5","unresolved":false,"context_lines":[{"line_number":626,"context_line":"                return none_char"},{"line_number":627,"context_line":"            elif key \u003d\u003d \u0027protocol\u0027:"},{"line_number":628,"context_line":"                return str(self._get_ip_proto_name_and_num(value,"},{"line_number":629,"context_line":"                               ethertype\u003drule.get(\u0027ethertype\u0027)))"},{"line_number":630,"context_line":"            return str(value)"},{"line_number":631,"context_line":""},{"line_number":632,"context_line":"        comparison_keys \u003d ["}],"source_content_type":"text/x-python","patch_set":13,"id":"bfb3d3c7_4df7bf60","line":629,"in_reply_to":"bfb3d3c7_29a8428b","updated":"2019-05-25 01:46:20.000000000","message":"Took a stab at improving the indentation","commit_id":"b114bb0f0834e87310d6a5f24b259dddf1befe93"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"b6ee38ff30c515a70c6ee6289756423380e9551c","unresolved":false,"context_lines":[{"line_number":626,"context_line":"                return none_char"},{"line_number":627,"context_line":"            elif key \u003d\u003d \u0027protocol\u0027:"},{"line_number":628,"context_line":"                return str(self._get_ip_proto_name_and_num(value,"},{"line_number":629,"context_line":"                               ethertype\u003drule.get(\u0027ethertype\u0027)))"},{"line_number":630,"context_line":"            return str(value)"},{"line_number":631,"context_line":""},{"line_number":632,"context_line":"        comparison_keys \u003d ["}],"source_content_type":"text/x-python","patch_set":13,"id":"bfb3d3c7_29a8428b","line":629,"in_reply_to":"bfb3d3c7_357417fe","updated":"2019-05-24 19:47:05.000000000","message":"Yes, I didn\u0027t know the best indentation since it\u0027s an argument for the call, but pep8 liked it :)","commit_id":"b114bb0f0834e87310d6a5f24b259dddf1befe93"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"2883df0d8bbbbc1b388b4267cd60c6d9373e5584","unresolved":false,"context_lines":[{"line_number":451,"context_line":"        protocol \u003d str(protocol)"},{"line_number":452,"context_line":"        # Force all legacy IPv6 ICMP protocol names to be \u0027ipv6-icmp\u0027"},{"line_number":453,"context_line":"        if (ethertype \u003d\u003d constants.IPv6 and"},{"line_number":454,"context_line":"                protocol in const.IPV6_ICMP_LEGACY_PROTO_LIST):"},{"line_number":455,"context_line":"            protocol \u003d constants.PROTO_NAME_IPV6_ICMP"},{"line_number":456,"context_line":"        if protocol in constants.IP_PROTOCOL_MAP:"},{"line_number":457,"context_line":"            return [protocol, str(constants.IP_PROTOCOL_MAP.get(protocol))]"}],"source_content_type":"text/x-python","patch_set":14,"id":"bfb3d3c7_89c90bad","line":454,"updated":"2019-05-28 15:38:07.000000000","message":"sorry for adding it so late but I just though: maybe would be useful to add some \"deprecation\" warning message in logs in such case?\nIt can be done as follow up patch also if You think it\u0027s reasonable.","commit_id":"42074a67259eb4bfe70631d087fa4fc4d509ab51"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"95c8f49a1db6faf7f635ed2bca40ecc5dc555a32","unresolved":false,"context_lines":[{"line_number":451,"context_line":"        protocol \u003d str(protocol)"},{"line_number":452,"context_line":"        # Force all legacy IPv6 ICMP protocol names to be \u0027ipv6-icmp\u0027"},{"line_number":453,"context_line":"        if (ethertype \u003d\u003d constants.IPv6 and"},{"line_number":454,"context_line":"                protocol in const.IPV6_ICMP_LEGACY_PROTO_LIST):"},{"line_number":455,"context_line":"            protocol \u003d constants.PROTO_NAME_IPV6_ICMP"},{"line_number":456,"context_line":"        if protocol in constants.IP_PROTOCOL_MAP:"},{"line_number":457,"context_line":"            return [protocol, str(constants.IP_PROTOCOL_MAP.get(protocol))]"}],"source_content_type":"text/x-python","patch_set":14,"id":"bfb3d3c7_c9906346","line":454,"in_reply_to":"bfb3d3c7_89c90bad","updated":"2019-05-28 15:51:36.000000000","message":"I could add something here as this is most likely when we\u0027ve read an entry out of the DB using the old value as new ones should have been converted.  But only the operator will see it, so maybe LOG.info ?  And I guess we should log the rule ID and the tenant ID.","commit_id":"42074a67259eb4bfe70631d087fa4fc4d509ab51"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"2883df0d8bbbbc1b388b4267cd60c6d9373e5584","unresolved":false,"context_lines":[{"line_number":546,"context_line":""},{"line_number":547,"context_line":"    def _make_canonical_ipv6_icmp_protocol(self, rule):"},{"line_number":548,"context_line":"        if (rule.get(\u0027ethertype\u0027) \u003d\u003d constants.IPv6 and"},{"line_number":549,"context_line":"                rule.get(\u0027protocol\u0027) in const.IPV6_ICMP_LEGACY_PROTO_LIST):"},{"line_number":550,"context_line":"            rule[\u0027protocol\u0027] \u003d constants.PROTO_NAME_IPV6_ICMP"},{"line_number":551,"context_line":""},{"line_number":552,"context_line":"    def _validate_security_group_rule(self, context, security_group_rule):"}],"source_content_type":"text/x-python","patch_set":14,"id":"bfb3d3c7_09bd1b01","line":549,"updated":"2019-05-28 15:38:07.000000000","message":"and same here","commit_id":"42074a67259eb4bfe70631d087fa4fc4d509ab51"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"95c8f49a1db6faf7f635ed2bca40ecc5dc555a32","unresolved":false,"context_lines":[{"line_number":546,"context_line":""},{"line_number":547,"context_line":"    def _make_canonical_ipv6_icmp_protocol(self, rule):"},{"line_number":548,"context_line":"        if (rule.get(\u0027ethertype\u0027) \u003d\u003d constants.IPv6 and"},{"line_number":549,"context_line":"                rule.get(\u0027protocol\u0027) in const.IPV6_ICMP_LEGACY_PROTO_LIST):"},{"line_number":550,"context_line":"            rule[\u0027protocol\u0027] \u003d constants.PROTO_NAME_IPV6_ICMP"},{"line_number":551,"context_line":""},{"line_number":552,"context_line":"    def _validate_security_group_rule(self, context, security_group_rule):"}],"source_content_type":"text/x-python","patch_set":14,"id":"bfb3d3c7_e9e3e7d7","line":549,"in_reply_to":"bfb3d3c7_09bd1b01","updated":"2019-05-28 15:51:36.000000000","message":"In this case, the resultant rule (if created) will have the \u0027ipv6-icmp\u0027 value, so I don\u0027t think we should log anything as it should be correct in the DB.","commit_id":"42074a67259eb4bfe70631d087fa4fc4d509ab51"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"daa0b202faf7f70edf25882786523cc3fddd5e54","unresolved":false,"context_lines":[{"line_number":546,"context_line":""},{"line_number":547,"context_line":"    def _make_canonical_ipv6_icmp_protocol(self, rule):"},{"line_number":548,"context_line":"        if (rule.get(\u0027ethertype\u0027) \u003d\u003d constants.IPv6 and"},{"line_number":549,"context_line":"                rule.get(\u0027protocol\u0027) in const.IPV6_ICMP_LEGACY_PROTO_LIST):"},{"line_number":550,"context_line":"            rule[\u0027protocol\u0027] \u003d constants.PROTO_NAME_IPV6_ICMP"},{"line_number":551,"context_line":""},{"line_number":552,"context_line":"    def _validate_security_group_rule(self, context, security_group_rule):"}],"source_content_type":"text/x-python","patch_set":14,"id":"bfb3d3c7_29a6df54","line":549,"in_reply_to":"bfb3d3c7_e9e3e7d7","updated":"2019-05-28 15:55:42.000000000","message":"I though that here maybe we can warn, inform operator that some user is still using legacy names in API. Maybe he would be able to educate users of his cloud to use proper name instead :)","commit_id":"42074a67259eb4bfe70631d087fa4fc4d509ab51"}],"releasenotes/notes/security-group-ipv6-icmp-221c59dcaf2caa3c.yaml":[{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"0cc20d996516a5c36a070020bd517ef17dccb9e5","unresolved":false,"context_lines":[{"line_number":6,"context_line":"    an API GET call."},{"line_number":7,"context_line":"fixes:"},{"line_number":8,"context_line":"  - |"},{"line_number":9,"context_line":"    Security group rule code as been changed to better detect duplicate"},{"line_number":10,"context_line":"    rules by standardizing on ``ipv6-icmp`` as the protocol field value"},{"line_number":11,"context_line":"    for IPv6 ICMP rules.  The legacy names ``icmpv6`` and ``icmp`` can still"},{"line_number":12,"context_line":"    be used in API POST calls, but API GET calls will return ``ipv6-icmp``."}],"source_content_type":"text/x-yaml","patch_set":13,"id":"bfb3d3c7_addc3be4","line":9,"range":{"start_line":9,"start_character":29,"end_line":9,"end_character":31},"updated":"2019-05-25 01:46:20.000000000","message":"has","commit_id":"b114bb0f0834e87310d6a5f24b259dddf1befe93"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"c569f8a31291851acb07b6bf9bab528aa49c0189","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Existing IPv6 ICMP security group rules created by using legacy protocol"},{"line_number":5,"context_line":"    names ``icmpv6`` and ``icmp`` will now be returned as ``ipv6-icmp`` in"},{"line_number":6,"context_line":"    an API GET call."},{"line_number":7,"context_line":"fixes:"},{"line_number":8,"context_line":"  - |"},{"line_number":9,"context_line":"    Security group rule code has been changed to better detect duplicate"}],"source_content_type":"text/x-yaml","patch_set":14,"id":"bfb3d3c7_7e16e7f3","line":6,"updated":"2019-05-25 18:07:19.000000000","message":"What if someone now have in DB rules created with \"ipv6-icmp\" and \"icmpv6\" in security group? Should one of them be now removed maybe or we will keep such duplicate groups until user will remove them? If we will keep them, it will result with duplicate (same) rules on list now, right?\n\nMaybe we should consider DB upgrade script which would update/remove such rules with legacy protocols?","commit_id":"42074a67259eb4bfe70631d087fa4fc4d509ab51"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"213a564f6510b4c244ded68eec711cfa1fcec092","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Existing IPv6 ICMP security group rules created by using legacy protocol"},{"line_number":5,"context_line":"    names ``icmpv6`` and ``icmp`` will now be returned as ``ipv6-icmp`` in"},{"line_number":6,"context_line":"    an API GET call."},{"line_number":7,"context_line":"fixes:"},{"line_number":8,"context_line":"  - |"},{"line_number":9,"context_line":"    Security group rule code has been changed to better detect duplicate"}],"source_content_type":"text/x-yaml","patch_set":14,"id":"bfb3d3c7_a6b43cd2","line":6,"in_reply_to":"bfb3d3c7_7e16e7f3","updated":"2019-05-28 15:11:42.000000000","message":"Yes, they will have both rules if they already existed, and they will look like duplicates in a rule list, just the ID will be different.  I don\u0027t think that causes a problem in the SG code though.\n\nIn earlier patch sets, I tried to do some DB upgrade steps, but it was failing miserably, so it might be possible, but I did get worried about the case where we somehow failed an upgrade.\n\nIn a more recent patch set I did have it detect the duplicate and actually change the protocol name in the DB, but I changed it to just always return \u0027ipv6-icmp\u0027, since I was also worried about that case triggering an exception.","commit_id":"42074a67259eb4bfe70631d087fa4fc4d509ab51"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"2883df0d8bbbbc1b388b4267cd60c6d9373e5584","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Existing IPv6 ICMP security group rules created by using legacy protocol"},{"line_number":5,"context_line":"    names ``icmpv6`` and ``icmp`` will now be returned as ``ipv6-icmp`` in"},{"line_number":6,"context_line":"    an API GET call."},{"line_number":7,"context_line":"fixes:"},{"line_number":8,"context_line":"  - |"},{"line_number":9,"context_line":"    Security group rule code has been changed to better detect duplicate"}],"source_content_type":"text/x-yaml","patch_set":14,"id":"bfb3d3c7_494c7341","line":6,"in_reply_to":"bfb3d3c7_a6b43cd2","updated":"2019-05-28 15:38:07.000000000","message":"ok, lets go with this like it\u0027s now :)","commit_id":"42074a67259eb4bfe70631d087fa4fc4d509ab51"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"c569f8a31291851acb07b6bf9bab528aa49c0189","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    Security group rule code has been changed to better detect duplicate"},{"line_number":10,"context_line":"    rules by standardizing on ``ipv6-icmp`` as the protocol field value"},{"line_number":11,"context_line":"    for IPv6 ICMP rules.  The legacy names ``icmpv6`` and ``icmp`` can still"},{"line_number":12,"context_line":"    be used in API POST calls, but API GET calls will return ``ipv6-icmp``."},{"line_number":13,"context_line":"    Partial fix for bug"},{"line_number":14,"context_line":"    `1582500 \u003chttps://bugs.launchpad.net/neutron/+bug/1582500\u003e`_."}],"source_content_type":"text/x-yaml","patch_set":14,"id":"bfb3d3c7_1ed56b1c","line":12,"updated":"2019-05-25 18:07:19.000000000","message":"will it raise \"duplicate rule\" exception now if I will try to create rule with \"ipv6-icmp\" and \"icmpv6\"?","commit_id":"42074a67259eb4bfe70631d087fa4fc4d509ab51"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"213a564f6510b4c244ded68eec711cfa1fcec092","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    Security group rule code has been changed to better detect duplicate"},{"line_number":10,"context_line":"    rules by standardizing on ``ipv6-icmp`` as the protocol field value"},{"line_number":11,"context_line":"    for IPv6 ICMP rules.  The legacy names ``icmpv6`` and ``icmp`` can still"},{"line_number":12,"context_line":"    be used in API POST calls, but API GET calls will return ``ipv6-icmp``."},{"line_number":13,"context_line":"    Partial fix for bug"},{"line_number":14,"context_line":"    `1582500 \u003chttps://bugs.launchpad.net/neutron/+bug/1582500\u003e`_."}],"source_content_type":"text/x-yaml","patch_set":14,"id":"bfb3d3c7_66cac44e","line":12,"in_reply_to":"bfb3d3c7_1ed56b1c","updated":"2019-05-28 15:11:42.000000000","message":"Yes, and also \u0027icmp\u0027, I didn\u0027t remove this old legacy API support since someone could be assuming it, but rules created using the legacy names will now always be stored as \u0027ipv6-icmp\u0027.","commit_id":"42074a67259eb4bfe70631d087fa4fc4d509ab51"}]}