)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"406f1d3d62b1403d4b2075b62f0a4933ee3c40c0","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Only neutron routers should be sending RAs, and with"},{"line_number":10,"context_line":"the iptables firewall these are dropped, but there"},{"line_number":11,"context_line":"was no corresponding rule for the OVS firewall."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: I045c652ad8cbecf5ed8e98934306476ed7170e90"},{"line_number":14,"context_line":"Closes-bug: #1685237"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f044301_ce2da547","line":11,"updated":"2017-05-04 08:24:09.000000000","message":"I don\u0027t understand what is it trying to fix? Does it mean that firewall_driver \u003d openvswitch doesn\u0027t implement protection agains instances sending RAs? If so, then the fix must go to somewhere here https://github.com/openstack/neutron/blob/master/neutron/agent/linux/openvswitch_firewall/firewall.py#L568 to drop the ICMP RA type.","commit_id":"5d16016c9122635ca23394c830a9b2c9de1e317f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e0df5af4a8cd62e3004e4c0994b0db942ce696da","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Only neutron routers should be sending RAs, and with"},{"line_number":10,"context_line":"the iptables firewall these are dropped, but there"},{"line_number":11,"context_line":"was no corresponding rule for the OVS firewall."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: I045c652ad8cbecf5ed8e98934306476ed7170e90"},{"line_number":14,"context_line":"Closes-bug: #1685237"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f044301_8eaafd82","line":11,"in_reply_to":"3f044301_4ee63519","updated":"2017-05-04 08:27:03.000000000","message":"Or maybe we should create a 2 lists: allowed for ingress and allowed for egress :)","commit_id":"5d16016c9122635ca23394c830a9b2c9de1e317f"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"49ccfcef3b76cb375548e716f2b244854124008f","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Only neutron routers should be sending RAs, and with"},{"line_number":10,"context_line":"the iptables firewall these are dropped, but there"},{"line_number":11,"context_line":"was no corresponding rule for the OVS firewall."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: I045c652ad8cbecf5ed8e98934306476ed7170e90"},{"line_number":14,"context_line":"Closes-bug: #1685237"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f044301_df75429a","line":11,"in_reply_to":"3f044301_8eaafd82","updated":"2017-05-04 14:51:47.000000000","message":"Yes, this is to prevent an instance from sending an RA.  The iptables code sets this up when it does anti-spoofing, so it seemed the logical place to do in in OVS.  And grep pointed in this direction :)\n\nICMPV6_ALLOWED_TYPES is supposed to be for ingress, but the link you supplied showed it\u0027s being applied to egress.  Maybe that is the issue?","commit_id":"5d16016c9122635ca23394c830a9b2c9de1e317f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"56ab1217a80dfa728f7c946dcc275796921b8506","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Only neutron routers should be sending RAs, and with"},{"line_number":10,"context_line":"the iptables firewall these are dropped, but there"},{"line_number":11,"context_line":"was no corresponding rule for the OVS firewall."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: I045c652ad8cbecf5ed8e98934306476ed7170e90"},{"line_number":14,"context_line":"Closes-bug: #1685237"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f044301_4ee63519","line":11,"in_reply_to":"3f044301_ce2da547","updated":"2017-05-04 08:25:18.000000000","message":"Or just remove it from the ALLOWED_TYPES: https://github.com/openstack/neutron/blob/master/neutron/agent/firewall.py#L37","commit_id":"5d16016c9122635ca23394c830a9b2c9de1e317f"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"1d493dce51ea49a7874b8c656c26315aa28ff4ac","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Only neutron routers should be sending RAs, and with"},{"line_number":10,"context_line":"the iptables firewall these are dropped, but there"},{"line_number":11,"context_line":"was no corresponding rule for the OVS firewall."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: I045c652ad8cbecf5ed8e98934306476ed7170e90"},{"line_number":14,"context_line":"Closes-bug: #1685237"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f044301_ffe0fe98","line":11,"in_reply_to":"3f044301_df75429a","updated":"2017-05-04 15:10:39.000000000","message":"Yes, egress should probably allow only NDP. The main point is that ovs firewall has its own module, those flows for things like arp spooging etc. in ovs_agent are for hybrid firewall.","commit_id":"5d16016c9122635ca23394c830a9b2c9de1e317f"}],"neutron/agent/firewall.py":[{"author":{"_account_id":7787,"name":"Kevin Benton","email":"kevin@benton.pub","username":"blak111"},"change_message_id":"d933117345a521b3a0e705e6c275b813e0010441","unresolved":false,"context_lines":[{"line_number":36,"context_line":"ICMPV6_ALLOWED_INGRESS_TYPES \u003d [n_const.ICMPV6_TYPE_MLD_QUERY,"},{"line_number":37,"context_line":"                                n_const.ICMPV6_TYPE_RA,"},{"line_number":38,"context_line":"                                n_const.ICMPV6_TYPE_NS,"},{"line_number":39,"context_line":"                                n_const.ICMPV6_TYPE_NA]"},{"line_number":40,"context_line":"# for backwards-compatibility"},{"line_number":41,"context_line":"ICMPV6_ALLOWED_TYPES \u003d ICMPV6_ALLOWED_INGRESS_TYPES"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"ff0f0b1f_8decf1f3","line":39,"updated":"2017-05-20 01:29:00.000000000","message":"Agree, can we split this into two small patches (renames + OVS change).","commit_id":"98b8e387ead58d796d2290c3006304a7b5cd4e58"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"e8e8b2f8e35bc64ad549f87a061101fb7571386b","unresolved":false,"context_lines":[{"line_number":36,"context_line":"ICMPV6_ALLOWED_INGRESS_TYPES \u003d [n_const.ICMPV6_TYPE_MLD_QUERY,"},{"line_number":37,"context_line":"                                n_const.ICMPV6_TYPE_RA,"},{"line_number":38,"context_line":"                                n_const.ICMPV6_TYPE_NS,"},{"line_number":39,"context_line":"                                n_const.ICMPV6_TYPE_NA]"},{"line_number":40,"context_line":"# for backwards-compatibility"},{"line_number":41,"context_line":"ICMPV6_ALLOWED_TYPES \u003d ICMPV6_ALLOWED_INGRESS_TYPES"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"ff0f0b1f_cc98c81c","line":39,"updated":"2017-05-19 08:40:09.000000000","message":"I don\u0027t know if this change should be done in this patch.\n\nNow you have splitted ingress and egress (nice work!), maybe you can add ICMPv6 Redirect [1][2] to ICMPV6_ALLOWED_INGRESS_TYPES.\n\nBTW, it\u0027s not in neutron_lib/constants yet.\n\n[1] https://tools.ietf.org/html/rfc4861, pages 10 and 11\n[2] http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/22974-icmpv6codes.html","commit_id":"98b8e387ead58d796d2290c3006304a7b5cd4e58"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"971dc4b062f13a6e535b2d393fcb43a36bce63c1","unresolved":false,"context_lines":[{"line_number":36,"context_line":"ICMPV6_ALLOWED_INGRESS_TYPES \u003d [n_const.ICMPV6_TYPE_MLD_QUERY,"},{"line_number":37,"context_line":"                                n_const.ICMPV6_TYPE_RA,"},{"line_number":38,"context_line":"                                n_const.ICMPV6_TYPE_NS,"},{"line_number":39,"context_line":"                                n_const.ICMPV6_TYPE_NA]"},{"line_number":40,"context_line":"# for backwards-compatibility"},{"line_number":41,"context_line":"ICMPV6_ALLOWED_TYPES \u003d ICMPV6_ALLOWED_INGRESS_TYPES"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"ff0f0b1f_27a392b4","line":39,"in_reply_to":"ff0f0b1f_8decf1f3","updated":"2017-05-22 21:35:51.000000000","message":"I can split it up.","commit_id":"98b8e387ead58d796d2290c3006304a7b5cd4e58"}],"neutron/agent/linux/openvswitch_firewall/firewall.py":[{"author":{"_account_id":17120,"name":"Manjeet Singh Bhatia","email":"manjeet.s.bhatia@intel.com","username":"manjeets"},"change_message_id":"cd789825ab570fbf53edfe5fcc3a2c25495fcd7f","unresolved":false,"context_lines":[{"line_number":659,"context_line":"                actions\u003d\u0027drop\u0027"},{"line_number":660,"context_line":"            )"},{"line_number":661,"context_line":""},{"line_number":662,"context_line":"        # Drop Router Advertisements from instances"},{"line_number":663,"context_line":"        self._add_flow("},{"line_number":664,"context_line":"            table\u003dovs_consts.BASE_EGRESS_TABLE,"},{"line_number":665,"context_line":"            priority\u003d70,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f044301_2384105e","line":662,"range":{"start_line":662,"start_character":10,"end_line":662,"end_character":21},"updated":"2017-05-04 16:18:32.000000000","message":"Drop Ipv6 ?","commit_id":"52570e2d9eac85fbe8359fc24dd3f4852bae5919"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"706701ebbca5f0fadbce7071a851a8f3020f0ed9","unresolved":false,"context_lines":[{"line_number":659,"context_line":"                actions\u003d\u0027drop\u0027"},{"line_number":660,"context_line":"            )"},{"line_number":661,"context_line":""},{"line_number":662,"context_line":"        # Drop Router Advertisements from instances"},{"line_number":663,"context_line":"        self._add_flow("},{"line_number":664,"context_line":"            table\u003dovs_consts.BASE_EGRESS_TABLE,"},{"line_number":665,"context_line":"            priority\u003d70,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f044301_4673aa16","line":662,"range":{"start_line":662,"start_character":10,"end_line":662,"end_character":21},"in_reply_to":"3f044301_2384105e","updated":"2017-05-04 16:54:15.000000000","message":"I think the fact that it\u0027s RA, it contains the information about it being IPv6","commit_id":"52570e2d9eac85fbe8359fc24dd3f4852bae5919"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"706701ebbca5f0fadbce7071a851a8f3020f0ed9","unresolved":false,"context_lines":[{"line_number":668,"context_line":"            dl_type\u003dconstants.ETHERTYPE_IPV6,"},{"line_number":669,"context_line":"            nw_proto\u003dlib_const.PROTO_NUM_IPV6_ICMP,"},{"line_number":670,"context_line":"            icmp_type\u003dlib_const.ICMPV6_TYPE_RA,"},{"line_number":671,"context_line":"            tp_src\u003dsrc_port,"},{"line_number":672,"context_line":"            tp_dst\u003ddst_port,"},{"line_number":673,"context_line":"            actions\u003d\u0027drop\u0027"},{"line_number":674,"context_line":"        )"},{"line_number":675,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"3f044301_46e16a9a","line":672,"range":{"start_line":671,"start_character":0,"end_line":672,"end_character":28},"updated":"2017-05-04 16:54:15.000000000","message":"I quickly looked at rfc4861 and I don\u0027t see that RA would use those ports. I always though they are for state* DHCP.","commit_id":"52570e2d9eac85fbe8359fc24dd3f4852bae5919"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"0dac8860ba48ee0d3f2e4c21ddf0c53a8e43109f","unresolved":false,"context_lines":[{"line_number":575,"context_line":"            dl_type\u003dconstants.ETHERTYPE_IPV6,"},{"line_number":576,"context_line":"            nw_proto\u003dlib_const.PROTO_NUM_IPV6_ICMP,"},{"line_number":577,"context_line":"            actions\u003d\u0027normal\u0027"},{"line_number":578,"context_line":"        )"},{"line_number":579,"context_line":""},{"line_number":580,"context_line":"    def _initialize_egress(self, port):"},{"line_number":581,"context_line":"        \"\"\"Identify egress traffic and send it to egress base\"\"\""}],"source_content_type":"text/x-python","patch_set":3,"id":"3f044301_4fb5fd30","line":578,"updated":"2017-05-04 17:53:20.000000000","message":"I don\u0027t think we actually need this at all, and it\u0027s breaking the functional tests.","commit_id":"f5a2447f29c3c29452e2ab59cb0045f5686a468a"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"56f5a6d2baff836f36da78c01a7aeafdaf8d83ea","unresolved":false,"context_lines":[{"line_number":566,"context_line":"        self._initialize_ingress(port)"},{"line_number":567,"context_line":""},{"line_number":568,"context_line":"    def _initialize_egress_ipv6_icmp(self, port):"},{"line_number":569,"context_line":"        for icmp_type in firewall.ICMPV6_ALLOWED_EGRESS_TYPES:"},{"line_number":570,"context_line":"            self._add_flow("},{"line_number":571,"context_line":"                table\u003dovs_consts.BASE_EGRESS_TABLE,"},{"line_number":572,"context_line":"                priority\u003d95,"}],"source_content_type":"text/x-python","patch_set":5,"id":"3f044301_6a9f8450","line":569,"updated":"2017-05-04 20:12:25.000000000","message":"Jakub - why do we even have to specify egress ICMPv6 types?  I would have thought anything can be sent unless explicitly denied below.  At least I\u0027m assuming this will fix the test failures.","commit_id":"98b8e387ead58d796d2290c3006304a7b5cd4e58"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"34007ddbe199d723e49eb20a40d83fbf97dec31a","unresolved":false,"context_lines":[{"line_number":566,"context_line":"        self._initialize_ingress(port)"},{"line_number":567,"context_line":""},{"line_number":568,"context_line":"    def _initialize_egress_ipv6_icmp(self, port):"},{"line_number":569,"context_line":"        for icmp_type in firewall.ICMPV6_ALLOWED_EGRESS_TYPES:"},{"line_number":570,"context_line":"            self._add_flow("},{"line_number":571,"context_line":"                table\u003dovs_consts.BASE_EGRESS_TABLE,"},{"line_number":572,"context_line":"                priority\u003d95,"}],"source_content_type":"text/x-python","patch_set":5,"id":"3f044301_81e3ca33","line":569,"in_reply_to":"3f044301_6a9f8450","updated":"2017-05-05 07:17:50.000000000","message":"I think egress traffic in dropped by default unless explicitly allowed in the driver. The fact that neutron creates default security group allowing all egress traffic is actually an explicit rule for the firewall. That means, if you have a port with port security enabled associated with no security group then it won\u0027t be able to use NDP or slaac.","commit_id":"98b8e387ead58d796d2290c3006304a7b5cd4e58"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"92a0f15d0aeb21c1f6e603ac33c44a5f39dc55ce","unresolved":false,"context_lines":[{"line_number":660,"context_line":"                actions\u003d\u0027drop\u0027"},{"line_number":661,"context_line":"            )"},{"line_number":662,"context_line":""},{"line_number":663,"context_line":"        # Drop Router Advertisements from instances"},{"line_number":664,"context_line":"        self._add_flow("},{"line_number":665,"context_line":"            table\u003dovs_consts.BASE_EGRESS_TABLE,"},{"line_number":666,"context_line":"            priority\u003d70,"}],"source_content_type":"text/x-python","patch_set":5,"id":"1f013ff3_29a2c49b","line":663,"updated":"2017-05-14 23:22:26.000000000","message":"Is it needed now since we don\u0027t allow RA on L569?","commit_id":"98b8e387ead58d796d2290c3006304a7b5cd4e58"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"ecfb2367de48948b5d1903f701a32133f0895c62","unresolved":false,"context_lines":[{"line_number":660,"context_line":"                actions\u003d\u0027drop\u0027"},{"line_number":661,"context_line":"            )"},{"line_number":662,"context_line":""},{"line_number":663,"context_line":"        # Drop Router Advertisements from instances"},{"line_number":664,"context_line":"        self._add_flow("},{"line_number":665,"context_line":"            table\u003dovs_consts.BASE_EGRESS_TABLE,"},{"line_number":666,"context_line":"            priority\u003d70,"}],"source_content_type":"text/x-python","patch_set":5,"id":"1f013ff3_0e67f74f","line":663,"in_reply_to":"1f013ff3_29a2c49b","updated":"2017-05-15 16:34:29.000000000","message":"True, I guess it shouldn\u0027t be required, but I think it\u0027s good to make it obvious like L648 does for DHCP.","commit_id":"98b8e387ead58d796d2290c3006304a7b5cd4e58"}]}