)]}'
{"doc/source/contributor/internals/openvswitch_firewall.rst":[{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"9cf2844cd1273d026ee076a278f5e1c7873df8ba","unresolved":false,"context_lines":[{"line_number":359,"context_line":" table\u003d82, priority\u003d71,ct_state\u003d+est-rel-rpl,icmp,reg5\u003d0x2 actions\u003dconjunction(18,2/2)"},{"line_number":360,"context_line":" table\u003d82, priority\u003d71,ct_state\u003d+new-est,icmp,reg5\u003d0x2 actions\u003dconjunction(19,2/2)"},{"line_number":361,"context_line":" table\u003d82, priority\u003d71,conj_id\u003d18,ct_state\u003d+est-rel-rpl,ip,reg5\u003d0x2 actions\u003dstrip_vlan,output:2,resubmit(,92)"},{"line_number":362,"context_line":" table\u003d82, priority\u003d71,conj_id\u003d19,ct_state\u003d+new-est,ip,reg5\u003d0x2 actions\u003dct(commit,zone\u003dNXM_NX_REG6[0..15]),strip_vlan,output:2,resubmit(,92)"},{"line_number":363,"context_line":" table\u003d82, priority\u003d50,ct_state\u003d+inv+trk actions\u003dresubmit(,93)"},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"There are some more security group rules with remote group IDs. Next"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_d6b26649","line":362,"range":{"start_line":362,"start_character":0,"end_line":362,"end_character":140},"updated":"2017-12-08 03:40:01.000000000","message":"I thinks there is missing this flow in reference implementation. :)","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"43747499d74519ea9118b7a468bdd88584c03587","unresolved":false,"context_lines":[{"line_number":359,"context_line":" table\u003d82, priority\u003d71,ct_state\u003d+est-rel-rpl,icmp,reg5\u003d0x2 actions\u003dconjunction(18,2/2)"},{"line_number":360,"context_line":" table\u003d82, priority\u003d71,ct_state\u003d+new-est,icmp,reg5\u003d0x2 actions\u003dconjunction(19,2/2)"},{"line_number":361,"context_line":" table\u003d82, priority\u003d71,conj_id\u003d18,ct_state\u003d+est-rel-rpl,ip,reg5\u003d0x2 actions\u003dstrip_vlan,output:2,resubmit(,92)"},{"line_number":362,"context_line":" table\u003d82, priority\u003d71,conj_id\u003d19,ct_state\u003d+new-est,ip,reg5\u003d0x2 actions\u003dct(commit,zone\u003dNXM_NX_REG6[0..15]),strip_vlan,output:2,resubmit(,92)"},{"line_number":363,"context_line":" table\u003d82, priority\u003d50,ct_state\u003d+inv+trk actions\u003dresubmit(,93)"},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"There are some more security group rules with remote group IDs. Next"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_166a09ec","line":362,"range":{"start_line":362,"start_character":0,"end_line":362,"end_character":140},"in_reply_to":"df87a7cf_5638919e","updated":"2017-12-08 09:26:44.000000000","message":"I mean that conj_id will be stored at a register(reg7) and before being sent to custom tables. Then we can use conj_id as a matching field in logging flow [1]. So I also would like to make ConjIdMap as a singleton class. Therefore logging code can obtain conj_id to generate a logging flow.\n\n[1] https://review.openstack.org/#/c/468281/44/neutron/services/logapi/drivers/openvswitch/ovs_firewall_log.py@380","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"a4ae96c224e3d93fa116abd9c82df33832dafb2c","unresolved":false,"context_lines":[{"line_number":359,"context_line":" table\u003d82, priority\u003d71,ct_state\u003d+est-rel-rpl,icmp,reg5\u003d0x2 actions\u003dconjunction(18,2/2)"},{"line_number":360,"context_line":" table\u003d82, priority\u003d71,ct_state\u003d+new-est,icmp,reg5\u003d0x2 actions\u003dconjunction(19,2/2)"},{"line_number":361,"context_line":" table\u003d82, priority\u003d71,conj_id\u003d18,ct_state\u003d+est-rel-rpl,ip,reg5\u003d0x2 actions\u003dstrip_vlan,output:2,resubmit(,92)"},{"line_number":362,"context_line":" table\u003d82, priority\u003d71,conj_id\u003d19,ct_state\u003d+new-est,ip,reg5\u003d0x2 actions\u003dct(commit,zone\u003dNXM_NX_REG6[0..15]),strip_vlan,output:2,resubmit(,92)"},{"line_number":363,"context_line":" table\u003d82, priority\u003d50,ct_state\u003d+inv+trk actions\u003dresubmit(,93)"},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"There are some more security group rules with remote group IDs. Next"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_e12fa285","line":362,"range":{"start_line":362,"start_character":0,"end_line":362,"end_character":140},"in_reply_to":"df87a7cf_d6b26649","updated":"2017-12-08 04:33:07.000000000","message":"Can we pass conj_id\u0027s information to custom tables (ACCEPTED_EGRESS_TRAFFIC_TABLE or ACCEPTED_INGRESS_TRAFFIC_TABLE)?\nIt would be great for logging, because logging need to distinguish remote rules and normal rules. Take a example: We have 3 SGA (protocol\u003dicmp), SGB(protocol\u003dicmp, remote_group_id\u003ddefault), port_a is attached to both SGA and SGB. Assuming, there is a logging object for SGB, a logging object for SGA. Therefore  we need conj_id to do that. Do you think so?  And do you have any suggestion for me? :)","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"d9f5ee6be03d6f45c927f80ff2b540483c8a0dc4","unresolved":false,"context_lines":[{"line_number":359,"context_line":" table\u003d82, priority\u003d71,ct_state\u003d+est-rel-rpl,icmp,reg5\u003d0x2 actions\u003dconjunction(18,2/2)"},{"line_number":360,"context_line":" table\u003d82, priority\u003d71,ct_state\u003d+new-est,icmp,reg5\u003d0x2 actions\u003dconjunction(19,2/2)"},{"line_number":361,"context_line":" table\u003d82, priority\u003d71,conj_id\u003d18,ct_state\u003d+est-rel-rpl,ip,reg5\u003d0x2 actions\u003dstrip_vlan,output:2,resubmit(,92)"},{"line_number":362,"context_line":" table\u003d82, priority\u003d71,conj_id\u003d19,ct_state\u003d+new-est,ip,reg5\u003d0x2 actions\u003dct(commit,zone\u003dNXM_NX_REG6[0..15]),strip_vlan,output:2,resubmit(,92)"},{"line_number":363,"context_line":" table\u003d82, priority\u003d50,ct_state\u003d+inv+trk actions\u003dresubmit(,93)"},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"There are some more security group rules with remote group IDs. Next"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_769b5517","line":362,"range":{"start_line":362,"start_character":0,"end_line":362,"end_character":140},"in_reply_to":"df87a7cf_d6b26649","updated":"2017-12-08 09:23:33.000000000","message":"Done","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a57f9586ec08999e7425da707043c1836fadac69","unresolved":false,"context_lines":[{"line_number":359,"context_line":" table\u003d82, priority\u003d71,ct_state\u003d+est-rel-rpl,icmp,reg5\u003d0x2 actions\u003dconjunction(18,2/2)"},{"line_number":360,"context_line":" table\u003d82, priority\u003d71,ct_state\u003d+new-est,icmp,reg5\u003d0x2 actions\u003dconjunction(19,2/2)"},{"line_number":361,"context_line":" table\u003d82, priority\u003d71,conj_id\u003d18,ct_state\u003d+est-rel-rpl,ip,reg5\u003d0x2 actions\u003dstrip_vlan,output:2,resubmit(,92)"},{"line_number":362,"context_line":" table\u003d82, priority\u003d71,conj_id\u003d19,ct_state\u003d+new-est,ip,reg5\u003d0x2 actions\u003dct(commit,zone\u003dNXM_NX_REG6[0..15]),strip_vlan,output:2,resubmit(,92)"},{"line_number":363,"context_line":" table\u003d82, priority\u003d50,ct_state\u003d+inv+trk actions\u003dresubmit(,93)"},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"There are some more security group rules with remote group IDs. Next"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_5638919e","line":362,"range":{"start_line":362,"start_character":0,"end_line":362,"end_character":140},"in_reply_to":"df87a7cf_e12fa285","updated":"2017-12-08 09:02:31.000000000","message":"Can you re-use the ConjIdMap in the code to obtain conj_id? I don\u0027t understand where on a packet you want to store it? Or you mean some  registry before it gets to logging part?","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"28484b2f91eaf1a9a1d54f56e50db960ed4d9745","unresolved":false,"context_lines":[{"line_number":447,"context_line":"Using OpenFlow in conjunction with OVS firewall"},{"line_number":448,"context_line":"-----------------------------------------------"},{"line_number":449,"context_line":""},{"line_number":450,"context_line":"There are three tables where packets are sent once they get through OVS"},{"line_number":451,"context_line":"firewall pipeline. The tables can be used by other mechanisms using OpenFlow"},{"line_number":452,"context_line":"that are supposed to work with OVS firewall. ``table 91`` contains all packets"},{"line_number":453,"context_line":"that are considered accepted by egress pipeline and won\u0027t be processed further."}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_d07a6eb8","line":450,"range":{"start_line":450,"start_character":68,"end_line":450,"end_character":71},"updated":"2017-12-08 02:11:55.000000000","message":"s/the OVS","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a57f9586ec08999e7425da707043c1836fadac69","unresolved":false,"context_lines":[{"line_number":447,"context_line":"Using OpenFlow in conjunction with OVS firewall"},{"line_number":448,"context_line":"-----------------------------------------------"},{"line_number":449,"context_line":""},{"line_number":450,"context_line":"There are three tables where packets are sent once they get through OVS"},{"line_number":451,"context_line":"firewall pipeline. The tables can be used by other mechanisms using OpenFlow"},{"line_number":452,"context_line":"that are supposed to work with OVS firewall. ``table 91`` contains all packets"},{"line_number":453,"context_line":"that are considered accepted by egress pipeline and won\u0027t be processed further."}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_763d958d","line":450,"range":{"start_line":450,"start_character":68,"end_line":450,"end_character":71},"in_reply_to":"df87a7cf_d07a6eb8","updated":"2017-12-08 09:02:31.000000000","message":"Done","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"28484b2f91eaf1a9a1d54f56e50db960ed4d9745","unresolved":false,"context_lines":[{"line_number":449,"context_line":""},{"line_number":450,"context_line":"There are three tables where packets are sent once they get through OVS"},{"line_number":451,"context_line":"firewall pipeline. The tables can be used by other mechanisms using OpenFlow"},{"line_number":452,"context_line":"that are supposed to work with OVS firewall. ``table 91`` contains all packets"},{"line_number":453,"context_line":"that are considered accepted by egress pipeline and won\u0027t be processed further."},{"line_number":454,"context_line":"``NORMAL`` action is used by default in this table. ``table 92`` contains all"},{"line_number":455,"context_line":"packets that were processed by ingress filtering pipeline. As packets from"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_704da298","line":452,"range":{"start_line":452,"start_character":31,"end_line":452,"end_character":33},"updated":"2017-12-08 02:11:55.000000000","message":"s/the OVS","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a57f9586ec08999e7425da707043c1836fadac69","unresolved":false,"context_lines":[{"line_number":449,"context_line":""},{"line_number":450,"context_line":"There are three tables where packets are sent once they get through OVS"},{"line_number":451,"context_line":"firewall pipeline. The tables can be used by other mechanisms using OpenFlow"},{"line_number":452,"context_line":"that are supposed to work with OVS firewall. ``table 91`` contains all packets"},{"line_number":453,"context_line":"that are considered accepted by egress pipeline and won\u0027t be processed further."},{"line_number":454,"context_line":"``NORMAL`` action is used by default in this table. ``table 92`` contains all"},{"line_number":455,"context_line":"packets that were processed by ingress filtering pipeline. As packets from"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_36438d15","line":452,"range":{"start_line":452,"start_character":31,"end_line":452,"end_character":33},"in_reply_to":"df87a7cf_704da298","updated":"2017-12-08 09:02:31.000000000","message":"Done","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"28484b2f91eaf1a9a1d54f56e50db960ed4d9745","unresolved":false,"context_lines":[{"line_number":450,"context_line":"There are three tables where packets are sent once they get through OVS"},{"line_number":451,"context_line":"firewall pipeline. The tables can be used by other mechanisms using OpenFlow"},{"line_number":452,"context_line":"that are supposed to work with OVS firewall. ``table 91`` contains all packets"},{"line_number":453,"context_line":"that are considered accepted by egress pipeline and won\u0027t be processed further."},{"line_number":454,"context_line":"``NORMAL`` action is used by default in this table. ``table 92`` contains all"},{"line_number":455,"context_line":"packets that were processed by ingress filtering pipeline. As packets from"},{"line_number":456,"context_line":"ingress filtering pipeline were injected to its destination, ``table 92``"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_9052a63a","line":453,"range":{"start_line":453,"start_character":32,"end_line":453,"end_character":38},"updated":"2017-12-08 02:11:55.000000000","message":"s/the egress","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a57f9586ec08999e7425da707043c1836fadac69","unresolved":false,"context_lines":[{"line_number":450,"context_line":"There are three tables where packets are sent once they get through OVS"},{"line_number":451,"context_line":"firewall pipeline. The tables can be used by other mechanisms using OpenFlow"},{"line_number":452,"context_line":"that are supposed to work with OVS firewall. ``table 91`` contains all packets"},{"line_number":453,"context_line":"that are considered accepted by egress pipeline and won\u0027t be processed further."},{"line_number":454,"context_line":"``NORMAL`` action is used by default in this table. ``table 92`` contains all"},{"line_number":455,"context_line":"packets that were processed by ingress filtering pipeline. As packets from"},{"line_number":456,"context_line":"ingress filtering pipeline were injected to its destination, ``table 92``"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_7666f5c3","line":453,"range":{"start_line":453,"start_character":32,"end_line":453,"end_character":38},"in_reply_to":"df87a7cf_9052a63a","updated":"2017-12-08 09:02:31.000000000","message":"Done","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"28484b2f91eaf1a9a1d54f56e50db960ed4d9745","unresolved":false,"context_lines":[{"line_number":453,"context_line":"that are considered accepted by egress pipeline and won\u0027t be processed further."},{"line_number":454,"context_line":"``NORMAL`` action is used by default in this table. ``table 92`` contains all"},{"line_number":455,"context_line":"packets that were processed by ingress filtering pipeline. As packets from"},{"line_number":456,"context_line":"ingress filtering pipeline were injected to its destination, ``table 92``"},{"line_number":457,"context_line":"contains copies of those packets. Finally, ``table 93`` contains all packets"},{"line_number":458,"context_line":"that were filtered by firewall and should be dropped. Default action is"},{"line_number":459,"context_line":"``drop`` in this table."}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_f060d203","line":456,"updated":"2017-12-08 02:11:55.000000000","message":"You don\u0027t specify the default action for table 92 here.","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a57f9586ec08999e7425da707043c1836fadac69","unresolved":false,"context_lines":[{"line_number":453,"context_line":"that are considered accepted by egress pipeline and won\u0027t be processed further."},{"line_number":454,"context_line":"``NORMAL`` action is used by default in this table. ``table 92`` contains all"},{"line_number":455,"context_line":"packets that were processed by ingress filtering pipeline. As packets from"},{"line_number":456,"context_line":"ingress filtering pipeline were injected to its destination, ``table 92``"},{"line_number":457,"context_line":"contains copies of those packets. Finally, ``table 93`` contains all packets"},{"line_number":458,"context_line":"that were filtered by firewall and should be dropped. Default action is"},{"line_number":459,"context_line":"``drop`` in this table."}],"source_content_type":"text/x-rst","patch_set":1,"id":"df87a7cf_966a997e","line":456,"in_reply_to":"df87a7cf_f060d203","updated":"2017-12-08 09:02:31.000000000","message":"Done","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"c108fa14b050ceb6036d51fd789c3b3e12cdc52b","unresolved":false,"context_lines":[{"line_number":449,"context_line":""},{"line_number":450,"context_line":"There are three tables where packets are sent once they get through the OVS"},{"line_number":451,"context_line":"firewall pipeline. The tables can be used by other mechanisms using OpenFlow"},{"line_number":452,"context_line":"that are supposed to work with the OVS firewall. ``table 91`` contains all"},{"line_number":453,"context_line":"packets that are considered accepted by the egress pipeline and won\u0027t be"},{"line_number":454,"context_line":"processed further. ``NORMAL`` action is used by default in this table."},{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_fabf36a7","line":453,"range":{"start_line":452,"start_character":49,"end_line":453,"end_character":12},"updated":"2017-12-08 23:56:46.000000000","message":"Consider:\n\nPackets sent to ``table 91``","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e3501d1c2f111a3b22f6a8adaa8b57e2f80d2f0b","unresolved":false,"context_lines":[{"line_number":449,"context_line":""},{"line_number":450,"context_line":"There are three tables where packets are sent once they get through the OVS"},{"line_number":451,"context_line":"firewall pipeline. The tables can be used by other mechanisms using OpenFlow"},{"line_number":452,"context_line":"that are supposed to work with the OVS firewall. ``table 91`` contains all"},{"line_number":453,"context_line":"packets that are considered accepted by the egress pipeline and won\u0027t be"},{"line_number":454,"context_line":"processed further. ``NORMAL`` action is used by default in this table."},{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_ce99f4d0","line":453,"range":{"start_line":452,"start_character":49,"end_line":453,"end_character":12},"in_reply_to":"df87a7cf_fabf36a7","updated":"2017-12-13 15:35:59.000000000","message":"Done","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"c108fa14b050ceb6036d51fd789c3b3e12cdc52b","unresolved":false,"context_lines":[{"line_number":452,"context_line":"that are supposed to work with the OVS firewall. ``table 91`` contains all"},{"line_number":453,"context_line":"packets that are considered accepted by the egress pipeline and won\u0027t be"},{"line_number":454,"context_line":"processed further. ``NORMAL`` action is used by default in this table."},{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_1ad21a01","line":455,"range":{"start_line":455,"start_character":0,"end_line":455,"end_character":38},"updated":"2017-12-08 23:56:46.000000000","message":"Packets sent to ``table 92``","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"c108fa14b050ceb6036d51fd789c3b3e12cdc52b","unresolved":false,"context_lines":[{"line_number":452,"context_line":"that are supposed to work with the OVS firewall. ``table 91`` contains all"},{"line_number":453,"context_line":"packets that are considered accepted by the egress pipeline and won\u0027t be"},{"line_number":454,"context_line":"processed further. ``NORMAL`` action is used by default in this table."},{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_dad7d2ed","line":455,"range":{"start_line":455,"start_character":57,"end_line":455,"end_character":64},"updated":"2017-12-08 23:56:46.000000000","message":"the ingress","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e3501d1c2f111a3b22f6a8adaa8b57e2f80d2f0b","unresolved":false,"context_lines":[{"line_number":452,"context_line":"that are supposed to work with the OVS firewall. ``table 91`` contains all"},{"line_number":453,"context_line":"packets that are considered accepted by the egress pipeline and won\u0027t be"},{"line_number":454,"context_line":"processed further. ``NORMAL`` action is used by default in this table."},{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_aea830db","line":455,"range":{"start_line":455,"start_character":0,"end_line":455,"end_character":38},"in_reply_to":"df87a7cf_1ad21a01","updated":"2017-12-13 15:35:59.000000000","message":"Done","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e3501d1c2f111a3b22f6a8adaa8b57e2f80d2f0b","unresolved":false,"context_lines":[{"line_number":452,"context_line":"that are supposed to work with the OVS firewall. ``table 91`` contains all"},{"line_number":453,"context_line":"packets that are considered accepted by the egress pipeline and won\u0027t be"},{"line_number":454,"context_line":"processed further. ``NORMAL`` action is used by default in this table."},{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_2eb42035","line":455,"range":{"start_line":455,"start_character":57,"end_line":455,"end_character":64},"in_reply_to":"df87a7cf_dad7d2ed","updated":"2017-12-13 15:35:59.000000000","message":"Done","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"c108fa14b050ceb6036d51fd789c3b3e12cdc52b","unresolved":false,"context_lines":[{"line_number":453,"context_line":"packets that are considered accepted by the egress pipeline and won\u0027t be"},{"line_number":454,"context_line":"processed further. ``NORMAL`` action is used by default in this table."},{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"},{"line_number":459,"context_line":"were filtered by firewall and should be dropped. Default action is ``drop`` in"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_ba0c4ea5","line":456,"range":{"start_line":456,"start_character":26,"end_line":456,"end_character":33},"updated":"2017-12-08 23:56:46.000000000","message":"the ingress","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e3501d1c2f111a3b22f6a8adaa8b57e2f80d2f0b","unresolved":false,"context_lines":[{"line_number":453,"context_line":"packets that are considered accepted by the egress pipeline and won\u0027t be"},{"line_number":454,"context_line":"processed further. ``NORMAL`` action is used by default in this table."},{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"},{"line_number":459,"context_line":"were filtered by firewall and should be dropped. Default action is ``drop`` in"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_ae81104d","line":456,"range":{"start_line":456,"start_character":26,"end_line":456,"end_character":33},"in_reply_to":"df87a7cf_ba0c4ea5","updated":"2017-12-13 15:35:59.000000000","message":"Done","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"c108fa14b050ceb6036d51fd789c3b3e12cdc52b","unresolved":false,"context_lines":[{"line_number":454,"context_line":"processed further. ``NORMAL`` action is used by default in this table."},{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"},{"line_number":459,"context_line":"were filtered by firewall and should be dropped. Default action is ``drop`` in"},{"line_number":460,"context_line":"this table."}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_da735215","line":457,"range":{"start_line":457,"start_character":26,"end_line":457,"end_character":34},"updated":"2017-12-08 23:56:46.000000000","message":"receives","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e3501d1c2f111a3b22f6a8adaa8b57e2f80d2f0b","unresolved":false,"context_lines":[{"line_number":454,"context_line":"processed further. ``NORMAL`` action is used by default in this table."},{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"},{"line_number":459,"context_line":"were filtered by firewall and should be dropped. Default action is ``drop`` in"},{"line_number":460,"context_line":"this table."}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_4e964497","line":457,"range":{"start_line":457,"start_character":26,"end_line":457,"end_character":34},"in_reply_to":"df87a7cf_da735215","updated":"2017-12-13 15:35:59.000000000","message":"Done","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"c108fa14b050ceb6036d51fd789c3b3e12cdc52b","unresolved":false,"context_lines":[{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"},{"line_number":459,"context_line":"were filtered by firewall and should be dropped. Default action is ``drop`` in"},{"line_number":460,"context_line":"this table."},{"line_number":461,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_7a024671","line":458,"range":{"start_line":458,"start_character":37,"end_line":458,"end_character":75},"updated":"2017-12-08 23:56:46.000000000","message":"packets sent to ``table 93``","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e3501d1c2f111a3b22f6a8adaa8b57e2f80d2f0b","unresolved":false,"context_lines":[{"line_number":455,"context_line":"``table 92`` contains all packets that were processed by ingress filtering"},{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"},{"line_number":459,"context_line":"were filtered by firewall and should be dropped. Default action is ``drop`` in"},{"line_number":460,"context_line":"this table."},{"line_number":461,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_0e903c95","line":458,"range":{"start_line":458,"start_character":37,"end_line":458,"end_character":75},"in_reply_to":"df87a7cf_7a024671","updated":"2017-12-13 15:35:59.000000000","message":"Done","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":4694,"name":"Miguel Lavalle","email":"miguel@mlavalle.com","username":"minsel"},"change_message_id":"c108fa14b050ceb6036d51fd789c3b3e12cdc52b","unresolved":false,"context_lines":[{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"},{"line_number":459,"context_line":"were filtered by firewall and should be dropped. Default action is ``drop`` in"},{"line_number":460,"context_line":"this table."},{"line_number":461,"context_line":""},{"line_number":462,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_3af83e79","line":459,"range":{"start_line":459,"start_character":17,"end_line":459,"end_character":25},"updated":"2017-12-08 23:56:46.000000000","message":"the firewall","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e3501d1c2f111a3b22f6a8adaa8b57e2f80d2f0b","unresolved":false,"context_lines":[{"line_number":456,"context_line":"pipeline. As packets from ingress filtering pipeline were injected to its"},{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"},{"line_number":459,"context_line":"were filtered by firewall and should be dropped. Default action is ``drop`` in"},{"line_number":460,"context_line":"this table."},{"line_number":461,"context_line":""},{"line_number":462,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_2e8d007b","line":459,"range":{"start_line":459,"start_character":17,"end_line":459,"end_character":25},"in_reply_to":"df87a7cf_3af83e79","updated":"2017-12-13 15:35:59.000000000","message":"Done","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"47379603d473b37e70c598dedc9de3118db72939","unresolved":false,"context_lines":[{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"},{"line_number":459,"context_line":"were filtered by firewall and should be dropped. Default action is ``drop`` in"},{"line_number":460,"context_line":"this table."},{"line_number":461,"context_line":""},{"line_number":462,"context_line":""},{"line_number":463,"context_line":"Future work"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_0334d7fa","line":460,"updated":"2017-12-11 15:08:57.000000000","message":"Maybe it\u0027s also worth to mention that it always should be like that in this table, that last action for packets should be always DROP, otherwise it can be resumbmitted somewhere and not dropped finally :)","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"e3501d1c2f111a3b22f6a8adaa8b57e2f80d2f0b","unresolved":false,"context_lines":[{"line_number":457,"context_line":"destination, ``table 92`` contains copies of those packets and therefore"},{"line_number":458,"context_line":"default action is ``drop``. Finally, ``table 93`` contains all packets that"},{"line_number":459,"context_line":"were filtered by firewall and should be dropped. Default action is ``drop`` in"},{"line_number":460,"context_line":"this table."},{"line_number":461,"context_line":""},{"line_number":462,"context_line":""},{"line_number":463,"context_line":"Future work"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df87a7cf_4e3de42a","line":460,"in_reply_to":"df87a7cf_0334d7fa","updated":"2017-12-13 15:35:59.000000000","message":"I think this should be left up to decide by consumer of the tables. It\u0027s true for logging though","commit_id":"3e881457e2313f2b07fd8524e10b6ba2562f84fc"}],"neutron/agent/linux/openvswitch_firewall/firewall.py":[{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"28484b2f91eaf1a9a1d54f56e50db960ed4d9745","unresolved":false,"context_lines":[{"line_number":444,"context_line":"            table\u003dovs_consts.ACCEPTED_EGRESS_TRAFFIC_TABLE,"},{"line_number":445,"context_line":"            priority\u003d1,"},{"line_number":446,"context_line":"            actions\u003d\u0027normal\u0027)"},{"line_number":447,"context_line":"        for table in (ovs_consts.ACCEPTED_INGRESS_TRAFFIC_TABLE,"},{"line_number":448,"context_line":"                      ovs_consts.DROPPED_TRAFFIC_TABLE):"},{"line_number":449,"context_line":"            self.int_br.br.add_flow("},{"line_number":450,"context_line":"                table\u003dtable, priority\u003d0, actions\u003d\u0027drop\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_503dfeda","line":447,"range":{"start_line":447,"start_character":22,"end_line":447,"end_character":63},"updated":"2017-12-08 02:11:55.000000000","message":"If the default action for this table supposed to be drop?","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a57f9586ec08999e7425da707043c1836fadac69","unresolved":false,"context_lines":[{"line_number":444,"context_line":"            table\u003dovs_consts.ACCEPTED_EGRESS_TRAFFIC_TABLE,"},{"line_number":445,"context_line":"            priority\u003d1,"},{"line_number":446,"context_line":"            actions\u003d\u0027normal\u0027)"},{"line_number":447,"context_line":"        for table in (ovs_consts.ACCEPTED_INGRESS_TRAFFIC_TABLE,"},{"line_number":448,"context_line":"                      ovs_consts.DROPPED_TRAFFIC_TABLE):"},{"line_number":449,"context_line":"            self.int_br.br.add_flow("},{"line_number":450,"context_line":"                table\u003dtable, priority\u003d0, actions\u003d\u0027drop\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_02c72498","line":447,"range":{"start_line":447,"start_character":22,"end_line":447,"end_character":63},"in_reply_to":"df87a7cf_503dfeda","updated":"2017-12-08 09:02:31.000000000","message":"Yes, accepted ingress traffic is injected directly to port with output action and a copy is resubmitted to ACCEPTED_INGRESS_TRAFFIC_TABLE. I\u0027ll leave a comment about it here, I know it\u0027s a bit confusing","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"9cf2844cd1273d026ee076a278f5e1c7873df8ba","unresolved":false,"context_lines":[{"line_number":874,"context_line":"                ct_mark\u003dovsfw_consts.CT_MARK_NORMAL,"},{"line_number":875,"context_line":"                reg_port\u003dport.ofport,"},{"line_number":876,"context_line":"                ct_zone\u003dport.vlan_tag,"},{"line_number":877,"context_line":"                actions\u003d\u0027resubmit(,%d)\u0027 % ("},{"line_number":878,"context_line":"                    ovs_consts.ACCEPTED_EGRESS_TRAFFIC_TABLE)"},{"line_number":879,"context_line":"            )"},{"line_number":880,"context_line":"        self._add_flow("},{"line_number":881,"context_line":"            table\u003dovs_consts.RULES_EGRESS_TABLE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_163f6eb4","line":878,"range":{"start_line":877,"start_character":25,"end_line":878,"end_character":61},"updated":"2017-12-08 03:40:01.000000000","message":"Currently, first accept packet is enough for logging. So I\u0027m not sure whether we need to resubmit these packet to ACCEPT_EGRESS_TRAFFIC_TABLE for other features.","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a57f9586ec08999e7425da707043c1836fadac69","unresolved":false,"context_lines":[{"line_number":874,"context_line":"                ct_mark\u003dovsfw_consts.CT_MARK_NORMAL,"},{"line_number":875,"context_line":"                reg_port\u003dport.ofport,"},{"line_number":876,"context_line":"                ct_zone\u003dport.vlan_tag,"},{"line_number":877,"context_line":"                actions\u003d\u0027resubmit(,%d)\u0027 % ("},{"line_number":878,"context_line":"                    ovs_consts.ACCEPTED_EGRESS_TRAFFIC_TABLE)"},{"line_number":879,"context_line":"            )"},{"line_number":880,"context_line":"        self._add_flow("},{"line_number":881,"context_line":"            table\u003dovs_consts.RULES_EGRESS_TABLE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_d6226152","line":878,"range":{"start_line":877,"start_character":25,"end_line":878,"end_character":61},"in_reply_to":"df87a7cf_163f6eb4","updated":"2017-12-08 09:02:31.000000000","message":"I wanted to generalize the flow, so it would be - process packets filtering based on SG -\u003e if accepted, send it to accept table. Such table can serve as connecting point to other features using openflow. Feel free to log only first packet, that will be all up to whoever wants to connect to ovs firewall. What do you think?","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"b6ee40362706465249c6a7e438d7d3170381534a","unresolved":false,"context_lines":[{"line_number":874,"context_line":"                ct_mark\u003dovsfw_consts.CT_MARK_NORMAL,"},{"line_number":875,"context_line":"                reg_port\u003dport.ofport,"},{"line_number":876,"context_line":"                ct_zone\u003dport.vlan_tag,"},{"line_number":877,"context_line":"                actions\u003d\u0027resubmit(,%d)\u0027 % ("},{"line_number":878,"context_line":"                    ovs_consts.ACCEPTED_EGRESS_TRAFFIC_TABLE)"},{"line_number":879,"context_line":"            )"},{"line_number":880,"context_line":"        self._add_flow("},{"line_number":881,"context_line":"            table\u003dovs_consts.RULES_EGRESS_TABLE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_d9e7f211","line":878,"range":{"start_line":877,"start_character":25,"end_line":878,"end_character":61},"in_reply_to":"df87a7cf_590682d0","updated":"2017-12-08 09:55:18.000000000","message":"That\u0027s great. Thanks. :)","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"fbfbb49d6086673b95460de724819673c63df7af","unresolved":false,"context_lines":[{"line_number":874,"context_line":"                ct_mark\u003dovsfw_consts.CT_MARK_NORMAL,"},{"line_number":875,"context_line":"                reg_port\u003dport.ofport,"},{"line_number":876,"context_line":"                ct_zone\u003dport.vlan_tag,"},{"line_number":877,"context_line":"                actions\u003d\u0027resubmit(,%d)\u0027 % ("},{"line_number":878,"context_line":"                    ovs_consts.ACCEPTED_EGRESS_TRAFFIC_TABLE)"},{"line_number":879,"context_line":"            )"},{"line_number":880,"context_line":"        self._add_flow("},{"line_number":881,"context_line":"            table\u003dovs_consts.RULES_EGRESS_TABLE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_99608ad1","line":878,"range":{"start_line":877,"start_character":25,"end_line":878,"end_character":61},"in_reply_to":"df87a7cf_99196a7b","updated":"2017-12-08 09:40:06.000000000","message":"Thanks in advance. :)","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"30d17a738c055b4e943bc7f1fb45c9f53b3a0e7e","unresolved":false,"context_lines":[{"line_number":874,"context_line":"                ct_mark\u003dovsfw_consts.CT_MARK_NORMAL,"},{"line_number":875,"context_line":"                reg_port\u003dport.ofport,"},{"line_number":876,"context_line":"                ct_zone\u003dport.vlan_tag,"},{"line_number":877,"context_line":"                actions\u003d\u0027resubmit(,%d)\u0027 % ("},{"line_number":878,"context_line":"                    ovs_consts.ACCEPTED_EGRESS_TRAFFIC_TABLE)"},{"line_number":879,"context_line":"            )"},{"line_number":880,"context_line":"        self._add_flow("},{"line_number":881,"context_line":"            table\u003dovs_consts.RULES_EGRESS_TABLE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_590682d0","line":878,"range":{"start_line":877,"start_character":25,"end_line":878,"end_character":61},"in_reply_to":"df87a7cf_99608ad1","updated":"2017-12-08 09:51:00.000000000","message":"Yes, I think CT information should be available so you can use it.","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"4b9d6e23fa51b0343534845744b9644a4eb2b491","unresolved":false,"context_lines":[{"line_number":874,"context_line":"                ct_mark\u003dovsfw_consts.CT_MARK_NORMAL,"},{"line_number":875,"context_line":"                reg_port\u003dport.ofport,"},{"line_number":876,"context_line":"                ct_zone\u003dport.vlan_tag,"},{"line_number":877,"context_line":"                actions\u003d\u0027resubmit(,%d)\u0027 % ("},{"line_number":878,"context_line":"                    ovs_consts.ACCEPTED_EGRESS_TRAFFIC_TABLE)"},{"line_number":879,"context_line":"            )"},{"line_number":880,"context_line":"        self._add_flow("},{"line_number":881,"context_line":"            table\u003dovs_consts.RULES_EGRESS_TABLE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_99196a7b","line":878,"range":{"start_line":877,"start_character":25,"end_line":878,"end_character":61},"in_reply_to":"df87a7cf_d6226152","updated":"2017-12-08 09:36:27.000000000","message":"I think that make sense. For log only first accept packet, can i use ct_state\u003d+new-est or ct_state\u003d\u0027+est-rel-rpl\u0027 as a matching field in logging flow? or do you have any suggestion for me to log only first packet?","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"9cf2844cd1273d026ee076a278f5e1c7873df8ba","unresolved":false,"context_lines":[{"line_number":906,"context_line":"                dl_type\u003dconstants.ETHERTYPE_IPV6,"},{"line_number":907,"context_line":"                nw_proto\u003dlib_const.PROTO_NUM_IPV6_ICMP,"},{"line_number":908,"context_line":"                icmp_type\u003dicmp_type,"},{"line_number":909,"context_line":"                actions\u003d\u0027output:{:d},resubmit(,{:d})\u0027.format("},{"line_number":910,"context_line":"                    port.ofport,"},{"line_number":911,"context_line":"                    ovs_consts.ACCEPTED_INGRESS_TRAFFIC_TABLE),"},{"line_number":912,"context_line":"            )"},{"line_number":913,"context_line":""},{"line_number":914,"context_line":"    def _initialize_ingress(self, port):"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_b3a81420","line":911,"range":{"start_line":909,"start_character":37,"end_line":911,"end_character":63},"updated":"2017-12-08 03:40:01.000000000","message":"Do we need to send this packet to custom tables?","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"9cf2844cd1273d026ee076a278f5e1c7873df8ba","unresolved":false,"context_lines":[{"line_number":918,"context_line":"            priority\u003d100,"},{"line_number":919,"context_line":"            dl_type\u003dconstants.ETHERTYPE_ARP,"},{"line_number":920,"context_line":"            reg_port\u003dport.ofport,"},{"line_number":921,"context_line":"            actions\u003d\u0027output:{:d},resubmit(,{:d})\u0027.format("},{"line_number":922,"context_line":"                port.ofport,"},{"line_number":923,"context_line":"                ovs_consts.ACCEPTED_INGRESS_TRAFFIC_TABLE),"},{"line_number":924,"context_line":"        )"},{"line_number":925,"context_line":"        self._initialize_ingress_ipv6_icmp(port)"},{"line_number":926,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_d37a78b8","line":923,"range":{"start_line":921,"start_character":33,"end_line":923,"end_character":58},"updated":"2017-12-08 03:40:01.000000000","message":"Same my above comment at L911","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"9cf2844cd1273d026ee076a278f5e1c7873df8ba","unresolved":false,"context_lines":[{"line_number":936,"context_line":"                nw_proto\u003dlib_const.PROTO_NUM_UDP,"},{"line_number":937,"context_line":"                tp_src\u003dsrc_port,"},{"line_number":938,"context_line":"                tp_dst\u003ddst_port,"},{"line_number":939,"context_line":"                actions\u003d\u0027output:{:d},resubmit(,{:d})\u0027.format("},{"line_number":940,"context_line":"                    port.ofport,"},{"line_number":941,"context_line":"                    ovs_consts.ACCEPTED_INGRESS_TRAFFIC_TABLE),"},{"line_number":942,"context_line":"            )"},{"line_number":943,"context_line":""},{"line_number":944,"context_line":"        # Track untracked"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_9352b03a","line":941,"range":{"start_line":939,"start_character":37,"end_line":941,"end_character":63},"updated":"2017-12-08 03:40:01.000000000","message":"Same my above comment at L911","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":15471,"name":"Nguyen Phuong An","email":"annp.cs51@gmail.com","username":"An-FVL"},"change_message_id":"9cf2844cd1273d026ee076a278f5e1c7873df8ba","unresolved":false,"context_lines":[{"line_number":988,"context_line":"                ct_state\u003dstate,"},{"line_number":989,"context_line":"                ct_mark\u003dovsfw_consts.CT_MARK_NORMAL,"},{"line_number":990,"context_line":"                ct_zone\u003dport.vlan_tag,"},{"line_number":991,"context_line":"                actions\u003d\u0027output:{:d},resubmit(,{:d})\u0027.format("},{"line_number":992,"context_line":"                    port.ofport,"},{"line_number":993,"context_line":"                    ovs_consts.ACCEPTED_INGRESS_TRAFFIC_TABLE)"},{"line_number":994,"context_line":"            )"},{"line_number":995,"context_line":"        self._add_flow("},{"line_number":996,"context_line":"            table\u003dovs_consts.RULES_INGRESS_TABLE,"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_562416af","line":993,"range":{"start_line":991,"start_character":37,"end_line":993,"end_character":62},"updated":"2017-12-08 03:40:01.000000000","message":"Currently, first accept packet is enough for logging. So I\u0027m not sure whether we need to resubmit these packet to ACCEPT_INGRESS_TRAFFIC_TABLE for other features.","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"}],"neutron/plugins/ml2/drivers/openvswitch/agent/common/constants.py":[{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"28484b2f91eaf1a9a1d54f56e50db960ed4d9745","unresolved":false,"context_lines":[{"line_number":71,"context_line":"    RULES_INGRESS_TABLE,"},{"line_number":72,"context_line":")"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"# Tables for parties reacting with ovs firewall"},{"line_number":75,"context_line":"ACCEPTED_EGRESS_TRAFFIC_TABLE \u003d 91"},{"line_number":76,"context_line":"ACCEPTED_INGRESS_TRAFFIC_TABLE \u003d 92"},{"line_number":77,"context_line":"DROPPED_TRAFFIC_TABLE \u003d 93"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_d0a58e48","line":74,"range":{"start_line":74,"start_character":21,"end_line":74,"end_character":29},"updated":"2017-12-08 02:11:55.000000000","message":"s/interacting ?","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"},{"author":{"_account_id":8655,"name":"Jakub Libosvar","email":"libosvar@redhat.com","username":"jlibosva"},"change_message_id":"a57f9586ec08999e7425da707043c1836fadac69","unresolved":false,"context_lines":[{"line_number":71,"context_line":"    RULES_INGRESS_TABLE,"},{"line_number":72,"context_line":")"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"# Tables for parties reacting with ovs firewall"},{"line_number":75,"context_line":"ACCEPTED_EGRESS_TRAFFIC_TABLE \u003d 91"},{"line_number":76,"context_line":"ACCEPTED_INGRESS_TRAFFIC_TABLE \u003d 92"},{"line_number":77,"context_line":"DROPPED_TRAFFIC_TABLE \u003d 93"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_f61f6505","line":74,"range":{"start_line":74,"start_character":21,"end_line":74,"end_character":29},"in_reply_to":"df87a7cf_d0a58e48","updated":"2017-12-08 09:02:31.000000000","message":"Done","commit_id":"8c85dd4582f4eb1bf5a6da56ff3c6679148c782e"}]}