)]}'
{"doc/networking-guide/source/intro-os-networking.rst":[{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"ec25912081898f1b55a893c7cefce52a0861c6ea","unresolved":false,"context_lines":[{"line_number":178,"context_line":"allocation:"},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"* DHCP discovery and request messages sourced from the unspecified IPv4 address"},{"line_number":181,"context_line":"  (0.0.0.0), are permitted so long as they originate from a valid source MAC"},{"line_number":182,"context_line":"  address."},{"line_number":183,"context_line":"* ICMPv6 MLD Reports (v1 and v2) and Neighbor Solicitation messages sourced"},{"line_number":184,"context_line":"  from the unspecified IPv6 address (::), are permitted so long as they"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3ac371cc_7171f175","line":181,"updated":"2016-08-17 18:49:19.000000000","message":"permitted if they originate\n\n\"so long as they\" is tough to translate.","commit_id":"45e58672ff031e29177c0720c56edbac77ddd98d"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"ec25912081898f1b55a893c7cefce52a0861c6ea","unresolved":false,"context_lines":[{"line_number":181,"context_line":"  (0.0.0.0), are permitted so long as they originate from a valid source MAC"},{"line_number":182,"context_line":"  address."},{"line_number":183,"context_line":"* ICMPv6 MLD Reports (v1 and v2) and Neighbor Solicitation messages sourced"},{"line_number":184,"context_line":"  from the unspecified IPv6 address (::), are permitted so long as they"},{"line_number":185,"context_line":"  originate from a valid source MAC address. These ICMPv6 types are required"},{"line_number":186,"context_line":"  for an instance to complete Duplicate Address Detection."},{"line_number":187,"context_line":"* DHCP renewal and rebinding messages are permitted from a valid source IP"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3ac371cc_f10b21d4","line":184,"updated":"2016-08-17 18:49:19.000000000","message":"are permitted if","commit_id":"45e58672ff031e29177c0720c56edbac77ddd98d"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"ec25912081898f1b55a893c7cefce52a0861c6ea","unresolved":false,"context_lines":[{"line_number":193,"context_line":"* ICMPv6 router advertisements are denied to prevent an instance from acting as"},{"line_number":194,"context_line":"  IPv6 router."},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"These rules are enforced regardless of the user specified security group rules."},{"line_number":197,"context_line":"In addition ARP is permitted since it is actually non-IP traffic."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"By enforcing these fixed and anti-spoofing rules a verity of malicious"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3ac371cc_5124b55e","line":196,"updated":"2016-08-17 18:49:19.000000000","message":"user-specified","commit_id":"45e58672ff031e29177c0720c56edbac77ddd98d"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"ec25912081898f1b55a893c7cefce52a0861c6ea","unresolved":false,"context_lines":[{"line_number":196,"context_line":"These rules are enforced regardless of the user specified security group rules."},{"line_number":197,"context_line":"In addition ARP is permitted since it is actually non-IP traffic."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"By enforcing these fixed and anti-spoofing rules a verity of malicious"},{"line_number":200,"context_line":"first-hop security issues are prevented. The goal being that two instances"},{"line_number":201,"context_line":"belonging to different tenants can both use a common shared network safely."},{"line_number":202,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3ac371cc_51db154f","line":199,"updated":"2016-08-17 18:49:19.000000000","message":"variety (right? verity is a word but doesn\u0027t work in this context)","commit_id":"45e58672ff031e29177c0720c56edbac77ddd98d"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"ec25912081898f1b55a893c7cefce52a0861c6ea","unresolved":false,"context_lines":[{"line_number":201,"context_line":"belonging to different tenants can both use a common shared network safely."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"Security group, anti-spoofing and fixed rules can be disabled by setting the"},{"line_number":204,"context_line":"port_security_enabled port attribute to false. When this is set, the firewall"},{"line_number":205,"context_line":"driver does not generate any rules for that port."},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"Extensions"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3ac371cc_11a35db3","line":204,"updated":"2016-08-17 18:49:19.000000000","message":"markup port_security_enabled\n\nWhen this attribute is set to true, (right? I could be reading this wrong hence would like to clear ambiguity).","commit_id":"45e58672ff031e29177c0720c56edbac77ddd98d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":153,"context_line":"security group. By default, this group drops all ingress traffic and allows all"},{"line_number":154,"context_line":"egress. Rules can be added to this group in order to change the behavior."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Security groups are realized by firewall drivers. Firewall drivers are selected"},{"line_number":157,"context_line":"by the operator by the configuration of OpenStack Networking and its plugins,"},{"line_number":158,"context_line":"and materialize the underlying firewall configuration rules on each port. The"},{"line_number":159,"context_line":"firewall driver is also responsible for generating rules to enforce"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_5f8a5cc0","line":156,"range":{"start_line":156,"start_character":16,"end_line":156,"end_character":31},"updated":"2016-08-22 09:07:24.000000000","message":"I don\u0027t know what this means? Could we make this clearer?","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":153,"context_line":"security group. By default, this group drops all ingress traffic and allows all"},{"line_number":154,"context_line":"egress. Rules can be added to this group in order to change the behavior."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Security groups are realized by firewall drivers. Firewall drivers are selected"},{"line_number":157,"context_line":"by the operator by the configuration of OpenStack Networking and its plugins,"},{"line_number":158,"context_line":"and materialize the underlying firewall configuration rules on each port. The"},{"line_number":159,"context_line":"firewall driver is also responsible for generating rules to enforce"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_39810090","line":156,"range":{"start_line":156,"start_character":16,"end_line":156,"end_character":31},"in_reply_to":"1ac06dbe_5f8a5cc0","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":154,"context_line":"egress. Rules can be added to this group in order to change the behavior."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Security groups are realized by firewall drivers. Firewall drivers are selected"},{"line_number":157,"context_line":"by the operator by the configuration of OpenStack Networking and its plugins,"},{"line_number":158,"context_line":"and materialize the underlying firewall configuration rules on each port. The"},{"line_number":159,"context_line":"firewall driver is also responsible for generating rules to enforce"},{"line_number":160,"context_line":"anti-spoofing and permit instances to acquire IP addresses."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_dfbc8c6e","line":157,"range":{"start_line":157,"start_character":0,"end_line":157,"end_character":35},"updated":"2016-08-22 09:07:24.000000000","message":"rephase","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":154,"context_line":"egress. Rules can be added to this group in order to change the behavior."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Security groups are realized by firewall drivers. Firewall drivers are selected"},{"line_number":157,"context_line":"by the operator by the configuration of OpenStack Networking and its plugins,"},{"line_number":158,"context_line":"and materialize the underlying firewall configuration rules on each port. The"},{"line_number":159,"context_line":"firewall driver is also responsible for generating rules to enforce"},{"line_number":160,"context_line":"anti-spoofing and permit instances to acquire IP addresses."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_197c04b4","line":157,"range":{"start_line":157,"start_character":0,"end_line":157,"end_character":35},"in_reply_to":"1ac06dbe_dfbc8c6e","updated":"2016-08-23 20:50:22.000000000","message":"done","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Security groups are realized by firewall drivers. Firewall drivers are selected"},{"line_number":157,"context_line":"by the operator by the configuration of OpenStack Networking and its plugins,"},{"line_number":158,"context_line":"and materialize the underlying firewall configuration rules on each port. The"},{"line_number":159,"context_line":"firewall driver is also responsible for generating rules to enforce"},{"line_number":160,"context_line":"anti-spoofing and permit instances to acquire IP addresses."},{"line_number":161,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_bfbf105f","line":158,"range":{"start_line":158,"start_character":4,"end_line":158,"end_character":15},"updated":"2016-08-22 09:07:24.000000000","message":"materializes*","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Security groups are realized by firewall drivers. Firewall drivers are selected"},{"line_number":157,"context_line":"by the operator by the configuration of OpenStack Networking and its plugins,"},{"line_number":158,"context_line":"and materialize the underlying firewall configuration rules on each port. The"},{"line_number":159,"context_line":"firewall driver is also responsible for generating rules to enforce"},{"line_number":160,"context_line":"anti-spoofing and permit instances to acquire IP addresses."},{"line_number":161,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_0dfccb3c","line":158,"range":{"start_line":158,"start_character":4,"end_line":158,"end_character":15},"in_reply_to":"1ac06dbe_bfbf105f","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":159,"context_line":"firewall driver is also responsible for generating rules to enforce"},{"line_number":160,"context_line":"anti-spoofing and permit instances to acquire IP addresses."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Anti-spoofing rules are added each instance port to ensure all traffic received"},{"line_number":163,"context_line":"by the network from the instance port has a source MAC and IP addresses which"},{"line_number":164,"context_line":"is associated with that instance port. This way, the source address can be"},{"line_number":165,"context_line":"relied upon to accurately filter traffic. These source accesses include not"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_3facc034","line":162,"range":{"start_line":162,"start_character":19,"end_line":162,"end_character":43},"updated":"2016-08-22 09:07:24.000000000","message":"are added to each instance*?","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":159,"context_line":"firewall driver is also responsible for generating rules to enforce"},{"line_number":160,"context_line":"anti-spoofing and permit instances to acquire IP addresses."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Anti-spoofing rules are added each instance port to ensure all traffic received"},{"line_number":163,"context_line":"by the network from the instance port has a source MAC and IP addresses which"},{"line_number":164,"context_line":"is associated with that instance port. This way, the source address can be"},{"line_number":165,"context_line":"relied upon to accurately filter traffic. These source accesses include not"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_6dea9f75","line":162,"range":{"start_line":162,"start_character":19,"end_line":162,"end_character":43},"in_reply_to":"1ac06dbe_3facc034","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":162,"context_line":"Anti-spoofing rules are added each instance port to ensure all traffic received"},{"line_number":163,"context_line":"by the network from the instance port has a source MAC and IP addresses which"},{"line_number":164,"context_line":"is associated with that instance port. This way, the source address can be"},{"line_number":165,"context_line":"relied upon to accurately filter traffic. These source accesses include not"},{"line_number":166,"context_line":"just the fixed-addresses of the port, but the allowed-address pairs and the"},{"line_number":167,"context_line":"IPv6 link-local address associated with the port MAC address and any additional"},{"line_number":168,"context_line":"MAC addresses included in allowed-address pairs. The source MAC and IP address"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_9f59745d","line":165,"range":{"start_line":165,"start_character":64,"end_line":165,"end_character":71},"updated":"2016-08-22 09:07:24.000000000","message":"include, not just the fixed addresses of the port, but*","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":162,"context_line":"Anti-spoofing rules are added each instance port to ensure all traffic received"},{"line_number":163,"context_line":"by the network from the instance port has a source MAC and IP addresses which"},{"line_number":164,"context_line":"is associated with that instance port. This way, the source address can be"},{"line_number":165,"context_line":"relied upon to accurately filter traffic. These source accesses include not"},{"line_number":166,"context_line":"just the fixed-addresses of the port, but the allowed-address pairs and the"},{"line_number":167,"context_line":"IPv6 link-local address associated with the port MAC address and any additional"},{"line_number":168,"context_line":"MAC addresses included in allowed-address pairs. The source MAC and IP address"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_8de71bab","line":165,"range":{"start_line":165,"start_character":64,"end_line":165,"end_character":71},"in_reply_to":"1ac06dbe_9f59745d","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":173,"context_line":"all MAC addresses including the port\u0027s MAC address and MAC addresses included"},{"line_number":174,"context_line":"in allowed-address pairs."},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"Finally the firewall driver implements some base rules to permit IP address"},{"line_number":177,"context_line":"allocation. Instances are prohibited from egressing traffic to assign IP"},{"line_number":178,"context_line":"address to other instances:"},{"line_number":179,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_9f305403","line":176,"range":{"start_line":176,"start_character":0,"end_line":176,"end_character":11},"updated":"2016-08-22 09:07:24.000000000","message":"The firewall* (remove finally)","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":173,"context_line":"all MAC addresses including the port\u0027s MAC address and MAC addresses included"},{"line_number":174,"context_line":"in allowed-address pairs."},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"Finally the firewall driver implements some base rules to permit IP address"},{"line_number":177,"context_line":"allocation. Instances are prohibited from egressing traffic to assign IP"},{"line_number":178,"context_line":"address to other instances:"},{"line_number":179,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_4df1a36a","line":176,"range":{"start_line":176,"start_character":0,"end_line":176,"end_character":11},"in_reply_to":"1ac06dbe_9f305403","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":185,"context_line":"There are few exceptions to the egress anti-spoofing rules for IP address"},{"line_number":186,"context_line":"assignment:"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"* DHCP discovery and request messages sourced from the unspecified IPv4 address"},{"line_number":189,"context_line":"  (0.0.0.0), are permitted if they originate from a valid source MAC address."},{"line_number":190,"context_line":"* ICMPv6 MLD Reports (v1 and v2) and Neighbor Solicitation messages sourced"},{"line_number":191,"context_line":"  from the unspecified IPv6 address (::), are permitted if originate from a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_ff150849","line":188,"range":{"start_line":188,"start_character":29,"end_line":188,"end_character":45},"updated":"2016-08-22 09:07:24.000000000","message":"messages that are sourced*","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":185,"context_line":"There are few exceptions to the egress anti-spoofing rules for IP address"},{"line_number":186,"context_line":"assignment:"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"* DHCP discovery and request messages sourced from the unspecified IPv4 address"},{"line_number":189,"context_line":"  (0.0.0.0), are permitted if they originate from a valid source MAC address."},{"line_number":190,"context_line":"* ICMPv6 MLD Reports (v1 and v2) and Neighbor Solicitation messages sourced"},{"line_number":191,"context_line":"  from the unspecified IPv6 address (::), are permitted if originate from a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_2dcd4731","line":188,"range":{"start_line":188,"start_character":29,"end_line":188,"end_character":45},"in_reply_to":"1ac06dbe_ff150849","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":187,"context_line":""},{"line_number":188,"context_line":"* DHCP discovery and request messages sourced from the unspecified IPv4 address"},{"line_number":189,"context_line":"  (0.0.0.0), are permitted if they originate from a valid source MAC address."},{"line_number":190,"context_line":"* ICMPv6 MLD Reports (v1 and v2) and Neighbor Solicitation messages sourced"},{"line_number":191,"context_line":"  from the unspecified IPv6 address (::), are permitted if originate from a"},{"line_number":192,"context_line":"  valid source MAC address. These ICMPv6 types are required for an instance to"},{"line_number":193,"context_line":"  complete Duplicate Address Detection."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_daff7aff","line":190,"range":{"start_line":190,"start_character":59,"end_line":190,"end_character":75},"updated":"2016-08-22 09:07:24.000000000","message":"message that are sourced*","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":187,"context_line":""},{"line_number":188,"context_line":"* DHCP discovery and request messages sourced from the unspecified IPv4 address"},{"line_number":189,"context_line":"  (0.0.0.0), are permitted if they originate from a valid source MAC address."},{"line_number":190,"context_line":"* ICMPv6 MLD Reports (v1 and v2) and Neighbor Solicitation messages sourced"},{"line_number":191,"context_line":"  from the unspecified IPv6 address (::), are permitted if originate from a"},{"line_number":192,"context_line":"  valid source MAC address. These ICMPv6 types are required for an instance to"},{"line_number":193,"context_line":"  complete Duplicate Address Detection."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_ad52d764","line":190,"range":{"start_line":190,"start_character":59,"end_line":190,"end_character":75},"in_reply_to":"1ac06dbe_daff7aff","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":202,"context_line":"  permitted so an instance can join multicast groups and discover neighbors."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"ARP is not implicitly permitted since it is a non-IP protocol which security"},{"line_number":205,"context_line":"groups are incapable of filtering. ARP filtering rules are including in the"},{"line_number":206,"context_line":"anti-spoofing rules to prevent an instance from using ARP to intercept traffic"},{"line_number":207,"context_line":"destine for another IP."},{"line_number":208,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_7a192679","line":205,"range":{"start_line":205,"start_character":55,"end_line":205,"end_character":68},"updated":"2016-08-22 09:07:24.000000000","message":"are included*","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":202,"context_line":"  permitted so an instance can join multicast groups and discover neighbors."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"ARP is not implicitly permitted since it is a non-IP protocol which security"},{"line_number":205,"context_line":"groups are incapable of filtering. ARP filtering rules are including in the"},{"line_number":206,"context_line":"anti-spoofing rules to prevent an instance from using ARP to intercept traffic"},{"line_number":207,"context_line":"destine for another IP."},{"line_number":208,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_2d66e750","line":205,"range":{"start_line":205,"start_character":55,"end_line":205,"end_character":68},"in_reply_to":"1ac06dbe_7a192679","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":206,"context_line":"anti-spoofing rules to prevent an instance from using ARP to intercept traffic"},{"line_number":207,"context_line":"destine for another IP."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"These rules are enforced regardless of the user-specified security group rules."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"By enforcing these fixed and anti-spoofing rules a variety of malicious"},{"line_number":212,"context_line":"first-hop security issues are prevented. The goal being that two instances"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_7a3006e9","line":209,"range":{"start_line":209,"start_character":0,"end_line":209,"end_character":4},"updated":"2016-08-22 09:07:24.000000000","message":"This should be with the paragraph above","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":208,"context_line":""},{"line_number":209,"context_line":"These rules are enforced regardless of the user-specified security group rules."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"By enforcing these fixed and anti-spoofing rules a variety of malicious"},{"line_number":212,"context_line":"first-hop security issues are prevented. The goal being that two instances"},{"line_number":213,"context_line":"belonging to different tenants can both use a common shared network safely."},{"line_number":214,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_da4dba73","line":211,"range":{"start_line":211,"start_character":42,"end_line":211,"end_character":48},"updated":"2016-08-22 09:07:24.000000000","message":"rules, a variety*","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":208,"context_line":""},{"line_number":209,"context_line":"These rules are enforced regardless of the user-specified security group rules."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"By enforcing these fixed and anti-spoofing rules a variety of malicious"},{"line_number":212,"context_line":"first-hop security issues are prevented. The goal being that two instances"},{"line_number":213,"context_line":"belonging to different tenants can both use a common shared network safely."},{"line_number":214,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_ed716f0d","line":211,"range":{"start_line":211,"start_character":42,"end_line":211,"end_character":48},"in_reply_to":"1ac06dbe_da4dba73","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":213,"context_line":"belonging to different tenants can both use a common shared network safely."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"While traffic necessary for IP address assignment are permitted by the fixed"},{"line_number":216,"context_line":"rules, the metadata service is not. If a user wishes to use metadata to"},{"line_number":217,"context_line":"configure instances, then they must ensure the egress security group rules"},{"line_number":218,"context_line":"permit TCP port 80 to 169.254.169.254. This is permitted by default in new"},{"line_number":219,"context_line":"security groups, but if a user wishes to remove the default egress all security"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_9a4ce271","line":216,"range":{"start_line":216,"start_character":36,"end_line":216,"end_character":52},"updated":"2016-08-22 09:07:24.000000000","message":"If you wish*","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":213,"context_line":"belonging to different tenants can both use a common shared network safely."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"While traffic necessary for IP address assignment are permitted by the fixed"},{"line_number":216,"context_line":"rules, the metadata service is not. If a user wishes to use metadata to"},{"line_number":217,"context_line":"configure instances, then they must ensure the egress security group rules"},{"line_number":218,"context_line":"permit TCP port 80 to 169.254.169.254. This is permitted by default in new"},{"line_number":219,"context_line":"security groups, but if a user wishes to remove the default egress all security"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_6d857fcd","line":216,"range":{"start_line":216,"start_character":36,"end_line":216,"end_character":52},"in_reply_to":"1ac06dbe_9a4ce271","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"6159ce696d3654f5e484f052090ecaacaea7e832","unresolved":false,"context_lines":[{"line_number":220,"context_line":"group rule they should consider this implication."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Security group, anti-spoofing and fixed rules can be disabled by setting the"},{"line_number":223,"context_line":":code:`port_security_enabled` port attribute to false. When this option is"},{"line_number":224,"context_line":"disabled, the firewall driver does not generate any rules for that port."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"User specified security group rules are permitted through security groups in a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_fa7196a9","line":223,"range":{"start_line":223,"start_character":48,"end_line":223,"end_character":53},"updated":"2016-08-22 09:07:24.000000000","message":"``false``","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"e474bb0315d53f9b303f12d104b66751284e6372","unresolved":false,"context_lines":[{"line_number":220,"context_line":"group rule they should consider this implication."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Security group, anti-spoofing and fixed rules can be disabled by setting the"},{"line_number":223,"context_line":":code:`port_security_enabled` port attribute to false. When this option is"},{"line_number":224,"context_line":"disabled, the firewall driver does not generate any rules for that port."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"User specified security group rules are permitted through security groups in a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ac06dbe_2d7f07e1","line":223,"range":{"start_line":223,"start_character":48,"end_line":223,"end_character":53},"in_reply_to":"1ac06dbe_fa7196a9","updated":"2016-08-23 20:50:22.000000000","message":"Fixed","commit_id":"58aca32ae321dd1077366c126bd98950aa5759ed"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"5a6be2a9bcddb008ff2b74e79b053deb59e46405","unresolved":false,"context_lines":[{"line_number":149,"context_line":"ability to specify the type of traffic and direction (ingress/egress) that is"},{"line_number":150,"context_line":"permitted to pass through a port. A security group is a container for security"},{"line_number":151,"context_line":"group rules. When a port is created, it is associated with a security group. If"},{"line_number":152,"context_line":"a security group is not specified, the port is associated with a \u0027default\u0027"},{"line_number":153,"context_line":"security group. By default, this group drops all ingress traffic and allows all"},{"line_number":154,"context_line":"egress. Rules can be added to this group in order to change the behavior."},{"line_number":155,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ac06dbe_45284a33","line":152,"range":{"start_line":152,"start_character":66,"end_line":152,"end_character":73},"updated":"2016-08-24 00:20:40.000000000","message":"remove scare quotes.","commit_id":"7fc8e70376edbfc521789ca01ad8eb9cd320f8cd"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"17bbc31f6b6a6507a1dd5d99537d117f90e614e1","unresolved":false,"context_lines":[{"line_number":149,"context_line":"ability to specify the type of traffic and direction (ingress/egress) that is"},{"line_number":150,"context_line":"permitted to pass through a port. A security group is a container for security"},{"line_number":151,"context_line":"group rules. When a port is created, it is associated with a security group. If"},{"line_number":152,"context_line":"a security group is not specified, the port is associated with a \u0027default\u0027"},{"line_number":153,"context_line":"security group. By default, this group drops all ingress traffic and allows all"},{"line_number":154,"context_line":"egress. Rules can be added to this group in order to change the behavior."},{"line_number":155,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ac06dbe_65d0e6c9","line":152,"range":{"start_line":152,"start_character":66,"end_line":152,"end_character":73},"in_reply_to":"1ac06dbe_45284a33","updated":"2016-08-24 00:29:18.000000000","message":"A security group is created in in project automatically it is named \"default\", how should the port association with this security group be conveyed?","commit_id":"7fc8e70376edbfc521789ca01ad8eb9cd320f8cd"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"d354e8a2e2d1810b1dc3ec661f27da0fbfd70788","unresolved":false,"context_lines":[{"line_number":149,"context_line":"ability to specify the type of traffic and direction (ingress/egress) that is"},{"line_number":150,"context_line":"permitted to pass through a port. A security group is a container for security"},{"line_number":151,"context_line":"group rules. When a port is created, it is associated with a security group. If"},{"line_number":152,"context_line":"a security group is not specified, the port is associated with a \u0027default\u0027"},{"line_number":153,"context_line":"security group. By default, this group drops all ingress traffic and allows all"},{"line_number":154,"context_line":"egress. Rules can be added to this group in order to change the behavior."},{"line_number":155,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ac06dbe_707b6bbe","line":152,"range":{"start_line":152,"start_character":66,"end_line":152,"end_character":73},"in_reply_to":"1ac06dbe_65d0e6c9","updated":"2016-08-24 10:19:54.000000000","message":"Dustin - if you\u0027re actually referring to the name of it, I would recommend putting it in the back ticks for appropriate markup.\n``default`` (or single back ticks, depending, check your output :) )","commit_id":"7fc8e70376edbfc521789ca01ad8eb9cd320f8cd"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"5a6be2a9bcddb008ff2b74e79b053deb59e46405","unresolved":false,"context_lines":[{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Security group rules are translated to configuration of the underlying packet"},{"line_number":157,"context_line":"filtering technology, such as iptables, by firewall drivers. When configuring"},{"line_number":158,"context_line":"OpenStack Networking and its plugins the operator selects a firewall driver."},{"line_number":159,"context_line":"The firewall driver is also responsible for generating rules to enforce"},{"line_number":160,"context_line":"anti-spoofing and permit instances to acquire IP addresses."},{"line_number":161,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ac06dbe_05d93257","line":158,"range":{"start_line":158,"start_character":25,"end_line":158,"end_character":76},"updated":"2016-08-24 00:20:40.000000000","message":"its plugins, select a firewall driver.","commit_id":"7fc8e70376edbfc521789ca01ad8eb9cd320f8cd"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"5a6be2a9bcddb008ff2b74e79b053deb59e46405","unresolved":false,"context_lines":[{"line_number":160,"context_line":"anti-spoofing and permit instances to acquire IP addresses."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Anti-spoofing rules are added to each instance port to ensure all traffic"},{"line_number":163,"context_line":"received by the network from the instance port has a source MAC and IP"},{"line_number":164,"context_line":"addresses which is associated with that instance port. This way, the source"},{"line_number":165,"context_line":"address can be relied upon to accurately filter traffic. These source addresses"},{"line_number":166,"context_line":"include, not just the fixed-addresses of the port, but the allowed-address"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ac06dbe_85e5220a","line":163,"range":{"start_line":163,"start_character":51,"end_line":163,"end_character":52},"updated":"2016-08-24 00:20:40.000000000","message":"remove for plural agreement.","commit_id":"7fc8e70376edbfc521789ca01ad8eb9cd320f8cd"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"5a6be2a9bcddb008ff2b74e79b053deb59e46405","unresolved":false,"context_lines":[{"line_number":163,"context_line":"received by the network from the instance port has a source MAC and IP"},{"line_number":164,"context_line":"addresses which is associated with that instance port. This way, the source"},{"line_number":165,"context_line":"address can be relied upon to accurately filter traffic. These source addresses"},{"line_number":166,"context_line":"include, not just the fixed-addresses of the port, but the allowed-address"},{"line_number":167,"context_line":"pairs and the IPv6 link-local address associated with the port MAC address and"},{"line_number":168,"context_line":"any additional MAC addresses included in allowed-address pairs. The source MAC"},{"line_number":169,"context_line":"and IP address are validated such that only the combinations specified in"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ac06dbe_45adea99","line":166,"range":{"start_line":166,"start_character":27,"end_line":166,"end_character":28},"updated":"2016-08-24 00:20:40.000000000","message":"I don\u0027t think this (or the following ones) needs to be hyphenated?","commit_id":"7fc8e70376edbfc521789ca01ad8eb9cd320f8cd"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"5a6be2a9bcddb008ff2b74e79b053deb59e46405","unresolved":false,"context_lines":[{"line_number":163,"context_line":"received by the network from the instance port has a source MAC and IP"},{"line_number":164,"context_line":"addresses which is associated with that instance port. This way, the source"},{"line_number":165,"context_line":"address can be relied upon to accurately filter traffic. These source addresses"},{"line_number":166,"context_line":"include, not just the fixed-addresses of the port, but the allowed-address"},{"line_number":167,"context_line":"pairs and the IPv6 link-local address associated with the port MAC address and"},{"line_number":168,"context_line":"any additional MAC addresses included in allowed-address pairs. The source MAC"},{"line_number":169,"context_line":"and IP address are validated such that only the combinations specified in"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ac06dbe_a5d13e25","line":166,"range":{"start_line":166,"start_character":7,"end_line":166,"end_character":8},"updated":"2016-08-24 00:20:40.000000000","message":"delete comma splice","commit_id":"7fc8e70376edbfc521789ca01ad8eb9cd320f8cd"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"5a6be2a9bcddb008ff2b74e79b053deb59e46405","unresolved":false,"context_lines":[{"line_number":188,"context_line":"* DHCP discovery and request messages that are sourced from the unspecified"},{"line_number":189,"context_line":"  IPv4 address (0.0.0.0), are permitted if they originate from a valid source"},{"line_number":190,"context_line":"  MAC address."},{"line_number":191,"context_line":"* ICMPv6 MLD Reports (v1 and v2) and Neighbor Solicitation messages that are"},{"line_number":192,"context_line":"  sourced from the unspecified IPv6 address (::), are permitted if originate"},{"line_number":193,"context_line":"  from a valid source MAC address. These ICMPv6 types are required for an"},{"line_number":194,"context_line":"  instance to complete Duplicate Address Detection."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ac06dbe_25b9cecc","line":191,"range":{"start_line":191,"start_character":37,"end_line":191,"end_character":58},"updated":"2016-08-24 00:20:40.000000000","message":"Remove initcaps.","commit_id":"7fc8e70376edbfc521789ca01ad8eb9cd320f8cd"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"f05ecbba62baa2c41db9ac69f5da4d3f943a85d7","unresolved":false,"context_lines":[{"line_number":141,"context_line":"Security groups provide a container for virtual firewall rules that control"},{"line_number":142,"context_line":"ingress (inbound to instances) and egress (outbound from instances) network"},{"line_number":143,"context_line":"traffic at the port level. Each port in a subnet can reference one or more"},{"line_number":144,"context_line":"security groups. The firewall driver translates security group rules to a"},{"line_number":145,"context_line":"configuration for the underlying packet filtering technology such as"},{"line_number":146,"context_line":"``iptables``."},{"line_number":147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_4971f5a7","line":144,"updated":"2016-08-31 20:17:27.000000000","message":"Should we mention security group inheritance and/or application of multiple groups to an instance?","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"961e1366e72cadae6e140c2297598d69e8e8836f","unresolved":false,"context_lines":[{"line_number":141,"context_line":"Security groups provide a container for virtual firewall rules that control"},{"line_number":142,"context_line":"ingress (inbound to instances) and egress (outbound from instances) network"},{"line_number":143,"context_line":"traffic at the port level. Each port in a subnet can reference one or more"},{"line_number":144,"context_line":"security groups. The firewall driver translates security group rules to a"},{"line_number":145,"context_line":"configuration for the underlying packet filtering technology such as"},{"line_number":146,"context_line":"``iptables``."},{"line_number":147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_84259fc3","line":144,"in_reply_to":"fa7ab95a_0f152d9a","updated":"2016-08-31 22:39:19.000000000","message":"Done","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"4bfda6e6030383efe7cfae7105c302b6a0d5d5c5","unresolved":false,"context_lines":[{"line_number":141,"context_line":"Security groups provide a container for virtual firewall rules that control"},{"line_number":142,"context_line":"ingress (inbound to instances) and egress (outbound from instances) network"},{"line_number":143,"context_line":"traffic at the port level. Each port in a subnet can reference one or more"},{"line_number":144,"context_line":"security groups. The firewall driver translates security group rules to a"},{"line_number":145,"context_line":"configuration for the underlying packet filtering technology such as"},{"line_number":146,"context_line":"``iptables``."},{"line_number":147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_0f152d9a","line":144,"in_reply_to":"fa7ab95a_4971f5a7","updated":"2016-08-31 21:35:03.000000000","message":"I\u0027m not sure what you mean by security group inheritance.\n\nYes, we should explain that security groups consist of sets of allow rules and are additive when multiple security groups are attached to a single instance port.","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"4bfda6e6030383efe7cfae7105c302b6a0d5d5c5","unresolved":false,"context_lines":[{"line_number":154,"context_line":""},{"line_number":155,"context_line":".. note::"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"   If you use the conventional (HTTP) metadata service, removing the default"},{"line_number":158,"context_line":"   egress rules denies instances access to TCP port 80 on 169.254.169.254."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Security group rules are stateful. Thus, allowing ingress TCP port 22 for"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_efed698f","line":157,"range":{"start_line":157,"start_character":18,"end_line":157,"end_character":30},"updated":"2016-08-31 21:35:03.000000000","message":"conventional metadata? AFAIK the only other option is config drive which may pass metadata but isn\u0027t a metadata service as all. Are you including config drive in the larger set of metadata services or is there another implementation I\u0027m not aware of.","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"961e1366e72cadae6e140c2297598d69e8e8836f","unresolved":false,"context_lines":[{"line_number":154,"context_line":""},{"line_number":155,"context_line":".. note::"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"   If you use the conventional (HTTP) metadata service, removing the default"},{"line_number":158,"context_line":"   egress rules denies instances access to TCP port 80 on 169.254.169.254."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Security group rules are stateful. Thus, allowing ingress TCP port 22 for"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_c406c71f","line":157,"range":{"start_line":157,"start_character":18,"end_line":157,"end_character":30},"in_reply_to":"fa7ab95a_efed698f","updated":"2016-08-31 22:39:19.000000000","message":"Done","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"4bfda6e6030383efe7cfae7105c302b6a0d5d5c5","unresolved":false,"context_lines":[{"line_number":155,"context_line":".. note::"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"   If you use the conventional (HTTP) metadata service, removing the default"},{"line_number":158,"context_line":"   egress rules denies instances access to TCP port 80 on 169.254.169.254."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Security group rules are stateful. Thus, allowing ingress TCP port 22 for"},{"line_number":161,"context_line":"secure shell automatically creates rules that allow return egress traffic"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_2f83d1cd","line":158,"range":{"start_line":158,"start_character":73,"end_line":158,"end_character":74},"updated":"2016-08-31 21:35:03.000000000","message":"... thus preventing instance from retrieving metadata.","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"961e1366e72cadae6e140c2297598d69e8e8836f","unresolved":false,"context_lines":[{"line_number":155,"context_line":".. note::"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"   If you use the conventional (HTTP) metadata service, removing the default"},{"line_number":158,"context_line":"   egress rules denies instances access to TCP port 80 on 169.254.169.254."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Security group rules are stateful. Thus, allowing ingress TCP port 22 for"},{"line_number":161,"context_line":"secure shell automatically creates rules that allow return egress traffic"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_b71d7768","line":158,"range":{"start_line":158,"start_character":73,"end_line":158,"end_character":74},"in_reply_to":"fa7ab95a_2f83d1cd","updated":"2016-08-31 22:39:19.000000000","message":"Done","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"4bfda6e6030383efe7cfae7105c302b6a0d5d5c5","unresolved":false,"context_lines":[{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Security group rules are stateful. Thus, allowing ingress TCP port 22 for"},{"line_number":161,"context_line":"secure shell automatically creates rules that allow return egress traffic"},{"line_number":162,"context_line":"and ICMP error messages involving TCP connections."},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"By default, all security groups contain a series of basic (sanity) and"},{"line_number":165,"context_line":"anti-spoofing rules that perform the following actions:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_4fb9f578","line":162,"range":{"start_line":162,"start_character":33,"end_line":162,"end_character":49},"updated":"2016-08-31 21:35:03.000000000","message":"The use of plural connections is a bit confusing here. How about ... involving those TCP connections. as opposed to all TCP connections.","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"961e1366e72cadae6e140c2297598d69e8e8836f","unresolved":false,"context_lines":[{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Security group rules are stateful. Thus, allowing ingress TCP port 22 for"},{"line_number":161,"context_line":"secure shell automatically creates rules that allow return egress traffic"},{"line_number":162,"context_line":"and ICMP error messages involving TCP connections."},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"By default, all security groups contain a series of basic (sanity) and"},{"line_number":165,"context_line":"anti-spoofing rules that perform the following actions:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_77204f4a","line":162,"range":{"start_line":162,"start_character":33,"end_line":162,"end_character":49},"in_reply_to":"fa7ab95a_4fb9f578","updated":"2016-08-31 22:39:19.000000000","message":"Done","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"4bfda6e6030383efe7cfae7105c302b6a0d5d5c5","unresolved":false,"context_lines":[{"line_number":165,"context_line":"anti-spoofing rules that perform the following actions:"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"* Allow egress traffic only if it uses the source MAC and IP addresses"},{"line_number":168,"context_line":"  of the port for the instance."},{"line_number":169,"context_line":"* Allow egress DHCP discovery and request messages that use the source MAC"},{"line_number":170,"context_line":"  address of the port for the instance and the unspecified IPv4 address"},{"line_number":171,"context_line":"  (0.0.0.0)."}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_2129258a","line":168,"updated":"2016-08-31 21:35:03.000000000","message":"or valid source MAC and IP combination specified in ``allowed-address-pairs``\n\nor valid MAC (port MAC or `allowed-address-pairs`` MAC) and associated EUI64 link-local IPv6 address","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"961e1366e72cadae6e140c2297598d69e8e8836f","unresolved":false,"context_lines":[{"line_number":165,"context_line":"anti-spoofing rules that perform the following actions:"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"* Allow egress traffic only if it uses the source MAC and IP addresses"},{"line_number":168,"context_line":"  of the port for the instance."},{"line_number":169,"context_line":"* Allow egress DHCP discovery and request messages that use the source MAC"},{"line_number":170,"context_line":"  address of the port for the instance and the unspecified IPv4 address"},{"line_number":171,"context_line":"  (0.0.0.0)."}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_97c9537c","line":168,"in_reply_to":"fa7ab95a_2129258a","updated":"2016-08-31 22:39:19.000000000","message":"Done","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"4bfda6e6030383efe7cfae7105c302b6a0d5d5c5","unresolved":false,"context_lines":[{"line_number":170,"context_line":"  address of the port for the instance and the unspecified IPv4 address"},{"line_number":171,"context_line":"  (0.0.0.0)."},{"line_number":172,"context_line":"* Allow ingress DHCP and DHCPv6 responses from the DHCP server on the"},{"line_number":173,"context_line":"  subnet so instances can acquire an IP addresses."},{"line_number":174,"context_line":"* Deny egress DHCP and DHCPv6 responses to prevent instances from"},{"line_number":175,"context_line":"  acting as DHCP(v6) servers."},{"line_number":176,"context_line":"* Allow ingress/egress ICMPv6 MLD, neighbor solicitation, and neighbor"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_2f3bd1ec","line":173,"range":{"start_line":173,"start_character":34,"end_line":173,"end_character":50},"updated":"2016-08-31 21:35:03.000000000","message":"an IP address -or- IP addresses.","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"961e1366e72cadae6e140c2297598d69e8e8836f","unresolved":false,"context_lines":[{"line_number":170,"context_line":"  address of the port for the instance and the unspecified IPv4 address"},{"line_number":171,"context_line":"  (0.0.0.0)."},{"line_number":172,"context_line":"* Allow ingress DHCP and DHCPv6 responses from the DHCP server on the"},{"line_number":173,"context_line":"  subnet so instances can acquire an IP addresses."},{"line_number":174,"context_line":"* Deny egress DHCP and DHCPv6 responses to prevent instances from"},{"line_number":175,"context_line":"  acting as DHCP(v6) servers."},{"line_number":176,"context_line":"* Allow ingress/egress ICMPv6 MLD, neighbor solicitation, and neighbor"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_17a463b7","line":173,"range":{"start_line":173,"start_character":34,"end_line":173,"end_character":50},"in_reply_to":"fa7ab95a_2f3bd1ec","updated":"2016-08-31 22:39:19.000000000","message":"Done","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"4bfda6e6030383efe7cfae7105c302b6a0d5d5c5","unresolved":false,"context_lines":[{"line_number":182,"context_line":"  messages that use the source MAC address of a particular instance and"},{"line_number":183,"context_line":"  the unspecified IPv6 address (::). Duplicate address detection (DAD) relies"},{"line_number":184,"context_line":"  on these messages."},{"line_number":185,"context_line":"* Allow egress non-IP traffic from all MAC addresses including the MAC address"},{"line_number":186,"context_line":"  of the port for the instance and MAC addresses in ``allowed-address-pairs``."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Although non-IP traffic, security groups do not implicitly allow all ARP"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_c10319b7","line":185,"range":{"start_line":185,"start_character":35,"end_line":185,"end_character":78},"updated":"2016-08-31 21:35:03.000000000","message":"This is confusing, I read this as all MAC addresses: 00:00:00:00:00:00 through FF:FF:FF:FF:FF:FF including the specific addresses on the port object and in the allowed-address-pair list which would be already be included in the set of all addresses.","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"961e1366e72cadae6e140c2297598d69e8e8836f","unresolved":false,"context_lines":[{"line_number":182,"context_line":"  messages that use the source MAC address of a particular instance and"},{"line_number":183,"context_line":"  the unspecified IPv6 address (::). Duplicate address detection (DAD) relies"},{"line_number":184,"context_line":"  on these messages."},{"line_number":185,"context_line":"* Allow egress non-IP traffic from all MAC addresses including the MAC address"},{"line_number":186,"context_line":"  of the port for the instance and MAC addresses in ``allowed-address-pairs``."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Although non-IP traffic, security groups do not implicitly allow all ARP"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa7ab95a_979eb352","line":185,"range":{"start_line":185,"start_character":35,"end_line":185,"end_character":78},"in_reply_to":"fa7ab95a_c10319b7","updated":"2016-08-31 22:39:19.000000000","message":"Done","commit_id":"d88cdc550a35aebf5d4746111dd5f7b3442e11cb"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"0dfec6506f3ee5c17e3e59b8c483011cde3f4a8a","unresolved":false,"context_lines":[{"line_number":141,"context_line":"Security groups provide a container for virtual firewall rules that control"},{"line_number":142,"context_line":"ingress (inbound to instances) and egress (outbound from instances) network"},{"line_number":143,"context_line":"traffic at the port level. Security groups use a default deny policy and"},{"line_number":144,"context_line":"only contain rules that allow specific traffic. Each port in a subnet can"},{"line_number":145,"context_line":"reference one or more security groups in an additive fashion. The firewall"},{"line_number":146,"context_line":"driver translates security group rules to a configuration for the underlying"},{"line_number":147,"context_line":"packet filtering technology such as ``iptables``."}],"source_content_type":"text/x-rst","patch_set":10,"id":"fa7ab95a_1a92ca4b","line":144,"range":{"start_line":144,"start_character":58,"end_line":144,"end_character":69},"updated":"2016-08-31 23:09:40.000000000","message":"Ports can have fixed-ips from multiple subnets e.g. a dual stack or multiple IPv6 prefixes. I\u0027m not sure what additional information the phrase \"in a subnet\" is trying to convey, but \"in a Neutron network\" (to clarify we are referring to Neutron\u0027s concept of a network, rather than a more general compute network) would be more precise. I would also be fine dropping this phrase entirely.","commit_id":"fcaf2f834b07c6f793f5427f688c3e27f54a404a"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"0a7a36b57f98bfa6ea6e65ae1760bc440fefbf33","unresolved":false,"context_lines":[{"line_number":141,"context_line":"Security groups provide a container for virtual firewall rules that control"},{"line_number":142,"context_line":"ingress (inbound to instances) and egress (outbound from instances) network"},{"line_number":143,"context_line":"traffic at the port level. Security groups use a default deny policy and"},{"line_number":144,"context_line":"only contain rules that allow specific traffic. Each port in a subnet can"},{"line_number":145,"context_line":"reference one or more security groups in an additive fashion. The firewall"},{"line_number":146,"context_line":"driver translates security group rules to a configuration for the underlying"},{"line_number":147,"context_line":"packet filtering technology such as ``iptables``."}],"source_content_type":"text/x-rst","patch_set":10,"id":"fa7ab95a_1031c90b","line":144,"range":{"start_line":144,"start_character":58,"end_line":144,"end_character":69},"in_reply_to":"fa7ab95a_1a92ca4b","updated":"2016-09-01 00:05:02.000000000","message":"Done","commit_id":"fcaf2f834b07c6f793f5427f688c3e27f54a404a"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"0a7a36b57f98bfa6ea6e65ae1760bc440fefbf33","unresolved":false,"context_lines":[{"line_number":141,"context_line":"Security groups provide a container for virtual firewall rules that control"},{"line_number":142,"context_line":"ingress (inbound to instances) and egress (outbound from instances) network"},{"line_number":143,"context_line":"traffic at the port level. Security groups use a default deny policy and"},{"line_number":144,"context_line":"only contain rules that allow specific traffic. Each port in a subnet can"},{"line_number":145,"context_line":"reference one or more security groups in an additive fashion. The firewall"},{"line_number":146,"context_line":"driver translates security group rules to a configuration for the underlying"},{"line_number":147,"context_line":"packet filtering technology such as ``iptables``."}],"source_content_type":"text/x-rst","patch_set":10,"id":"fa7ab95a_f0538537","line":144,"range":{"start_line":144,"start_character":58,"end_line":144,"end_character":69},"in_reply_to":"fa7ab95a_1a92ca4b","updated":"2016-09-01 00:05:02.000000000","message":"Done","commit_id":"fcaf2f834b07c6f793f5427f688c3e27f54a404a"},{"author":{"_account_id":10558,"name":"Dustin Lundquist","email":"dustin@null-ptr.net","username":"dlundquist"},"change_message_id":"0dfec6506f3ee5c17e3e59b8c483011cde3f4a8a","unresolved":false,"context_lines":[{"line_number":196,"context_line":"these rules."},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"You can disable security groups including basic and anti-spoofing rules"},{"line_number":199,"context_line":"(except ARP) by setting the port attribute ``port_security_enabled`` to"},{"line_number":200,"context_line":"``False``."},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"Extensions"}],"source_content_type":"text/x-rst","patch_set":10,"id":"fa7ab95a_35779fa0","line":199,"range":{"start_line":199,"start_character":0,"end_line":199,"end_character":12},"updated":"2016-08-31 23:09:40.000000000","message":"Really? ARP filtering is still in place when port_security_enabled is set to False? This is not the case in the linuxbridge agent: https://github.com/openstack/neutron/blob/cc275e4/neutron/plugins/ml2/drivers/linuxbridge/agent/arp_protect.py#L31-L36.","commit_id":"fcaf2f834b07c6f793f5427f688c3e27f54a404a"},{"author":{"_account_id":9515,"name":"Matthew Kassawara","email":"mkassawara@gmail.com","username":"ionosphere80"},"change_message_id":"0a7a36b57f98bfa6ea6e65ae1760bc440fefbf33","unresolved":false,"context_lines":[{"line_number":196,"context_line":"these rules."},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"You can disable security groups including basic and anti-spoofing rules"},{"line_number":199,"context_line":"(except ARP) by setting the port attribute ``port_security_enabled`` to"},{"line_number":200,"context_line":"``False``."},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"Extensions"}],"source_content_type":"text/x-rst","patch_set":10,"id":"fa7ab95a_0b26fab9","line":199,"range":{"start_line":199,"start_character":0,"end_line":199,"end_character":12},"in_reply_to":"fa7ab95a_35779fa0","updated":"2016-09-01 00:05:02.000000000","message":"Done","commit_id":"fcaf2f834b07c6f793f5427f688c3e27f54a404a"}]}