)]}'
{"security-notes/OSSN-0020":[{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d60f6bf0e7195410e2abe5647a4dc8e5c846c4ad","unresolved":false,"context_lines":[{"line_number":7,"context_line":"uses the term \"floating IP\" to refer to an IP address (typically"},{"line_number":8,"context_line":"public) that can be dynamically added to a running virtual instance."},{"line_number":9,"context_line":"OpenStack Compute uses Network Address Translation (NAT) to assign"},{"line_number":10,"context_line":"floating IPs to virtual instances. Floating IPs can dynamically be"},{"line_number":11,"context_line":"released from a running virtual instance but any active connections are"},{"line_number":12,"context_line":"not terminated with this release, as expected."},{"line_number":13,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_97aae86e","line":10,"updated":"2014-08-18 14:33:29.000000000","message":"Change the word order here.  I would say \"can be dynamically\".","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d94b09730b20943d9401d881fc53c5b6adc91722","unresolved":false,"context_lines":[{"line_number":7,"context_line":"uses the term \"floating IP\" to refer to an IP address (typically"},{"line_number":8,"context_line":"public) that can be dynamically added to a running virtual instance."},{"line_number":9,"context_line":"OpenStack Compute uses Network Address Translation (NAT) to assign"},{"line_number":10,"context_line":"floating IPs to virtual instances. Floating IPs can dynamically be"},{"line_number":11,"context_line":"released from a running virtual instance but any active connections are"},{"line_number":12,"context_line":"not terminated with this release, as expected."},{"line_number":13,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_122c0f99","line":10,"in_reply_to":"1abeadc6_97aae86e","updated":"2014-08-21 20:31:38.000000000","message":"Done","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d60f6bf0e7195410e2abe5647a4dc8e5c846c4ad","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Neutron, Icehouse, Havana, Grizzly, Folsom"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"### Discussion ###"},{"line_number":18,"context_line":"Floating IPs are not allocated to virtual instances by default. Users"},{"line_number":19,"context_line":"need to explicitly allocate it to their virtual instance. After a"},{"line_number":20,"context_line":"virtual instance is created, a floating IP address can be associated to"},{"line_number":21,"context_line":"that instance. Users can create connections to the virtual instance"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_57f5b081","line":18,"updated":"2014-08-18 14:33:29.000000000","message":"I would make this first sentence singular, as that is how the rest of the paragraph reads.  I would change the beginning of the paragraph to read:\n\n\"When creating a virtual instance, a floating IP address is not allocated by default.  After a virtual instance is created, a user can explicitly associate a floating IP address to that instance.\"","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d94b09730b20943d9401d881fc53c5b6adc91722","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Neutron, Icehouse, Havana, Grizzly, Folsom"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"### Discussion ###"},{"line_number":18,"context_line":"Floating IPs are not allocated to virtual instances by default. Users"},{"line_number":19,"context_line":"need to explicitly allocate it to their virtual instance. After a"},{"line_number":20,"context_line":"virtual instance is created, a floating IP address can be associated to"},{"line_number":21,"context_line":"that instance. Users can create connections to the virtual instance"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_32210ba0","line":18,"in_reply_to":"1abeadc6_57f5b081","updated":"2014-08-21 20:31:38.000000000","message":"Done","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d60f6bf0e7195410e2abe5647a4dc8e5c846c4ad","unresolved":false,"context_lines":[{"line_number":22,"context_line":"using this floating IP address. Also, this floating IP address can be"},{"line_number":23,"context_line":"disassociated from any running instance without shutting it down."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"If a user initiates an SSH connection using floating IP address, this"},{"line_number":26,"context_line":"connection remains alive and accessible even after the floating IP"},{"line_number":27,"context_line":"address is released from that instance. The same applies to any TCP"},{"line_number":28,"context_line":"connections. This potentially violates restrictive policy which are"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_97a7484f","line":25,"updated":"2014-08-18 14:33:29.000000000","message":"Don\u0027t reference SSH here.  This applies to any connection.","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d94b09730b20943d9401d881fc53c5b6adc91722","unresolved":false,"context_lines":[{"line_number":22,"context_line":"using this floating IP address. Also, this floating IP address can be"},{"line_number":23,"context_line":"disassociated from any running instance without shutting it down."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"If a user initiates an SSH connection using floating IP address, this"},{"line_number":26,"context_line":"connection remains alive and accessible even after the floating IP"},{"line_number":27,"context_line":"address is released from that instance. The same applies to any TCP"},{"line_number":28,"context_line":"connections. This potentially violates restrictive policy which are"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_522687b8","line":25,"in_reply_to":"1abeadc6_97a7484f","updated":"2014-08-21 20:31:38.000000000","message":"Done","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d60f6bf0e7195410e2abe5647a4dc8e5c846c4ad","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"If a user initiates an SSH connection using floating IP address, this"},{"line_number":26,"context_line":"connection remains alive and accessible even after the floating IP"},{"line_number":27,"context_line":"address is released from that instance. The same applies to any TCP"},{"line_number":28,"context_line":"connections. This potentially violates restrictive policy which are"},{"line_number":29,"context_line":"only being applied to new connections. These policies are ignored for"},{"line_number":30,"context_line":"pre-existing connections and the virtual instance remains accessible"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_375e7446","line":27,"updated":"2014-08-18 14:33:29.000000000","message":"You should be able to remove this \"...applies to any TCP...\" sentence once the SSH reference is removed above.","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d94b09730b20943d9401d881fc53c5b6adc91722","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"If a user initiates an SSH connection using floating IP address, this"},{"line_number":26,"context_line":"connection remains alive and accessible even after the floating IP"},{"line_number":27,"context_line":"address is released from that instance. The same applies to any TCP"},{"line_number":28,"context_line":"connections. This potentially violates restrictive policy which are"},{"line_number":29,"context_line":"only being applied to new connections. These policies are ignored for"},{"line_number":30,"context_line":"pre-existing connections and the virtual instance remains accessible"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_723aa3ce","line":27,"in_reply_to":"1abeadc6_375e7446","updated":"2014-08-21 20:31:38.000000000","message":"Done","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d60f6bf0e7195410e2abe5647a4dc8e5c846c4ad","unresolved":false,"context_lines":[{"line_number":25,"context_line":"If a user initiates an SSH connection using floating IP address, this"},{"line_number":26,"context_line":"connection remains alive and accessible even after the floating IP"},{"line_number":27,"context_line":"address is released from that instance. The same applies to any TCP"},{"line_number":28,"context_line":"connections. This potentially violates restrictive policy which are"},{"line_number":29,"context_line":"only being applied to new connections. These policies are ignored for"},{"line_number":30,"context_line":"pre-existing connections and the virtual instance remains accessible"},{"line_number":31,"context_line":"from internet."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_b731a40d","line":28,"updated":"2014-08-18 14:33:29.000000000","message":"Change \"policy\" to \"policies\".","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d94b09730b20943d9401d881fc53c5b6adc91722","unresolved":false,"context_lines":[{"line_number":25,"context_line":"If a user initiates an SSH connection using floating IP address, this"},{"line_number":26,"context_line":"connection remains alive and accessible even after the floating IP"},{"line_number":27,"context_line":"address is released from that instance. The same applies to any TCP"},{"line_number":28,"context_line":"connections. This potentially violates restrictive policy which are"},{"line_number":29,"context_line":"only being applied to new connections. These policies are ignored for"},{"line_number":30,"context_line":"pre-existing connections and the virtual instance remains accessible"},{"line_number":31,"context_line":"from internet."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_92373fe3","line":28,"in_reply_to":"1abeadc6_b731a40d","updated":"2014-08-21 20:31:38.000000000","message":"Done","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d60f6bf0e7195410e2abe5647a4dc8e5c846c4ad","unresolved":false,"context_lines":[{"line_number":28,"context_line":"connections. This potentially violates restrictive policy which are"},{"line_number":29,"context_line":"only being applied to new connections. These policies are ignored for"},{"line_number":30,"context_line":"pre-existing connections and the virtual instance remains accessible"},{"line_number":31,"context_line":"from internet."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"- Only attach floating IP address to a virtual instance when that"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_da048517","line":31,"updated":"2014-08-18 14:33:29.000000000","message":"I wouldn\u0027t say \"internet\" here, as we don\u0027t know if the floating IP network is internet accessible.","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d94b09730b20943d9401d881fc53c5b6adc91722","unresolved":false,"context_lines":[{"line_number":28,"context_line":"connections. This potentially violates restrictive policy which are"},{"line_number":29,"context_line":"only being applied to new connections. These policies are ignored for"},{"line_number":30,"context_line":"pre-existing connections and the virtual instance remains accessible"},{"line_number":31,"context_line":"from internet."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"- Only attach floating IP address to a virtual instance when that"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_12532f18","line":31,"in_reply_to":"1abeadc6_da048517","updated":"2014-08-21 20:31:38.000000000","message":"replacing \"internet\" with \"public network\". Thanks!","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d60f6bf0e7195410e2abe5647a4dc8e5c846c4ad","unresolved":false,"context_lines":[{"line_number":31,"context_line":"from internet."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"- Only attach floating IP address to a virtual instance when that"},{"line_number":35,"context_line":"instance should be accessible from networks outside the cloud,"},{"line_number":36,"context_line":"including the Internet."},{"line_number":37,"context_line":"- Terminate all connections to a virtual instance before releasing"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_7a4b7159","line":34,"updated":"2014-08-18 14:33:29.000000000","message":"\"...attach a floating...\"","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d94b09730b20943d9401d881fc53c5b6adc91722","unresolved":false,"context_lines":[{"line_number":31,"context_line":"from internet."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"- Only attach floating IP address to a virtual instance when that"},{"line_number":35,"context_line":"instance should be accessible from networks outside the cloud,"},{"line_number":36,"context_line":"including the Internet."},{"line_number":37,"context_line":"- Terminate all connections to a virtual instance before releasing"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_7241c338","line":34,"in_reply_to":"1abeadc6_7a4b7159","updated":"2014-08-21 20:31:38.000000000","message":"Done","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d60f6bf0e7195410e2abe5647a4dc8e5c846c4ad","unresolved":false,"context_lines":[{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"- Only attach floating IP address to a virtual instance when that"},{"line_number":35,"context_line":"instance should be accessible from networks outside the cloud,"},{"line_number":36,"context_line":"including the Internet."},{"line_number":37,"context_line":"- Terminate all connections to a virtual instance before releasing"},{"line_number":38,"context_line":"floating IP address."},{"line_number":39,"context_line":"- Set the appropriate quota for number of floating IPs allowed per"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_da3c8596","line":36,"updated":"2014-08-18 14:33:29.000000000","message":"I think you can just drop the \"...including the Internet\" part of this.","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d94b09730b20943d9401d881fc53c5b6adc91722","unresolved":false,"context_lines":[{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"- Only attach floating IP address to a virtual instance when that"},{"line_number":35,"context_line":"instance should be accessible from networks outside the cloud,"},{"line_number":36,"context_line":"including the Internet."},{"line_number":37,"context_line":"- Terminate all connections to a virtual instance before releasing"},{"line_number":38,"context_line":"floating IP address."},{"line_number":39,"context_line":"- Set the appropriate quota for number of floating IPs allowed per"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_923e5fb7","line":36,"in_reply_to":"1abeadc6_da3c8596","updated":"2014-08-21 20:31:38.000000000","message":"Done","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d60f6bf0e7195410e2abe5647a4dc8e5c846c4ad","unresolved":false,"context_lines":[{"line_number":35,"context_line":"instance should be accessible from networks outside the cloud,"},{"line_number":36,"context_line":"including the Internet."},{"line_number":37,"context_line":"- Terminate all connections to a virtual instance before releasing"},{"line_number":38,"context_line":"floating IP address."},{"line_number":39,"context_line":"- Set the appropriate quota for number of floating IPs allowed per"},{"line_number":40,"context_line":"tenant to limit its usage. You can set this quota in Neutron config"},{"line_number":41,"context_line":"file \"neutron.conf\" using:"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_7ae7f140","line":38,"updated":"2014-08-18 14:33:29.000000000","message":"\"...a floating IP...\"","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d94b09730b20943d9401d881fc53c5b6adc91722","unresolved":false,"context_lines":[{"line_number":35,"context_line":"instance should be accessible from networks outside the cloud,"},{"line_number":36,"context_line":"including the Internet."},{"line_number":37,"context_line":"- Terminate all connections to a virtual instance before releasing"},{"line_number":38,"context_line":"floating IP address."},{"line_number":39,"context_line":"- Set the appropriate quota for number of floating IPs allowed per"},{"line_number":40,"context_line":"tenant to limit its usage. You can set this quota in Neutron config"},{"line_number":41,"context_line":"file \"neutron.conf\" using:"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_b24b5b58","line":38,"in_reply_to":"1abeadc6_7ae7f140","updated":"2014-08-21 20:31:38.000000000","message":"Done","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"d60f6bf0e7195410e2abe5647a4dc8e5c846c4ad","unresolved":false,"context_lines":[{"line_number":36,"context_line":"including the Internet."},{"line_number":37,"context_line":"- Terminate all connections to a virtual instance before releasing"},{"line_number":38,"context_line":"floating IP address."},{"line_number":39,"context_line":"- Set the appropriate quota for number of floating IPs allowed per"},{"line_number":40,"context_line":"tenant to limit its usage. You can set this quota in Neutron config"},{"line_number":41,"context_line":"file \"neutron.conf\" using:"},{"line_number":42,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_3add7971","line":39,"updated":"2014-08-18 14:33:29.000000000","message":"\"...for the number...\"\n\nI would also say \"floating IP addresses\" instead of just \"floating IPs\" to be consistent.","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"d94b09730b20943d9401d881fc53c5b6adc91722","unresolved":false,"context_lines":[{"line_number":36,"context_line":"including the Internet."},{"line_number":37,"context_line":"- Terminate all connections to a virtual instance before releasing"},{"line_number":38,"context_line":"floating IP address."},{"line_number":39,"context_line":"- Set the appropriate quota for number of floating IPs allowed per"},{"line_number":40,"context_line":"tenant to limit its usage. You can set this quota in Neutron config"},{"line_number":41,"context_line":"file \"neutron.conf\" using:"},{"line_number":42,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"1abeadc6_127a4f88","line":39,"in_reply_to":"1abeadc6_3add7971","updated":"2014-08-21 20:31:38.000000000","message":"Done","commit_id":"9a217f0476d8502685473499b2370fd10235acb4"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"c6f40e9f0830ccb9ebba549e324b671f2df4243e","unresolved":false,"context_lines":[{"line_number":27,"context_line":"address is released from that instance. This potentially violates"},{"line_number":28,"context_line":"restrictive policies which are only being applied to new connections."},{"line_number":29,"context_line":"These policies are ignored for pre-existing connections and the virtual"},{"line_number":30,"context_line":"instance remains accessible from public network."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"### Recommended Actions ###"},{"line_number":33,"context_line":"- Only attach a floating IP address to a virtual instance when that"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_55b671da","line":30,"updated":"2014-08-19 01:06:03.000000000","message":"Add \"the\":\n\n  \"...the public network.\"","commit_id":"a0eb3df0da592de916e3881b9e05d0705c04c897"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"c6f40e9f0830ccb9ebba549e324b671f2df4243e","unresolved":false,"context_lines":[{"line_number":36,"context_line":"floating IP address."},{"line_number":37,"context_line":"- Set the appropriate quota for the number of floating IP addresses"},{"line_number":38,"context_line":"allowed per tenant to limit its usage. You can set this quota in"},{"line_number":39,"context_line":"Neutron config file \"neutron.conf\" using:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"--- begin example neutron.conf snippet ---"},{"line_number":42,"context_line":"    # Number of floating IPs allowed per tenant."}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1abeadc6_55ed91c2","line":39,"updated":"2014-08-19 01:06:03.000000000","message":"Add \"the\":\n\n  \"...the Neutron config...\"","commit_id":"a0eb3df0da592de916e3881b9e05d0705c04c897"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"eb58708d9703d0586daabcd5df595a460f65cb5b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Disassociating floating IPs from a VM does not terminate NAT connections"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_a5ac6a8d","line":1,"updated":"2014-08-22 02:29:54.000000000","message":"I think this is only true if a plugin is using the L3-agent. If you\u0027re using another plugin that doesn\u0027t use that (for example the NSX plugin) I know the connections are terminated. I think we should update this to say that it only affects the l3-agent.","commit_id":"c6d7ca3e995d230b9d84e4b1f6809378a923a44d"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"dceac523b155271fa4893977eefbcce15a495cf2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Disassociating floating IPs from a VM does not terminate NAT connections"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"fa98f980_9a388ad4","line":1,"in_reply_to":"1abeadc6_a5ac6a8d","updated":"2014-09-04 18:18:27.000000000","message":"Updated Title: \n\nDisassociating floating IPs from a VM does not terminate NAT connections  with L3 Agent","commit_id":"c6d7ca3e995d230b9d84e4b1f6809378a923a44d"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"7f150f64d24fb6acc2b37e6fa20d45d1c821197b","unresolved":false,"context_lines":[{"line_number":33,"context_line":"- Only attach a floating IP address to a virtual instance when that"},{"line_number":34,"context_line":"  instance should be accessible from networks outside the cloud."},{"line_number":35,"context_line":"- Terminate all connections to a virtual instance before releasing a"},{"line_number":36,"context_line":"  floating IP address."},{"line_number":37,"context_line":"- Set the appropriate quota for the number of floating IP addresses"},{"line_number":38,"context_line":"  allowed per tenant to limit its usage. You can set this quota in the"},{"line_number":39,"context_line":"  Neutron config file \"neutron.conf\" using:"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_0e911f47","line":36,"updated":"2014-08-19 20:45:09.000000000","message":"It isn\u0027t the known connections that they should be worried about.  It is the unknown connections that they should be worried about.  So, how are they going to terminate the connections they aren\u0027t aware of?\n\nMaybe if they are sensitive to this issue we should recommend destroying the instance along with disassociating the floating ip.","commit_id":"c6d7ca3e995d230b9d84e4b1f6809378a923a44d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"71658397a9407c93ba05c5beeca84d4a54b911ac","unresolved":false,"context_lines":[{"line_number":33,"context_line":"- Only attach a floating IP address to a virtual instance when that"},{"line_number":34,"context_line":"  instance should be accessible from networks outside the cloud."},{"line_number":35,"context_line":"- Terminate all connections to a virtual instance before releasing a"},{"line_number":36,"context_line":"  floating IP address."},{"line_number":37,"context_line":"- Set the appropriate quota for the number of floating IP addresses"},{"line_number":38,"context_line":"  allowed per tenant to limit its usage. You can set this quota in the"},{"line_number":39,"context_line":"  Neutron config file \"neutron.conf\" using:"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_28116e05","line":36,"in_reply_to":"1abeadc6_0e911f47","updated":"2014-08-19 22:07:42.000000000","message":"I like the idea of recommending that an instance be terminated along with disassociating the floating IP if possible.\n\nI suppose something like tcpkill can\u0027t be recommended since you wouldn\u0027t be able to identity the connections coming over the floating IP due to NAT, right?  If that\u0027s the case, there is really nothing that we can recommend aside from destroying instances.","commit_id":"c6d7ca3e995d230b9d84e4b1f6809378a923a44d"},{"author":{"_account_id":11933,"name":"Randy Perryman","email":"randy@whioak.com","username":"randy"},"change_message_id":"01dce4ee151ff522cdbb20ff21bdbda9e5e1e24f","unresolved":false,"context_lines":[{"line_number":33,"context_line":"- Only attach a floating IP address to a virtual instance when that"},{"line_number":34,"context_line":"  instance should be accessible from networks outside the cloud."},{"line_number":35,"context_line":"- Terminate all connections to a virtual instance before releasing a"},{"line_number":36,"context_line":"  floating IP address."},{"line_number":37,"context_line":"- Set the appropriate quota for the number of floating IP addresses"},{"line_number":38,"context_line":"  allowed per tenant to limit its usage. You can set this quota in the"},{"line_number":39,"context_line":"  Neutron config file \"neutron.conf\" using:"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_62b895c8","line":36,"in_reply_to":"1abeadc6_28116e05","updated":"2014-08-21 18:02:17.000000000","message":"It should be possible to list all active NAT Translations between the floating IP and other destinations.  Using the information terminating them is possible.\n\nShould mention of TTL for NAT Translation be mentioned here?","commit_id":"c6d7ca3e995d230b9d84e4b1f6809378a923a44d"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6909618d9d8315e92644d2a4ce8d86ec67f34334","unresolved":false,"context_lines":[{"line_number":33,"context_line":"- Only attach a floating IP address to a virtual instance when that"},{"line_number":34,"context_line":"  instance should be accessible from networks outside the cloud."},{"line_number":35,"context_line":"- Terminate all connections to a virtual instance before releasing a"},{"line_number":36,"context_line":"  floating IP address."},{"line_number":37,"context_line":"- Set the appropriate quota for the number of floating IP addresses"},{"line_number":38,"context_line":"  allowed per tenant to limit its usage. You can set this quota in the"},{"line_number":39,"context_line":"  Neutron config file \"neutron.conf\" using:"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_f138edd4","line":36,"in_reply_to":"1abeadc6_62b895c8","updated":"2014-08-21 20:30:50.000000000","message":"I am trying to find out how to generate such listing of all active NAT Translations between the floating IP and other destinations.\n\nBut I believe the person/application creating a VM might not have privileges to generate such listing.","commit_id":"c6d7ca3e995d230b9d84e4b1f6809378a923a44d"},{"author":{"_account_id":7448,"name":"Carl Baldwin","email":"carl@ecbaldwin.net","username":"carl-baldwin"},"change_message_id":"7f150f64d24fb6acc2b37e6fa20d45d1c821197b","unresolved":false,"context_lines":[{"line_number":34,"context_line":"  instance should be accessible from networks outside the cloud."},{"line_number":35,"context_line":"- Terminate all connections to a virtual instance before releasing a"},{"line_number":36,"context_line":"  floating IP address."},{"line_number":37,"context_line":"- Set the appropriate quota for the number of floating IP addresses"},{"line_number":38,"context_line":"  allowed per tenant to limit its usage. You can set this quota in the"},{"line_number":39,"context_line":"  Neutron config file \"neutron.conf\" using:"},{"line_number":40,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_4e9b1767","line":37,"updated":"2014-08-19 20:45:09.000000000","message":"I\u0027m not sure how this helps.","commit_id":"c6d7ca3e995d230b9d84e4b1f6809378a923a44d"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f8cfa06912ab2653e872569ef8eea05343806be9","unresolved":false,"context_lines":[{"line_number":34,"context_line":"  instance should be accessible from networks outside the cloud."},{"line_number":35,"context_line":"- Terminate all connections to a virtual instance before releasing a"},{"line_number":36,"context_line":"  floating IP address."},{"line_number":37,"context_line":"- Set the appropriate quota for the number of floating IP addresses"},{"line_number":38,"context_line":"  allowed per tenant to limit its usage. You can set this quota in the"},{"line_number":39,"context_line":"  Neutron config file \"neutron.conf\" using:"},{"line_number":40,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_76321360","line":37,"updated":"2014-08-21 20:16:59.000000000","message":"If there is a tool that can list connections through the floating IP, can we put a code snippet here?  I favor keeping as much of the implementation details in OSSNs as possible.","commit_id":"c6d7ca3e995d230b9d84e4b1f6809378a923a44d"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"71658397a9407c93ba05c5beeca84d4a54b911ac","unresolved":false,"context_lines":[{"line_number":34,"context_line":"  instance should be accessible from networks outside the cloud."},{"line_number":35,"context_line":"- Terminate all connections to a virtual instance before releasing a"},{"line_number":36,"context_line":"  floating IP address."},{"line_number":37,"context_line":"- Set the appropriate quota for the number of floating IP addresses"},{"line_number":38,"context_line":"  allowed per tenant to limit its usage. You can set this quota in the"},{"line_number":39,"context_line":"  Neutron config file \"neutron.conf\" using:"},{"line_number":40,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_a8f2decf","line":37,"in_reply_to":"1abeadc6_4e9b1767","updated":"2014-08-19 22:07:42.000000000","message":"Agreed.  This should be removed.  If someone needs floating IPs, they are going to use them.  The number of floating IPs in use by a tenant doesn\u0027t affect this problem.","commit_id":"c6d7ca3e995d230b9d84e4b1f6809378a923a44d"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6909618d9d8315e92644d2a4ce8d86ec67f34334","unresolved":false,"context_lines":[{"line_number":34,"context_line":"  instance should be accessible from networks outside the cloud."},{"line_number":35,"context_line":"- Terminate all connections to a virtual instance before releasing a"},{"line_number":36,"context_line":"  floating IP address."},{"line_number":37,"context_line":"- Set the appropriate quota for the number of floating IP addresses"},{"line_number":38,"context_line":"  allowed per tenant to limit its usage. You can set this quota in the"},{"line_number":39,"context_line":"  Neutron config file \"neutron.conf\" using:"},{"line_number":40,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1abeadc6_5614379f","line":37,"in_reply_to":"1abeadc6_a8f2decf","updated":"2014-08-21 20:30:50.000000000","message":"Yeah, agree. I will remove this from the list of recommended actions.","commit_id":"c6d7ca3e995d230b9d84e4b1f6809378a923a44d"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3001217b4d6e94bf15cc8c468a5f3fd13f96dd80","unresolved":false,"context_lines":[{"line_number":10,"context_line":"OpenStack Compute uses Network Address Translation (NAT) to assign"},{"line_number":11,"context_line":"floating IPs to virtual instances. Floating IPs can be dynamically"},{"line_number":12,"context_line":"released from a running virtual instance but any active connections are"},{"line_number":13,"context_line":"not terminated with this release, as expected."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Affected Services / Software ###"},{"line_number":16,"context_line":"Neutron, Icehouse, Havana, Grizzly, Folsom"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_31d41ceb","line":13,"updated":"2014-09-04 22:31:07.000000000","message":"I think we need to remove the comma here.  The way it currently reads it sounds like this behavior is to be expected.  It should read ...\"with this release as expected.\"","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"123a9088e85c70a740b9e7e9bb67fd7944a5adab","unresolved":false,"context_lines":[{"line_number":10,"context_line":"OpenStack Compute uses Network Address Translation (NAT) to assign"},{"line_number":11,"context_line":"floating IPs to virtual instances. Floating IPs can be dynamically"},{"line_number":12,"context_line":"released from a running virtual instance but any active connections are"},{"line_number":13,"context_line":"not terminated with this release, as expected."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Affected Services / Software ###"},{"line_number":16,"context_line":"Neutron, Icehouse, Havana, Grizzly, Folsom"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_69bd8202","line":13,"in_reply_to":"fa98f980_31d41ceb","updated":"2014-09-08 18:41:36.000000000","message":"Done","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3001217b4d6e94bf15cc8c468a5f3fd13f96dd80","unresolved":false,"context_lines":[{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"When creating a virtual instance, a floating IP address is not"},{"line_number":20,"context_line":"allocated by default. After a virtual instance is created, a user can"},{"line_number":21,"context_line":"explicitly associate a floating IP address to that instance. Users can"},{"line_number":22,"context_line":"create connections to the virtual instance using this floating IP"},{"line_number":23,"context_line":"address. Also, this floating IP address can be disassociated from any"},{"line_number":24,"context_line":"running instance without shutting it down."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_714dc4c3","line":21,"updated":"2014-09-04 22:31:07.000000000","message":"Do we want to mention that the floating IP address is available outside the instance?","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"123a9088e85c70a740b9e7e9bb67fd7944a5adab","unresolved":false,"context_lines":[{"line_number":18,"context_line":"### Discussion ###"},{"line_number":19,"context_line":"When creating a virtual instance, a floating IP address is not"},{"line_number":20,"context_line":"allocated by default. After a virtual instance is created, a user can"},{"line_number":21,"context_line":"explicitly associate a floating IP address to that instance. Users can"},{"line_number":22,"context_line":"create connections to the virtual instance using this floating IP"},{"line_number":23,"context_line":"address. Also, this floating IP address can be disassociated from any"},{"line_number":24,"context_line":"running instance without shutting it down."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_e925f25c","line":21,"in_reply_to":"fa98f980_714dc4c3","updated":"2014-09-08 18:41:36.000000000","message":"Yes, it\u0027s a valid behavior. Cloud users can associate floating IP based on need, after an instance is created.","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3001217b4d6e94bf15cc8c468a5f3fd13f96dd80","unresolved":false,"context_lines":[{"line_number":21,"context_line":"explicitly associate a floating IP address to that instance. Users can"},{"line_number":22,"context_line":"create connections to the virtual instance using this floating IP"},{"line_number":23,"context_line":"address. Also, this floating IP address can be disassociated from any"},{"line_number":24,"context_line":"running instance without shutting it down."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"If a user initiates a connection using floating IP address, this"},{"line_number":27,"context_line":"connection remains alive and accessible even after the floating IP"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_b1664c28","line":24,"updated":"2014-09-04 22:31:07.000000000","message":"this sentence is a little ambiguous, maybe \"without shutting down the instance\"?","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"123a9088e85c70a740b9e7e9bb67fd7944a5adab","unresolved":false,"context_lines":[{"line_number":21,"context_line":"explicitly associate a floating IP address to that instance. Users can"},{"line_number":22,"context_line":"create connections to the virtual instance using this floating IP"},{"line_number":23,"context_line":"address. Also, this floating IP address can be disassociated from any"},{"line_number":24,"context_line":"running instance without shutting it down."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"If a user initiates a connection using floating IP address, this"},{"line_number":27,"context_line":"connection remains alive and accessible even after the floating IP"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_09e23603","line":24,"in_reply_to":"fa98f980_b1664c28","updated":"2014-09-08 18:41:36.000000000","message":"replaced it with \"without shutting that instance down\"","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3001217b4d6e94bf15cc8c468a5f3fd13f96dd80","unresolved":false,"context_lines":[{"line_number":23,"context_line":"address. Also, this floating IP address can be disassociated from any"},{"line_number":24,"context_line":"running instance without shutting it down."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"If a user initiates a connection using floating IP address, this"},{"line_number":27,"context_line":"connection remains alive and accessible even after the floating IP"},{"line_number":28,"context_line":"address is released from that instance. This potentially violates"},{"line_number":29,"context_line":"restrictive policies which are only being applied to new connections."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_310fbc38","line":26,"updated":"2014-09-04 22:31:07.000000000","message":"using *a* floating IP address","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"123a9088e85c70a740b9e7e9bb67fd7944a5adab","unresolved":false,"context_lines":[{"line_number":23,"context_line":"address. Also, this floating IP address can be disassociated from any"},{"line_number":24,"context_line":"running instance without shutting it down."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"If a user initiates a connection using floating IP address, this"},{"line_number":27,"context_line":"connection remains alive and accessible even after the floating IP"},{"line_number":28,"context_line":"address is released from that instance. This potentially violates"},{"line_number":29,"context_line":"restrictive policies which are only being applied to new connections."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_a9a04aa6","line":26,"in_reply_to":"fa98f980_310fbc38","updated":"2014-09-08 18:41:36.000000000","message":"replaced it with, using *the* floating IP address","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3001217b4d6e94bf15cc8c468a5f3fd13f96dd80","unresolved":false,"context_lines":[{"line_number":28,"context_line":"address is released from that instance. This potentially violates"},{"line_number":29,"context_line":"restrictive policies which are only being applied to new connections."},{"line_number":30,"context_line":"These policies are ignored for pre-existing connections and the virtual"},{"line_number":31,"context_line":"instance remains accessible from public network."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"- Only attach a floating IP address to a virtual instance when that"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_3c115352","line":31,"updated":"2014-09-04 22:31:07.000000000","message":"from *the","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"123a9088e85c70a740b9e7e9bb67fd7944a5adab","unresolved":false,"context_lines":[{"line_number":28,"context_line":"address is released from that instance. This potentially violates"},{"line_number":29,"context_line":"restrictive policies which are only being applied to new connections."},{"line_number":30,"context_line":"These policies are ignored for pre-existing connections and the virtual"},{"line_number":31,"context_line":"instance remains accessible from public network."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"- Only attach a floating IP address to a virtual instance when that"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_699e6265","line":31,"in_reply_to":"fa98f980_3c115352","updated":"2014-09-08 18:41:36.000000000","message":"not sure about *the*, how about *any*?","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3001217b4d6e94bf15cc8c468a5f3fd13f96dd80","unresolved":false,"context_lines":[{"line_number":38,"context_line":"connections. It\u0027s also possible to get the list of unknown connections"},{"line_number":39,"context_line":"using connection tracking tools. The conntrack entries lists all the"},{"line_number":40,"context_line":"current entries in your conntrack database. With the ip_conntrack"},{"line_number":41,"context_line":"module loaded, a cat of /proc/net/ip_conntrack might look like:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"--- begin example ip_conntrack snippet ---"},{"line_number":44,"context_line":"tcp      6 117 SYN_SENT src\u003d192.168.1.6 dst\u003d192.168.1.9 sport\u003d32775 \\"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_1cb2cf4b","line":41,"updated":"2014-09-04 22:31:07.000000000","message":"I\u0027d say \"the output of /proc\"... rather than \"a cat\"","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"123a9088e85c70a740b9e7e9bb67fd7944a5adab","unresolved":false,"context_lines":[{"line_number":38,"context_line":"connections. It\u0027s also possible to get the list of unknown connections"},{"line_number":39,"context_line":"using connection tracking tools. The conntrack entries lists all the"},{"line_number":40,"context_line":"current entries in your conntrack database. With the ip_conntrack"},{"line_number":41,"context_line":"module loaded, a cat of /proc/net/ip_conntrack might look like:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"--- begin example ip_conntrack snippet ---"},{"line_number":44,"context_line":"tcp      6 117 SYN_SENT src\u003d192.168.1.6 dst\u003d192.168.1.9 sport\u003d32775 \\"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_499fde50","line":41,"in_reply_to":"fa98f980_1cb2cf4b","updated":"2014-09-08 18:41:36.000000000","message":"using \"cat\" as this example shows contents of the file /proc/net/ip_conntrack","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3001217b4d6e94bf15cc8c468a5f3fd13f96dd80","unresolved":false,"context_lines":[{"line_number":46,"context_line":"     dport\u003d32775 use\u003d2"},{"line_number":47,"context_line":"--- end example ip_conntrack snippet ---"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"The first column is protocol, which in this case is tcp. Next, the same"},{"line_number":50,"context_line":"value in normal decimal coding. After this, we see TTL of conntrack"},{"line_number":51,"context_line":"entry which signifies how long it has to live. This value is set to 117"},{"line_number":52,"context_line":"seconds right now and is decremented regularly until we see more"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_3cadd3e9","line":49,"updated":"2014-09-04 22:31:07.000000000","message":"is *the* protocol\n\nMaybe \"The first column is the protocol, which in this case is tcp, followed by the same value in normal decimal coding.\"","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"123a9088e85c70a740b9e7e9bb67fd7944a5adab","unresolved":false,"context_lines":[{"line_number":46,"context_line":"     dport\u003d32775 use\u003d2"},{"line_number":47,"context_line":"--- end example ip_conntrack snippet ---"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"The first column is protocol, which in this case is tcp. Next, the same"},{"line_number":50,"context_line":"value in normal decimal coding. After this, we see TTL of conntrack"},{"line_number":51,"context_line":"entry which signifies how long it has to live. This value is set to 117"},{"line_number":52,"context_line":"seconds right now and is decremented regularly until we see more"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_e9d092cb","line":49,"in_reply_to":"fa98f980_3cadd3e9","updated":"2014-09-08 18:41:36.000000000","message":"Replaced it with:\n\nThe first column is the protocol, which in this case is tcp. Next,\n 50 the same protocol is repesented in normal decimal coding.","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"3001217b4d6e94bf15cc8c468a5f3fd13f96dd80","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"The first column is protocol, which in this case is tcp. Next, the same"},{"line_number":50,"context_line":"value in normal decimal coding. After this, we see TTL of conntrack"},{"line_number":51,"context_line":"entry which signifies how long it has to live. This value is set to 117"},{"line_number":52,"context_line":"seconds right now and is decremented regularly until we see more"},{"line_number":53,"context_line":"traffic. Next comes the actual state that this entry is in at the"},{"line_number":54,"context_line":"present point of time. In this case, we are looking at a packet that is"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_bcd6234d","line":51,"updated":"2014-09-04 22:31:07.000000000","message":"I\u0027m not sure we want to list so many of these details in the OSSN, maybe point them to a document explaining how conntrack works.","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"123a9088e85c70a740b9e7e9bb67fd7944a5adab","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"The first column is protocol, which in this case is tcp. Next, the same"},{"line_number":50,"context_line":"value in normal decimal coding. After this, we see TTL of conntrack"},{"line_number":51,"context_line":"entry which signifies how long it has to live. This value is set to 117"},{"line_number":52,"context_line":"seconds right now and is decremented regularly until we see more"},{"line_number":53,"context_line":"traffic. Next comes the actual state that this entry is in at the"},{"line_number":54,"context_line":"present point of time. In this case, we are looking at a packet that is"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"fa98f980_09031674","line":51,"in_reply_to":"fa98f980_bcd6234d","updated":"2014-09-08 18:41:36.000000000","message":"This para explains format of the contents of ip_conntrack, i would suggest keeping this section as part of OSSN and making it comprehensive. Thoughts?","commit_id":"65b62cc30da1b97b85407a8daa30aeb6f23d772e"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3a73c2bab0fcd740cad97ddf098f815f2fa8ff54","unresolved":false,"context_lines":[{"line_number":10,"context_line":"OpenStack Compute uses Network Address Translation (NAT) to assign"},{"line_number":11,"context_line":"floating IPs to virtual instances. Floating IPs can be dynamically"},{"line_number":12,"context_line":"released from a running virtual instance but any active connections are"},{"line_number":13,"context_line":"not terminated with this release as expected."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Affected Services / Software ###"},{"line_number":16,"context_line":"Neutron, Icehouse, Havana, Grizzly, Folsom"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_fb5cb51b","line":13,"updated":"2014-09-09 18:01:58.000000000","message":"You should probably add \"when using the L3 agent\" here.  You currently only mention that this is specific to the L3 agent in the title, but that fact needs to be made more prominent.","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"51f6bb364235fb27d4be534c54ecfbd81fb2ff55","unresolved":false,"context_lines":[{"line_number":10,"context_line":"OpenStack Compute uses Network Address Translation (NAT) to assign"},{"line_number":11,"context_line":"floating IPs to virtual instances. Floating IPs can be dynamically"},{"line_number":12,"context_line":"released from a running virtual instance but any active connections are"},{"line_number":13,"context_line":"not terminated with this release as expected."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Affected Services / Software ###"},{"line_number":16,"context_line":"Neutron, Icehouse, Havana, Grizzly, Folsom"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_e180828d","line":13,"in_reply_to":"fa98f980_fb5cb51b","updated":"2014-09-10 19:26:04.000000000","message":"Done","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3a73c2bab0fcd740cad97ddf098f815f2fa8ff54","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"If a user initiates a connection using the floating IP address, this"},{"line_number":27,"context_line":"connection remains alive and accessible even after the floating IP"},{"line_number":28,"context_line":"address is released from that instance. This potentially violates"},{"line_number":29,"context_line":"restrictive policies which are only being applied to new connections."},{"line_number":30,"context_line":"These policies are ignored for pre-existing connections and the virtual"},{"line_number":31,"context_line":"instance remains accessible from public network."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_5b7ce172","line":28,"updated":"2014-09-09 18:01:58.000000000","message":"You should also mention that his is when using the L3 agent here.","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"51f6bb364235fb27d4be534c54ecfbd81fb2ff55","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"If a user initiates a connection using the floating IP address, this"},{"line_number":27,"context_line":"connection remains alive and accessible even after the floating IP"},{"line_number":28,"context_line":"address is released from that instance. This potentially violates"},{"line_number":29,"context_line":"restrictive policies which are only being applied to new connections."},{"line_number":30,"context_line":"These policies are ignored for pre-existing connections and the virtual"},{"line_number":31,"context_line":"instance remains accessible from public network."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_017ca6b4","line":28,"in_reply_to":"fa98f980_5b7ce172","updated":"2014-09-10 19:26:04.000000000","message":"Done","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3a73c2bab0fcd740cad97ddf098f815f2fa8ff54","unresolved":false,"context_lines":[{"line_number":28,"context_line":"address is released from that instance. This potentially violates"},{"line_number":29,"context_line":"restrictive policies which are only being applied to new connections."},{"line_number":30,"context_line":"These policies are ignored for pre-existing connections and the virtual"},{"line_number":31,"context_line":"instance remains accessible from public network."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"- Only attach a floating IP address to a virtual instance when that"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_bbd78d4e","line":31,"updated":"2014-09-09 18:01:58.000000000","message":"You should add the word \"the\" back in as you had it in your previous patch.  This sentence doesn\u0027t read properly without it.","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"51f6bb364235fb27d4be534c54ecfbd81fb2ff55","unresolved":false,"context_lines":[{"line_number":28,"context_line":"address is released from that instance. This potentially violates"},{"line_number":29,"context_line":"restrictive policies which are only being applied to new connections."},{"line_number":30,"context_line":"These policies are ignored for pre-existing connections and the virtual"},{"line_number":31,"context_line":"instance remains accessible from public network."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Actions ###"},{"line_number":34,"context_line":"- Only attach a floating IP address to a virtual instance when that"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_214a8a83","line":31,"in_reply_to":"fa98f980_bbd78d4e","updated":"2014-09-10 19:26:04.000000000","message":"Done","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3a73c2bab0fcd740cad97ddf098f815f2fa8ff54","unresolved":false,"context_lines":[{"line_number":36,"context_line":"- Terminate all connections to a virtual instance before releasing a"},{"line_number":37,"context_line":"floating IP address. It\u0027s simple and easy to terminate all known"},{"line_number":38,"context_line":"connections. It\u0027s also possible to get the list of unknown connections"},{"line_number":39,"context_line":"using connection tracking tools. The conntrack entries lists all the"},{"line_number":40,"context_line":"current entries in your conntrack database. With the ip_conntrack"},{"line_number":41,"context_line":"module loaded, a cat of /proc/net/ip_conntrack might look like:"},{"line_number":42,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_9b4ac925","line":39,"updated":"2014-09-09 18:01:58.000000000","message":"(nit) all *of* the...","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"51f6bb364235fb27d4be534c54ecfbd81fb2ff55","unresolved":false,"context_lines":[{"line_number":36,"context_line":"- Terminate all connections to a virtual instance before releasing a"},{"line_number":37,"context_line":"floating IP address. It\u0027s simple and easy to terminate all known"},{"line_number":38,"context_line":"connections. It\u0027s also possible to get the list of unknown connections"},{"line_number":39,"context_line":"using connection tracking tools. The conntrack entries lists all the"},{"line_number":40,"context_line":"current entries in your conntrack database. With the ip_conntrack"},{"line_number":41,"context_line":"module loaded, a cat of /proc/net/ip_conntrack might look like:"},{"line_number":42,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_e157a224","line":39,"in_reply_to":"fa98f980_9b4ac925","updated":"2014-09-10 19:26:04.000000000","message":"Done","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"dc65bfd4139cfcaaccc0b4a8ec8bffbcc555f160","unresolved":false,"context_lines":[{"line_number":61,"context_line":"packets. The information details the source IP address and destination"},{"line_number":62,"context_line":"IP address (which are both inverted, since the packet is to be directed"},{"line_number":63,"context_line":"back to us). The same thing goes for the source port and destination"},{"line_number":64,"context_line":"port of the connection."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Kill TCP connections using tcpkill with the source port, like:"},{"line_number":67,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_3b62c0d8","line":64,"updated":"2014-09-09 15:50:03.000000000","message":"I\u0027m strongly in favor of shortening this, or moving it out.  We could describe what to look for without showing every column.  Say something like:\n\nInspect entries in \"/proc/net/ip_conntrack\" for UNREPLIED (or whatever) and kill any connections you find with \"tcpkill -9 port source_port\".  \n\nFor more information on using conntrack see the link below.\n\nThat being said if consensus is to leave this in, I\u0027m ok with it.","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3a73c2bab0fcd740cad97ddf098f815f2fa8ff54","unresolved":false,"context_lines":[{"line_number":61,"context_line":"packets. The information details the source IP address and destination"},{"line_number":62,"context_line":"IP address (which are both inverted, since the packet is to be directed"},{"line_number":63,"context_line":"back to us). The same thing goes for the source port and destination"},{"line_number":64,"context_line":"port of the connection."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Kill TCP connections using tcpkill with the source port, like:"},{"line_number":67,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_db753133","line":64,"in_reply_to":"fa98f980_3b62c0d8","updated":"2014-09-09 18:01:58.000000000","message":"I agree with Travis.\n\nI\u0027d prefer that we provide a reference to the other documentation that this came from instead of duplicating it all here.  All we need to call out here is how to identity the floating IP connections and any information that we need to pass to tcpkill to kill them.  After describing this, we can then just say:\n\n\"For a more detailed desription of conntrack entries, please see the \u003cfoo\u003e documentation listed in the references section of this note.\"","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3a73c2bab0fcd740cad97ddf098f815f2fa8ff54","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Kill TCP connections using tcpkill with the source port, like:"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"--- begin example tcpkill snippet ---"},{"line_number":69,"context_line":"tcpkill -9 port source_port"},{"line_number":70,"context_line":"--- end example tcpkill snippet ---"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Kill TCP/UDP connections using fuser like:"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_9bc9e95c","line":69,"updated":"2014-09-09 18:01:58.000000000","message":"Shouldn\u0027t we be able to kill the connections via IP?  Wy would we have to use the source port?\n\nIt would also be good to have this example follow on from the example conntrack entry listed above.  Call out what IP is the floating IP from the above example and show the exact command to kill it here.\n\nI would also add a little more wording just before the example, like:\n\n\"The tcpkill command can be used to kill TCP connections.  Given the previous conntrack entry example, the connection would be killed with the following tcpkill command...\"","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3a73c2bab0fcd740cad97ddf098f815f2fa8ff54","unresolved":false,"context_lines":[{"line_number":69,"context_line":"tcpkill -9 port source_port"},{"line_number":70,"context_line":"--- end example tcpkill snippet ---"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Kill TCP/UDP connections using fuser like:"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"--- begin example fuser snippet ---"},{"line_number":75,"context_line":"fuser -k -n tcp dest_ip,dest_port"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_dbda9116","line":72,"updated":"2014-09-09 18:01:58.000000000","message":"I think we should say a little more here, like:\n\n\"The fuser command can also be used to kill TCP/UDP connections.  Given the previous conntrack entry example, the connection would be killed with the following fuser command...\"","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"51f6bb364235fb27d4be534c54ecfbd81fb2ff55","unresolved":false,"context_lines":[{"line_number":69,"context_line":"tcpkill -9 port source_port"},{"line_number":70,"context_line":"--- end example tcpkill snippet ---"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Kill TCP/UDP connections using fuser like:"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"--- begin example fuser snippet ---"},{"line_number":75,"context_line":"fuser -k -n tcp dest_ip,dest_port"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"fa98f980_6c5ac92b","line":72,"in_reply_to":"fa98f980_dbda9116","updated":"2014-09-10 19:26:04.000000000","message":"Done","commit_id":"f30a0e467b65da169778ae214fc66184e10467b5"}]}