)]}'
{"tripleo_ansible/roles/tripleo-firewall/tasks/tripleo_firewall_add.yml":[{"author":{"_account_id":24245,"name":"Harald Jensås","email":"hjensas@redhat.com","username":"harald.jensas"},"change_message_id":"f3f9c06bf6987f04d7bc50fbfb3c4033761ba664","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":70,"context_line":"  when:"},{"line_number":71,"context_line":"    - item[\u0027rule\u0027][\u0027dport\u0027] is defined"},{"line_number":72,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027tcp\u0027)) !\u003d \u0027ipv6\u0027"},{"line_number":73,"context_line":"    - item[\u0027rule\u0027][\u0027source\u0027] | default(\u0027127.0.0.1\u0027) | ipv4"},{"line_number":74,"context_line":"    - item[\u0027rule\u0027][\u0027destination\u0027] | default(\u0027127.0.0.1\u0027) | ipv4"},{"line_number":75,"context_line":"  loop: \"{{ ((item[\u0027rule\u0027][\u0027dport\u0027] is iterable) and (item[\u0027rule\u0027][\u0027dport\u0027] is not string)) | ternary(item[\u0027rule\u0027][\u0027dport\u0027], [item[\u0027rule\u0027][\u0027dport\u0027]]) }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_7aecdaf2","line":72,"range":{"start_line":72,"start_character":6,"end_line":72,"end_character":56},"updated":"2019-09-21 15:16:22.000000000","message":"proto is either TCP or UDP? It should never be \u0027ipv6\u0027?","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":24245,"name":"Harald Jensås","email":"hjensas@redhat.com","username":"harald.jensas"},"change_message_id":"9a657cfa1550c2e243ef1354d7214079611c5da3","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":70,"context_line":"  when:"},{"line_number":71,"context_line":"    - item[\u0027rule\u0027][\u0027dport\u0027] is defined"},{"line_number":72,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027tcp\u0027)) !\u003d \u0027ipv6\u0027"},{"line_number":73,"context_line":"    - item[\u0027rule\u0027][\u0027source\u0027] | default(\u0027127.0.0.1\u0027) | ipv4"},{"line_number":74,"context_line":"    - item[\u0027rule\u0027][\u0027destination\u0027] | default(\u0027127.0.0.1\u0027) | ipv4"},{"line_number":75,"context_line":"  loop: \"{{ ((item[\u0027rule\u0027][\u0027dport\u0027] is iterable) and (item[\u0027rule\u0027][\u0027dport\u0027] is not string)) | ternary(item[\u0027rule\u0027][\u0027dport\u0027], [item[\u0027rule\u0027][\u0027dport\u0027]]) }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_dfffeefe","line":72,"range":{"start_line":72,"start_character":6,"end_line":72,"end_character":56},"in_reply_to":"3fa7e38b_4d2feaa0","updated":"2019-09-23 14:34:11.000000000","message":"Indeed, only tcp or udp is incorrect. There are many other valid protocols. ipv4 and ipv6 is valid as well.\n\nBUT, whe proto is ipv4 or ipv6 it means we want to control what to do if an ip packet is encapsulated in an ip package. (ip-in-ip). It should not control if the rule is created in ip6tables or iptables.\n\nSee:\n- https://en.wikipedia.org/wiki/6to4\n- https://en.wikipedia.org/wiki/IP_in_IP","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"dde79885546691a787cc545ef0c168b7e8b33ed6","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":70,"context_line":"  when:"},{"line_number":71,"context_line":"    - item[\u0027rule\u0027][\u0027dport\u0027] is defined"},{"line_number":72,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027tcp\u0027)) !\u003d \u0027ipv6\u0027"},{"line_number":73,"context_line":"    - item[\u0027rule\u0027][\u0027source\u0027] | default(\u0027127.0.0.1\u0027) | ipv4"},{"line_number":74,"context_line":"    - item[\u0027rule\u0027][\u0027destination\u0027] | default(\u0027127.0.0.1\u0027) | ipv4"},{"line_number":75,"context_line":"  loop: \"{{ ((item[\u0027rule\u0027][\u0027dport\u0027] is iterable) and (item[\u0027rule\u0027][\u0027dport\u0027] is not string)) | ternary(item[\u0027rule\u0027][\u0027dport\u0027], [item[\u0027rule\u0027][\u0027dport\u0027]]) }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_4d2feaa0","line":72,"range":{"start_line":72,"start_character":6,"end_line":72,"end_character":56},"in_reply_to":"3fa7e38b_7aecdaf2","updated":"2019-09-22 01:37:35.000000000","message":"sadly we have a proto setting of ipv4, ipv6, vrrp, and gre in THT.\n\nexamples\n\n- https://review.opendev.org/#/c/677237/21/deployment/kubernetes/kubernetes-worker-baremetal-ansible.yaml@61 \n- https://review.opendev.org/#/c/677237/21/deployment/keepalived/keepalived-container-puppet.yaml@78\n\nWhile this doesn\u0027t make that proto setting right in any way, it is something we have to deal with for the time being.","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"47de40ee2ae18c95e678b8036fb3d1f3d9f6d850","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":70,"context_line":"  when:"},{"line_number":71,"context_line":"    - item[\u0027rule\u0027][\u0027dport\u0027] is defined"},{"line_number":72,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027tcp\u0027)) !\u003d \u0027ipv6\u0027"},{"line_number":73,"context_line":"    - item[\u0027rule\u0027][\u0027source\u0027] | default(\u0027127.0.0.1\u0027) | ipv4"},{"line_number":74,"context_line":"    - item[\u0027rule\u0027][\u0027destination\u0027] | default(\u0027127.0.0.1\u0027) | ipv4"},{"line_number":75,"context_line":"  loop: \"{{ ((item[\u0027rule\u0027][\u0027dport\u0027] is iterable) and (item[\u0027rule\u0027][\u0027dport\u0027] is not string)) | ternary(item[\u0027rule\u0027][\u0027dport\u0027], [item[\u0027rule\u0027][\u0027dport\u0027]]) }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_ddd2965c","line":72,"range":{"start_line":72,"start_character":6,"end_line":72,"end_character":56},"in_reply_to":"3fa7e38b_dfffeefe","updated":"2019-09-23 16:24:38.000000000","message":"I appreciate the links but I\u0027m aware of what 6to4 and IP in IP is.\n\nIf you feel this line should be removed you\u0027re more than welcome to make this change and I would be happy to review it.","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":24245,"name":"Harald Jensås","email":"hjensas@redhat.com","username":"harald.jensas"},"change_message_id":"f3f9c06bf6987f04d7bc50fbfb3c4033761ba664","unresolved":false,"context_lines":[{"line_number":104,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":105,"context_line":"  when:"},{"line_number":106,"context_line":"    - item[\u0027rule\u0027][\u0027dport\u0027] is defined"},{"line_number":107,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027tcp\u0027)) !\u003d \u0027ipv4\u0027"},{"line_number":108,"context_line":"    - item[\u0027rule\u0027][\u0027source\u0027] | default(\u0027::\u0027) | ipv6"},{"line_number":109,"context_line":"    - item[\u0027rule\u0027][\u0027destination\u0027] | default(\u0027::\u0027) | ipv6"},{"line_number":110,"context_line":"  loop: \"{{ ((item[\u0027rule\u0027][\u0027dport\u0027] is iterable) and (item[\u0027rule\u0027][\u0027dport\u0027] is not string)) | ternary(item[\u0027rule\u0027][\u0027dport\u0027], [item[\u0027rule\u0027][\u0027dport\u0027]]) }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_5af1decc","line":107,"range":{"start_line":107,"start_character":6,"end_line":107,"end_character":56},"updated":"2019-09-21 15:16:22.000000000","message":"proto is either TCP or UDP? It should never be \u0027ipv4\u0027?","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"dde79885546691a787cc545ef0c168b7e8b33ed6","unresolved":false,"context_lines":[{"line_number":104,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":105,"context_line":"  when:"},{"line_number":106,"context_line":"    - item[\u0027rule\u0027][\u0027dport\u0027] is defined"},{"line_number":107,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027tcp\u0027)) !\u003d \u0027ipv4\u0027"},{"line_number":108,"context_line":"    - item[\u0027rule\u0027][\u0027source\u0027] | default(\u0027::\u0027) | ipv6"},{"line_number":109,"context_line":"    - item[\u0027rule\u0027][\u0027destination\u0027] | default(\u0027::\u0027) | ipv6"},{"line_number":110,"context_line":"  loop: \"{{ ((item[\u0027rule\u0027][\u0027dport\u0027] is iterable) and (item[\u0027rule\u0027][\u0027dport\u0027] is not string)) | ternary(item[\u0027rule\u0027][\u0027dport\u0027], [item[\u0027rule\u0027][\u0027dport\u0027]]) }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_6d2ae690","line":107,"range":{"start_line":107,"start_character":6,"end_line":107,"end_character":56},"in_reply_to":"3fa7e38b_5af1decc","updated":"2019-09-22 01:37:35.000000000","message":"see above","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":24245,"name":"Harald Jensås","email":"hjensas@redhat.com","username":"harald.jensas"},"change_message_id":"f3f9c06bf6987f04d7bc50fbfb3c4033761ba664","unresolved":false,"context_lines":[{"line_number":130,"context_line":"    ip_version: ipv4"},{"line_number":131,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":132,"context_line":"  when:"},{"line_number":133,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027all\u0027)) !\u003d \u0027ipv6\u0027"},{"line_number":134,"context_line":"    - item[\u0027rule\u0027][\u0027proto\u0027] is defined"},{"line_number":135,"context_line":"    - item[\u0027rule\u0027][\u0027dport\u0027] is undefined"},{"line_number":136,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_fae0cafc","line":133,"range":{"start_line":133,"start_character":5,"end_line":133,"end_character":56},"updated":"2019-09-21 15:16:22.000000000","message":"proto is either TCP or UDP? It should never be \u0027ipv6\u0027?","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"dde79885546691a787cc545ef0c168b7e8b33ed6","unresolved":false,"context_lines":[{"line_number":130,"context_line":"    ip_version: ipv4"},{"line_number":131,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":132,"context_line":"  when:"},{"line_number":133,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027all\u0027)) !\u003d \u0027ipv6\u0027"},{"line_number":134,"context_line":"    - item[\u0027rule\u0027][\u0027proto\u0027] is defined"},{"line_number":135,"context_line":"    - item[\u0027rule\u0027][\u0027dport\u0027] is undefined"},{"line_number":136,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_0d1b3281","line":133,"range":{"start_line":133,"start_character":5,"end_line":133,"end_character":56},"in_reply_to":"3fa7e38b_fae0cafc","updated":"2019-09-22 01:37:35.000000000","message":"see above","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":24245,"name":"Harald Jensås","email":"hjensas@redhat.com","username":"harald.jensas"},"change_message_id":"f3f9c06bf6987f04d7bc50fbfb3c4033761ba664","unresolved":false,"context_lines":[{"line_number":148,"context_line":"    ctstate: \"{{ tripleo_ctstate }}\""},{"line_number":149,"context_line":"    limit: \"{{ item[\u0027rule\u0027][\u0027limit\u0027] | default(omit) }}\""},{"line_number":150,"context_line":"    limit_burst: \"{{ item[\u0027rule\u0027][\u0027limit_burst\u0027] | default(omit) }}\""},{"line_number":151,"context_line":"    ip_version: ipv6"},{"line_number":152,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":153,"context_line":"  when:"},{"line_number":154,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027all\u0027)) !\u003d \u0027ipv4\u0027"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_daddce42","line":151,"range":{"start_line":151,"start_character":4,"end_line":151,"end_character":14},"updated":"2019-09-21 15:16:22.000000000","message":"Should we not add \u0027ip_version\u0027 as a parameter to the rule input. And have ...\n\n  when:\n    - (item[\u0027rule\u0027][\u0027ip_version\u0027] | default(\u0027all\u0027)) !\u003d \u0027ipv6\u0027","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"dde79885546691a787cc545ef0c168b7e8b33ed6","unresolved":false,"context_lines":[{"line_number":148,"context_line":"    ctstate: \"{{ tripleo_ctstate }}\""},{"line_number":149,"context_line":"    limit: \"{{ item[\u0027rule\u0027][\u0027limit\u0027] | default(omit) }}\""},{"line_number":150,"context_line":"    limit_burst: \"{{ item[\u0027rule\u0027][\u0027limit_burst\u0027] | default(omit) }}\""},{"line_number":151,"context_line":"    ip_version: ipv6"},{"line_number":152,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":153,"context_line":"  when:"},{"line_number":154,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027all\u0027)) !\u003d \u0027ipv4\u0027"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_ed17b650","line":151,"range":{"start_line":151,"start_character":4,"end_line":151,"end_character":14},"in_reply_to":"3fa7e38b_daddce42","updated":"2019-09-22 01:37:35.000000000","message":"+1 having a specific setting to allow rules to be crafted using specific ip versions would be a welcomed feature.","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":24245,"name":"Harald Jensås","email":"hjensas@redhat.com","username":"harald.jensas"},"change_message_id":"f3f9c06bf6987f04d7bc50fbfb3c4033761ba664","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    ip_version: ipv6"},{"line_number":152,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":153,"context_line":"  when:"},{"line_number":154,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027all\u0027)) !\u003d \u0027ipv4\u0027"},{"line_number":155,"context_line":"    - item[\u0027rule\u0027][\u0027proto\u0027] is defined"},{"line_number":156,"context_line":"    - item[\u0027rule\u0027][\u0027dport\u0027] is undefined"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_7a17faee","line":154,"range":{"start_line":154,"start_character":6,"end_line":154,"end_character":56},"updated":"2019-09-21 15:16:22.000000000","message":"proto is either TCP or UDP? It should never be \u0027ipv4\u0027?","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"dde79885546691a787cc545ef0c168b7e8b33ed6","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    ip_version: ipv6"},{"line_number":152,"context_line":"    state: \"{{ tripleo_firewall_port_states[(item[\u0027rule\u0027][\u0027extras\u0027] | default({}))[\u0027ensure\u0027] | default(\u0027enabled\u0027)] }}\""},{"line_number":153,"context_line":"  when:"},{"line_number":154,"context_line":"    - (item[\u0027rule\u0027][\u0027proto\u0027] | default(\u0027all\u0027)) !\u003d \u0027ipv4\u0027"},{"line_number":155,"context_line":"    - item[\u0027rule\u0027][\u0027proto\u0027] is defined"},{"line_number":156,"context_line":"    - item[\u0027rule\u0027][\u0027dport\u0027] is undefined"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3fa7e38b_cd143a51","line":154,"range":{"start_line":154,"start_character":6,"end_line":154,"end_character":56},"in_reply_to":"3fa7e38b_7a17faee","updated":"2019-09-22 01:37:35.000000000","message":"see above.","commit_id":"1449edf2703f9c9a92a34884bf752ad6bff6c239"}]}