{"action":"created","issue":{"url":"https://api.github.com/repos/Metaswitch/calico/issues/636","labels_url":"https://api.github.com/repos/Metaswitch/calico/issues/636/labels{/name}","comments_url":"https://api.github.com/repos/Metaswitch/calico/issues/636/comments","events_url":"https://api.github.com/repos/Metaswitch/calico/issues/636/events","html_url":"https://github.com/Metaswitch/calico/pull/636","id":86584525,"number":636,"title":"Separate FORWARD and INPUT chains in Felix","user":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/Metaswitch/calico/milestones/12","html_url":"https://github.com/Metaswitch/calico/milestones/0.25","labels_url":"https://api.github.com/repos/Metaswitch/calico/milestones/12/labels","id":1150928,"number":12,"title":"0.25","description":"","creator":{"login":"matthewdupre","id":9053570,"avatar_url":"https://avatars.githubusercontent.com/u/9053570?v=3","gravatar_id":"","url":"https://api.github.com/users/matthewdupre","html_url":"https://github.com/matthewdupre","followers_url":"https://api.github.com/users/matthewdupre/followers","following_url":"https://api.github.com/users/matthewdupre/following{/other_user}","gists_url":"https://api.github.com/users/matthewdupre/gists{/gist_id}","starred_url":"https://api.github.com/users/matthewdupre/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthewdupre/subscriptions","organizations_url":"https://api.github.com/users/matthewdupre/orgs","repos_url":"https://api.github.com/users/matthewdupre/repos","events_url":"https://api.github.com/users/matthewdupre/events{/privacy}","received_events_url":"https://api.github.com/users/matthewdupre/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":2,"state":"open","created_at":"2015-06-05T10:02:57Z","updated_at":"2015-06-18T10:20:52Z","due_on":"2015-06-21T23:00:00Z","closed_at":null},"comments":20,"created_at":"2015-06-09T12:36:09Z","updated_at":"2015-06-18T12:07:23Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Metaswitch/calico/pulls/636","html_url":"https://github.com/Metaswitch/calico/pull/636","diff_url":"https://github.com/Metaswitch/calico/pull/636.diff","patch_url":"https://github.com/Metaswitch/calico/pull/636.patch"},"body":"This resolves #196.\r\n\r\nThe effect of this patch is to stop adding felix-FROM-ENDPOINT to the INPUT chain of the filter table in iptables, and instead to add another top-level chain that contains only rules that affect inbound packets. This creates a split between the endpoint security rules (which apply only to forwarded packets) and the rules that affect traffic intended to reach the host.\r\n\r\nRight now this is set up to be extremely secure, but we may want to relax it slightly. ICMP packets from guests leap to mind as a possible exemption we'll want to grant.\r\n\r\nI have to drop a few extra commits that will move some other rules from where they are to this new INPUT chain. In particular, the metadata rule needs to move in.\r\n\r\nI haven't had a chance to live test this yet, and the UT coverage here isn't great, so I suggest not merging it until someone gets a chance to live-test it. Nevertheless, review would be welcome, particularly from @plwhite and @fasaxc."},"comment":{"url":"https://api.github.com/repos/Metaswitch/calico/issues/comments/113131349","html_url":"https://github.com/Metaswitch/calico/pull/636#issuecomment-113131349","issue_url":"https://api.github.com/repos/Metaswitch/calico/issues/636","id":113131349,"user":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"created_at":"2015-06-18T12:07:23Z","updated_at":"2015-06-18T12:07:23Z","body":"Changes made."}}