| *** diogogmt has joined #openstack-fwaas | 00:37 | |
| *** njohnsto_ has joined #openstack-fwaas | 02:16 | |
| *** njohnsto_ has quit IRC | 02:18 | |
| *** njohnsto_ has joined #openstack-fwaas | 02:19 | |
| *** vishwanathj has quit IRC | 02:54 | |
| *** mickeys has quit IRC | 03:17 | |
| *** njohnsto_ has quit IRC | 03:30 | |
| *** SarathMekala has joined #openstack-fwaas | 03:43 | |
| *** chandanc has joined #openstack-fwaas | 03:48 | |
| *** mickeys has joined #openstack-fwaas | 03:58 | |
| *** SridarK_ has joined #openstack-fwaas | 03:59 | |
| *** yushiro has joined #openstack-fwaas | 03:59 | |
| *** padkrish has joined #openstack-fwaas | 04:00 | |
| *** mickeys has quit IRC | 04:03 | |
| yushiro | padkrish: Can we discuss about L2-agent? | 04:59 |
|---|---|---|
| padkrish | yushiro: sure | 04:59 |
| padkrish | first one, i am looking at now: | 05:00 |
| padkrish | https://review.openstack.org/#/c/323971/6/neutron_fwaas/services/firewall/agents/v2/l2/extensions/fwaas.py line 100 | 05:00 |
| *** SarathMekala is now known as SarathMekala_brb | 05:01 | |
| padkrish | So, we will be calling the plugin RPC for getting the fwg_id | 05:01 |
| yushiro | padkrish: At first, thanks for your e-mail :) | 05:01 |
| padkrish | yushiro# np, the least i could do at this time :) | 05:03 |
| yushiro | padkrish: OK. so, go back to your word.. Yes. we should get firewall-group-id at this timing. | 05:04 |
| yushiro | padkrish: In order to apply firewall-rules | 05:04 |
| yushiro | to the port. | 05:04 |
| padkrish | yes, am taking a shot at that | 05:05 |
| yushiro | However, 'port' of an argument doesn't include 'firewall-group' guys. | 05:06 |
| padkrish | and also based on IP address of the port, we should query the firewall address group ID, right? Or are we deferring that for now? | 05:06 |
| padkrish | yes, i dumped that... | 05:06 |
| padkrish | {u'profile': {}, u'network_qos_policy_id': None, u'qos_policy_id': None, u'allowed_address_pairs': [], u'admin_state_up': True, u'network_id': u'99ef5e31-e626-41e7-8095-39f9600c9442', u'segmentation_id': None, 'vif_port': <neutron.agent.common.ovs_lib.VifPort object at 0x7fdb9da206d0>, u'device_owner': u'network:dhcp', u'physical_network': None, u'mac_address': u'fa:16:3e:d6:c4:e8', u'device': u'ed9307d3-5191-44f6-aa1a-e57 | 05:07 |
| padkrish | 67ba54cee', u'port_security_enabled': False, u'port_id': u'ed9307d3-5191-44f6-aa1a-e5767ba54cee', u'fixed_ips': [{u'subnet_id': u'cc58fb01-f138-4bae-a34a-7c0e54870f1a', u'ip_address': u'10.0.0.2'}], u'network_type': u'local', u'security_groups': []} | 05:07 |
| padkrish | this is the port data | 05:07 |
| yushiro | padkrish: thanks. Regarding address_group_id, it is also necessary. but this value is in the future. | 05:09 |
| padkrish | ok | 05:10 |
| padkrish | should we modify lines 53-59 and use regular RPC instead of versioned objects or can we continue with versioned objects? | 05:11 |
| yushiro | hmm, if we use regular RPC, it is necessary to add some patch into neutron-side. | 05:13 |
| yushiro | We use L2-agent extension, I think L53-59 is not necessary to modify. | 05:14 |
| yushiro | If anything, we should extend 'firewall_group_id' in 'port' object and enable to insert 'firewall_group_id' into the return value from get_device_details. | 05:16 |
| yushiro | I'd like to sync with you at this point. | 05:17 |
| yushiro | (maybe 1 month ago, you've already mentioned about it :) | 05:17 |
| yushiro | However, we should clear the association b/w "port" and "firewall_group". | 05:18 |
| padkrish | i agree that's easiest and also modular... but that means modification in neutron RPC. And, it FWaaS is planning to be independent, isn't it? | 05:18 |
| padkrish | that's we call another RPC to the FWaaS plugin | 05:18 |
| yushiro | ah, OK. I see. sorry, I was confused . | 05:20 |
| padkrish | no worries at all.... | 05:20 |
| padkrish | L2 agent extension is for port notification, for FW notification like policy, rule updates etc. we need either versioned objects or RPC from plugin to L2 agent extension | 05:21 |
| yushiro | yes. | 05:25 |
| padkrish | so, that's why asked about lines 53-59 | 05:27 |
| yushiro | I see. thanks. | 05:28 |
| yushiro | Hmm, padkrish, I'm still not clear. please let me clarify | 05:31 |
| padkrish | ok, sure..go ahead | 05:32 |
| yushiro | In l2-agent, we should trigger 'port' create/update/delete. | 05:32 |
| yushiro | And also trigger firewall-group/rule/policy create/update/delete. | 05:33 |
| padkrish | yes... | 05:33 |
| yushiro | and we should prevent neutron-side fix. | 05:34 |
| padkrish | yes | 05:35 |
| yushiro | Ok, so, go back your opinion. | 05:38 |
| yushiro | 1. another RPC to the FWaaS plugin , 2. continue with versioned objects. | 05:39 |
| yushiro | Regarding 1., is it the way which njohnston has tought us on e-mail? | 05:39 |
| padkrish | yes....he has pointed us to L3 agent RPC example.. | 05:41 |
| yushiro | OK. I understood. How about 2. ? | 05:41 |
| padkrish | for 2. either we continue with versioned objects or use RPC mechanisms like L3 agent | 05:44 |
| padkrish | since versioned object hasn't merged, in order to make fast progress, i am thinking, we can follow L3 agent and then refactor this code, when versioned object is available. | 05:45 |
| padkrish | what do you think? | 05:45 |
| yushiro | padkrish: I agree with you because versioned object is necessary not only L2-agent but L3 one. | 05:46 |
| padkrish | ok | 05:47 |
| padkrish | and regarding driver | 05:49 |
| padkrish | lines 44-45, we need to integrate with driver patch | 05:50 |
| padkrish | have you tried integrating that for L3? | 05:55 |
| yushiro | no I haven't. | 05:55 |
| yushiro | Regarding L44,45 I was given from chandanc about driver's interface information. | 05:57 |
| yushiro | Yes, we need to integrate | 05:57 |
| padkrish | L3 agent would have already done that, right? | 05:58 |
| padkrish | Didn't get a chance to go through that patch in detail :( | 05:58 |
| yushiro | just a moment, please. | 05:58 |
| yushiro | I think so. I'll build today's latest devstack. | 06:00 |
| padkrish | ok | 06:01 |
| padkrish | ok, let me also look at the patch | 06:01 |
| padkrish | that's it from my side... | 06:02 |
| yushiro | padkrish: I'll try to implement L3-agent mech for L2 first, and check. However, I have 1 wondering point. | 06:02 |
| padkrish | ok | 06:03 |
| yushiro | In case of 'port' create/update, we should specify 'firewall_group_id' at that time. | 06:03 |
| yushiro | In other words, 'firewall_group_id' should be displayed into port-show result. | 06:03 |
| yushiro | like qos_policy_id | 06:03 |
| padkrish | yes, it belongs to default one, i think, if not specified? | 06:06 |
| yushiro | Yeah. if not specified, default firewall group should be applied. | 06:06 |
| yushiro | So, in order to control from port, we should add more patch as extension, shouldn't we? | 06:07 |
| padkrish | hmmm...sorry, can you elaborate more? what patch should be added? | 06:08 |
| yushiro | padkrish: I think we should extend 'port' attributes_map like as follows: | 06:11 |
| yushiro | https://github.com/openstack/neutron/blob/master/neutron/extensions/qos.py#L116 | 06:12 |
| yushiro | I'm not sure that we can achieve this(enable to specify firweall-group-id from port)in fwaas repos. | 06:13 |
| *** amotoki has joined #openstack-fwaas | 06:14 | |
| padkrish | oh ok... | 06:16 |
| yushiro | ping amotoki | 06:20 |
| padkrish | ok, yushiro...bye, will chat later | 06:21 |
| yushiro | padkrish: OK. thanks. | 06:21 |
| amotoki | yushiro: pong | 06:21 |
| yushiro | amotoki: Hi, I have 1 quick question. | 06:21 |
| amotoki | yushiro: what? | 06:22 |
| yushiro | I'd like to specify 'firewall_group_id' like 'qos_policy_id' on port. | 06:23 |
| yushiro | Regarding QoS, following EXTENDED_ATTRIBUETS_2_0 has been used: | 06:24 |
| yushiro | https://github.com/openstack/neutron/blob/master/neutron/extensions/qos.py#L116 | 06:24 |
| yushiro | Do you know that is this definition also valid even if fwaas repos? | 06:26 |
| yushiro | s/fwaas repos/other neutron repos | 06:26 |
| *** padkrish has quit IRC | 06:29 | |
| amotoki | yushiro: yes. it's possible. | 06:38 |
| amotoki | yushiro: note that the firewall plugin is responsible to populate additional attributes though. | 06:39 |
| yushiro | amotoki: Thanks a lot! | 07:06 |
| yushiro | amotoki: sorry. I was calling from my manager.. | 07:06 |
| *** yushiro is now known as yushiro_afk | 07:37 | |
| *** mickeys has joined #openstack-fwaas | 08:55 | |
| *** mickeys has quit IRC | 08:57 | |
| *** yushiro_afk has quit IRC | 09:22 | |
| *** chandanc has quit IRC | 10:58 | |
| *** amotoki has quit IRC | 11:06 | |
| *** SarathMekala_brb has quit IRC | 11:13 | |
| *** amotoki has joined #openstack-fwaas | 11:37 | |
| *** amotoki has quit IRC | 11:50 | |
| *** amotoki has joined #openstack-fwaas | 11:58 | |
| *** amotoki has quit IRC | 12:07 | |
| *** amotoki has joined #openstack-fwaas | 12:33 | |
| *** ntt has joined #openstack-fwaas | 12:36 | |
| ntt | Hi, using the fwaas plugin it is possible to do a rule like: 192.168.177.10:2222 -> 10.0.0.5:22, where 192.168.177.10 = external gateway on the router (first ip of the the floating network range, assigned to an interface in the qrouter namespace) and 10.0.0.0/24 = tenant private network?? | 12:36 |
| *** vishwanathj has joined #openstack-fwaas | 13:11 | |
| *** diogogmt has quit IRC | 14:17 | |
| xgerman | ntt this looks like port rewriting we are more doing accept, reject, drop of packages but not rewriting them at the moment | 14:18 |
| xgerman | on the other hand the LBaaS project can do that if it’s tcp but not sure how well ssh proxying would work ;-) | 14:19 |
| njohnston | FYI all: https://review.openstack.org/#/c/363967/ | 14:50 |
| *** SarathMekala has joined #openstack-fwaas | 14:51 | |
| *** amotoki has quit IRC | 14:56 | |
| *** diogogmt has joined #openstack-fwaas | 15:04 | |
| *** diogogmt has quit IRC | 15:15 | |
| *** diogogmt has joined #openstack-fwaas | 15:19 | |
| SridarK_ | ntt: hi | 15:31 |
| SridarK_ | on ur question above - u can have a rule in this manner, but the rules are applied on the qr- i/f | 15:32 |
| *** chandanc has joined #openstack-fwaas | 15:33 | |
| SridarK_ | one thing to be careful abt is to ensure that addresses u refer to - there is no ambiguity due to NAT (post or pre) | 15:33 |
| SridarK_ | this could pose an issue | 15:34 |
| SridarK_ | njohnston: thx | 15:34 |
| SridarK_ | i will add myself to 363967 | 15:34 |
| *** chandanc has quit IRC | 16:02 | |
| *** diogogmt has quit IRC | 16:46 | |
| *** _SarathMekala_ has joined #openstack-fwaas | 17:01 | |
| *** SarathMekala has quit IRC | 17:04 | |
| *** mickeys has joined #openstack-fwaas | 17:12 | |
| *** chandanc has joined #openstack-fwaas | 17:14 | |
| *** chandanc has quit IRC | 17:36 | |
| *** SarathMekala has joined #openstack-fwaas | 17:55 | |
| *** _SarathMekala_ has quit IRC | 17:58 | |
| *** diogogmt has joined #openstack-fwaas | 17:59 | |
| *** SarathMekala has quit IRC | 18:15 | |
| *** mickeys has quit IRC | 18:43 | |
| njohnston | SridarK_: SridarK_: Quick question for you. Right now if you look at the fwaas reno notes, there is nothing at all that mentiones FWaaS v2 at all. I was thinking about writing one to say 'introducing FWaaS v2.0' (with 2.1 being when we integrate the L2 component etc. and flesh out the spec). | 19:07 |
| njohnston | That being said, what would you list as the 'features' of what we have implemented as distinct from FWaaS v1? Just that we have implemented the core FWaaS v2 engine for L3, and achieved rough feature parity with FWaaS v1? | 19:07 |
| SridarK_ | njohnston: and also that we have moved to being able to apply on ports | 19:08 |
| SridarK_ | so it is easier to move across L3 and L2(eventually) | 19:08 |
| SridarK_ | in addition to what u say | 19:09 |
| SridarK_ | also that we are aligned to using the L3Agent Ext framework | 19:09 |
| njohnston | So it would be correct to say we apply on router ports - and then when the L2 work lands that will change from 'router ports' to just 'any ports'? | 19:09 |
| SridarK_ | i think we can say, eventually in addition to L3 Ports we can also apply on VM ports | 19:10 |
| njohnston | I think a release note should only cover what a user can do wit the software at that time, not projected future uses; it's not that kind of document. If I was an operator, I would definitely not want to see anything stated in the future tense in a release note. | 19:11 |
| SridarK_ | ah ok agree | 19:12 |
| mfranc213 | fwiw i don't really have that sensibility | 19:12 |
| mfranc213 | sorry, i'm lurking. | 19:12 |
| SridarK_ | :-) | 19:12 |
| SridarK_ | i think if we can word it so that we convey that ports but is is only L3 today and easy to support to L2 using the same API | 19:13 |
| SridarK_ | but u are correct in that release notes cover what we are shipping | 19:14 |
| njohnston | OK, I created https://review.openstack.org/366916 - hopefully that can be a jumping-off point for discussion | 19:19 |
| SridarK_ | ok | 19:21 |
| *** lnicolas has joined #openstack-fwaas | 19:29 | |
| *** lnicolas has quit IRC | 19:41 | |
| *** lnicolas has joined #openstack-fwaas | 19:42 | |
| *** mickeys has joined #openstack-fwaas | 20:13 | |
| *** mickeys has quit IRC | 20:18 | |
| *** lnicolas has quit IRC | 20:32 | |
| *** lnicolas has joined #openstack-fwaas | 20:34 | |
| *** mickeys has joined #openstack-fwaas | 20:38 | |
| *** vishwana_ has joined #openstack-fwaas | 20:51 | |
| *** vishwanathj has quit IRC | 20:52 | |
| *** diogogmt has quit IRC | 23:24 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!