| *** hoangcx has joined #openstack-fwaas | 01:01 | |
| *** yamamoto has joined #openstack-fwaas | 01:21 | |
| *** annp has joined #openstack-fwaas | 02:23 | |
| *** yamamoto_ has joined #openstack-fwaas | 02:36 | |
| *** yamamoto has quit IRC | 02:39 | |
| *** annp has quit IRC | 03:00 | |
| *** annp has joined #openstack-fwaas | 03:35 | |
| annp | reedip, ping | 03:36 |
|---|---|---|
| openstackgerrit | Nguyen Phuong An proposed openstack/neutron-fwaas master: Adding unique attribute for port_id https://review.openstack.org/512154 | 03:49 |
| *** yushiro has joined #openstack-fwaas | 04:25 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/neutron-fwaas master: Adding unique attribute for port_id https://review.openstack.org/512154 | 04:39 |
| *** vks1 has joined #openstack-fwaas | 04:46 | |
| *** hoangcx has quit IRC | 05:11 | |
| *** hoangcx has joined #openstack-fwaas | 05:14 | |
| annp | yushiro, ping. | 06:09 |
| yushiro | annp, pong | 06:22 |
| *** carl_baldwin has quit IRC | 06:24 | |
| annp | Have you check my comment in ovs driver patch? | 06:26 |
| *** carl_baldwin has joined #openstack-fwaas | 06:26 | |
| annp | yushiro, have you check my comment in ovs driver patch? | 06:26 |
| yushiro | No not yet. I"ll check it. | 06:26 |
| yushiro | annp, In addition, we considerd DB unique constraint for firewall_group_port_association_v2, I think it's OK to merge later. | 06:27 |
| yushiro | ping ivasilevskaya | 06:28 |
| *** openstackgerrit has quit IRC | 06:28 | |
| reedip | annp : poing | 06:29 |
| yushiro | annp, I wonder ivasilevskaya's comment on L2-agent patch. Do you think that is it possible to change state 'PENDING_CREATE' with no error? | 06:30 |
| yushiro | s/PENDING_CREATE/PENDING_UPDATE | 06:30 |
| annp | yushiro, assuming ivasilevskaya is using noop driver, So from my understanding, we always update firewall group status with status ACTIVE or INACTIVE, otherwise nothing. | 06:36 |
| yushiro | annp, Yeah, noop driver never changes the fwg state. | 06:38 |
| *** AlexeyAbashkin has joined #openstack-fwaas | 06:39 | |
| annp | yushiro, Have you met her situation while you tested with your local environment? | 06:40 |
| annp | yushiro, I'd suggest we should merge patch https://review.openstack.org/512154 first to avoid issues related to concurrency, something like we couldn't expected. | 06:43 |
| annp | yushiro, do you think so? | 06:44 |
| yushiro | annp, No not yet. I've tested with no error except DB duplication now. | 06:44 |
| yushiro | annp, Yes, I think so. I think it's OK to put +2 though l2-agent patch is mine ;) | 06:45 |
| yushiro | annp, Hence, you don't need to update https://review.openstack.org/#/c/512154/ ASAP. | 06:45 |
| yushiro | It's not so urgent. | 06:46 |
| *** AlexeyAbashkin has quit IRC | 06:46 | |
| annp | yushiro, OK. I got it. | 06:47 |
| yushiro | annp, BTW, have you tested L2-agent patch? | 06:48 |
| annp | yushiro, I haven't tested it with ivasilevskaya's case yet. I just create a firewall group and then set port to the firewall group. L2 agent patch works fine for me. That's all | 06:50 |
| yushiro | annp, OK, I'll put comment about what I tested for l2-agent. | 06:52 |
| yushiro | Then, I'll put +2 | 06:52 |
| yushiro | ah, will take a look for ovs driver patch either. | 06:53 |
| annp | yushiro, thanks | 06:53 |
| annp | yushiro, :) | 06:53 |
| *** vks1 has quit IRC | 06:59 | |
| *** openstackgerrit has joined #openstack-fwaas | 07:02 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/neutron-fwaas master: Adding unique contraint for port_id https://review.openstack.org/512154 | 07:02 |
| ivasilevskaya | Hi guys | 07:05 |
| ivasilevskaya | I believe the issue I found is a bug but unrelated to l2 agent patch | 07:06 |
| ivasilevskaya | Will work on clear repro | 07:06 |
| ivasilevskaya | I have my concerns about ovs driver, did you verify the generated openflow rules on br-int for correctness? | 07:07 |
| *** vks1 has joined #openstack-fwaas | 07:13 | |
| ivasilevskaya | annp: as for your suggestion to rename tables that's just what I offered to do several patchsets ago put we need to make sure they don't overlap with neutron's tables for ovs firewall | 07:22 |
| ivasilevskaya | annp: yeah, it's ok, we should be fine - neutron's tables start from table 71 | 07:23 |
| ivasilevskaya | but overall I would not be in a haste to merge ovs driver - there are a ton of cases to test and I couldn't even get it working yet on my test bed (no flows are generated upon adding a port to firewall group) | 07:24 |
| ivasilevskaya | annp: have you tried ovs driver patch on devstack with neutron's ovsfw security groups driver? | 07:25 |
| *** yamamoto_ has quit IRC | 07:35 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 07:38 | |
| *** vks1 has quit IRC | 08:22 | |
| *** yamamoto has joined #openstack-fwaas | 08:36 | |
| annp | ivasilevskaya, From my understanding, we will ignore interact between fwg and security group if firewall_l2_driver is configured: 'ovs' at the moment. | 08:39 |
| ivasilevskaya | annp: I'd say that's an awful idea but let it be. Did you verify openflow rules on br-int? | 08:39 |
| annp | ivasilevskaya, sorry, I haven't verify it yet. | 08:40 |
| ivasilevskaya | annp: at least did you check that they are generated at all? | 08:40 |
| ivasilevskaya | annp: in case "you add an active vm's port to firewall group" | 08:41 |
| annp | ivasilevskaya, ah, I just tested with this case. I saw in firewall rule flows in br-int. | 08:41 |
| *** yamamoto has quit IRC | 08:42 | |
| annp | ivasilevskaya, however, I haven't verified these flows is correct or not. Have you verified that? | 08:42 |
| ivasilevskaya | annp: the flows aren't generated at all on my env. I'm investigating | 08:43 |
| annp | ivasilevskaya, could you share with me your firewall rule? | 08:43 |
| ivasilevskaya | annp: I believe we need a fullstack test that creates fwg, boots a vm, adds its port to fwg and verifies that vm's accessibility (by ssh or icmp) changes appropriately | 08:44 |
| *** vks1 has joined #openstack-fwaas | 08:44 | |
| ivasilevskaya | annp: are there fullstack tests in fwaas? | 08:44 |
| annp | ivasilevskaya, unfortunately, There are no fullstack tests in fwaas :( | 08:46 |
| annp | ivasilevskaya, have you familiar with fullstack test? | 08:46 |
| ivasilevskaya | annp with neutron's | 08:47 |
| annp | ivasilevskaya, Great! It would be great if you bring fullstack to fwaas. :) | 08:48 |
| annp | ivasilevskaya, Regarding to "the flows aren't generated at all on my env". Have you added firewall rule with action='allow' to your test? | 08:50 |
| ivasilevskaya | annp: hm, I have both allow and deny in my test. But are you saying that deny rules won't be generated? Why not generate the flow and have explicit action=drop? | 08:53 |
| annp | ivasilevskaya, yes, deny rule won't generated. Because our ovs driver based on ovsfw driver for security group. In case security group, we don't have any security group with action drop and deny or deny. | 08:56 |
| annp | ivasilevskaya, that is current design ovs driver implementation. | 08:58 |
| annp | ivasilevskaya, that is current design of ovs driver implementation. | 08:58 |
| ivasilevskaya | annp: ok, got it. I thought sth has changed since I ported upstream ovsfw code | 08:59 |
| annp | ivasilevskaya, yes. I just add small thing to making ovs driver just running. :) | 09:01 |
| annp | ivasilevskaya, Today, I'm quite busy with another thing. So could you update ovs driver patch? | 09:02 |
| ivasilevskaya | annp: you mean table numbers? | 09:02 |
| ivasilevskaya | I'll do this, no problem | 09:03 |
| annp | ivasilevskaya, yes, table number and verifying firewall rule flows in br-int or something if you want to change. | 09:03 |
| ivasilevskaya | annp: if there's no fullstack mechanism in fwaas yet that's a whole new big change | 09:04 |
| *** yamamoto has joined #openstack-fwaas | 09:04 | |
| annp | ivasilevskaya, thanks for great help. | 09:04 |
| ivasilevskaya | annp: so I believe we need to think how to thoroughly test ovs driver another way | 09:04 |
| ivasilevskaya | annp: but I'll see what I can do. Though I personally don't believe it can be merged in the timeframe we are given | 09:05 |
| annp | ivasilevskaya, yes. at least functional test, I guest | 09:05 |
| annp | ivasilevskaya, Yep. But at least we can try ...:) | 09:06 |
| *** yamamoto has quit IRC | 09:09 | |
| annp | ivasilevskaya, Can you share with us your testing and result on google doc or something? So other reviewers can follow and give us suggestion or ... | 09:11 |
| annp | ivasilevskaya, How do you think? :) | 09:11 |
| ivasilevskaya | annp it depends if I won't switch to another project) Hardening fwaas was kind of a poc, and the proper testing will require more than 3 days I have till the end of this task | 09:13 |
| *** yamamoto has joined #openstack-fwaas | 09:13 | |
| annp | ivasilevskaya, I got it. I hope you won't switch to another project. :) | 09:19 |
| *** AlexeyAbashkin has quit IRC | 09:53 | |
| yushiro | Hi ivasilevskaya | 09:53 |
| ivasilevskaya | hi yushiro | 09:53 |
| *** AlexeyAbashkin has joined #openstack-fwaas | 09:53 | |
| yushiro | Did you check /etc/neutron/plugins/ml2/ml2_conf.ini in [securitygroup] section? In order to test l2-agent patch, we need to change 'firewall_driver = openvswitch' from 'firewall_driver = iptables_hybrid'. | 09:54 |
| yushiro | I'm so sorry, I forgot to mention about that in the etherpad[1] https://etherpad.openstack.org/p/fwaas-v2-l2 | 09:55 |
| ivasilevskaya | yushiro why do we need to change the driver? | 09:55 |
| ivasilevskaya | annp said he didn't test with neutron's ovsfw driver | 09:55 |
| yushiro | ivasilevskaya, ah, sorry. I replied to your comment "the flows aren't generated at all on my env. I'm investigating" . | 09:56 |
| ivasilevskaya | yushiro, I'm a bit confused. Do you say that we MUST change neutron's security driver to ovsfw to test fwaas ovs driver? | 09:57 |
| yushiro | ivasilevskaya, I said misunderstanding comment, sorry. No need to change security driver to test fwaas OVS driver only. | 09:58 |
| ivasilevskaya | yushiro, ok, got it. Thanks! | 09:59 |
| yushiro | ivasilevskaya, I thought that we should take care of co-existing case both SG and FW in br-int. | 09:59 |
| annp | yushiro, did you test with ovs driver? | 10:00 |
| annp | yushiro, will we consider about co-existing later? | 10:01 |
| yushiro | annp, I didn't. I just focused on l2-agent behavior. | 10:01 |
| yushiro | annp, I believe that FW wins if co-existing case. I'd like to verify at once. | 10:02 |
| annp | yushiro, ah, same to me. I'm building local environment and let me see. | 10:02 |
| yushiro | annp, How we can check flow-rule? ovs-ofctl dump-flows br-int ? | 10:03 |
| annp | yushiro, yes, fwaas alayws win. :) | 10:03 |
| annp | yushiro, sudo ovs-ofctl dump-flows br-int | 10:03 |
| yushiro | annp, If so, I think it can work correctly (As I expected). | 10:04 |
| yushiro | annp, aha, I forgot to specify 'sudo' | 10:04 |
| yushiro | So, we can test all patterns for firewall_rule like protocol, action, source/dest_port, source/dest_ip_address and ip_version. | 10:05 |
| annp | yushiro, please make sure your firewall rules have at least once allow rule. | 10:05 |
| yushiro | annp, +1 | 10:06 |
| annp | yushiro, :) thanks. | 10:06 |
| yushiro | annp, In addition, plz check following case: fwg with ingress policy, port but no firweall_rule in the policy. | 10:07 |
| yushiro | I'll leave this IRC and will come back... see you. | 10:09 |
| annp | yushiro, you mean in this case we should allow all ingress connection, right? | 10:09 |
| yushiro | annp, Hmm, | 10:10 |
| yushiro | annp, no. If there is no rule, no traffic should allow. | 10:10 |
| yushiro | annp, If firewall policy doesn't include any rule, what ovs driver will work ? | 10:11 |
| yushiro | Only default rule is configured or nothing to configure ? | 10:11 |
| annp | yushiro, if firewall policy has no rule, ovs driver will drop all. I think. | 10:11 |
| yushiro | annp, OK, that's as I expected. Anyway, will consider . | 10:12 |
| annp | in ovs driver side, they only take care allow rules. Otherwise nothing. | 10:12 |
| yushiro | However, in driver side, there is 'default rule', isn't it? | 10:13 |
| annp | yushiro, there is some rule for dhcp, arp, .. and drop rules. We should only focus to table=41,42,43 and table=51, 52 | 10:17 |
| yushiro | annp, yeah | 10:18 |
| *** yushiro has quit IRC | 10:23 | |
| *** openstackgerrit has quit IRC | 10:33 | |
| *** annp has quit IRC | 10:57 | |
| *** annp has joined #openstack-fwaas | 11:02 | |
| *** AlexeyAbashkin has quit IRC | 11:04 | |
| *** vks1 has quit IRC | 11:13 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 11:20 | |
| *** annp has quit IRC | 11:21 | |
| *** yamamoto has quit IRC | 11:38 | |
| *** yamamoto has joined #openstack-fwaas | 11:58 | |
| *** yamamoto has quit IRC | 12:21 | |
| *** hoangcx_ has joined #openstack-fwaas | 12:46 | |
| *** yamamoto has joined #openstack-fwaas | 12:52 | |
| ivasilevskaya | annp: I solved my env trouble but no good news from my side: my first manual test failed. | 12:55 |
| ivasilevskaya | Test: create 3 networks, security group with all allowed, firewall group with 1 ingress policy that allows icmp, boot 3 vms, verify that vms can be reached from dhcp namespace. Then add 1 vm port to firewall group, try pinging it from dhcp namespace - no connectivity (http://paste.openstack.org/show/623717/) | 12:55 |
| ivasilevskaya | after running unset --port VMPORT vm can be reached again. So I suspect fwaas ovs driver | 12:56 |
| ivasilevskaya | BTW guys xgerman_ yamamoto reedip annp After gate trouble recheck didn't remove -1 from zuul. How can this be solved? We wanted to merge some patches today iirc like https://review.openstack.org/#/c/425769/ | 12:58 |
| *** Aju has joined #openstack-fwaas | 13:46 | |
| *** afranc has quit IRC | 13:48 | |
| *** hoangcx_ has quit IRC | 13:50 | |
| *** hoangcx_ has joined #openstack-fwaas | 13:51 | |
| xgerman_ | I think we need to recheck until we hit a good env — on the LBaaS side Michael was battling mismatched qemu/kvm settings ind evstack all weekend | 14:05 |
| *** yamamoto has quit IRC | 14:07 | |
| *** vks1 has joined #openstack-fwaas | 14:15 | |
| *** vks1 has quit IRC | 14:19 | |
| *** vks1 has joined #openstack-fwaas | 14:21 | |
| *** vks1 has quit IRC | 14:29 | |
| *** vks1 has joined #openstack-fwaas | 14:44 | |
| *** yamamoto has joined #openstack-fwaas | 15:08 | |
| *** yamamoto has quit IRC | 15:14 | |
| *** yamamoto has joined #openstack-fwaas | 16:10 | |
| *** hoangcx_ has quit IRC | 16:14 | |
| *** yamamoto has quit IRC | 16:15 | |
| *** AlexeyAbashkin has quit IRC | 16:36 | |
| *** yamamoto has joined #openstack-fwaas | 17:12 | |
| *** yamamoto has quit IRC | 17:18 | |
| *** vks1 has quit IRC | 17:37 | |
| *** AlexeyAbashkin has joined #openstack-fwaas | 17:59 | |
| *** AlexeyAbashkin has quit IRC | 18:03 | |
| *** yamamoto has joined #openstack-fwaas | 18:14 | |
| *** yamamoto has quit IRC | 18:19 | |
| *** yamamoto has joined #openstack-fwaas | 19:15 | |
| *** yamamoto has quit IRC | 19:20 | |
| *** yamamoto has joined #openstack-fwaas | 20:17 | |
| *** yamamoto has quit IRC | 20:22 | |
| *** yamamoto has joined #openstack-fwaas | 21:18 | |
| *** yamamoto has quit IRC | 21:24 | |
| xgerman_ | ivasilevskaya looks like we are failing on http://logs.openstack.org/69/425769/55/check/openstack-tox-py35/9af7fd3/job-output.txt.gz#_2017-10-16_14_22_01_402344 | 21:27 |
| xgerman_ | I am not sure if that is legit or a zuul thing… | 21:27 |
| xgerman_ | reedip, yushiro: We have a few days more time to get things merged… mlavalle will check midweek again | 21:28 |
| *** yamamoto has joined #openstack-fwaas | 22:21 | |
| *** yamamoto has quit IRC | 22:26 | |
| *** lnicolas has joined #openstack-fwaas | 23:07 | |
| *** yamamoto has joined #openstack-fwaas | 23:22 | |
| *** yamamoto has quit IRC | 23:28 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!