| *** yamamoto has joined #openvswitch | 00:57 | |
| *** armax has quit IRC | 01:07 | |
| *** yamamoto has quit IRC | 01:11 | |
| *** yamamoto has joined #openvswitch | 01:37 | |
| *** dholler has quit IRC | 02:09 | |
| *** dholler has joined #openvswitch | 02:23 | |
| *** psahoo has joined #openvswitch | 02:57 | |
| *** armax has joined #openvswitch | 03:08 | |
| *** acidfu has quit IRC | 03:31 | |
| *** JamesBenson has joined #openvswitch | 03:31 | |
| *** JamesBenson has quit IRC | 03:36 | |
| *** acidfu has joined #openvswitch | 03:38 | |
| *** psahoo has quit IRC | 04:50 | |
| *** psahoo has joined #openvswitch | 04:52 | |
| *** blahdodo has quit IRC | 05:50 | |
| *** blahdodo has joined #openvswitch | 05:54 | |
| *** eelco has joined #openvswitch | 06:09 | |
| *** links has joined #openvswitch | 06:23 | |
| *** apus has quit IRC | 06:34 | |
| *** apus has joined #openvswitch | 06:35 | |
| *** slaweq has joined #openvswitch | 06:57 | |
| *** maciejjozefczyk has joined #openvswitch | 06:57 | |
| *** JamesBenson has joined #openvswitch | 07:33 | |
| *** JamesBenson has quit IRC | 07:38 | |
| *** rcernin has quit IRC | 07:45 | |
| *** imaximets_ has quit IRC | 08:04 | |
| *** imaximets has joined #openvswitch | 08:04 | |
| *** imaximets_ has joined #openvswitch | 08:11 | |
| *** imaximets has quit IRC | 08:13 | |
| *** imaximets_ is now known as imaximets | 08:42 | |
| *** jaicaa has quit IRC | 09:05 | |
| *** jaicaa has joined #openvswitch | 09:07 | |
| *** JamesBenson has joined #openvswitch | 09:34 | |
| *** JamesBenson has quit IRC | 09:38 | |
| *** mmirecki has joined #openvswitch | 09:49 | |
| *** psahoo has quit IRC | 10:25 | |
| *** troulouliou_div2 has joined #openvswitch | 10:35 | |
| *** psahoo has joined #openvswitch | 10:38 | |
| *** psahoo has quit IRC | 10:46 | |
| *** psahoo has joined #openvswitch | 10:58 | |
| *** yamamoto has quit IRC | 11:02 | |
| *** yamamoto has joined #openvswitch | 11:09 | |
| *** EisNerd has quit IRC | 11:26 | |
| *** JamesBenson has joined #openvswitch | 11:35 | |
| *** JamesBenson has quit IRC | 11:39 | |
| *** JamesBenson has joined #openvswitch | 11:45 | |
| *** JamesBenson has quit IRC | 11:47 | |
| *** JamesBenson has joined #openvswitch | 11:47 | |
| *** psahoo has quit IRC | 11:49 | |
| *** osmanlicilegi has quit IRC | 11:50 | |
| *** psahoo has joined #openvswitch | 11:56 | |
| *** yamamoto has quit IRC | 12:01 | |
| *** osmanlicilegi has joined #openvswitch | 12:07 | |
| *** yamamoto has joined #openvswitch | 12:12 | |
| *** jraju__ has joined #openvswitch | 12:25 | |
| *** links has quit IRC | 12:25 | |
| *** jraju__ is now known as Jaison}afk | 12:40 | |
| *** bostondriver has joined #openvswitch | 12:40 | |
| *** yamamoto has quit IRC | 12:42 | |
| *** rtjure has quit IRC | 12:46 | |
| *** rtjure has joined #openvswitch | 12:47 | |
| *** donhw_ has joined #openvswitch | 12:49 | |
| *** donhw has quit IRC | 12:52 | |
| *** Jaison}afk is now known as Jaison | 13:02 | |
| *** Jaison is now known as jraju | 13:02 | |
| *** thaller has quit IRC | 13:05 | |
| *** thaller has joined #openvswitch | 13:05 | |
| *** thaller has quit IRC | 13:07 | |
| *** thaller has joined #openvswitch | 13:07 | |
| *** thaller has quit IRC | 13:12 | |
| *** thaller has joined #openvswitch | 13:15 | |
| *** thaller_ has joined #openvswitch | 13:18 | |
| *** yamamoto has joined #openvswitch | 13:19 | |
| *** thaller has quit IRC | 13:21 | |
| *** yamamoto has quit IRC | 13:22 | |
| *** psahoo has quit IRC | 13:39 | |
| *** psahoo has joined #openvswitch | 13:45 | |
| *** yamamoto has joined #openvswitch | 13:46 | |
| *** yamamoto has quit IRC | 13:53 | |
| *** rtjure has quit IRC | 14:14 | |
| *** rtjure has joined #openvswitch | 14:14 | |
| *** yamamoto has joined #openvswitch | 14:36 | |
| *** yamamoto has quit IRC | 14:42 | |
| *** rtjure has quit IRC | 14:49 | |
| *** mmirecki has quit IRC | 14:58 | |
| *** dcbw has joined #openvswitch | 15:03 | |
| *** ktraynor_ has joined #openvswitch | 15:10 | |
| *** blahdodo_ has joined #openvswitch | 15:11 | |
| *** dobson has joined #openvswitch | 15:12 | |
| *** jaicaa_ has joined #openvswitch | 15:13 | |
| *** blahdodo has quit IRC | 15:14 | |
| *** jaicaa has quit IRC | 15:14 | |
| *** mnasiadka has quit IRC | 15:14 | |
| *** JamesBen_ has joined #openvswitch | 15:14 | |
| *** mnasiadka_ has joined #openvswitch | 15:14 | |
| *** ktraynor has quit IRC | 15:14 | |
| *** dobson` has quit IRC | 15:14 | |
| *** dcbw has quit IRC | 15:14 | |
| *** JamesBenson has quit IRC | 15:14 | |
| *** strondeak has quit IRC | 15:14 | |
| *** donhw_ has quit IRC | 15:15 | |
| *** strondeak has joined #openvswitch | 15:15 | |
| *** _lore_ has quit IRC | 15:15 | |
| *** a5m0 has quit IRC | 15:15 | |
| *** dcbw has joined #openvswitch | 15:15 | |
| *** donhw has joined #openvswitch | 15:16 | |
| *** a5m0 has joined #openvswitch | 15:16 | |
| *** _lore_ has joined #openvswitch | 15:18 | |
| *** eelco has quit IRC | 15:36 | |
| *** yamamoto has joined #openvswitch | 15:40 | |
| *** troulouliou_div2 has quit IRC | 15:50 | |
| *** dmellado has joined #openvswitch | 16:00 | |
| *** yamamoto has quit IRC | 16:04 | |
| *** dmellado has quit IRC | 16:20 | |
| *** factor has joined #openvswitch | 16:21 | |
| *** icarusfactor has quit IRC | 16:21 | |
| *** dmellado has joined #openvswitch | 16:22 | |
| *** factor has quit IRC | 16:28 | |
| *** EisNerd has joined #openvswitch | 16:28 | |
| *** yamamoto has joined #openvswitch | 16:36 | |
| *** yamamoto has quit IRC | 16:45 | |
| *** armax has quit IRC | 16:50 | |
| *** armax has joined #openvswitch | 16:51 | |
| *** dceara has joined #openvswitch | 17:07 | |
| *** psahoo has quit IRC | 17:08 | |
| *** Franky_T has joined #openvswitch | 17:14 | |
| *** zhouhan_ has quit IRC | 17:16 | |
| numans | Hello | 17:16 |
|---|---|---|
| panda | 'lo | 17:16 |
| *** zhouhan has joined #openvswitch | 17:16 | |
| dceara | Hi | 17:16 |
| * numans checking if mmichelson is there to start the meeting. | 17:17 | |
| *** rtjure has joined #openvswitch | 17:17 | |
| numans | #help | 17:18 |
| numans | I guess we can start the meeting ? | 17:18 |
| panda | :) | 17:19 |
| numans | #startmeeting ovn_community_development_discussion | 17:19 |
| openstack | Meeting started Thu Jul 2 17:19:32 2020 UTC and is due to finish in 60 minutes. The chair is numans. Information about MeetBot at http://wiki.debian.org/MeetBot. | 17:19 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 17:19 |
| openstack | The meeting name has been set to 'ovn_community_development_discussion' | 17:19 |
| numans | Hello | 17:19 |
| panda | o/ | 17:19 |
| numans | Who want to go first | 17:19 |
| numans | Ok. I can go quick. | 17:20 |
| numans | I did some code reviews this week and a few small patches. | 17:20 |
| numans | This week I mostly worked on trying/exploring to optimize the conntrack usage in OVN | 17:21 |
| numans | so that we don't send the packet to conntrack to all the packets even if there is one ACL with allow-related. | 17:21 |
| numans | Lets see how that goes. | 17:21 |
| _lore_ | hi all | 17:22 |
| numans | I plan to look into dceara's lflow patches tomorrow. | 17:22 |
| numans | _lore_, Hi | 17:22 |
| numans | That's it from me. | 17:22 |
| numans | If some want to go next, then please. | 17:22 |
| *** ktraynor_ has quit IRC | 17:23 | |
| dceara | I can go next | 17:24 |
| dceara | Thanks numans for reviewing the Port_Group split v2 I sent earlier this week. | 17:26 |
| numans | dceara, welcome | 17:26 |
| dceara | While working on it I was thinking it might be useful to have a way to incrementally process Port_Group.ports updates. E.g. when a port is added/deleted from a port. However I don't see a easy way to implement it right now. | 17:27 |
| dceara | Complementary to numans investigation into conntrack I'm also looking into the possibility for the CMS to configure explicit rules to have part of the traffic skip conntrack. The end goal would be to be able to combine stateful and stateless ACLs in the same logical switch. | 17:28 |
| *** warewolf has quit IRC | 17:28 | |
| dceara | And today I sent new revisions of the DNAT lflow reduction patches and also a v8 of the IDL recovery patch. | 17:29 |
| dceara | That's it on my side, thanks. | 17:29 |
| mmichelson | Sorry, I just got back in. | 17:30 |
| mmichelson | I guess I can go next | 17:31 |
| numans | mmichelson, no worries. We start few minutes back. | 17:31 |
| mmichelson | To run counter to what dceara is doing, I'm looking to add some new conntrack usage in the case where ECMP routes are used. The idea is that if traffic is received over an ECMP route, then we want to send reply traffic out the same route. | 17:31 |
| mmichelson | Based on numans' and dceara's changes now being in master and 20.06, I plan next week to tag 20.06.1. | 17:32 |
| mmichelson | And I believe that's all for me to report. | 17:32 |
| mmichelson | Do we have anybody else that wishes to share? | 17:33 |
| imaximets | I could. | 17:33 |
| imaximets | A quick update on stable releases for those who do not read mail-list carefully. | 17:34 |
| imaximets | We discussed a little bit with Ben and, apparently, now I will prepare stable OVS releases. | 17:35 |
| numans | imaximets++ | 17:35 |
| imaximets | Target date to release new stables on all branches starting from 2.5 is not decided yet, but it should be somewhere soon. | 17:36 |
| imaximets | Technically, I'm waiting for patches to recommend new stable DPDK releases that should be very soon. | 17:36 |
| imaximets | After that I'll prepare patches and tag releases after review/merge. | 17:37 |
| imaximets | For the main OVS release we're now at the date of soft freeze. | 17:37 |
| imaximets | But, I think we need an official email for that. | 17:37 |
| imaximets | I wanted to catch blp here to ask, but it seems I will write an email to him to coordinate the dates. | 17:38 |
| mmichelson | imaximets, I was just about to ask if blp was going to be the one to send out that official email :) | 17:38 |
| mmichelson | But I guess you'll work that out with him | 17:39 |
| flaviof | imaximets++ Thanks a lot for doing this! | 17:39 |
| imaximets | mmichelson, yes, I think so. | 17:39 |
| imaximets | For the dates, my assumption is that branch should be created somewhere on July 17 (wraping to the end of the week as it was last time) | 17:40 |
| imaximets | But we will discuss that on a list, I suppose. | 17:40 |
| imaximets | From the non release related things: | 17:40 |
| imaximets | I sent out stream record/replay patch set. | 17:41 |
| imaximets | I told about it long time ago. To summarize: it allowes to record all the dats on the streams and replay it afterwards. | 17:42 |
| imaximets | More details here: | 17:42 |
| imaximets | #link https://patchwork.ozlabs.org/project/openvswitch/list/?series=186549 | 17:42 |
| imaximets | And that's it from my side. | 17:42 |
| dceara | imaximets: The record/replay functionality seems really cool! I plan to try it out next week. | 17:42 |
| *** dholler has quit IRC | 17:44 | |
| imaximets | dceara, thanks! | 17:44 |
| zhouhan | imaximets: This is cool. I will try to find some time to review it, too. | 17:45 |
| imaximets | zhouhan, cool! | 17:45 |
| zhouhan | imaximets: could you also review dceara's IDL patch. I acked it. | 17:46 |
| *** apus has quit IRC | 17:46 | |
| imaximets | zhouhan, yes. v7 looked fine, so I asked dceara to post v8. Will look at v8 closely. | 17:46 |
| zhouhan | mmichelson: Question on ECMP with conntrack, even if we can use conntrack for reply in OVN, maybe it doesn't help for traffic initiated from OVN to external network. The ECMP implementation on external routers (physical) would decide the return path. | 17:47 |
| mmichelson | zhouhan, Yes, that's a possibility. In the case I'm working to fix, each ECMP route is going to a separate physical router, and we know that the far end routes back to those same physical routers. | 17:49 |
| *** apus has joined #openvswitch | 17:50 | |
| zhouhan | mmichelson: I see. I guess it helps for debugging. Is there any other reason for that? | 17:51 |
| zhouhan | numans: dceara: Could you explain the idea how to avoid conntrack for ACL? Does it require that the stateless ACLs have higher priority than stateful ACLs? | 17:52 |
| mmichelson | zhouhan, I don't understand what you mean. It's to ensure the return traffic traverses the same return path. | 17:53 |
| zhouhan | mmichelson: I mean, why is it required to be on same return path? One obvious reason I can think is to make trouble shooting easier, but I think there might be other benefits you are thinking about. | 17:54 |
| zhouhan | mmichelson: or, is it because the physical routers have stateful features enabled, so it is mandatory to ensure it returns on same path? | 17:55 |
| mmichelson | zhouhan, https://bugzilla.redhat.com/show_bug.cgi?id=1849683 is the bug report that describes the problem in more detail. One cited reason in the report is ensuring that connection-oriented traffic follows the same path. it likely is due to stateful features enabled in the router as you mention | 17:56 |
| openstack | bugzilla.redhat.com bug 1849683 in OVN "[RFE] Add support for stateful next hop (ECMP bypass)" [Urgent,New] - Assigned to mmichels | 17:56 |
| zhouhan | mmichelson: got it, thanks | 17:56 |
| dceara | zhouhan: What I was looking at (for conntrack) was that if the CMS decides that, for example, "UDP traffic doesn't need stateful ACLs" we could add a filter in pre-ACL tables, set a bit in a register and based on that decide later if we send the packet to conntrack or not and if we match on ct_state or not. | 17:57 |
| dceara | zhouhan: this would allow the CMS to decide what traffic should be stateful firewalled and what traffic should be stateless firewalled | 17:57 |
| numans | zhouhan, right now even if one ACL with allow-related is present we send the traffic to conntrack (both in the ingress and egress pipeline of the ls) | 17:58 |
| numans | zhouhan, datapath testing done by our ovs team and dceara shows significant performance drops because of conntrack in general being slow | 17:58 |
| zhouhan | dceara: it means you will do the actual ACL matching for stateless ACLs in "pre-ACL" table, otherwise, how do you know if the packet should have the bit set or not? | 17:59 |
| zhouhan | numans: yes, I understand the motivation, but just wonder the "how" part. | 18:00 |
| numans | zhouhan, that's the challenging part. I did some poc by adding few actions like this : | 18:01 |
| numans | table=10(ls_in_stateful ), priority=100 , match=(reg0[1] == 1 && ip4), action=(ct_commit(ct_label=0/1); next; ct_save(ip4.src,ip4.dst); ) | 18:01 |
| numans | ct_save would actually translate to learn action | 18:01 |
| numans | and another ovn action - ct_is_saved(..) to check if we need to send the traffic to conntrack or not for the reply traffic. | 18:01 |
| numans | zhouhan, I'm just doing some poc now. Honestly don't know if its worth or not. | 18:02 |
| numans | and also planning to add a new acl type - allow-reply | 18:02 |
| dceara | zhouhan: It would be hierarchical in a way, in pre-acl we'd say, if traffic matches a pattern (e.g., is UDP) set a bit. Then in the ACL tables rules that have "allow", e.g. "match=udp.dport==4242" will translate to two openflows: 1) if register bit is 0 add match on ct_state 2) if register bit is 1 don't add match on ct_state. | 18:02 |
| numans | for ACLs of type allow-related, we would still keep the present implementation. | 18:02 |
| dceara | zhouhan: I'll try to send out an rfc soon so we can discuss about it on the mailing list. | 18:03 |
| zhouhan | dceara: I see. So pre-ACL checks more general rule, like is it UDP. That makes sense. | 18:03 |
| numans | dceara, The approach I'm taking kind of might come in your way. Like I'm determing if we need to send the pkt to conntrack or not in pre-acl stage. | 18:03 |
| numans | but not sure :) | 18:04 |
| dceara | numans: I call dibs on the highest priority in table pre-acl :) | 18:04 |
| numans | dceara, :) | 18:04 |
| dceara | numans: joking, we can definitely find a way to have both work together | 18:04 |
| numans | dceara, yeah provided the approach I'm taking makes sense. | 18:05 |
| numans | ofcourse there are few concerns with the approach I'm taking. | 18:05 |
| zhouhan | dceara: and it is implies that the "general" rules are with higher priority than anything else, e.g. if there is an ACL without TCP/UDP, but only IP and ports. | 18:05 |
| zhouhan | dceara: that ACL will be handled partially as stateful, even if it has "allow-related" | 18:06 |
| zhouhan | dceara: for UDP packet, it will not be tracked. | 18:06 |
| dceara | zhouhan: I was actually thinking only of acls with action "allow" | 18:07 |
| dceara | zhouhan: Those get changed "under the hood" to allow-related right now if there's at least one allow-related ACL configured on the LS. | 18:07 |
| numans | dceara, how would skip the conntrack in the egress pipeline ? | 18:07 |
| zhouhan | dceara: I mean, in pre-ACL stage you already marked the bit to skip conntrack, so even if the packet matches a "allow-related" rule, it won't get processed as stateful. | 18:07 |
| mmichelson | That sounds like a conflicting configuration | 18:08 |
| zhouhan | mmichelson: yes, it would be. But if we consider the "general" rules as high priority and overrides the specific rules, it might still work. (if documented well enough) | 18:09 |
| dceara | zhouhan: Yes, but as mmichelson said, it would be the job of the CMS to come up with a good general match. | 18:09 |
| zhouhan | ok, I think we are on the same page :) | 18:10 |
| dceara | :) | 18:10 |
| zhouhan | numans: Regarding "learn" action, there were problems of flow explosion. | 18:10 |
| numans | zhouhan, I also thought of translating ct_save to controller action. | 18:11 |
| numans | may be it can be done that way. | 18:11 |
| numans | zhouhan, but right now I'm just exploring if it is possible to do or not | 18:11 |
| numans | and not worring about flow explosion or hardtimeout of the flows. | 18:12 |
| zhouhan | numans: I am not sure about the details of your approach yet, no comment. It is great if you already thought about those problems :) | 18:12 |
| numans | zhouhan, Honestly I haven't thought much :). I'm thinking to tackle that as step 2. | 18:13 |
| numans | zhouhan, and throw away the code/approach if it can't solve it | 18:13 |
| zhouhan | numans: understand :) | 18:13 |
| zhouhan | I don't have much to update this week except some quick reviews. I will continue reviewing dceara's IP_INPUT flow reducing patches. | 18:14 |
| zhouhan | I will probably not attend the next 2 week's meetings. | 18:15 |
| zhouhan | (that's my update) | 18:15 |
| mmichelson | Hopefully you're doing something fun the next 2 weeks | 18:15 |
| dceara | zhouhan: thanks for the reviews! | 18:15 |
| flaviof | zhouhan: you will be missed | 18:15 |
| zhouhan | mmichelson: hopefully (PTO :) | 18:16 |
| numans | zhouhan, have a good PTO | 18:16 |
| zhouhan | flaviof: will miss you all! | 18:16 |
| flaviof | +1 | 18:16 |
| zhouhan | numans: thx! | 18:16 |
| mmichelson | OK, so anybody else, or have we reached the end of the meeting? | 18:16 |
| imaximets | quick question | 18:16 |
| imaximets | zhouhan, what with the raft issue you told a few weeks ago? | 18:17 |
| imaximets | zhouhan, have you managed to find a root cause? | 18:17 |
| zhouhan | imaximets: I didn't reproduce it (didn't try hard either) | 18:17 |
| * dceara is curious too about that | 18:17 | |
| imaximets | zhouhan, ack. | 18:17 |
| mmichelson | All right, thanks everybody. | 18:18 |
| imaximets | numans, I guess, you should stop the meeting as you started it. :) | 18:20 |
| numans | imaximets, ack. | 18:20 |
| numans | waiting for the signal | 18:20 |
| numans | #endmeeting | 18:20 |
| openstack | Meeting ended Thu Jul 2 18:20:40 2020 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 18:20 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/ovn_community_development_discussion/2020/ovn_community_development_discussion.2020-07-02-17.19.html | 18:20 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/ovn_community_development_discussion/2020/ovn_community_development_discussion.2020-07-02-17.19.txt | 18:20 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/ovn_community_development_discussion/2020/ovn_community_development_discussion.2020-07-02-17.19.log.html | 18:20 |
| dceara | Bye! | 18:21 |
| imaximets | Bye. | 18:21 |
| numans | mmichelson, your script will take care of sending the MoM to the ML right ? | 18:21 |
| numans | Bye | 18:21 |
| * flaviof wishes of a great long weekend to those of us in the US | 18:21 | |
| numans | flaviof, yeah happy independence day | 18:21 |
| zhouhan | bye all | 18:22 |
| mmichelson | numans, yes | 18:23 |
| numans | mmichelson, cool | 18:23 |
| mmichelson | numans, done! | 18:23 |
| *** dceara has quit IRC | 18:35 | |
| *** Franky_T has quit IRC | 18:53 | |
| *** armax has quit IRC | 19:39 | |
| *** zhouhan_ has joined #openvswitch | 20:17 | |
| *** zhouhan has quit IRC | 20:18 | |
| *** zhouhan_ has quit IRC | 21:11 | |
| *** zhouhan has joined #openvswitch | 21:16 | |
| *** bostondriver has quit IRC | 21:44 | |
| *** slaweq has quit IRC | 22:04 | |
| *** erig has quit IRC | 22:06 | |
| *** rtjure has quit IRC | 22:07 | |
| *** rebrec has joined #openvswitch | 22:21 | |
| *** rebrec has quit IRC | 22:34 | |
| *** armax has joined #openvswitch | 22:42 | |
| *** rcernin has joined #openvswitch | 22:42 | |
| *** armax has quit IRC | 23:25 | |
| *** zhouhan_ has joined #openvswitch | 23:39 | |
| *** zhouhan has quit IRC | 23:42 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!