Thursday, 2017-11-16

*** yamamoto has joined #openstack-fwaas00:40
*** yamamoto has quit IRC00:45
*** obre has quit IRC01:22
*** Aju has quit IRC01:22
*** carl_baldwin has quit IRC01:22
*** xgerman_ has quit IRC01:22
*** fyxim has quit IRC01:22
*** reedip has quit IRC01:22
*** openstackgerrit has quit IRC01:22
*** amotoki has quit IRC01:22
*** mfranc213 has quit IRC01:22
*** ChanServ has quit IRC01:22
*** hoangcx has quit IRC01:22
*** bzhao has quit IRC01:22
*** bbzhao has quit IRC01:22
*** zigo has quit IRC01:22
*** mestery has quit IRC01:22
*** doude has quit IRC01:22
*** jdavis has quit IRC01:22
*** threestrands has quit IRC01:22
*** njohnston has quit IRC01:22
*** jhesketh has quit IRC01:22
*** threestrands has joined #openstack-fwaas01:28
*** bbzhao has joined #openstack-fwaas01:28
*** hoangcx has joined #openstack-fwaas01:28
*** bzhao has joined #openstack-fwaas01:28
*** zigo has joined #openstack-fwaas01:28
*** mestery has joined #openstack-fwaas01:28
*** reedip has joined #openstack-fwaas01:28
*** fyxim has joined #openstack-fwaas01:28
*** xgerman_ has joined #openstack-fwaas01:28
*** obre has joined #openstack-fwaas01:28
*** openstackgerrit has joined #openstack-fwaas01:28
*** carl_baldwin has joined #openstack-fwaas01:28
*** Aju has joined #openstack-fwaas01:28
*** njohnston has joined #openstack-fwaas01:28
*** amotoki has joined #openstack-fwaas01:28
*** jhesketh has joined #openstack-fwaas01:28
*** doude has joined #openstack-fwaas01:28
*** mfranc213 has joined #openstack-fwaas01:28
*** ChanServ has joined #openstack-fwaas01:28
*** barjavel.freenode.net sets mode: +o ChanServ01:28
*** annp has joined #openstack-fwaas01:28
*** hoangcx has quit IRC01:41
openstackgerritNguyen Phuong An proposed openstack/neutron-fwaas master: Adding unique constraint for port_id  https://review.openstack.org/51215401:41
*** jdavis has joined #openstack-fwaas01:41
*** hoangcx has joined #openstack-fwaas01:41
*** yamamoto has joined #openstack-fwaas01:42
*** jdavis has quit IRC01:43
*** yamamoto has quit IRC01:47
*** yamamoto has joined #openstack-fwaas02:43
*** yamamoto has quit IRC02:49
*** yamamoto has joined #openstack-fwaas03:14
*** AlexeyAbashkin has joined #openstack-fwaas03:21
*** AlexeyAbashkin has quit IRC03:25
*** chandanc has joined #openstack-fwaas04:33
*** eN_Guruprasad_Rn has joined #openstack-fwaas06:28
*** threestrands has quit IRC07:30
openstackgerritAkihiro Motoki proposed openstack/neutron-fwaas-dashboard master: .gitignore: add translation catalogs (.mo and .pot)  https://review.openstack.org/52033507:47
*** bzhao has quit IRC07:55
*** bzhao has joined #openstack-fwaas07:55
*** yamamoto_ has joined #openstack-fwaas08:24
*** yamamoto_ has quit IRC08:25
*** yamamoto has quit IRC08:28
*** AlexeyAbashkin has joined #openstack-fwaas08:29
*** yamamoto has joined #openstack-fwaas09:20
*** yamamoto has quit IRC09:52
*** jdavis has joined #openstack-fwaas09:53
*** jdavis has quit IRC09:54
*** annp has quit IRC10:12
*** yamamoto has joined #openstack-fwaas10:14
*** yamamoto_ has joined #openstack-fwaas10:22
*** yamamoto has quit IRC10:26
*** yamamoto_ has quit IRC11:29
*** eN_Guruprasad_Rn has quit IRC11:40
*** eN_Guruprasad_Rn has joined #openstack-fwaas11:41
*** eN_Guruprasad_Rn has quit IRC11:44
*** eN_Guruprasad_Rn has joined #openstack-fwaas11:45
*** yamamoto has joined #openstack-fwaas11:45
*** yamamoto has quit IRC11:50
*** yamamoto has joined #openstack-fwaas11:55
*** yamamoto has quit IRC12:05
*** yamamoto has joined #openstack-fwaas12:15
*** eN_Guruprasad_Rn has quit IRC12:17
*** eN_Guruprasad_Rn has joined #openstack-fwaas12:18
*** eN_Guruprasad_Rn has quit IRC12:19
*** yamamoto has quit IRC12:20
*** yamamoto has joined #openstack-fwaas12:30
*** yamamoto has quit IRC12:34
*** yamamoto has joined #openstack-fwaas12:45
*** yamamoto has quit IRC12:50
*** yamamoto has joined #openstack-fwaas13:00
*** yamamoto has quit IRC13:04
*** yamamoto has joined #openstack-fwaas13:15
*** yamamoto has quit IRC13:20
*** yamamoto has joined #openstack-fwaas13:30
*** yamamoto has quit IRC13:34
reedipo/13:40
*** SarathMekala has joined #openstack-fwaas13:41
*** annp has joined #openstack-fwaas13:43
*** sarathmekala_ has joined #openstack-fwaas13:47
*** SarathMekala has quit IRC13:49
*** hoangcx_ has joined #openstack-fwaas13:50
*** doude has quit IRC13:55
*** yushiro has joined #openstack-fwaas13:59
yushirohi14:00
*** sarathmekala_ has quit IRC14:00
annphi14:00
*** chandanc has joined #openstack-fwaas14:00
*** yamamoto has joined #openstack-fwaas14:00
*** SridarK has joined #openstack-fwaas14:00
yushiro#startmeeting fwaas14:00
openstackMeeting started Thu Nov 16 14:00:51 2017 UTC and is due to finish in 60 minutes.  The chair is yushiro. Information about MeetBot at http://wiki.debian.org/MeetBot.14:00
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.14:00
*** openstack changes topic to " (Meeting topic: fwaas)"14:00
openstackThe meeting name has been set to 'fwaas'14:00
SridarKHi FWaaS folks14:00
chandancHello All14:01
yushiro#chair SridarK yushiro xgerman_14:01
openstackCurrent chairs: SridarK xgerman_ yushiro14:01
yushiroI think today is xgerman_ :)14:01
xgerman_One sec14:01
SridarKyes14:01
xgerman_ok14:02
SridarKxgerman_: do u want me to start off with summit feedback14:02
xgerman_yes14:02
SridarK#topic Summit feedback14:02
*** openstack changes topic to "Summit feedback (Meeting topic: fwaas)"14:02
SridarKSo this summit the attendance it seems was abt 2400 or so  - again this is what i heard not official figures14:03
SridarKthere were not as many contributors at least from neutron14:03
yushiroyeah14:04
reedipdamn bad luck14:04
SridarKmany folks i know did not make it because Sydney is quite far for most folks14:04
*** doude has joined #openstack-fwaas14:04
xgerman_yes, indeed14:04
doudeHi14:04
yushirodoude, hi14:05
*** yamamoto has quit IRC14:05
SridarKamongst FWaaS, yushiro, doude and myself were there and we had met up twice to discuss some of our priorities so it was useful14:05
SridarKlot of focus on containers and OpenStack14:05
yushiroyes14:06
xgerman_they have most of the talks as videos online14:07
SridarKin our FWaaS discussions - we went over the L2 support patches and the priorities and had a good discussions with doude on refactoring to use service drivers14:07
SridarKwhich was something we have wanted to do from the I release14:08
SridarKso our priorities to focus on merging the L2 support, more testing and pull in the Service drivers as major actions and pull in some of the things we have been discussing such as Audit support and look at the Common Classifier (depending on what we see as community adoption)14:09
SridarKi think those were the main things to bring back to the team14:09
SridarKxgerman_: +1 on videos14:10
reedipso what are the targetted plans14:10
reedipI mean do we have a roadmap for the patches ?14:10
SridarKreedip: step 1 to merge in L2 support, the agent is done, i want to complete my testing and then i am good to +A14:11
yushiroSridarK, +114:11
reedipok14:11
SridarKstep 2: Pull in the driver and coexistence with SG14:11
reedipSridarK : lets write this down as the roadmap for the Q cycle in the fwaas etherpad , that ways we would know where we are lagging14:11
SridarKthis will need more testing14:11
SridarKreedip: ok i will add that14:12
xgerman_+114:12
reedipWe generally have everything in the meeting but I forget it by next meeting, I hope others dont though :)14:12
xgerman_I am really hoping we get L2 in by Q-214:12
SridarKhad a chat with chandanc on step 2 - lets discuss that today - he has some things to bring up for discussion today14:13
chandancsure SridarK14:13
SridarKstep 3 Focus on doude's changes for service driver - i think we can pull this in for Q14:13
*** doude has quit IRC14:13
reedipIMHO, it would should be our only focus for Q-314:14
SridarKand we focus on more testing both manual and translating that to tempest14:14
reedipwith functional/fullstack testing improvement14:14
SridarKreedip: +114:14
xgerman_+114:14
yushiro+114:15
SridarKAs other features, lets pull in Audit RFE and other things that we come up with14:15
xgerman_I like to see remote FWG…14:15
SridarKxgerman_: +1 lets add that to the list14:15
reedipxgerman_ whats that ?14:15
*** yamamoto has joined #openstack-fwaas14:15
xgerman_it’s the same as remote security groups — so you can have rules referencing ports in other groups14:16
annp+1 xgerman_14:16
SridarKCommon classifier - we can look at as well14:16
chandancxgerman_: thats nice14:16
SridarKSG logging should get in this cycle14:17
*** doude has joined #openstack-fwaas14:17
*** doude has quit IRC14:17
*** doude has joined #openstack-fwaas14:17
SridarKso yushiro will plan for FWaaS logging as well but possibly next cycle14:17
annpSridarK, yeah. :)14:17
yushiroSridarK, Yes, definitely... I hope.  I wish. I believe  :)14:17
SridarK:-)14:17
xgerman_The Holoiday season starts in the US so…14:18
hoangcx_lol yushiro14:18
xgerman_#topic L2 support14:18
*** openstack changes topic to "L2 support (Meeting topic: fwaas)"14:18
SridarKSo this was the tentative plan, again nothing is cast in stone - but again this is nothing new - i think we are all on the same page14:18
SridarKsorry xgerman_ go ahead14:19
xgerman_it’s mostly we need to discuss annp’s patch14:19
SridarKi had some issues with my deployment  so could not finish my tests14:19
SridarKonce i complete - i am good with the agent PS14:19
*** yamamoto has quit IRC14:20
SridarKxgerman_: yes14:20
SridarKalso lets give the floor to chandanc to bring up some discussion14:20
chandancsure,14:20
annpxgerman_: yes, chandanc, please go ahead14:21
chandancI have done some test with the co-existense patch,14:21
chandancbut the idea is a bit different here14:21
chandanclet me share the link to the ppt for the same14:21
chandanchttps://docs.google.com/presentation/d/1tRf-JQQiF0v_BdJahDjraxSEgz3c41YGdzHj3ui1C0Q/edit?usp=sharing14:21
SridarKannp: pls jump in as u had planned a mtg last week too - i am not fully aware of the outcome14:22
chandancthe second slide should make things clear about the proposal14:22
yushirochandanc, OK14:23
chandancin the co existense case i am proposing for a 2 table based abbroach to hold just the drop rules in fwaas policies14:23
xgerman_slide 4: “Conntrack handling is delegated to Security Groups tables” — we still need to pull the conntrack entry for ports we deny14:23
chandanceverything else is delegated to SG14:24
reedipwhy just the drop tables ?14:24
reedipoh the reject and accept are given to SG14:24
annpchandanc, nice idea!14:24
chandancxgerman_: we will have rule based match and drop14:25
chandancya14:25
xgerman_but if the connections is alreday in conntrack won’t they bypass ys?14:25
reedipone question... why FW Egress is going to SG Egress. Wont it be the opposite ?14:25
chandancxgerman_: i think the contrack will be over ridden as our tables are the first in the stack14:25
reedipWe have FW -> SG -> Node , right ?14:25
chandancreedip: yes14:26
xgerman_mmh, not sure…it often bypasses things for speed14:26
reedipchandanc : ok , I am confused with the yes... I dont know what I said was right :)14:26
chandancWe have FW -> SG -> Node , right ?14:27
chandancyes to that14:27
reedipok ... so chandanc : again my question ... would FWEgress table forward the packet to SG Egress table ?14:27
annpchandanc, have you tested with your proposal?14:28
reedipshouldnt it be the opposite ? I mean the ingress is also the same ...14:28
chandancthe flow of packet is vm1 - Egress of FWAAS - Base of SG Egress - Egress Rules of SG and then reverse14:28
chandanci have just generated the outputs14:28
chandancannp: have a look here http://paste.openstack.org/show/626423/14:28
annpchandanc, let's  me see14:29
chandancthis is for co-exist case14:29
chandancsure14:29
SridarKannp: what are ur thoughts regarding conn track do u see any issues14:29
chandancin stand alone mode complete set of rules are generated http://paste.openstack.org/show/626424/14:29
xgerman_SridarK +1 — conntrack worries me as well14:30
chandanci think people can have a look and think about it, we can discuss during the wek14:30
annpSridarK, yeah, i think the problem related to conntrack14:30
SridarKyes this was defn one of the things we wanted to flush out and discuss with everyone14:30
chandancok, this is what i have on the conntrack part14:31
SridarKI am not that familiar but annp hoangcx_ - u guys are the experts14:31
chandancthe connection is initiated - and as it traverses through the conntrack modules the entry is made to new connection depending on te fact that it is allowed by firewall14:32
xgerman_yes, my worry is if we get a rule to deny an established connection14:33
chandanconce the conntrack entry is made, any related or reply packet to the original connection is allowed14:33
annpSridarK, chandanc, actually, i haven't understood why conntrack has been changed from +new-est to +est-rep+rpl for first packet.14:33
chandancthen the connection goes to eastablished14:33
chandancnow if we have a deny rule in the first table, the new connection cannot be created14:34
chandancif a eastablish connection is present and a deny rule is added to fwaas, it will be added to the first table14:35
SridarKxgerman_: the workflow u bring up is that we have an est connection, then the user updates the policy with a rule that should deny this est flow ?14:35
xgerman_yep14:35
chandancand the rules in the first table will take precedence over the conntrack allow rules in the SG tables later14:35
chandancSridarK: yes14:36
chandancannp: i think as we have 2 tables managing conntrack there is a possibllity of FWaaS tables making the conntrack entry , so when the packet reaches the SG table it is not new any more14:36
annpchandanc, ah, yes, you're right14:38
hoangcx_+1 xgerman_'s concern. It was occurred with iptables conntrack (we fixed it). For OVS, we need to check for that.14:38
chandanchoangcx: i agree conntrack needs to be verified by testing, it can bring up unthough of cases14:39
annpchandanc, do you mean in your approach, conntrack will be managed by fwaas, right?14:41
chandancno by SG alone14:41
chandancin co-exist case14:41
chandancFWaaS tables will only take care of deny rules to explicitly drop packets14:42
annpchandanc, I mean in co-exist case, fwg will be create conntrack entry, right?14:42
chandancannp no, SG will create the conntrack, once it is know that the connection is allowed by both FWaaS and SG rules14:43
chandancany connection not allowed by FWaaS will be already dropped in the initial tables and will never reach SG14:43
xgerman_ok, that makes sense14:44
chandancif the connection is also allowed by SG only then conntrack will be added14:44
chandancxgerman_: thanks :)14:44
annpchandanc, that makes sense, it's same my initial idea14:45
chandancannp: i agree :)14:45
*** yamamoto has joined #openstack-fwaas14:45
chandanci just tried to make it simpler with 2 tables only14:45
xgerman_yeah, I like the simpler approach even if it means different code paths for stand-alone/co-existence14:46
annpchandanc, but i'm afraid about performance in case co-existence, a packets must be travelled into all accept flows of fwg, right?14:47
chandancxgerman_: actually i have the code merged for standalone and co-exist, and it is triggered based on a flag14:47
chandancannp, not sure i got the case14:47
hoangcx_I think we don't need to care performance at initial step14:48
hoangcx_(OVS performance looks so good AFAIK)14:49
yushirohoangcx_, +114:49
chandanchoangcx: agree, i would prefer to be correct then to be performent for the first pass14:49
annpchandanc, ah, ok.14:49
hoangcx_We can enhance it later then when functionality land14:50
*** yamamoto has quit IRC14:50
SridarKbut lets evaluate annp's concern so we know what the downsides are14:50
chandancsure SridarK14:50
annpSridarK, +114:50
hoangcx_SridarK: +114:50
yushiroSridarK, +114:51
chandanclets bring up the cases where we see issues, so that we know the problems14:51
chandanc+114:51
chandancI would like to push in the code to gerrit for better review14:52
SridarK+114:52
annpchandanc, yeah, Please do that.14:52
chandanci can work on the co-existance patch from annp, or a separate one14:52
SridarKAlso if folks can think thru this more14:52
yushirochandanc, will take a look.14:52
chandancUp to annp14:53
chandanc:) i hope annp has a backup of his code14:53
annpchandanc, yes, please update my patch. I have backup once. :)14:53
SridarKchandanc: , annp: if u can sync up more to ensure that things are good and if all use cases work that will work14:54
chandanccool annp14:54
SridarKgerrit or offline14:54
SridarKchandanc: thx for putting together a ppt to clarify things14:54
chandancSure SridarK14:54
xgerman_T-514:55
reedip need to leave, another meeting.. will check rest of the discussion later ... thanks :)14:55
chandancI will update the PS by tomorrow after some cleanup14:55
yushirochandanc, Thanks.14:56
SridarKsounds good14:56
annpchandanc: thanks14:56
SridarKAlso i was wondering why someone would want to enable both L2 FWaaS and SG (other than a transition period)14:57
chandancyushiro: annp please review the patch once i publish and let me know14:57
yushirochandanc, YEEES!!14:57
annpchandanc, sure14:57
SridarKi would think we it will be either - or14:57
xgerman_yeah, eventually it should all be FW14:58
SridarKand eventually we get to a point we have only one security model on L214:58
chandancSridarK: i would like to think so14:58
SridarKwe should also have a plan if we have a deployment with SG on iptables and L2 FWaaS14:58
yushiroFinally, we are enough to use only FWG.  However, I think it is more useful by using SG with 'remote_group_id' like AWS SG.14:58
SridarKi think we called out that we will not support that14:59
chandancSridarK: yes that one is not covered14:59
SridarKbut we should understand the implications and if we need to disallow that in our code14:59
SridarK1 min14:59
yushiroGood discussion today :)15:00
xgerman_#endmeeting15:00
*** openstack changes topic to "#openstack-fwaas"15:00
openstackMeeting ended Thu Nov 16 15:00:31 2017 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)15:00
SridarK+115:00
openstackMinutes:        http://eavesdrop.openstack.org/meetings/fwaas/2017/fwaas.2017-11-16-14.00.html15:00
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/fwaas/2017/fwaas.2017-11-16-14.00.txt15:00
xgerman_+115:00
openstackLog:            http://eavesdrop.openstack.org/meetings/fwaas/2017/fwaas.2017-11-16-14.00.log.html15:00
*** yamamoto has joined #openstack-fwaas15:00
SridarKthanks all for joining15:00
yushiroThanks all.  Good night.15:00
chandancthanks all, bye15:00
xgerman_next week is a Holiday in the US15:00
SridarKxgerman_: yes15:01
xgerman_SridarK - will you be around?15:01
SridarKxgerman_: yes i will be around15:01
xgerman_or should we skip?15:01
xgerman_ok, 6 am is early enough…15:01
SridarKxgerman_: sigh too early :-)15:01
xgerman_that too15:01
annpthanks all. G9 :)15:02
yushiroxgerman_, SridarK We're national holiday too in Japan.15:02
SridarKmaybe we can keep the mtg - esp since most folks on the driver side of things do no have a holiday15:02
SridarKyushiro: oh really15:02
yushiro23th Nov.15:02
xgerman_mmh15:03
SridarKmaybe we can keep it - in case annp and chandanc need to close on things15:03
SridarKi can be there15:03
xgerman_me, too15:03
yushiroSridarK, OK, I see.15:03
SridarKwe can keep it short15:03
xgerman_yep…15:03
yushiroSridarK, If possible, I can join too.15:03
SridarKok good lets do that15:03
SridarKyushiro: no worries in case u are not able to15:03
yushiroThx15:03
SridarKyushiro: i will connect with in my eve time15:04
SridarKso to wrap up the testing15:04
yushiro:)15:04
SridarKin case i have questions15:04
SridarKthx15:04
*** hoangcx_ has quit IRC15:04
*** yushiro has quit IRC15:04
annpSridarK, :) thank you.15:04
SridarKannp: thx15:05
*** yamamoto has quit IRC15:05
*** annp has left #openstack-fwaas15:06
*** chandanc has quit IRC15:06
*** yamamoto has joined #openstack-fwaas15:15
*** yamamoto has quit IRC15:20
*** yamamoto has joined #openstack-fwaas15:30
*** yamamoto has quit IRC15:34
*** yamamoto has joined #openstack-fwaas15:45
*** yamamoto has quit IRC15:49
*** vks1 has joined #openstack-fwaas15:53
*** openstackgerrit has quit IRC16:03
*** yamamoto has joined #openstack-fwaas16:15
*** SridarK has quit IRC16:17
*** yamamoto has quit IRC16:19
*** yamamoto has joined #openstack-fwaas16:30
*** AlexeyAbashkin has quit IRC16:32
*** yamamoto has quit IRC16:35
*** yamamoto has joined #openstack-fwaas16:45
*** yamamoto has quit IRC16:49
*** yamamoto has joined #openstack-fwaas16:54
*** yamamoto has quit IRC16:54
*** yamamoto has joined #openstack-fwaas17:55
*** yamamoto has quit IRC18:01
*** vks1 has quit IRC18:02
*** amotoki has quit IRC18:20
*** yamamoto has joined #openstack-fwaas18:26
*** yamamoto has quit IRC18:30
*** yamamoto has joined #openstack-fwaas18:41
*** yamamoto has quit IRC18:46
*** yamamoto has joined #openstack-fwaas18:54
*** yamamoto has quit IRC19:14
*** yamamoto has joined #openstack-fwaas19:17
*** openstackgerrit has joined #openstack-fwaas19:33
openstackgerritAndreas Jaeger proposed openstack/neutron-fwaas-dashboard master: Remove setting of version/release from releasenotes  https://review.openstack.org/52071219:33
openstackgerritAndreas Jaeger proposed openstack/neutron-fwaas master: Remove setting of version/release from releasenotes  https://review.openstack.org/52071319:34
*** yamamoto has quit IRC20:16
*** yamamoto has joined #openstack-fwaas21:17
openstackgerritMerged openstack/neutron-fwaas-dashboard master: Remove setting of version/release from releasenotes  https://review.openstack.org/52071221:19
*** yamamoto has quit IRC21:22
*** yamamoto has joined #openstack-fwaas21:54
openstackgerritMerged openstack/neutron-fwaas master: Remove setting of version/release from releasenotes  https://review.openstack.org/52071322:22
*** yamamoto_ has joined #openstack-fwaas23:27
*** yamamoto has quit IRC23:31

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!