| *** jmasud has quit IRC | 00:00 | |
| *** jmasud has joined #openstack-meeting | 00:05 | |
| *** ayoung has quit IRC | 00:14 | |
| *** macz_ has joined #openstack-meeting | 00:39 | |
| *** macz_ has quit IRC | 00:44 | |
| *** jmasud has quit IRC | 00:55 | |
| *** jmasud has joined #openstack-meeting | 00:56 | |
| *** yamamoto has joined #openstack-meeting | 01:01 | |
| *** Liang__ has joined #openstack-meeting | 01:04 | |
| *** ykatabam has quit IRC | 01:15 | |
| *** ttsiouts has joined #openstack-meeting | 01:17 | |
| *** ykatabam has joined #openstack-meeting | 01:20 | |
| *** rfolco has quit IRC | 01:29 | |
| *** ysandeep|away is now known as ysandeep|rover | 01:44 | |
| *** ttsiouts has quit IRC | 01:51 | |
| *** hyunsikyang has quit IRC | 01:53 | |
| *** masahito has joined #openstack-meeting | 02:00 | |
| *** masahito has quit IRC | 02:02 | |
| *** masahito has joined #openstack-meeting | 02:02 | |
| *** yamamoto has quit IRC | 02:03 | |
| *** yamamoto has joined #openstack-meeting | 02:16 | |
| *** Qitao has joined #openstack-meeting | 02:17 | |
| *** ociuhandu has joined #openstack-meeting | 02:23 | |
| *** macz_ has joined #openstack-meeting | 02:27 | |
| *** macz_ has quit IRC | 02:32 | |
| *** ysandeep|rover is now known as ysandeep|rover|b | 02:36 | |
| *** ttsiouts has joined #openstack-meeting | 02:49 | |
| *** yamamoto has quit IRC | 03:02 | |
| *** yamamoto has joined #openstack-meeting | 03:04 | |
| *** yamamoto has quit IRC | 03:04 | |
| *** yamamoto has joined #openstack-meeting | 03:05 | |
| *** yamamoto has quit IRC | 03:09 | |
| *** yamamoto has joined #openstack-meeting | 03:09 | |
| *** apetrich has quit IRC | 03:10 | |
| *** ttsiouts has quit IRC | 03:23 | |
| *** psachin has joined #openstack-meeting | 03:25 | |
| *** jmasud has quit IRC | 03:31 | |
| *** jmasud has joined #openstack-meeting | 03:32 | |
| *** jmasud has quit IRC | 03:36 | |
| *** jmasud has joined #openstack-meeting | 03:37 | |
| *** Qitao has quit IRC | 03:38 | |
| *** masahito has quit IRC | 03:42 | |
| *** ykatabam has quit IRC | 03:49 | |
| *** ykatabam has joined #openstack-meeting | 03:51 | |
| *** ysandeep|rover|b is now known as ysandeep|rover | 04:19 | |
| *** larainema has joined #openstack-meeting | 04:27 | |
| *** ociuhandu has quit IRC | 04:45 | |
| *** ociuhandu has joined #openstack-meeting | 04:46 | |
| *** ociuhandu has quit IRC | 04:52 | |
| *** jmasud has quit IRC | 04:54 | |
| *** jmasud has joined #openstack-meeting | 04:55 | |
| *** ykatabam has quit IRC | 05:12 | |
| *** ykatabam has joined #openstack-meeting | 05:12 | |
| *** yamamoto has quit IRC | 05:13 | |
| *** brinzhang has joined #openstack-meeting | 05:16 | |
| *** brinzhang_ has quit IRC | 05:16 | |
| *** ttsiouts has joined #openstack-meeting | 05:20 | |
| *** yamamoto has joined #openstack-meeting | 05:22 | |
| *** links has joined #openstack-meeting | 05:23 | |
| *** yamamoto has quit IRC | 05:38 | |
| *** JangwonLee_ has joined #openstack-meeting | 05:51 | |
| *** ttsiouts has quit IRC | 05:53 | |
| *** JangwonLee__ has quit IRC | 05:54 | |
| *** JangwonLee__ has joined #openstack-meeting | 05:55 | |
| *** JangwonLee_ has quit IRC | 05:59 | |
| *** jamesmcarthur has quit IRC | 06:07 | |
| *** yamamoto has joined #openstack-meeting | 06:09 | |
| *** hyunsikyang has joined #openstack-meeting | 06:17 | |
| *** igordc has quit IRC | 06:21 | |
| *** njohnston has quit IRC | 06:21 | |
| *** yamamoto has quit IRC | 06:22 | |
| *** yamamoto has joined #openstack-meeting | 06:35 | |
| *** rbudden has quit IRC | 06:44 | |
| *** ociuhandu has joined #openstack-meeting | 06:46 | |
| *** ociuhandu has quit IRC | 06:55 | |
| *** ociuhandu has joined #openstack-meeting | 06:55 | |
| *** slaweq has joined #openstack-meeting | 06:58 | |
| *** yamamoto has quit IRC | 07:02 | |
| *** yamamoto has joined #openstack-meeting | 07:05 | |
| *** ociuhandu has quit IRC | 07:05 | |
| *** ociuhandu has joined #openstack-meeting | 07:06 | |
| *** dklyle has quit IRC | 07:08 | |
| *** ttsiouts has joined #openstack-meeting | 07:09 | |
| *** ociuhandu has quit IRC | 07:11 | |
| *** brinzhang_ has joined #openstack-meeting | 07:17 | |
| *** bnemec has quit IRC | 07:20 | |
| *** brinzhang has quit IRC | 07:21 | |
| *** gtema has joined #openstack-meeting | 07:23 | |
| *** ociuhandu has joined #openstack-meeting | 07:26 | |
| *** ociuhandu has quit IRC | 07:32 | |
| *** jamesmcarthur has joined #openstack-meeting | 07:41 | |
| *** jamesmcarthur has quit IRC | 07:47 | |
| *** jmasud has quit IRC | 07:48 | |
| *** rpittau|afk is now known as rpittau | 07:56 | |
| *** ralonsoh has joined #openstack-meeting | 07:57 | |
| *** ysandeep|rover is now known as ysandeep|rover|l | 08:03 | |
| *** JangwonLee__ has quit IRC | 08:06 | |
| *** JangwonLee__ has joined #openstack-meeting | 08:06 | |
| *** ykatabam has quit IRC | 08:15 | |
| *** jmasud has joined #openstack-meeting | 08:25 | |
| *** ociuhandu has joined #openstack-meeting | 08:27 | |
| *** witek has joined #openstack-meeting | 08:32 | |
| *** ysandeep|rover|l is now known as ysandeep|lunch | 08:32 | |
| *** brinzhang has joined #openstack-meeting | 08:33 | |
| *** brinzhang_ has quit IRC | 08:36 | |
| *** ykatabam has joined #openstack-meeting | 08:39 | |
| *** jamesmcarthur has joined #openstack-meeting | 08:43 | |
| *** ykatabam has quit IRC | 08:44 | |
| *** ociuhandu has quit IRC | 08:44 | |
| *** jamesmcarthur has quit IRC | 08:48 | |
| *** rmart04 has joined #openstack-meeting | 08:49 | |
| *** ociuhandu has joined #openstack-meeting | 08:54 | |
| *** jmasud has quit IRC | 08:55 | |
| *** jmasud has joined #openstack-meeting | 08:56 | |
| *** ykatabam has joined #openstack-meeting | 09:06 | |
| *** jamesmcarthur has joined #openstack-meeting | 09:07 | |
| *** ysandeep|lunch is now known as ysandeep|rover | 09:09 | |
| *** jamesmcarthur has quit IRC | 09:12 | |
| *** ociuhandu has quit IRC | 09:15 | |
| *** ociuhandu has joined #openstack-meeting | 09:15 | |
| *** ociuhandu has quit IRC | 09:20 | |
| *** ykatabam has quit IRC | 09:35 | |
| *** maohongbo has quit IRC | 09:38 | |
| *** ociuhandu has joined #openstack-meeting | 09:43 | |
| *** jamesmcarthur has joined #openstack-meeting | 09:47 | |
| *** ociuhandu has quit IRC | 09:52 | |
| *** e0ne has joined #openstack-meeting | 09:54 | |
| *** jamesmcarthur has quit IRC | 09:55 | |
| *** ociuhandu has joined #openstack-meeting | 09:55 | |
| *** Liang__ has quit IRC | 10:01 | |
| *** jamesmcarthur has joined #openstack-meeting | 10:04 | |
| *** brinzhang has quit IRC | 10:09 | |
| *** ociuhandu has quit IRC | 10:09 | |
| *** ociuhandu has joined #openstack-meeting | 10:22 | |
| *** rpittau is now known as rpittau|bbl | 10:29 | |
| *** rcernin has quit IRC | 10:29 | |
| *** ociuhandu has quit IRC | 10:33 | |
| *** jamesmcarthur has quit IRC | 10:47 | |
| *** ysandeep|rover is now known as ysandeep|break | 11:05 | |
| *** yamamoto has quit IRC | 11:09 | |
| *** jamesmcarthur has joined #openstack-meeting | 11:14 | |
| *** ociuhandu has joined #openstack-meeting | 11:17 | |
| *** jamesmcarthur has quit IRC | 11:20 | |
| *** yamamoto has joined #openstack-meeting | 11:27 | |
| *** ociuhandu has quit IRC | 11:32 | |
| *** pescobar has quit IRC | 11:37 | |
| *** ociuhandu has joined #openstack-meeting | 11:43 | |
| *** ysandeep|break is now known as ysandeep|rover | 11:48 | |
| *** ociuhandu has quit IRC | 11:49 | |
| *** pescobar has joined #openstack-meeting | 11:50 | |
| *** rpittau|bbl is now known as rpitau | 12:08 | |
| *** rpitau is now known as rpittau | 12:09 | |
| *** jamesmcarthur has joined #openstack-meeting | 12:15 | |
| *** jamesmcarthur has quit IRC | 12:20 | |
| *** pescobar has quit IRC | 12:22 | |
| *** njohnston has joined #openstack-meeting | 12:26 | |
| *** heikkine has quit IRC | 12:29 | |
| *** Lucas_Gray has joined #openstack-meeting | 12:30 | |
| *** Lucas_Gray has quit IRC | 12:35 | |
| *** Lucas_Gray has joined #openstack-meeting | 12:37 | |
| *** rh-jelabarre has joined #openstack-meeting | 12:38 | |
| *** Lucas_Gray has quit IRC | 12:40 | |
| *** moguimar has quit IRC | 12:45 | |
| *** Lucas_Gray has joined #openstack-meeting | 12:46 | |
| *** Lucas_Gray has quit IRC | 12:47 | |
| *** ociuhandu has joined #openstack-meeting | 12:47 | |
| *** andrebeltrami has joined #openstack-meeting | 12:48 | |
| *** zigo has quit IRC | 12:48 | |
| *** jamesmcarthur has joined #openstack-meeting | 12:51 | |
| *** zigo has joined #openstack-meeting | 12:51 | |
| *** jmasud has quit IRC | 12:54 | |
| *** stephen-ma has joined #openstack-meeting | 12:55 | |
| *** jamesmcarthur has quit IRC | 12:56 | |
| *** jmasud has joined #openstack-meeting | 12:56 | |
| *** raildo has joined #openstack-meeting | 12:58 | |
| *** rfolco has joined #openstack-meeting | 13:01 | |
| *** macz_ has joined #openstack-meeting | 13:16 | |
| *** macz_ has quit IRC | 13:20 | |
| *** rbudden has joined #openstack-meeting | 13:26 | |
| *** cgoncalves has joined #openstack-meeting | 13:28 | |
| *** manuvakery has quit IRC | 13:30 | |
| *** stephen-ma has quit IRC | 13:38 | |
| *** ociuhandu has quit IRC | 13:42 | |
| *** imalinovskiy has joined #openstack-meeting | 13:45 | |
| *** jamesmcarthur has joined #openstack-meeting | 13:52 | |
| *** mlavalle has joined #openstack-meeting | 13:56 | |
| *** jamesmcarthur has quit IRC | 13:57 | |
| *** ysandeep|rover is now known as ysandeep|away | 13:59 | |
| slaweq | #startmeeting neutron_drivers | 14:00 |
|---|---|---|
| openstack | Meeting started Fri Apr 3 14:00:37 2020 UTC and is due to finish in 60 minutes. The chair is slaweq. Information about MeetBot at http://wiki.debian.org/MeetBot. | 14:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 14:00 |
| *** openstack changes topic to " (Meeting topic: neutron_drivers)" | 14:00 | |
| openstack | The meeting name has been set to 'neutron_drivers' | 14:00 |
| mlavalle | o/ | 14:00 |
| slaweq | hi everyone :) | 14:00 |
| ralonsoh | hi | 14:01 |
| slaweq | lets wait few more minutes for njohnston haleyb amotoki and yamamoto | 14:02 |
| yamamoto | hi | 14:02 |
| mlavalle | /me had a conversation recently with dalvarez. He agrees that slaweq "esta jodido con ese jefe" | 14:03 |
| slaweq | :) | 14:03 |
| mlavalle | while we wait I might as well share | 14:03 |
| haleyb | hi | 14:03 |
| slaweq | ok, we have quorum already so I think we can start | 14:04 |
| njohnston | o/ | 14:05 |
| slaweq | #topic RFEs | 14:05 |
| *** openstack changes topic to "RFEs (Meeting topic: neutron_drivers)" | 14:05 | |
| slaweq | we have 3 rfes for today | 14:05 |
| slaweq | first one is: https://bugs.launchpad.net/neutron/+bug/1592028 | 14:05 |
| openstack | Launchpad bug 1592028 in neutron "[RFE] Support security-group-rule creation with address-groups" [Wishlist,Triaged] - Assigned to Roey Chen (roeyc) | 14:05 |
| *** macz_ has joined #openstack-meeting | 14:07 | |
| *** macz_ has quit IRC | 14:07 | |
| njohnston | Wow, that is quite an oldie | 14:07 |
| mlavalle | well, I resucitated it | 14:08 |
| slaweq | njohnston: yes, but mlavalle told me that he is interested in doing that | 14:08 |
| njohnston | I think it's a good idea; any sophisticated firewall system has the ability to construct these kinds of objects | 14:08 |
| *** macz_ has joined #openstack-meeting | 14:08 | |
| mlavalle | at my employer we want to implement it | 14:08 |
| slaweq | I think yamamoto has got valid question, he asked it in comment to this RFE | 14:09 |
| mlavalle | we would develop upstream and then use it in our internal deployments | 14:09 |
| njohnston | It would be especially good if they could be either global or tenant-local; in the private cloud scenario the ability for a central admin group to be able define IP blocks for common services is something I have seen a lot of pent up demand for | 14:09 |
| mlavalle | and the answer to yamamoto's question is most likely yes | 14:10 |
| mlavalle | although I would have to dig deeper in our use case | 14:10 |
| slaweq | personally I don't think that such update would be more complex than now add of new port to same security group when 'remote_group_id' is used there | 14:12 |
| slaweq | You need to update ipset on all hosts where this is used and IMO in this new case it would be similar | 14:12 |
| *** bnemec has joined #openstack-meeting | 14:13 | |
| *** bnemec is now known as beekneemech | 14:14 | |
| slaweq | mlavalle: are You going to implement that only for iptables_hybrid driver or for others too? | 14:14 |
| mlavalle | I don't think our intent is implement it for the hybrid driver | 14:15 |
| mlavalle | we don't use the hybrid driver | 14:16 |
| slaweq | so only openvswitch driver? | 14:16 |
| mlavalle | yes | 14:16 |
| njohnston | I'm all right with that | 14:16 |
| slaweq | me too | 14:17 |
| slaweq | I would just want to clarify one more thing | 14:17 |
| mlavalle | I mean, is the way forward, right? | 14:17 |
| slaweq | in RFE there is written something like: | 14:17 |
| slaweq | "NOTE: For the purpose of the use-case above, the default allow-egress rules are removed ("zero trust" model) once the default sg is created." | 14:17 |
| slaweq | but You are not going to propose removal of those rules from default groups? | 14:17 |
| mlavalle | no, keep in mind we are re-purposing an existing RFE | 14:18 |
| mlavalle | that clearly needs adaptation | 14:18 |
| *** TrevorV has joined #openstack-meeting | 14:18 | |
| njohnston | yeah, it was unclear to me why that would be a mandatory part of the proposal | 14:18 |
| slaweq | yes, I just wanted to make this clear as this would be pretty big backward incompatibility :) | 14:18 |
| mlavalle | LOL | 14:18 |
| slaweq | other than that I'm fine with accepting this rfe | 14:19 |
| njohnston | I like this on a number of levels. +1 | 14:19 |
| slaweq | but we will also probably need spec with description of new API | 14:19 |
| njohnston | yes definitely | 14:19 |
| slaweq | so +1 from me | 14:19 |
| ralonsoh | +1 from me (waiting for the spec) | 14:19 |
| mlavalle | yeah, we are fully expecting that the next step is a spec | 14:19 |
| yamamoto | +1 | 14:20 |
| slaweq | haleyb: any thoughts? | 14:20 |
| haleyb | i'm fine with it, +1 from me | 14:21 |
| mlavalle | ok, thanks, I'll assign that RFE to me then | 14:21 |
| slaweq | ok, so rfe approved, as a next step we are waiting for spec :) | 14:21 |
| mlavalle | and will write the spec | 14:21 |
| slaweq | thx mlavalle for revive this old spec | 14:21 |
| njohnston | yes thanks mlavalle! | 14:21 |
| mlavalle | :-) | 14:21 |
| slaweq | so next one | 14:22 |
| slaweq | https://bugs.launchpad.net/neutron/+bug/1869129 | 14:22 |
| openstack | Launchpad bug 1869129 in neutron "neutron accepts CIDR in security groups that are invalid in ovn" [Undecided,In progress] - Assigned to Jake Yip (waipengyip) | 14:22 |
| slaweq | this one was reported as bug in ovn SG driver first | 14:22 |
| slaweq | but then someone raised point that this is currently potential security issue e.g. in iptables driver | 14:22 |
| slaweq | and that we should fix it on API level | 14:22 |
| slaweq | so I wanted to discuss it here as potentially new rfe | 14:23 |
| haleyb | so i did have a thought on this one, as it reminded me of another bug i fixed | 14:23 |
| haleyb | https://bugs.launchpad.net/neutron/+bug/1582500 | 14:23 |
| openstack | Launchpad bug 1582500 in neutron "icmp, icmpv6 and ipv6-icmp should raise duplicated sg rule exception" [Wishlist,Fix released] - Assigned to Miguel Lavalle (minsel) | 14:23 |
| haleyb | https://review.opendev.org/#/c/453346/ was the fix | 14:23 |
| haleyb | in that case the SG api was changed to always force the SG rule to have a common name, can we just treat this bug similarly and change it to write the correct value to the DB? | 14:24 |
| haleyb | and maybe have to change the RPC side as well, or fix the other drivers | 14:25 |
| njohnston | I was thinking along similar lines to haleyb | 14:25 |
| slaweq | haleyb: so if someone will set e.g. 192.168.1.100/24 in rule, we will change it to 192.168.1.0/24 | 14:25 |
| slaweq | correct? | 14:25 |
| haleyb | slaweq: yes, use cidr.cidr from netaddr.IPNetwork() | 14:25 |
| *** ociuhandu has joined #openstack-meeting | 14:25 | |
| haleyb | i realize the caller might notice the difference | 14:25 |
| slaweq | we can add e.g warning in logs to tell at least to cloud admin that we did such convertion | 14:26 |
| njohnston | yes, if the caller did "create rule with $ip/$mask; check for creation by listing groups and grepping for $ip/$mask" then we broke them if $ip gets converted. Hopefully people don't use such antipatterns though. | 14:27 |
| haleyb | right. i haven't verified but if we allow 192.168.1.100/24 and 192.168.1.99/24 rules, fixing to use the network would also possibly fix a duplicate rule issue | 14:27 |
| slaweq | haleyb: You mean this warning on agent's side? | 14:28 |
| njohnston | I think the warning would be on the server side since we should do this conversion before we store it in the db | 14:28 |
| yamamoto | does it solve the security concern? (i don't understand the security concern) | 14:29 |
| * cgoncalves lurks and notices a potential Neutron stable API breakage coming | 14:29 | |
| haleyb | slaweq: would have to be a warning on the server side i think if at all, i can't remember if we warn for the icmp one i mentioned | 14:29 |
| haleyb | cgoncalves: no, i want to leave the API alone and not start failing on these cidrs | 14:30 |
| *** jamesmcarthur has joined #openstack-meeting | 14:30 | |
| cgoncalves | haleyb, IIRC you said you'd store in the DB the "good" CIDR so I expect the API to return it instead of the user-provided CIDR | 14:31 |
| njohnston | cgoncalves raises a good point though, we should consider if "the ip you put in the rule is the same IP you expect to get out of the rule" is implicit in the api contract | 14:31 |
| haleyb | i don't know, but we have precedence for doing this in the ipv6-icmp case | 14:32 |
| ralonsoh | I wouldn't follow this path: we should not sanitize a CIDR (store the correct one in the DB) and don't fail | 14:33 |
| haleyb | the tempest SG case might notice this and fail though | 14:33 |
| ralonsoh | because the user won't notice that | 14:33 |
| slaweq | yamamoto: security concern raised in comment #5 is that if user will set bad cidr in rule, he may open his SG for wider range | 14:33 |
| ralonsoh | this will really break the compatibility | 14:33 |
| yamamoto | slaweq: he will get what he specified, won't he? | 14:34 |
| slaweq | yamamoto: I would need to check it but according to c#5 | 14:34 |
| haleyb | ralonsoh: even if what we're actually enforcing is the "correct" cidr? | 14:34 |
| ralonsoh | yamamoto, not depending on the backend | 14:34 |
| slaweq | setting 192.168.1.1/0 will end up with rule like "-A neutron-linuxbri-i4abb52c4-d -j ACCEPT" | 14:35 |
| ralonsoh | haleyb, yes because (1) now we'll probably have duplicated rules and (2) we must warn the user (or fail) | 14:35 |
| cgoncalves | slaweq, human config error will always happen. it is not a security issue. the system does what it is told to enforce | 14:35 |
| cgoncalves | slaweq, that is correct. there is nothing wrong with it | 14:35 |
| njohnston | isn't that correct behavior for a 0 netmask? why would you ever use a /0 netmask unless you wanted to open it up tot he world? Working As Intended | 14:35 |
| ralonsoh | cgoncalves, I don't agree, if we can detect that we should raise an exception | 14:36 |
| slaweq | njohnston: cgoncalves TBH I agree with You - we can't prevent users from making any mistakes | 14:36 |
| cgoncalves | ralonsoh, it's a valid CIDR per the RFC | 14:36 |
| haleyb | ralonsoh: i think we would actually catch duplicate rules now as we'd actually use netaddr.IPNetwork(ip).cidr | 14:36 |
| njohnston | I have used /0 netmasks before, but that was when I intended to expose a service tot he world | 14:37 |
| cgoncalves | ralonsoh, if you want to prevent that, sure, create a new API but don't touch the existing one | 14:37 |
| mlavalle | I lean towards to avoid getting in the mind reading business | 14:38 |
| mlavalle | let's do what the user is asking us to do through the API | 14:39 |
| slaweq | so it seems that with haleyb's proposal even, the only improvement would be that we would change what user send in request that he could see "correct" cidr in rule show | 14:39 |
| slaweq | >>> n = netaddr.IPNetwork("192.168.1.1/0") | 14:39 |
| slaweq | >>> n.cidr | 14:39 |
| slaweq | IPNetwork('0.0.0.0/0') | 14:39 |
| slaweq | but still security "issue" would be the same | 14:39 |
| ralonsoh | exactly | 14:40 |
| ralonsoh | cgoncalves, and "192.168.1.1/0" is not a valid CIDR | 14:40 |
| ralonsoh | the CIDR is 0.0.0.0/0 | 14:40 |
| *** EmilienM is now known as EvilienM | 14:40 | |
| cgoncalves | ralonsoh, sure it is a valid CIDR | 14:40 |
| haleyb | >>> netaddr.IPNetwork('192.168.1.100/24').cidr | 14:41 |
| haleyb | IPNetwork('192.168.1.0/24') | 14:41 |
| mlavalle | ahh, I see your point ralonsoh | 14:41 |
| haleyb | no complaints from netaddr | 14:41 |
| slaweq | haleyb: yes, I also checked that | 14:41 |
| slaweq | so it would have basically same effect in e.g. iptables as is now | 14:42 |
| slaweq | the difference would be that user would see "correct" network address in rule get | 14:42 |
| haleyb | i agree the /0 is an odd case, but really is user error if i'm remembering the last time we thought about it | 14:43 |
| njohnston | I think the /0 case is unrelated to correcting the network address | 14:43 |
| haleyb | slaweq: yes, it would behave the same in iptables, and maybe fix OVN? what to do about old rules in the OVN case? | 14:43 |
| *** jamesmcarthur has quit IRC | 14:44 | |
| njohnston | I got disconnected so let me replay the last couple of lines I sent: | 14:44 |
| *** jamesmcarthur has joined #openstack-meeting | 14:44 | |
| njohnston | so back to the core issue here, it looks like OVN only accepts the network number when specifying a CIDR as opposed to any IP in the network, and that is not standard behavior. I think that if OVN has this incompatibility, does it impose a significant efficiency penalty for OVN to handle it within the OVN driver code? | 14:44 |
| slaweq | for ovn - we can simply do such convertion on driver's level and left all in db like it is now | 14:44 |
| haleyb | njohnston: ack, i think we'd need to fix something in OVN if even just to deal with existing rules | 14:45 |
| haleyb | and fyi, the API says this for remote_ip_prefix - "The remote IP prefix that is matched by this security group rule." | 14:46 |
| slaweq | so basically the main question here is: do we want to fix it on ovn driver's level for ovn that it will work with our current API, or do we want to change API/DB and make it works for all drivers in same way? | 14:46 |
| mlavalle | if the latter, wouldn't we have a backwards compatibility issue? | 14:47 |
| haleyb | slaweq: i think we have to fix OVN regardless | 14:47 |
| slaweq | mlavalle: IMO with latter we will have some api change | 14:47 |
| mlavalle | yeah and then wouldn't we incur in backwards compatibility issue? | 14:48 |
| slaweq | so my proposal is to fix/change it in ovn driver and add maybe some warning in API ref that this should be network adress, otherwise it will be converted to network address by driver | 14:48 |
| haleyb | mlavalle: do you mean at the API level? | 14:49 |
| mlavalle | yes | 14:49 |
| mlavalle | I'm just trying to explore the implications | 14:50 |
| haleyb | it depends on if we think changing the cidr in the rule to be what we're enforcing vs what was in the POST is ok | 14:50 |
| haleyb | we do tweak it for ipv6-icmp and noone's noticed | 14:51 |
| mlavalle | so far at least | 14:51 |
| mlavalle | LOL | 14:51 |
| * haleyb crosses fingers | 14:51 | |
| slaweq | but for cidr it may be noticed faster IMHO | 14:51 |
| *** njohnston_ has joined #openstack-meeting | 14:51 | |
| mlavalle | that's true | 14:52 |
| haleyb | i wonder if tempest checks, it definitely fails with the API change, and that enforcement could be a bigger backwards-compat issue | 14:55 |
| njohnston_ | WRT /0 I think we have traditionally not been in the business of preventing users from shooting themselves in the foot | 14:56 |
| slaweq | haleyb: https://github.com/openstack/neutron-tempest-plugin/blob/master/neutron_tempest_plugin/api/test_security_groups.py seems that is comparing rules' ids :) | 14:56 |
| haleyb | njohnston: no, the gun is loaded | 14:56 |
| njohnston_ | I could imagine creating a new exception “you asked for a rule with an IP specified but a net ask of /0; to request a wide open rule you must specify 0.0.0.0/0” | 14:57 |
| slaweq | njohnston_++ for such api change :) | 14:58 |
| haleyb | njohnston: yes, that would be ok with me (or use "any" which is also a synonym) | 14:58 |
| slaweq | ok, we are almost on top of hour so we need to finish here for today | 14:58 |
| slaweq | I will summarize this disussion in comment to the LP bug | 14:59 |
| slaweq | and we will get back to it next week | 14:59 |
| slaweq | fine for You? | 14:59 |
| mlavalle | yes | 14:59 |
| njohnston | yes | 14:59 |
| yamamoto | yes | 14:59 |
| haleyb | yes, thanks | 14:59 |
| cgoncalves | Nate's suggestion is not backward compatible | 14:59 |
| slaweq | ok, thx for attending and have a great weekend (at home mostly) | 15:00 |
| slaweq | o/ | 15:00 |
| slaweq | #endmeeting | 15:00 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings/" | 15:00 | |
| openstack | Meeting ended Fri Apr 3 15:00:13 2020 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:00 |
| *** jamesmcarthur has quit IRC | 15:00 | |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/neutron_drivers/2020/neutron_drivers.2020-04-03-14.00.html | 15:00 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/neutron_drivers/2020/neutron_drivers.2020-04-03-14.00.txt | 15:00 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/neutron_drivers/2020/neutron_drivers.2020-04-03-14.00.log.html | 15:00 |
| *** yamamoto has quit IRC | 15:00 | |
| *** jamesmcarthur has joined #openstack-meeting | 15:00 | |
| mlavalle | o/ | 15:00 |
| *** mlavalle has left #openstack-meeting | 15:00 | |
| *** klindgren_ has quit IRC | 15:06 | |
| *** klindgren has joined #openstack-meeting | 15:07 | |
| *** dklyle has joined #openstack-meeting | 15:09 | |
| *** e0ne has quit IRC | 15:12 | |
| *** jiaopengju2 has quit IRC | 15:18 | |
| *** imalinovskiy has quit IRC | 15:18 | |
| *** jgriffith has quit IRC | 15:18 | |
| *** jgriffith has joined #openstack-meeting | 15:18 | |
| *** jiaopengju1 has joined #openstack-meeting | 15:18 | |
| *** jiaopengju1 has quit IRC | 15:18 | |
| *** jiaopengju1 has joined #openstack-meeting | 15:19 | |
| *** njohnston_ has quit IRC | 15:20 | |
| *** yamamoto has joined #openstack-meeting | 15:20 | |
| *** gyee has joined #openstack-meeting | 15:22 | |
| njohnston | sorry, I got disconnected there. Replaying the last couple things I said:/quit | 15:29 |
| *** igordc has joined #openstack-meeting | 15:32 | |
| *** links has quit IRC | 15:35 | |
| *** rpittau is now known as rpittau|afk | 15:43 | |
| *** gtema has quit IRC | 15:48 | |
| *** ysandeep|away is now known as ysandeep | 15:49 | |
| *** psachin has quit IRC | 15:53 | |
| *** yamamoto has quit IRC | 15:53 | |
| *** ysandeep is now known as ysandeep|away | 15:56 | |
| *** witek has quit IRC | 16:02 | |
| *** e0ne has joined #openstack-meeting | 16:02 | |
| *** ociuhandu has quit IRC | 16:08 | |
| *** Lucas_Gray has joined #openstack-meeting | 16:11 | |
| *** cmurphy is now known as cmorpheus | 16:13 | |
| *** yamamoto has joined #openstack-meeting | 16:16 | |
| *** Lucas_Gray has quit IRC | 16:20 | |
| *** armax has joined #openstack-meeting | 16:20 | |
| *** rmk has quit IRC | 16:31 | |
| *** rmk has joined #openstack-meeting | 16:31 | |
| *** jmasud has quit IRC | 16:55 | |
| *** jmasud has joined #openstack-meeting | 16:57 | |
| *** yamamoto has quit IRC | 17:00 | |
| *** jiaopengju1 has quit IRC | 17:03 | |
| *** jiaopengju1 has joined #openstack-meeting | 17:04 | |
| *** Lucas_Gray has joined #openstack-meeting | 17:06 | |
| *** jlvillal is now known as jlvillal_laptop | 17:10 | |
| *** jlvillal_laptop is now known as jlvill-travel | 17:10 | |
| *** jlvill-travel is now known as jlvacation | 17:11 | |
| *** jlvacation is now known as jlv-sick | 17:11 | |
| *** jlv-sick is now known as jlviva-viva | 17:11 | |
| *** jlviva-viva is now known as jlvillal | 17:11 | |
| *** gtema has joined #openstack-meeting | 17:11 | |
| *** ociuhandu has joined #openstack-meeting | 17:12 | |
| *** bbowen has quit IRC | 17:14 | |
| *** bbowen has joined #openstack-meeting | 17:14 | |
| *** gtema has quit IRC | 17:19 | |
| *** gtema has joined #openstack-meeting | 17:20 | |
| *** gtema has quit IRC | 17:25 | |
| *** jamesmcarthur has quit IRC | 17:26 | |
| *** jamesmcarthur has joined #openstack-meeting | 17:29 | |
| *** jamesmcarthur has quit IRC | 17:33 | |
| *** JangwonLee__ has quit IRC | 17:33 | |
| *** jamesmcarthur has joined #openstack-meeting | 17:34 | |
| *** JangwonLee__ has joined #openstack-meeting | 17:34 | |
| *** yamamoto has joined #openstack-meeting | 17:39 | |
| *** yamamoto has quit IRC | 17:47 | |
| *** slaweq has quit IRC | 17:47 | |
| *** ociuhandu has quit IRC | 18:17 | |
| *** ociuhandu has joined #openstack-meeting | 18:17 | |
| *** ociuhandu has quit IRC | 18:23 | |
| *** manuvakery has joined #openstack-meeting | 18:24 | |
| *** ralonsoh has quit IRC | 18:38 | |
| *** slaweq has joined #openstack-meeting | 18:38 | |
| *** rmart04 has quit IRC | 18:38 | |
| *** jamesmcarthur has quit IRC | 18:39 | |
| *** macz_ has quit IRC | 18:59 | |
| *** hemna has quit IRC | 18:59 | |
| *** njohnston has quit IRC | 19:01 | |
| *** njohnston has joined #openstack-meeting | 19:05 | |
| *** hemna_ has joined #openstack-meeting | 19:08 | |
| *** hemna_ has quit IRC | 19:08 | |
| *** hemna_ has joined #openstack-meeting | 19:10 | |
| *** slaweq has quit IRC | 19:10 | |
| *** hemna_ has quit IRC | 19:11 | |
| *** ttsiouts has quit IRC | 19:12 | |
| *** gtema has joined #openstack-meeting | 19:26 | |
| *** jamesmcarthur has joined #openstack-meeting | 19:28 | |
| *** jamesmcarthur has quit IRC | 19:28 | |
| *** jamesmcarthur has joined #openstack-meeting | 19:29 | |
| *** gtema has quit IRC | 19:30 | |
| *** ttsiouts has joined #openstack-meeting | 19:32 | |
| *** hemna has joined #openstack-meeting | 19:34 | |
| *** hemna has quit IRC | 19:37 | |
| *** ttsiouts has quit IRC | 19:37 | |
| *** Lucas_Gray has quit IRC | 19:52 | |
| *** TrevorV has quit IRC | 19:54 | |
| *** macz_ has joined #openstack-meeting | 19:57 | |
| *** Lucas_Gray has joined #openstack-meeting | 19:57 | |
| *** ociuhandu has joined #openstack-meeting | 19:58 | |
| *** macz_ has quit IRC | 20:02 | |
| *** ttsiouts has joined #openstack-meeting | 20:04 | |
| *** ttsiouts has quit IRC | 20:09 | |
| *** Lucas_Gray has quit IRC | 20:13 | |
| *** Lucas_Gray has joined #openstack-meeting | 20:17 | |
| *** macz_ has joined #openstack-meeting | 20:23 | |
| *** Lucas_Gray has quit IRC | 20:24 | |
| *** manuvakery has quit IRC | 20:34 | |
| *** e0ne has quit IRC | 20:38 | |
| *** ociuhandu has quit IRC | 20:46 | |
| *** ociuhandu has joined #openstack-meeting | 20:47 | |
| *** ociuhandu has quit IRC | 20:52 | |
| *** jmasud has quit IRC | 20:55 | |
| *** jmasud has joined #openstack-meeting | 20:56 | |
| *** ociuhandu has joined #openstack-meeting | 21:00 | |
| *** raildo has quit IRC | 21:01 | |
| *** ociuhandu has quit IRC | 21:04 | |
| *** EvilienM is now known as EmilienM | 21:07 | |
| *** jamesmcarthur has quit IRC | 21:23 | |
| *** jamesmcarthur has joined #openstack-meeting | 21:24 | |
| *** jamesmcarthur has quit IRC | 21:29 | |
| *** jamesmcarthur has joined #openstack-meeting | 21:36 | |
| *** yamamoto has joined #openstack-meeting | 21:44 | |
| *** yamamoto has quit IRC | 21:50 | |
| *** macz_ has quit IRC | 22:13 | |
| *** larainema has quit IRC | 22:25 | |
| *** ttsiouts has joined #openstack-meeting | 22:28 | |
| *** ttsiouts has quit IRC | 22:32 | |
| *** igordc has quit IRC | 22:36 | |
| *** igordc has joined #openstack-meeting | 22:36 | |
| *** rh-jelabarre has quit IRC | 22:38 | |
| *** andrebeltrami has quit IRC | 22:57 | |
| *** ttsiouts has joined #openstack-meeting | 23:05 | |
| *** jamesmcarthur has quit IRC | 23:19 | |
| *** jamesmcarthur has joined #openstack-meeting | 23:20 | |
| *** jamesmcarthur has quit IRC | 23:25 | |
| *** jamesmcarthur has joined #openstack-meeting | 23:29 | |
| *** ociuhandu has joined #openstack-meeting | 23:36 | |
| *** ttsiouts has quit IRC | 23:38 | |
| *** ociuhandu has quit IRC | 23:41 | |
| *** tetsuro has joined #openstack-meeting | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!