19:00:10 <oanson> #startmeeting Dragonflow
19:00:11 <openstack> Meeting started Mon Jan  1 19:00:10 2018 UTC and is due to finish in 60 minutes.  The chair is oanson. Information about MeetBot at http://wiki.debian.org/MeetBot.
19:00:12 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
19:00:14 <openstack> The meeting name has been set to 'dragonflow'
19:00:23 <oanson> So how many survived into 2018 ?
19:00:45 <leyal> Hi ,at least 2 ;)
19:00:52 <oanson> I have two workoholics, and one mean-looking cat.
19:01:22 <oanson> All right. Let's roll with this.
19:01:25 <oanson> #topic roadmap
19:01:47 <oanson> The only progress I know of is in the tempest gate.
19:02:09 <oanson> We have a single failing test remaining - cross tenant communications with Security Groups
19:02:20 <oanson> snapiri found the bug there
19:02:35 <oanson> Bug https://bugs.launchpad.net/dragonflow/+bug/1740739
19:02:36 <openstack> Launchpad bug 1740739 in DragonFlow "Security group mismatch for floating IP" [High,New]
19:02:49 <oanson> I'll go into details here, and skip it in the bugs section.
19:03:03 <oanson> Basically, we saw that the security group rules allow based on the port's IP address.
19:03:03 <leyal> cool , so we will see green tempest soon ?
19:03:15 <oanson> leyal, no. That bug is a Biggie :(
19:03:27 <leyal> :(
19:03:36 <oanson> But in cross-tenant, the packet is natted (the test uses floating IPs)
19:03:51 <oanson> So the security group rule doesn't match on the port's floating IP, only the private IP.
19:04:28 <leyal> Is that bug on the test , or bug is SG behavior ?
19:04:31 <oanson> This is doubly problematic, because if there is IP overlap between the tenants (which is allowed), then we just allowed access for a different port with that IP, which we shouldn't have
19:04:39 <oanson> The bug is in SG behaviour. This is a real bug
19:05:15 <oanson> I was hoping to get a vote today if the bug should be upgraded to critical. But I guess this will have to wait for tomorrow after everyone reviewed the log
19:05:58 <oanson> I don't have a solution of the top of my head. We need to take into account public IPs (which means mixing dNAT and SG logic)
19:06:26 <oanson> We also need to know when the private IP is routable and only take those cases into account, which means taking the destination port into account in the rules, which is not done at the moment
19:06:28 <leyal> don't sure that i understand , we don't have a port field in SG-rule
19:07:02 <oanson> The security group rules rely either on IPs (single or subnets), or on other security groups
19:07:19 <oanson> In the case of other security groups, it means all logical ports which have that security group.
19:07:31 <oanson> i.e. these ports are members of this security group
19:07:52 <oanson> Say I have ports A,B,C,D. I have security group E and F.
19:08:11 <oanson> ports A,B are attached to sec group E, and C,D are attached to group F.
19:08:11 <leyal> yep , got it.
19:08:22 <oanson> Well, I'll finish the example anyway :)
19:08:44 <oanson> Now if group E allows ssh from group F, the ports A,B should allow ssh from port C,D.
19:08:58 <oanson> And if we go through nat, it gets... strange
19:09:34 <oanson> So if anyone has a magical solution, please suggest it on the bug.
19:09:36 <leyal> so we need so sperate between ip on the same tenant , if same-tenant use internal ip , if it's other tenant use the public ip e.g NAT
19:09:54 <oanson> In essence, yes.
19:10:31 <oanson> s/same tenant/non-routable networks/. Since the scenario is also valid for same tenant, but different networks.
19:11:12 <oanson> That's all I have for roadmap. leyal, you have something?
19:11:21 <leyal> yep
19:11:29 <oanson> Shoot
19:11:44 <leyal> https://review.openstack.org/#/c/529971/
19:12:11 <oanson> Yes. Very cool, by the way!
19:12:42 <leyal> actually this patch is drivers for kuryr - for using DF to connect between kubertes pod .
19:13:05 <oanson> Yes
19:13:52 <leyal> it's just a poc , there is still a lot of work for really use DF as networking backend for k8s
19:14:06 <oanson> Yes. I see that there are some interesting comments on it
19:14:51 <leyal> yep , got many comment , i will upload new PS hopfully this week
19:15:01 <oanson> Cool. Looking forwards to testing it :)
19:15:36 <oanson> leyal, anything else on this?
19:15:48 <leyal> thats all from my side :)
19:15:54 <oanson> Cool.
19:16:10 <oanson> #topic Bugs
19:16:24 <oanson> We already discussed https://bugs.launchpad.net/dragonflow/+bug/1740739
19:16:25 <openstack> Launchpad bug 1740739 in DragonFlow "Security group mismatch for floating IP" [High,New]
19:16:30 <oanson> That's all I had that was interesting.
19:16:31 <oanson> leyal, ?
19:17:07 <leyal> I didn't know about something else
19:17:24 <oanson> Cool
19:17:24 <oanson> #topic Open Discussion
19:17:33 <oanson> I have nothing here either.
19:17:45 <leyal> me too
19:17:49 <oanson> Cool.
19:17:53 <oanson> Then thanks for coming!
19:17:56 <oanson> #endmeeting