)]}'
{"doc/source/specs/security_groups.rst":[{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"ec462cf12bb42d66e4db32eaaa6a335a7c589645","unresolved":false,"context_lines":[{"line_number":120,"context_line":"  at each compute node per security group), this is an increasing number."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"2) On the ingress classification table (table 0) , Dragonflow sets reg6 to"},{"line_number":123,"context_line":"  match the port security group id"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"3) On L2 lookup and L3 lookup tables Dragonflow installs flows which set reg5"},{"line_number":126,"context_line":"  as the destination port security group id (at this point the destination port"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a7b0d38_2920b447","line":123,"updated":"2015-12-28 07:58:54.000000000","message":"What port you mean here ?\nSource TCP/UDP port ?\nVM port ?","commit_id":"8a8d600f59a663d4a1c7f9ba3b52686ee345723d"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"c08ca0fc1fd0e8edf019d517f86e36b38e0fd97e","unresolved":false,"context_lines":[{"line_number":120,"context_line":"  at each compute node per security group), this is an increasing number."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"2) On the ingress classification table (table 0) , Dragonflow sets reg6 to"},{"line_number":123,"context_line":"  match the port security group id"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"3) On L2 lookup and L3 lookup tables Dragonflow installs flows which set reg5"},{"line_number":126,"context_line":"  as the destination port security group id (at this point the destination port"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a7b0d38_ad390fa6","line":123,"in_reply_to":"1a7b0d38_2920b447","updated":"2015-12-28 08:33:16.000000000","message":"Done","commit_id":"8a8d600f59a663d4a1c7f9ba3b52686ee345723d"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"ec462cf12bb42d66e4db32eaaa6a335a7c589645","unresolved":false,"context_lines":[{"line_number":123,"context_line":"  match the port security group id"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"3) On L2 lookup and L3 lookup tables Dragonflow installs flows which set reg5"},{"line_number":126,"context_line":"  as the destination port security group id (at this point the destination port"},{"line_number":127,"context_line":"  both for L2 or L3 is known - we are after distributed virtual routing step)"},{"line_number":128,"context_line":"  (Dragonflow sets reg7 as the destination port id)"},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a7b0d38_a9da644a","line":126,"range":{"start_line":126,"start_character":9,"end_line":126,"end_character":25},"updated":"2015-12-28 07:58:54.000000000","message":"What destination port here ?\nDestination TCP/UDP port ?\nOr destination VM ?","commit_id":"8a8d600f59a663d4a1c7f9ba3b52686ee345723d"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"c08ca0fc1fd0e8edf019d517f86e36b38e0fd97e","unresolved":false,"context_lines":[{"line_number":123,"context_line":"  match the port security group id"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"3) On L2 lookup and L3 lookup tables Dragonflow installs flows which set reg5"},{"line_number":126,"context_line":"  as the destination port security group id (at this point the destination port"},{"line_number":127,"context_line":"  both for L2 or L3 is known - we are after distributed virtual routing step)"},{"line_number":128,"context_line":"  (Dragonflow sets reg7 as the destination port id)"},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a7b0d38_cd3edb8b","line":126,"range":{"start_line":126,"start_character":9,"end_line":126,"end_character":25},"in_reply_to":"1a7b0d38_a9da644a","updated":"2015-12-28 08:33:16.000000000","message":"Done","commit_id":"8a8d600f59a663d4a1c7f9ba3b52686ee345723d"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"ec462cf12bb42d66e4db32eaaa6a335a7c589645","unresolved":false,"context_lines":[{"line_number":129,"context_line":""},{"line_number":130,"context_line":"  *** Its important to note that currently broadcast/multicast traffic is"},{"line_number":131,"context_line":"   duplicated in the source, if we want to duplicate it at the destination, security"},{"line_number":132,"context_line":"   group rules must be applied at destination per port as we could have"},{"line_number":133,"context_line":"   different rules for different ports in regards to broadcast/multicast ***"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a7b0d38_09ea98db","line":132,"updated":"2015-12-28 07:58:54.000000000","message":"Again what port you mean here ?","commit_id":"8a8d600f59a663d4a1c7f9ba3b52686ee345723d"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"c08ca0fc1fd0e8edf019d517f86e36b38e0fd97e","unresolved":false,"context_lines":[{"line_number":129,"context_line":""},{"line_number":130,"context_line":"  *** Its important to note that currently broadcast/multicast traffic is"},{"line_number":131,"context_line":"   duplicated in the source, if we want to duplicate it at the destination, security"},{"line_number":132,"context_line":"   group rules must be applied at destination per port as we could have"},{"line_number":133,"context_line":"   different rules for different ports in regards to broadcast/multicast ***"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a7b0d38_ad602fa6","line":132,"in_reply_to":"1a7b0d38_09ea98db","updated":"2015-12-28 08:33:16.000000000","message":"Done","commit_id":"8a8d600f59a663d4a1c7f9ba3b52686ee345723d"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"6b68cbf112f8d352c92b3bfd61d74046fbacbf4c","unresolved":false,"context_lines":[{"line_number":271,"context_line":"This solution perform the ingress security group classification in the destination"},{"line_number":272,"context_line":"but in order to model security groups classification similar to the model"},{"line_number":273,"context_line":"i presented above, the destination also must know the source port security group id."},{"line_number":274,"context_line":"For this we use Geneve dynamic TLV and pass to the destination the source port"},{"line_number":275,"context_line":"security group id (in addition to the destination port id which is written"},{"line_number":276,"context_line":"in the tunnel VNI)."},{"line_number":277,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a7b0d38_8d853308","line":274,"range":{"start_line":274,"start_character":4,"end_line":274,"end_character":8},"updated":"2015-12-28 08:53:54.000000000","message":"Please add per our discussion The possibility of doing this in any tunneling protocol (VxLAn , GRE, Geneve)\n\n\nCurrently the tunnel id is a global mapping between   PORT_is --\u003e Tunnel_id \nif we change this to be ID mapping only between the Source Compute Node and the dest Compute Node then could easily use 24 bit (VxLan, GRE) to map the port id mapping in 12 bit and to map the SG src id in the other 12 bit","commit_id":"8a8d600f59a663d4a1c7f9ba3b52686ee345723d"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"1fcff20cc2f9a987141782b528bd91fdc44dd998","unresolved":false,"context_lines":[{"line_number":271,"context_line":"This solution perform the ingress security group classification in the destination"},{"line_number":272,"context_line":"but in order to model security groups classification similar to the model"},{"line_number":273,"context_line":"i presented above, the destination also must know the source port security group id."},{"line_number":274,"context_line":"For this we use Geneve dynamic TLV and pass to the destination the source port"},{"line_number":275,"context_line":"security group id (in addition to the destination port id which is written"},{"line_number":276,"context_line":"in the tunnel VNI)."},{"line_number":277,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a7b0d38_4d3f4b24","line":274,"range":{"start_line":274,"start_character":16,"end_line":274,"end_character":35},"updated":"2015-12-28 08:50:25.000000000","message":"only Geneve?","commit_id":"8a8d600f59a663d4a1c7f9ba3b52686ee345723d"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"1fcff20cc2f9a987141782b528bd91fdc44dd998","unresolved":false,"context_lines":[{"line_number":313,"context_line":""},{"line_number":314,"context_line":"Cons"},{"line_number":315,"context_line":"----"},{"line_number":316,"context_line":"1) We have to use Geneve (or other dynamic tunneling) in order to pass the"},{"line_number":317,"context_line":"source security group id number."},{"line_number":318,"context_line":""},{"line_number":319,"context_line":"2) We send traffic to destination even when we can know it is going to be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a7b0d38_6d0a477b","line":316,"range":{"start_line":316,"start_character":18,"end_line":316,"end_character":24},"updated":"2015-12-28 08:50:25.000000000","message":"I\u0027d like to mention that VxLAN is popular and has been used in almost all large-scale deployments. Moreover, lots of NICs supports VxLAN optimization for production. Is it meaningful to implement sg in this way? I doubt.","commit_id":"8a8d600f59a663d4a1c7f9ba3b52686ee345723d"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":82,"context_line":"A security rule applies either to inbound traffic (ingress) or outbound traffic (egress)."},{"line_number":83,"context_line":"You can grant access to a specific CIDR range, or to another security group."},{"line_number":84,"context_line":"When you specify a security group as the source for a rule,"},{"line_number":85,"context_line":"this allows ports associated with the source security group to access ports in the security group."},{"line_number":86,"context_line":"(The reverse behaviour applies the same for destination)"},{"line_number":87,"context_line":"The default security group is already populated with rules that allows ports in"},{"line_number":88,"context_line":"the group to access each other."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_eda87722","line":85,"updated":"2015-12-28 09:03:52.000000000","message":"What ports here in 2 cases?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":82,"context_line":"A security rule applies either to inbound traffic (ingress) or outbound traffic (egress)."},{"line_number":83,"context_line":"You can grant access to a specific CIDR range, or to another security group."},{"line_number":84,"context_line":"When you specify a security group as the source for a rule,"},{"line_number":85,"context_line":"this allows ports associated with the source security group to access ports in the security group."},{"line_number":86,"context_line":"(The reverse behaviour applies the same for destination)"},{"line_number":87,"context_line":"The default security group is already populated with rules that allows ports in"},{"line_number":88,"context_line":"the group to access each other."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_6c96c094","line":85,"in_reply_to":"1a7b0d38_eda87722","updated":"2015-12-28 14:06:46.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":84,"context_line":"When you specify a security group as the source for a rule,"},{"line_number":85,"context_line":"this allows ports associated with the source security group to access ports in the security group."},{"line_number":86,"context_line":"(The reverse behaviour applies the same for destination)"},{"line_number":87,"context_line":"The default security group is already populated with rules that allows ports in"},{"line_number":88,"context_line":"the group to access each other."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The above mentioned capability makes the current process of syncing security group information"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_ad658f1e","line":87,"updated":"2015-12-28 09:03:52.000000000","message":"TCP/UDP ports here ?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":84,"context_line":"When you specify a security group as the source for a rule,"},{"line_number":85,"context_line":"this allows ports associated with the source security group to access ports in the security group."},{"line_number":86,"context_line":"(The reverse behaviour applies the same for destination)"},{"line_number":87,"context_line":"The default security group is already populated with rules that allows ports in"},{"line_number":88,"context_line":"the group to access each other."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The above mentioned capability makes the current process of syncing security group information"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_6cdd606e","line":87,"in_reply_to":"1a7b0d38_ad658f1e","updated":"2015-12-28 14:06:46.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":88,"context_line":"the group to access each other."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The above mentioned capability makes the current process of syncing security group information"},{"line_number":91,"context_line":"difficult because it needs to keep track of all the ports and the security group they belong"},{"line_number":92,"context_line":"to and make sure to sync this information on every change to the local agents."},{"line_number":93,"context_line":"(In current implementation this is managed with ipsets to improve this problem)."},{"line_number":94,"context_line":"More then that, changes in port configuration (addition/removal) and changes in security group"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_6d6b27f2","line":91,"range":{"start_line":91,"start_character":52,"end_line":91,"end_character":57},"updated":"2015-12-28 09:03:52.000000000","message":"What ports here ?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":88,"context_line":"the group to access each other."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The above mentioned capability makes the current process of syncing security group information"},{"line_number":91,"context_line":"difficult because it needs to keep track of all the ports and the security group they belong"},{"line_number":92,"context_line":"to and make sure to sync this information on every change to the local agents."},{"line_number":93,"context_line":"(In current implementation this is managed with ipsets to improve this problem)."},{"line_number":94,"context_line":"More then that, changes in port configuration (addition/removal) and changes in security group"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_6c4b202b","line":91,"range":{"start_line":91,"start_character":52,"end_line":91,"end_character":57},"in_reply_to":"1a7b0d38_6d6b27f2","updated":"2015-12-28 14:06:46.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":91,"context_line":"difficult because it needs to keep track of all the ports and the security group they belong"},{"line_number":92,"context_line":"to and make sure to sync this information on every change to the local agents."},{"line_number":93,"context_line":"(In current implementation this is managed with ipsets to improve this problem)."},{"line_number":94,"context_line":"More then that, changes in port configuration (addition/removal) and changes in security group"},{"line_number":95,"context_line":"rules/groups require a complicated process or re-compiling the rules to iptable chains pipeline"},{"line_number":96,"context_line":"and rules.(Something that sometimes require re-compilation of the entire pipeline)"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_8d477376","line":94,"updated":"2015-12-28 09:03:52.000000000","message":"What port here ?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":91,"context_line":"difficult because it needs to keep track of all the ports and the security group they belong"},{"line_number":92,"context_line":"to and make sure to sync this information on every change to the local agents."},{"line_number":93,"context_line":"(In current implementation this is managed with ipsets to improve this problem)."},{"line_number":94,"context_line":"More then that, changes in port configuration (addition/removal) and changes in security group"},{"line_number":95,"context_line":"rules/groups require a complicated process or re-compiling the rules to iptable chains pipeline"},{"line_number":96,"context_line":"and rules.(Something that sometimes require re-compilation of the entire pipeline)"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_2c5198d8","line":94,"in_reply_to":"1a7b0d38_8d477376","updated":"2015-12-28 14:06:46.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Solution Guidelines"},{"line_number":105,"context_line":"--------------------"},{"line_number":106,"context_line":"1) Leverage OVS connection tracking for implementing state full rules"},{"line_number":107,"context_line":"2) Avoid the need to recompile or change flows for every port add/delete"},{"line_number":108,"context_line":"3) Keep flow number that implement security groups to a minimum"},{"line_number":109,"context_line":"4) Changes to security group rules will replace minimum number of flows"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_6d39e7f1","line":107,"range":{"start_line":107,"start_character":57,"end_line":107,"end_character":61},"updated":"2015-12-28 09:03:52.000000000","message":"What port here?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Solution Guidelines"},{"line_number":105,"context_line":"--------------------"},{"line_number":106,"context_line":"1) Leverage OVS connection tracking for implementing state full rules"},{"line_number":107,"context_line":"2) Avoid the need to recompile or change flows for every port add/delete"},{"line_number":108,"context_line":"3) Keep flow number that implement security groups to a minimum"},{"line_number":109,"context_line":"4) Changes to security group rules will replace minimum number of flows"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_8c568ccc","line":107,"range":{"start_line":107,"start_character":57,"end_line":107,"end_character":61},"in_reply_to":"1a7b0d38_6d39e7f1","updated":"2015-12-28 14:06:46.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":123,"context_line":"  match the VM port security group id"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"3) On L2 lookup and L3 lookup tables Dragonflow installs flows which set reg5"},{"line_number":126,"context_line":"  as the destination VM port security group id (at this point the destination port"},{"line_number":127,"context_line":"  both for L2 or L3 is known - we are after distributed virtual routing step)"},{"line_number":128,"context_line":"  (Dragonflow sets reg7 as the destination port id)"},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_0d2b8395","line":126,"range":{"start_line":126,"start_character":66,"end_line":126,"end_character":82},"updated":"2015-12-28 09:03:52.000000000","message":"destination VM port I suppose ?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":123,"context_line":"  match the VM port security group id"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"3) On L2 lookup and L3 lookup tables Dragonflow installs flows which set reg5"},{"line_number":126,"context_line":"  as the destination VM port security group id (at this point the destination port"},{"line_number":127,"context_line":"  both for L2 or L3 is known - we are after distributed virtual routing step)"},{"line_number":128,"context_line":"  (Dragonflow sets reg7 as the destination port id)"},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_cc07b4c8","line":126,"range":{"start_line":126,"start_character":66,"end_line":126,"end_character":82},"in_reply_to":"1a7b0d38_0d2b8395","updated":"2015-12-28 14:06:46.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":130,"context_line":"  *** Its important to note that currently broadcast/multicast traffic is"},{"line_number":131,"context_line":"   duplicated in the source, if we want to duplicate it at the destination, security"},{"line_number":132,"context_line":"   group rules must be applied at destination per VM port as we could have"},{"line_number":133,"context_line":"   different rules for different ports in regards to broadcast/multicast ***"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."},{"line_number":136,"context_line":"   We retrieve the connection state of this flow for IP and IPv6 traffic,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_5013605b","line":133,"range":{"start_line":133,"start_character":23,"end_line":133,"end_character":38},"updated":"2015-12-28 09:03:52.000000000","message":"What destination ports here ?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":130,"context_line":"  *** Its important to note that currently broadcast/multicast traffic is"},{"line_number":131,"context_line":"   duplicated in the source, if we want to duplicate it at the destination, security"},{"line_number":132,"context_line":"   group rules must be applied at destination per VM port as we could have"},{"line_number":133,"context_line":"   different rules for different ports in regards to broadcast/multicast ***"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."},{"line_number":136,"context_line":"   We retrieve the connection state of this flow for IP and IPv6 traffic,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_ac126807","line":133,"range":{"start_line":133,"start_character":23,"end_line":133,"end_character":38},"in_reply_to":"1a7b0d38_5013605b","updated":"2015-12-28 14:06:46.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."},{"line_number":136,"context_line":"   We retrieve the connection state of this flow for IP and IPv6 traffic,"},{"line_number":137,"context_line":"   The zone is the same as reg6 (src port security group id)::"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"     ip, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":140,"context_line":"     ip6, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_902308a7","line":137,"range":{"start_line":137,"start_character":33,"end_line":137,"end_character":41},"updated":"2015-12-28 09:03:52.000000000","message":"Here you talk about packet network src port right ?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."},{"line_number":136,"context_line":"   We retrieve the connection state of this flow for IP and IPv6 traffic,"},{"line_number":137,"context_line":"   The zone is the same as reg6 (src port security group id)::"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"     ip, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":140,"context_line":"     ip6, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_0c029cb4","line":137,"range":{"start_line":137,"start_character":33,"end_line":137,"end_character":41},"in_reply_to":"1a7b0d38_902308a7","updated":"2015-12-28 14:06:46.000000000","message":"No, VM port","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":151,"context_line":"6) We then have rules that match for all local security group rules on the outbound side"},{"line_number":152,"context_line":"   (Egress side - traffic leaving the local VM)."},{"line_number":153,"context_line":"   It is very easy to model these rules when we have both the source and destination"},{"line_number":154,"context_line":"   ports security group ids identified."},{"line_number":155,"context_line":"   On match we commit the flow to the connection tracking module with the same zone as the"},{"line_number":156,"context_line":"   source port security group id."},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_70553cf8","line":154,"range":{"start_line":154,"start_character":3,"end_line":154,"end_character":8},"updated":"2015-12-28 09:03:52.000000000","message":"VM ports or protocol ports ?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":151,"context_line":"6) We then have rules that match for all local security group rules on the outbound side"},{"line_number":152,"context_line":"   (Egress side - traffic leaving the local VM)."},{"line_number":153,"context_line":"   It is very easy to model these rules when we have both the source and destination"},{"line_number":154,"context_line":"   ports security group ids identified."},{"line_number":155,"context_line":"   On match we commit the flow to the connection tracking module with the same zone as the"},{"line_number":156,"context_line":"   source port security group id."},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_4c23c456","line":154,"range":{"start_line":154,"start_character":3,"end_line":154,"end_character":8},"in_reply_to":"1a7b0d38_70553cf8","updated":"2015-12-28 14:06:46.000000000","message":"VM ports","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":153,"context_line":"   It is very easy to model these rules when we have both the source and destination"},{"line_number":154,"context_line":"   ports security group ids identified."},{"line_number":155,"context_line":"   On match we commit the flow to the connection tracking module with the same zone as the"},{"line_number":156,"context_line":"   source port security group id."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"   For example, lets assume we have the following topology:"},{"line_number":159,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_30449448","line":156,"range":{"start_line":156,"start_character":10,"end_line":156,"end_character":14},"updated":"2015-12-28 09:03:52.000000000","message":"Again here","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":153,"context_line":"   It is very easy to model these rules when we have both the source and destination"},{"line_number":154,"context_line":"   ports security group ids identified."},{"line_number":155,"context_line":"   On match we commit the flow to the connection tracking module with the same zone as the"},{"line_number":156,"context_line":"   source port security group id."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"   For example, lets assume we have the following topology:"},{"line_number":159,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_6c200049","line":156,"range":{"start_line":156,"start_character":10,"end_line":156,"end_character":14},"in_reply_to":"1a7b0d38_30449448","updated":"2015-12-28 14:06:46.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":199,"context_line":"       match:ct_state\u003d+new+trk,tcp,reg6\u003dX,reg5\u003dY, actions\u003dct(commit,zone\u003dNXM_NX_REG6[0..15]),resubmit(,\u003cnext_table\u003e)"},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"   With this approach we can model every security group rule to exactly one flow, and"},{"line_number":202,"context_line":"   any changes in port additions/deletion don\u0027t have to change any of these flows just"},{"line_number":203,"context_line":"   the classification rules for that port (which have to change anyway)"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"   It is also very simple to delete/modify these flows in case of security rule update as"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_d07bd08a","line":202,"range":{"start_line":202,"start_character":18,"end_line":202,"end_character":22},"updated":"2015-12-28 09:03:52.000000000","message":"what port here?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"ee6fbe3b1f5946a4aa28639f369b2ca06cc94dc7","unresolved":false,"context_lines":[{"line_number":199,"context_line":"       match:ct_state\u003d+new+trk,tcp,reg6\u003dX,reg5\u003dY, actions\u003dct(commit,zone\u003dNXM_NX_REG6[0..15]),resubmit(,\u003cnext_table\u003e)"},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"   With this approach we can model every security group rule to exactly one flow, and"},{"line_number":202,"context_line":"   any changes in port additions/deletion don\u0027t have to change any of these flows just"},{"line_number":203,"context_line":"   the classification rules for that port (which have to change anyway)"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"   It is also very simple to delete/modify these flows in case of security rule update as"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_cc8a541b","line":202,"range":{"start_line":202,"start_character":18,"end_line":202,"end_character":22},"in_reply_to":"1a7b0d38_d07bd08a","updated":"2015-12-28 14:09:29.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":200,"context_line":""},{"line_number":201,"context_line":"   With this approach we can model every security group rule to exactly one flow, and"},{"line_number":202,"context_line":"   any changes in port additions/deletion don\u0027t have to change any of these flows just"},{"line_number":203,"context_line":"   the classification rules for that port (which have to change anyway)"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"   It is also very simple to delete/modify these flows in case of security rule update as"},{"line_number":206,"context_line":"   each rule always only map to a single flow."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_f0604cd1","line":203,"updated":"2015-12-28 09:03:52.000000000","message":"again unclear port here","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"33f059394beed5b5d6c5c3fd0d48522286f5cc5c","unresolved":false,"context_lines":[{"line_number":200,"context_line":""},{"line_number":201,"context_line":"   With this approach we can model every security group rule to exactly one flow, and"},{"line_number":202,"context_line":"   any changes in port additions/deletion don\u0027t have to change any of these flows just"},{"line_number":203,"context_line":"   the classification rules for that port (which have to change anyway)"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"   It is also very simple to delete/modify these flows in case of security rule update as"},{"line_number":206,"context_line":"   each rule always only map to a single flow."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_6ce7a011","line":203,"in_reply_to":"1a7b0d38_f0604cd1","updated":"2015-12-28 14:06:46.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":220,"context_line":""},{"line_number":221,"context_line":"With this solution after the egress security group table (which classified rules for"},{"line_number":222,"context_line":"the local VMs egress policy) we have another table which holds the destination"},{"line_number":223,"context_line":"port ingress security group rules converted to flows."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"The pipeline looks like this:"},{"line_number":226,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_90a8e8dc","line":223,"range":{"start_line":223,"start_character":0,"end_line":223,"end_character":4},"updated":"2015-12-28 09:03:52.000000000","message":"What port here","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"ee6fbe3b1f5946a4aa28639f369b2ca06cc94dc7","unresolved":false,"context_lines":[{"line_number":220,"context_line":""},{"line_number":221,"context_line":"With this solution after the egress security group table (which classified rules for"},{"line_number":222,"context_line":"the local VMs egress policy) we have another table which holds the destination"},{"line_number":223,"context_line":"port ingress security group rules converted to flows."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"The pipeline looks like this:"},{"line_number":226,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_8c976c39","line":223,"range":{"start_line":223,"start_character":0,"end_line":223,"end_character":4},"in_reply_to":"1a7b0d38_90a8e8dc","updated":"2015-12-28 14:09:29.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"56774bc161d7ca931c14853d56b8d32eb2ead7ef","unresolved":false,"context_lines":[{"line_number":238,"context_line":""},{"line_number":239,"context_line":"Converting security group rules to flows is very similar to the above"},{"line_number":240,"context_line":"process but now we use reg5 to indicate the current security group id we inspect and reg6"},{"line_number":241,"context_line":"to mark the source port security group id."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"*** Due to the state fullness of security groups we must also change table 0 which is receiving"},{"line_number":244,"context_line":"the traffic and dispatching it to port."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_50afe0e1","line":241,"updated":"2015-12-28 09:03:52.000000000","message":"what port here?","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"ee6fbe3b1f5946a4aa28639f369b2ca06cc94dc7","unresolved":false,"context_lines":[{"line_number":238,"context_line":""},{"line_number":239,"context_line":"Converting security group rules to flows is very similar to the above"},{"line_number":240,"context_line":"process but now we use reg5 to indicate the current security group id we inspect and reg6"},{"line_number":241,"context_line":"to mark the source port security group id."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"*** Due to the state fullness of security groups we must also change table 0 which is receiving"},{"line_number":244,"context_line":"the traffic and dispatching it to port."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a7b0d38_4ca664af","line":241,"in_reply_to":"1a7b0d38_50afe0e1","updated":"2015-12-28 14:09:29.000000000","message":"Done","commit_id":"cb27cc5760eba40f6301c5ccb56c6f5204a70019"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"fdeb555dd6e340558793557be39d4403302b3606","unresolved":false,"context_lines":[{"line_number":132,"context_line":"   group rules must be applied at destination per VM port as we could have"},{"line_number":133,"context_line":"   different rules for different VM ports in regards to broadcast/multicast ***"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."},{"line_number":136,"context_line":"   We retrieve the connection state of this flow for IP and IPv6 traffic,"},{"line_number":137,"context_line":"   The zone is the same as reg6 (src VM port security group id)::"},{"line_number":138,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_ae01f339","line":135,"range":{"start_line":135,"start_character":2,"end_line":135,"end_character":78},"updated":"2015-12-28 23:50:49.000000000","message":"When do we commit packet to CT? I think we should commit ingress packet into CT, then we can inspect CT state of corresponding egress packet.","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"f069e99094c8598fd6fb983f85a97628df607e54","unresolved":false,"context_lines":[{"line_number":132,"context_line":"   group rules must be applied at destination per VM port as we could have"},{"line_number":133,"context_line":"   different rules for different VM ports in regards to broadcast/multicast ***"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."},{"line_number":136,"context_line":"   We retrieve the connection state of this flow for IP and IPv6 traffic,"},{"line_number":137,"context_line":"   The zone is the same as reg6 (src VM port security group id)::"},{"line_number":138,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_97120356","line":135,"range":{"start_line":135,"start_character":2,"end_line":135,"end_character":78},"in_reply_to":"1a7b0d38_ae01f339","updated":"2015-12-29 09:05:43.000000000","message":"You are right, but we first try to retrieve the connection state.\n\nLines  187-200 describe the commit, meaning we start tracking\nthis connection with connection tracking, we might still need to perform another commit on every packet but i dont think so (but its a technical issue that needs to be resolved when we start working on it, it doesnt change the design)","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"56c34b64a3c7bd35f78280736932eaa4f8c68f92","unresolved":false,"context_lines":[{"line_number":144,"context_line":"   if its invalid state we drop the packet and if the connection state is \"NEW\""},{"line_number":145,"context_line":"   we continue checking security rules for Egress::"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"     priority\u003d65534,ct_state\u003d-new-est+rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"},{"line_number":148,"context_line":"     priority\u003d65534,ct_state\u003d-new+est-rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"},{"line_number":149,"context_line":"     priority\u003d65534,ct_state\u003d+inv+trk, actions\u003ddrop"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_a1b34199","line":147,"range":{"start_line":147,"start_character":34,"end_line":147,"end_character":37},"updated":"2015-12-29 08:55:22.000000000","message":"I think that it should be +est because it is a related flow that is all ready established","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"87951ea7bc8bbf6c0237b77f8cf1c45edd4321c2","unresolved":false,"context_lines":[{"line_number":144,"context_line":"   if its invalid state we drop the packet and if the connection state is \"NEW\""},{"line_number":145,"context_line":"   we continue checking security rules for Egress::"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"     priority\u003d65534,ct_state\u003d-new-est+rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"},{"line_number":148,"context_line":"     priority\u003d65534,ct_state\u003d-new+est-rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"},{"line_number":149,"context_line":"     priority\u003d65534,ct_state\u003d+inv+trk, actions\u003ddrop"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_c1485630","line":147,"range":{"start_line":147,"start_character":34,"end_line":147,"end_character":37},"in_reply_to":"1a7b0d38_37322ff3","updated":"2015-12-30 09:18:11.000000000","message":"it should be  +rel we should let any related flow passed new and established  \n(+new,-new)","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"f069e99094c8598fd6fb983f85a97628df607e54","unresolved":false,"context_lines":[{"line_number":144,"context_line":"   if its invalid state we drop the packet and if the connection state is \"NEW\""},{"line_number":145,"context_line":"   we continue checking security rules for Egress::"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"     priority\u003d65534,ct_state\u003d-new-est+rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"},{"line_number":148,"context_line":"     priority\u003d65534,ct_state\u003d-new+est-rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"},{"line_number":149,"context_line":"     priority\u003d65534,ct_state\u003d+inv+trk, actions\u003ddrop"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_37322ff3","line":147,"range":{"start_line":147,"start_character":34,"end_line":147,"end_character":37},"in_reply_to":"1a7b0d38_a1b34199","updated":"2015-12-29 09:05:43.000000000","message":"The next flow catches established, here we want to catch related that is not established.\n(This is the expected behaviour i assume for security groups, but if not we need to change that here, i will consult)","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"00a4e372dd0167ffbda1f8f782fce10264d784e2","unresolved":false,"context_lines":[{"line_number":172,"context_line":"|             |                          |          |                |                            |"},{"line_number":173,"context_line":"|             |                          |          |                |                            |"},{"line_number":174,"context_line":"|  +----------+---------------------+    |          |   +------------+------------------------+   |"},{"line_number":175,"context_line":"|  |                                |    |          |   |                                     |   |"},{"line_number":176,"context_line":"|  |              OVS               |    |          |   |                 OVS                 |   |"},{"line_number":177,"context_line":"|  |                                |    |          |   |                                     |   |"},{"line_number":178,"context_line":"|  +--------------------------------+    |          |   +-------------------------------------+   |"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_742f5a88","line":175,"updated":"2015-12-29 02:12:18.000000000","message":"Egress security group table should only commit packet to CT if allowed pass , it shouldn\u0027t contains stateful match field such as related, established which should be the reverse direction\u0027s key match fields to implement a stateful firewall","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"f069e99094c8598fd6fb983f85a97628df607e54","unresolved":false,"context_lines":[{"line_number":172,"context_line":"|             |                          |          |                |                            |"},{"line_number":173,"context_line":"|             |                          |          |                |                            |"},{"line_number":174,"context_line":"|  +----------+---------------------+    |          |   +------------+------------------------+   |"},{"line_number":175,"context_line":"|  |                                |    |          |   |                                     |   |"},{"line_number":176,"context_line":"|  |              OVS               |    |          |   |                 OVS                 |   |"},{"line_number":177,"context_line":"|  |                                |    |          |   |                                     |   |"},{"line_number":178,"context_line":"|  +--------------------------------+    |          |   +-------------------------------------+   |"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_f7834754","line":175,"in_reply_to":"1a7b0d38_742f5a88","updated":"2015-12-29 09:05:43.000000000","message":"I am not sure i understand what is your concern, we only commit if the security group rule matched (meaning allow) and before we check the security groups we check if this is an already established connection.\n\nIf it is no need to check the rules","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"fa6ce0ed7e97e938780138094b800123251c2c24","unresolved":false,"context_lines":[{"line_number":200,"context_line":""},{"line_number":201,"context_line":"   With this approach we can model every security group rule to exactly one flow, and"},{"line_number":202,"context_line":"   any changes in VM port additions/deletion don\u0027t have to change any of these flows just"},{"line_number":203,"context_line":"   the classification rules for that port (which have to change anyway)"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"   It is also very simple to delete/modify these flows in case of security rule update as"},{"line_number":206,"context_line":"   each rule always only map to a single flow."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_966aa919","line":203,"range":{"start_line":203,"start_character":37,"end_line":203,"end_character":41},"updated":"2015-12-30 07:35:36.000000000","message":"VM Port ?","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"3da39ca5098e9b2420b61de520f7b0315ed3210a","unresolved":false,"context_lines":[{"line_number":200,"context_line":""},{"line_number":201,"context_line":"   With this approach we can model every security group rule to exactly one flow, and"},{"line_number":202,"context_line":"   any changes in VM port additions/deletion don\u0027t have to change any of these flows just"},{"line_number":203,"context_line":"   the classification rules for that port (which have to change anyway)"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"   It is also very simple to delete/modify these flows in case of security rule update as"},{"line_number":206,"context_line":"   each rule always only map to a single flow."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_21a132aa","line":203,"range":{"start_line":203,"start_character":37,"end_line":203,"end_character":41},"in_reply_to":"fa69d971_966aa919","updated":"2015-12-30 09:26:31.000000000","message":"Done","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"fa6ce0ed7e97e938780138094b800123251c2c24","unresolved":false,"context_lines":[{"line_number":241,"context_line":"to mark the source VM port security group id."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"*** Due to the state fullness of security groups we must also change table 0 which is receiving"},{"line_number":244,"context_line":"the traffic and dispatching it to port."},{"line_number":245,"context_line":"We still need to make sure to commit this flow to connection tracking module at the"},{"line_number":246,"context_line":"destination, this will be used when the destination tries to reply."},{"line_number":247,"context_line":"This is the only action we need to perform at destination as we already verified all security"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_7654d553","line":244,"updated":"2015-12-30 07:35:36.000000000","message":"target VM port I suppose ?","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"3da39ca5098e9b2420b61de520f7b0315ed3210a","unresolved":false,"context_lines":[{"line_number":241,"context_line":"to mark the source VM port security group id."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"*** Due to the state fullness of security groups we must also change table 0 which is receiving"},{"line_number":244,"context_line":"the traffic and dispatching it to port."},{"line_number":245,"context_line":"We still need to make sure to commit this flow to connection tracking module at the"},{"line_number":246,"context_line":"destination, this will be used when the destination tries to reply."},{"line_number":247,"context_line":"This is the only action we need to perform at destination as we already verified all security"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_21b612dd","line":244,"in_reply_to":"fa69d971_7654d553","updated":"2015-12-30 09:26:31.000000000","message":"Done","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"fa6ce0ed7e97e938780138094b800123251c2c24","unresolved":false,"context_lines":[{"line_number":258,"context_line":"Cons"},{"line_number":259,"context_line":"------"},{"line_number":260,"context_line":"1) In this solution we have to install in the ingress security table flows that match"},{"line_number":261,"context_line":"all possible destination ports (still one flow per rule)"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"2) Its problematic if we are doing smart broadcast/multicast distribution as different"},{"line_number":264,"context_line":"security policy can be configured to ports in the same broadcast/multicast domain"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_f6c68515","line":261,"updated":"2015-12-30 07:35:36.000000000","message":"VM port?","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"3da39ca5098e9b2420b61de520f7b0315ed3210a","unresolved":false,"context_lines":[{"line_number":258,"context_line":"Cons"},{"line_number":259,"context_line":"------"},{"line_number":260,"context_line":"1) In this solution we have to install in the ingress security table flows that match"},{"line_number":261,"context_line":"all possible destination ports (still one flow per rule)"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"2) Its problematic if we are doing smart broadcast/multicast distribution as different"},{"line_number":264,"context_line":"security policy can be configured to ports in the same broadcast/multicast domain"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_41bb06c5","line":261,"in_reply_to":"fa69d971_f6c68515","updated":"2015-12-30 09:26:31.000000000","message":"Done","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"56c34b64a3c7bd35f78280736932eaa4f8c68f92","unresolved":false,"context_lines":[{"line_number":260,"context_line":"1) In this solution we have to install in the ingress security table flows that match"},{"line_number":261,"context_line":"all possible destination ports (still one flow per rule)"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"2) Its problematic if we are doing smart broadcast/multicast distribution as different"},{"line_number":264,"context_line":"security policy can be configured to ports in the same broadcast/multicast domain"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"3) This is problematic for traffic coming from public/external network"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_bcda8449","line":263,"range":{"start_line":263,"start_character":35,"end_line":263,"end_character":60},"updated":"2015-12-29 08:55:22.000000000","message":"just a reminder for us to register a BP and spec for the smart broadcast/multicast","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"f069e99094c8598fd6fb983f85a97628df607e54","unresolved":false,"context_lines":[{"line_number":260,"context_line":"1) In this solution we have to install in the ingress security table flows that match"},{"line_number":261,"context_line":"all possible destination ports (still one flow per rule)"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"2) Its problematic if we are doing smart broadcast/multicast distribution as different"},{"line_number":264,"context_line":"security policy can be configured to ports in the same broadcast/multicast domain"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"3) This is problematic for traffic coming from public/external network"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_3749cf60","line":263,"range":{"start_line":263,"start_character":35,"end_line":263,"end_character":60},"in_reply_to":"1a7b0d38_bcda8449","updated":"2015-12-29 09:05:43.000000000","message":"will do","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"fa6ce0ed7e97e938780138094b800123251c2c24","unresolved":false,"context_lines":[{"line_number":261,"context_line":"all possible destination ports (still one flow per rule)"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"2) Its problematic if we are doing smart broadcast/multicast distribution as different"},{"line_number":264,"context_line":"security policy can be configured to ports in the same broadcast/multicast domain"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"3) This is problematic for traffic coming from public/external network"},{"line_number":267,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_d6eca191","line":264,"updated":"2015-12-30 07:35:36.000000000","message":"VM Port ?","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"3da39ca5098e9b2420b61de520f7b0315ed3210a","unresolved":false,"context_lines":[{"line_number":261,"context_line":"all possible destination ports (still one flow per rule)"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"2) Its problematic if we are doing smart broadcast/multicast distribution as different"},{"line_number":264,"context_line":"security policy can be configured to ports in the same broadcast/multicast domain"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"3) This is problematic for traffic coming from public/external network"},{"line_number":267,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_01b50ecc","line":264,"in_reply_to":"fa69d971_d6eca191","updated":"2015-12-30 09:26:31.000000000","message":"Done","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"fa6ce0ed7e97e938780138094b800123251c2c24","unresolved":false,"context_lines":[{"line_number":270,"context_line":""},{"line_number":271,"context_line":"This solution perform the ingress security group classification in the destination"},{"line_number":272,"context_line":"but in order to model security groups classification similar to the model"},{"line_number":273,"context_line":"i presented above, the destination also must know the source port security group id."},{"line_number":274,"context_line":"For this we use Geneve dynamic TLV and pass to the destination the source port"},{"line_number":275,"context_line":"security group id (in addition to the destination port id which is written"},{"line_number":276,"context_line":"in the tunnel VNI)."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_36fc1d3e","line":273,"range":{"start_line":273,"start_character":0,"end_line":273,"end_character":1},"updated":"2015-12-30 07:35:36.000000000","message":"Lowercase I","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"3da39ca5098e9b2420b61de520f7b0315ed3210a","unresolved":false,"context_lines":[{"line_number":270,"context_line":""},{"line_number":271,"context_line":"This solution perform the ingress security group classification in the destination"},{"line_number":272,"context_line":"but in order to model security groups classification similar to the model"},{"line_number":273,"context_line":"i presented above, the destination also must know the source port security group id."},{"line_number":274,"context_line":"For this we use Geneve dynamic TLV and pass to the destination the source port"},{"line_number":275,"context_line":"security group id (in addition to the destination port id which is written"},{"line_number":276,"context_line":"in the tunnel VNI)."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_212b72ed","line":273,"range":{"start_line":273,"start_character":0,"end_line":273,"end_character":1},"in_reply_to":"fa69d971_36fc1d3e","updated":"2015-12-30 09:26:31.000000000","message":"Done","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"fa6ce0ed7e97e938780138094b800123251c2c24","unresolved":false,"context_lines":[{"line_number":271,"context_line":"This solution perform the ingress security group classification in the destination"},{"line_number":272,"context_line":"but in order to model security groups classification similar to the model"},{"line_number":273,"context_line":"i presented above, the destination also must know the source port security group id."},{"line_number":274,"context_line":"For this we use Geneve dynamic TLV and pass to the destination the source port"},{"line_number":275,"context_line":"security group id (in addition to the destination port id which is written"},{"line_number":276,"context_line":"in the tunnel VNI)."},{"line_number":277,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_169a3915","line":274,"range":{"start_line":274,"start_character":67,"end_line":274,"end_character":78},"updated":"2015-12-30 07:35:36.000000000","message":"VM Port ?","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"3da39ca5098e9b2420b61de520f7b0315ed3210a","unresolved":false,"context_lines":[{"line_number":271,"context_line":"This solution perform the ingress security group classification in the destination"},{"line_number":272,"context_line":"but in order to model security groups classification similar to the model"},{"line_number":273,"context_line":"i presented above, the destination also must know the source port security group id."},{"line_number":274,"context_line":"For this we use Geneve dynamic TLV and pass to the destination the source port"},{"line_number":275,"context_line":"security group id (in addition to the destination port id which is written"},{"line_number":276,"context_line":"in the tunnel VNI)."},{"line_number":277,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_8146debd","line":274,"range":{"start_line":274,"start_character":67,"end_line":274,"end_character":78},"in_reply_to":"fa69d971_169a3915","updated":"2015-12-30 09:26:31.000000000","message":"Done","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"fa6ce0ed7e97e938780138094b800123251c2c24","unresolved":false,"context_lines":[{"line_number":272,"context_line":"but in order to model security groups classification similar to the model"},{"line_number":273,"context_line":"i presented above, the destination also must know the source port security group id."},{"line_number":274,"context_line":"For this we use Geneve dynamic TLV and pass to the destination the source port"},{"line_number":275,"context_line":"security group id (in addition to the destination port id which is written"},{"line_number":276,"context_line":"in the tunnel VNI)."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"\u003c--- Solution for not using Geneve ----\u003e"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_b69ecd05","line":275,"range":{"start_line":275,"start_character":50,"end_line":275,"end_character":54},"updated":"2015-12-30 07:35:36.000000000","message":"VM Port ?","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"3da39ca5098e9b2420b61de520f7b0315ed3210a","unresolved":false,"context_lines":[{"line_number":272,"context_line":"but in order to model security groups classification similar to the model"},{"line_number":273,"context_line":"i presented above, the destination also must know the source port security group id."},{"line_number":274,"context_line":"For this we use Geneve dynamic TLV and pass to the destination the source port"},{"line_number":275,"context_line":"security group id (in addition to the destination port id which is written"},{"line_number":276,"context_line":"in the tunnel VNI)."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"\u003c--- Solution for not using Geneve ----\u003e"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_411786a3","line":275,"range":{"start_line":275,"start_character":50,"end_line":275,"end_character":54},"in_reply_to":"fa69d971_b69ecd05","updated":"2015-12-30 09:26:31.000000000","message":"Done","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"56c34b64a3c7bd35f78280736932eaa4f8c68f92","unresolved":false,"context_lines":[{"line_number":321,"context_line":"2) Can work for optimized L2 broadcast/multicast traffic, we will still need to"},{"line_number":322,"context_line":"   be able to send the source security group id somehow."},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"3) Require installing security group rule flows o"},{"line_number":325,"context_line":""},{"line_number":326,"context_line":"Cons"},{"line_number":327,"context_line":"----"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_3cc69468","line":324,"range":{"start_line":324,"start_character":3,"end_line":324,"end_character":49},"updated":"2015-12-29 08:55:22.000000000","message":"I am not sure i understand why is it a Pro","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"f069e99094c8598fd6fb983f85a97628df607e54","unresolved":false,"context_lines":[{"line_number":321,"context_line":"2) Can work for optimized L2 broadcast/multicast traffic, we will still need to"},{"line_number":322,"context_line":"   be able to send the source security group id somehow."},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"3) Require installing security group rule flows o"},{"line_number":325,"context_line":""},{"line_number":326,"context_line":"Cons"},{"line_number":327,"context_line":"----"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_578b3b68","line":324,"range":{"start_line":324,"start_character":3,"end_line":324,"end_character":49},"in_reply_to":"1a7b0d38_3cc69468","updated":"2015-12-29 09:05:43.000000000","message":"need to change, this was suppose to mean we only install flows for local ports","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"56c34b64a3c7bd35f78280736932eaa4f8c68f92","unresolved":false,"context_lines":[{"line_number":331,"context_line":"per compute node and number of security groups)"},{"line_number":332,"context_line":""},{"line_number":333,"context_line":"2) We send traffic to destination even when we can know it is going to be"},{"line_number":334,"context_line":"dropped"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"3) Security group ids must be unique across the setup (global) and must be"},{"line_number":337,"context_line":"allocated from the DF plugin"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a7b0d38_1c67184e","line":334,"range":{"start_line":334,"start_character":0,"end_line":334,"end_character":7},"updated":"2015-12-29 08:55:22.000000000","message":"We can later introduce a mechanism that send back to the src Node a packet with drop info for this connection add it to Geneve\nThis src Node can add a flow with a short aging and drop the connection at the src host","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"3da39ca5098e9b2420b61de520f7b0315ed3210a","unresolved":false,"context_lines":[{"line_number":331,"context_line":"per compute node and number of security groups)"},{"line_number":332,"context_line":""},{"line_number":333,"context_line":"2) We send traffic to destination even when we can know it is going to be"},{"line_number":334,"context_line":"dropped"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"3) Security group ids must be unique across the setup (global) and must be"},{"line_number":337,"context_line":"allocated from the DF plugin"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_015f4e73","line":334,"range":{"start_line":334,"start_character":0,"end_line":334,"end_character":7},"in_reply_to":"1a7b0d38_1c67184e","updated":"2015-12-30 09:26:31.000000000","message":"Done","commit_id":"6149e3e210ecaa345f1bf28339476dbcfa152abd"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"f2a1a8c8f8e99228a126624838f121e1be176914","unresolved":false,"context_lines":[{"line_number":129,"context_line":"  both for L2 or L3 is known - we are after distributed virtual routing step)"},{"line_number":130,"context_line":"  (Dragonflow sets reg7 as the destination port id)"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"  *** Its important to note that currently broadcast/multicast traffic is"},{"line_number":133,"context_line":"   duplicated in the source, if we want to duplicate it at the destination, security"},{"line_number":134,"context_line":"   group rules must be applied at destination per VM port as we could have"},{"line_number":135,"context_line":"   different rules for different VM ports in regards to broadcast/multicast ***"},{"line_number":136,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa69d971_ce863ab9","line":133,"range":{"start_line":132,"start_character":33,"end_line":133,"end_character":27},"updated":"2015-12-30 13:58:27.000000000","message":"Do not quite get it. What does it mean?","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"673c4f3a29e963336431d832e6b6f94b2bbeccff","unresolved":false,"context_lines":[{"line_number":129,"context_line":"  both for L2 or L3 is known - we are after distributed virtual routing step)"},{"line_number":130,"context_line":"  (Dragonflow sets reg7 as the destination port id)"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"  *** Its important to note that currently broadcast/multicast traffic is"},{"line_number":133,"context_line":"   duplicated in the source, if we want to duplicate it at the destination, security"},{"line_number":134,"context_line":"   group rules must be applied at destination per VM port as we could have"},{"line_number":135,"context_line":"   different rules for different VM ports in regards to broadcast/multicast ***"},{"line_number":136,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa69d971_e67c8222","line":133,"range":{"start_line":132,"start_character":33,"end_line":133,"end_character":27},"in_reply_to":"fa69d971_ce863ab9","updated":"2015-12-30 15:06:25.000000000","message":"We duplicate broadcast/multicast packets for L2 (currently) we were thinking instead of duplicating the packet to each VM port only duplicate it to compute nodes that have VMs from this broadcast/multicast domain.\n\nIn that case it will be hard to understand the destination port security group id (as potentially different ports in the same broadcast domain can have different security groups This is an unlikely scenario but still exists)","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"a54d4cd9ec5c529b8860ab9da1d0f85982c42a26","unresolved":false,"context_lines":[{"line_number":137,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."},{"line_number":138,"context_line":"   We retrieve the connection state of this flow for IP and IPv6 traffic,"},{"line_number":139,"context_line":"   The zone is the same as reg6 (src VM port security group id)::"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"     ip, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":142,"context_line":"     ip6, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a5ae5dd_ad6e6f94","line":140,"updated":"2016-02-09 09:44:10.000000000","message":"I\u0027m not too comfortable with using the security group as a zone. The connection tracking part is an orthogonal feature whose services are used for security group rule implementation. I think the zone should be the tenant ID, network ID, or something similar. Future users of connection tracking shouldn\u0027t have to deal with security groups, despite the added overhead.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"6bdb720ae87b7ae169458ef19548845e64153618","unresolved":false,"context_lines":[{"line_number":137,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."},{"line_number":138,"context_line":"   We retrieve the connection state of this flow for IP and IPv6 traffic,"},{"line_number":139,"context_line":"   The zone is the same as reg6 (src VM port security group id)::"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"     ip, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":142,"context_line":"     ip6, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a57f1b5_f16d1dcd","line":140,"in_reply_to":"3a57f1b5_d95dbfed","updated":"2016-02-10 05:54:04.000000000","message":"Connection tracking is a general feature, not one geared towards implementing security with security groups. Therefore, there can be features and applications that rely on connection tracking without using security groups. I think it makes more sense to use a zone that\u0027s more general.\n\nConnection tracking allows maintaining metadata (from what I saw, it has \u0027labels\u0027). The security groups can be stored there, and then zoning by network should work easily.\n  \nIn any case, IPs can overlap in the same security group as well.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"680aa8780c59c1bb0feec8c0c774a2eaba55c01f","unresolved":false,"context_lines":[{"line_number":137,"context_line":"4) After classification, Dragonflow sends traffic to connection tracking table."},{"line_number":138,"context_line":"   We retrieve the connection state of this flow for IP and IPv6 traffic,"},{"line_number":139,"context_line":"   The zone is the same as reg6 (src VM port security group id)::"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"     ip, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":142,"context_line":"     ip6, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a57f1b5_d95dbfed","line":140,"in_reply_to":"5a5ae5dd_ad6e6f94","updated":"2016-02-09 19:37:48.000000000","message":"i really don\u0027t understand what you mean, can you please try to elaborate?\n\"Future users of connection tracking..\" ???\n\nEither way this can\u0027t be tenant ID as IP\u0027s can still overlap in the same tenant.\nThis could be network id, i don\u0027t see whats the added value, the downside is that it will be more complex","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"a54d4cd9ec5c529b8860ab9da1d0f85982c42a26","unresolved":false,"context_lines":[{"line_number":139,"context_line":"   The zone is the same as reg6 (src VM port security group id)::"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"     ip, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":142,"context_line":"     ip6, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"5) In the egress security table we first match if a connection tracking entry"},{"line_number":145,"context_line":"   exists, if it does (with stat EST) we move to the next table in the pipeline,"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a5ae5dd_8dd053f9","line":142,"updated":"2016-02-09 09:44:10.000000000","message":"What does the conntrack table attribute mean? I couldn\u0027t find it in the conntrack docs.\nIt looks like the treatment for both ipv4 and ipv6 is the same. Why separate into two flows? Do you want to keep non-IPv4/6 traffic untracked?","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"b7949954a4ca78302cc217110036907fceb226b4","unresolved":false,"context_lines":[{"line_number":139,"context_line":"   The zone is the same as reg6 (src VM port security group id)::"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"     ip, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":142,"context_line":"     ip6, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"5) In the egress security table we first match if a connection tracking entry"},{"line_number":145,"context_line":"   exists, if it does (with stat EST) we move to the next table in the pipeline,"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a57f1b5_eb622216","line":142,"in_reply_to":"3a57f1b5_d9361fb4","updated":"2016-02-09 20:02:00.000000000","message":"and yes, non IP traffic is untracked","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"680aa8780c59c1bb0feec8c0c774a2eaba55c01f","unresolved":false,"context_lines":[{"line_number":139,"context_line":"   The zone is the same as reg6 (src VM port security group id)::"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"     ip, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":142,"context_line":"     ip6, actions\u003dct(table\u003d\u003cegress_security_group\u003e,zone\u003dNXM_NX_REG6[0..15])"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"5) In the egress security table we first match if a connection tracking entry"},{"line_number":145,"context_line":"   exists, if it does (with stat EST) we move to the next table in the pipeline,"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a57f1b5_d9361fb4","line":142,"in_reply_to":"5a5ae5dd_8dd053f9","updated":"2016-02-09 19:37:48.000000000","message":"i can\u0027t do an open flow match on IP4 and IPv6 together.\nthe table is the next table to go to.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"a54d4cd9ec5c529b8860ab9da1d0f85982c42a26","unresolved":false,"context_lines":[{"line_number":144,"context_line":"5) In the egress security table we first match if a connection tracking entry"},{"line_number":145,"context_line":"   exists, if it does (with stat EST) we move to the next table in the pipeline,"},{"line_number":146,"context_line":"   if its invalid state we drop the packet and if the connection state is \"NEW\""},{"line_number":147,"context_line":"   we continue checking security rules for Egress::"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"     priority\u003d65534,ct_state\u003d-new-est+rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"},{"line_number":150,"context_line":"     priority\u003d65534,ct_state\u003d-new+est-rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a5ae5dd_adcd0f5f","line":147,"updated":"2016-02-09 09:44:10.000000000","message":"I\u0027m not sure I understand the flow, here. If you apply solution 1 below, this is where the security group rules will reside? In solution 2 below, the default rule in this table will be resubmit(,\u003cnext_table-egress\u003e)?\n\nAbout related connections - am I right in understanding you let them through automatically? If so, do we want this behaviour configurable?","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"680aa8780c59c1bb0feec8c0c774a2eaba55c01f","unresolved":false,"context_lines":[{"line_number":144,"context_line":"5) In the egress security table we first match if a connection tracking entry"},{"line_number":145,"context_line":"   exists, if it does (with stat EST) we move to the next table in the pipeline,"},{"line_number":146,"context_line":"   if its invalid state we drop the packet and if the connection state is \"NEW\""},{"line_number":147,"context_line":"   we continue checking security rules for Egress::"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"     priority\u003d65534,ct_state\u003d-new-est+rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"},{"line_number":150,"context_line":"     priority\u003d65534,ct_state\u003d-new+est-rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a57f1b5_d9edbf8f","line":147,"in_reply_to":"5a5ae5dd_adcd0f5f","updated":"2016-02-09 19:37:48.000000000","message":"The logic is:\n\n1) Check if there is a connection tracking entry\n2) If yes, continue\n3) If no, check security groups\n\nAll the other stuff are details that will need to be covered in the implementation.\n\"next_table-egress\" just means the next table after the security groups check in our overall pipeline.\n\nFor the relate traffic, this needs to be exactly like current implementation of Neutron, no need to make this configurable at this point, but if such need is there we can change it easily.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"0f92b93634c787c19381e89fc961d795c835c437","unresolved":false,"context_lines":[{"line_number":146,"context_line":"   if its invalid state we drop the packet and if the connection state is \"NEW\""},{"line_number":147,"context_line":"   we continue checking security rules for Egress::"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"     priority\u003d65534,ct_state\u003d-new-est+rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"},{"line_number":150,"context_line":"     priority\u003d65534,ct_state\u003d-new+est-rel-inv+trk, actions\u003dresubmit(,\u003cnext_table-egress\u003e)"},{"line_number":151,"context_line":"     priority\u003d65534,ct_state\u003d+inv+trk, actions\u003ddrop"},{"line_number":152,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa69d971_1a1b1b74","line":149,"range":{"start_line":149,"start_character":29,"end_line":149,"end_character":49},"updated":"2015-12-31 07:07:26.000000000","message":"i think that it should be  ct_state\u003d+rel-inv\n\nBut we might need to commit it (I am not sure,we should check)\n\nct_state\u003d+new+rel-inv  --\u003e actions\u003dct(commit, \n\nFrom what I understand packet will be marked as related only if it is related traffic to one of the flows that were committed before and are all ready in established state.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"189b7f34fdac6b5cef16c16d09895ccb8fceaa49","unresolved":false,"context_lines":[{"line_number":218,"context_line":"At this point the two mentioned solutions differs from each other."},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"Solution 1 - Perform Full Security Inspection at Source"},{"line_number":221,"context_line":"-------------------------------------------------------"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"With this solution after the egress security group table (which classified rules for"},{"line_number":224,"context_line":"the local VMs egress policy) we have another table which holds the destination"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a5ae5dd_b10292b2","line":221,"updated":"2016-02-08 08:27:19.000000000","message":"FYI midonet implements a variation of this approach.\n\"corner cases\" mentioned in [1] might be interesting you.\n\n[1] https://github.com/midonet/midonet/blob/master/docs/stateful-packet-processing.md","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"680aa8780c59c1bb0feec8c0c774a2eaba55c01f","unresolved":false,"context_lines":[{"line_number":218,"context_line":"At this point the two mentioned solutions differs from each other."},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"Solution 1 - Perform Full Security Inspection at Source"},{"line_number":221,"context_line":"-------------------------------------------------------"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"With this solution after the egress security group table (which classified rules for"},{"line_number":224,"context_line":"the local VMs egress policy) we have another table which holds the destination"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a57f1b5_39d8931d","line":221,"in_reply_to":"5a5ae5dd_b10292b2","updated":"2016-02-09 19:37:48.000000000","message":"Thanks for sharing YAMAMOTO, i will take a look","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"f2a1a8c8f8e99228a126624838f121e1be176914","unresolved":false,"context_lines":[{"line_number":245,"context_line":"*** Due to the state fullness of security groups we must also change table 0 which is receiving"},{"line_number":246,"context_line":"the traffic and dispatching it to destination VM port."},{"line_number":247,"context_line":"We still need to make sure to commit this flow to connection tracking module at the"},{"line_number":248,"context_line":"destination, this will be used when the destination tries to reply."},{"line_number":249,"context_line":"This is the only action we need to perform at destination as we already verified all security"},{"line_number":250,"context_line":"rules both for egress and ingress at the source."},{"line_number":251,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa69d971_6e4e2ec3","line":248,"range":{"start_line":248,"start_character":0,"end_line":248,"end_character":11},"updated":"2015-12-30 13:58:27.000000000","message":"For solution one, we need to commit to different zones at one side. Not only we should commit to the zone corresponding to local port\u0027s security group but also to the zone corresponding to the remote port\u0027s security group. Because Before we inspect the Ingress Security Groups Table, we should check the state of the packet to find out if it is in \"est\", \"related\" status regarding to the remote port\u0027s sg context(REG5, not REG6). So there is a missing \" Remote SG Connection Tracking Table\" between Egress Security Groups table and Ingress Security Groups table, and we still need to pass the source port\u0027s SGid to the remote host because we need to commit packet in zone\u003dreg6\u0026reg5 (twice) in the remote host in case that the destination tries to reply. Different zones mean different contexts.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"673c4f3a29e963336431d832e6b6f94b2bbeccff","unresolved":false,"context_lines":[{"line_number":245,"context_line":"*** Due to the state fullness of security groups we must also change table 0 which is receiving"},{"line_number":246,"context_line":"the traffic and dispatching it to destination VM port."},{"line_number":247,"context_line":"We still need to make sure to commit this flow to connection tracking module at the"},{"line_number":248,"context_line":"destination, this will be used when the destination tries to reply."},{"line_number":249,"context_line":"This is the only action we need to perform at destination as we already verified all security"},{"line_number":250,"context_line":"rules both for egress and ingress at the source."},{"line_number":251,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa69d971_c674defe","line":248,"range":{"start_line":248,"start_character":0,"end_line":248,"end_character":11},"in_reply_to":"fa69d971_6e4e2ec3","updated":"2015-12-30 15:06:25.000000000","message":"Very good point :)\n\nThis is actually something i talked with Eran Gampel about yesterday.\nBut its very nice that you spotted it as well.\n\nThere is no problem that we use different zones, at least thats what i think, if i am wrong please explain.\n\nThe zones are meant to prevent problems with overlapping IP\u0027s but if we have routing between two ports (and we obviously do because we managed to get to this point) it means they cant have parallel IPs.\nSo even if we save the connection at each side in different zones it will still works since we use the same connection tracking results both for the egress security rules and the ingress of the destination.\n\nHope its clear :) let me know if you think its problematic.\n\nBut regardless i think we lean towards the second solution anyhow, it makes much more sense modelling wise","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"f2a1a8c8f8e99228a126624838f121e1be176914","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":"3) This is problematic for traffic coming from public/external network"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"Solution 2 - Perform Ingress Security Inspection at Destination"},{"line_number":271,"context_line":"---------------------------------------------------------------"},{"line_number":272,"context_line":""},{"line_number":273,"context_line":"This solution perform the ingress security group classification in the destination"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa69d971_0eed328b","line":270,"range":{"start_line":270,"start_character":0,"end_line":270,"end_character":10},"updated":"2015-12-30 13:58:27.000000000","message":"I think Solution2 is better","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"0f92b93634c787c19381e89fc961d795c835c437","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":"3) This is problematic for traffic coming from public/external network"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"Solution 2 - Perform Ingress Security Inspection at Destination"},{"line_number":271,"context_line":"---------------------------------------------------------------"},{"line_number":272,"context_line":""},{"line_number":273,"context_line":"This solution perform the ingress security group classification in the destination"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa69d971_375f1843","line":270,"range":{"start_line":270,"start_character":0,"end_line":270,"end_character":10},"in_reply_to":"fa69d971_0652f667","updated":"2015-12-31 07:07:26.000000000","message":"I agree Solution 2 is a better choice, we could later introduce an optimization not to send traffic that was all ready blocked.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"673c4f3a29e963336431d832e6b6f94b2bbeccff","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":"3) This is problematic for traffic coming from public/external network"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"Solution 2 - Perform Ingress Security Inspection at Destination"},{"line_number":271,"context_line":"---------------------------------------------------------------"},{"line_number":272,"context_line":""},{"line_number":273,"context_line":"This solution perform the ingress security group classification in the destination"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa69d971_0652f667","line":270,"range":{"start_line":270,"start_character":0,"end_line":270,"end_character":10},"in_reply_to":"fa69d971_0eed328b","updated":"2015-12-30 15:06:25.000000000","message":"I agree, and Eran Gampel agrees as well! :)","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"dbf9604ecdb2b03c5924e451880b92ab6350ea29","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":"3) This is problematic for traffic coming from public/external network"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"Solution 2 - Perform Ingress Security Inspection at Destination"},{"line_number":271,"context_line":"---------------------------------------------------------------"},{"line_number":272,"context_line":""},{"line_number":273,"context_line":"This solution perform the ingress security group classification in the destination"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba63e191_eb775700","line":270,"range":{"start_line":270,"start_character":0,"end_line":270,"end_character":10},"in_reply_to":"fa69d971_375f1843","updated":"2016-01-19 14:12:04.000000000","message":"+1","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"189b7f34fdac6b5cef16c16d09895ccb8fceaa49","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":"3) This is problematic for traffic coming from public/external network"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":"Solution 2 - Perform Ingress Security Inspection at Destination"},{"line_number":271,"context_line":"---------------------------------------------------------------"},{"line_number":272,"context_line":""},{"line_number":273,"context_line":"This solution perform the ingress security group classification in the destination"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a5ae5dd_71617aa8","line":270,"range":{"start_line":270,"start_character":0,"end_line":270,"end_character":10},"in_reply_to":"fa69d971_375f1843","updated":"2016-02-08 08:27:19.000000000","message":"+1 to start from a simpler solution.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"a54d4cd9ec5c529b8860ab9da1d0f85982c42a26","unresolved":false,"context_lines":[{"line_number":287,"context_line":"10 bits to carry the src security group id."},{"line_number":288,"context_line":"With this model we can still deploy this solution but with VXLAN/GRE."},{"line_number":289,"context_line":"Of course this limit the number of ports per compute nodes and number"},{"line_number":290,"context_line":"of security groups supported."},{"line_number":291,"context_line":"\u003c----- End ----\u003e"},{"line_number":292,"context_line":""},{"line_number":293,"context_line":"The pipeline for this solution looks like this:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a5ae5dd_c824f961","line":290,"updated":"2016-02-09 09:44:10.000000000","message":"If the port ID can be inferred from the tunnel ID, and the security group can be inferred from the port ID, why do we need this behaviour?\nAdditionally, it may be possible to infer the compute node ID from the encapsulating source IP address. Then we can construct ComputeNodeID/PortID pairs, and from the extract the information.\nThis forces us to update all the nodes (to update the classification rules) when a VM is edited. But as stated above, this already has be done.\nThis can be done only for non-variable sized tunnel IDs, where we can\u0027t encapsulate this information, or if we don\u0027t want to take too much of the packet\u0027s mtu.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"6bdb720ae87b7ae169458ef19548845e64153618","unresolved":false,"context_lines":[{"line_number":287,"context_line":"10 bits to carry the src security group id."},{"line_number":288,"context_line":"With this model we can still deploy this solution but with VXLAN/GRE."},{"line_number":289,"context_line":"Of course this limit the number of ports per compute nodes and number"},{"line_number":290,"context_line":"of security groups supported."},{"line_number":291,"context_line":"\u003c----- End ----\u003e"},{"line_number":292,"context_line":""},{"line_number":293,"context_line":"The pipeline for this solution looks like this:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a57f1b5_115d59e9","line":290,"in_reply_to":"3a57f1b5_b9eb23b0","updated":"2016-02-10 05:54:04.000000000","message":"I was trying to think up ways to minimise the use of bits on the tunnel ID. Any information we can extract is information that doesn\u0027t have to be passed over the tunnel ID. This could be limited to only when non-variable tunnel-id size is used.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"680aa8780c59c1bb0feec8c0c774a2eaba55c01f","unresolved":false,"context_lines":[{"line_number":287,"context_line":"10 bits to carry the src security group id."},{"line_number":288,"context_line":"With this model we can still deploy this solution but with VXLAN/GRE."},{"line_number":289,"context_line":"Of course this limit the number of ports per compute nodes and number"},{"line_number":290,"context_line":"of security groups supported."},{"line_number":291,"context_line":"\u003c----- End ----\u003e"},{"line_number":292,"context_line":""},{"line_number":293,"context_line":"The pipeline for this solution looks like this:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a57f1b5_b9eb23b0","line":290,"in_reply_to":"5a5ae5dd_c824f961","updated":"2016-02-09 19:37:48.000000000","message":"The port id is stating the destination port, this is not our problem, we need the src port id (or the source port security group id).\n\nI am not sure i understand your other statement, why do we need the compute node id?\nWe can understand the source from the source IP address as you mentioned, but the idea is to be able to send it instead of re-classifying our source port in the destination (that sounds strange :))","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"f2a1a8c8f8e99228a126624838f121e1be176914","unresolved":false,"context_lines":[{"line_number":321,"context_line":"----"},{"line_number":322,"context_line":"1) Easier to model public/external traffic security groups"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"2) Can work for optimized L2 broadcast/multicast traffic, we will still need to"},{"line_number":325,"context_line":"   be able to send the source security group id somehow."},{"line_number":326,"context_line":""},{"line_number":327,"context_line":"3) Require installing security group rule flows only for local ports"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa69d971_891a7c6d","line":324,"range":{"start_line":324,"start_character":16,"end_line":324,"end_character":56},"updated":"2015-12-30 13:58:27.000000000","message":"What does this mean?","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"673c4f3a29e963336431d832e6b6f94b2bbeccff","unresolved":false,"context_lines":[{"line_number":321,"context_line":"----"},{"line_number":322,"context_line":"1) Easier to model public/external traffic security groups"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"2) Can work for optimized L2 broadcast/multicast traffic, we will still need to"},{"line_number":325,"context_line":"   be able to send the source security group id somehow."},{"line_number":326,"context_line":""},{"line_number":327,"context_line":"3) Require installing security group rule flows only for local ports"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa69d971_06d996f3","line":324,"range":{"start_line":324,"start_character":16,"end_line":324,"end_character":56},"in_reply_to":"fa69d971_891a7c6d","updated":"2015-12-30 15:06:25.000000000","message":"See my response above.","commit_id":"a7c6a27e231089ce1b80099e235f042ce1be048b"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"b4a27e7fd53d8d2563fe8577a682106228b0a7e6","unresolved":false,"context_lines":[{"line_number":251,"context_line":""},{"line_number":252,"context_line":"Pros"},{"line_number":253,"context_line":"-----"},{"line_number":254,"context_line":"1) We block traffic at the source and avoid sending traffic which will be dropped"},{"line_number":255,"context_line":"at the destination"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"2) We dont need to pass any additional metadata and hence dont need Geneve tunneling"}],"source_content_type":"text/x-rst","patch_set":6,"id":"bae84128_5cd12722","line":254,"updated":"2016-02-24 15:26:43.000000000","message":"this is a major \u0027pro\u0027, which I would hate to see lost.\nhaving said that, there could be other ways to block unwanted ingress at a front gate, e.g. by adding a dragonflow service that can block a flow much earlier in the topology (e.g. the edge vrouter, or the source), which will be called by the df-app at the dest upon classifying the flow as \"to drop\".","commit_id":"875ced6ef68c72a63772162eb48409df4520b58f"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"b4a27e7fd53d8d2563fe8577a682106228b0a7e6","unresolved":false,"context_lines":[{"line_number":254,"context_line":"1) We block traffic at the source and avoid sending traffic which will be dropped"},{"line_number":255,"context_line":"at the destination"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"2) We dont need to pass any additional metadata and hence dont need Geneve tunneling"},{"line_number":258,"context_line":"like solution 2."},{"line_number":259,"context_line":""},{"line_number":260,"context_line":"Cons"}],"source_content_type":"text/x-rst","patch_set":6,"id":"bae84128_3ca1c394","line":257,"updated":"2016-02-24 15:26:43.000000000","message":"perhaps revise this statement, as you already mitigated the use of Geneve","commit_id":"875ced6ef68c72a63772162eb48409df4520b58f"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"b4a27e7fd53d8d2563fe8577a682106228b0a7e6","unresolved":false,"context_lines":[{"line_number":259,"context_line":""},{"line_number":260,"context_line":"Cons"},{"line_number":261,"context_line":"------"},{"line_number":262,"context_line":"1) In this solution we have to install in the ingress security table flows that match"},{"line_number":263,"context_line":"all possible destination VM ports (still one flow per rule)"},{"line_number":264,"context_line":""},{"line_number":265,"context_line":"2) Its problematic if we are doing smart broadcast/multicast distribution as different"}],"source_content_type":"text/x-rst","patch_set":6,"id":"bae84128_fce91b80","line":262,"updated":"2016-02-24 15:26:43.000000000","message":"this could explode very quickly, especially if you have a very large deployment with many VMs/containers talking to each other","commit_id":"875ced6ef68c72a63772162eb48409df4520b58f"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"b4a27e7fd53d8d2563fe8577a682106228b0a7e6","unresolved":false,"context_lines":[{"line_number":262,"context_line":"1) In this solution we have to install in the ingress security table flows that match"},{"line_number":263,"context_line":"all possible destination VM ports (still one flow per rule)"},{"line_number":264,"context_line":""},{"line_number":265,"context_line":"2) Its problematic if we are doing smart broadcast/multicast distribution as different"},{"line_number":266,"context_line":"security policy can be configured to VM ports in the same broadcast/multicast domain"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"3) This is problematic for traffic coming from public/external network"}],"source_content_type":"text/x-rst","patch_set":6,"id":"bae84128_1ca4bf05","line":265,"range":{"start_line":265,"start_character":0,"end_line":265,"end_character":1},"updated":"2016-02-24 15:26:43.000000000","message":"i think this could collide with the IGMP functionality","commit_id":"875ced6ef68c72a63772162eb48409df4520b58f"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"b4a27e7fd53d8d2563fe8577a682106228b0a7e6","unresolved":false,"context_lines":[{"line_number":278,"context_line":"security group id (in addition to the destination VM port id which is written"},{"line_number":279,"context_line":"in the tunnel VNI)."},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"\u003c--- Solution for not using Geneve ----\u003e"},{"line_number":282,"context_line":"Currently the tunnel id is a global mapping between PORT_id --\u003e Tunnel_id."},{"line_number":283,"context_line":"This is why we need all 24 bits of the VNI field."},{"line_number":284,"context_line":"However, we can allocate the unique port ids per compute node and manage them"}],"source_content_type":"text/x-rst","patch_set":6,"id":"bae84128_9fbd6104","line":281,"updated":"2016-02-24 15:26:43.000000000","message":"I think it is good to have a solution that aligns-with and is optimized-for the specific neutron ml2 typedriver that is being used in the particular deployment - once dragonflow is ml2 as well, of course","commit_id":"875ced6ef68c72a63772162eb48409df4520b58f"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"b4a27e7fd53d8d2563fe8577a682106228b0a7e6","unresolved":false,"context_lines":[{"line_number":284,"context_line":"However, we can allocate the unique port ids per compute node and manage them"},{"line_number":285,"context_line":"at the plugin."},{"line_number":286,"context_line":"By doing this we can split the VNI into 14 bits for the port id and"},{"line_number":287,"context_line":"10 bits to carry the src security group id."},{"line_number":288,"context_line":"With this model we can still deploy this solution but with VXLAN/GRE."},{"line_number":289,"context_line":"Of course this limit the number of ports per compute nodes and number"},{"line_number":290,"context_line":"of security groups supported."}],"source_content_type":"text/x-rst","patch_set":6,"id":"bae84128_1f43116d","line":287,"updated":"2016-02-24 15:26:43.000000000","message":"I don\u0027t feel like this would be a problem from the limitation on # of SGs, 1024 per port sounds more than enough.\nAs for limiting to 16384 ports per CN... this could become a limitation at some point.\nAlthough it will be possible (and maybe even preferable) for users to just move to Geneve, we might want to consider allowing the user to decide the ratio point between SGs and ports... (I would probably go with 8-bit:16-bit)","commit_id":"875ced6ef68c72a63772162eb48409df4520b58f"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"cef4bb2fea5165eb06e26383b8e3f4267c4f6256","unresolved":false,"context_lines":[{"line_number":284,"context_line":"However, we can allocate the unique port ids per compute node and manage them"},{"line_number":285,"context_line":"at the plugin."},{"line_number":286,"context_line":"By doing this we can split the VNI into 14 bits for the port id and"},{"line_number":287,"context_line":"10 bits to carry the src security group id."},{"line_number":288,"context_line":"With this model we can still deploy this solution but with VXLAN/GRE."},{"line_number":289,"context_line":"Of course this limit the number of ports per compute nodes and number"},{"line_number":290,"context_line":"of security groups supported."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aed3d3a_12039110","line":287,"in_reply_to":"bae84128_1f43116d","updated":"2016-02-27 12:37:57.000000000","message":"the ratio could be at least a constant. vxlan is widely used in production and is supported by hardware offload.","commit_id":"875ced6ef68c72a63772162eb48409df4520b58f"}]}