)]}'
{"doc/source/specs/metadata_service.rst":[{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"51998df2231713c9b211102e1a23e78809547a74","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* X-Instance-ID: The UUID of the virtual instance"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* X-Instance-ID-Signature: A cryptographic signature of the Instance-ID[1]"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* X-Tenant-ID: The UUID of the tenant"},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_f275d4f9","line":48,"range":{"start_line":48,"start_character":71,"end_line":48,"end_character":74},"updated":"2016-04-28 17:45:48.000000000","message":"[1]?  missing reference?","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"30c0341da9334dcb7e17714162c14a9a9d319225","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* X-Instance-ID: The UUID of the virtual instance"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* X-Instance-ID-Signature: A cryptographic signature of the Instance-ID[1]"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* X-Tenant-ID: The UUID of the tenant"},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_4d6b1d20","line":48,"range":{"start_line":48,"start_character":71,"end_line":48,"end_character":74},"in_reply_to":"1a122d0e_f275d4f9","updated":"2016-04-30 06:53:58.000000000","message":"Done","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"5386538996f48f57f8460e2112a0b383f58334e8","unresolved":false,"context_lines":[{"line_number":64,"context_line":"the Nova metadata service. It processes the HTTP request, and sends an HTTP"},{"line_number":65,"context_line":"request to the Nova metadata service, adding the required headers."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The metadata service runs in its own network namespace."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"The metadata service\u0027s namespace has two interfaces: tap-metadata and"},{"line_number":70,"context_line":"veth-metadata. tap-metadata is an OVS port used to communicate with the VMs."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_33920d4c","line":67,"range":{"start_line":67,"start_character":0,"end_line":67,"end_character":55},"updated":"2016-04-25 17:17:13.000000000","message":"As a result, the same network namespaces are spread among compute nodes.\n\nCan we use local controller as the metadata proxy?\nVM-\u003e169.254.169.254-\u003edf metadata app-\u003espawn_green_thread-\u003enova api.\n\nWhy do we need to deploy metadata service within each network namespace?","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"577e8e935be7a9521dbe12445fba2734fba7a451","unresolved":false,"context_lines":[{"line_number":64,"context_line":"the Nova metadata service. It processes the HTTP request, and sends an HTTP"},{"line_number":65,"context_line":"request to the Nova metadata service, adding the required headers."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The metadata service runs in its own network namespace."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"The metadata service\u0027s namespace has two interfaces: tap-metadata and"},{"line_number":70,"context_line":"veth-metadata. tap-metadata is an OVS port used to communicate with the VMs."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_6e013c6a","line":67,"range":{"start_line":67,"start_character":0,"end_line":67,"end_character":55},"in_reply_to":"1a122d0e_33920d4c","updated":"2016-04-25 17:52:17.000000000","message":"There may be another web server running on the node at 0.0.0.0:80 (e.g. horizon). As a result, any metadata service running on that port must be in a network namespace.\n\nI\u0027ll add this information.","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"51998df2231713c9b211102e1a23e78809547a74","unresolved":false,"context_lines":[{"line_number":64,"context_line":"the Nova metadata service. It processes the HTTP request, and sends an HTTP"},{"line_number":65,"context_line":"request to the Nova metadata service, adding the required headers."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The metadata service runs in its own network namespace."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"The metadata service\u0027s namespace has two interfaces: tap-metadata and"},{"line_number":70,"context_line":"veth-metadata. tap-metadata is an OVS port used to communicate with the VMs."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_b26a3cb1","line":67,"range":{"start_line":67,"start_character":0,"end_line":67,"end_character":55},"in_reply_to":"1a122d0e_6e013c6a","updated":"2016-04-28 17:45:48.000000000","message":"FYI\nwhen i wrote a similar functionality in midonet [1]\ni avoided the problem by NAT\u0027ing the port.\n\n[1] https://github.com/midonet/midonet/blob/master/docs/openstack-metadata.md","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"075a4291566e329cab289e894ee8a7e42da9f691","unresolved":false,"context_lines":[{"line_number":64,"context_line":"the Nova metadata service. It processes the HTTP request, and sends an HTTP"},{"line_number":65,"context_line":"request to the Nova metadata service, adding the required headers."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The metadata service runs in its own network namespace."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"The metadata service\u0027s namespace has two interfaces: tap-metadata and"},{"line_number":70,"context_line":"veth-metadata. tap-metadata is an OVS port used to communicate with the VMs."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_e55019d7","line":67,"range":{"start_line":67,"start_character":0,"end_line":67,"end_character":55},"in_reply_to":"1a122d0e_ad7bd1f3","updated":"2016-05-03 03:06:08.000000000","message":"sure, so use a different port.","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"30c0341da9334dcb7e17714162c14a9a9d319225","unresolved":false,"context_lines":[{"line_number":64,"context_line":"the Nova metadata service. It processes the HTTP request, and sends an HTTP"},{"line_number":65,"context_line":"request to the Nova metadata service, adding the required headers."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The metadata service runs in its own network namespace."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"The metadata service\u0027s namespace has two interfaces: tap-metadata and"},{"line_number":70,"context_line":"veth-metadata. tap-metadata is an OVS port used to communicate with the VMs."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_ad7bd1f3","line":67,"range":{"start_line":67,"start_character":0,"end_line":67,"end_character":55},"in_reply_to":"1a122d0e_b26a3cb1","updated":"2016-04-30 06:53:58.000000000","message":"I will look into it. However, from what I saw in the specific case I ran into, the web server was bound to 0.0.0.0:80, so any new interface and IP (that wasn\u0027t in a network namespace) was automatically bound as well. The bind command failed on that.","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"51998df2231713c9b211102e1a23e78809547a74","unresolved":false,"context_lines":[{"line_number":69,"context_line":"The metadata service\u0027s namespace has two interfaces: tap-metadata and"},{"line_number":70,"context_line":"veth-metadata. tap-metadata is an OVS port used to communicate with the VMs."},{"line_number":71,"context_line":"veth-metadata is a member of a veth-pair used to communicate with the physical"},{"line_number":72,"context_line":"network."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"The veth-metadata is a member of a veth pair. The other member is in the main"},{"line_number":75,"context_line":"namespace. Outgoing communication is then NATed by the compute node. The"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_d2fc18b7","line":72,"updated":"2016-04-28 17:45:48.000000000","message":"some figures would be nice.","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"30c0341da9334dcb7e17714162c14a9a9d319225","unresolved":false,"context_lines":[{"line_number":69,"context_line":"The metadata service\u0027s namespace has two interfaces: tap-metadata and"},{"line_number":70,"context_line":"veth-metadata. tap-metadata is an OVS port used to communicate with the VMs."},{"line_number":71,"context_line":"veth-metadata is a member of a veth-pair used to communicate with the physical"},{"line_number":72,"context_line":"network."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"The veth-metadata is a member of a veth pair. The other member is in the main"},{"line_number":75,"context_line":"namespace. Outgoing communication is then NATed by the compute node. The"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_4d24bd0d","line":72,"in_reply_to":"1a122d0e_d2fc18b7","updated":"2016-04-30 06:53:58.000000000","message":"Done","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"51998df2231713c9b211102e1a23e78809547a74","unresolved":false,"context_lines":[{"line_number":105,"context_line":"packets are sent to the metadata service reply table."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Packets that reach the metadata service table are forwarded to the metadata"},{"line_number":108,"context_line":"service, via the OVS port \u0027tap-metadata\u0027 mentioned above. The packet\u0027s source"},{"line_number":109,"context_line":"IP address is modified to be the in_port. The MSB is set, so that the IP will"},{"line_number":110,"context_line":"appear legal, and will not be dropped by the linux network stack."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"A TCP SYN packet that reaches the metadata service table is intercepted by the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_a6ae817e","line":109,"range":{"start_line":108,"start_character":58,"end_line":109,"end_character":56},"updated":"2016-04-28 17:45:48.000000000","message":"can you make it clear the way the ip address is generated from in_port?","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"30c0341da9334dcb7e17714162c14a9a9d319225","unresolved":false,"context_lines":[{"line_number":105,"context_line":"packets are sent to the metadata service reply table."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Packets that reach the metadata service table are forwarded to the metadata"},{"line_number":108,"context_line":"service, via the OVS port \u0027tap-metadata\u0027 mentioned above. The packet\u0027s source"},{"line_number":109,"context_line":"IP address is modified to be the in_port. The MSB is set, so that the IP will"},{"line_number":110,"context_line":"appear legal, and will not be dropped by the linux network stack."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"A TCP SYN packet that reaches the metadata service table is intercepted by the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_ed0e698b","line":109,"range":{"start_line":108,"start_character":58,"end_line":109,"end_character":56},"in_reply_to":"1a122d0e_a6ae817e","updated":"2016-04-30 06:53:58.000000000","message":"Done","commit_id":"9152473301fa34d246e740a7ed50b524739d8853"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"0502e23da0b839fdc3345fef1d35435a3273f591","unresolved":false,"context_lines":[{"line_number":139,"context_line":"service, via the OVS port \u0027tap-metadata\u0027 mentioned above. The packet\u0027s source"},{"line_number":140,"context_line":"IP address is modified to be the in_port. The MSB is set, so that the IP will"},{"line_number":141,"context_line":"appear legal, and will not be dropped by the linux network stack. i.e."},{"line_number":142,"context_line":"int(src_ip) \u003c- in_port \u0026 0x80000000 (\u003d in_port \u0026 int(128.0.0.0)."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"For example, if a VM\u0027s in_port is 13, the packets\u0027 source IP is modified to:"},{"line_number":145,"context_line":"128.0.0.13. If the in_port is 1058, the resulting IP is: 128.0.4.34."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_853fa586","line":142,"range":{"start_line":142,"start_character":23,"end_line":142,"end_character":24},"updated":"2016-05-03 03:19:20.000000000","message":"you mean | ?","commit_id":"62b6a67a95350901d322ed9ca36a0846ba0a9a6b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"7fe6cfd37adc8b2096920dd090ad5907e8133ce4","unresolved":false,"context_lines":[{"line_number":139,"context_line":"service, via the OVS port \u0027tap-metadata\u0027 mentioned above. The packet\u0027s source"},{"line_number":140,"context_line":"IP address is modified to be the in_port. The MSB is set, so that the IP will"},{"line_number":141,"context_line":"appear legal, and will not be dropped by the linux network stack. i.e."},{"line_number":142,"context_line":"int(src_ip) \u003c- in_port \u0026 0x80000000 (\u003d in_port \u0026 int(128.0.0.0)."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"For example, if a VM\u0027s in_port is 13, the packets\u0027 source IP is modified to:"},{"line_number":145,"context_line":"128.0.0.13. If the in_port is 1058, the resulting IP is: 128.0.4.34."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_0cfe1d38","line":142,"range":{"start_line":142,"start_character":23,"end_line":142,"end_character":24},"in_reply_to":"1a122d0e_853fa586","updated":"2016-05-03 06:21:59.000000000","message":"Yes, I did.","commit_id":"62b6a67a95350901d322ed9ca36a0846ba0a9a6b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"This allows the instance to retrieve additional configuration information, e.g."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"* Public IP"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* Public hostname"},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_7455a2c4","line":25,"updated":"2016-05-04 12:30:26.000000000","message":"What do you mean public IP?","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"This allows the instance to retrieve additional configuration information, e.g."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"* Public IP"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* Public hostname"},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_ca230104","line":25,"in_reply_to":"1a122d0e_7455a2c4","updated":"2016-05-05 09:09:08.000000000","message":"The VM may get its public IP from the metadata service. e.g. if there is a fip installed.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"* Public IP"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* Public hostname"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"* Random seed"},{"line_number":30,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_54718643","line":27,"updated":"2016-05-04 12:30:26.000000000","message":"same","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"* Public IP"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* Public hostname"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"* Random seed"},{"line_number":30,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_4a653143","line":27,"in_reply_to":"1a122d0e_54718643","updated":"2016-05-05 09:09:08.000000000","message":"The VM may get its public host name, which could be different than the VM name or internal hostname.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"More specifically, the virtual instance sends an HTTP request to the link-local"},{"line_number":40,"context_line":"IPv4 address 169.254.169.254. A service listening on that address needs to add"},{"line_number":41,"context_line":"the following HTTP headers, and then forward the request to the nova service."},{"line_number":42,"context_line":"In effect behaving as a transparent HTTP proxy."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The added headers are:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_74900296","line":41,"updated":"2016-05-04 12:30:26.000000000","message":"If we have more then one nova service, who is receiving the request? are we suppose to load balance between them?","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"More specifically, the virtual instance sends an HTTP request to the link-local"},{"line_number":40,"context_line":"IPv4 address 169.254.169.254. A service listening on that address needs to add"},{"line_number":41,"context_line":"the following HTTP headers, and then forward the request to the nova service."},{"line_number":42,"context_line":"In effect behaving as a transparent HTTP proxy."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The added headers are:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_2a90b5ec","line":41,"in_reply_to":"1a122d0e_74900296","updated":"2016-05-05 09:09:08.000000000","message":"One nova service receives the request. Decided by configuration.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":39,"context_line":"More specifically, the virtual instance sends an HTTP request to the link-local"},{"line_number":40,"context_line":"IPv4 address 169.254.169.254. A service listening on that address needs to add"},{"line_number":41,"context_line":"the following HTTP headers, and then forward the request to the nova service."},{"line_number":42,"context_line":"In effect behaving as a transparent HTTP proxy."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The added headers are:"},{"line_number":45,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_14bf0efd","line":42,"updated":"2016-05-04 12:30:26.000000000","message":"when you say \"transparent\", isnt the destination IP changes to the nova service ip?\nThis is not really transparent if we are doing termination and i assume we are, no?","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":39,"context_line":"More specifically, the virtual instance sends an HTTP request to the link-local"},{"line_number":40,"context_line":"IPv4 address 169.254.169.254. A service listening on that address needs to add"},{"line_number":41,"context_line":"the following HTTP headers, and then forward the request to the nova service."},{"line_number":42,"context_line":"In effect behaving as a transparent HTTP proxy."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The added headers are:"},{"line_number":45,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_3e459642","line":42,"in_reply_to":"1a122d0e_14bf0efd","updated":"2016-05-05 09:09:08.000000000","message":"From wikipedia: [Transparent Proxy] Also known as an intercepting proxy, inline proxy, or forced proxy, a transparent proxy intercepts normal communication at the network layer without requiring any special client configuration. Clients need not be aware of the existence of the proxy. A transparent proxy is normally located between the client and the Internet, with the proxy performing some of the functions of a gateway or router.\n\nIn any case, I think a proxy is always terminating, and always changes the destination IP.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":52,"context_line":"* X-Forwarded-For: The IP of the virtual instance"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Currently, there is a solution implemented by Neutron. However, this solution"},{"line_number":55,"context_line":"is implemented in a network node, with a proxy per tenant, and a proxy per"},{"line_number":56,"context_line":"network node."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The solution proposed here is distributed, in that there is a single proxy"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_f4aff27a","line":55,"updated":"2016-05-04 12:30:26.000000000","message":"the proxy is per network and the agent is per compute node i believe (or per tenant)","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":52,"context_line":"* X-Forwarded-For: The IP of the virtual instance"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Currently, there is a solution implemented by Neutron. However, this solution"},{"line_number":55,"context_line":"is implemented in a network node, with a proxy per tenant, and a proxy per"},{"line_number":56,"context_line":"network node."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The solution proposed here is distributed, in that there is a single proxy"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_3e8ab664","line":55,"in_reply_to":"1a122d0e_f4aff27a","updated":"2016-05-05 09:09:08.000000000","message":"All proxies/agents are on the network node - one per tenant receiving the packet, and the other per network node adding additional info and passing it to the nova service.\n\nBoth proxies/agents must be on the same node, since they communicate via unix sockets and not TCP/IP.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"49f914921970178b0c343c8554d2f2fc06d0f988","unresolved":false,"context_lines":[{"line_number":55,"context_line":"is implemented in a network node, with a proxy per tenant, and a proxy per"},{"line_number":56,"context_line":"network node."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The solution proposed here is distributed, in that there is a single proxy"},{"line_number":59,"context_line":"running on each compute node that runs a Dragonflow controller."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The solution proposed here assumes only that the VM has a logical port. It does"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_1377283c","line":58,"range":{"start_line":58,"start_character":46,"end_line":58,"end_character":56},"updated":"2016-05-04 11:13:20.000000000","message":"please rephrase","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"af9bb1b52396e2c67b62bf345829d16edc4798f5","unresolved":false,"context_lines":[{"line_number":55,"context_line":"is implemented in a network node, with a proxy per tenant, and a proxy per"},{"line_number":56,"context_line":"network node."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The solution proposed here is distributed, in that there is a single proxy"},{"line_number":59,"context_line":"running on each compute node that runs a Dragonflow controller."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The solution proposed here assumes only that the VM has a logical port. It does"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_39db23ef","line":58,"range":{"start_line":58,"start_character":46,"end_line":58,"end_character":56},"in_reply_to":"1a122d0e_1377283c","updated":"2016-05-04 11:57:01.000000000","message":"Please explain.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The solution proposed here assumes only that the VM has a logical port. It does"},{"line_number":62,"context_line":"not rely on DHCP, or a router. The VM selects a link-local address"},{"line_number":63,"context_line":"autonomously, and uses it to communicate with the service."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Proposed Change"},{"line_number":66,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_f4fd326f","line":63,"updated":"2016-05-04 12:30:26.000000000","message":"In Neutron, at least for the DHCP case the VM uses its own received IP","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The solution proposed here assumes only that the VM has a logical port. It does"},{"line_number":62,"context_line":"not rely on DHCP, or a router. The VM selects a link-local address"},{"line_number":63,"context_line":"autonomously, and uses it to communicate with the service."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Proposed Change"},{"line_number":66,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_dec6229b","line":63,"in_reply_to":"1a122d0e_f4fd326f","updated":"2016-05-05 09:09:08.000000000","message":"This solution is VM-IP agnostic. I\u0027ll rephrase to reflect that.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    |                                   |"},{"line_number":91,"context_line":"    +-----------------------------------+"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The metadata service behaves as a proxy, between a VM with a link-local IP, and"},{"line_number":94,"context_line":"the Nova metadata service. It processes the HTTP request, and sends an HTTP"},{"line_number":95,"context_line":"request to the Nova metadata service, adding the required headers."},{"line_number":96,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_b478daf9","line":93,"updated":"2016-05-04 12:30:26.000000000","message":"the VM already has an IP at the point of the cloud-init request","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    |                                   |"},{"line_number":91,"context_line":"    +-----------------------------------+"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The metadata service behaves as a proxy, between a VM with a link-local IP, and"},{"line_number":94,"context_line":"the Nova metadata service. It processes the HTTP request, and sends an HTTP"},{"line_number":95,"context_line":"request to the Nova metadata service, adding the required headers."},{"line_number":96,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_9e378aaf","line":93,"in_reply_to":"1a122d0e_b478daf9","updated":"2016-05-05 09:09:08.000000000","message":"Same here re: VM IP.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":98,"context_line":"communicate with the VMs."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The metadata service listens on an OVS interface, with IP 169.254.169.254, on"},{"line_number":101,"context_line":"a configurable non-standard port. The configuration can specify that the"},{"line_number":102,"context_line":"service will use an ephemeral port. This is so to avoid collision with existing"},{"line_number":103,"context_line":"HTTP services on the host."},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_f4e7f2a9","line":101,"updated":"2016-05-04 12:30:26.000000000","message":"Why is this not running inside a namespace? we need to consider security implications of such design when VMs are communicating with processes running on our host machine, i think this at least should be mailed and verified that its ok","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":98,"context_line":"communicate with the VMs."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The metadata service listens on an OVS interface, with IP 169.254.169.254, on"},{"line_number":101,"context_line":"a configurable non-standard port. The configuration can specify that the"},{"line_number":102,"context_line":"service will use an ephemeral port. This is so to avoid collision with existing"},{"line_number":103,"context_line":"HTTP services on the host."},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_5e69728b","line":101,"in_reply_to":"1a122d0e_f4e7f2a9","updated":"2016-05-05 09:09:08.000000000","message":"I believe this design is secure. All incoming data is sanitised. No external information is passed to external calls without due processing, and sanitisation.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"49f914921970178b0c343c8554d2f2fc06d0f988","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"VMs access the metadata service on IP 169.254.169.254, port 80. VMs are"},{"line_number":106,"context_line":"identified by their in_port. The Dragonflow metadata service retrieves the VM"},{"line_number":107,"context_line":"and tenant ID according to the in_port, and forwards it to the Nova metadata"},{"line_number":108,"context_line":"service."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"All IP packets from the tap-metadata interface are treated as directly"},{"line_number":111,"context_line":"routable. This is done by creating an outgoing interface based routing rule to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_d314904e","line":108,"range":{"start_line":107,"start_character":39,"end_line":108,"end_character":7},"updated":"2016-05-04 11:13:20.000000000","message":"I suppose you better tell here explicitly that you proxy the HTTP request - you add http headers, etc..","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"af9bb1b52396e2c67b62bf345829d16edc4798f5","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"VMs access the metadata service on IP 169.254.169.254, port 80. VMs are"},{"line_number":106,"context_line":"identified by their in_port. The Dragonflow metadata service retrieves the VM"},{"line_number":107,"context_line":"and tenant ID according to the in_port, and forwards it to the Nova metadata"},{"line_number":108,"context_line":"service."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"All IP packets from the tap-metadata interface are treated as directly"},{"line_number":111,"context_line":"routable. This is done by creating an outgoing interface based routing rule to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_79fc7b3e","line":108,"range":{"start_line":107,"start_character":39,"end_line":108,"end_character":7},"in_reply_to":"1a122d0e_d314904e","updated":"2016-05-04 11:57:01.000000000","message":"Done","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"49f914921970178b0c343c8554d2f2fc06d0f988","unresolved":false,"context_lines":[{"line_number":132,"context_line":"original VM."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"The initial flows that are installed detect connections to 169.254.169.254:80"},{"line_number":135,"context_line":"and re-routes them to the metadata service table."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"These initial flows also modify the destination port of the packet to be the"},{"line_number":138,"context_line":"service\u0027s listening port."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_6e4b135a","line":135,"range":{"start_line":135,"start_character":5,"end_line":135,"end_character":13},"updated":"2016-05-04 11:13:20.000000000","message":"same here, \"re-routing\" for most of the people here imply using the same packet while you create a new http request","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"af9bb1b52396e2c67b62bf345829d16edc4798f5","unresolved":false,"context_lines":[{"line_number":132,"context_line":"original VM."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"The initial flows that are installed detect connections to 169.254.169.254:80"},{"line_number":135,"context_line":"and re-routes them to the metadata service table."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"These initial flows also modify the destination port of the packet to be the"},{"line_number":138,"context_line":"service\u0027s listening port."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_39b0438b","line":135,"range":{"start_line":135,"start_character":5,"end_line":135,"end_character":13},"in_reply_to":"1a122d0e_6e4b135a","updated":"2016-05-04 11:57:01.000000000","message":"Actually, here I mean the same packet. The packet is received on table 9 (service classification). The metadata service case is detected (IP/port 169.254.168.254:80), and that packet is sent to the metadata service table (and from there to the metadata service). This is a re-routing.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":142,"context_line":""},{"line_number":143,"context_line":"Packets that reach the metadata service table are forwarded to the metadata"},{"line_number":144,"context_line":"service, via the OVS port \u0027tap-metadata\u0027 mentioned above. The packet\u0027s source"},{"line_number":145,"context_line":"IP address is modified to be the in_port. The MSB is set, so that the IP will"},{"line_number":146,"context_line":"appear legal, and will not be dropped by the linux network stack. i.e."},{"line_number":147,"context_line":"int(src_ip) \u003c- in_port | 0x80000000 (\u003d in_port | int(128.0.0.0)."},{"line_number":148,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_c857bac8","line":145,"updated":"2016-05-04 12:30:26.000000000","message":"If you only change the source tcp port to reflect the VM network and use the IP (which is the VM IP) to do this pointing it might be simpler.\n(And use learning flows to implement the reverse direction)\n\nFor this case we dont really need controller intervention as well","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":142,"context_line":""},{"line_number":143,"context_line":"Packets that reach the metadata service table are forwarded to the metadata"},{"line_number":144,"context_line":"service, via the OVS port \u0027tap-metadata\u0027 mentioned above. The packet\u0027s source"},{"line_number":145,"context_line":"IP address is modified to be the in_port. The MSB is set, so that the IP will"},{"line_number":146,"context_line":"appear legal, and will not be dropped by the linux network stack. i.e."},{"line_number":147,"context_line":"int(src_ip) \u003c- in_port | 0x80000000 (\u003d in_port | int(128.0.0.0)."},{"line_number":148,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_1e21ba4d","line":145,"in_reply_to":"1a122d0e_c857bac8","updated":"2016-05-05 09:09:08.000000000","message":"Even changing the source port requires controller intervention - something needs to record the old TCP port, and add a reverse flow.\n\nI\u0027ll review learning flows. I am not sure how they come in. I\u0027d be grateful for more information.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":147,"context_line":"int(src_ip) \u003c- in_port | 0x80000000 (\u003d in_port | int(128.0.0.0)."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"For example, if a VM\u0027s in_port is 13, the packets\u0027 source IP is modified to:"},{"line_number":150,"context_line":"128.0.0.13. If the in_port is 1058, the resulting IP is: 128.0.4.34."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"A TCP SYN packet that reaches the metadata service table is intercepted by the"},{"line_number":153,"context_line":"controller. The controller installs return flows, and then passes the packet"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_08209248","line":150,"updated":"2016-05-04 12:30:26.000000000","message":"The ids are the logical port id or the OF id?","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":147,"context_line":"int(src_ip) \u003c- in_port | 0x80000000 (\u003d in_port | int(128.0.0.0)."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"For example, if a VM\u0027s in_port is 13, the packets\u0027 source IP is modified to:"},{"line_number":150,"context_line":"128.0.0.13. If the in_port is 1058, the resulting IP is: 128.0.4.34."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"A TCP SYN packet that reaches the metadata service table is intercepted by the"},{"line_number":153,"context_line":"controller. The controller installs return flows, and then passes the packet"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_ded90258","line":150,"in_reply_to":"1a122d0e_08209248","updated":"2016-05-05 09:09:08.000000000","message":"The IDs are the in_port. As far as I know these are the OF ports. I\u0027ll add that above.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"48193544c61d67c9625d97cb716b5353f2cd78bd","unresolved":false,"context_lines":[{"line_number":153,"context_line":"controller. The controller installs return flows, and then passes the packet"},{"line_number":154,"context_line":"in the same way as the original flow."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"The controller installs an ARP mapping from the modified IP address to the"},{"line_number":157,"context_line":"MAC address of the VM initiating the request. This mapping is installed on"},{"line_number":158,"context_line":"the tap-metadata interface only."},{"line_number":159,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_88878211","line":156,"updated":"2016-05-04 12:30:26.000000000","message":"not needed if we only convert src port numbers","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"c1bef60ad68707976cb8761cea1320a74e045cce","unresolved":false,"context_lines":[{"line_number":153,"context_line":"controller. The controller installs return flows, and then passes the packet"},{"line_number":154,"context_line":"in the same way as the original flow."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"The controller installs an ARP mapping from the modified IP address to the"},{"line_number":157,"context_line":"MAC address of the VM initiating the request. This mapping is installed on"},{"line_number":158,"context_line":"the tap-metadata interface only."},{"line_number":159,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_1ecb7a54","line":156,"in_reply_to":"1a122d0e_88878211","updated":"2016-05-05 09:09:08.000000000","message":"Not true if we don\u0027t use DHCP, or the VM uses a link-local IP for which the ARP responder is not informed.","commit_id":"e6204cf44a0e6636fbac728398f158dae22aa1b4"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"d9b10c14c2ca31009e34505995b0af9a77cbc4c2","unresolved":false,"context_lines":[{"line_number":83,"context_line":"    |      |            |    |Metadata| |         |"},{"line_number":84,"context_line":"    |      |            |    |Service +-----------+"},{"line_number":85,"context_line":"    |      |VM port     +-------------+ |"},{"line_number":86,"context_line":"    |      |IP 169.254.13.85   |Metadata service - IP 169.254.169.254"},{"line_number":87,"context_line":"    |   +---------------------------+   |"},{"line_number":88,"context_line":"    |   | OVS switch                |   |"},{"line_number":89,"context_line":"    |   +---------------------------+   |"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dab17558_8fc7da62","line":86,"range":{"start_line":86,"start_character":32,"end_line":86,"end_character":48},"updated":"2016-05-12 01:50:44.000000000","message":"tap-metadata?","commit_id":"cedb45568e692bb2469589869ebb568a1112559a"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"d06ccfd82c5b2cafcb75bb50d479d741d94d33b6","unresolved":false,"context_lines":[{"line_number":83,"context_line":"    |      |            |    |Metadata| |         |"},{"line_number":84,"context_line":"    |      |            |    |Service +-----------+"},{"line_number":85,"context_line":"    |      |VM port     +-------------+ |"},{"line_number":86,"context_line":"    |      |IP 169.254.13.85   |Metadata service - IP 169.254.169.254"},{"line_number":87,"context_line":"    |   +---------------------------+   |"},{"line_number":88,"context_line":"    |   | OVS switch                |   |"},{"line_number":89,"context_line":"    |   +---------------------------+   |"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dab17558_128f4524","line":86,"range":{"start_line":86,"start_character":32,"end_line":86,"end_character":48},"in_reply_to":"dab17558_8fc7da62","updated":"2016-05-13 10:47:20.000000000","message":"tap-metadata is the name of the interface.\nMetadata service is the logical name of what we\u0027re doing. In the same way that \u0027VM port\u0027 is not \u0027tap\u003cVM ID\u003e\u0027.\n\nIs this acceptable, or should I still change it?","commit_id":"cedb45568e692bb2469589869ebb568a1112559a"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"d9b10c14c2ca31009e34505995b0af9a77cbc4c2","unresolved":false,"context_lines":[{"line_number":114,"context_line":"As part of this forwarding process, the metadata service adds to the HTTP"},{"line_number":115,"context_line":"request the HTTP headers described above."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"All IP packets from the tap-metadata interface are treated as directly"},{"line_number":118,"context_line":"routable. This is done by creating an outgoing interface based routing rule to"},{"line_number":119,"context_line":"a routing table where all routes are on the direct network."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"This rule will only match packets that already egress via tap-metadata, and"},{"line_number":122,"context_line":"will not affect the network on the rest of the compute node. Additionally,"},{"line_number":123,"context_line":"there will be no networks reachable from the tap-metadata interface in the main"},{"line_number":124,"context_line":"routing table."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"The X-Instance-ID-Signature header is calculated with the hmac algorithm over"},{"line_number":127,"context_line":"the X-Instance-ID header and a shared secret available in /etc/nova/nova.conf."}],"source_content_type":"text/x-rst","patch_set":5,"id":"dab17558_af2bbe80","line":124,"range":{"start_line":117,"start_character":0,"end_line":124,"end_character":14},"updated":"2016-05-12 01:50:44.000000000","message":"i don\u0027t follow this.  an example would be nice.","commit_id":"cedb45568e692bb2469589869ebb568a1112559a"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"d06ccfd82c5b2cafcb75bb50d479d741d94d33b6","unresolved":false,"context_lines":[{"line_number":114,"context_line":"As part of this forwarding process, the metadata service adds to the HTTP"},{"line_number":115,"context_line":"request the HTTP headers described above."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"All IP packets from the tap-metadata interface are treated as directly"},{"line_number":118,"context_line":"routable. This is done by creating an outgoing interface based routing rule to"},{"line_number":119,"context_line":"a routing table where all routes are on the direct network."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"This rule will only match packets that already egress via tap-metadata, and"},{"line_number":122,"context_line":"will not affect the network on the rest of the compute node. Additionally,"},{"line_number":123,"context_line":"there will be no networks reachable from the tap-metadata interface in the main"},{"line_number":124,"context_line":"routing table."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"The X-Instance-ID-Signature header is calculated with the hmac algorithm over"},{"line_number":127,"context_line":"the X-Instance-ID header and a shared secret available in /etc/nova/nova.conf."}],"source_content_type":"text/x-rst","patch_set":5,"id":"dab17558_32b369eb","line":124,"range":{"start_line":117,"start_character":0,"end_line":124,"end_character":14},"in_reply_to":"dab17558_af2bbe80","updated":"2016-05-13 10:47:20.000000000","message":"Done","commit_id":"cedb45568e692bb2469589869ebb568a1112559a"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"d9b10c14c2ca31009e34505995b0af9a77cbc4c2","unresolved":false,"context_lines":[{"line_number":151,"context_line":"service, via the OVS port \u0027tap-metadata\u0027 mentioned above. The packet\u0027s source"},{"line_number":152,"context_line":"IP address is modified to be the in_port. The MSB is set, so that the IP will"},{"line_number":153,"context_line":"appear legal, and will not be dropped by the linux network stack. i.e."},{"line_number":154,"context_line":"int(src_ip) \u003c- in_port | 0x80000000 (\u003d in_port | int(128.0.0.0)."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"In effect, we use the in_port to identify the VM. The in_port is the OF-port"},{"line_number":157,"context_line":"of the port through which the VM made the request. Each port is treated"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dab17558_ef21469f","line":154,"range":{"start_line":154,"start_character":63,"end_line":154,"end_character":64},"updated":"2016-05-12 01:50:44.000000000","message":"missing )","commit_id":"cedb45568e692bb2469589869ebb568a1112559a"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"d06ccfd82c5b2cafcb75bb50d479d741d94d33b6","unresolved":false,"context_lines":[{"line_number":151,"context_line":"service, via the OVS port \u0027tap-metadata\u0027 mentioned above. The packet\u0027s source"},{"line_number":152,"context_line":"IP address is modified to be the in_port. The MSB is set, so that the IP will"},{"line_number":153,"context_line":"appear legal, and will not be dropped by the linux network stack. i.e."},{"line_number":154,"context_line":"int(src_ip) \u003c- in_port | 0x80000000 (\u003d in_port | int(128.0.0.0)."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"In effect, we use the in_port to identify the VM. The in_port is the OF-port"},{"line_number":157,"context_line":"of the port through which the VM made the request. Each port is treated"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dab17558_72c5f13b","line":154,"range":{"start_line":154,"start_character":63,"end_line":154,"end_character":64},"in_reply_to":"dab17558_ef21469f","updated":"2016-05-13 10:47:20.000000000","message":"Done","commit_id":"cedb45568e692bb2469589869ebb568a1112559a"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"d9b10c14c2ca31009e34505995b0af9a77cbc4c2","unresolved":false,"context_lines":[{"line_number":171,"context_line":"the tap-metadata interface only."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Since the output device is selected firstly by the routing table, and the"},{"line_number":174,"context_line":"tap-metadata interface will not appear in the main routing table, only packets"},{"line_number":175,"context_line":"explicitly sent via tap-metadata will be affected by the above ARP table"},{"line_number":176,"context_line":"tampering."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"The return flows are installed in the metadata service reply table. They detect"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dab17558_4f75f261","line":175,"range":{"start_line":174,"start_character":66,"end_line":175,"end_character":32},"updated":"2016-05-12 01:50:44.000000000","message":"how does the proxy send packets via tap-metadata?","commit_id":"cedb45568e692bb2469589869ebb568a1112559a"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"d06ccfd82c5b2cafcb75bb50d479d741d94d33b6","unresolved":false,"context_lines":[{"line_number":171,"context_line":"the tap-metadata interface only."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Since the output device is selected firstly by the routing table, and the"},{"line_number":174,"context_line":"tap-metadata interface will not appear in the main routing table, only packets"},{"line_number":175,"context_line":"explicitly sent via tap-metadata will be affected by the above ARP table"},{"line_number":176,"context_line":"tampering."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"The return flows are installed in the metadata service reply table. They detect"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dab17558_9595df41","line":175,"range":{"start_line":174,"start_character":66,"end_line":175,"end_character":32},"in_reply_to":"dab17558_4f75f261","updated":"2016-05-13 10:47:20.000000000","message":"The socket is on tap-metadata. The source IP is 169.254.169.254, which belongs to the tap-metadata socket.\n\nI\u0027ll add this info.","commit_id":"cedb45568e692bb2469589869ebb568a1112559a"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"5145ff03e98e6cdfa6f050ba24f69f59e1b2d694","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* X-Instance-ID-Signature: A cryptographic signature of the Instance-ID[1]"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* X-Tenant-ID: The UUID of the tenant"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"* X-Forwarded-For: The IP of the virtual instance"},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_9b10e54f","line":50,"range":{"start_line":50,"start_character":2,"end_line":50,"end_character":37},"updated":"2016-05-17 11:45:18.000000000","message":"This one is needed for the current implementation of the double proxy, I think we do not actually need it for our implementation calling the Nova Metadata directly","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"f91abe72e2eb174838056f0c8c21025cbf3e4074","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* X-Instance-ID-Signature: A cryptographic signature of the Instance-ID[1]"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* X-Tenant-ID: The UUID of the tenant"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"* X-Forwarded-For: The IP of the virtual instance"},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_ba515a64","line":50,"range":{"start_line":50,"start_character":2,"end_line":50,"end_character":37},"in_reply_to":"dab17558_84e99d81","updated":"2016-05-17 13:27:10.000000000","message":"Ok got it","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"f9fa4bac9541db4e7fc0873b6f91bc6eb300902f","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* X-Instance-ID-Signature: A cryptographic signature of the Instance-ID[1]"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* X-Tenant-ID: The UUID of the tenant"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"* X-Forwarded-For: The IP of the virtual instance"},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_84e99d81","line":50,"range":{"start_line":50,"start_character":2,"end_line":50,"end_character":37},"in_reply_to":"dab17558_9b10e54f","updated":"2016-05-17 12:58:48.000000000","message":"The code in _handle_instance_id_request (https://github.com/openstack/nova/blob/master/nova/api/metadata/handler.py) insists that this header will be sent.","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"5145ff03e98e6cdfa6f050ba24f69f59e1b2d694","unresolved":false,"context_lines":[{"line_number":106,"context_line":"service will use an ephemeral port. This is so to avoid collision with existing"},{"line_number":107,"context_line":"HTTP services on the host."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"VMs access the metadata service on IP 169.254.169.254, port 80. VMs are"},{"line_number":110,"context_line":"identified by their in_port. The Dragonflow metadata service retrieves the VM"},{"line_number":111,"context_line":"and tenant ID according to the in_port, and forwards it to the Nova metadata"},{"line_number":112,"context_line":"service."}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_3c1a8f7d","line":109,"range":{"start_line":109,"start_character":42,"end_line":109,"end_character":45},"updated":"2016-05-17 11:45:18.000000000","message":"we need to add ARP respond  for this address with could be a fake MAC","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"f9fa4bac9541db4e7fc0873b6f91bc6eb300902f","unresolved":false,"context_lines":[{"line_number":106,"context_line":"service will use an ephemeral port. This is so to avoid collision with existing"},{"line_number":107,"context_line":"HTTP services on the host."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"VMs access the metadata service on IP 169.254.169.254, port 80. VMs are"},{"line_number":110,"context_line":"identified by their in_port. The Dragonflow metadata service retrieves the VM"},{"line_number":111,"context_line":"and tenant ID according to the in_port, and forwards it to the Nova metadata"},{"line_number":112,"context_line":"service."}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_449a1515","line":109,"range":{"start_line":109,"start_character":42,"end_line":109,"end_character":45},"in_reply_to":"dab17558_3c1a8f7d","updated":"2016-05-17 12:58:48.000000000","message":"Done","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"5145ff03e98e6cdfa6f050ba24f69f59e1b2d694","unresolved":false,"context_lines":[{"line_number":106,"context_line":"service will use an ephemeral port. This is so to avoid collision with existing"},{"line_number":107,"context_line":"HTTP services on the host."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"VMs access the metadata service on IP 169.254.169.254, port 80. VMs are"},{"line_number":110,"context_line":"identified by their in_port. The Dragonflow metadata service retrieves the VM"},{"line_number":111,"context_line":"and tenant ID according to the in_port, and forwards it to the Nova metadata"},{"line_number":112,"context_line":"service."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"As part of this forwarding process, the metadata service adds to the HTTP"},{"line_number":115,"context_line":"request the HTTP headers described above."}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_411a0c7e","line":112,"range":{"start_line":109,"start_character":1,"end_line":112,"end_character":8},"updated":"2016-05-17 11:45:18.000000000","message":"Please add the proposed pipeline  match , actions and added tables","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"f9fa4bac9541db4e7fc0873b6f91bc6eb300902f","unresolved":false,"context_lines":[{"line_number":106,"context_line":"service will use an ephemeral port. This is so to avoid collision with existing"},{"line_number":107,"context_line":"HTTP services on the host."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"VMs access the metadata service on IP 169.254.169.254, port 80. VMs are"},{"line_number":110,"context_line":"identified by their in_port. The Dragonflow metadata service retrieves the VM"},{"line_number":111,"context_line":"and tenant ID according to the in_port, and forwards it to the Nova metadata"},{"line_number":112,"context_line":"service."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"As part of this forwarding process, the metadata service adds to the HTTP"},{"line_number":115,"context_line":"request the HTTP headers described above."}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_048dadd2","line":112,"range":{"start_line":109,"start_character":1,"end_line":112,"end_character":8},"in_reply_to":"dab17558_411a0c7e","updated":"2016-05-17 12:58:48.000000000","message":"Done","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"5145ff03e98e6cdfa6f050ba24f69f59e1b2d694","unresolved":false,"context_lines":[{"line_number":198,"context_line":"controller. The controller installs return flows, and then passes the packet"},{"line_number":199,"context_line":"in the same way as the original flow."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"The controller installs an ARP mapping from the modified IP address to the"},{"line_number":202,"context_line":"MAC address of the VM initiating the request. This mapping is installed on"},{"line_number":203,"context_line":"the tap-metadata interface only."},{"line_number":204,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_9cac5bee","line":201,"range":{"start_line":201,"start_character":27,"end_line":201,"end_character":39},"updated":"2016-05-17 11:45:18.000000000","message":"I think it will be best not to use the kernel ARP table directly via CLI. It is slow Control PATH and management nightmare.   \nIt will be best to use OpenFlow ARP Responder on the proposed MetaData Table","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"f9fa4bac9541db4e7fc0873b6f91bc6eb300902f","unresolved":false,"context_lines":[{"line_number":198,"context_line":"controller. The controller installs return flows, and then passes the packet"},{"line_number":199,"context_line":"in the same way as the original flow."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"The controller installs an ARP mapping from the modified IP address to the"},{"line_number":202,"context_line":"MAC address of the VM initiating the request. This mapping is installed on"},{"line_number":203,"context_line":"the tap-metadata interface only."},{"line_number":204,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_c4ad6532","line":201,"range":{"start_line":201,"start_character":27,"end_line":201,"end_character":39},"in_reply_to":"dab17558_9cac5bee","updated":"2016-05-17 12:58:48.000000000","message":"Done","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":6854,"name":"YAMAMOTO Takashi","email":"yamamoto@midokura.com","username":"yamamoto"},"change_message_id":"855065be020f97d375acc4c19ea37642a71d87bf","unresolved":false,"context_lines":[{"line_number":209,"context_line":""},{"line_number":210,"context_line":"In other words, any packet sent from the compute node will be routed normally."},{"line_number":211,"context_line":"Packets sent in reply from the metadata service to the VM will be sent via the"},{"line_number":212,"context_line":"tap-metadata interface (since that\u0027s the interface bound to the socket), and"},{"line_number":213,"context_line":"these packets will be routed back to the VM via OVS."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"The return flows are installed in the metadata service reply table. They detect"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_15c6c699","line":212,"range":{"start_line":212,"start_character":37,"end_line":212,"end_character":70},"updated":"2016-05-16 09:58:13.000000000","message":"do you mean just bind(2) and the above \"oif\" rule matches with everything sends from the socket?","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"8cc756e529cb86a3ff55cb45ef412be5f8ab5642","unresolved":false,"context_lines":[{"line_number":209,"context_line":""},{"line_number":210,"context_line":"In other words, any packet sent from the compute node will be routed normally."},{"line_number":211,"context_line":"Packets sent in reply from the metadata service to the VM will be sent via the"},{"line_number":212,"context_line":"tap-metadata interface (since that\u0027s the interface bound to the socket), and"},{"line_number":213,"context_line":"these packets will be routed back to the VM via OVS."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"The return flows are installed in the metadata service reply table. They detect"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dab17558_71475dbc","line":212,"range":{"start_line":212,"start_character":37,"end_line":212,"end_character":70},"in_reply_to":"dab17558_15c6c699","updated":"2016-05-16 12:36:41.000000000","message":"Yes.","commit_id":"c2b21740889be73f472b69ac6e43e0e80f86b4da"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"af602fa78ac6edfb1c32092e2621acbde5d640f4","unresolved":false,"context_lines":[{"line_number":253,"context_line":""},{"line_number":254,"context_line":"::"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"    match\u003din_port:I action\u003dresubmit(, METADATA_SERVICE_REPLY_TABLE)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"Additionally, when the controller receives a SYN packet, it adds a return flow"},{"line_number":259,"context_line":"to METADATA_SERVICE_REPLY_TABLE. Given the VMs IP is X and OFPort is I\u0027,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bab6814e_4e99526e","line":256,"range":{"start_line":256,"start_character":27,"end_line":256,"end_character":35},"updated":"2016-05-18 13:11:25.000000000","message":"why resubmit and not goto ?","commit_id":"8bfc22dab6a0827e0c4ba29aaab784f616c7fec0"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"bdb45f3f8b7ed33cf5eeb2c09c393953da989b73","unresolved":false,"context_lines":[{"line_number":253,"context_line":""},{"line_number":254,"context_line":"::"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"    match\u003din_port:I action\u003dresubmit(, METADATA_SERVICE_REPLY_TABLE)"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"Additionally, when the controller receives a SYN packet, it adds a return flow"},{"line_number":259,"context_line":"to METADATA_SERVICE_REPLY_TABLE. Given the VMs IP is X and OFPort is I\u0027,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bab6814e_6f7251e7","line":256,"range":{"start_line":256,"start_character":27,"end_line":256,"end_character":35},"in_reply_to":"bab6814e_4e99526e","updated":"2016-05-18 13:40:49.000000000","message":"That\u0027s how it appears in ovs-ofctl dump-flows. The actual code uses OFPInstructionGotoTable (Which is goto).","commit_id":"8bfc22dab6a0827e0c4ba29aaab784f616c7fec0"}]}