)]}'
{"doc/source/specs/service_function_chaining.rst":[{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"bb0ae4b02a29b15f6298b3f5b5f0a5004f7a9201","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Service Function Chaining"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/dragonflow/+spec/service-function-chaining"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_4718031e","line":9,"range":{"start_line":7,"start_character":0,"end_line":9,"end_character":42},"updated":"2016-11-08 11:26:05.000000000","message":"Pls notice the format, see this patch \n\nhttps://review.openstack.org/#/c/394305/","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"1f6d7320b35bdc7a2e15a86f24fd78ab629348ba","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Service Function Chaining"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/dragonflow/+spec/service-function-chaining"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_62bc156d","line":9,"range":{"start_line":7,"start_character":0,"end_line":9,"end_character":42},"in_reply_to":"9a629dbe_4718031e","updated":"2016-11-08 12:39:57.000000000","message":"Done","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"bb0ae4b02a29b15f6298b3f5b5f0a5004f7a9201","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Service function deployment in a network that supports only destination based"},{"line_number":17,"context_line":"routing can be very time consuming. It requires sophisticated topologies that"},{"line_number":18,"context_line":"have to be mainatined manually outside of the tools offered by neutron."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Recently networking-sfc proposed a change in the API to allow definition of"},{"line_number":21,"context_line":"service function chains and policy based routing (flow classifiers), based"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_67ba67e3","line":18,"range":{"start_line":18,"start_character":11,"end_line":18,"end_character":21},"updated":"2016-11-08 11:26:05.000000000","message":"maitained","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"1f6d7320b35bdc7a2e15a86f24fd78ab629348ba","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Service function deployment in a network that supports only destination based"},{"line_number":17,"context_line":"routing can be very time consuming. It requires sophisticated topologies that"},{"line_number":18,"context_line":"have to be mainatined manually outside of the tools offered by neutron."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Recently networking-sfc proposed a change in the API to allow definition of"},{"line_number":21,"context_line":"service function chains and policy based routing (flow classifiers), based"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_82c129e7","line":18,"range":{"start_line":18,"start_character":11,"end_line":18,"end_character":21},"in_reply_to":"9a629dbe_67ba67e3","updated":"2016-11-08 12:39:57.000000000","message":"Done","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"bb0ae4b02a29b15f6298b3f5b5f0a5004f7a9201","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"::"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"                                         +----------+"},{"line_number":33,"context_line":"                                 Match   | Service  |"},{"line_number":34,"context_line":"                                    +----\u003e function +----+   +-------+"},{"line_number":35,"context_line":" +--------+       +------------+    |    | chain    |    +---\u003e Dest. |"},{"line_number":36,"context_line":" | Source |       | Flow       +----+    +----------+    +---\u003e port  |"},{"line_number":37,"context_line":" | port   +-------\u003e classifier +----+                    |   +-------+"},{"line_number":38,"context_line":" +--------+       +------------+    | No match           |"},{"line_number":39,"context_line":"                                    +--------------------+"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_8794db37","line":39,"range":{"start_line":32,"start_character":0,"end_line":39,"end_character":58},"updated":"2016-11-08 11:26:05.000000000","message":"Pls notice the format, see this patch","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"1f6d7320b35bdc7a2e15a86f24fd78ab629348ba","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"::"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"                                         +----------+"},{"line_number":33,"context_line":"                                 Match   | Service  |"},{"line_number":34,"context_line":"                                    +----\u003e function +----+   +-------+"},{"line_number":35,"context_line":" +--------+       +------------+    |    | chain    |    +---\u003e Dest. |"},{"line_number":36,"context_line":" | Source |       | Flow       +----+    +----------+    +---\u003e port  |"},{"line_number":37,"context_line":" | port   +-------\u003e classifier +----+                    |   +-------+"},{"line_number":38,"context_line":" +--------+       +------------+    | No match           |"},{"line_number":39,"context_line":"                                    +--------------------+"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_0287d9b5","line":39,"range":{"start_line":32,"start_character":0,"end_line":39,"end_character":58},"in_reply_to":"9a629dbe_8794db37","updated":"2016-11-08 12:39:57.000000000","message":"Can you please explain the format issue?","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"bb0ae4b02a29b15f6298b3f5b5f0a5004f7a9201","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"#. Incoming from local SFs - which we\u0027ll check (see security concerns), we\u0027ll"},{"line_number":75,"context_line":"   match this traffic with in_port and NSH header, then push the correct"},{"line_number":76,"context_line":"   metadata and port key, and forward to NSH egress checks table, and then to "},{"line_number":77,"context_line":"   the NSG routing table."},{"line_number":78,"context_line":"#. Incoming from remote contollers -  which will be matched using network type,"},{"line_number":79,"context_line":"   segment id, and NSH header, then forward to the NSH routing table"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_4249d15e","line":76,"range":{"start_line":76,"start_character":77,"end_line":76,"end_character":78},"updated":"2016-11-08 11:26:05.000000000","message":"extra space","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"1f6d7320b35bdc7a2e15a86f24fd78ab629348ba","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"#. Incoming from local SFs - which we\u0027ll check (see security concerns), we\u0027ll"},{"line_number":75,"context_line":"   match this traffic with in_port and NSH header, then push the correct"},{"line_number":76,"context_line":"   metadata and port key, and forward to NSH egress checks table, and then to "},{"line_number":77,"context_line":"   the NSG routing table."},{"line_number":78,"context_line":"#. Incoming from remote contollers -  which will be matched using network type,"},{"line_number":79,"context_line":"   segment id, and NSH header, then forward to the NSH routing table"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_a2b62d88","line":76,"range":{"start_line":76,"start_character":77,"end_line":76,"end_character":78},"in_reply_to":"9a629dbe_4249d15e","updated":"2016-11-08 12:39:57.000000000","message":"Done","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"bb0ae4b02a29b15f6298b3f5b5f0a5004f7a9201","unresolved":false,"context_lines":[{"line_number":157,"context_line":""},{"line_number":158,"context_line":".. code-block:: json"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":" {"},{"line_number":161,"context_line":"     \"id\": \"ID of port pair group\","},{"line_number":162,"context_line":"     \"port_pairs\": ["},{"line_number":163,"context_line":"         {"},{"line_number":164,"context_line":"             \"ingress_port_id\": \"ID of the ingress port for SF\","},{"line_number":165,"context_line":"             \"egress_port_id\": \"ID on the egress port for SF\","},{"line_number":166,"context_line":"             \"sfc_proto\": \"NSH/none\","},{"line_number":167,"context_line":"             \"weight\": \"Weight of the port pair for LB purposes\""},{"line_number":168,"context_line":"         },"},{"line_number":169,"context_line":"         \"Zero or more port pairs\""},{"line_number":170,"context_line":"     ]"},{"line_number":171,"context_line":" }"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Service function chains:"},{"line_number":174,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_e2c4a593","line":171,"range":{"start_line":160,"start_character":0,"end_line":171,"end_character":2},"updated":"2016-11-08 11:26:05.000000000","message":"Can the port pair group object just inside SFC? So that we can have less table in nb db.","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"1f6d7320b35bdc7a2e15a86f24fd78ab629348ba","unresolved":false,"context_lines":[{"line_number":157,"context_line":""},{"line_number":158,"context_line":".. code-block:: json"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":" {"},{"line_number":161,"context_line":"     \"id\": \"ID of port pair group\","},{"line_number":162,"context_line":"     \"port_pairs\": ["},{"line_number":163,"context_line":"         {"},{"line_number":164,"context_line":"             \"ingress_port_id\": \"ID of the ingress port for SF\","},{"line_number":165,"context_line":"             \"egress_port_id\": \"ID on the egress port for SF\","},{"line_number":166,"context_line":"             \"sfc_proto\": \"NSH/none\","},{"line_number":167,"context_line":"             \"weight\": \"Weight of the port pair for LB purposes\""},{"line_number":168,"context_line":"         },"},{"line_number":169,"context_line":"         \"Zero or more port pairs\""},{"line_number":170,"context_line":"     ]"},{"line_number":171,"context_line":" }"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Service function chains:"},{"line_number":174,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_e25e6544","line":171,"range":{"start_line":160,"start_character":0,"end_line":171,"end_character":2},"in_reply_to":"9a629dbe_e2c4a593","updated":"2016-11-08 12:39:57.000000000","message":"According to networking-sfc data model, SFC and port pair group are not in one-to-many relationship, but are rather in many-to-many.\n\nhttp://docs.openstack.org/developer/networking-sfc/api.html#data-model-impact","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"bb0ae4b02a29b15f6298b3f5b5f0a5004f7a9201","unresolved":false,"context_lines":[{"line_number":273,"context_line":""},{"line_number":274,"context_line":"Work Items"},{"line_number":275,"context_line":"----------"},{"line_number":276,"context_line":"#. Make sure openvswitch NSH patches [6] get merged"},{"line_number":277,"context_line":"#. Implement MechDriver changes to accept the callbacks from networking-sfc"},{"line_number":278,"context_line":"   and the relevant parts of north-bound API."},{"line_number":279,"context_line":"#. Implement the dragonflow controller app that manages the flows based on the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_82520912","line":276,"range":{"start_line":276,"start_character":2,"end_line":276,"end_character":42},"updated":"2016-11-08 11:26:05.000000000","message":"Why not use MPLS just like networking-sfc doing in ovs-agent? if the nsh is still in-progress in ovs","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"1f6d7320b35bdc7a2e15a86f24fd78ab629348ba","unresolved":false,"context_lines":[{"line_number":273,"context_line":""},{"line_number":274,"context_line":"Work Items"},{"line_number":275,"context_line":"----------"},{"line_number":276,"context_line":"#. Make sure openvswitch NSH patches [6] get merged"},{"line_number":277,"context_line":"#. Implement MechDriver changes to accept the callbacks from networking-sfc"},{"line_number":278,"context_line":"   and the relevant parts of north-bound API."},{"line_number":279,"context_line":"#. Implement the dragonflow controller app that manages the flows based on the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_f36ab519","line":276,"range":{"start_line":276,"start_character":2,"end_line":276,"end_character":42},"in_reply_to":"9a629dbe_82520912","updated":"2016-11-08 12:39:57.000000000","message":"NSH is much more flexible, both encapsulation-wise and overlay topology-wise, and there is significant work being done in networking-sfc to add NSH support.\n\nWe can support MPLS service functions by adding a proxy that will act as NSH/MPLS adapter.","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":11159,"name":"Hong Hui Xiao","email":"honghui_xiao@yeah.net","username":"HongHuiXiao"},"change_message_id":"bb0ae4b02a29b15f6298b3f5b5f0a5004f7a9201","unresolved":false,"context_lines":[{"line_number":274,"context_line":"Work Items"},{"line_number":275,"context_line":"----------"},{"line_number":276,"context_line":"#. Make sure openvswitch NSH patches [6] get merged"},{"line_number":277,"context_line":"#. Implement MechDriver changes to accept the callbacks from networking-sfc"},{"line_number":278,"context_line":"   and the relevant parts of north-bound API."},{"line_number":279,"context_line":"#. Implement the dragonflow controller app that manages the flows based on the"},{"line_number":280,"context_line":"   SFCs relevant to the controller."},{"line_number":281,"context_line":"#. Implement SFC \"port security\" mechanism."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_87c13be7","line":278,"range":{"start_line":277,"start_character":0,"end_line":278,"end_character":45},"updated":"2016-11-08 11:26:05.000000000","message":"I thought sfc has their own service plugin instead of using ml2 mech driver.","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"1f6d7320b35bdc7a2e15a86f24fd78ab629348ba","unresolved":false,"context_lines":[{"line_number":274,"context_line":"Work Items"},{"line_number":275,"context_line":"----------"},{"line_number":276,"context_line":"#. Make sure openvswitch NSH patches [6] get merged"},{"line_number":277,"context_line":"#. Implement MechDriver changes to accept the callbacks from networking-sfc"},{"line_number":278,"context_line":"   and the relevant parts of north-bound API."},{"line_number":279,"context_line":"#. Implement the dragonflow controller app that manages the flows based on the"},{"line_number":280,"context_line":"   SFCs relevant to the controller."},{"line_number":281,"context_line":"#. Implement SFC \"port security\" mechanism."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_538fe122","line":278,"range":{"start_line":277,"start_character":0,"end_line":278,"end_character":45},"in_reply_to":"9a629dbe_87c13be7","updated":"2016-11-08 12:39:57.000000000","message":"You\u0027re right, will change that","commit_id":"1d76f75eb78def05613877927d1a300822b7ce2a"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"540b47399cfd0d28511cc16bbb38c79f45402037","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Problem Description"},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Service function deployment in a network that supports only destination based"},{"line_number":17,"context_line":"routing can be very time consuming. It requires sophisticated topologies that"},{"line_number":18,"context_line":"have to be maintained manually outside of the tools offered by neutron."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Recently networking-sfc proposed a change in the API to allow definition of"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_9864084a","line":17,"range":{"start_line":16,"start_character":60,"end_line":17,"end_character":33},"updated":"2016-11-09 09:18:51.000000000","message":"Could you please explain for it? why is it time consuming?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Problem Description"},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Service function deployment in a network that supports only destination based"},{"line_number":17,"context_line":"routing can be very time consuming. It requires sophisticated topologies that"},{"line_number":18,"context_line":"have to be maintained manually outside of the tools offered by neutron."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Recently networking-sfc proposed a change in the API to allow definition of"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_a25c32ee","line":17,"range":{"start_line":16,"start_character":60,"end_line":17,"end_character":33},"in_reply_to":"9a629dbe_9864084a","updated":"2016-11-09 13:32:51.000000000","message":"Basically if we want to insert a service between A and B and our network id dest based forwarding, we have to make sure our SF is located between A and B, s.t. if SF has 2 ports and acts as the gateway between A\u0027s network segment and B\u0027s network segment.\n\nRFC7498 describes this and several other issues SFC architecture helps to solve.\n\nhttps://tools.ietf.org/html/rfc7498","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_3aaa1471","line":43,"range":{"start_line":43,"start_character":35,"end_line":43,"end_character":42},"updated":"2016-11-09 08:15:31.000000000","message":"Any reasons why NSH is the chosen approach?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"ba0cf2ce3c2b711df9f83eb2e552fe699a1ffb7e","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_a4b52fef","line":43,"range":{"start_line":43,"start_character":35,"end_line":43,"end_character":58},"updated":"2016-11-09 06:04:24.000000000","message":"Does OVS support NSH currently? If it is just in a unstable status, please give some information in this spec about the time when it is stable. If so, I also suggest you mark this spec as Experimental function of dragonflow.","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"540b47399cfd0d28511cc16bbb38c79f45402037","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_38313c06","line":43,"range":{"start_line":43,"start_character":23,"end_line":43,"end_character":31},"updated":"2016-11-09 09:18:51.000000000","message":"advantage","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_e7d9dc84","line":43,"range":{"start_line":43,"start_character":35,"end_line":43,"end_character":42},"in_reply_to":"9a629dbe_3aaa1471","updated":"2016-11-09 13:32:51.000000000","message":"@Li Ma. Upstream OVS does not support NSH at the moment, and IETF hasn\u0027t finished drafting NSH yet, but OVS patches exist and networking-sfc are working on adding NSH support as well.","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_36ef8388","line":43,"range":{"start_line":43,"start_character":35,"end_line":43,"end_character":58},"in_reply_to":"9a629dbe_933b0b9c","updated":"2016-11-09 13:32:51.000000000","message":"@hujie, @irena.\n\nnetworking-sfc initially implemented port-pair chains using MPLS - flow classifier to pushes all the labels describing the SFs packet has to traverse through then sends it to the first node.\n\nSFC architecture supports not just linear paths, a service function can re-classify the packet and make it another route inside the service overlay network. This basically means that a packet traverses a graph along some some route that can branch.\n\nWith NSH we need much less information to reclassify, only what is the path identifier of the branch taken.\n\nWith MPLS we also need to know what are the tags of the service functions along the path, and keep them up to date in case a new service is inserted or an old one is retired.\n\nWith the proposition of graph API by networking-sfc, I think NSH is a more suitable technology to implement service function chaining.","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"540b47399cfd0d28511cc16bbb38c79f45402037","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_933b0b9c","line":43,"range":{"start_line":43,"start_character":35,"end_line":43,"end_character":58},"in_reply_to":"9a629dbe_a4b52fef","updated":"2016-11-09 09:18:51.000000000","message":"+1, and are there any other standard protocol for SFC? what\u0027s the advantage of NSH?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"2c430cf94238750995571413689e73946e1ebcef","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_4a1608a8","line":43,"range":{"start_line":43,"start_character":35,"end_line":43,"end_character":42},"in_reply_to":"9a629dbe_e7d9dc84","updated":"2016-11-09 14:33:55.000000000","message":"This may limit the number of the deployment environments that would be willing to use SFC funtionality","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"},{"line_number":47,"context_line":"for routing the SFC related traffic inside the pipeline and between the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_fa6edc94","line":44,"range":{"start_line":43,"start_character":62,"end_line":44,"end_character":8},"updated":"2016-11-09 08:15:31.000000000","message":"There are also cases for L2 insertions (sort of bump in the wire). Would the current spec allow such cases as well?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"2c430cf94238750995571413689e73946e1ebcef","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"},{"line_number":47,"context_line":"for routing the SFC related traffic inside the pipeline and between the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_ca9f784e","line":44,"range":{"start_line":43,"start_character":62,"end_line":44,"end_character":8},"in_reply_to":"9a629dbe_8eba02bf","updated":"2016-11-09 14:33:55.000000000","message":"Do we need NSH is such case? I think this can be achieved with VLAN","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"},{"line_number":47,"context_line":"for routing the SFC related traffic inside the pipeline and between the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_8eba02bf","line":44,"range":{"start_line":43,"start_character":62,"end_line":44,"end_character":8},"in_reply_to":"9a629dbe_fa6edc94","updated":"2016-11-09 13:32:51.000000000","message":"Yes, we can create a chain whose source is, for example, a VM port, and create a classifier that allows all traffic through.\nThis way all VMs L2 traffic on the port will go through our chain.","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"},{"line_number":47,"context_line":"for routing the SFC related traffic inside the pipeline and between the"},{"line_number":48,"context_line":"controllers, its primary tasks will be:"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_5a2d0845","line":46,"range":{"start_line":46,"start_character":48,"end_line":46,"end_character":63},"updated":"2016-11-09 08:15:31.000000000","message":"DF application running at each compute node?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":43,"context_line":"database and will take advantge of NSH [3] and openvswitch to implement the"},{"line_number":44,"context_line":"routing."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new DF application responsible"},{"line_number":47,"context_line":"for routing the SFC related traffic inside the pipeline and between the"},{"line_number":48,"context_line":"controllers, its primary tasks will be:"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_f8142445","line":46,"range":{"start_line":46,"start_character":48,"end_line":46,"end_character":63},"in_reply_to":"9a629dbe_5a2d0845","updated":"2016-11-09 13:32:51.000000000","message":"yes, will make it more clear","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":47,"context_line":"for routing the SFC related traffic inside the pipeline and between the"},{"line_number":48,"context_line":"controllers, its primary tasks will be:"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"+ Routing traffic from source ports into the SFC pipeline."},{"line_number":51,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":52,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":53,"context_line":"  that maps to a correct service function chain, and popping the NSH header"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_faca5c6d","line":50,"range":{"start_line":50,"start_character":1,"end_line":50,"end_character":9},"updated":"2016-11-09 08:15:31.000000000","message":"Routing is a bit overloaded term here. Do you just mean addition of the SFC pipeline?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":47,"context_line":"for routing the SFC related traffic inside the pipeline and between the"},{"line_number":48,"context_line":"controllers, its primary tasks will be:"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"+ Routing traffic from source ports into the SFC pipeline."},{"line_number":51,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":52,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":53,"context_line":"  that maps to a correct service function chain, and popping the NSH header"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_c7a4d8a7","line":50,"range":{"start_line":50,"start_character":1,"end_line":50,"end_character":9},"in_reply_to":"9a629dbe_b3de4f3d","updated":"2016-11-09 13:32:51.000000000","message":"I agree this is a better wording","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"540b47399cfd0d28511cc16bbb38c79f45402037","unresolved":false,"context_lines":[{"line_number":47,"context_line":"for routing the SFC related traffic inside the pipeline and between the"},{"line_number":48,"context_line":"controllers, its primary tasks will be:"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"+ Routing traffic from source ports into the SFC pipeline."},{"line_number":51,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":52,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":53,"context_line":"  that maps to a correct service function chain, and popping the NSH header"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_b3de4f3d","line":50,"range":{"start_line":50,"start_character":1,"end_line":50,"end_character":9},"in_reply_to":"9a629dbe_faca5c6d","updated":"2016-11-09 09:18:51.000000000","message":"@Irena, here mean classify the corresponding flow into the SFC pipeline, not just a addition for SFC pipeline.","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"540b47399cfd0d28511cc16bbb38c79f45402037","unresolved":false,"context_lines":[{"line_number":51,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":52,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":53,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":54,"context_line":"  once packet reaches the end of the chain."},{"line_number":55,"context_line":"+ Routing traffic between SFs both locally and between controllers."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_f37d271d","line":54,"range":{"start_line":54,"start_character":14,"end_line":54,"end_character":43},"updated":"2016-11-09 09:18:51.000000000","message":"just pop at the end of chain? Will the NSH header be changed in the middle of the pipeline??","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":51,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":52,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":53,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":54,"context_line":"  once packet reaches the end of the chain."},{"line_number":55,"context_line":"+ Routing traffic between SFs both locally and between controllers."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_e7e39c03","line":54,"range":{"start_line":54,"start_character":14,"end_line":54,"end_character":43},"in_reply_to":"9a629dbe_f37d271d","updated":"2016-11-09 13:32:51.000000000","message":"Each NSH-aware service function is responsible for the decrementing of SI field (or the proxy in case of NSH-unaware service) and manipulating the metadata. The initial classification occurs in at the point of adding the NSH header, and further re-classification is done by the service function (although current port-chain model of networking-sfc does not presume re-classification other that through graph model).","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":54,"context_line":"  once packet reaches the end of the chain."},{"line_number":55,"context_line":"+ Routing traffic between SFs both locally and between controllers."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"::"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"                                            +---+"},{"line_number":60,"context_line":"               +----------------------+ +---\u003eSF1|"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_9a832004","line":57,"updated":"2016-11-09 08:15:31.000000000","message":"Please add description to the diagram","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":54,"context_line":"  once packet reaches the end of the chain."},{"line_number":55,"context_line":"+ Routing traffic between SFs both locally and between controllers."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"::"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"                                            +---+"},{"line_number":60,"context_line":"               +----------------------+ +---\u003eSF1|"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_0e7432cd","line":57,"in_reply_to":"9a629dbe_9a832004","updated":"2016-11-09 13:32:51.000000000","message":"Done","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"We will have to handle 2 types of NSH traffic:"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"#. Incoming from local SFs - which we\u0027ll check (see security concerns), we\u0027ll"},{"line_number":75,"context_line":"   match this traffic with in_port and NSH header, then push the correct"},{"line_number":76,"context_line":"   metadata and port key, and forward to NSH egress checks table, and then to"},{"line_number":77,"context_line":"   the NSG routing table."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_7a7d6ce6","line":74,"range":{"start_line":74,"start_character":34,"end_line":74,"end_character":37},"updated":"2016-11-09 08:15:31.000000000","message":"we \u003d\u003d Local Controller?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"We will have to handle 2 types of NSH traffic:"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"#. Incoming from local SFs - which we\u0027ll check (see security concerns), we\u0027ll"},{"line_number":75,"context_line":"   match this traffic with in_port and NSH header, then push the correct"},{"line_number":76,"context_line":"   metadata and port key, and forward to NSH egress checks table, and then to"},{"line_number":77,"context_line":"   the NSG routing table."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_13fffb34","line":74,"range":{"start_line":74,"start_character":34,"end_line":74,"end_character":37},"in_reply_to":"9a629dbe_7a7d6ce6","updated":"2016-11-09 13:32:51.000000000","message":"yes, changing","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"540b47399cfd0d28511cc16bbb38c79f45402037","unresolved":false,"context_lines":[{"line_number":74,"context_line":"#. Incoming from local SFs - which we\u0027ll check (see security concerns), we\u0027ll"},{"line_number":75,"context_line":"   match this traffic with in_port and NSH header, then push the correct"},{"line_number":76,"context_line":"   metadata and port key, and forward to NSH egress checks table, and then to"},{"line_number":77,"context_line":"   the NSG routing table."},{"line_number":78,"context_line":"#. Incoming from remote contollers -  which will be matched using network type,"},{"line_number":79,"context_line":"   segment id, and NSH header, then forward to the NSH routing table"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_13f53b82","line":77,"range":{"start_line":77,"start_character":7,"end_line":77,"end_character":10},"updated":"2016-11-09 09:18:51.000000000","message":"NSH","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":22060,"name":"jingting","email":"kangjingting@huawei.com","username":"jingting"},"change_message_id":"98fca71143c2e23198437edb15ecc91182133102","unresolved":false,"context_lines":[{"line_number":74,"context_line":"#. Incoming from local SFs - which we\u0027ll check (see security concerns), we\u0027ll"},{"line_number":75,"context_line":"   match this traffic with in_port and NSH header, then push the correct"},{"line_number":76,"context_line":"   metadata and port key, and forward to NSH egress checks table, and then to"},{"line_number":77,"context_line":"   the NSG routing table."},{"line_number":78,"context_line":"#. Incoming from remote contollers -  which will be matched using network type,"},{"line_number":79,"context_line":"   segment id, and NSH header, then forward to the NSH routing table"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_f8b18490","line":77,"range":{"start_line":77,"start_character":7,"end_line":77,"end_character":10},"updated":"2016-11-09 09:09:52.000000000","message":"NSH","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":74,"context_line":"#. Incoming from local SFs - which we\u0027ll check (see security concerns), we\u0027ll"},{"line_number":75,"context_line":"   match this traffic with in_port and NSH header, then push the correct"},{"line_number":76,"context_line":"   metadata and port key, and forward to NSH egress checks table, and then to"},{"line_number":77,"context_line":"   the NSG routing table."},{"line_number":78,"context_line":"#. Incoming from remote contollers -  which will be matched using network type,"},{"line_number":79,"context_line":"   segment id, and NSH header, then forward to the NSH routing table"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_ce0dda38","line":77,"range":{"start_line":77,"start_character":7,"end_line":77,"end_character":10},"in_reply_to":"9a629dbe_f8b18490","updated":"2016-11-09 13:32:51.000000000","message":"Done","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"For each service function local to the controller, we\u0027ll create an entry in the"},{"line_number":82,"context_line":"NSH routing table, that will forward all packets with the appropriate SPI, SI"},{"line_number":83,"context_line":"to the SF ingress port. If there SF has more than one instance we can load"},{"line_number":84,"context_line":"balance between them with select type group actions."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"The app is also responsible for terminating NSH encapsulation once we complete"},{"line_number":87,"context_line":"the last element of the service function chain, and will forward the packet to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_3a4bf4b1","line":84,"range":{"start_line":83,"start_character":70,"end_line":84,"end_character":7},"updated":"2016-11-09 08:15:31.000000000","message":"Round Robin?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"540b47399cfd0d28511cc16bbb38c79f45402037","unresolved":false,"context_lines":[{"line_number":81,"context_line":"For each service function local to the controller, we\u0027ll create an entry in the"},{"line_number":82,"context_line":"NSH routing table, that will forward all packets with the appropriate SPI, SI"},{"line_number":83,"context_line":"to the SF ingress port. If there SF has more than one instance we can load"},{"line_number":84,"context_line":"balance between them with select type group actions."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"The app is also responsible for terminating NSH encapsulation once we complete"},{"line_number":87,"context_line":"the last element of the service function chain, and will forward the packet to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_33223f01","line":84,"range":{"start_line":84,"start_character":26,"end_line":84,"end_character":52},"updated":"2016-11-09 09:18:51.000000000","message":"when you use the group to implement LB, please consider local and remote next hop service function node.","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":81,"context_line":"For each service function local to the controller, we\u0027ll create an entry in the"},{"line_number":82,"context_line":"NSH routing table, that will forward all packets with the appropriate SPI, SI"},{"line_number":83,"context_line":"to the SF ingress port. If there SF has more than one instance we can load"},{"line_number":84,"context_line":"balance between them with select type group actions."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"The app is also responsible for terminating NSH encapsulation once we complete"},{"line_number":87,"context_line":"the last element of the service function chain, and will forward the packet to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_bc2617cc","line":84,"range":{"start_line":84,"start_character":26,"end_line":84,"end_character":52},"in_reply_to":"9a629dbe_33223f01","updated":"2016-11-09 13:32:51.000000000","message":"Yes I\u0027ve given it some thought. This can create a scenario where packets are traveling back and forth needlessly or perform more hops between the controllers than they have to.\n\nThe optimal path is not hard to figure out (can be modeled as min-cost flow), but it does not ensure equal load distribution.","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"For each service function local to the controller, we\u0027ll create an entry in the"},{"line_number":82,"context_line":"NSH routing table, that will forward all packets with the appropriate SPI, SI"},{"line_number":83,"context_line":"to the SF ingress port. If there SF has more than one instance we can load"},{"line_number":84,"context_line":"balance between them with select type group actions."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"The app is also responsible for terminating NSH encapsulation once we complete"},{"line_number":87,"context_line":"the last element of the service function chain, and will forward the packet to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_5dbd0267","line":84,"range":{"start_line":83,"start_character":70,"end_line":84,"end_character":7},"in_reply_to":"9a629dbe_3a4bf4b1","updated":"2016-11-09 13:32:51.000000000","message":"yes, we can do weighted RR with OVS","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"SPI allocation will take place in the Neutron side, and to avoid conflict"},{"line_number":117,"context_line":"between allocated IDs we should use the same method we use for port tunnel"},{"line_number":118,"context_line":"keys, by allocating unique IDs through our database driver."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"We should also reserve a certain range for locally managed SFCs, see Benefits"},{"line_number":121,"context_line":"to DragonFlow section for more details."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_7ac00ce1","line":118,"range":{"start_line":118,"start_character":20,"end_line":118,"end_character":30},"updated":"2016-11-09 08:15:31.000000000","message":"Should SPI be globally unique?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"SPI allocation will take place in the Neutron side, and to avoid conflict"},{"line_number":117,"context_line":"between allocated IDs we should use the same method we use for port tunnel"},{"line_number":118,"context_line":"keys, by allocating unique IDs through our database driver."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"We should also reserve a certain range for locally managed SFCs, see Benefits"},{"line_number":121,"context_line":"to DragonFlow section for more details."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_b8846cd4","line":118,"range":{"start_line":118,"start_character":20,"end_line":118,"end_character":30},"in_reply_to":"9a629dbe_7ac00ce1","updated":"2016-11-09 13:32:51.000000000","message":"I think they should be unique, because SFCs can span several controllers (e.g. https://tools.ietf.org/html/rfc7665#page-24 Figure 5). \n\nWhen we receive an NSH packet from another controller we\u0027ll have to forward it to a local service function according to SPI/SI tuple. It is easier if SPI/SI are globally agreed upon.","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":124,"context_line":"---------------------------------------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"In a recent patch, networking-sfc proposed addition of SFC graphs to implement"},{"line_number":127,"context_line":"service function chaings that support re-classification (see bug [4] and"},{"line_number":128,"context_line":"patch [5]). The graph stiches together pairs of SFCs, dest-to-source, to mark"},{"line_number":129,"context_line":"that transition from one SFC to the other is possible."},{"line_number":130,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_faac1c37","line":127,"range":{"start_line":127,"start_character":16,"end_line":127,"end_character":24},"updated":"2016-11-09 08:15:31.000000000","message":"typo: chains","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":124,"context_line":"---------------------------------------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"In a recent patch, networking-sfc proposed addition of SFC graphs to implement"},{"line_number":127,"context_line":"service function chaings that support re-classification (see bug [4] and"},{"line_number":128,"context_line":"patch [5]). The graph stiches together pairs of SFCs, dest-to-source, to mark"},{"line_number":129,"context_line":"that transition from one SFC to the other is possible."},{"line_number":130,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_d87120e2","line":127,"range":{"start_line":127,"start_character":16,"end_line":127,"end_character":24},"in_reply_to":"9a629dbe_faac1c37","updated":"2016-11-09 13:32:51.000000000","message":"Thanks","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":22060,"name":"jingting","email":"kangjingting@huawei.com","username":"jingting"},"change_message_id":"98fca71143c2e23198437edb15ecc91182133102","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"In a recent patch, networking-sfc proposed addition of SFC graphs to implement"},{"line_number":127,"context_line":"service function chaings that support re-classification (see bug [4] and"},{"line_number":128,"context_line":"patch [5]). The graph stiches together pairs of SFCs, dest-to-source, to mark"},{"line_number":129,"context_line":"that transition from one SFC to the other is possible."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_734e7770","line":128,"range":{"start_line":128,"start_character":22,"end_line":128,"end_character":29},"updated":"2016-11-09 09:09:52.000000000","message":"stitch?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"In a recent patch, networking-sfc proposed addition of SFC graphs to implement"},{"line_number":127,"context_line":"service function chaings that support re-classification (see bug [4] and"},{"line_number":128,"context_line":"patch [5]). The graph stiches together pairs of SFCs, dest-to-source, to mark"},{"line_number":129,"context_line":"that transition from one SFC to the other is possible."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_ee145e45","line":128,"range":{"start_line":128,"start_character":22,"end_line":128,"end_character":29},"in_reply_to":"9a629dbe_734e7770","updated":"2016-11-09 13:32:51.000000000","message":"Done","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":145,"context_line":"flows that match the packet to all the flow classifiers of all the SFCs who"},{"line_number":146,"context_line":"have an incoming edge from the former SFC. (E.g. in the figure above, all the"},{"line_number":147,"context_line":"packets that come out of SFC1 will be forwarded to flow classifiers of SFC2 and"},{"line_number":148,"context_line":"SFC2)."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Changes to the object model"},{"line_number":151,"context_line":"---------------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_3a7e94ae","line":148,"range":{"start_line":148,"start_character":2,"end_line":148,"end_character":4},"updated":"2016-11-09 08:15:31.000000000","message":"3?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":145,"context_line":"flows that match the packet to all the flow classifiers of all the SFCs who"},{"line_number":146,"context_line":"have an incoming edge from the former SFC. (E.g. in the figure above, all the"},{"line_number":147,"context_line":"packets that come out of SFC1 will be forwarded to flow classifiers of SFC2 and"},{"line_number":148,"context_line":"SFC2)."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Changes to the object model"},{"line_number":151,"context_line":"---------------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_d848408a","line":148,"range":{"start_line":148,"start_character":2,"end_line":148,"end_character":4},"in_reply_to":"9a629dbe_3a7e94ae","updated":"2016-11-09 13:32:51.000000000","message":"Yes :)","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":150,"context_line":"Changes to the object model"},{"line_number":151,"context_line":"---------------------------"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"This change will introduce and object that matches its design to the respective"},{"line_number":154,"context_line":"objects in Neutron:"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Port pair groups:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_ba162453","line":153,"range":{"start_line":153,"start_character":26,"end_line":153,"end_character":37},"updated":"2016-11-09 08:15:31.000000000","message":"DF objects","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":150,"context_line":"Changes to the object model"},{"line_number":151,"context_line":"---------------------------"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"This change will introduce and object that matches its design to the respective"},{"line_number":154,"context_line":"objects in Neutron:"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Port pair groups:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_582c30ab","line":153,"range":{"start_line":153,"start_character":26,"end_line":153,"end_character":37},"in_reply_to":"9a629dbe_ba162453","updated":"2016-11-09 13:32:51.000000000","message":"Thanks","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":184,"context_line":"         \"First port pair group ID\","},{"line_number":185,"context_line":"         \"Zero or more port pair group IDs\""},{"line_number":186,"context_line":"     ]"},{"line_number":187,"context_line":"     \"flow_classifiers\": ["},{"line_number":188,"context_line":"         {"},{"line_number":189,"context_line":"             \"name\": \"Flow classifier name\","},{"line_number":190,"context_line":"             \"ether_type\": \"IPv4/IPv6\","}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_1d362ae6","line":187,"range":{"start_line":187,"start_character":4,"end_line":187,"end_character":26},"updated":"2016-11-09 08:15:31.000000000","message":"there are some talks about separate Flow Classification neutron service. Worth to take into account that at some point, there can be separate API to manage flow classifiers that can be applicable for different services, such as SFC, Port Mirroring, QoS, etc.","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"2c430cf94238750995571413689e73946e1ebcef","unresolved":false,"context_lines":[{"line_number":184,"context_line":"         \"First port pair group ID\","},{"line_number":185,"context_line":"         \"Zero or more port pair group IDs\""},{"line_number":186,"context_line":"     ]"},{"line_number":187,"context_line":"     \"flow_classifiers\": ["},{"line_number":188,"context_line":"         {"},{"line_number":189,"context_line":"             \"name\": \"Flow classifier name\","},{"line_number":190,"context_line":"             \"ether_type\": \"IPv4/IPv6\","}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_85f733f4","line":187,"range":{"start_line":187,"start_character":4,"end_line":187,"end_character":26},"in_reply_to":"9a629dbe_1351bb62","updated":"2016-11-09 14:33:55.000000000","message":"more details are here: https://wiki.openstack.org/wiki/Neutron/CommonFlowClassifier","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":184,"context_line":"         \"First port pair group ID\","},{"line_number":185,"context_line":"         \"Zero or more port pair group IDs\""},{"line_number":186,"context_line":"     ]"},{"line_number":187,"context_line":"     \"flow_classifiers\": ["},{"line_number":188,"context_line":"         {"},{"line_number":189,"context_line":"             \"name\": \"Flow classifier name\","},{"line_number":190,"context_line":"             \"ether_type\": \"IPv4/IPv6\","}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_1351bb62","line":187,"range":{"start_line":187,"start_character":4,"end_line":187,"end_character":26},"in_reply_to":"9a629dbe_1d362ae6","updated":"2016-11-09 13:32:51.000000000","message":"Thanks for bringing this up, I was not aware. I\u0027ll look into this more in-depth.\n\nWe can separate the flow-classifier objects into their own table, and make this a list of IDs. The final structure of FC objects will depend on the model that will be chosen in Neutron","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":217,"context_line":"Security concerns"},{"line_number":218,"context_line":"-----------------"},{"line_number":219,"context_line":"User deployed service functions have full control over the packets they produce"},{"line_number":220,"context_line":"and can take advantge of that to inject invalid or malicious packets into our"},{"line_number":221,"context_line":"network. For this matter, a valid packet is one that does not intend to harm"},{"line_number":222,"context_line":"the network or its resources."},{"line_number":223,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_3d312eed","line":220,"range":{"start_line":220,"start_character":74,"end_line":220,"end_character":77},"updated":"2016-11-09 08:15:31.000000000","message":"what do you mean by \u0027our\u0027 network?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":217,"context_line":"Security concerns"},{"line_number":218,"context_line":"-----------------"},{"line_number":219,"context_line":"User deployed service functions have full control over the packets they produce"},{"line_number":220,"context_line":"and can take advantge of that to inject invalid or malicious packets into our"},{"line_number":221,"context_line":"network. For this matter, a valid packet is one that does not intend to harm"},{"line_number":222,"context_line":"the network or its resources."},{"line_number":223,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_f33b67cf","line":220,"range":{"start_line":220,"start_character":74,"end_line":220,"end_character":77},"in_reply_to":"9a629dbe_3d312eed","updated":"2016-11-09 13:32:51.000000000","message":"Reworded","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"540b47399cfd0d28511cc16bbb38c79f45402037","unresolved":false,"context_lines":[{"line_number":223,"context_line":""},{"line_number":224,"context_line":"We can perform several checks on SF egress packets:"},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"#. Check if the packet is NSH encapsulated, if it is not, apply the original"},{"line_number":227,"context_line":"   pipeline (port sec, security groups, fw, ...)"},{"line_number":228,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":229,"context_line":"   belongs to the same tenant as the service funcion."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_9335cbf8","line":226,"range":{"start_line":226,"start_character":47,"end_line":226,"end_character":56},"updated":"2016-11-09 09:18:51.000000000","message":"not","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":223,"context_line":""},{"line_number":224,"context_line":"We can perform several checks on SF egress packets:"},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"#. Check if the packet is NSH encapsulated, if it is not, apply the original"},{"line_number":227,"context_line":"   pipeline (port sec, security groups, fw, ...)"},{"line_number":228,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":229,"context_line":"   belongs to the same tenant as the service funcion."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_dcc66b48","line":226,"range":{"start_line":226,"start_character":47,"end_line":226,"end_character":56},"in_reply_to":"9a629dbe_9335cbf8","updated":"2016-11-09 13:32:51.000000000","message":"Done","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":229,"context_line":"   belongs to the same tenant as the service funcion."},{"line_number":230,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":231,"context_line":"   does not take into account re-classification at service function nodes) FIXME"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"The above steps can be implemented using flows in OVS"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_9df4faf2","line":232,"updated":"2016-11-09 08:15:31.000000000","message":"Any user/admin facing tuning of security options?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":229,"context_line":"   belongs to the same tenant as the service funcion."},{"line_number":230,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":231,"context_line":"   does not take into account re-classification at service function nodes) FIXME"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"The above steps can be implemented using flows in OVS"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_732d9745","line":232,"in_reply_to":"9a629dbe_9df4faf2","updated":"2016-11-09 13:32:51.000000000","message":"The current networking-sfc API does not specify any security configuration options.","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":22060,"name":"jingting","email":"kangjingting@huawei.com","username":"jingting"},"change_message_id":"98fca71143c2e23198437edb15ecc91182133102","unresolved":false,"context_lines":[{"line_number":252,"context_line":"apps (now service functions) with much less coupling to each other, and let the"},{"line_number":253,"context_line":"service function app drive the messages between them."},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"For example, for each packet originating from the VM port on the controller, we"},{"line_number":256,"context_line":"can define the following SFC:"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"* Port security"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_53aa5371","line":255,"range":{"start_line":255,"start_character":58,"end_line":255,"end_character":75},"updated":"2016-11-09 09:09:52.000000000","message":"compute or something else?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":252,"context_line":"apps (now service functions) with much less coupling to each other, and let the"},{"line_number":253,"context_line":"service function app drive the messages between them."},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"For example, for each packet originating from the VM port on the controller, we"},{"line_number":256,"context_line":"can define the following SFC:"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"* Port security"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_8e2a027d","line":255,"range":{"start_line":255,"start_character":58,"end_line":255,"end_character":75},"in_reply_to":"9a629dbe_53aa5371","updated":"2016-11-09 13:32:51.000000000","message":"yes, mean the node that runs the local controller. Will change to compute","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":270,"context_line":"  +------+      |  | sec.|  | SF |  | SF |  | SF  |   |"},{"line_number":271,"context_line":"                |  +-----+  +----+  +----+  +-----+   |"},{"line_number":272,"context_line":"                +-------------------------------------+"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"Work Items"},{"line_number":275,"context_line":"----------"},{"line_number":276,"context_line":"#. Make sure openvswitch NSH patches [6] get merged"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_5dd4221f","line":273,"updated":"2016-11-09 08:15:31.000000000","message":"what are the overall system requirements, such as minimal OVS version?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":270,"context_line":"  +------+      |  | sec.|  | SF |  | SF |  | SF  |   |"},{"line_number":271,"context_line":"                |  +-----+  +----+  +----+  +-----+   |"},{"line_number":272,"context_line":"                +-------------------------------------+"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"Work Items"},{"line_number":275,"context_line":"----------"},{"line_number":276,"context_line":"#. Make sure openvswitch NSH patches [6] get merged"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_f3e8c7e4","line":273,"in_reply_to":"9a629dbe_5dd4221f","updated":"2016-11-09 13:32:51.000000000","message":"We\u0027ll know once NSH patches get merged","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"7209944a092a2aaf58981ce8cf2703b57f11cece","unresolved":false,"context_lines":[{"line_number":279,"context_line":"   SFCs relevant to the controller."},{"line_number":280,"context_line":"#. Implement SFC \"port security\" mechanism."},{"line_number":281,"context_line":"#. Integrate existing DF apps into SF chains"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"References"},{"line_number":284,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":285,"context_line":"[1] https://tools.ietf.org/html/rfc7665"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_7dbe46d5","line":282,"updated":"2016-11-09 08:15:31.000000000","message":"Testing?","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"682210a88d396d23af3d7cbb3b84810b725ebddb","unresolved":false,"context_lines":[{"line_number":279,"context_line":"   SFCs relevant to the controller."},{"line_number":280,"context_line":"#. Implement SFC \"port security\" mechanism."},{"line_number":281,"context_line":"#. Integrate existing DF apps into SF chains"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"References"},{"line_number":284,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":285,"context_line":"[1] https://tools.ietf.org/html/rfc7665"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_0c3190ec","line":282,"in_reply_to":"9a629dbe_7dbe46d5","updated":"2016-11-09 13:32:51.000000000","message":"Will address","commit_id":"b745868d2f92c6c46ef35f410a37c7c734ef1b77"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"e0e2b752f38e1f63304aa33a60fec9ab8599db94","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantage of NSH [3] and openvswitch to implement packet"},{"line_number":44,"context_line":"forwarding between service functions."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_bc7b6527","line":43,"updated":"2016-11-09 18:26:27.000000000","message":"Can you please elaborate why you choose to use NSH? is it because it is referenced in networking-sfc?","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"8b500b248e69b3557ce35e3e58510009662f4cb4","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantage of NSH [3] and openvswitch to implement packet"},{"line_number":44,"context_line":"forwarding between service functions."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_cb4f1932","line":43,"in_reply_to":"9a629dbe_9e7586fb","updated":"2016-11-11 14:24:56.000000000","message":"I think NSH may be a good option for in-band metadata/state sharing across service functions.  Having said that, Dragonflow can also implement out-of-band approach, which reads the metadata/state from its DB, without modifying the data packets. the cost of reading the DB could be offset by the cost of packet fragmentation incurred by the NSH headers (not to mentioned, if there is no NSH hardware acceleration deployed, which is highly probable, given that it is still new)","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantage of NSH [3] and openvswitch to implement packet"},{"line_number":44,"context_line":"forwarding between service functions."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_9e7586fb","line":43,"in_reply_to":"9a629dbe_bc7b6527","updated":"2016-11-10 15:40:58.000000000","message":"Yes, networking-sfc\u0027s intention to support NSH and service function graphs are a major factor in choosing NSH.\n\nThe architecture proposed by SFC-WG at IETF seems to fit the model networking-sfc propose and NSH is being developed to aid implementing this architecture so I think it an appropriate choice.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"69cb3e0e743b3ccc519c32c6608222c4f16a6f34","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantage of NSH [3] and openvswitch to implement packet"},{"line_number":44,"context_line":"forwarding between service functions."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_61fa48bf","line":43,"in_reply_to":"9a629dbe_cb4f1932","updated":"2016-11-15 23:10:19.000000000","message":"Reading the NSH header can be done with flows. Reading the information out-of-band has to be done by passing the packet to the controller, which involves a context switch and a memory copy (since at the moment the controller is in python).\n\nAdditionally, unless passed between nodes (which will happen less than the amount of time the packet is passed between \u0027SFF\u0027s), there is no fragmentation since it is done within the same OVS bridge and virtual devices/SFs which expect the header (so they would match the MTU to expect it too). Since the nodes all belong to the cloud operator, the MTU can be modified to expect it there too (i.e. the use of jumbo frames)","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"e0e2b752f38e1f63304aa33a60fec9ab8599db94","unresolved":false,"context_lines":[{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantage of NSH [3] and openvswitch to implement packet"},{"line_number":44,"context_line":"forwarding between service functions."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"To implement this change we will introduce a new application inside DF local"},{"line_number":48,"context_line":"controller responsible for forwarding SFC related traffic inside the pipeline"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_9ca5c1a3","line":45,"updated":"2016-11-09 18:26:27.000000000","message":"In the above regards need to verify that official OVS versions already support NSH","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantage of NSH [3] and openvswitch to implement packet"},{"line_number":44,"context_line":"forwarding between service functions."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"To implement this change we will introduce a new application inside DF local"},{"line_number":48,"context_line":"controller responsible for forwarding SFC related traffic inside the pipeline"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_6f9803c1","line":45,"in_reply_to":"9a629dbe_9ca5c1a3","updated":"2016-11-10 15:40:58.000000000","message":"There is no support yet, but patches that implement it exist so once the draft is finished it should be a matter of time until NSH is supported.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"e0e2b752f38e1f63304aa33a60fec9ab8599db94","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":52,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":53,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":54,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":55,"context_line":"  once packet reaches the end of the chain."},{"line_number":56,"context_line":"+ Routing traffic between SFs both locally and between controllers."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_5c332962","line":53,"updated":"2016-11-09 18:26:27.000000000","message":"I think you need to extend more on how the distributed routing is going to be effected and how it is carried on with service chain.\n\nFor example, are we still doing the routing on the source?\nIf not, how are we keeping the source port information in order to do it in the last place of the chain. how do we enforce security groups/policy on the different ports in the chain with this model and so on..","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":52,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":53,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":54,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":55,"context_line":"  once packet reaches the end of the chain."},{"line_number":56,"context_line":"+ Routing traffic between SFs both locally and between controllers."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_a41b2272","line":53,"in_reply_to":"9a629dbe_5c332962","updated":"2016-11-10 15:40:58.000000000","message":"NSH supports metadata (either fixed or the TLV kind) and we can designate several fields to share this kind of information between the controllers.\n\nWe\u0027ll have to perform L2 routing again once the chain is done because we picked it at L2 lookup stage (or similar).","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"8b500b248e69b3557ce35e3e58510009662f4cb4","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":52,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":53,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":54,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":55,"context_line":"  once packet reaches the end of the chain."},{"line_number":56,"context_line":"+ Routing traffic between SFs both locally and between controllers."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_ef194a23","line":53,"in_reply_to":"9a629dbe_a41b2272","updated":"2016-11-11 14:24:56.000000000","message":"what\u0027s L2 routing?","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":52,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":53,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":54,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":55,"context_line":"  once packet reaches the end of the chain."},{"line_number":56,"context_line":"+ Routing traffic between SFs both locally and between controllers."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_fa9c855f","line":53,"in_reply_to":"9a629dbe_ef194a23","updated":"2016-11-13 09:35:40.000000000","message":"Meant L2 lookup","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"a6c9db149e7919a1549fd00fa33639f9c47c46f7","unresolved":false,"context_lines":[{"line_number":55,"context_line":"  once packet reaches the end of the chain."},{"line_number":56,"context_line":"+ Routing traffic between SFs both locally and between controllers."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The following figure shows how for each local service function we add a flow"},{"line_number":59,"context_line":"forwards all packets with appropriate SPI/SI pairs."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_8ad580ba","line":58,"range":{"start_line":58,"start_character":72,"end_line":58,"end_character":76},"updated":"2016-11-09 14:33:38.000000000","message":"flow that","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":55,"context_line":"  once packet reaches the end of the chain."},{"line_number":56,"context_line":"+ Routing traffic between SFs both locally and between controllers."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The following figure shows how for each local service function we add a flow"},{"line_number":59,"context_line":"forwards all packets with appropriate SPI/SI pairs."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_cc3e8a8a","line":58,"range":{"start_line":58,"start_character":72,"end_line":58,"end_character":76},"in_reply_to":"9a629dbe_8ad580ba","updated":"2016-11-10 15:40:58.000000000","message":"Done","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"e0e2b752f38e1f63304aa33a60fec9ab8599db94","unresolved":false,"context_lines":[{"line_number":64,"context_line":"               +----------------------+ +---\u003eSF1|"},{"line_number":65,"context_line":"               |NSH table             | |   +---+"},{"line_number":66,"context_line":" +-------+ NSH |                      | |"},{"line_number":67,"context_line":" |Table 0+-----\u003eSPI\u003d1,SI\u003d1,metadata\u003d1 +-+   +---+"},{"line_number":68,"context_line":" +-------+     |SPI\u003d2,SI\u003d3,metadata\u003d2 +-----\u003eSF2|"},{"line_number":69,"context_line":"               |SPI\u003d2,SI\u003d2,metadata\u003d2 +-+   +---+"},{"line_number":70,"context_line":"               |                      | |"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_3c9cb50e","line":67,"updated":"2016-11-09 18:26:27.000000000","message":"What happens when you want to classify north/south traffic coming into your env that doesnt have NSH headers (you need specific hardware in order to support it)\nI dont think you addressed this case in the proxy details.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":64,"context_line":"               +----------------------+ +---\u003eSF1|"},{"line_number":65,"context_line":"               |NSH table             | |   +---+"},{"line_number":66,"context_line":" +-------+ NSH |                      | |"},{"line_number":67,"context_line":" |Table 0+-----\u003eSPI\u003d1,SI\u003d1,metadata\u003d1 +-+   +---+"},{"line_number":68,"context_line":" +-------+     |SPI\u003d2,SI\u003d3,metadata\u003d2 +-----\u003eSF2|"},{"line_number":69,"context_line":"               |SPI\u003d2,SI\u003d2,metadata\u003d2 +-+   +---+"},{"line_number":70,"context_line":"               |                      | |"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_af569b27","line":67,"in_reply_to":"9a629dbe_3c9cb50e","updated":"2016-11-10 15:40:58.000000000","message":"NSH headers are added during classification which happens at one the controllers so inbound north/south doesn\u0027t need NSH headers. From there the packet traverses only to other controllers, and service functions that support NSH (those that don\u0027t get the packet without encapsulation).","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"e0e2b752f38e1f63304aa33a60fec9ab8599db94","unresolved":false,"context_lines":[{"line_number":66,"context_line":" +-------+ NSH |                      | |"},{"line_number":67,"context_line":" |Table 0+-----\u003eSPI\u003d1,SI\u003d1,metadata\u003d1 +-+   +---+"},{"line_number":68,"context_line":" +-------+     |SPI\u003d2,SI\u003d3,metadata\u003d2 +-----\u003eSF2|"},{"line_number":69,"context_line":"               |SPI\u003d2,SI\u003d2,metadata\u003d2 +-+   +---+"},{"line_number":70,"context_line":"               |                      | |"},{"line_number":71,"context_line":"               |SPI\u003d2,SI\u003d1,pop_nsh    | |   +---+"},{"line_number":72,"context_line":"               +----------------------+ +---\u003eSF3|"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_1c1a917d","line":69,"updated":"2016-11-09 18:26:27.000000000","message":"This modeling also means that classification of chaining only happens in the source ports,  essentially i cant add classifications on router ports (as they are distributed on Dragonflow)or after routing happens.\n\nI personally think this is an important case and i am not familiar how it is addressed in networking-sfc, if it is supported then special care need to be added.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":66,"context_line":" +-------+ NSH |                      | |"},{"line_number":67,"context_line":" |Table 0+-----\u003eSPI\u003d1,SI\u003d1,metadata\u003d1 +-+   +---+"},{"line_number":68,"context_line":" +-------+     |SPI\u003d2,SI\u003d3,metadata\u003d2 +-----\u003eSF2|"},{"line_number":69,"context_line":"               |SPI\u003d2,SI\u003d2,metadata\u003d2 +-+   +---+"},{"line_number":70,"context_line":"               |                      | |"},{"line_number":71,"context_line":"               |SPI\u003d2,SI\u003d1,pop_nsh    | |   +---+"},{"line_number":72,"context_line":"               +----------------------+ +---\u003eSF3|"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_e97a53f0","line":69,"in_reply_to":"9a629dbe_1c1a917d","updated":"2016-11-10 15:40:58.000000000","message":"You\u0027re right, I\u0027ve missed it. We\u0027ll have to add classification flows in l3 lookup, for traffic going to or out of router ports, dhpc app for dhcp agent ports, and dnat for floating IPs.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"8b500b248e69b3557ce35e3e58510009662f4cb4","unresolved":false,"context_lines":[{"line_number":66,"context_line":" +-------+ NSH |                      | |"},{"line_number":67,"context_line":" |Table 0+-----\u003eSPI\u003d1,SI\u003d1,metadata\u003d1 +-+   +---+"},{"line_number":68,"context_line":" +-------+     |SPI\u003d2,SI\u003d3,metadata\u003d2 +-----\u003eSF2|"},{"line_number":69,"context_line":"               |SPI\u003d2,SI\u003d2,metadata\u003d2 +-+   +---+"},{"line_number":70,"context_line":"               |                      | |"},{"line_number":71,"context_line":"               |SPI\u003d2,SI\u003d1,pop_nsh    | |   +---+"},{"line_number":72,"context_line":"               +----------------------+ +---\u003eSF3|"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_f4483fce","line":69,"in_reply_to":"9a629dbe_e97a53f0","updated":"2016-11-11 14:24:56.000000000","message":"I think we need to also make sure the selective proactive distribution mechanism will publish to service chain nodes, so that a node performing the penultimate service of a chain can also do all distributed services for that flow (dhcp, dnat, sg, and future ones, e.g. igmp, local nat, etc.), and not need to forward to another node","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":66,"context_line":" +-------+ NSH |                      | |"},{"line_number":67,"context_line":" |Table 0+-----\u003eSPI\u003d1,SI\u003d1,metadata\u003d1 +-+   +---+"},{"line_number":68,"context_line":" +-------+     |SPI\u003d2,SI\u003d3,metadata\u003d2 +-----\u003eSF2|"},{"line_number":69,"context_line":"               |SPI\u003d2,SI\u003d2,metadata\u003d2 +-+   +---+"},{"line_number":70,"context_line":"               |                      | |"},{"line_number":71,"context_line":"               |SPI\u003d2,SI\u003d1,pop_nsh    | |   +---+"},{"line_number":72,"context_line":"               +----------------------+ +---\u003eSF3|"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_da58a18d","line":69,"in_reply_to":"9a629dbe_f4483fce","updated":"2016-11-13 09:35:40.000000000","message":"For the distributed services there shouldn\u0027t be an issue because we\u0027ll subscribe to tenants topic once we realize that we service and SFC of the tenant, but some things might have to travel to source controller (snat?).\n\nThings like floating IPs have to be taken into consideration as well. Consider that we want to classify some of the traffic incoming to the floating IP port (e.g. dst_port: tcp/80) and send it to SF on another node. Would it make sense to place the FIP on another node?","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"399a9c00194b91bb0b003fa719305f2f11b4a9bf","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":" #. Match this traffic with in_port and NSH header"},{"line_number":81,"context_line":" #. Push relevant network_id and port key,"},{"line_number":82,"context_line":" #. Forward to service function egress checks (see security concerns)"},{"line_number":83,"context_line":" #. Dispatch according to NSH forwarding table."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"#. Incoming from remote controllers"},{"line_number":86,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_b814154d","line":83,"range":{"start_line":82,"start_character":0,"end_line":83,"end_character":47},"updated":"2016-11-10 20:46:04.000000000","message":"It may be possible to unify these, by e.g. having forwarding rules only for valid \u003cnetwork_id, port key, SPI, SI\u003e tuples.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":" #. Match this traffic with in_port and NSH header"},{"line_number":81,"context_line":" #. Push relevant network_id and port key,"},{"line_number":82,"context_line":" #. Forward to service function egress checks (see security concerns)"},{"line_number":83,"context_line":" #. Dispatch according to NSH forwarding table."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"#. Incoming from remote controllers"},{"line_number":86,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_9ab469d5","line":83,"range":{"start_line":82,"start_character":0,"end_line":83,"end_character":47},"in_reply_to":"9a629dbe_b814154d","updated":"2016-11-13 09:35:40.000000000","message":"I agree","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"8b500b248e69b3557ce35e3e58510009662f4cb4","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"For each service function local to the controller, we\u0027ll create an entry in the"},{"line_number":92,"context_line":"NSH routing table, that will forward all packets with the appropriate SPI, SI"},{"line_number":93,"context_line":"to the SF ingress port. If there SF has more than one instance we can load"},{"line_number":94,"context_line":"balance between them with select type group actions, using bucket weight we can"},{"line_number":95,"context_line":"implement weighed round robin."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"The app is also responsible for terminating NSH encapsulation once we complete"},{"line_number":98,"context_line":"the last element of the service function chain, and will forward the packet to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_b47a47bb","line":95,"range":{"start_line":93,"start_character":24,"end_line":95,"end_character":30},"updated":"2016-11-11 14:24:56.000000000","message":"This part should be written like a proposition / possible implementation.  If there are multiple ways how a user may want this to behave, then it should be pluggable and configurable, with a default behavior","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"For each service function local to the controller, we\u0027ll create an entry in the"},{"line_number":92,"context_line":"NSH routing table, that will forward all packets with the appropriate SPI, SI"},{"line_number":93,"context_line":"to the SF ingress port. If there SF has more than one instance we can load"},{"line_number":94,"context_line":"balance between them with select type group actions, using bucket weight we can"},{"line_number":95,"context_line":"implement weighed round robin."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"The app is also responsible for terminating NSH encapsulation once we complete"},{"line_number":98,"context_line":"the last element of the service function chain, and will forward the packet to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_3ac6fd49","line":95,"range":{"start_line":93,"start_character":24,"end_line":95,"end_character":30},"in_reply_to":"9a629dbe_b47a47bb","updated":"2016-11-13 09:35:40.000000000","message":"Ok, after some more reading I don\u0027t think this approach is enough. According to [1] load balancing should have an option to be both sticky and non-sticky, and this proposition does not support the former.\n\n[1] https://wiki.openstack.org/wiki/Neutron/ServiceInsertionAndChaining#Overview","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"a6c9db149e7919a1549fd00fa33639f9c47c46f7","unresolved":false,"context_lines":[{"line_number":101,"context_line":"NSH-unaware service functions"},{"line_number":102,"context_line":"-----------------------------"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Additional care will be needed for SFs that do not support NSH. We\u0027ll have to"},{"line_number":105,"context_line":"implement a proxy that will:"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"#. Terminate NSH encapsulation right before we pass the packet to the ingress"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_8a166053","line":104,"range":{"start_line":104,"start_character":34,"end_line":104,"end_character":62},"updated":"2016-11-09 14:33:38.000000000","message":"how DF determines this?","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":101,"context_line":"NSH-unaware service functions"},{"line_number":102,"context_line":"-----------------------------"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Additional care will be needed for SFs that do not support NSH. We\u0027ll have to"},{"line_number":105,"context_line":"implement a proxy that will:"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"#. Terminate NSH encapsulation right before we pass the packet to the ingress"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_38b2e194","line":104,"range":{"start_line":104,"start_character":34,"end_line":104,"end_character":62},"in_reply_to":"9a629dbe_8a166053","updated":"2016-11-10 15:40:58.000000000","message":"For each port-pair (i.e service function) we have \u0027sfc_proto\u0027 we can use to determine how to treat it and what kind of proxy must be used","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"399a9c00194b91bb0b003fa719305f2f11b4a9bf","unresolved":false,"context_lines":[{"line_number":120,"context_line":"                |                           |"},{"line_number":121,"context_line":"                +--------+ NSH proxy +------+"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Service Path Identifier allocation"},{"line_number":125,"context_line":"----------------------------------"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_e316e24a","line":123,"updated":"2016-11-10 20:46:04.000000000","message":"Please add the contraints that are currently known for this solution, e.g. a single SFC Unaware SF per location in the graph (so that the tuple \u003cnetwork id, port id, SPI, SI\u003e will be known).","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":120,"context_line":"                |                           |"},{"line_number":121,"context_line":"                +--------+ NSH proxy +------+"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Service Path Identifier allocation"},{"line_number":125,"context_line":"----------------------------------"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_7ac0752b","line":123,"in_reply_to":"9a629dbe_e316e24a","updated":"2016-11-13 09:35:40.000000000","message":"OK","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"399a9c00194b91bb0b003fa719305f2f11b4a9bf","unresolved":false,"context_lines":[{"line_number":151,"context_line":" |                  +-------+             |"},{"line_number":152,"context_line":" +----------------------------------------+"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"To implement this graph we\u0027ll have to add routing between SFCs as well. For"},{"line_number":155,"context_line":"each SFC of the graph, that has an outgoing edge to another SFC, we will add"},{"line_number":156,"context_line":"flows that match the packet to all the flow classifiers of all the SFCs who"},{"line_number":157,"context_line":"have an incoming edge from the former SFC. (E.g. in the figure above, all the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_a36dcacd","line":154,"range":{"start_line":154,"start_character":42,"end_line":154,"end_character":49},"updated":"2016-11-10 20:46:04.000000000","message":"Not sure this strictly qualifies as routing. Is this the term used in networking-sfc or IETF docs?","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":151,"context_line":" |                  +-------+             |"},{"line_number":152,"context_line":" +----------------------------------------+"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"To implement this graph we\u0027ll have to add routing between SFCs as well. For"},{"line_number":155,"context_line":"each SFC of the graph, that has an outgoing edge to another SFC, we will add"},{"line_number":156,"context_line":"flows that match the packet to all the flow classifiers of all the SFCs who"},{"line_number":157,"context_line":"have an incoming edge from the former SFC. (E.g. in the figure above, all the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_9adb8921","line":154,"range":{"start_line":154,"start_character":42,"end_line":154,"end_character":49},"in_reply_to":"9a629dbe_2f3a6299","updated":"2016-11-13 09:35:40.000000000","message":"+1","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"8b500b248e69b3557ce35e3e58510009662f4cb4","unresolved":false,"context_lines":[{"line_number":151,"context_line":" |                  +-------+             |"},{"line_number":152,"context_line":" +----------------------------------------+"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"To implement this graph we\u0027ll have to add routing between SFCs as well. For"},{"line_number":155,"context_line":"each SFC of the graph, that has an outgoing edge to another SFC, we will add"},{"line_number":156,"context_line":"flows that match the packet to all the flow classifiers of all the SFCs who"},{"line_number":157,"context_line":"have an incoming edge from the former SFC. (E.g. in the figure above, all the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_2f3a6299","line":154,"range":{"start_line":154,"start_character":42,"end_line":154,"end_character":49},"in_reply_to":"9a629dbe_a36dcacd","updated":"2016-11-11 14:24:56.000000000","message":"i think it should be \"forwarding\", as it is also called later in the paragraph","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"8b500b248e69b3557ce35e3e58510009662f4cb4","unresolved":false,"context_lines":[{"line_number":175,"context_line":"             \"ingress_port_id\": \"ID of the ingress port for SF\","},{"line_number":176,"context_line":"             \"egress_port_id\": \"ID on the egress port for SF\","},{"line_number":177,"context_line":"             \"sfc_proto\": \"NSH/none\","},{"line_number":178,"context_line":"             \"weight\": \"Weight of the port pair for LB purposes\""},{"line_number":179,"context_line":"         },"},{"line_number":180,"context_line":"         \"Zero or more port pairs\""},{"line_number":181,"context_line":"     ]"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_af2912e8","line":178,"range":{"start_line":178,"start_character":14,"end_line":178,"end_character":64},"updated":"2016-11-11 14:24:56.000000000","message":"not sure this is a good direction... the weight (if at all used) would [conceivably] be set dynamically by the lb monitor (or some other component), based on the actual load of the node at a given time.  the rest of the structure is metadata that never changes.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":175,"context_line":"             \"ingress_port_id\": \"ID of the ingress port for SF\","},{"line_number":176,"context_line":"             \"egress_port_id\": \"ID on the egress port for SF\","},{"line_number":177,"context_line":"             \"sfc_proto\": \"NSH/none\","},{"line_number":178,"context_line":"             \"weight\": \"Weight of the port pair for LB purposes\""},{"line_number":179,"context_line":"         },"},{"line_number":180,"context_line":"         \"Zero or more port pairs\""},{"line_number":181,"context_line":"     ]"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_ba920d4a","line":178,"range":{"start_line":178,"start_character":14,"end_line":178,"end_character":64},"in_reply_to":"9a629dbe_af2912e8","updated":"2016-11-13 09:35:40.000000000","message":"Weight is something that networking-sfc model requires.\n\n\n The “weight” parameter is used to specify the weight for \n each SF for load distribution in a port pair group. This \n represents a percentage of the traffic to be sent to each SF.\n\nIn setups where not all SFs are born equal (resource-wise), it tells the how much traffic it should handle (relative to others in the group)","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"e0e2b752f38e1f63304aa33a60fec9ab8599db94","unresolved":false,"context_lines":[{"line_number":189,"context_line":"     \"id\": \"ID of the SFC\","},{"line_number":190,"context_line":"     \"name\": \"Name of the SFC\","},{"line_number":191,"context_line":"     \"tenant_id\": \"Tenant ID of the SFC\","},{"line_number":192,"context_line":"     \"proto\": \"NSH\","},{"line_number":193,"context_line":"     \"service_path_id\": \"Identifier of this SFC\","},{"line_number":194,"context_line":"     \"port_pair_groups\": ["},{"line_number":195,"context_line":"         \"First port pair group ID\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_502dcd93","line":192,"updated":"2016-11-09 18:26:27.000000000","message":"This must be NSH?","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":189,"context_line":"     \"id\": \"ID of the SFC\","},{"line_number":190,"context_line":"     \"name\": \"Name of the SFC\","},{"line_number":191,"context_line":"     \"tenant_id\": \"Tenant ID of the SFC\","},{"line_number":192,"context_line":"     \"proto\": \"NSH\","},{"line_number":193,"context_line":"     \"service_path_id\": \"Identifier of this SFC\","},{"line_number":194,"context_line":"     \"port_pair_groups\": ["},{"line_number":195,"context_line":"         \"First port pair group ID\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_af1bfb71","line":192,"in_reply_to":"9a629dbe_502dcd93","updated":"2016-11-10 15:40:58.000000000","message":"This spec relies on proto being NSH","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"8b500b248e69b3557ce35e3e58510009662f4cb4","unresolved":false,"context_lines":[{"line_number":189,"context_line":"     \"id\": \"ID of the SFC\","},{"line_number":190,"context_line":"     \"name\": \"Name of the SFC\","},{"line_number":191,"context_line":"     \"tenant_id\": \"Tenant ID of the SFC\","},{"line_number":192,"context_line":"     \"proto\": \"NSH\","},{"line_number":193,"context_line":"     \"service_path_id\": \"Identifier of this SFC\","},{"line_number":194,"context_line":"     \"port_pair_groups\": ["},{"line_number":195,"context_line":"         \"First port pair group ID\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_6f6c5a08","line":192,"in_reply_to":"9a629dbe_638bb21f","updated":"2016-11-11 14:24:56.000000000","message":"can this also be \"None\"? (i.e. implicitly generate a NSH proxy)","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":189,"context_line":"     \"id\": \"ID of the SFC\","},{"line_number":190,"context_line":"     \"name\": \"Name of the SFC\","},{"line_number":191,"context_line":"     \"tenant_id\": \"Tenant ID of the SFC\","},{"line_number":192,"context_line":"     \"proto\": \"NSH\","},{"line_number":193,"context_line":"     \"service_path_id\": \"Identifier of this SFC\","},{"line_number":194,"context_line":"     \"port_pair_groups\": ["},{"line_number":195,"context_line":"         \"First port pair group ID\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_faeac5ab","line":192,"in_reply_to":"9a629dbe_6f6c5a08","updated":"2016-11-13 09:35:40.000000000","message":"Do you mean for all the service functions along the chain?\nI wanted that parameter to signify that inside ovs and between the controllers we\u0027ll pass NSH packets","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"399a9c00194b91bb0b003fa719305f2f11b4a9bf","unresolved":false,"context_lines":[{"line_number":189,"context_line":"     \"id\": \"ID of the SFC\","},{"line_number":190,"context_line":"     \"name\": \"Name of the SFC\","},{"line_number":191,"context_line":"     \"tenant_id\": \"Tenant ID of the SFC\","},{"line_number":192,"context_line":"     \"proto\": \"NSH\","},{"line_number":193,"context_line":"     \"service_path_id\": \"Identifier of this SFC\","},{"line_number":194,"context_line":"     \"port_pair_groups\": ["},{"line_number":195,"context_line":"         \"First port pair group ID\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_638bb21f","line":192,"in_reply_to":"9a629dbe_af1bfb71","updated":"2016-11-10 20:46:04.000000000","message":"I think it would be best to wait with other protocols, e.g. MPLS based routing, for later.\n\nOnce this spec is implemented, we can add other protocols, or adaptors to handle other protocols.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"69cb3e0e743b3ccc519c32c6608222c4f16a6f34","unresolved":false,"context_lines":[{"line_number":189,"context_line":"     \"id\": \"ID of the SFC\","},{"line_number":190,"context_line":"     \"name\": \"Name of the SFC\","},{"line_number":191,"context_line":"     \"tenant_id\": \"Tenant ID of the SFC\","},{"line_number":192,"context_line":"     \"proto\": \"NSH\","},{"line_number":193,"context_line":"     \"service_path_id\": \"Identifier of this SFC\","},{"line_number":194,"context_line":"     \"port_pair_groups\": ["},{"line_number":195,"context_line":"         \"First port pair group ID\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_41af0c94","line":192,"in_reply_to":"9a629dbe_faeac5ab","updated":"2016-11-15 23:10:19.000000000","message":"@Eshed, I don\u0027t think so. This is based on networking-sfc definition, where \u0027none\u0027 means no metadata header (i.e. no NSH, MPLS, or anything else).","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"a6c9db149e7919a1549fd00fa33639f9c47c46f7","unresolved":false,"context_lines":[{"line_number":237,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":238,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":239,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":240,"context_line":"   belongs to the same tenant as the service function."},{"line_number":241,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":242,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_0517a3ed","line":240,"range":{"start_line":240,"start_character":17,"end_line":240,"end_character":28},"updated":"2016-11-09 14:33:38.000000000","message":"Cannot service chain be shared across tenants? Lets say the admin created chain that shared with some tenants? Maybe its futuristic case with current API, but worth to consider","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"18eb048bdb43d62bba7dfd5a2310e966006be295","unresolved":false,"context_lines":[{"line_number":237,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":238,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":239,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":240,"context_line":"   belongs to the same tenant as the service function."},{"line_number":241,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":242,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_68ee8bed","line":240,"range":{"start_line":240,"start_character":17,"end_line":240,"end_character":28},"in_reply_to":"7a77a97e_20faf8bd","updated":"2016-11-16 14:12:00.000000000","message":"@Li Ma, we can implement it but I think its better to see what way networking-sfc will choose to go.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"07a20cbac635282755afb6ba347b92b5854f59d0","unresolved":false,"context_lines":[{"line_number":237,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":238,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":239,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":240,"context_line":"   belongs to the same tenant as the service function."},{"line_number":241,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":242,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_20faf8bd","line":240,"range":{"start_line":240,"start_character":17,"end_line":240,"end_character":28},"in_reply_to":"7a77a97e_a1dc6013","updated":"2016-11-16 10:02:40.000000000","message":"Can we borrow the idea from neutron RBAC?","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":237,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":238,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":239,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":240,"context_line":"   belongs to the same tenant as the service function."},{"line_number":241,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":242,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_6cb9fe14","line":240,"range":{"start_line":240,"start_character":17,"end_line":240,"end_character":28},"in_reply_to":"9a629dbe_0517a3ed","updated":"2016-11-10 15:40:58.000000000","message":"Maybe we can have different treatment the two scenarios:\n\n* Admin deployed SFs are trusted and can be shared between tenants. We do not perform checks on their egress packets.\n* Tenant deployed SFs are subject to the checks described.\n\nWhat do you think?","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":237,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":238,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":239,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":240,"context_line":"   belongs to the same tenant as the service function."},{"line_number":241,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":242,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_7a4a35ae","line":240,"range":{"start_line":240,"start_character":17,"end_line":240,"end_character":28},"in_reply_to":"9a629dbe_2e40a306","updated":"2016-11-13 09:35:40.000000000","message":"I\u0027m not sure how VLAN tagging can solve the multi-tenancy issue for shared SF, if SF can just change the tag on the egress packet.\n\nI\u0027m not sure there is any practical way to ensure tenant isolation with a shared service functions, because it basically acts as a bridge, it can receive packets from several tenants, and send packets to several tenants.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":7776,"name":"Paul Carver","email":"pcarver@att.com","username":"pcarver"},"change_message_id":"adcc2ffb1c36d897e32889e8ac34e5ab29352cb0","unresolved":false,"context_lines":[{"line_number":237,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":238,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":239,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":240,"context_line":"   belongs to the same tenant as the service function."},{"line_number":241,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":242,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_f8876db2","line":240,"range":{"start_line":240,"start_character":17,"end_line":240,"end_character":28},"in_reply_to":"9a629dbe_6cb9fe14","updated":"2016-11-10 20:16:19.000000000","message":"I don\u0027t think we\u0027ve considered multi-tenant SFs in networking-sfc but it\u0027s worth thinking about. If supported then there does need to be some sort of trust model defined. I\u0027m not sure the idea of breaking it down by admin vs tenant is the best solution but it\u0027s a good first proposal.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"69cb3e0e743b3ccc519c32c6608222c4f16a6f34","unresolved":false,"context_lines":[{"line_number":237,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":238,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":239,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":240,"context_line":"   belongs to the same tenant as the service function."},{"line_number":241,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":242,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_a1dc6013","line":240,"range":{"start_line":240,"start_character":17,"end_line":240,"end_character":28},"in_reply_to":"9a629dbe_7a4a35ae","updated":"2016-11-15 23:10:19.000000000","message":"I agree with @Dima. Any mutli-tenant SF has to be trusted, since it can manipulate all information we have about the packet.\n\nIf the SF is trusted (because it belongs to the operator and not the tenant), then it can be multi-tenant. This might be used e.g. for performance reasons.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"8b500b248e69b3557ce35e3e58510009662f4cb4","unresolved":false,"context_lines":[{"line_number":237,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":238,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":239,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":240,"context_line":"   belongs to the same tenant as the service function."},{"line_number":241,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":242,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_2e40a306","line":240,"range":{"start_line":240,"start_character":17,"end_line":240,"end_character":28},"in_reply_to":"9a629dbe_f8876db2","updated":"2016-11-11 14:24:56.000000000","message":"I am not sure a multi-tenant SF is a practical direction, due to many reasons (e.g. proper resource metering for billing per tenant, security, security, security, ...).  I suggest we never let a SF perform a manipulation that will cause ingress traffic of Tenant A to egress as Tenant B.  This could be [relatively] easily implemented using (e.g.) port VLAN tagging before and after the SF (thus ensuring the traffic stays on the right track).\nIf at some point in the future someone comes up with a practical multi-tenant SF that makes sense as a single-node-multiple-tenants, they will need to implement internally multiple port pairs/groups that work in isolated mode (like e.g. hardware firewall)","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"e0e2b752f38e1f63304aa33a60fec9ab8599db94","unresolved":false,"context_lines":[{"line_number":264,"context_line":"service function app drive the messages between them."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"For example, for each packet originating from the VM port on the compute, we"},{"line_number":267,"context_line":"can define the following SFC:"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"* Port security"},{"line_number":270,"context_line":"* Security groups"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_909cc55e","line":267,"updated":"2016-11-09 18:26:27.000000000","message":"I cant see how this simplify things, i think it will make things more complicated as you wont be able to share metadata.\nAll these functions are implemented in OVS, they dont have a \"port\" that receive and send traffic too and from and they dont behave like \"services\".\n(And it doesnt fit the networking-sfc API you described previously)\n\nI also think that coupling and order will still need to be maintained.\n\nPersonally i would rethink about this approach, i can tell you that we previously had a design that could simplify things in this manner which we called \"Topology based Service Injection\" and in that design you could abstract our current application as services.\nBUT, it differs greatly from networking-sfc and from the current approach this spec takes","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":264,"context_line":"service function app drive the messages between them."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"For example, for each packet originating from the VM port on the compute, we"},{"line_number":267,"context_line":"can define the following SFC:"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"* Port security"},{"line_number":270,"context_line":"* Security groups"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_a4fa4241","line":267,"in_reply_to":"9a629dbe_909cc55e","updated":"2016-11-10 15:40:58.000000000","message":"I did not think of defining internal kinds of chain with port pairs, but rather manage the order of those apps using NSH.\n\nI would imagine defining a sequence (or a graph) of apps in the code [PortSecurity, SecurityGroups] (or configuration)\n\nAnd have following flows generated to stitch the apps into a local SFC.\n\nIn NSH routing table:\nspi\u003d1,si\u003d255: goto \u003cPort Security table\u003e\nspi\u003d1,si\u003d254: goto \u003cSecurity Groups table\u003e\n\nPort security table:\nreg6\u003d\u003csome port\u003e,dl_src\u003d\u003cmac of some port\u003e: dec_si, goto \u003cNSH routing table\u003e\n\nSecurity Groups table:\nct(table\u003d\u003cSecurity Groups table 2\u003e,...)\n\nSecurity Groups table2:\n....\nconj_id\u003dX: dec_spi, goto \u003cNSH routing table\u003e\n\nMaybe its not worthwhile, I\u0027d be glad to hear your input.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"69cb3e0e743b3ccc519c32c6608222c4f16a6f34","unresolved":false,"context_lines":[{"line_number":264,"context_line":"service function app drive the messages between them."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"For example, for each packet originating from the VM port on the compute, we"},{"line_number":267,"context_line":"can define the following SFC:"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"* Port security"},{"line_number":270,"context_line":"* Security groups"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_a1f3809d","line":267,"in_reply_to":"9a629dbe_9a02a971","updated":"2016-11-15 23:10:19.000000000","message":"@Dima, +2 on the comment (The comment can be merged (: )","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"399a9c00194b91bb0b003fa719305f2f11b4a9bf","unresolved":false,"context_lines":[{"line_number":264,"context_line":"service function app drive the messages between them."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"For example, for each packet originating from the VM port on the compute, we"},{"line_number":267,"context_line":"can define the following SFC:"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"* Port security"},{"line_number":270,"context_line":"* Security groups"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_c35c7e7f","line":267,"in_reply_to":"9a629dbe_a4fa4241","updated":"2016-11-10 20:46:04.000000000","message":"The plan is to support Topology Injection in this manner. The use of SFC and NSH allows us more flexibility in the structure of the pipeline. Like @Dima said, a configuration scheme will construct the relevant flows + classifications. I wouldn\u0027t return the packet to table 0 every time, however. Since the scheme is in configuration, it is decided during Dragonflow set-up, and therefore the next table can be calculated in advance. This way, we can also retain OVS metadata fields (e.g. metadata, in_port, reg*).\n\n@Dima, did I get it right?","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":264,"context_line":"service function app drive the messages between them."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"For example, for each packet originating from the VM port on the compute, we"},{"line_number":267,"context_line":"can define the following SFC:"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"* Port security"},{"line_number":270,"context_line":"* Security groups"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_9a02a971","line":267,"in_reply_to":"9a629dbe_c35c7e7f","updated":"2016-11-13 09:35:40.000000000","message":"Yes, it even seems that NSH encap is not necessary for this and it can be done on the packets themselves (without going through NSH dispatch table, and landing in the next app instead). We should see if that can be easily done, if so I don\u0027t mind dropping NSH from this flow.\n\nBut as stated below, this implementation is not a part of this spec, and I suggest we review all the alternatives when time comes.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"399a9c00194b91bb0b003fa719305f2f11b4a9bf","unresolved":false,"context_lines":[{"line_number":281,"context_line":"  +------+      |  | sec.|  | SF |  | SF |  | SF  |   |"},{"line_number":282,"context_line":"                |  +-----+  +----+  +----+  +-----+   |"},{"line_number":283,"context_line":"                +-------------------------------------+"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"Work Items"},{"line_number":286,"context_line":"----------"},{"line_number":287,"context_line":"#. Make sure openvswitch NSH patches [6] get merged"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_a3f22a04","line":284,"updated":"2016-11-10 20:46:04.000000000","message":"I think the concept of \u0027SFs implemented as flows\u0027 should be expanded. Throughout this document you have treated SFs as port-pairs (like they appear in networking-sfc) which means that once the SF is finished, the packet returns to table 0. Is this the case here as well?","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"321163f58d1c2762f1ecd8c06214fcf2c07639e0","unresolved":false,"context_lines":[{"line_number":281,"context_line":"  +------+      |  | sec.|  | SF |  | SF |  | SF  |   |"},{"line_number":282,"context_line":"                |  +-----+  +----+  +----+  +-----+   |"},{"line_number":283,"context_line":"                +-------------------------------------+"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"Work Items"},{"line_number":286,"context_line":"----------"},{"line_number":287,"context_line":"#. Make sure openvswitch NSH patches [6] get merged"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_baca0d19","line":284,"in_reply_to":"9a629dbe_a3f22a04","updated":"2016-11-13 09:35:40.000000000","message":"I will elaborate on this concept and my ideas of implementing it, though its implementation is not in the scope of this spec.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"a6c9db149e7919a1549fd00fa33639f9c47c46f7","unresolved":false,"context_lines":[{"line_number":289,"context_line":"#. Implement the DragonFlow controller app that manages the flows based on the"},{"line_number":290,"context_line":"   SFCs relevant to the controller."},{"line_number":291,"context_line":"#. Implement SFC \"port security\" mechanism."},{"line_number":292,"context_line":"#. Integrate existing DF apps into SF chains"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"References"},{"line_number":295,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_458c3b35","line":292,"range":{"start_line":292,"start_character":0,"end_line":292,"end_character":44},"updated":"2016-11-09 14:33:38.000000000","message":"this one is not directly related to the scope of this spec, it is just taking advantage of the proposed SFC mechanism to rework existing pipeline. I think its better to handle it separately","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"399a9c00194b91bb0b003fa719305f2f11b4a9bf","unresolved":false,"context_lines":[{"line_number":289,"context_line":"#. Implement the DragonFlow controller app that manages the flows based on the"},{"line_number":290,"context_line":"   SFCs relevant to the controller."},{"line_number":291,"context_line":"#. Implement SFC \"port security\" mechanism."},{"line_number":292,"context_line":"#. Integrate existing DF apps into SF chains"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"References"},{"line_number":295,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_43494eb6","line":292,"range":{"start_line":292,"start_character":0,"end_line":292,"end_character":44},"in_reply_to":"9a629dbe_2410f258","updated":"2016-11-10 20:46:04.000000000","message":"This will also allow this spec\u0027s implementation to be \u0027non-intrusive\u0027, in that the feature can be turned off (the app removed in configuration) if the standard is not finalised by the end of cycle, or NSH was not added to OVS yet.","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":16983,"name":"Eshed Gal-Or","email":"eshed.galor@huawei.com","username":"eshedg"},"change_message_id":"8b500b248e69b3557ce35e3e58510009662f4cb4","unresolved":false,"context_lines":[{"line_number":289,"context_line":"#. Implement the DragonFlow controller app that manages the flows based on the"},{"line_number":290,"context_line":"   SFCs relevant to the controller."},{"line_number":291,"context_line":"#. Implement SFC \"port security\" mechanism."},{"line_number":292,"context_line":"#. Integrate existing DF apps into SF chains"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"References"},{"line_number":295,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_aec75362","line":292,"range":{"start_line":292,"start_character":0,"end_line":292,"end_character":44},"in_reply_to":"9a629dbe_43494eb6","updated":"2016-11-11 14:24:56.000000000","message":"+1","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"12e0f6ff806d1a90a2228fd3a3b65fc3939a8648","unresolved":false,"context_lines":[{"line_number":289,"context_line":"#. Implement the DragonFlow controller app that manages the flows based on the"},{"line_number":290,"context_line":"   SFCs relevant to the controller."},{"line_number":291,"context_line":"#. Implement SFC \"port security\" mechanism."},{"line_number":292,"context_line":"#. Integrate existing DF apps into SF chains"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"References"},{"line_number":295,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a629dbe_2410f258","line":292,"range":{"start_line":292,"start_character":0,"end_line":292,"end_character":44},"in_reply_to":"9a629dbe_458c3b35","updated":"2016-11-10 15:40:58.000000000","message":"I agree","commit_id":"ef9468a6dd913ac53b2fa07934329da96af9c62b"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"92f3924075ce1b5289c64bb54f6d889174ea863a","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantage of NSH [3]_ and OVS to implement packet"},{"line_number":44,"context_line":"forwarding between service functions."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new application inside DF local"},{"line_number":47,"context_line":"controller responsible for forwarding SFC related traffic inside the pipeline"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_80e3cc32","line":44,"range":{"start_line":43,"start_character":18,"end_line":44,"end_character":37},"updated":"2016-11-16 10:02:32.000000000","message":"You can mark it as experimental and add an ovs-nsh working branch (maybe not ovs official) to devstack to enable testing. Please add some notes here to mention that ovs-nsh is not officially supported.","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"9158b73926d825709c9687defcd2c8f6d197cf88","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantage of NSH [3]_ and OVS to implement packet"},{"line_number":44,"context_line":"forwarding between service functions."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new application inside DF local"},{"line_number":47,"context_line":"controller responsible for forwarding SFC related traffic inside the pipeline"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_758642dc","line":44,"range":{"start_line":43,"start_character":18,"end_line":44,"end_character":37},"in_reply_to":"7a77a97e_0898b7bf","updated":"2016-11-17 03:51:28.000000000","message":"I mean adding a paragraph in this spec.","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"36fd142cfe44ebfe6b9cc6203f11f287f2b16ada","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantage of NSH [3]_ and OVS to implement packet"},{"line_number":44,"context_line":"forwarding between service functions."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new application inside DF local"},{"line_number":47,"context_line":"controller responsible for forwarding SFC related traffic inside the pipeline"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_dad51343","line":44,"range":{"start_line":43,"start_character":18,"end_line":44,"end_character":37},"in_reply_to":"7a77a97e_758642dc","updated":"2016-11-20 10:00:12.000000000","message":"Done","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"781951742104b7ae81a258a8035b286480b34e60","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This change will introduce the notion of service function chains to DragonFlow"},{"line_number":43,"context_line":"database and will take advantage of NSH [3]_ and OVS to implement packet"},{"line_number":44,"context_line":"forwarding between service functions."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"To implement this change we will introduce a new application inside DF local"},{"line_number":47,"context_line":"controller responsible for forwarding SFC related traffic inside the pipeline"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_0898b7bf","line":44,"range":{"start_line":43,"start_character":18,"end_line":44,"end_character":37},"in_reply_to":"7a77a97e_80e3cc32","updated":"2016-11-16 14:31:16.000000000","message":"I\u0027m not sure how to mark this spec as experimental.\n\nAbout the devstack support, I\u0027ll add it once I start working on it","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"92f3924075ce1b5289c64bb54f6d889174ea863a","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"For each service function local to the controller, we\u0027ll create an entry in the"},{"line_number":96,"context_line":"NSH routing table, that will forward all packets with the appropriate SPI, SI"},{"line_number":97,"context_line":"to the SF ingress port. If there SF has more than one instance we have to load"},{"line_number":98,"context_line":"balance between the instances."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The app is also responsible for terminating NSH encapsulation once the packet"},{"line_number":101,"context_line":"completes last element of the service function chain. Then it is passed it on"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_204cb841","line":98,"range":{"start_line":97,"start_character":63,"end_line":98,"end_character":30},"updated":"2016-11-16 10:02:32.000000000","message":"does it relate with load balance spec? is there any common part which is able to take advantage of.\nhttps://review.openstack.org/397997","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"781951742104b7ae81a258a8035b286480b34e60","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"For each service function local to the controller, we\u0027ll create an entry in the"},{"line_number":96,"context_line":"NSH routing table, that will forward all packets with the appropriate SPI, SI"},{"line_number":97,"context_line":"to the SF ingress port. If there SF has more than one instance we have to load"},{"line_number":98,"context_line":"balance between the instances."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The app is also responsible for terminating NSH encapsulation once the packet"},{"line_number":101,"context_line":"completes last element of the service function chain. Then it is passed it on"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_2bd80def","line":98,"range":{"start_line":97,"start_character":63,"end_line":98,"end_character":30},"in_reply_to":"7a77a97e_204cb841","updated":"2016-11-16 14:31:16.000000000","message":"Thinks, I will go over this spec","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"5d4ca94ffe9cca87f74f09a5f2324435036f6c6c","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"#. Terminate NSH encapsulation right before we pass the packet to the ingress"},{"line_number":112,"context_line":"   port."},{"line_number":113,"context_line":"#. Add NSH headers to the packet coming from the egress port, and set the"},{"line_number":114,"context_line":"   appropriate SPI and SI. Considering we\u0027re setting the NSH header ourselves,"},{"line_number":115,"context_line":"   we can skip the security checks stage for proxied SFs."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"A difficulty with NSH-unaware SFs is association of egress packets to paths"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_31107e4e","line":114,"range":{"start_line":113,"start_character":3,"end_line":114,"end_character":25},"updated":"2016-11-16 14:57:57.000000000","message":"1.How do you fill back the correct SPI and SI if the SF has modified the 5-tuples(also the src and dst mac) of the original packet, for example, the NAT or LB service node. I do not see the solution for this situation.\n2. Do you want to support router device as a SF in SFC?","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"1a5947d110cdb4ae7898e481bcea0724aaa494d1","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"#. Terminate NSH encapsulation right before we pass the packet to the ingress"},{"line_number":112,"context_line":"   port."},{"line_number":113,"context_line":"#. Add NSH headers to the packet coming from the egress port, and set the"},{"line_number":114,"context_line":"   appropriate SPI and SI. Considering we\u0027re setting the NSH header ourselves,"},{"line_number":115,"context_line":"   we can skip the security checks stage for proxied SFs."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"A difficulty with NSH-unaware SFs is association of egress packets to paths"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_f077cb37","line":114,"range":{"start_line":113,"start_character":3,"end_line":114,"end_character":25},"in_reply_to":"7a77a97e_16e9aa14","updated":"2016-11-16 22:23:18.000000000","message":"@hujie,@Omer\n\n1. I think there a further limitations with such \u0027simple\u0027 SF, (such as network ID/source port). With more advanced SFs we can do more, such as correlating ingress and egress packets by VLAN tags or MPLS labels.\n\n2. We can theoretically implement a router as a service function as Omer mentioned be we should take note of how we treat the packet once it is out of the chain - i.e. currently we restore network id / port ID and resume L2 lookup), Dragonflow itself can implement such router by swapping port/network IDs (because it manages those) but external SF would not work that way... I\u0027d love to know what can be done to support that...","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"36fd142cfe44ebfe6b9cc6203f11f287f2b16ada","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"#. Terminate NSH encapsulation right before we pass the packet to the ingress"},{"line_number":112,"context_line":"   port."},{"line_number":113,"context_line":"#. Add NSH headers to the packet coming from the egress port, and set the"},{"line_number":114,"context_line":"   appropriate SPI and SI. Considering we\u0027re setting the NSH header ourselves,"},{"line_number":115,"context_line":"   we can skip the security checks stage for proxied SFs."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"A difficulty with NSH-unaware SFs is association of egress packets to paths"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_7a54ffc8","line":114,"range":{"start_line":113,"start_character":3,"end_line":114,"end_character":25},"in_reply_to":"7a77a97e_2cf007fe","updated":"2016-11-20 10:00:12.000000000","message":"@hujie.\n1. The SF will have to provide a way for correlating egress packets to ingress ones. \n\n2. The DVR stays the same and in the scope of this spec is not affected by SFC deployment. In a newer revision of this spec I have proposed a way to support SFs that perform L3 modifications (e.g. routing).","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"e782565d0a9ab6d1cabc25d55095006baac2d8c9","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"#. Terminate NSH encapsulation right before we pass the packet to the ingress"},{"line_number":112,"context_line":"   port."},{"line_number":113,"context_line":"#. Add NSH headers to the packet coming from the egress port, and set the"},{"line_number":114,"context_line":"   appropriate SPI and SI. Considering we\u0027re setting the NSH header ourselves,"},{"line_number":115,"context_line":"   we can skip the security checks stage for proxied SFs."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"A difficulty with NSH-unaware SFs is association of egress packets to paths"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_16e9aa14","line":114,"range":{"start_line":113,"start_character":3,"end_line":114,"end_character":25},"in_reply_to":"7a77a97e_31107e4e","updated":"2016-11-16 18:33:44.000000000","message":"@hujie\n1. When \u0027deploying\u0027 the SF, we know its position in the SFC graph. Therefore we know the SPI and SI. This information is gathered during SFC deployment, and doesn\u0027t change. This has the drawback that a single SF instance can only appear in a single location in the SFC graph, but I think this is the best we can do.\n\n2. In theory, yes. In order to support fully dynamic/flexible pipeline, we want all Dragonflow applications to be (virtually) SFs. This is why the benefit for Dragonflow section exists in this spec, even though it is not planned for Ocata.","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"683197466ea40aee0e91f9d82271ce2a653cd347","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"#. Terminate NSH encapsulation right before we pass the packet to the ingress"},{"line_number":112,"context_line":"   port."},{"line_number":113,"context_line":"#. Add NSH headers to the packet coming from the egress port, and set the"},{"line_number":114,"context_line":"   appropriate SPI and SI. Considering we\u0027re setting the NSH header ourselves,"},{"line_number":115,"context_line":"   we can skip the security checks stage for proxied SFs."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"A difficulty with NSH-unaware SFs is association of egress packets to paths"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_477a0725","line":114,"range":{"start_line":113,"start_character":3,"end_line":114,"end_character":25},"in_reply_to":"7a77a97e_7a54ffc8","updated":"2016-11-20 13:58:30.000000000","message":"1. So it is the limitation for SF.\n2. ok","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"29db6bb91c0f33d541f67797e6afbe3d86092355","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"#. Terminate NSH encapsulation right before we pass the packet to the ingress"},{"line_number":112,"context_line":"   port."},{"line_number":113,"context_line":"#. Add NSH headers to the packet coming from the egress port, and set the"},{"line_number":114,"context_line":"   appropriate SPI and SI. Considering we\u0027re setting the NSH header ourselves,"},{"line_number":115,"context_line":"   we can skip the security checks stage for proxied SFs."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"A difficulty with NSH-unaware SFs is association of egress packets to paths"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_2cf007fe","line":114,"range":{"start_line":113,"start_character":3,"end_line":114,"end_character":25},"in_reply_to":"7a77a97e_f077cb37","updated":"2016-11-17 02:03:33.000000000","message":"@Omer,@Dima\n1. I think currently most valid SFs are the NSH-unaware SF, and it\u0027s a long way to see enough NSH-aware SFs to support NFV for production, and I have a example for what I have worried, if we deployed a NAT SF (which also has the unique location and clear SC graph), if it belongs to SC 1 and the SI is 2, also it belongs to SC 2 and the SI is 3, when we receive the packets from its egress port, as all the fields in the header have been modified(5-tuples and mac), how do you judge the flow belongs to which SC?\n2. What\u0027s the relationship between DVR in Dragonflow and router SF, could you give a clear scenario to describe it? How do we use router SF when we already support DVR?\nthx:)","commit_id":"49ada55b2babfa1c735b6a777583d6e82da4cf5e"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"dfc5506e2c736aa17cb8b6056d896c703673528d","unresolved":false,"context_lines":[{"line_number":141,"context_line":"If we want to enable L3 routing inside SFC, we can utilize Destination Class"},{"line_number":142,"context_line":"field (optional, present when D bit is set), and place the packet in the"},{"line_number":143,"context_line":"network specified by Destination Class field."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"NSH-unaware service functions"},{"line_number":146,"context_line":"-----------------------------"},{"line_number":147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"7a77a97e_0acb9d1f","line":144,"updated":"2016-11-21 13:56:14.000000000","message":"Could you add more information on how this will be done using MPLS? Since MPLS is a PoC, I think a simple paragraph will suffice.","commit_id":"88ff5e675eb508e46071e9d38e32c4ad5af34ed9"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"37f1b48b167248e70484a90a6894dd93455e736a","unresolved":false,"context_lines":[{"line_number":141,"context_line":"If we want to enable L3 routing inside SFC, we can utilize Destination Class"},{"line_number":142,"context_line":"field (optional, present when D bit is set), and place the packet in the"},{"line_number":143,"context_line":"network specified by Destination Class field."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"NSH-unaware service functions"},{"line_number":146,"context_line":"-----------------------------"},{"line_number":147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"7a77a97e_78e30b06","line":144,"in_reply_to":"7a77a97e_0acb9d1f","updated":"2016-11-21 14:24:30.000000000","message":"Done","commit_id":"88ff5e675eb508e46071e9d38e32c4ad5af34ed9"},{"author":{"_account_id":20229,"name":"Omer Anson","email":"omer.anson@toganetworks.com","username":"oanson"},"change_message_id":"a7629739415f6329093e40c903cc149f2c768a50","unresolved":false,"context_lines":[{"line_number":60,"context_line":"SPI/SI (stored in the NB database), and install flows that will forward the"},{"line_number":61,"context_line":"packet to the relevant SF based on the label. On return, we\u0027ll replace the"},{"line_number":62,"context_line":"label with the succeeding one. Metadata that is needed once packet finishes the"},{"line_number":63,"context_line":"SFC can be either stored at the bottom of the stack or in the NB database."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"SFC application"},{"line_number":66,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7a77a97e_b9e1259d","line":63,"range":{"start_line":63,"start_character":32,"end_line":63,"end_character":51},"updated":"2016-11-21 15:31:11.000000000","message":"What do you mean by \u0027bottom of the stack\u0027?","commit_id":"0bb9bff4d8c906b64c9fb02a9f8aa30fb80b74ce"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"bfbef219f53fcaa4e4409ec0b7741d7a54cc9bff","unresolved":false,"context_lines":[{"line_number":60,"context_line":"SPI/SI (stored in the NB database), and install flows that will forward the"},{"line_number":61,"context_line":"packet to the relevant SF based on the label. On return, we\u0027ll replace the"},{"line_number":62,"context_line":"label with the succeeding one. Metadata that is needed once packet finishes the"},{"line_number":63,"context_line":"SFC can be either stored at the bottom of the stack or in the NB database."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"SFC application"},{"line_number":66,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7a77a97e_b92be593","line":63,"range":{"start_line":63,"start_character":32,"end_line":63,"end_character":51},"in_reply_to":"7a77a97e_b9e1259d","updated":"2016-11-21 15:36:56.000000000","message":"In MPLS we can push several labels at the front of the packet. MPLS requires the last one (inner-most) to have  Bottom-of-Stack bit set. I meant that we can pass info on the inner-most label (or several inner-most):\n\n\nL2 | MPLS: some label | MPLS: tenant_network_id, BOS\u003d1 | ...","commit_id":"0bb9bff4d8c906b64c9fb02a9f8aa30fb80b74ce"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"6a2bc4f0354eb68857bb7b76f25f59ed8f1ebed7","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"To implement the following ideas using MPLS we can allocate a label for each"},{"line_number":60,"context_line":"SPI/SI (stored in the NB database), and install flows that will forward the"},{"line_number":61,"context_line":"packet to the relevant SF based on the label. On return, we\u0027ll replace the"},{"line_number":62,"context_line":"label with the succeeding one. Metadata that is needed once packet finishes the"},{"line_number":63,"context_line":"SFC can be either stored at the bottom of the MPLS label stack (inner-most"},{"line_number":64,"context_line":"labels) or in the NB database."},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_5ca7034f","line":62,"range":{"start_line":61,"start_character":46,"end_line":62,"end_character":29},"updated":"2016-11-22 07:07:09.000000000","message":"Can you please elaborate on this?","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":16853,"name":"Ofer Ben-Yacov","email":"ofer.benyacov@gmail.com","username":"ofer.benyacov"},"change_message_id":"a4f16d96d0a81ef5c641a2d7fa94249cc54a98c6","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"To implement the following ideas using MPLS we can allocate a label for each"},{"line_number":60,"context_line":"SPI/SI (stored in the NB database), and install flows that will forward the"},{"line_number":61,"context_line":"packet to the relevant SF based on the label. On return, we\u0027ll replace the"},{"line_number":62,"context_line":"label with the succeeding one. Metadata that is needed once packet finishes the"},{"line_number":63,"context_line":"SFC can be either stored at the bottom of the MPLS label stack (inner-most"},{"line_number":64,"context_line":"labels) or in the NB database."},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_a7c47040","line":62,"range":{"start_line":61,"start_character":46,"end_line":62,"end_character":29},"in_reply_to":"7a77a97e_32550bc6","updated":"2016-11-22 12:28:59.000000000","message":"NSH header and MPLS label are different. NSH header has SPI that is constant and SI that is, as you stated, reduced on every node. You can\u0027t do the same with one label as you can get into collision/duplication with the MPLS label for different paths.\nYou can use the 20 bits of the MPLS label as 2 fields - use 16 of the MSB for path ID and 4 LSB bits for service index. This way you will be able to tell when you look at a packet what is the path and what is the previous/next service.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"9bae23451f0e5dc57eaf2ae27f2bc1a56a2f33b7","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"To implement the following ideas using MPLS we can allocate a label for each"},{"line_number":60,"context_line":"SPI/SI (stored in the NB database), and install flows that will forward the"},{"line_number":61,"context_line":"packet to the relevant SF based on the label. On return, we\u0027ll replace the"},{"line_number":62,"context_line":"label with the succeeding one. Metadata that is needed once packet finishes the"},{"line_number":63,"context_line":"SFC can be either stored at the bottom of the MPLS label stack (inner-most"},{"line_number":64,"context_line":"labels) or in the NB database."},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_32550bc6","line":62,"range":{"start_line":61,"start_character":46,"end_line":62,"end_character":29},"in_reply_to":"7a77a97e_5ca7034f","updated":"2016-11-22 08:37:45.000000000","message":"Just like in NSH where a service function (or its proxy) decrements SI on the NSH header to \u0027advance\u0027 the packet to the next stage, we\u0027ll have to do the same with MPLS label on the packet to mark that is passed to the next SF in the chain.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"8bf5e2b2913c61f722b8d65d68cb05ad22ef1f8d","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"To implement the following ideas using MPLS we can allocate a label for each"},{"line_number":60,"context_line":"SPI/SI (stored in the NB database), and install flows that will forward the"},{"line_number":61,"context_line":"packet to the relevant SF based on the label. On return, we\u0027ll replace the"},{"line_number":62,"context_line":"label with the succeeding one. Metadata that is needed once packet finishes the"},{"line_number":63,"context_line":"SFC can be either stored at the bottom of the MPLS label stack (inner-most"},{"line_number":64,"context_line":"labels) or in the NB database."},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_4599d16d","line":62,"range":{"start_line":61,"start_character":46,"end_line":62,"end_character":29},"in_reply_to":"7a77a97e_a7c47040","updated":"2016-11-22 13:25:00.000000000","message":"There are several ways to implement this, we can subdivide the label field, or create a mapping between SPI/SI pairs and MPLS labels, or use several MPLS headers. Since this is mainly for the PoC stage of implementation I\u0027d prefer not going too in depth on this.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"6a2bc4f0354eb68857bb7b76f25f59ed8f1ebed7","unresolved":false,"context_lines":[{"line_number":62,"context_line":"label with the succeeding one. Metadata that is needed once packet finishes the"},{"line_number":63,"context_line":"SFC can be either stored at the bottom of the MPLS label stack (inner-most"},{"line_number":64,"context_line":"labels) or in the NB database."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"SFC application"},{"line_number":67,"context_line":"---------------"},{"line_number":68,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_fc760fd7","line":65,"updated":"2016-11-22 07:07:09.000000000","message":"Is there any MTU impact?","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"9bae23451f0e5dc57eaf2ae27f2bc1a56a2f33b7","unresolved":false,"context_lines":[{"line_number":62,"context_line":"label with the succeeding one. Metadata that is needed once packet finishes the"},{"line_number":63,"context_line":"SFC can be either stored at the bottom of the MPLS label stack (inner-most"},{"line_number":64,"context_line":"labels) or in the NB database."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"SFC application"},{"line_number":67,"context_line":"---------------"},{"line_number":68,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_8fc078e2","line":65,"in_reply_to":"7a77a97e_fc760fd7","updated":"2016-11-22 08:37:45.000000000","message":"Yes, we\u0027ll have to take into account the overhead of several MPLS labels (depending on how many we\u0027ll have to use).","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"6a2bc4f0354eb68857bb7b76f25f59ed8f1ebed7","unresolved":false,"context_lines":[{"line_number":70,"context_line":"controller responsible for forwarding SFC related traffic inside the pipeline"},{"line_number":71,"context_line":"and between the controllers, its primary tasks will be:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":74,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":75,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":76,"context_line":"  that maps to a correct service function chain, and popping the NSH header"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_b7403009","line":73,"range":{"start_line":73,"start_character":44,"end_line":73,"end_character":54},"updated":"2016-11-22 07:07:09.000000000","message":"inserting flows?","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"9bae23451f0e5dc57eaf2ae27f2bc1a56a2f33b7","unresolved":false,"context_lines":[{"line_number":70,"context_line":"controller responsible for forwarding SFC related traffic inside the pipeline"},{"line_number":71,"context_line":"and between the controllers, its primary tasks will be:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":74,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":75,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":76,"context_line":"  that maps to a correct service function chain, and popping the NSH header"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_6f36bcb5","line":73,"range":{"start_line":73,"start_character":44,"end_line":73,"end_character":54},"in_reply_to":"7a77a97e_b7403009","updated":"2016-11-22 08:37:45.000000000","message":"I meant inserting the packets themselves into the SFC pipeline (goto table)","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"6a2bc4f0354eb68857bb7b76f25f59ed8f1ebed7","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":74,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":75,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":76,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":77,"context_line":"  once packet reaches the end of the chain."},{"line_number":78,"context_line":"+ Routing traffic between SFs both locally and between controllers."}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_f771c878","line":75,"range":{"start_line":75,"start_character":69,"end_line":75,"end_character":79},"updated":"2016-11-22 07:07:09.000000000","message":"since you refer to NSH here, maybe the section should be titled with NSH or put here NSH/MPLS","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"8bf5e2b2913c61f722b8d65d68cb05ad22ef1f8d","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":74,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":75,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":76,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":77,"context_line":"  once packet reaches the end of the chain."},{"line_number":78,"context_line":"+ Routing traffic between SFs both locally and between controllers."}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_e8c39455","line":75,"range":{"start_line":75,"start_character":69,"end_line":75,"end_character":79},"in_reply_to":"7a77a97e_b2903097","updated":"2016-11-22 13:25:00.000000000","message":"The following sections describe NSH headers and fields, so I think this is appropriate at this point.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":16853,"name":"Ofer Ben-Yacov","email":"ofer.benyacov@gmail.com","username":"ofer.benyacov"},"change_message_id":"a4f16d96d0a81ef5c641a2d7fa94249cc54a98c6","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":74,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":75,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":76,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":77,"context_line":"  once packet reaches the end of the chain."},{"line_number":78,"context_line":"+ Routing traffic between SFs both locally and between controllers."}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_b2903097","line":75,"range":{"start_line":75,"start_character":69,"end_line":75,"end_character":79},"in_reply_to":"7a77a97e_f2f7138a","updated":"2016-11-22 12:28:59.000000000","message":"I agree with Irena. Use Service Header and state that it can be NSH/MPLS or any other suitable protocol.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"9bae23451f0e5dc57eaf2ae27f2bc1a56a2f33b7","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":74,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":75,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":76,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":77,"context_line":"  once packet reaches the end of the chain."},{"line_number":78,"context_line":"+ Routing traffic between SFs both locally and between controllers."}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_f2f7138a","line":75,"range":{"start_line":75,"start_character":69,"end_line":75,"end_character":79},"in_reply_to":"7a77a97e_f771c878","updated":"2016-11-22 08:37:45.000000000","message":"The whole spec assumes NSH for underlying protocol. While we are likely to use MPLS at the beginning stage of the development, the whole design should stay the same because even with MPLS we plan to rely on NSH features and implement them on top of MPLS as far as possible.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":16853,"name":"Ofer Ben-Yacov","email":"ofer.benyacov@gmail.com","username":"ofer.benyacov"},"change_message_id":"a4f16d96d0a81ef5c641a2d7fa94249cc54a98c6","unresolved":false,"context_lines":[{"line_number":73,"context_line":"+ Classifying traffic from source ports and inserting into the SFC pipeline."},{"line_number":74,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":75,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":76,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":77,"context_line":"  once packet reaches the end of the chain."},{"line_number":78,"context_line":"+ Routing traffic between SFs both locally and between controllers."},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_12ec8428","line":76,"updated":"2016-11-22 12:28:59.000000000","message":"pop the Service Header","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":16853,"name":"Ofer Ben-Yacov","email":"ofer.benyacov@gmail.com","username":"ofer.benyacov"},"change_message_id":"a4f16d96d0a81ef5c641a2d7fa94249cc54a98c6","unresolved":false,"context_lines":[{"line_number":151,"context_line":"If we want to enable L3 routing inside SFC, we can utilize Destination Class"},{"line_number":152,"context_line":"field (optional, present when D bit is set), and place the packet in the"},{"line_number":153,"context_line":"network specified by Destination Class field."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"NSH-unaware service functions"},{"line_number":156,"context_line":"-----------------------------"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_323b40ed","line":154,"updated":"2016-11-22 12:28:59.000000000","message":"How do you implement this, if at all, when using MPLS?","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"8bf5e2b2913c61f722b8d65d68cb05ad22ef1f8d","unresolved":false,"context_lines":[{"line_number":151,"context_line":"If we want to enable L3 routing inside SFC, we can utilize Destination Class"},{"line_number":152,"context_line":"field (optional, present when D bit is set), and place the packet in the"},{"line_number":153,"context_line":"network specified by Destination Class field."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"NSH-unaware service functions"},{"line_number":156,"context_line":"-----------------------------"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_c5c40142","line":154,"in_reply_to":"7a77a97e_323b40ed","updated":"2016-11-22 13:25:00.000000000","message":"By placing MPLS labels at the bottom of the stack.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":16853,"name":"Ofer Ben-Yacov","email":"ofer.benyacov@gmail.com","username":"ofer.benyacov"},"change_message_id":"0dd784cecdba800dd7acc23b031030e4a03fb3f9","unresolved":false,"context_lines":[{"line_number":151,"context_line":"If we want to enable L3 routing inside SFC, we can utilize Destination Class"},{"line_number":152,"context_line":"field (optional, present when D bit is set), and place the packet in the"},{"line_number":153,"context_line":"network specified by Destination Class field."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"NSH-unaware service functions"},{"line_number":156,"context_line":"-----------------------------"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_d403d1b6","line":154,"in_reply_to":"7a77a97e_c5c40142","updated":"2016-11-22 14:25:34.000000000","message":"so write it in the spec .....","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"d0aeab9c1b4ddeb9f34b7ffe883a83fd534733ff","unresolved":false,"context_lines":[{"line_number":151,"context_line":"If we want to enable L3 routing inside SFC, we can utilize Destination Class"},{"line_number":152,"context_line":"field (optional, present when D bit is set), and place the packet in the"},{"line_number":153,"context_line":"network specified by Destination Class field."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"NSH-unaware service functions"},{"line_number":156,"context_line":"-----------------------------"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_2caf59e4","line":154,"in_reply_to":"7a77a97e_d403d1b6","updated":"2016-11-22 15:15:31.000000000","message":"It is covered under PoC implementation section","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":16853,"name":"Ofer Ben-Yacov","email":"ofer.benyacov@gmail.com","username":"ofer.benyacov"},"change_message_id":"a4f16d96d0a81ef5c641a2d7fa94249cc54a98c6","unresolved":false,"context_lines":[{"line_number":178,"context_line":"                |                           |"},{"line_number":179,"context_line":"                +--------+ NSH proxy +------+"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"Service Path Identifier allocation"},{"line_number":183,"context_line":"----------------------------------"},{"line_number":184,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_8d0eb530","line":181,"updated":"2016-11-22 12:28:59.000000000","message":"When using MPLS, do you expect Service Nodes to be MPLS-Aware or not?","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"8bf5e2b2913c61f722b8d65d68cb05ad22ef1f8d","unresolved":false,"context_lines":[{"line_number":178,"context_line":"                |                           |"},{"line_number":179,"context_line":"                +--------+ NSH proxy +------+"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"Service Path Identifier allocation"},{"line_number":183,"context_line":"----------------------------------"},{"line_number":184,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_a559c55d","line":181,"in_reply_to":"7a77a97e_8d0eb530","updated":"2016-11-22 13:25:00.000000000","message":"It is the same as with NSH. We\u0027ll use a proxy in case SF is not MPLS aware.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":16853,"name":"Ofer Ben-Yacov","email":"ofer.benyacov@gmail.com","username":"ofer.benyacov"},"change_message_id":"0dd784cecdba800dd7acc23b031030e4a03fb3f9","unresolved":false,"context_lines":[{"line_number":178,"context_line":"                |                           |"},{"line_number":179,"context_line":"                +--------+ NSH proxy +------+"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"Service Path Identifier allocation"},{"line_number":183,"context_line":"----------------------------------"},{"line_number":184,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_947cf921","line":181,"in_reply_to":"7a77a97e_a559c55d","updated":"2016-11-22 14:25:34.000000000","message":"ditto","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":16853,"name":"Ofer Ben-Yacov","email":"ofer.benyacov@gmail.com","username":"ofer.benyacov"},"change_message_id":"a4f16d96d0a81ef5c641a2d7fa94249cc54a98c6","unresolved":false,"context_lines":[{"line_number":254,"context_line":"         \"Zero or more port pairs\""},{"line_number":255,"context_line":"     ]"},{"line_number":256,"context_line":" }"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"Service function chains:"},{"line_number":259,"context_line":""},{"line_number":260,"context_line":".. code-block:: json"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_0de0e5cb","line":257,"updated":"2016-11-22 12:28:59.000000000","message":"The port-pair should have its own object and the group will have a reference to the port-pairs. This way port-pair will be able to be referenced by multiple groups.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"8bf5e2b2913c61f722b8d65d68cb05ad22ef1f8d","unresolved":false,"context_lines":[{"line_number":254,"context_line":"         \"Zero or more port pairs\""},{"line_number":255,"context_line":"     ]"},{"line_number":256,"context_line":" }"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"Service function chains:"},{"line_number":259,"context_line":""},{"line_number":260,"context_line":".. code-block:: json"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_c54ec1c0","line":257,"in_reply_to":"7a77a97e_0de0e5cb","updated":"2016-11-22 13:25:00.000000000","message":"networking-sfc data model this relationship as one to many, so our model fits.\n\nhttp://docs.openstack.org/developer/networking-sfc/api.html#data-model-impact","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":16853,"name":"Ofer Ben-Yacov","email":"ofer.benyacov@gmail.com","username":"ofer.benyacov"},"change_message_id":"0dd784cecdba800dd7acc23b031030e4a03fb3f9","unresolved":false,"context_lines":[{"line_number":254,"context_line":"         \"Zero or more port pairs\""},{"line_number":255,"context_line":"     ]"},{"line_number":256,"context_line":" }"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"Service function chains:"},{"line_number":259,"context_line":""},{"line_number":260,"context_line":".. code-block:: json"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_f4e28d2e","line":257,"in_reply_to":"7a77a97e_c54ec1c0","updated":"2016-11-22 14:25:34.000000000","message":"no its not. see the port pair group. it uses reference to the port pair object. \n\n{\"port_pair_group\": {\"name\": \"Firewall_PortPairGroup\",\n       \"tenant_id\": \"d382007aa9904763a801f68ecf065cf5\",\n       \"description\": \"Grouping Firewall SF instances\",\n       \"port_pairs\": [\n           \"78dcd363-fc23-aeb6-f44b-56dc5e2fb3ae\"\n       ],\n       \"port_pair_group_parameters\": [\n           \"lb_fields: ip_src\"\n       ]\n   }\n }","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"d0aeab9c1b4ddeb9f34b7ffe883a83fd534733ff","unresolved":false,"context_lines":[{"line_number":254,"context_line":"         \"Zero or more port pairs\""},{"line_number":255,"context_line":"     ]"},{"line_number":256,"context_line":" }"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"Service function chains:"},{"line_number":259,"context_line":""},{"line_number":260,"context_line":".. code-block:: json"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_6c06b121","line":257,"in_reply_to":"7a77a97e_f4e28d2e","updated":"2016-11-22 15:15:31.000000000","message":"In both the documentation page in and in their database schema they treat the relation as one to many.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"6a2bc4f0354eb68857bb7b76f25f59ed8f1ebed7","unresolved":false,"context_lines":[{"line_number":376,"context_line":""},{"line_number":377,"context_line":"   - VM ports"},{"line_number":378,"context_line":"   - Router ports and gateway port"},{"line_number":379,"context_line":"   - Floating IP\u0027s floating port"},{"line_number":380,"context_line":"   - DHCP agent port"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"#. Traversing the SFC - given an SFC and SF layout, we can check that our"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_b734b04a","line":379,"range":{"start_line":379,"start_character":19,"end_line":379,"end_character":27},"updated":"2016-11-22 07:07:09.000000000","message":"redundant","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"9bae23451f0e5dc57eaf2ae27f2bc1a56a2f33b7","unresolved":false,"context_lines":[{"line_number":376,"context_line":""},{"line_number":377,"context_line":"   - VM ports"},{"line_number":378,"context_line":"   - Router ports and gateway port"},{"line_number":379,"context_line":"   - Floating IP\u0027s floating port"},{"line_number":380,"context_line":"   - DHCP agent port"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"#. Traversing the SFC - given an SFC and SF layout, we can check that our"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_8f8cf836","line":379,"range":{"start_line":379,"start_character":19,"end_line":379,"end_character":27},"in_reply_to":"7a77a97e_b734b04a","updated":"2016-11-22 08:37:45.000000000","message":"Can remove, it was just to emphasize we\u0027re not referring to the port FIP is bound TO (The VM port)","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"6a2bc4f0354eb68857bb7b76f25f59ed8f1ebed7","unresolved":false,"context_lines":[{"line_number":405,"context_line":"   #. Propose design for internal SFCs"},{"line_number":406,"context_line":""},{"line_number":407,"context_line":"We would also have to make sure openvswitch NSH patches [8]_ get merged, and"},{"line_number":408,"context_line":"RYU support is added"},{"line_number":409,"context_line":""},{"line_number":410,"context_line":"References"},{"line_number":411,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_571d1cbc","line":408,"range":{"start_line":408,"start_character":0,"end_line":408,"end_character":11},"updated":"2016-11-22 07:07:09.000000000","message":"Can you please elaborate on what support is missing in RYU?","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"9bae23451f0e5dc57eaf2ae27f2bc1a56a2f33b7","unresolved":false,"context_lines":[{"line_number":405,"context_line":"   #. Propose design for internal SFCs"},{"line_number":406,"context_line":""},{"line_number":407,"context_line":"We would also have to make sure openvswitch NSH patches [8]_ get merged, and"},{"line_number":408,"context_line":"RYU support is added"},{"line_number":409,"context_line":""},{"line_number":410,"context_line":"References"},{"line_number":411,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a77a97e_0f92a857","line":408,"range":{"start_line":408,"start_character":0,"end_line":408,"end_character":11},"in_reply_to":"7a77a97e_571d1cbc","updated":"2016-11-22 08:37:45.000000000","message":"We\u0027ll have to use the new match/action types for NSH, that are not present yet in RYU.","commit_id":"093a3c61ad9db7429059b8cd925bf14039d494a4"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"3c7476cf3474c68aae320bea3fb34513d2117a21","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Service function deployment in a network that supports only destination based"},{"line_number":17,"context_line":"routing can be very time consuming. It requires sophisticated topologies that"},{"line_number":18,"context_line":"have to be maintained manually outside of the tools offered by neutron."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Recently networking-sfc proposed a change in the API to allow definition of"},{"line_number":21,"context_line":"service function chains and policy based routing (flow classifiers), based"}],"source_content_type":"text/x-rst","patch_set":12,"id":"7a77a97e_cd534d38","line":18,"range":{"start_line":18,"start_character":63,"end_line":18,"end_character":70},"updated":"2016-11-22 12:24:26.000000000","message":"Neutron","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"293e837e9b87d0e083eaa800bd0354e8a7906404","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Service function deployment in a network that supports only destination based"},{"line_number":17,"context_line":"routing can be very time consuming. It requires sophisticated topologies that"},{"line_number":18,"context_line":"have to be maintained manually outside of the tools offered by neutron."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Recently networking-sfc proposed a change in the API to allow definition of"},{"line_number":21,"context_line":"service function chains and policy based routing (flow classifiers), based"}],"source_content_type":"text/x-rst","patch_set":12,"id":"7a77a97e_d3504ed7","line":18,"range":{"start_line":18,"start_character":63,"end_line":18,"end_character":70},"in_reply_to":"7a77a97e_cd534d38","updated":"2016-11-22 13:25:25.000000000","message":"will fix","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"3c7476cf3474c68aae320bea3fb34513d2117a21","unresolved":false,"context_lines":[{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Neutron SFC mechanism defines a sequence of port pairs (or groups of) that"},{"line_number":28,"context_line":"represent a service function, and classifiers to filter incoming traffic. [2]_"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"::"},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"7a77a97e_e12ad8e6","line":28,"range":{"start_line":28,"start_character":12,"end_line":28,"end_character":28},"updated":"2016-11-22 12:24:26.000000000","message":"a sequence of port pairs should be a service chain, right?","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"293e837e9b87d0e083eaa800bd0354e8a7906404","unresolved":false,"context_lines":[{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Neutron SFC mechanism defines a sequence of port pairs (or groups of) that"},{"line_number":28,"context_line":"represent a service function, and classifiers to filter incoming traffic. [2]_"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"::"},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"7a77a97e_3341820c","line":28,"range":{"start_line":28,"start_character":12,"end_line":28,"end_character":28},"in_reply_to":"7a77a97e_e12ad8e6","updated":"2016-11-22 13:25:25.000000000","message":"will fix","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"3c7476cf3474c68aae320bea3fb34513d2117a21","unresolved":false,"context_lines":[{"line_number":73,"context_line":"controller responsible for forwarding SFC related traffic inside the pipeline"},{"line_number":74,"context_line":"and between the controllers, its primary tasks will be:"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"+ Classifying traffic from source ports and inserting them into the SFC"},{"line_number":77,"context_line":"  pipeline."},{"line_number":78,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":79,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":80,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":81,"context_line":"  once packet reaches the end of the chain."}],"source_content_type":"text/x-rst","patch_set":12,"id":"7a77a97e_6777b8d4","line":78,"range":{"start_line":76,"start_character":0,"end_line":78,"end_character":54},"updated":"2016-11-22 12:24:26.000000000","message":"what\u0027s the difference between the two tasks?","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"293e837e9b87d0e083eaa800bd0354e8a7906404","unresolved":false,"context_lines":[{"line_number":73,"context_line":"controller responsible for forwarding SFC related traffic inside the pipeline"},{"line_number":74,"context_line":"and between the controllers, its primary tasks will be:"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"+ Classifying traffic from source ports and inserting them into the SFC"},{"line_number":77,"context_line":"  pipeline."},{"line_number":78,"context_line":"+ Implementing flow classifiers with flows inside OVS."},{"line_number":79,"context_line":"+ Encapsulating packets that match a classifier with the appropriate NSH header"},{"line_number":80,"context_line":"  that maps to a correct service function chain, and popping the NSH header"},{"line_number":81,"context_line":"  once packet reaches the end of the chain."}],"source_content_type":"text/x-rst","patch_set":12,"id":"7a77a97e_93d89681","line":78,"range":{"start_line":76,"start_character":0,"end_line":78,"end_character":54},"in_reply_to":"7a77a97e_6777b8d4","updated":"2016-11-22 13:25:25.000000000","message":"I will merge the two","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"3c7476cf3474c68aae320bea3fb34513d2117a21","unresolved":false,"context_lines":[{"line_number":314,"context_line":""},{"line_number":315,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":316,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":317,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":318,"context_line":"   belongs to the same tenant as the service function."},{"line_number":319,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":320,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"The above steps can be implemented using flows in OVS"},{"line_number":323,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"7a77a97e_2d268168","line":320,"range":{"start_line":317,"start_character":0,"end_line":320,"end_character":74},"updated":"2016-11-22 12:24:26.000000000","message":"what\u0027s the difference about the Openflow entries between the NSH security checks table and NSH routing table? I think if you just check the correct SPI and SI, use the NSH routing table is enough, and any invalid SPI and SI will be dropped.","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"293e837e9b87d0e083eaa800bd0354e8a7906404","unresolved":false,"context_lines":[{"line_number":314,"context_line":""},{"line_number":315,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":316,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":317,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":318,"context_line":"   belongs to the same tenant as the service function."},{"line_number":319,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":320,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"The above steps can be implemented using flows in OVS"},{"line_number":323,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"7a77a97e_f3738ab2","line":320,"range":{"start_line":317,"start_character":0,"end_line":320,"end_character":74},"in_reply_to":"7a77a97e_2d268168","updated":"2016-11-22 13:25:25.000000000","message":"We want to match the SPI/SI pairs to the port they came from.\nWe don\u0027t want to allow a service function send packets into chains it does not belong to.","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"5d86308d3eb9685c60a9eb6ed19457f2878a7ea3","unresolved":false,"context_lines":[{"line_number":314,"context_line":""},{"line_number":315,"context_line":"#. Check if the packet is NSH encapsulated, if not, apply the original pipeline"},{"line_number":316,"context_line":"   (port sec, security groups, firewall, ...)"},{"line_number":317,"context_line":"#. Check that SPI on the packet maps to a valid SFC in the database that"},{"line_number":318,"context_line":"   belongs to the same tenant as the service function."},{"line_number":319,"context_line":"#. Check that SI on the packet maps to the next hop in the SFC (Neutron\u0027s API"},{"line_number":320,"context_line":"   does not take into account re-classification at service function nodes)"},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"The above steps can be implemented using flows in OVS"},{"line_number":323,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"5a74a57a_be8e7825","line":320,"range":{"start_line":317,"start_character":0,"end_line":320,"end_character":74},"in_reply_to":"7a77a97e_f3738ab2","updated":"2016-11-23 03:31:04.000000000","message":"I think the Openflow entries in NSH routing table could do the same thing, for example, if next hop is belonged to SC 1 and SI 2, any other flows(SC 2, SI 2,  SC 1, SI 3.......) will be dropped because no corresponding flows match them, pls correct me if I\u0027m wrong, thx","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":20287,"name":"hujie","email":"mike.hu@huawei.com","username":"hujie"},"change_message_id":"3c7476cf3474c68aae320bea3fb34513d2117a21","unresolved":false,"context_lines":[{"line_number":381,"context_line":"   - VM ports"},{"line_number":382,"context_line":"   - Router ports and gateway port"},{"line_number":383,"context_line":"   - Floating IP\u0027s port"},{"line_number":384,"context_line":"   - DHCP agent port"},{"line_number":385,"context_line":""},{"line_number":386,"context_line":"#. Traversing the SFC - given an SFC and SF layout, we can check that our"},{"line_number":387,"context_line":"   packet takes a logical route and visits all SFs in a logical order."}],"source_content_type":"text/x-rst","patch_set":12,"id":"7a77a97e_2dfe816b","line":384,"range":{"start_line":384,"start_character":4,"end_line":384,"end_character":20},"updated":"2016-11-22 12:24:26.000000000","message":"Does Dragonflow still have DHCP agent?","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"293e837e9b87d0e083eaa800bd0354e8a7906404","unresolved":false,"context_lines":[{"line_number":381,"context_line":"   - VM ports"},{"line_number":382,"context_line":"   - Router ports and gateway port"},{"line_number":383,"context_line":"   - Floating IP\u0027s port"},{"line_number":384,"context_line":"   - DHCP agent port"},{"line_number":385,"context_line":""},{"line_number":386,"context_line":"#. Traversing the SFC - given an SFC and SF layout, we can check that our"},{"line_number":387,"context_line":"   packet takes a logical route and visits all SFs in a logical order."}],"source_content_type":"text/x-rst","patch_set":12,"id":"7a77a97e_73685abb","line":384,"range":{"start_line":384,"start_character":4,"end_line":384,"end_character":20},"in_reply_to":"7a77a97e_2dfe816b","updated":"2016-11-22 13:25:25.000000000","message":"We still have a DHCP port when DHCP is enabled.","commit_id":"64dfc81a58b3f99831432f4151f746855118886a"},{"author":{"_account_id":6598,"name":"Berezovsky Irena","email":"irenab.dev@gmail.com","username":"irenab"},"change_message_id":"e57a6119d8ad75934015fa160ba4a0b338bf6d78","unresolved":false,"context_lines":[{"line_number":190,"context_line":"Service Path Identifier allocation"},{"line_number":191,"context_line":"----------------------------------"},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"SPI allocation will take place in the Neutron side, and to avoid conflict"},{"line_number":194,"context_line":"between allocated IDs we should use the same method we use for port tunnel"},{"line_number":195,"context_line":"keys, by allocating unique IDs through our database driver."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"We should also reserve a certain range for locally managed SFCs, see Benefits"},{"line_number":198,"context_line":"to DragonFlow section for more details."}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a74a57a_72f93680","line":195,"range":{"start_line":193,"start_character":0,"end_line":195,"end_character":59},"updated":"2016-11-24 07:50:27.000000000","message":"Not sure if what you are saying is that neutron is responsible to allocate SPI, but it will delegate the allocation to DF","commit_id":"d25aa6e3def5a3dcd3fdfa32fdc7eff61453df1a"},{"author":{"_account_id":23766,"name":"Dima Kuznetsov","email":"dima.kuznetsov@toganetworks.com","username":"dimak"},"change_message_id":"6f4c20b0cf1c2081f78ad25a24fe279fcb4df2d8","unresolved":false,"context_lines":[{"line_number":190,"context_line":"Service Path Identifier allocation"},{"line_number":191,"context_line":"----------------------------------"},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"SPI allocation will take place in the Neutron side, and to avoid conflict"},{"line_number":194,"context_line":"between allocated IDs we should use the same method we use for port tunnel"},{"line_number":195,"context_line":"keys, by allocating unique IDs through our database driver."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"We should also reserve a certain range for locally managed SFCs, see Benefits"},{"line_number":198,"context_line":"to DragonFlow section for more details."}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a74a57a_a0d36637","line":195,"range":{"start_line":193,"start_character":0,"end_line":195,"end_character":59},"in_reply_to":"5a74a57a_72f93680","updated":"2016-11-24 13:43:45.000000000","message":"I meant that the dragonflow code running inside neutron service will do that. Will revise.","commit_id":"d25aa6e3def5a3dcd3fdfa32fdc7eff61453df1a"}]}