Wednesday, 2016-11-09

*** mickeys has quit IRC00:41
*** hoangcx has joined #openstack-fwaas00:48
*** amotoki has quit IRC00:49
*** diogogmt has quit IRC00:52
*** SridarK has quit IRC01:34
*** diogogmt has joined #openstack-fwaas01:39
*** amotoki has joined #openstack-fwaas01:43
*** amotoki has quit IRC01:48
hoangcxnjohnston: Hi01:55
hoangcxnjohnston: Will the FWaaS team meeting hold at the same time as usual? Or change to another slot?01:56
*** yushiro has joined #openstack-fwaas03:50
xgermanI think same time04:52
*** SridarK has joined #openstack-fwaas05:51
SridarKyushiro: ping06:02
yushiroSridarK: pong06:03
SridarKyushiro: quick question - did we meet today06:03
SridarKi think with the time change - i got confused06:03
yushiroAh, I also confused..  However, I attended usual time (13:00JST) but nobody exists ;06:04
SridarKyushiro: ok - i did not see the logs either06:05
SridarKwe changed the clocks in the US06:06
SridarKsigh ok never mind06:06
SridarKi am looking thru the CLI patch06:06
yushiroOK.  njohnston suggested http://lists.openstack.org/pipermail/openstack-dev/2016-October/106410.html   and decided 1st proposal.06:08
yushiroSridarK, njohnston sorry I forgot to reply e-mail about this suggestion.06:08
SridarKyushiro: no we decided in the last mtg - but i also meant to confirm with njohnston today06:09
yushiroAh, OK.06:09
SridarKand i forgot during the day time06:09
yushiroI understand.  Thank you.06:09
SridarKnp i think the only discussion items we had were for the stadium06:10
yushiroBTW, could you wait for reviewing my CLI patch?  Because I have to update my patch today.06:11
yushiroI discussed with Akihiro and he agreed to customize his utility patch.06:12
yushiroAlso, he will propose his utility patch into osc-lib.06:12
yushiroI'll update my CLI patch within TODAY!06:12
yushiroBTW, quick question..  firewall_group always returns 'ports', don't you?  Currently, only POST/PUT returns 'ports'.06:14
SridarKyushiro: ok on the CLI patch06:18
SridarKlet me check fwg06:18
yushiroSure06:18
SridarKu mean on the delete ?06:20
SridarKwe dont06:21
SridarKon the plugin from the code standpoint - we kind of treat ports differently to accomodate how we handle on the db layer06:22
SridarKmaybe i am not understanding ur question06:22
SridarKok i see may be an issue on GET ?06:26
*** _MoonWolf_ has left #openstack-fwaas06:26
yushirosorry for confusing.  Let me paste some result..06:32
SridarKyushiro: ok i think i may see one issue06:33
SridarKbut let me check the paste06:34
yushirohttp://paste.openstack.org/show/588508/06:34
yushiroPOST, PUT returns 'ports' as response parameter.  GET(list, show) no 'ports' returns as response parameter.06:35
SridarKyushiro: yes u are correct06:35
SridarKi see the issue06:35
SridarKlet me fix it06:35
yushirooh, Thanks.  Can I file a bug now?06:35
yushiroon Launchpad06:35
SridarKoh yes pls06:36
yushiroSure.06:36
SridarKand assign it to me, i can use that for the fix06:36
yushiroDone! https://bugs.launchpad.net/neutron/+bug/164039506:37
openstackLaunchpad bug 1640395 in neutron "Missing 'ports' attribute when GET firewall-groups" [Undecided,New]06:37
yushiroSridar, I cannot find your launchpad name(skandasw) I don't know why...06:39
SridarKhmm not sure - but i assigned it to myself06:40
SridarKthanks06:40
yushiroOK.06:40
*** andrein has joined #openstack-fwaas07:14
SridarKyushiro: i will have a patch tomorrow morning our time07:36
yushiroSridarK: Sure. I'll review it :)07:36
SridarKok i am signing off07:36
yushirosee u07:45
*** andrein has quit IRC08:10
*** andrein has joined #openstack-fwaas08:38
*** andrein has quit IRC08:56
*** andrein has joined #openstack-fwaas08:57
*** andrein has quit IRC09:04
*** andrein has joined #openstack-fwaas09:06
mfranc213yushiro ping09:08
yushiromfranc213, pong09:08
mfranc213yushiro: how are you?09:09
yushiromfranc213, Fine thanks :)  BTW, sorry for yesterday. I didn't notice your ping09:09
mfranc213yushiro: no apologies.  we are on very different schedules.  i have a question for you.  is there a way that i can see the resulting api-ref without sending it through the gate?09:10
yushiromfranc213: Sure.09:11
yushiromfranc213: I think "tox -e api-ref" can bulid on your local environment.09:14
yushiromfranc213: after "tox -e api-ref" command, you can check a result by accessing with some browser(I.E, Firefox...)09:16
mfranc213which file is it that i look at?09:18
yushiromfranc213: Maybe api-ref/build/html.  I'll try it now.09:19
yushiroI checked it.  You should look at api-ref/build/html09:25
yushiromfranc213: "python -m SimpleHTTPServer" is easy to build HTTP server.  It's my recommend :)09:27
*** andrein has quit IRC09:28
mfranc213thank you yushiro.  i'll try this later.  right now it's not building because i've made a lot of changes.09:28
mfranc213i want you to know that i've abandoned things like audited_4 because it's totally confusing.  so instead i've created09:29
yushiromfranc213: Definitely agree.  It is so confusing & not easy to understand.09:29
mfranc213variables like audited_body_required (for instance).  this is transparent and i hope others won't object.09:29
mfranc213yushiro what time is it right now for you?09:31
yushiromfranc213: It's 18:32.  I'll be in my office at 23:00 today :)09:33
mfranc213yushiro: thank you.  it's 04:33 for me.  i'm going to start working again soon.  why will you be working so late?09:33
yushiromfranc213: Because I have to create some presentation files for summit report within this weekend.  TBH, I'd like to focus on writing/reviewing codes :)09:36
yushiromfranc213: So, can I wait reviewing for your latest PS?09:37
mfranc213yushiro: yes.  i need to review what i've done, add parameters, and then i will push the next PS for you to review.  i think this will take me 2 or 3 hours but that's a guess.  will that be okay for you?09:41
yushiromfranc213: Sure!09:41
yushiromfranc213: Ah, in previous review comments, please ignore that "it shuld be Optional at response params".  I wanted to say at request params.  This is my mistake.09:41
mfranc213yushiro.  thank you.   TBH i didn't understand how this whole thing worked until you provided your first review, and then i started to see.  so now i think it will be much more correct.09:42
*** andrein has joined #openstack-fwaas09:43
yushiromfranc213: I see.  I also put the comment that is easy to understand :)09:45
*** andrein has quit IRC10:07
*** andrein has joined #openstack-fwaas10:11
*** andrein has quit IRC10:15
*** andrein has joined #openstack-fwaas10:16
mfranc213yushiro: yes, your comments were extremely helpful.10:18
mfranc213yushiro: do you understand why the commands are listed in the order they are (insert rule, show policy details, update policy, etc.)?10:22
yushiromfranc213: hmm, I think the order is same as api-ref/source/v2/fwaas-v2.inc.  How about moving these sections?10:23
mfranc213yushiro: yes, that is where the order is taken from; i'm sorry my question was ambiguous.  what i meant, really, was: would it be okay with the community if i changed these sections around?10:25
mfranc213yushiro: i'm going to go ahead and do it.10:25
yushiromfranc213: Ah, I just understood what you mean.10:26
yushiromfranc213: Sorry, I don't know.  I watched other resources API ref, they weren't ordered at all..10:29
mfranc213yushiro: thank you.  i will order them and we'll see what people have to say :)10:29
yushiromfranc213: IMO, a title explains (fwaas, firewall_groups, firewall_policies, firewall_rules).  So, how about aligning it?10:30
mfranc213yushiro: yes, good idea.  that's what i'll do.10:31
mfranc213yushiro: i had a couple of questions for you on the PS if you have time to look.  also, i wonder if you might be able to get me the JSON for some of the commands? if you don't have time, then don't worry.10:31
*** andrein has quit IRC10:32
yushiromfranc213: Sure.  Is it maybe the JSON for firewall_group?( ports is missing)10:33
mfranc213yes, that's one of them.10:33
mfranc213and the sample firewall-policy-show-response.json doesn't show firewall_list and i think that may be wrong.10:34
yushiromfranc213, OK.  Let me explain about firewall-group JSON.10:35
mfranc213yushiro: excellent.10:35
yushiromfranc213: This is fwaas-v2 bug. I filed a bug report(https://bugs.launchpad.net/neutron/+bug/1640395)10:35
openstackLaunchpad bug 1640395 in neutron "Missing 'ports' attribute when GET firewall-groups" [Low,Confirmed] - Assigned to Sridar Kandaswamy (skandasw)10:35
yushiromfranc213: 'ports' attribute includes when POST/PUT as response param.  However, currently, GET(list, show) result doesn't include 'ports'.10:36
mfranc213yushiro: ahhh!  how do you think i should handle this?  should i mark it in the api-ref as a bug?  or just not mention it?  (just to confirm with you: we are talking about GET /v2.0/fwaas/firewall_groups/{firewall_group_id} ?)10:37
mfranc213s/not mention it/not mention that variable as being in the response10:37
yushiromfranc213: I think that api-ref should be included 'ports' as a response parameter for all methods GET(list, show),POST and PUT firewall-group.10:39
yushiromfranc213: Currently, SridarK is trying to fix above bug.10:39
mfranc213yushiro: okay, that's what i'll do.10:39
*** andrein has joined #openstack-fwaas10:40
mfranc213yushiro: neither firewall-policy-show-response.json and firewall-policy-update-response.json contain the firewall_list variable, but i think they both should.  what do you think?10:40
yushiromfranc213: hmm, is it 'firewall_rules' ?10:41
mfranc213yushiro: no, firewall_rules is a separate variable.  my understanding is that firewall_list is the list of firewall (groups) that a policy is attached to.  you'll see that this is part of the response in insert-rule-in-policy.  see https://review.openstack.org/#/c/391338/7..8/api-ref/source/v2/fwaas-v2.inc@8610:44
yushiromfranc213: I checked it.10:50
mfranc213yushiro: what did you find?10:51
yushiromfranc213: 1st:  In current source code, 'firewall_list' is used only fwaas-v1.10:54
*** andrein has quit IRC10:54
yushiromfranc213: 2nd: In fwaas-v2 SPEC[1], the response params for 'insert rule' is same 'GET/PUT firewall_policy'  [1]http://specs.openstack.org/openstack/neutron-specs/specs/newton/fwaas-api-2.0.html10:54
yushiromfranc213: Please let me investigate more..10:56
*** andrein has joined #openstack-fwaas10:57
*** andrein has quit IRC10:57
*** amotoki has joined #openstack-fwaas10:58
*** hoangcx has quit IRC10:59
mfranc213yushiro: thank you.10:59
*** korzen has joined #openstack-fwaas11:07
mfranc213yushiro: do you know if the id, name, and description in firewall-policy-insert-rule-response.json are for the policy or the rule?  the response contains firewall_rules and audited, which are are properties of the policy, but all the other variables in the response could be properties of either the rule or its policy.11:07
mfranc213yushiro: and i have the same questions about firewall-policy-remove-rule-response.json11:08
yushiromfranc213: id, name and description is for firewall-policy.11:10
mfranc213yushiro: thank you.11:10
yushiromfranc213: it's same as remove-rule-response.11:10
mfranc213yushiro: thank you.11:10
*** amotoki has quit IRC11:43
*** amotoki has joined #openstack-fwaas12:13
*** amotoki has quit IRC12:28
korzenhi, is there fwaas team meeting in 15 minutes?12:45
*** amotoki has joined #openstack-fwaas12:46
korzenhi SridarK, ^ ?12:49
yushirokorzen, Long time no see from Barcelona summit :)  Unfortunately, the weekly meeting time has not decided yet correctly.12:57
korzenyeap, hi yushiro12:59
korzenok, I was hoping to join todays meeting13:00
yushiroSure!13:00
yushiroping mfranc21313:00
mfranc213yushiro hello13:05
yushiromfranc213: Sorry for late. Let me talk about 'firewall_list' for 'insert/remove_rule'13:07
mfranc213yushiro: sounds good13:07
yushiroIn fwaas-v2, there is no attribute 'firewall_list' in firewall-policy.13:08
mfranc213yushiro: excellent.  i will remove that everywhere i see it.13:08
yushiroHere is a result for insert_rule and remove_rule.  http://paste.openstack.org/show/588549/13:08
mfranc213yushiro: nice i will put this into the PS.13:09
yushiroSource code point of view, there is no DB to store a relation b/w firewall_group and firewall_policy  because firewall_group stores them as "ingress_firewall_policy_id" and "egress_firewall_policy_id".13:10
yushiroTherefore, 'firewall_list' is not necessary.13:10
mfranc213yushiro: that makes sense. thank you for figuring this out.13:12
*** vhoward has joined #openstack-fwaas13:12
*** amotoki has quit IRC13:17
mfranc213yushiro: a firewall rule might have a null ip_version, correct?13:22
yushiromfranc213: A default value of ip_version is 4(integer), and either 4 or 6.13:25
yushiromfranc213: If a user doesn't specify 'ip_version', it is set 4 by default[1]13:27
yushiro[1] https://github.com/openstack/neutron-fwaas/blob/master/neutron_fwaas/extensions/firewall_v2.py#L21713:27
mfranc213yushiro: when a firewall rule applies to any ip address coming from a particular port, what should the ip_version be set to?13:27
yushiromfranc213: ip_version should align with ip address(source_ip_address or destination_ip_address) when creating firewall-rule. A validation exists[2]13:33
yushiro[2]https://github.com/openstack/neutron-fwaas/blob/master/neutron_fwaas/extensions/firewall_v2.py#L21713:33
yushiromfranc213: Please let me know if I don't answer to your question.13:33
mfranc213yushiro: oh i see.   thank you.  sorry you had to answer twice.13:33
yushiromfranc213: np.  I'd like to help for fwaas members.13:34
mfranc213yushiro: :)13:35
mfranc213yushiro: does insert_after mean that the new rule will be inserted immediately after the specified rule, or just anywhere after?13:39
yushiromfranc213: "inserted immediately after the specified rule" is right.13:41
mfranc213yushiro: thank you.13:41
yushiromfranc213: "insert_before" is also "inserted immediately before the specified rule".13:41
mfranc213yushiro: thank you.13:45
yushiromfranc213, :)13:45
korzenI am trying to setup devstack with fwaas, but docs page seems lacking local.conf entries: http://docs.openstack.org/developer/neutron-fwaas/devstack.html13:55
korzencan you share you local conf or point me to working one?13:56
*** vhoward has quit IRC14:00
*** andrein has joined #openstack-fwaas14:06
mfranc213yushiro: what is the default status of a firewall group?  if a user creates a firewall group with no status, what happens?14:11
yushiromfranc213: At first, 'status' can not specify from a user.14:12
mfranc213you mean when the user creates the firewall group, no status can be set?14:13
yushiromfranc213: Sorry. What I wanted to say is that user cannot specify the attributes 'status' when creating a firewall-group.14:13
mfranc213yushiro: okay, is there a default status for a newly created firewall_group?14:14
yushiromfranc213: when user creates firewall-group with no ports,  the 'status' is 'INACTIVE'.14:14
mfranc213yushiro.  thank you.  is there a default admin_state_up for a newly created firewall_group?14:15
SridarKkorzen: hi14:16
yushiromfranc213: Default value of 'admin_state_up' is "True"14:17
SridarKsorry had gone to bed when u pinged me14:17
mfranc213yushiro: thank you.14:17
korzenSridarK, no problem, I was trying to figure out if there is team meeting today14:17
SridarKkorzen: no there was some confusion on our part too - we decided to move the mtg to a more friendly time (urself included)14:18
SridarKwe will make sure to have an email out to the fwaas team as well - so u will get a heads up14:19
SridarKmfranc213: yushiro: +1 on status14:20
*** andrein has quit IRC14:20
SridarKstatus is something that comes back from the server14:20
yushiroYes.14:20
SridarKyushiro: thx for the info on generating from rst file - i meant to ask ur workflow on this also14:25
SridarKi will try it14:25
*** andrein has joined #openstack-fwaas14:25
yushiroOK :)14:25
mfranc213yushiro: i have one more question and then i can push the next PS.  is it the case that the user can supply either the insert_after or the insert_before, but not both?14:34
yushiroIf both 'insert_after' and 'insert_before' specified,  'insert_after' is ignored.('insert_before' wins)14:36
mfranc213yushiro: thank you. and i lied before, because i have one more question :)14:37
mfranc213yushiro:  when there are not yet any rules in a policy, then does the user specify neither a before nor an after?14:38
yushiromfranc213: Sure.14:38
mfranc213yushiro: i lied again because i realize another question: what happens if a user specifies a before or an after that doesn't exist on that policy?14:38
SridarKmfranc213: i believe we will raise an exc on that14:50
SridarKhttps://github.com/openstack/neutron-fwaas/blob/master/neutron_fwaas/db/firewall/v2/firewall_db_v2.py#L31614:50
yushiromfranc213: 1st, Yes, Sridar is correct.  It happens 400 Bad Request.14:50
mfranc213thank you SridarK.  yushiro, i will push the PS in a minute or two.  i'm sorry it's so late in the evening for you.14:51
yushiromfranc213: 2nd,14:51
yushiromfranc213: ah, sorry. it is same question.14:51
yushiromfranc213: when insert_rule, if user specified firewall_rule_id which is already associated the policy, 409(Conflict)[3] occurs.14:53
yushiro[3]https://github.com/openstack/neutron-fwaas/blob/master/neutron_fwaas/db/firewall/v2/firewall_db_v2.py#L30114:53
yushiromfranc213: OK. that's sounds great.14:53
mfranc213yushiro and sridark: okay new PS is up.  yushiro thank you for answering a million questions :)14:56
SridarKmfranc213: thx14:56
yushiromfranc213: You're welcome :)14:56
*** korzen_ has joined #openstack-fwaas14:58
yushiroSridarK: Sorry for late. I just updated CLI patch(https://review.openstack.org/#/c/351582/)15:01
*** andrein has quit IRC15:01
SridarKyushiro: ok thx - no prob i just woke up some time ago :-) So will look into it in a few hours15:02
yushiromfranc213, SridarK I'll go home now :)  See you today(It's 0:02 JST)15:02
mfranc213yushiro: goodnight.15:02
SridarK:-)15:02
SridarKGN yushiro15:02
yushirogood night~ :)15:03
*** yushiro has quit IRC15:03
*** andrein has joined #openstack-fwaas15:06
*** vhoward has joined #openstack-fwaas15:09
*** diogogmt has quit IRC15:13
*** andrein has quit IRC15:35
*** korzen has quit IRC15:36
*** andrein has joined #openstack-fwaas15:39
*** andrein has quit IRC16:14
*** andrein has joined #openstack-fwaas16:21
*** andrein has quit IRC17:21
*** andrein has joined #openstack-fwaas17:26
*** mickeys has joined #openstack-fwaas17:31
*** mickeys has quit IRC17:33
*** mickeys has joined #openstack-fwaas17:33
*** andrein has quit IRC17:45
*** SridarK has quit IRC17:55
*** vhoward has quit IRC18:53
*** amotoki has joined #openstack-fwaas18:55
*** SridarK_ has joined #openstack-fwaas18:55
*** amotoki has quit IRC18:59
*** diogogmt has joined #openstack-fwaas19:03
*** amotoki has joined #openstack-fwaas19:21
*** amotoki has quit IRC19:25
*** vhoward has joined #openstack-fwaas20:08
*** mickeys has quit IRC20:14
njohnstonSridarK_: ping20:47
SridarK_njohnston: pong20:47
SridarK_njohnston: pls go ahead - i wanted to ask u some thing also20:47
njohnstonI just wanted to let you know that I have been having difficulty finding a time for the fwaas team meeting that is at (or generally pretty close) to the time we voted for... the irc channels are occupied then20:48
njohnstonhttps://review.openstack.org/#/c/393793/20:48
njohnstonI don't want to confuse things, it's definitely important that we meet this week since it's the last meeting before the 11/14 O-1 deadline but I am not sure if we should just meet in #openstack-fwaas or what, until we get this sorted out20:49
SridarK_njohnston: ok - i wanted to also sync with u on that, meant to ask u y'day before ur day ended20:50
njohnstonI was out yesterday - I work as an election officer at my local precinct, so I was offline all day20:50
SridarK_no i agree - we should meet, last night yushiro and i chatted a bit in general20:50
SridarK_aha ok20:51
SridarK_or we can do a webex style meeting20:51
SridarK_for tomorrow or late today20:51
njohnstonI am amenable to anything20:52
SridarK_ok we can try for tonight also, but not sure on yushiro, chandan & Sarath's avail20:53
SridarK_we will only hear from them in the eve20:53
SridarK_shall we try for early am tomorrow20:54
SridarK_so it gives them some time to respond20:54
njohnstonsounds good20:54
SridarK_we can target 6am Pacific20:54
SridarK_i will check their resp late night and u can checkin early before i wake up20:55
SridarK_if we need to adjust the timings a bit20:55
njohnstonthanks!20:55
SridarK_let me send an email out20:56
SridarK_on the multinode CI - what else remains to be done ?20:56
njohnstonWell, it is in the experimental queue right now20:58
njohnstonI just tried it on https://review.openstack.org/#/c/391477/ and the multinode jobs both died20:59
njohnstonfailed, I mean20:59
njohnstonnow, I also put in the grenade tests as multinode also20:59
SridarK_njohnston: ok20:59
njohnstonbut they won't mean much until we put in smoke tests21:00
njohnstonwhich is here: https://review.openstack.org/#/c/394607/21:00
*** mickeys has joined #openstack-fwaas21:01
SridarK_sounds good - i will get on this21:04
*** vhoward has quit IRC21:06
*** vhoward has joined #openstack-fwaas21:46
*** amotoki has joined #openstack-fwaas21:50
*** amotoki has quit IRC21:53
*** vhoward has quit IRC22:03
*** SridarK_ has quit IRC23:46

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!