| *** longkb has joined #openstack-fwaas | 00:55 | |
| *** velizarx has joined #openstack-fwaas | 08:16 | |
| *** openstackgerrit has joined #openstack-fwaas | 08:55 | |
| openstackgerrit | Nguyen Phuong An proposed openstack/neutron-fwaas master: Should forward only first accepted packet to table 91 and 92 https://review.openstack.org/591890 | 08:55 |
|---|---|---|
| *** longkb has quit IRC | 10:04 | |
| *** velizarx has quit IRC | 12:35 | |
| *** velizarx has joined #openstack-fwaas | 12:40 | |
| *** yushiro has joined #openstack-fwaas | 13:30 | |
| yushiro | annp, ping | 13:30 |
| yushiro | annping | 13:30 |
| *** annp_ has joined #openstack-fwaas | 13:36 | |
| *** wkite has joined #openstack-fwaas | 13:38 | |
| reedip | annp_ yushiro is pinging you :) | 13:46 |
| yushiro | reedip, Haha, thanks :) | 13:46 |
| annp_ | hi reedip | 13:50 |
| annp_ | hi yushiro | 13:50 |
| yushiro | Hi annp_ . I checked and added more testcases regarding state transition: https://docs.google.com/spreadsheets/d/1Z_3h2Fqffz8Zjr6PHrMxBrx210jM7TtPDAFvSJtUXzg/edit#gid=0 | 13:51 |
| yushiro | Thanks for testing | 13:52 |
| annp_ | yushiro, you're welcome. | 13:53 |
| yushiro | annp_, Some testcases are different 'expected state'. e.g. Update(removing 'egress_policy') | 13:54 |
| yushiro | Let's today's meeting. | 13:55 |
| yushiro | s/Let's/Let's discuss | 13:55 |
| annp_ | yushiro, ah, | 13:57 |
| annp_ | let's me ask tuanvc for updating some incorrect expected state. | 13:57 |
| *** reedip is now known as reedip|afk | 13:58 | |
| yushiro | annp_, Sure. Does he join today's meeting? | 13:58 |
| amotoki | yushiro: osc-lib 1.11.1 was released | 14:00 |
| annp_ | yushiro, let's me check. Today is upgrade meeting. So he may join this meeting | 14:00 |
| yushiro | amotoki, Hi. Wow, OK. I just wonder why pytyon-neutronclient test has passed with no depending osc-lib 1.11.1 :p | 14:01 |
| yushiro | Hi FWaaS folks | 14:01 |
| yushiro | Let's begin the meeting. | 14:01 |
| *** SridarK has joined #openstack-fwaas | 14:01 | |
| SridarK | Hi FWaaS folks | 14:01 |
| yushiro | #startmeeting fwaas | 14:01 |
| annp_ | hi SridarK | 14:01 |
| openstack | Meeting started Thu Aug 16 14:01:34 2018 UTC and is due to finish in 60 minutes. The chair is yushiro. Information about MeetBot at http://wiki.debian.org/MeetBot. | 14:01 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 14:01 |
| *** openstack changes topic to " (Meeting topic: fwaas)" | 14:01 | |
| njohnston | o/ | 14:01 |
| openstack | The meeting name has been set to 'fwaas' | 14:01 |
| yushiro | Hi SridarK | 14:01 |
| annp_ | Hi Nate | 14:01 |
| yushiro | #chair SridarK | 14:02 |
| openstack | Current chairs: SridarK yushiro | 14:02 |
| SridarK | yushiro: today my turn i think ? | 14:02 |
| yushiro | SridarK, Yes, please :) | 14:02 |
| SridarK | ok :-) | 14:02 |
| SridarK | #topic Rocky | 14:02 |
| *** openstack changes topic to "Rocky (Meeting topic: fwaas)" | 14:02 | |
| SridarK | Thx to all for getting the FWaaS Logging patches in | 14:03 |
| yushiro | SridarK, Thank you too. I really appreciate. | 14:03 |
| annp_ | thank you a lot, SridarK. | 14:03 |
| SridarK | No issues at all - yushiro annp_ longkb hoangcx - u all did a great job | 14:04 |
| njohnston | congrats - you did great work! | 14:04 |
| yushiro | Thanks njohnston. :) | 14:04 |
| reedip|afk | \o/ | 14:04 |
| SridarK | Are there any other things that need attention | 14:04 |
| annp_ | SridarK, njohnston: you too. | 14:04 |
| annp_ | SridarK, I'd like to share with you some regression test between firewall and firewall logging | 14:05 |
| SridarK | annp_: yes i was going to ask abt that :-) | 14:05 |
| annp_ | Here is our test result: https://etherpad.openstack.org/p/firewall-logging | 14:05 |
| yushiro | This is the same URL that I wrote down at the agenda. | 14:06 |
| annp_ | yushiro, thanks. | 14:06 |
| annp_ | let's me summary: | 14:07 |
| SridarK | thx annp_ | 14:07 |
| yushiro | OK. | 14:07 |
| SridarK | so we have one issue | 14:07 |
| annp_ | 1. almost case for allow/drop with L3 port work fine. | 14:07 |
| SridarK | sorry annp_ go ahead | 14:08 |
| annp_ | 2. almost case for allow/drop with L2 port if we didn't enable L2 logging extension work fine. | 14:08 |
| annp_ | 3. There one issue related to case when enable L2 logging extension as I declared at case 3 in the link. | 14:09 |
| yushiro | annp_, You mean 'almost' is 'all', right? | 14:10 |
| *** longkb has joined #openstack-fwaas | 14:10 | |
| annp_ | yushiro, yes. | 14:10 |
| annp_ | yushiro, in other word, so far so good. :) | 14:10 |
| longkb | o/ | 14:10 |
| longkb | Sorry, I am late | 14:11 |
| yushiro | longkb, welcome home :) | 14:11 |
| longkb | thanks yushiro :D | 14:11 |
| yushiro | annp_, I see. Ok, that is same understanding. | 14:11 |
| SridarK | so if we have sg logging and fwaas logging enabled we have an issue | 14:11 |
| SridarK | although with fwaas logging we only support L3 | 14:11 |
| SridarK | ports | 14:11 |
| annp_ | SridarK, yes. | 14:11 |
| longkb | +1 SridarK | 14:12 |
| yushiro | SridarK, yes, you're right. | 14:12 |
| annp_ | SridarK, I and longkb already putted patches to fix that | 14:12 |
| SridarK | and u have patches in flight (sorry i had some PTO so not completely on top) | 14:12 |
| SridarK | annp_: +1 | 14:12 |
| annp_ | https://review.openstack.org/#/c/591918/ | 14:13 |
| annp_ | https://review.openstack.org/#/c/591978/ | 14:13 |
| SridarK | got it | 14:13 |
| yushiro | In addition, 1 follow up patch: https://review.openstack.org/#/c/590682/ | 14:13 |
| annp_ | SridarK, yushiro, We also need patch https://review.openstack.org/#/c/590682 to make logging work perfect. :) | 14:14 |
| SridarK | ok thx yushiro | 14:14 |
| yushiro | I think https://review.openstack.org/#/c/590682/ needs to be backported into stable/rocky if possible. | 14:14 |
| SridarK | and annp_ | 14:14 |
| yushiro | Sorry annp_ . | 14:14 |
| yushiro | annp_, We've duplicated :p | 14:14 |
| SridarK | :-) | 14:15 |
| annp_ | yushiro, ah. :) | 14:15 |
| SridarK | ok sounds good we can track these | 14:16 |
| annp_ | yushiro, Do you want to say something regards to some crazy bug at logging topic or later for bug topic | 14:16 |
| SridarK | lets go on to bugs then if we are done here | 14:16 |
| annp_ | SridarK, thanks. | 14:16 |
| yushiro | SridarK, annp_ +1 OK. | 14:16 |
| SridarK | ok | 14:16 |
| yushiro | annp_, I'll explain about this bug :) | 14:16 |
| longkb | got it :D | 14:17 |
| SridarK | #topic bugs | 14:17 |
| *** openstack changes topic to "bugs (Meeting topic: fwaas)" | 14:17 | |
| longkb | oh | 14:17 |
| SridarK | yushiro: pls go ahead | 14:17 |
| yushiro | Regarding annp_ , longkb and tuanvc's great testing, we've clarified known bug | 14:17 |
| yushiro | The bug was 'state transition of firewall group'. | 14:18 |
| longkb | I found another crazy bug on FW Dashboard too: https://docs.google.com/spreadsheets/d/1Z_3h2Fqffz8Zjr6PHrMxBrx210jM7TtPDAFvSJtUXzg/edit#gid=1429860855 | 14:18 |
| yushiro | longkb, Yes, thank you. | 14:18 |
| yushiro | SridarK, This is draft version of testcases for state transition: https://docs.google.com/spreadsheets/d/1Z_3h2Fqffz8Zjr6PHrMxBrx210jM7TtPDAFvSJtUXzg/edit#gid=0 | 14:19 |
| yushiro | I'd like to clarify again about 'state definition of firewall group'. | 14:20 |
| SridarK | ok hmm interesting we dont land up at correct status | 14:20 |
| SridarK | for some updates | 14:20 |
| yushiro | SridarK, Yeah. | 14:21 |
| yushiro | The most important point is 'what is "ACTIVE" state for firewall group?' | 14:22 |
| annp_ | yushiro, +1 | 14:22 |
| yushiro | In my understanding, ACTIVE: has ingress or egress_firewall_policy and has at least 1 port and admin_state_up is 'UP' | 14:22 |
| SridarK | yushiro: yes | 14:22 |
| yushiro | DOWN: admin_state_up is 'DOWN' | 14:23 |
| annp_ | yushiro, SridarK, Is there any document related to fwg state? | 14:23 |
| SridarK | yushiro: yes | 14:23 |
| SridarK | annp_: not sure if we have something | 14:23 |
| yushiro | annp_, In my memory, we've discussed on IRC meeting only since previous cycle. | 14:24 |
| annp_ | SridarK, yushiro, ok. So let's make the document about that | 14:24 |
| SridarK | but basically, INACTIVE means that we dont have a port or policy or both - to distinguish from DOWN | 14:24 |
| SridarK | annp_: +1 | 14:25 |
| yushiro | annp_, +1 | 14:25 |
| yushiro | SridarK, Yes, I agree with you. INACTIVE: has ingress or egress_firewall_policy and no port or no ingress or egress_firewall_policy and at least 1 port and admin_state_up is 'UP' | 14:25 |
| yushiro | ooops, difficult fot document.. | 14:26 |
| amotoki | do we need to reflect admin_state(_up) to status? | 14:26 |
| SridarK | yes some cleanup is needed | 14:26 |
| amotoki | in neutron port, admin_state UP and status ACTIVE means a port itself can work but it is disabled | 14:27 |
| yushiro | amotoki, DOWN ? | 14:27 |
| -amotoki- is looking at the code | 14:28 | |
| amotoki | there is a case where port status is DOWN and admin state is UP | 14:28 |
| amotoki | I might be wrong.... | 14:28 |
| SridarK | I think this needs some cleanup - i just added an item to our list | 14:29 |
| yushiro | current impl, firewall group depended on 'admin_state_up' with own 'status'. If admin_state_up is 'DOWN', then the status of firewall group changed into 'DOWN' | 14:29 |
| yushiro | SridarK, Thanks. | 14:29 |
| annp_ | SridarK, ++ | 14:29 |
| SridarK | amotoki: i think as yushiro says | 14:29 |
| amotoki | SridarK: yeah | 14:29 |
| SridarK | i think we need to look at this more and align better with neutron as well | 14:30 |
| amotoki | there is no clear guideline on what we should change 'status' attr when admin_state is changed.. | 14:30 |
| amotoki | IIRC network and port have different behaviors | 14:30 |
| SridarK | annp_: let me take an action and document current behavior and we start a thread on clean up | 14:30 |
| annp_ | SridarK, yeah.that's sound great! | 14:31 |
| SridarK | we are a bit unique also in what we need to do if a fwg is associated with multiple ports and one of them is down or admin down | 14:31 |
| SridarK | so that area needs some thought too | 14:31 |
| annp_ | SridarK, thanks. | 14:31 |
| yushiro | OK. | 14:32 |
| yushiro | I thought that firewall group was referring router's state transition but it was different.. There is no relation b/w admin_state_up and status for router. | 14:33 |
| SridarK | yushiro: sorry multitasking in another mtg | 14:34 |
| yushiro | In case of router, if 'admin_state_up' is down, the namespace has been removed. If we refer router's behavior, all firewall rules should be removed if we changed admin_state_up into 'DOWN'. That is one example.. | 14:35 |
| yushiro | SridarK, never mind :) | 14:35 |
| annp_ | yushiro, SridarK, I think we can discuss via email | 14:35 |
| yushiro | annp_, +1 | 14:35 |
| SridarK | yushiro: i agree | 14:36 |
| SridarK | here there are bugs and also handling multiple ports case | 14:37 |
| yushiro | Yeah, at first, let's summarize current behavior and sync up with fwaas members. | 14:37 |
| annp_ | yushiro, ++ | 14:38 |
| SridarK | yushiro: +1 | 14:38 |
| yushiro | SridarK, OK, that's all from me :) | 14:39 |
| SridarK | ok sounds good | 14:39 |
| annp_ | longkb, your turn :) | 14:39 |
| longkb | +1 annp | 14:40 |
| longkb | I make a statistic related to FW rules updating from FW Dashboard. Please look at this doc: https://docs.google.com/spreadsheets/d/1Z_3h2Fqffz8Zjr6PHrMxBrx210jM7TtPDAFvSJtUXzg/edit#gid=1429860855 | 14:41 |
| longkb | The value will return to default value if we do not choose again during FW rule updating | 14:42 |
| amotoki | it seems the first step is to check what body is passed as a request to neutron server and what is returned as a response from the neutron API. | 14:43 |
| yushiro | amotoki, +1 longkb I think checking request body is necessary as well. | 14:44 |
| longkb | +1 amotoki, yushiro :D | 14:44 |
| amotoki | longkb: could you file a bug to neutron-fwaas-dashboard so that all can track it? | 14:45 |
| longkb | amotoki: sure. I will report this bug tomorow :D | 14:45 |
| SridarK | +1 | 14:46 |
| annp_ | +1 | 14:46 |
| yushiro | SridarK, Can I put bug-report regarding state transition as well? | 14:46 |
| SridarK | longkb: good catch - possibly some regression | 14:46 |
| longkb | thanks SridarK | 14:47 |
| SridarK | yushiro: we shd sync up on the issue with HA/DVR Ports | 14:49 |
| yushiro | #link https://bugs.launchpad.net/neutron/+bug/1759773 | 14:50 |
| openstack | Launchpad bug 1759773 in neutron "FWaaS: Invalid port error on associating L3 ports (Router in HA) to firewall group" [Undecided,Confirmed] - Assigned to Sridar Kandaswamy (skandasw) | 14:50 |
| SridarK | as we last discussed we need to get some clarification from the L3HA team | 14:50 |
| yushiro | SridarK, Yes. However, I haven't discussed with them yet.. | 14:51 |
| SridarK | yushiro: in ur last round of tests - it seemed like the rules were not applied appropriately | 14:51 |
| SridarK | yushiro: ok no issues - lets discuss more offline | 14:52 |
| SridarK | I think thats all we had on this topic | 14:52 |
| SridarK | lets move on | 14:52 |
| yushiro | SridarK, yes. Even if we could associate FWG with HA port, the firewall rule has applired into 'standby' router. | 14:52 |
| SridarK | yushiro: +1 | 14:52 |
| SridarK | it seemed like this is something we need to handle | 14:53 |
| SridarK | #topic Open Discussion | 14:53 |
| *** openstack changes topic to "Open Discussion (Meeting topic: fwaas)" | 14:53 | |
| yushiro | SridarK, Yes, whether we should handle or abstruct from L3-HA layer. | 14:53 |
| SridarK | yushiro: yes exactly | 14:54 |
| yushiro | Tomorrow, I'll send e-mail to ML about this issue. | 14:54 |
| yushiro | #action yushiro will send ML about L3-HA issue | 14:54 |
| SridarK | yushiro: sounds good - or we can attend the L3 mtg and discuss there | 14:55 |
| SridarK | i think that may be more useful - so we can debug it quickly with the L3 team | 14:55 |
| yushiro | SridarK, yes. Maybe after this meeting ? will check it :) | 14:55 |
| SridarK | yushiro: ok | 14:56 |
| amotoki | IIRC there is no L3 meeting this week | 14:56 |
| SridarK | oh yes it was cancelled | 14:56 |
| SridarK | yushiro: then next week | 14:56 |
| yushiro | Tuesday at 1500 UTC in #openstack-meeting | 14:56 |
| amotoki | http://lists.openstack.org/pipermail/openstack-dev/2018-August/133129.html | 14:56 |
| yushiro | SridarK, OK, thanks. | 14:56 |
| SridarK | yushiro: i will ping u during ur day time and lets discuss b4 we attend the L3 mtg | 14:57 |
| yushiro | amotoki, Thanks akihiro | 14:57 |
| yushiro | SridarK, OK, thanks. | 14:57 |
| SridarK | i think it shd be quick IMO - we just need a specific clarification | 14:57 |
| SridarK | ok if nothing else we can close out ? | 14:57 |
| SridarK | Thx all for joining | 14:58 |
| SridarK | have a great week | 14:58 |
| yushiro | SridarK, Yes, we'are asking from Chris and Hyunsun | 14:58 |
| yushiro | Thanks all. | 14:58 |
| annp_ | SridarK, you too | 14:58 |
| SridarK | #endmeeting | 14:58 |
| *** openstack changes topic to "Queens (Meeting topic: fwaas)" | 14:58 | |
| openstack | Meeting ended Thu Aug 16 14:58:51 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 14:58 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-08-16-14.01.html | 14:58 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-08-16-14.01.txt | 14:58 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/fwaas/2018/fwaas.2018-08-16-14.01.log.html | 14:58 |
| annp_ | Thanks all, bye | 14:59 |
| yushiro | Chris... Chris Wright!! Aha, my friends :) | 14:59 |
| longkb | bye guys :d | 14:59 |
| *** annp_ has quit IRC | 14:59 | |
| yushiro | SridarK, do we need to reply on launchpad regarding L3-HA ? | 14:59 |
| SridarK | yushiro: hmm ok lets talk during ur morn | 15:00 |
| SridarK | so we have some plan and we can update accordingly | 15:00 |
| yushiro | SridarK, OK. So, we should reply the results after discussing L3-meeting, shouldn't we? | 15:00 |
| SridarK | my concern is we rush and land up opening a security hole | 15:01 |
| SridarK | yushiro: +1 | 15:01 |
| SridarK | I will ping u during ur morn time | 15:01 |
| SridarK | lets discuss some more | 15:01 |
| yushiro | SridarK, That's correct. Thanks. So, I'll wait for this reply. | 15:02 |
| SridarK | yushiro: also we can discuss the current patches in flight | 15:02 |
| SridarK | for logging | 15:02 |
| *** longkb has quit IRC | 15:02 | |
| SridarK | in terms of what needs to land in stable/rocky | 15:02 |
| SridarK | ok it is very late for u - lets talk more during ur morn | 15:02 |
| SridarK | GN yushiro | 15:03 |
| yushiro | SridarK Thanks. gn :) | 15:03 |
| SridarK | bye | 15:03 |
| yushiro | ping doude | 15:04 |
| *** yushiro has quit IRC | 15:08 | |
| *** wkite has quit IRC | 15:10 | |
| openstackgerrit | Akihiro Motoki proposed openstack/neutron-fwaas-dashboard master: Drop nose dependencies https://review.openstack.org/592539 | 15:11 |
| *** velizarx has quit IRC | 15:11 | |
| *** yushiro has joined #openstack-fwaas | 15:17 | |
| yushiro | LimeChat入れてみました。やっと日本語打てます | 15:18 |
| yushiro | Oops, sorry | 15:18 |
| *** yushiro has quit IRC | 15:19 | |
| *** longkb has joined #openstack-fwaas | 15:21 | |
| *** longkb has quit IRC | 15:22 | |
| *** longkb has joined #openstack-fwaas | 15:34 | |
| openstackgerrit | Akihiro Motoki proposed openstack/neutron-fwaas-dashboard master: Drop nose dependencies https://review.openstack.org/592539 | 15:47 |
| *** longkb has quit IRC | 16:00 | |
| *** longkb has joined #openstack-fwaas | 16:05 | |
| *** SumitNaiksatam has joined #openstack-fwaas | 16:20 | |
| *** longkb has quit IRC | 16:28 | |
| *** SridarK has quit IRC | 16:31 | |
| *** openstackgerrit has quit IRC | 16:49 | |
| *** doude has quit IRC | 17:31 | |
| *** njohnston has quit IRC | 23:27 | |
| *** njohnston has joined #openstack-fwaas | 23:28 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!