17:00:12 #startmeeting service_chaining 17:00:14 hi 17:00:17 Meeting started Thu Apr 7 17:00:12 2016 UTC and is due to finish in 60 minutes. The chair is Cathy__. Information about MeetBot at http://wiki.debian.org/MeetBot. 17:00:18 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 17:00:21 The meeting name has been set to 'service_chaining' 17:00:29 Hello 17:00:33 hello 17:00:38 hi everyone 17:01:10 hello 17:01:11 hi 17:01:16 hi 17:01:21 s3wong: scsnow LouisF hi 17:01:34 let's start 17:01:40 Cathy__: your nic keeps on changing :-) 17:01:44 Hi 17:01:51 doonhammer: hi 17:02:02 doonhammer: hi 17:02:05 hi 17:02:10 s3wong: really? I don't know why 17:02:24 Cathy__: register a nick for you 17:02:32 hi everyone 17:03:00 vikram: OK, will do 17:03:04 hi raofei 17:03:12 #topic Source port specification in the FC 17:04:08 Let me try to explain why we need the source port in the SFC FC specification 17:04:18 hi iyamahat vishnoianil 17:04:29 Cathy__, hi 17:05:41 With the source port specified, we know where to instantiate the FC 17:06:04 Cathy__, hi 17:06:25 Cathy__: Why we can't put it as a part of the chain 17:06:25 That will enhance the performance 17:06:41 Cathy__: I mean in service_chain_param 17:07:04 vikram: I guess we can consider that 17:07:25 Cathy__: Doing so we can keep FC generic 17:07:41 vikram: it is used to select traffic entering the chain so the FC is the right place to have it 17:08:21 LouisF: Agreed.. but this kills generic design for FC 17:08:34 vikram: +1 17:08:37 SFC spec do have source port as a match attribute for classifier, isn't it? 17:08:40 raofei: pcarver s3wong what's your thought? 17:08:42 the FC will evolve and have other parameters such as DSCP, vlan-id etc 17:08:51 vishnoianil: yes 17:09:07 LouisF: The problem here is we are making Src port as mandatory 17:09:18 Cathy__: I'm definitely concerned about putting SFC specific info in the FC because we would like the FC to be generic across things other than SFC 17:09:22 Cathy__: source port as in Neutron port? I don't even know FC has a networking location association... 17:09:25 In current way, the user can specify that all traffic coming from a source port will go through the chain 17:09:32 there was discussion on a common FC some months ago but that work has not progressed 17:10:39 stupid question, does FC == Flow Classifier? 17:10:41 pcarver: a port is not really SFC specific - is likely can be used by other features such as qos 17:10:43 Also, we need to maintain a clean separation between the abstract design of the API and the particular needs of one implementation. So we should ask whether the source port is required for all SFC drivers or just the OvS agent based one. 17:10:47 trozet: yes :-) 17:10:49 trozet:bingo 17:10:50 Cathy__, sorry i missed the initial context, are we talking about source port (L4 ) or "Ingress Port" ? 17:11:06 source port 17:11:07 since the source port can be used as a FC rule to classify the traffic, I am not sure if it is appropriate to move it out of the FC 17:11:15 vishnoianil: yeah, that was my question as well :-) 17:11:22 I have the same question as vishnoianil 17:11:32 vishnoianil: neutron src port 17:11:33 vishnoianil: s3wong source port in the FC 17:11:36 I'm assuming we're talking Neutron port where VM attaches 17:11:45 not TCP/UDP port 17:11:46 pcarver: +1 17:11:51 pcarver: yes 17:11:57 pcarver: yes, that's what I was thinking 17:12:22 Cathy__: I didn't get your reasoning 17:12:37 I think the issue is when you want to SFC to operate at a service/admin role, you want to be able to classify based on traffic from specific neutron networks or ports 17:12:37 I understand that for the OvS based implementation we need to know where to put the flow rules, but I'm not sure that's a generic SFC API requirement 17:12:41 pcarver: yes, but it is not the source port of a SF VM, it is a source port to identify traffic coming to the chain 17:12:49 Cathy__: wound't ingress network port part of FC? 17:12:54 Cathy__: since the source port can be used as a FC rule to classify the traffic, I am not sure if it is appropriate to move it out of the FC : My proposal is not to mandate this field 17:12:56 * wouldn't 17:12:57 i think with that, it gets bit vague, because "ingress port" basically considered as a L0 match criteria 17:12:57 trozet: yes 17:13:20 Cathy__: so with RBAC, doesn't that enable this type of behavior? 17:13:38 Thinking in terms of physical switches and firewalls for a moment. Normally an ACL or ruleset is defined and then it is applied to one or more (physical) ports 17:13:50 vishnoianil: yes it is a match on packet metadata not packet contents 17:13:58 s3wong: it is the ingress network port of a traffic flow which is currently part of the FC. 17:14:09 vikram: as you said, given that ingress Neutron port should be part of classification, shouldn't it be part of FC? Why would you opposed to including it as part of FC? 17:14:43 i believe src port made mandatory to check does traffic coming from same compute host or not 17:14:53 there are use cases where all traffic to/from a VM port must be steered into a SFC 17:14:56 s3wong: classification can be done for a stream of traffic coming from / to a neutron src 17:15:10 shouldn't we also include neutron network? and not just VM port here? 17:15:21 vishnoianil: our matching criteria is very large, can be up to L7 17:15:45 trozet: initial design is chaining ports 17:16:04 there are cases where a service operator wants all tenant traffic from a specific network to go through an admin chain before going to an external network, it makes sense to define one chain there in the admin space and not for every tenant 17:16:08 Cathy__, then in my opinion it make sense to me, i don' think it's breaking generic nature of the API 17:16:12 trozet: which address all the scenarios 17:16:14 vikram: i'm not talking about chaining, im talking about classification 17:16:53 trozet: Ok.. so you mean adding a param net in the FC? 17:17:06 vikram: yeah network and ports both in FC 17:17:26 trozet: ports already exist in the FC 17:17:28 trozet: I understand your point. Yes that is a use case we need to cover. Could one or a group of source ports represent that network whose traffic go through the chain? 17:17:42 trozet: anyways it can be done.. if we already support ports.. at the end nets are collection of ports 17:17:43 vikram: of course one would only be able ot match on network/ports outside of his tenant if he had proper admin rights given by RBAC I think 17:17:46 Cathy__, LouisF i think classification in general should provide all the attribute on which you can steer the traffic, except it enforces which attribute to be made mandatory or enforces any dependency between the matching attributes 17:17:58 trozet: I got to be honest, on the plumbing side, I don't know how to render 'network' into something like OVS flow table... subnet? VLAN? 17:18:19 trozet: If we can use existing way to cover other scenarios, I would rather not add more and more primitives in the FC 17:18:23 s3wong: +1 17:18:31 s3wong: in ODL its matched on in flows 17:18:34 s3wong: in OVS 17:18:47 vishnoianil, I am not suggesting to remove the src port attribute 17:18:54 s3wong, ideally it should be associated subnet, because it's lower level construct then network 17:19:04 s3wong: i think its part of hte tunnel ID for vxlan, but need to confirm 17:19:08 network has one to many associativity with subnet 17:19:09 vishnoianil, Just not to mandate it 17:19:14 s3wong: good point 17:19:46 Cathy__, vikram. LouisF: how about this then? If a source port is specified in the FC, we know where to put it; if not, all traffic is subjected to classification and matching? 17:19:53 vikram, okay, i think mandating it might create a problem 17:20:19 s3wong: that is existing way:-) 17:20:34 OK, so now the issue is "mandatory" or not 17:20:36 vishnoianil, Yup.. 17:20:50 Cathy__: +1 17:20:50 Cathy__: I see --- how the discussion is much more clear :-) 17:20:54 * now 17:21:03 Cathy__, "ingress port" actually scope your traffic to the specific port, so any classification you will specify after specify ingress port, will be scoped to that ingress port only 17:21:07 it can made optional in the FC with the caveat that in certain implementations there may be performance impact 17:21:10 raofei: I remember you have some point on this. 17:21:43 LouisF: For this one can provide this info using service_chainparam 17:21:46 Cathy__: in that context, I actually side with vikram here... we want the FC to be flexible enough to be specified as "all traffic from all port should be matched against this" 17:21:54 LouisF: For this one can provide this info using service_chain_parameter 17:22:21 so if make ingress port mandatory, to specify classification at switch level you will have to cater traffic each port basis and that can lead to flow explosion at the device level :) 17:22:43 LouisF: +1, exactly! 17:22:50 so from reading this discussion, matching on port is already supported, the discussion is whether to make it mandatory or not? 17:23:03 trozet: yes 17:23:06 trozet: correct 17:23:15 trozet: +1000 17:23:23 trozet: yep, my understanding as well (finally, after some long discussions) :-) 17:23:31 :( 17:23:33 why would you want to make it mandatory? 17:23:38 that doesn't make much sense to me 17:23:46 trozet, In my personal opinion, that's not good idea 17:23:47 there is a reason we later made it mandatory. I am still thinking about why. 17:24:14 Cathy__: IIRC, it was for identifying the flow on the other compute node 17:24:17 Cathy__: was that simply because then you know where to place the classifier flow? 17:24:30 trozet: no 17:24:56 it is currently mandatory, if it is made optional then the OVS rules for matching must be installed on all OVS switches 17:25:00 vikram: yes, something like that. I remember I described the scenario in one of our previous IRC meeting. 17:25:04 Cathy__: If the chain span across multiple nodes then we need to identify th flow 17:25:14 trozet: +1 17:25:27 Cathy__ , i remember , to find Compute node belongs to same tenent nw or different tenent (or OVS rather ) 17:25:29 coming from chain / it's normal packet 17:25:47 LouisF: yeah they should be on every OVS if not specific to a port 17:25:57 trozet: yep 17:26:12 LouisF: which probably is the user intent in this context (that the flow rules should be matched on all OVS switches) 17:26:48 s3wong: yes 17:27:17 So if the same flow comes back to SF VMs which happen to run on the same computer node, we need a way to distinguish this since depending on where the flow comes, the next hop is different. 17:27:18 so I guess the question is, who in the room wants to keep it mandatory? 17:27:36 trozet: +1000.. and where to mandate this 17:29:00 My proposal is we can pass the src port info "[--chain-parameters ]" here, if needed 17:29:02 If I remember correctly, we decided to use the source port as a way to distinguish the traffic entering the chain from the traffic that loop back to the compute node 17:30:28 Cathy__: I think it is perfectly fine if we happen to render the chain / FC into flow rules with source port context --- so that is something we (drivers) can do, without subjecting users to specify a source port 17:31:31 s3wong: I didn't get you 17:31:42 Cathy__: yeah if you have to specify port in classifier so you know that a return packet to OVS shouldnt be reclassified and is still part of the chain--that seems to me like you are fixing a chain problem by restricting the classifier 17:32:05 Cathy__: the chain flows should know where the packet is in the chain, and not restrict the classifier IMO 17:32:14 vikram, Cathy__: in your example, say SF1->SF2->SF3, a FC matches traffic to SF1 17:32:51 trozet: could you calrify what you mean by "chain flows should know where the packet is in the chain"? 17:33:43 vikram, Cathy__: if say SF3 happens to be in the same node as SF1, we can render a source port on the return traffic from SF2 -> SF3 with the same flow rules 17:34:03 trozet: return packets from the egress port of SF are re-classified on the current design 17:34:22 yes, s3wrong, for one scenario, service path is sf1->sf2->sf1->sf3, if we don't assign the source port, it's difficult to distinguish the return the traffic. 17:34:28 trozet: when the flow loops back to the same vSwitch that the traffic originally enters the chain, how does the vSwitch determine the different next hop? 17:34:49 Cathy__: well NSH solves that problem 17:34:49 the ovs driver/agent acts like a sfc proxy device 17:35:05 trozet: yes 17:35:11 Cathy__, LouisF trozet , are we talking of this specific problem, when we don't use NSH encap? 17:35:18 trozet: ;) Reality is tough 17:35:19 trozet: if we use NSH, we can use the service_index to solve it 17:35:22 Cathy__: I'm not as familiar with how you are doing SFC in networking-sfc 17:35:36 vishnoianil: technically OVS has no NSH support 17:35:47 vishnoianil: yes 17:35:50 vishnoianil: independently of what ODL SFC is using :-) 17:35:53 vishnoianil , its not included to ovs officially 17:36:01 s3wong, agree, but in ODL we do run OVS with NSH (that's not official version) 17:36:07 trozet: when we proposed the SCH spec which merged with NSH, we considered this case and service_index can be used for solving it 17:36:20 raofei: but the driver/agent matches on the egress port so is can distinguish return traffic from that originating from the source port 17:36:23 s3wong: :) let's not go down that road... it will be in a few months 17:36:29 s3wong, vishnoianil mohankumar__ agree 17:36:52 raofei: in that case, how would user specify source port for SF1->SF2 vs SF1->SF3? 17:36:58 vishnoianil: does odl support nsh-aware SFs? 17:37:02 Time is really draining fast ;) 17:37:33 Cathy__: so in current networking-sfc implementation, how do you distinguish a packet that is part of a chain versus regular tenant traffic? 17:37:33 LouisF, ODL can support NSH, but having SF NSH aware is kind of out of scope for ODL 17:38:01 trozet: https://github.com/openstack/networking-sfc/blob/master/doc/source/ovs_driver_and_agent_workflow.rst 17:38:03 trozet: through the FC. Not sure if I understand your question properly 17:38:22 vikram: the beauty of explaining things via IRC ... a whiteboard session would have explained the problem in 10 minutes :-) 17:38:24 vishnoianil: so the odl driver for sfc must do re-classification of packets returned from each SF 17:38:27 If OVS officially supports NSH, then we do not need this "mandatory". 17:38:49 s3wong :) 17:39:11 s3wong, Cathy__ trozet LouisF , i think won't it be good if we take this topic to mailing list, probably that will bring us to conclusion faster :), just an opinion 17:39:20 Cathy__: it depends on whether the SF is nsh-aware and the need to do reclassifcation on return traffic 17:39:32 trozet: Do you mean that OVS will officially support NSH in a few months? About what time will NSH be merged into OVS officially? 17:39:46 Cathy__, Yes, 2.6 should have support for NSH 17:39:54 Cathy__: My opinion is we should resolve the issue by disturbing a generic API 17:40:13 vishnoianil: great! when is that? 17:40:15 vishnoianil: really? was it finally merged? I've seen the outstanding patch there forever... 17:40:22 agree with Louis 17:40:24 vikram: not sure what you mean 17:40:46 vikram, do you mean "by NOT disturbing" ? 17:41:03 vishnoianil: who is doing that work? 17:41:27 vishnoianil, LouisF: Not imposing a restriction on a generic API 17:41:49 Maybe we can put this in the back burner for now and if we can get NSH support soon, then we will remove the "mandatory" at that "soon" time. 17:41:49 what we are having today by making the src port as a mandatory field 17:41:52 Cathy__: ok now I see you are using the MPLS header to track if its part of the chain 17:42:07 vikram: you mean by making the src port mandatory in the FC? 17:42:11 trozet: You are fast :) 17:42:13 trozet: yes, that is a place holder for future NSH header 17:42:17 Cathy__: so then what loop packet are we talking about that gets accidentally reclassified? 17:42:30 Cathy__: egress from the chain? 17:42:39 LouisF: I am half sleepy now.. ;) I mean not to make it mandatory 17:42:53 LouisF: It's time to bed :( 17:43:12 vikram: thanks for joining 17:43:54 trozet: not egress from the chain. Think about if all SF VM runs on the same Computer Node (vSwitch) 17:43:58 Cathy__ : i agree , to remove mandatory once we ve NSH suppport 17:43:58 LouisF: Please forgive if I sound stupid today .. Tiering day 17:44:12 mohankumar__: Ok, good. 17:44:27 vikram: mohankumar__ thanks for joining at your mid night! 17:44:30 Cathy__: Does ODL has any issues ? 17:44:33 trozet: the end-of-chain case is ok because the ovs driver/agent reclassifies on the egress port of the last SF 17:44:45 raofei: Thanks to you too at your 1am time !!! 17:45:05 Cathy__: Does ODL has any issues if we continu src port as mandatory in the FC API? 17:45:07 Cathy__: yeah so if you have multiple SF on the same node, when the packet from SF1-->OVS-->SF2 that is where you are worried about a reclassification problem if you dont specify a port? 17:45:12 raofei: +1000 17:45:26 vikram: not that I am aware of 17:45:47 trozet, vishnoianil, any inputs? 17:46:17 vikram: yeah it's not good 17:46:34 vikram: is it an issue for the onos driver? 17:46:38 i don't remeber for ONOS 17:46:41 so SourcePort->OVS->SF1->OVS->SF2 17:47:04 but I remember we were able to do it without src port as well 17:47:10 virkam: then if you want to match on tcp port 80 traffic, you have to create N number of classifiers for every port, or you just ignore any match port criteria from networking-sfc in the ODL driver 17:47:30 If no source port, then FC rules with no SourcePort->OVS->SF1->OVS->SF2 17:48:01 Cathy__: so your ingress packet from SF1, dont you have flows tha match ont eh MPLS header to decide if the packet is still part of the chain? 17:48:41 trozet: Agreed.. but frankly speaking classifier should be deployed a separate node and all the traffic should pass through it 17:49:27 how about this? I will send out a diagram describing this scenario. We have spent enough time on this discussion:-) I think a diagram will explain the problem easier. 17:49:46 vikram: that depends on the usage scenario - for mobile Gi LAN that would be correct, but the DC is different 17:50:00 trozet: yes, exactly what I was thinking... the match from unencapulated packet to SF1 and the second time it hits SF1 should be different 17:50:04 LouisF: Yes.. I realized 17:50:06 vikram: Can't assume traffic will be small enough to all pass through a single node 17:50:30 pcarver: make sense.. 17:50:33 trozet, SF on same SFF problem, why we can't solve that problem using NXM-REG? 17:50:40 Really learning SFC now ;) 17:51:02 Cathy__: so the issue is you dont encap the tunnel header if you are on the same OVS node, so you don't know the packet is part of the chain? 17:51:35 trozet: for your question, yes ONOS currently installs flow for N ports separately 17:51:38 trozet: yes, no need for tunnel header since it will not go through the tunnel 17:51:42 vishnoianil: for multiple SFs on the same SFF (OVS) it is not a problem beacuse the rules will match on the egress port of each SF 17:52:00 LouisF, okay 17:52:19 LouisF, reading trough chat with your max speed,sometime confuses you :P 17:52:53 vishnoianil: yeah maybe im sure shague would have a good fix for this 17:53:21 trozet, yeah 17:53:29 vishnoianil: it will match on the egress port of each SF, so we need a source port to distinguish traffic on the source port from traffic on the egress port of each SF 17:53:50 trozet: it would be good to find out how odl handles the non-nsh-aware SF 17:54:15 with NSH support, this issue is gone. 17:54:39 Cathy__: agree, for nsh-aware SFs 17:54:50 Cathy__: so cant you match on ingress port for the chain, rather than ingress port with the classifier? 17:55:13 Cathy__: if you just make the chain rule match on SF1 in_port 17:55:33 Cathy__: but then what if that VNF is part of multiple chains, how do you know what is the next hop? 17:55:39 since you have no header 17:55:40 trozet: the "ingress port" for the chain is the ingress port of the FC 17:55:55 LouisF: i mean in_port from the previous VNF in the chain 17:56:38 trozet: even if we have to reclassify, that is OK --- as long as the rules are replicated with the ingress port added ... I still think driver is a right place to do this, as opposed to having user specify a port 17:57:02 trozet: we still need to distinguish the traffic on the source port which is before the SF1, from the traffic on SF1 in_port 17:57:04 s3wong: yeah thats a good point 17:57:13 trozet: by egress port from a SF port-pair would be the OVS in_port 17:57:15 s3wong: just making the OVS networking-sfc driver apply the classifier to each port 17:57:39 trozet: since all the traffic is handled by the same Compute Node and vSwitch 17:58:32 Cathy__: traffic into chain is FC, traffic to SF1 is in_port SF1 + FC, which the driver needs to be smart enough to add... does that work? 17:59:02 trozet: the VNF re-classify will discriminate the chains when multiple chains use that VNF 17:59:10 s3wong: that seems a good way. let me think about it more 17:59:21 Hi folks, time is up. 17:59:40 I have a question regarding currect SFC implemenation in OVS driver. Where can I ask it? 17:59:40 :) 17:59:41 good discussion! 17:59:44 Let's continue the discussion in next meeting. We only cover one topic today:-) 17:59:52 scsnow: here 17:59:55 scsnow: Mailing List 17:59:59 scsnow: could you send your Q via email 18:00:09 Ok, by everyone 18:00:12 bye 18:00:14 bye 18:00:15 bye 18:00:16 I was waiting for open discussion topic here ) 18:00:24 scsnow: :-) 18:00:25 scsnow :) 18:00:26 bye 18:00:36 #endmeeting