19:04:43 #startmeeting ovsdb_weekly 19:04:43 Meeting started Tue Jul 7 19:04:43 2015 UTC. The chair is tbachman. Information about MeetBot at http://ci.openstack.org/meetbot.html. 19:04:43 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 19:04:43 The meeting name has been set to 'ovsdb_weekly' 19:04:48 #chair shague flaviof 19:04:48 Current chairs: flaviof shague tbachman 19:04:52 #topic agenda 19:04:59 #link https://meetings.opendaylight.org/opendaylight-ovsdb/2015/osvsdb_weekly_call/opendaylight-ovsdb-osvsdb_weekly_call.2015-03-24-19.06.html Last recorded meeting minutes 19:06:07 #topic status 19:08:29 #info shague added some manual test verification tasks 19:09:00 #action adetalhouet to move some tasks to doing in Trello 19:09:18 #info adetalhouet 19:09:21 #info shague said that VTEP con-call this morning invovled trying to decide the new APIs, and how it will map into neutron 19:10:11 #info vishnoianil is done with coding for ARP for external gateway — looking to hook it into main for external network, then will test 19:11:18 flaviof: do you know if the fix for security groups for stable/kilo is going to be back-ported, or do we think we’ll just be keeping the fork? 19:12:34 #info adetalhouet discovered an NPE in net-virt code in master branch, for distributed ARP (enable/disable) 19:12:53 #info flaviof says this NPE is not in stable/lithium 19:13:26 #info shague asks if this is related to bug 3545 19:13:34 #info flaviof says the subject is the same, but the NPE is not 19:15:08 https://gist.github.com/adetalhouet/204976edfef309c06edf 19:15:31 #link https://gist.github.com/adetalhouet/204976edfef309c06edf capture of NPE condition 19:15:42 adetalhouet: thx :) 19:16:06 tbachman: np :) nice to see OVSDB's gonna have minutes now 19:16:11 lol 19:16:19 I’ve been out of touch with the community for too long! :) 19:16:24 finally catching up 19:16:49 thanks, those are really useful to catch up on what happened 19:17:43 glad to help! 19:18:13 #info vishnoianil points out that the properties file is in the controller, and not OVSDB — it probably doesn’t have this new property, which is causing the problem 19:18:49 #info flaviof says that it should be coded in a way that if the config isn’t there, it should handle it (it checks if the property is null) 19:20:35 Gabriel Robitaille-Montpetit proposed a change to ovsdb: Suggestion: fix isDistributedArpDisabled NPE. https://git.opendaylight.org/gerrit/23852 19:20:39 #info afredette says he’s going to put a proposal together for SNAT support for sometime next week 19:21:47 #info vishnoianil says that clustering is the next thing on his plate after the ARP resolver 19:22:01 #info vishnoianil is going to work with flaviof on a tentative plan for clustering support 19:22:49 #info vishnoianil is looking to create a device-to-instance lock so that devices can be distributed across instances 19:23:59 #info shague asks if persistence and high availability is part of clustiner 19:24:24 #info vishnoianil says clustering enables persistence, high availability, and scalability 19:24:33 flaviof: do you know if the fix for security groups for stable/kilo is going to be back-ported, or do we think we’ll just be keeping the fork? 19:24:41 * tbachman beats a dead horse 19:26:35 Flavio Fernandes proposed a change to ovsdb: Bug 3954: NPE exception in isDistributedArpDisabled() https://git.opendaylight.org/gerrit/23853 19:27:18 #link https://lists.opendaylight.org/pipermail/ovsdb-dev/2015-July/001654.html email from shague to list on support for wildcard queries of MD-SAL 19:27:37 #info shague says that ttkacik responded saying they’re working on adding wildcard query support to the MD-SAL 19:27:51 #topic Security Groups presentation 19:28:31 #info aswinsuryan says they were trying to look at parity with openstack for security groups 19:28:44 #info they broke it into fixed security rules and security group CRUD 19:29:15 #info Fixed Security Rules are added despite whether a security group is selected or not, and adds a predefined set of rules which aren’t customizeable 19:29:27 #info Security Group CRUD is customizeable 19:29:52 #info For Fixed Security Groups, it allows ingress DHCP traffic and same-net traffic, but drops all other ingress 19:30:21 #info For egress, it drops any source IP/MAC pair other than that fo the connected VM; drops any DHCP server traffic from the VM; but allows all other traffice 19:30:55 #info Conntrack Rules drop packets that appear related to an existing connection but do not have an entry in conntrack; allows packets associated with a known session 19:31:34 any web link for the slides? 19:31:53 mohnish: I don’t have one :( 19:31:59 aswinsuryan: do you have a link to the slides? 19:32:58 #info shague asks if the conntrack referenced in the slides is different from OVS conntrack 19:33:04 #info aswinsuryan says this is from iptables 19:33:20 #info shague says that conntrack is a new feature that the OVS team is looking to add in a future release 19:34:00 #info aswinsuryan says the currently the DHCP rules are added, the rest need to be added 19:35:23 #info modules to work on: neutron (needs to be ported to MD-SAL); net-virt: add a listener for MD-SAL notifications; add logic to process CRUD operations in PortSecurityHandler; Uncomment the code in OF13Provider to handle SecurityGroup handling on an interface update; in Egress/IngressAclService add logic to support multiple protocols 19:36:27 #info shague asks if the security group work will require more nicira extensions 19:37:49 shague: FWIW, GBP has implemented SG support, but I can’t say that it’s totally comprehensive 19:38:55 #info tbachman says that GBP has implemented support for SG, but isn’t sure how comprehensive it is 19:40:07 #info vishnoianil asks if security groups allow support at the connection level as well 19:40:29 #info flaviof says they have rules like allow HTTP or don’t allow SSH 19:40:49 #info flaviof says the initial implementation by networkstatic checks for initial SYN packet 19:41:55 #info vishnoianil asks aswinsuryan if they have an OVS setup where they can test L7 flows 19:42:08 A change was merged to ovsdb: Bug 3954: NPE exception in isDistributedArpDisabled() https://git.opendaylight.org/gerrit/23853 19:42:36 * tbachman can’t type the ip-tables slide :) 19:44:55 #info aswinsuryan says they’re trying to map ip-tables constructs into flow-mods 19:48:15 #info LuisGomez says to filter using destination and source port works with openflow, but what can be done for state (e.g. TCP)? 19:49:34 #info LuisGomez says this is needed for things like stateful firewalls 19:51:03 #info vishnoianil asks if openstack tries to resolve conflicts between security group rules (e.g. allow and deny both configured) 19:51:27 #info aswinsuryan says he hasn’t checked that 19:52:31 #info flaviof says normally we defer to openstack to do the right thing 19:54:16 #info tbachman asks if the fix for Security Groups in stable/kilo will be backported 19:54:28 #info flaviof says that armando was going to look at it, but hasn’t heard back from him yet 19:54:56 #info flaviof says we can either neuter the callbacks, or have a commit in stable/kilo to fix this 19:55:45 * tbachman promises to stop harassing flaviof now ;) 19:55:46 lol 19:56:33 #endmeeting