<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Providing some comments and (a ton of) questions on the wiki for the model/CLI/API. Great document, BTW.<div><br></div><div><a href="https://wiki.openstack.org/wiki/Quantum/VPNaaS">https://wiki.openstack.org/wiki/Quantum/VPNaaS</a></div><div><br></div><div><b>DataModel</b></div><div><br></div><div>VPNServices Table</div><div><br></div><div>Looking at strongswan, it looks like they have a lifetime_units of packets. Do we want to add that, in addition to time/kilobytes?</div><div><br></div><div><br></div><div>IKEPolicy and IPsecPolicys Tables</div><div><br></div><div>Should these table names be plural or singular (I'm guessing plural)? If so, should be IPsecPolicies.</div><div><br></div><div>Are these two tables mutually exclusive?</div><div> If so, should they be combined as there is much in common?</div><div><br></div><div>Whether exclusive or not, should some of the comment fields be extracted to another table (e.g. algorithm, lifetime, pas)?</div><div><br></div><div>Can you elaborate on the pas field? Looking at strongswan, they said this (which was a bit confusing to me):</div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><div>"<span style="color: rgb(54, 0, 12); font-family: Verdana, sans-serif; font-size: 11px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 16.1875px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); display: inline !important; float: none;">IKEv2 always uses</span></div><span style="color: rgb(54, 0, 12); font-family: Verdana, sans-serif; font-size: 11px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 16.1875px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); display: inline !important; float: none;">PFS for IKE_SA rekeying whereas for CHILD_SA rekeying PFS is enforced by defining a Diffie-Hellman dhgroup<br></span><span style="color: rgb(54, 0, 12); font-family: Verdana, sans-serif; font-size: 11px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 16.1875px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); display: inline !important; float: none;">in the </span><em style="color: rgb(54, 0, 12); font-family: Verdana, sans-serif; font-size: 11px; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 16.1875px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);">esp</em><span style="color: rgb(54, 0, 12); font-family: Verdana, sans-serif; font-size: 11px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 16.1875px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); display: inline !important; float: none;"> parameter. Since </span><a href="http://wiki.strongswan.org/projects/strongswan/wiki/500" class="wiki-page" style="color: rgb(138, 0, 32); text-decoration: none; font-weight: bold; font-family: Verdana, sans-serif; font-size: 11px; font-style: normal; font-variant: normal; letter-spacing: normal; line-height: 16.1875px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);">5.0.0</a><span style="color: rgb(54, 0, 12); font-family: Verdana, sans-serif; font-size: 11px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 16.1875px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); display: inline !important; float: none;"> the latter also applies to IKEv1 and this parameter has no effect anymore."</span></blockquote><div><font class="Apple-style-span" color="#36000c" face="Verdana, sans-serif"><span class="Apple-style-span" style="font-size: 12px; line-height: 16px;"><br></span></font></div><div><font class="Apple-style-span" color="#36000c" face="Verdana, sans-serif"><span class="Apple-style-span" style="font-size: 12px; line-height: 16px;"><br></span></font></div><div><div>VPNServiceConnections Table</div><div><br></div><div>Should dpd_interval be did_delay?</div><div>Should a value of zero be allowed? Strongswan indicated that zero meant no info messages sent and relied on packets, like rekey messages to determine peer health.</div><div><br></div><div>Is the intent to only support additional auth_mode later (strongswan shows a few more)?</div><div><br></div><div><br></div><div><b>CLI</b></div><div><br></div><div>Do the vpn-vpnservice-* and vpn-vpnserviceconnection-* commands need the second "vpn"?</div><div><br></div><div>How is the "-c COLUMN" argument used on create commands?</div><div><br></div><div>What is the "shell" options for the -f option (format?) on create, list, and show commands? Why no json/xml/etc?</div><div><br></div><div>Should the update commands have argument to specify the fields to update? Is that supposed to be the "--variable VARIABLE" argument?</div><div><br></div><div><br></div><div><b>REST</b></div><div><b><br></b></div><div>Is it the OS convention to have the version in the URI or to use version less for the most recent version and aliases for that version (e.g. /v1.0/vpnservices and /v1/vpnservices would be an alias to /vpnservices)? No intent to start a debate, just wondering what's the approach being used and curious as to how this is handled over time.</div><div><br></div><div>/ikepolicys => /ikepolicies</div><div><br></div><div>/ipsecpolicys => /ipsecpolicies</div><div><br></div><div><br></div><div>Regards,</div><div><br></div><div><div><div apple-content-edited="true">
PCM (Paul Michali)<br><br>
</div>
<br></div></div></div></body></html>