<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:宋体;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:宋体;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@宋体";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:宋体;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ZH-CN" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D">Hi all,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D">Do we have plan to implement it in Liberity? I am really interest in and want to join it.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D">/Yalei<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Miguel Ángel Ajo [mailto:majopela@redhat.com]
<br>
<b>Sent:</b> Saturday, February 21, 2015 12:31 AM<br>
<b>To:</b> Ben Pfaff<br>
<b>Cc:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> Re: [openstack-dev] [ovs-dev] [PATCH 8/8] [RFC] [neutron] ovn: Start work on design ocumentation.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Helvetica","sans-serif";color:#A0A0A8">On Friday, 20 de February de 2015 at 17:06, Ben Pfaff wrote:</span><span lang="EN-US" style="font-size:10.5pt;font-family:"Helvetica","sans-serif""><o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0cm 0cm 0cm 8.0pt;margin-left:0cm;margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Fri, Feb 20, 2015 at 12:45:46PM +0100, Miguel Ángel Ajo wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Thursday, 19 de February de 2015 at 23:15, Kyle Mestery wrote:
<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Thu, Feb 19, 2015 at 3:55 PM, Ben Pfaff <blp@nicira.com (<a href="mailto:blp@nicira.com">mailto:blp@nicira.com</a>)> wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">My initial reaction is that we can implement security groups as<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">another action in the ACL table that is similar to "allow" but in<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">addition permits reciprocal inbound traffic. Does that sound<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">sufficient to you?<o:p></o:p></span></p>
</div>
</div>
</blockquote>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US">Yes, having fine grained allows (matching on protocols, ports, and<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">remote ips would satisfy the neutron use case).<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Also we use connection tracking to allow reciprocal inbound traffic<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">via ESTABLISHED/RELATED, any equivalent solution would do.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">For reference, our SG implementation, currently is able to match on<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">combinations of:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">* direction: ingress/egress<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">* protocol: icmp/tcp/udp/<raw number><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">* port_range: min-max (it’s always dst)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">* L2 packet ethertype: IPv4, IPv6, etc...<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">* remote_ip_prefix: as a CIDR or * remote_group_id (to reference all other IPs in a certain group)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">All of them assume connection tracking so known connection packets will<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">go the other way around.<o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">OK. All of those should work OK. (I don't know for sure whether we'll<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">have explicit groups; initially, probably not.)<o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">That makes sense.</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0cm 0cm 0cm 8.0pt;margin-left:0cm;margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Is the exponential explosion due to cross-producting, that is, because<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">you have, say, n1 source addresses and n2 destination addresses and so<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">you need n1*n2 flows to specify all the combinations? We aim to solve<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">that in OVN by giving the CMS direct support for more sophisticated<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">matching rules, so that it can say something like:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">ip.src in {<a>, <b>, <c>, ...} && ip.dst in {<d>, <e>, <f>, ...}<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">&& (tcp.src in {80, 443, 8080} || tcp.dst in {80, 443, 8080})<o:p></o:p></span></p>
</div>
</div>
</blockquote>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">That sounds good and very flexible.<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">and let OVN implement it in OVS via the "conjunctive match" feature<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">recently added, which is like a set membership match but more<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">powerful. <o:p></o:p></span></p>
</div>
</div>
</blockquote>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US">Hmm, where can I find examples about that feature, sounds interesting.<o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">If you look at ovs-ofctl(8) in a development version of OVS, such as<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><a href="http://benpfaff.org/~blp/dist-docs/ovs-ofctl.8.pdf">http://benpfaff.org/~blp/dist-docs/ovs-ofctl.8.pdf</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">search for "conjunction", which explains the implementation.
<o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">Amazing, yes, it seems like conjunctions will do the work quite optimally</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">at OpenFlow level.</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">My hat off… :)</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0cm 0cm 0cm 8.0pt;margin-left:0cm;margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">(This<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">isn't the form that Neutron would use with OVN; that is the Boolean<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">expression syntax above.)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">Of course, understood, I was curious about the low level supporting the</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">high level above.</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0cm 0cm 0cm 8.0pt;margin-left:0cm;margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">It might still be nice to support lists of IPs (or<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">whatever), since these lists could still recur in a number of<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">circumstances, but my guess is that this will help a lot even without<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">that.<o:p></o:p></span></p>
</div>
</div>
</blockquote>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US">As afar as I understood, given the way megaflows resolve rules via hashes<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">even if we had lots of rules with different ip addresses, that would be very fast,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">probably as fast or more than our current ipset solution.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">The only caveat would be having to update lots of flow rules when a port goes<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">in or out of a security group, since you have to go and clear/add the rules to each<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">single port on the same security group (as long as they have 1 rule referencing the sg).<o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">That sounds like another good argument for allowing explicit groups. I<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">have a design in mind for that but I doubt it's the first thing to<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">implement.<o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">Of course, 1 step at a time. I will do a 2nd pass on your documents, looking a bit</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">more on the higher level. I’m very happy to see that the low level is very well tied</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">up and capable.</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">Best regards,</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt">Miguel Ángel.</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>