<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:black">Hello everyone: <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> I would like to test the waters on some new functionality we think is needed to protect OpenStack deployments from some overload situations due to an excessive user or DDOS scenario. We wrote this up in
the style of an RFE. Please let us know your thoughts and we can proceed with a formal RFE with more detail if there are no concerns raised.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">*What is being requested*</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">This request is to extend the QOS APIs to include the ability to provide connection rate limiting
</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">*Why is it being requested*</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">There are many scenarios where a VM may be intentionally malicious or become harmful to the network due to its rate of initializing TCP connections. The reverse direction of a VM being attacked with an excessive
amount of TCP connection requests either intentionally or due to overload is also problematic.
</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">*Implementation Choices</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> There might be a number of ways to implement this, but one of the easiest would appear to be to extend the APIs being developed under:
<a href="https://review.openstack.org/#/c/187513/">https://review.openstack.org/#/c/187513/</a></span><span style="color:#1F497D">.
</span><span style="color:black">An additional rule type “connections per-second” could be added.
</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">The dataplane implementation itself may be realized with netfilter and conntrack.
</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">*Alternatives</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">It would be possible to extend the security groups in a similar fashion, but due to the addition of rate limiting, QoS seems a more nature fit.
</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">*Who needs it*</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Cloud operators have experienced this issue in real deployments in a number of cases. </span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="543" style="width:407.25pt">
<tbody>
<tr>
<td colspan="3" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><img border="0" width="110" height="73" id="Picture_x0020_4" src="cid:image001.jpg@01D0A8F4.ED91DB30" alt="http://www.cisco.com/web/europe/images/email/signature/logo05.jpg"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td nowrap="" valign="top" style="padding:0in 0in 0in .25in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:#666666">John Joyce</span></b><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:#666666"><br>
PRINCIPAL ENGINEER.ENGINEERING<br>
joycej@cisco.com<br>
Phone: <b>+1 978 936 0227</b><o:p></o:p></span></p>
</td>
<td width="50%" valign="top" style="width:50.0%;padding:11.25pt 0in 7.5pt 15.0pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:#666666">Cisco Systems Limited</span></b><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:#666666"><br>
1414 Massachusetts Ave.<br>
BOXBOROUGH<br>
MASSACHUSETTS<br>
01719<br>
US<br>
</span><a href="http://www.cisco.com"><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:#666666">Cisco.com</span></a><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:#666666"><o:p></o:p></span></p>
</td>
<td style="padding:0in 0in 0in 0in"></td>
</tr>
<tr>
<td colspan="3" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="padding:0in 15.0pt 3.75pt .25in"></td>
</tr>
<tr>
<td style="border:none;border-bottom:solid #CCCCCC 1.0pt;padding:0in 0in 0in 0in">
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:12.0pt;font-family:"Times New Roman","serif";display:none"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="400" style="width:300.0pt">
<tbody>
<tr>
<td style="padding:0in 15.0pt 0in .25in">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#009900"><img border="0" width="18" height="19" id="Picture_x0020_1" src="cid:image002.gif@01D0A8F4.ED91DB30" alt="Think before you print.">Think before you print.<o:p></o:p></span></p>
</td>
</tr>
<tr>
<td style="padding:5.25pt 15.0pt 4.5pt .25in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#999999">This email may contain confidential and privileged material for the sole use of the intended recipient.
Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#999999">For corporate legal information go to:<br>
</span><a href="http://www.cisco.com/web/about/doing_business/legal/cri/index.html" title="Legal Information"><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#0E58A0">http://www.cisco.com/web/about/doing_business/legal/cri/index.html</span></a><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#999999"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>