<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Ryan,</div>
<div><br>
</div>
<div>More help is always great :-). As far as who to collaborate, what ever Is easiest for everyone – I am pretty flexible.</div>
<div><br>
</div>
<div>Regards</div>
<div><br>
</div>
<div>John</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Ryan Moats <<a href="mailto:rmoats@us.ibm.com">rmoats@us.ibm.com</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, May 31, 2016 at 1:59 PM<br>
<span style="font-weight:bold">To: </span>John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>><br>
<span style="font-weight:bold">Cc: </span>Ben Pfaff <<a href="mailto:blp@ovn.org">blp@ovn.org</a>>, "<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>" <<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>>, Justin Pettit
<<a href="mailto:jpettit@ovn.org">jpettit@ovn.org</a>>, OpenStack Development Mailing List <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>>, Russell Bryant <<a href="mailto:russell@ovn.org">russell@ovn.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN<br>
</div>
<div><br>
</div>
<div>
<div>
<p><tt>John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>> wrote on 05/31/2016 03:21:30 PM:<br>
<br>
> From: John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>></tt><br>
<tt>> To: Ryan Moats/Omaha/IBM@IBMUS</tt><br>
<tt>> Cc: Ben Pfaff <<a href="mailto:blp@ovn.org">blp@ovn.org</a>>, "<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>"
<br>
> <<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>>, Justin Pettit <<a href="mailto:jpettit@ovn.org">jpettit@ovn.org</a>>,
<br>
> "OpenStack Development Mailing List" <openstack-<br>
> <a href="mailto:dev@lists.openstack.org">dev@lists.openstack.org</a>>, Russell Bryant <<a href="mailto:russell@ovn.org">russell@ovn.org</a>></tt><br>
<tt>> Date: 05/31/2016 03:22 PM</tt><br>
<tt>> Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN</tt><br>
<tt>> <br>
> Ryan,</tt><br>
<tt>> <br>
> Let me add the tables to OVN for SFC. That will give us a working <br>
> system to prototype the flow classifier approach on. Hopefully I can<br>
> get something done by end of week.</tt><br>
<tt>> <br>
> Regards</tt><br>
<tt>> <br>
> John</tt><br>
<br>
<tt>I've got some internal folks that are willing to help with writing code (as</tt><br>
<tt>I will be once I clear my current firefights) so the question of how to</tt><br>
<tt>collaborate with code now arises...</tt><br>
<br>
<tt>Are you comfortable with putting the changes on r.o.o as WiP and patchworks</tt><br>
<tt>as RFC and work through the review process or would you rather work via</tt><br>
<tt>forks and pull requests in github?</tt><br>
<br>
<tt>Ryan</tt><br>
<br>
<tt>> From: Ryan Moats <<a href="mailto:rmoats@us.ibm.com">rmoats@us.ibm.com</a>><br>
> Date: Tuesday, May 31, 2016 at 10:17 AM<br>
> To: John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>><br>
> Cc: Ben Pfaff <<a href="mailto:blp@ovn.org">blp@ovn.org</a>>, "<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>" <<br>
> <a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>>, Justin Pettit <<a href="mailto:jpettit@ovn.org">jpettit@ovn.org</a>>, OpenStack<br>
> Development Mailing List <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>>, Russell Bryant <<br>
> <a href="mailto:russell@ovn.org">russell@ovn.org</a>><br>
> Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN</tt><br>
<tt>> <br>
> John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>> wrote on 05/26/2016
<br>
> 11:08:43 AM:<br>
> <br>
> > From: John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>><br>
> > To: Ryan Moats/Omaha/IBM@IBMUS<br>
> > Cc: Ben Pfaff <<a href="mailto:blp@ovn.org">blp@ovn.org</a>>, "<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>"
<br>
> > <<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>>, Justin Pettit <<a href="mailto:jpettit@ovn.org">jpettit@ovn.org</a>>,
<br>
> > "OpenStack Development Mailing List" <openstack-<br>
> > <a href="mailto:dev@lists.openstack.org">dev@lists.openstack.org</a>>, Russell Bryant <<a href="mailto:russell@ovn.org">russell@ovn.org</a>><br>
> > Date: 05/26/2016 11:09 AM<br>
> > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN<br>
> > <br>
> > Ryan,<br>
> > <br>
> > My (incomplete) throughts about the flow-classifier are:<br>
> > <br>
> > 1) ACL’s are more about denying access, while the flow classifier <br>
> > is more about steering selected traffic to a path, so we would need <br>
> > to deny-all except allowed flows.<br>
> > 2) The networking-sfc team has done a nice job with the drivers so <br>
> > ovn has its own flow-classifier driver which allows us to align the <br>
> > flow-classifier with the matches supported in ovs/ovn, which could <br>
> > be an advantage.<br>
> <br>
> The ACL table has a very simple flow-classifier structure and I'd<br>
> like to see if that can be re-used for the purpose of the SFC classifier<br>
> (read that I feel the Logical_Flow_Classifier table is too complex).<br>
> My initial thoughts were to look at extending the action column and<br>
> using the external-ids field to differentiate between legacy ACLs and<br>
> those that are used to intercept traffic and route it to an SFC.<br>
> <br>
> > <br>
> > What were your thoughts on the schema it adds a lot of tables and a <br>
> > lot of commands – cannot think of anyway around it<br>
> <br>
> In this case, I think that the other tables are reasonable and I'm <br>
> uncomfortable trying to stretch the existing tables to cover that<br>
> information...<br>
> <br>
> Ryan<br>
> <br>
> > <br>
> > Regards<br>
> > <br>
> > John<br>
> > <br>
> > From: Ryan Moats <<a href="mailto:rmoats@us.ibm.com">rmoats@us.ibm.com</a>><br>
> > Date: Wednesday, May 25, 2016 at 9:12 PM<br>
> > To: John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>><br>
> > Cc: Ben Pfaff <<a href="mailto:blp@ovn.org">blp@ovn.org</a>>, "<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>" <<br>
> > <a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>>, Justin Pettit <<a href="mailto:jpettit@ovn.org">jpettit@ovn.org</a>>, OpenStack<br>
> > Development Mailing List <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>>,
<br>
> Russell Bryant <<br>
> > <a href="mailto:russell@ovn.org">russell@ovn.org</a>><br>
> > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN<br>
> > <br>
> > John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>> wrote on 05/25/2016
<br>
> > 07:27:46 PM:<br>
> > <br>
> > > From: John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>><br>
> > > To: Ryan Moats/Omaha/IBM@IBMUS<br>
> > > Cc: "<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>" <<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>>, "OpenStack
<br>
> > > Development Mailing List" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>>, Ben
<br>
> > > Pfaff <<a href="mailto:blp@ovn.org">blp@ovn.org</a>>, Justin Pettit <<a href="mailto:jpettit@ovn.org">jpettit@ovn.org</a>>, Russell Bryant<br>
> > > <<a href="mailto:russell@ovn.org">russell@ovn.org</a>><br>
> > > Date: 05/25/2016 07:28 PM<br>
> > > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN<br>
> > > <br>
> > > Ryan,<br>
> > > <br>
> > > Ok – I will let the experts weigh in on load balancing.<br>
> > > <br>
> > > In the meantime I have attached a couple of files to show where I am<br>
> > > going. The first is sfc_dict.py and is a representation of the dict <br>
> > > I am passing from SFC to OVN. This will then translate to the <br>
> > > attached ovn-nb schema file.<br>
> > > <br>
> > > One of my concerns is that SFC almost doubles the size of the ovn-nb<br>
> > > schema but I could not think of any other way of doing it.<br>
> > > <br>
> > > Thoughts?<br>
> > > <br>
> > > John<br>
> > <br>
> > The dictionary looks fine for a starting point, and the more I look<br>
> > at the classifier, the more I wonder if we can't do something with<br>
> > the current ACL table to avoid duplication in the NB database<br>
> > definition...<br>
> > <br>
> > Ryan<br>
> > <br>
> > > From: Ryan Moats <<a href="mailto:rmoats@us.ibm.com">rmoats@us.ibm.com</a>><br>
> > > Date: Wednesday, May 25, 2016 at 7:27 AM<br>
> > > To: John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>><br>
> > > Cc: "<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>" <<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>>, OpenStack
<br>
> > > Development Mailing List <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>>, Ben Pfaff <<br>
> > > <a href="mailto:blp@ovn.org">blp@ovn.org</a>>, Justin Pettit <<a href="mailto:jpettit@ovn.org">jpettit@ovn.org</a>>, Russell Bryant <<br>
> > <a href="mailto:russell@ovn.org">russell@ovn.org</a><br>
> > > ><br>
> > > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN<br>
> > > <br>
> > > John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>> wrote on 05/24/2016
<br>
> > > 06:33:05 PM:<br>
> > > <br>
> > > > From: John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>><br>
> > > > To: Ryan Moats/Omaha/IBM@IBMUS<br>
> > > > Cc: "<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>" <<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>>, "OpenStack
<br>
> > > > Development Mailing List" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
> > > > Date: 05/24/2016 06:33 PM<br>
> > > > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN<br>
> > > > <br>
> > > > Ryan,<br>
> > > > <br>
> > > > Thanks for getting back to me and pointing me in a more OVS like <br>
> > > > direction. What you say makes sense, let me hack something together.<br>
> > > > I have been a little distracted getting some use cases together. The<br>
> > > > other area is how to better map the flow-classifier I have been <br>
> > > > thinking about it a little, but I will leave it till after we get <br>
> > > > the chains done.<br>
> > > > <br>
> > > > Your load-balancing comment was very interesting – I saw some <br>
> > > > patches for load-balancing a few months ago but nothing since. It <br>
> > > > would be great if we could align with load-balancing as that would <br>
> > > > make a really powerful solution.<br>
> > > > <br>
> > > > Regards<br>
> > > > <br>
> > > > John<br>
> > > <br>
> > > John-<br>
> > > <br>
> > > For the load balancing, I believe that you'll want to look at<br>
> > > openvswitch's select group, as that should let you set up multiple<br>
> > > buckets for each egress port in the port pairs that make up a port<br>
> > > group.<br>
> > > <br>
> > > As I understand it, Table 0 identifies the logical port and logical<br>
> > > flow. I'm worried that this means we'll end up with separate bucket<br>
> > > rules for each ingress port of the port pairs that make up a port<br>
> > > group, leading to a cardinality product in the number of rules.<br>
> > > I'm trying to think of a way where Table 0 could identify the packet<br>
> > > as being part of a particular port group, and then I'd only need one<br>
> > > set of bucket rules to figure out the egress side. However, the<br>
> > > amount of free metadata space is limited and so before we go down<br>
> > > this path, I'm going to pull Justin, Ben and Russell in to see if<br>
> > > they buy into this idea or if they can think of an alternative.<br>
> > > <br>
> > > Ryan<br>
> > > <br>
> > > > <br>
> > > > From: Ryan Moats <<a href="mailto:rmoats@us.ibm.com">rmoats@us.ibm.com</a>><br>
> > > > Date: Monday, May 23, 2016 at 9:06 PM<br>
> > > > To: John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>><br>
> > > > Cc: "<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>" <<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>>, OpenStack
<br>
> > > > Development Mailing List <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
> > > > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN<br>
> > > > <br>
> > > > John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>> wrote on 05/18/2016
<br>
> > > > 03:55:14 PM:<br>
> > > > <br>
> > > > > From: John McDowall <<a href="mailto:jmcdowall@paloaltonetworks.com">jmcdowall@paloaltonetworks.com</a>><br>
> > > > > To: Ryan Moats/Omaha/IBM@IBMUS<br>
> > > > > Cc: "<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>" <<a href="mailto:discuss@openvswitch.org">discuss@openvswitch.org</a>>, "OpenStack
<br>
> > > > > Development Mailing List" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
> > > > > Date: 05/18/2016 03:55 PM<br>
> > > > > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN<br>
> > > > > <br>
> > > > > Ryan,<br>
> > > > > <br>
> > > > > OK all three repos and now aligned with their masters. I have done <br>
> > > > > some simple level system tests and I can steer traffic to a single <br>
> > > > > VNF. Note: some additional changes to networking-sfc to catch-up <br>
> > > > > with their changes.<br>
> > > > > <br>
> > > > > <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_doonhammer_networking-2Dsfc&d=CwMGaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=vZ6VUDaavDpfOdPQrz1ED54jEjvAE36A8TVJroVlrOQ&m=mLaxHI6XiGcUfgsL5Egu3aC0QR-xI7L_QuffCoTwtz8&s=8QaDNJ9iUOwW-TDDioAlHYpO-WM2a7-bMuP7qJTezaw&e=">
https://github.com/doonhammer/networking-sfc</a> <br>
> > > > > <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_doonhammer_networking-2Dovn&d=CwMGaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=vZ6VUDaavDpfOdPQrz1ED54jEjvAE36A8TVJroVlrOQ&m=mLaxHI6XiGcUfgsL5Egu3aC0QR-xI7L_QuffCoTwtz8&s=ITWWb5V3L60kdiwK5QIbo-YEcIvGkdKDW4xl6uNj_3g&e=">
https://github.com/doonhammer/networking-ovn</a><br>
> > > > > <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_doonhammer_ovs&d=CwMGaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=vZ6VUDaavDpfOdPQrz1ED54jEjvAE36A8TVJroVlrOQ&m=mLaxHI6XiGcUfgsL5Egu3aC0QR-xI7L_QuffCoTwtz8&s=bBOpCVRnF1ntciYqKMTLupX4eagWaWVXoKRWAwAio2I&e=">
https://github.com/doonhammer/ovs</a> <br>
> > > > > <br>
> > > > > The next tasks I see are:<br>
> > > > > <br>
> > > > > 1. Decouple networking-sfc and networking-ovn. I am thinking that I <br>
> > > > > will pass a nested port-chain dictionary holding port-pairs/port-<br>
> > > > > pair-groups/flow-classifiers from networking-sfc to networking-ovn.<br>
> > > > > 2. Align the interface between networking-ovn and ovs/ovn to match <br>
> > > > > the nested dictionary in 1.<br>
> > > > > 3. Modify the ovn-nb schema and ovn-northd.c to march the port-<br>
> > > chain model.<br>
> > > > > 4. Add ability to support chain of port-pairs<br>
> > > > > 5. Think about flow-classifiers and how best to map them, today I <br>
> > > > > just map the logical-port and ignore everything else.<br>
> > > > > <br>
> > > > > Any other suggestions/feedback?<br>
> > > > > <br>
> > > > > Regards<br>
> > > > > <br>
> > > > > John<br>
> > > > <br>
> > > > John-<br>
> > > > <br>
> > > > (Sorry for sending this twice, but I forgot that text/html is not liked<br>
> > > > by the mailing lists ...)<br>
> > > > <br>
> > > > My apologies for not answering this sooner - I was giving a two day<br>
> > > > training on Tues/Wed last week and came back to my son graduating<br>
> > > > from HS the next day, so things have been a bit of a whirlwind here.<br>
> > > > <br>
> > > > Looking at the github repos, I like the idea of passing a dictionary<br>
> > > > from networking-sfc to networking-ovn. The flow classifiers should<br>
> > > > be relatively straightforward to map to ovs match rules (famous last<br>
> > > > words)...<br>
> > > > <br>
> > > > I've probably missed an orbit here, but in the ovn-northd <br>
> implementation,<br>
> > > > I was expecting to find service chains in the egress and <br>
> router pipelines<br>
> > > > in addition to the ingress pipeline (see below for why I thinka service<br>
> > > > chain stage in the egress pipeline makes sense ...)<br>
> > > > <br>
> > > > Also, in the ovn-northd implementation, I'm a little disturbedto see the<br>
> > > > ingress side of the service chain sending packets to output ports - I<br>
> > > > think that a more scalable (and more "ovs-like" approach) would be to<br>
> > > > match the egress side of a port pair in the chaining stage of the<br>
> > > > ingress pipeline, with an action that set the input port register.<br>
> > > > Then the egress pipeline would have a chaining stage where the output<br>
> > > > port register would be set based on the ingress port of the next port<br>
> > > > pair in the chain and the packet being punted to the proper output port<br>
> > > > in the last table. That should automagically build your function chain<br>
> > > > and provide the basis for bucketizing multiple ingress ports for the<br>
> > > > next port group to support hash based load balancing.<br>
> > > > <br>
> > > > Does that make sense?<br>
> > > > <br>
> > > > Ryan[attachment "ovn-nb.ovsschema.sfc" deleted by Ryan Moats/<br>
> > > Omaha/IBM] [attachment "sfc_dict.py" deleted by Ryan Moats/Omaha/IBM] </tt>
<br>
</p>
</div>
</div>
</span>
</body>
</html>