@@ -10,10 +10,10 @@ manage affected security group rules. Thus, there is no need for an agent.
10
10
It is good to keep in mind that Openstack Security Groups (SG) and their rules
11
11
(SGR) map 1:1 into OVN's Port Groups (PG) and Access Control Lists (ACL):
12
12
13
- .. code-block :: none
13
+ .. code-block :: none
14
14
15
- Openstack Security Group <=> OVN Port Group
16
- Openstack Security Group Rule <=> OVN ACL
15
+ Openstack Security Group <=> OVN Port Group
16
+ Openstack Security Group Rule <=> OVN ACL
17
17
18
18
Just like SGs have a list of SGRs, PGs have a list of ACLs. PGs also have
19
19
a list of logical ports, but that is not really relevant in this context.
@@ -50,22 +50,22 @@ https://github.com/ovn-org/ovn/commit/880dca99eaf73db7e783999c29386d03c82093bf
50
50
Below is an example of a meter configuration in OVN. You can locate the fair,
51
51
unit, burst_size, and rate attributes:
52
52
53
- .. code-block :: bash
53
+ .. code-block :: bash
54
54
55
- $ ovn-nbctl list meter
56
- _uuid : 70c76ba9-f303-471b-9d49-25dee299827f
57
- bands : [f114c205-a170-4425-8ca6-4e71099d1955]
58
- external_ids : {" neutron:device_owner" =logging-plugin}
59
- fair : true
60
- name : acl_log_meter
61
- unit : pktps
55
+ $ ovn-nbctl list meter
56
+ _uuid : 70c76ba9-f303-471b-9d49-25dee299827f
57
+ bands : [f114c205-a170-4425-8ca6-4e71099d1955]
58
+ external_ids : {" neutron:device_owner" =logging-plugin}
59
+ fair : true
60
+ name : acl_log_meter
61
+ unit : pktps
62
62
63
- $ ovn-nbctl list meter-band
64
- _uuid : f114c205-a170-4425-8ca6-4e71099d1955
65
- action : drop
66
- burst_size : 25
67
- external_ids : {}
68
- rate : 100
63
+ $ ovn-nbctl list meter-band
64
+ _uuid : f114c205-a170-4425-8ca6-4e71099d1955
65
+ action : drop
66
+ burst_size : 25
67
+ external_ids : {}
68
+ rate : 100
69
69
70
70
The burst_size and rate attributes are configurable through
71
71
neutron.conf.services.logging.log_driver_opts. That is not new.
@@ -78,39 +78,39 @@ Moreover, there are a few attributes in each ACL that makes it able to
78
78
provide the networking logging feature. Let's use the example below
79
79
to point out the relevant fields:
80
80
81
- .. code-block :: none
82
-
83
- $ openstack network log create --resource-type security_group \
84
- --resource ${SG} --event ACCEPT logme -f value -c ID
85
- 2e456c7f-154e-40a8-bb10-f88ba51b90b5
86
-
87
- $ openstack security group show ${SG} -f json -c rules | jq '.rules | .[2]' | grep -v 'null'
88
- {
89
- "id": "de4ea1e4-c946-40ed-b5b6-53c59418dc0b",
90
- "tenant_id": "2600067ea3a446dba332d20a30ed44fa",
91
- "security_group_id": "c604e984-0789-4c9a-a297-3e7f62fa73fd",
92
- "ethertype": "IPv4",
93
- "direction": "egress",
94
- "standard_attr_id": 48,
95
- "tags": [],
96
- "created_at": "2021-02-06T22:17:44Z",
97
- "updated_at": "2021-02-06T22:17:44Z",
98
- "revision_number": 0,
99
- "project_id": "2600067ea3a446dba332d20a30ed44fa"
100
- }
101
-
102
- $ ovn-nbctl find acl \
103
- "external_ids:\"neutron:security_group_rule_id\""="de4ea1e4-c946-40ed-b5b6-53c59418dc0b"
104
- _uuid : 791679e9-237d-4732-a31e-aa634496e02b
105
- action : allow-related
106
- direction : from-lport
107
- external_ids : {"neutron:security_group_rule_id"="de4ea1e4-c946-40ed-b5b6-53c59418dc0b"}
108
- log : true
109
- match : "inport == @pg_c604e984_0789_4c9a_a297_3e7f62fa73fd && ip4"
110
- meter : acl_log_meter
111
- name : neutron-2e456c7f-154e-40a8-bb10-f88ba51b90b5
112
- priority : 1002
113
- severity : info
81
+ .. code-block :: none
82
+
83
+ $ openstack network log create --resource-type security_group \
84
+ --resource ${SG} --event ACCEPT logme -f value -c ID
85
+ 2e456c7f-154e-40a8-bb10-f88ba51b90b5
86
+
87
+ $ openstack security group show ${SG} -f json -c rules | jq '.rules | .[2]' | grep -v 'null'
88
+ {
89
+ "id": "de4ea1e4-c946-40ed-b5b6-53c59418dc0b",
90
+ "tenant_id": "2600067ea3a446dba332d20a30ed44fa",
91
+ "security_group_id": "c604e984-0789-4c9a-a297-3e7f62fa73fd",
92
+ "ethertype": "IPv4",
93
+ "direction": "egress",
94
+ "standard_attr_id": 48,
95
+ "tags": [],
96
+ "created_at": "2021-02-06T22:17:44Z",
97
+ "updated_at": "2021-02-06T22:17:44Z",
98
+ "revision_number": 0,
99
+ "project_id": "2600067ea3a446dba332d20a30ed44fa"
100
+ }
101
+
102
+ $ ovn-nbctl find acl \
103
+ "external_ids:\"neutron:security_group_rule_id\""="de4ea1e4-c946-40ed-b5b6-53c59418dc0b"
104
+ _uuid : 791679e9-237d-4732-a31e-aa634496e02b
105
+ action : allow-related
106
+ direction : from-lport
107
+ external_ids : {"neutron:security_group_rule_id"="de4ea1e4-c946-40ed-b5b6-53c59418dc0b"}
108
+ log : true
109
+ match : "inport == @pg_c604e984_0789_4c9a_a297_3e7f62fa73fd && ip4"
110
+ meter : acl_log_meter
111
+ name : neutron-2e456c7f-154e-40a8-bb10-f88ba51b90b5
112
+ priority : 1002
113
+ severity : info
114
114
115
115
The first command creates a networking-log for a given SG. The second shows an SGR from that SG.
116
116
The third shell command is where we can see how the ACL with the meter information gets populated.
@@ -128,14 +128,14 @@ These are the attributes pertinent to network logging:
128
128
If we poked the SGR with packets that match its criteria, the ovn-controller local to where the ACLs
129
129
is enforced will log something that looks like this:
130
130
131
- .. code-block :: none
131
+ .. code-block :: none
132
132
133
- 2021-02-16T11:59:00.640Z|00045|acl_log(ovn_pinctrl0)|INFO|
134
- name="neutron-2e456c7f-154e-40a8-bb10-f88ba51b90b5",
135
- verdict=allow, severity=info: icmp,vlan_tci=0x0000,dl_src=fa:16:3e:24:dc:88,
136
- dl_dst=fa:16:3e:15:6d:e0,
137
- nw_src=10.0.0.12,nw_dst=10.0.0.11,nw_tos=0,nw_ecn=0,nw_ttl=64,icmp_type=8,
138
- icmp_code=0
133
+ 2021-02-16T11:59:00.640Z|00045|acl_log(ovn_pinctrl0)|INFO|
134
+ name="neutron-2e456c7f-154e-40a8-bb10-f88ba51b90b5",
135
+ verdict=allow, severity=info: icmp,vlan_tci=0x0000,dl_src=fa:16:3e:24:dc:88,
136
+ dl_dst=fa:16:3e:15:6d:e0,
137
+ nw_src=10.0.0.12,nw_dst=10.0.0.11,nw_tos=0,nw_ecn=0,nw_ttl=64,icmp_type=8,
138
+ icmp_code=0
139
139
140
140
It is beyond the scope of this document to talk about what happens after the logs are generated
141
141
by ovn-controllers. The harvesting of files across compute nodes is something a project like
0 commit comments