.. This work is licensed under a Creative Commons Attribution 3.0 Unported License. http://creativecommons.org/licenses/by/3.0/legalcode ============================ Tap-as-a-Service for neutron ============================ URL of the launchpad blueprint: https://blueprints.launchpad.net/neutron/+spec/port-mirroring The above mentioned blueprint aims to add port mirroring capabilities in neutron. Port mirroring allows sending a copy of packets ingressing or egressing (or both) one port to another port (usually distinct from the packet’s destination). From the source VM’s perspective, mirrored ingress packets are captured after passing the inbound Security Group filter. Mirrored egress packets are captured before passing the outbound Security Group filter. All captured packets are forwarded to the mirror’s destination port without passing through its inbound filter. The proposed port mirroring capability shall be introduced in neutron as an service called 'Tap-as-a-Service'. Problem description =================== Neutron currently does not support the functionality of port mirroring in tenant networks. This features could be benefit the tenant who would like to debug their virtual networks. This neutron spec proposes to introduce the feature of port mirroring by adding a new service called Tap-as-a-Service. The use-case is to debug network traffic by “tapping” or "mirroring" packets traversing a network element. This neutron spec focuses on mirroring traffic from one VM to another so that it can be useful to both administrators and tenants; future versions may address mirroring from a VM to an arbitrary interface on a compute host or on the network controller, or to the Neutron CLI. Mirroring traffic has many uses, it provides visibility into VM network traffic which can be used for monitoring, debugging and analyzing network traffic ingressing and egressing a VM. (ex. IDS). Different usage scenarios for the service are listed below: 1. Tapping/Mirroring network traffic ingressing, egressing or both from a particular neutron port. 2. Tapping/Mirroring all network traffic on an entire tenant network. Proposed change =============== The proposal is to add a new neutron service 'Tap-as-a-Service' in order to enable the functionality of tapping/mirroring traffic inside tenant networks in neutron. This service will be modeled similar to other services in neutron like the firewall, loadbalancer, l3 router etc. The proposed service would allow the tenants to create a tap service instance to which they can add neutron ports that need to be mirrored by creating tap flows. The tap service itself will be a neutron port, which will be the destination port for the mirrored traffic. The destination Tap-as-a-Service neutron port will be created on a network owned by the tenant who is requesting for the service. The ports to be mirrored that are added to the service can belong to any network owned by the tenant. This allow the tenant to mirror traffic from port(s) belonging to any networks that they own on to the same Tap-as-a-Serivce nuetron port. In the first version of this service, the tenants can launch a VM on the neutron port that was created by instantiating the tap service to capture or analyze the mirrored traffic. The following would be the work flow for using this service from a tenants point of view 1. Create an instance of the tap service (creation of the service return back with a neutron port UUID). 2. Launch a monitoring or traffic analysis VM on the port returned by the tap service while creating the service. 3. Create a tap flow by associating a neutron port that needs to be mirrored with an already created tap service instance. Alternatives ------------ As an alternative to introducing port mirroring functionality under neutron services, it could be added as an extension to the existing neutron v2 APIs. Data model impact ----------------- Tap-as-a-Service introduces the following data models into neutron as database schemas. 1. TapService +-----------+--------+----------+-----------+---------------+-------------------------+ | Attribute | Type | Access | Default | Validation/ | Description | | Name | | (CRUD) | Value | Conversion | | +===========+========+==========+===========+===============+=========================+ | id | UUID | CR, all | generated | N/A | UUID of the tap | | | | | | | service inst. | +-----------+--------+----------+-----------+---------------+-------------------------+ | tenant_id | UUID | CR, all | N/A | UUID of a | UUID of the | | | | | | valid | tenant creating | | | | | | tenant | the service | +-----------+--------+----------+-----------+---------------+-------------------------+ | port_id | UUID + R, all | N/A | UUID of a | A neutron port | | | | | | valid neutron | is created by the | | | | | | port | service for destination | | | | | | | of mirrored traffic | +-----------+--------+----------+-----------+---------------+-------------------------+ 2. TapFlow +-------------+--------+----------+-----------+---------------+-------------------------+ | Attribute | Type | Access | Default | Validation/ | Description | | Name | | (CRUD) | Value | Conversion | | +=============+========+==========+===========+===============+=========================+ | id | UUID | CR, all | generated | N/A | UUID of the | | | | | | | TapFlow instance. | +-------------+--------+----------+-----------+---------------+-------------------------+ | tap_id | UUID | CR, all | N/A | Valid tap | UUID of the tap | | | | | | service UUID | service instance. | +-------------+--------+----------+-----------+---------------+-------------------------+ | source_port | UUID | CR, all | N/A | UUID of a | UUID of the neutron | | | | | | valid neutron | port that needed to be | | | | | | port | mirrored | +-------------+--------+----------+-----------+---------------+-------------------------+ | direction | ENUM | CRU, all | BOTH | | Whether to mirror the | | | (IN, | | | | traffic leaving or | | | OUT, | | | | arriving at the | | | BOTH) | | | | source port | +-------------+--------+----------+-----------+---------------+-------------------------+ REST API impact --------------- The Tap-as-a-Serivice shall be offered over the RESTFull API interface under the following namespace: http://wiki.openstack.org/Neutron/TaaS/API_1.0 The resource attribute map for the TaaS is provided below: .. code-block:: python direction_enum = [None, 'IN', 'OUT', 'BI'] RESOURCE_ATTRIBUTE_MAP = { TapService: { 'id': {'allow_post': False, 'allow_put': False, 'validate': {'type:uuid': None}, 'is_visible': True, 'primary_key': True}, 'tenant_id': {'allow_post': True, 'allow_put': False, 'validate': {'type:string': None}, 'required_by_policy': True, 'is_visible': True}, 'port_id': {'allow_post': False, 'allow_put': False, 'validate': {'type:uuid': None}, 'is_visible': True}, }, TapFlow: { 'id': {'allow_post': False, 'allow_put': False, 'validate': {'type:uuid': None}, 'is_visible': True, 'primary_key': True}, 'tap_id': {'allow_post': True, 'allow_put': False, 'validate': {'type:string': None}, 'required_by_policy': True, 'is_visible': True}, 'source_port': {'allow_post': True, 'allow_put': False, 'validate': {'type:uuid': None}, 'required_by_policy': True, 'is_visible': True}, 'direction': {'allow_post': True, 'allow_put': False, 'validate': {'type:string': direction_enum}, 'is_visible': True}, } } Security impact --------------- The port(s) on which the TaaS runs should be able to forward mirrored packets to the VM attached to it without filtering it out. The mirrored traffic usually is destined to a VM that is not the same as the VM attached on the port that belongs to TaaS (mirror destination port). Notifications impact -------------------- None Other end user impact --------------------- None Performance Impact ------------------ None Other deployer impact --------------------- None Developer impact ---------------- This will be a new API, and will not affect existing API. Implementation ============== The reference implementation for this service will be based on the OVS driver. The implementation will leverage the port mirroring feature in OVS to accomplish this. To transfer mirrored data across OVS switches in different physical server, an out of band GRE tunnel will be used. Assignee(s) ----------- Vinay Yadhav Work Items ---------- * TaaS API and data model implementation. * TaaS OVS driver. * OVS agent changes for port mirroring. Dependencies ============ None Testing ======= * Unit Tests to be added. * API Tests in Tempest to be added. * Functional tests in tempest to be added. Documentation Impact ==================== Both, API and, Admin guide will be updated. References ==========